5.10.121-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 146/452 drbd: fix duplicate array initializer
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 33cb0917bbe241dd17a2b87ead63514c1b7e5615 ]
There are two initializers for P_RETRY_WRITE:
drivers/block/drbd/drbd_main.c:3676:22: warning: initialized field overwritten [-Woverride-init]
Remove the first one since it was already ignored by the compiler and reorder the list to match the enum definition. As P_ZEROES had no entry, add that one instead.
--- drivers/block/drbd/drbd_main.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/block/drbd/drbd_main.c +6 -5
@@ -3631,9 +3631,8 @@ const char *cmdname(enum drbd_packet cmd)* when we want to support more than * one PRO_VERSION */ static const char *cmdnames[] = { + [P_DATA ] ="Data" , - [P_WSAME ] ="WriteSame" , - [P_TRIM ] ="Trim" , [P_DATA_REPLY ] ="DataReply" , [P_RS_DATA_REPLY ] ="RSDataReply" , [P_BARRIER ] ="Barrier" ,
@@ -3644,7 +3643,6 @@ const char *cmdname(enum drbd_packet cmd) [P_DATA_REQUEST] = "DataRequest", [P_RS_DATA_REQUEST] = "RSDataRequest", [P_SYNC_PARAM] = "SyncParam", - [P_SYNC_PARAM89] = "SyncParam89", [P_PROTOCOL] = "ReportProtocol", [P_UUIDS] = "ReportUUIDs", [P_SIZES] = "ReportSizes",
@@ -3652,6 +3650,7 @@ const char *cmdname(enum drbd_packet cmd) [P_SYNC_UUID] = "ReportSyncUUID", [P_AUTH_CHALLENGE] = "AuthChallenge", [P_AUTH_RESPONSE] = "AuthResponse", + [P_STATE_CHG_REQ] = "StateChgRequest", [P_PING] = "Ping", [P_PING_ACK] = "PingAck", [P_RECV_ACK] = "RecvAck",
@@ -3662,24 +3661,26 @@ const char *cmdname(enum drbd_packet cmd) [P_NEG_DREPLY] = "NegDReply", [P_NEG_RS_DREPLY] = "NegRSDReply", [P_BARRIER_ACK] = "BarrierAck", - [P_STATE_CHG_REQ] = "StateChgRequest", [P_STATE_CHG_REPLY] = "StateChgReply", [P_OV_REQUEST] = "OVRequest", [P_OV_REPLY] = "OVReply", [P_OV_RESULT] = "OVResult", [P_CSUM_RS_REQUEST] = "CsumRSRequest", [P_RS_IS_IN_SYNC] = "CsumRSIsInSync", + [P_SYNC_PARAM89] = "SyncParam89", [P_COMPRESSED_BITMAP] = "CBitmap", [P_DELAY_PROBE] = "DelayProbe", [P_OUT_OF_SYNC] = "OutOfSync", - [P_RETRY_WRITE] = "RetryWrite", [P_RS_CANCEL] = "RSCancel", [P_CONN_ST_CHG_REQ] = "conn_st_chg_req", [P_CONN_ST_CHG_REPLY] = "conn_st_chg_reply", [P_RETRY_WRITE] = "retry_write", [P_PROTOCOL_UPDATE] = "protocol_update", + [P_TRIM] = "Trim", [P_RS_THIN_REQ] = "rs_thin_req", [P_RS_DEALLOCATED] = "rs_deallocated", + [P_WSAME] = "WriteSame", + [P_ZEROES] = "Zeroes",/* enum drbd_packet, but not commands - obsoleted flags: * P_MAY_IGNORE
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 147/452 EDAC/dmc520: Dont print an error for each unconfigured interrupt line
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
[ Upstream commit ad2df24732e8956a45a00894d2163c4ee8fb0e1f ]
The dmc520 driver requires that at least one interrupt line, out of the ten possible, is configured. The driver prints an error and returns -EINVAL from its .probe function if there are no interrupt lines configured.
Don't print a KERN_ERR level message for each interrupt line that's unconfigured as that can confuse users into thinking that there is an error condition.
Before this change, the following KERN_ERR level messages would be reported if only dram_ecc_errc and dram_ecc_errd were configured in the device tree:
dmc520 68000000.dmc: IRQ ram_ecc_errc not found dmc520 68000000.dmc: IRQ ram_ecc_errd not found dmc520 68000000.dmc: IRQ failed_access not found dmc520 68000000.dmc: IRQ failed_prog not found dmc520 68000000.dmc: IRQ link_err not dmc520 68000000.dmc: IRQ temperature_event not found dmc520 68000000.dmc: IRQ arch_fsm not found dmc520 68000000.dmc: IRQ phy_request not found
--- drivers/edac/dmc520_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/edac/dmc520_edac.c +1 -1
@@ -489,7 +489,7 @@ static int dmc520_edac_probe(struct platform_device *pdev) dev = &pdev->dev;for (idx =0 ; idx <NUMBER_OF_IRQS ; idx++) { - irq =platform_get_irq_byname (pdev, dmc520_irq_configs[idx].name); + irq =platform_get_irq_byname_optional (pdev, dmc520_irq_configs[idx].name); irqs[idx] = irq; masks[idx] = dmc520_irq_configs[idx].mask;if (irq >=0 ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 148/452 mtd: rawnand: denali: Use managed device resources
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 3a745b51cddafade99aaea1b93aad31e9614e230 ]
All of the resources used by this driver has managed interfaces, so use them. Otherwise we will get the following splat:
[ 4.472703] denali-nand-pci 0000:00:05.0: timeout while waiting for irq 0x1000 [ 4.474071] denali-nand-pci: probe of 0000:00:05.0 failed with error -5 [ 4.473538] nand: No NAND device found [ 4.474068] BUG: unable to handle page fault for address: ffffc90005000410 [ 4.475169] #PF: supervisor write access in kernel mode [ 4.475579] #PF: error_code(0x0002) - not-present page [ 4.478362] RIP: 0010:iowrite32+0x9/0x50 [ 4.486068] Call Trace: [ 4.486269] <IRQ> [ 4.486443] denali_isr+0x15b/0x300 [denali] [ 4.486788] ? denali_direct_write+0x50/0x50 [denali] [ 4.487189] __handle_irq_event_percpu+0x161/0x3b0 [ 4.487571] handle_irq_event+0x7d/0x1b0 [ 4.487884] handle_fasteoi_irq+0x2b0/0x770 [ 4.488219] __common_interrupt+0xc8/0x1b0 [ 4.488549] common_interrupt+0x9a/0xc0
--- drivers/mtd/nand/raw/denali_pci.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
drivers/mtd/nand/raw/denali_pci.c +4 -11
@@ -74,22 +74,21 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)return ret; } - denali->reg =ioremap (csr_base, csr_len); + denali->reg =devm_ioremap (denali->dev, csr_base, csr_len);if (!denali->reg) {dev_err (&dev->dev,"Spectra: Unable to remap memory region\n" );return -ENOMEM ; } - denali->host =ioremap (mem_base, mem_len); + denali->host =devm_ioremap (denali->dev, mem_base, mem_len);if (!denali->host) {dev_err (&dev->dev,"Spectra: ioremap failed!" ); - ret = -ENOMEM ; - goto out_unmap_reg; +return -ENOMEM ; } ret =denali_init (denali);if (ret) - goto out_unmap_host; +return ret; nsels = denali->nbanks;
@@ -117,10 +116,6 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) out_remove_denali:denali_remove (denali); -out_unmap_host: -iounmap (denali->host); -out_unmap_reg: -iounmap (denali->reg);return ret; }
@@ -129,8 +124,6 @@ static void denali_pci_remove(struct pci_dev *dev)struct denali_controller *denali =pci_get_drvdata (dev);denali_remove (denali); -iounmap (denali->reg); -iounmap (denali->host); }static struct pci_driver denali_pci_driver = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 149/452 HID: hid-led: fix maximum brightness for Dream Cheeky
In reply to Greg Kroah-HartmanFrom: Jonathan Teh <[email protected]>
[ Upstream commit 116c3f4a78ebe478d5ad5a038baf931e93e7d748 ]
Increase maximum brightness for Dream Cheeky to 63. Emperically determined based on testing in kernel 4.4 on this device:
Bus 003 Device 002: ID 1d34:0004 Dream Cheeky Webmail Notifier
--- drivers/hid/hid-led.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-led.c +1 -1
@@ -366,7 +366,7 @@ static const struct hidled_config hidled_configs[] = { .type = DREAM_CHEEKY, .name = "Dream Cheeky Webmail Notifier", .short_name = "dream_cheeky", - .max_brightness = 31, + .max_brightness = 63, .num_leds = 1, .report_size = 9, .report_type = RAW_REQUEST,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 150/452 HID: elan: Fix potential double free in elan_input_configured
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 1af20714fedad238362571620be0bd690ded05b6 ]
'input' is a managed resource allocated with devm_input_allocate_device(), so there is no need to call input_free_device() explicitly or there will be a double free.
According to the doc of devm_input_allocate_device():
* Managed input devices do not need to be explicitly unregistered or
* freed as it will be done automatically when owner device unbinds from
* its driver (or binding fails).
--- drivers/hid/hid-elan.c | 2 -- 1 file changed, 2 deletions(-)
drivers/hid/hid-elan.c +0 -2
@@ -188,7 +188,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi) ret =input_mt_init_slots (input,ELAN_MAX_FINGERS ,INPUT_MT_POINTER );if (ret) {hid_err (hdev,"Failed to init elan MT slots: %d\n" , ret); -input_free_device (input);return ret; }
@@ -200,7 +199,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)hid_err (hdev,"Failed to register elan input device: %d\n" , ret);input_mt_destroy_slots (input); -input_free_device (input);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 151/452 drm/bridge: Fix error handling in analogix_dp_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9f15930bb2ef9f031d62ffc49629cbae89137733 ]
In the error handling path, the clk_prepare_enable() function call should be balanced by a corresponding 'clk_disable_unprepare()' call, as already done in the remove function.
--- .../gpu/drm/bridge/analogix/analogix_dp_core.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +13 -5
@@ -1705,8 +1705,10 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); dp->reg_base =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (dp->reg_base)) -return ERR_CAST (dp->reg_base); +if (IS_ERR (dp->reg_base)) { + ret =PTR_ERR (dp->reg_base); + goto err_disable_clk; + } dp->force_hpd =of_property_read_bool (dev->of_node,"force-hpd" );
@@ -1718,7 +1720,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)if (IS_ERR (dp->hpd_gpiod)) {dev_err (dev,"error getting HDP GPIO: %ld\n" ,PTR_ERR (dp->hpd_gpiod)); -return ERR_CAST (dp->hpd_gpiod); + ret =PTR_ERR (dp->hpd_gpiod); + goto err_disable_clk; }if (dp->hpd_gpiod) {
@@ -1738,7 +1741,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)if (dp->irq == -ENXIO ) {dev_err (&pdev->dev,"failed to get irq\n" ); -return ERR_PTR (-ENODEV ); + ret = -ENODEV ; + goto err_disable_clk; } ret = devm_request_threaded_irq(&pdev->dev, dp->irq,
@@ -1747,11 +1751,15 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) irq_flags, "analogix-dp", dp);if (ret) {dev_err (&pdev->dev,"failed to request irq\n" ); -return ERR_PTR (ret); + goto err_disable_clk; }disable_irq (dp->irq);return dp; + +err_disable_clk: +clk_disable_unprepare (dp->clock); +return ERR_PTR (ret); }EXPORT_SYMBOL_GPL (analogix_dp_probe);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 152/452 sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq
In reply to Greg Kroah-HartmanFrom: Chengming Zhou <[email protected]>
[ Upstream commit 64eaf50731ac0a8c76ce2fedd50ef6652aabc5ff ]
Since commit 23127296889f ("sched/fair: Update scale invariance of PELT") change to use rq_clock_pelt() instead of rq_clock_task(), we should also use rq_clock_pelt() for throttled_clock_task_time and throttled_clock_task accounting to get correct cfs_rq_clock_pelt() of throttled cfs_rq. And rename throttled_clock_task(_time) to be clock_pelt rather than clock_task.
--- kernel/sched/fair.c | 8 ++++---- kernel/sched/pelt.h | 4 ++-- kernel/sched/sched.h | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-)
kernel/sched/fair.c +4 -4
@@ -4758,8 +4758,8 @@ static int tg_unthrottle_up(struct task_group *tg, void *data) cfs_rq->throttle_count--;if (!cfs_rq->throttle_count) { - cfs_rq->throttled_clock_task_time +=rq_clock_task (rq) - - cfs_rq->throttled_clock_task; + cfs_rq->throttled_clock_pelt_time +=rq_clock_pelt (rq) - + cfs_rq->throttled_clock_pelt;/* Add cfs_rq with already running entity in the list */ if (cfs_rq->nr_running >=1 )
@@ -4776,7 +4776,7 @@ static int tg_throttle_down(struct task_group *tg, void *data)/* group is entering throttled state, stop time */ if (!cfs_rq->throttle_count) { - cfs_rq->throttled_clock_task =rq_clock_task (rq); + cfs_rq->throttled_clock_pelt =rq_clock_pelt (rq);list_del_leaf_cfs_rq (cfs_rq); } cfs_rq->throttle_count++;
@@ -5194,7 +5194,7 @@ static void sync_throttle(struct task_group *tg, int cpu) pcfs_rq = tg->parent->cfs_rq[cpu]; cfs_rq->throttle_count = pcfs_rq->throttle_count; - cfs_rq->throttled_clock_task =rq_clock_task (cpu_rq (cpu)); + cfs_rq->throttled_clock_pelt =rq_clock_pelt (cpu_rq (cpu)); }/* conditionally throttle active cfs_rq's from put_prev_entity() */
kernel/sched/pelt.h +2 -2
@@ -145,9 +145,9 @@ static inline u64 rq_clock_pelt(struct rq *rq)static inline u64 cfs_rq_clock_pelt (struct cfs_rq *cfs_rq) {if (unlikely (cfs_rq->throttle_count)) -return cfs_rq->throttled_clock_task - cfs_rq->throttled_clock_task_time; +return cfs_rq->throttled_clock_pelt - cfs_rq->throttled_clock_pelt_time; -return rq_clock_pelt (rq_of (cfs_rq)) - cfs_rq->throttled_clock_task_time; +return rq_clock_pelt (rq_of (cfs_rq)) - cfs_rq->throttled_clock_pelt_time; }#else static inline u64 cfs_rq_clock_pelt (struct cfs_rq *cfs_rq)
kernel/sched/sched.h +2 -2
@@ -599,8 +599,8 @@ struct cfs_rq {s64 runtime_remaining;u64 throttled_clock; -u64 throttled_clock_task; -u64 throttled_clock_task_time; +u64 throttled_clock_pelt; +u64 throttled_clock_pelt_time;int throttled;int throttle_count;struct list_head throttled_list;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 153/452 spi: img-spfi: Fix pm_runtime_get_sync() error checking
In reply to Greg Kroah-HartmanFrom: Zheng Yongjun <[email protected]>
[ Upstream commit cc470d55343056d6b2a5c32e10e0aad06f324078 ]
If the device is already in a runtime PM enabled state pm_runtime_get_sync() will return 1, so a test for negative value should be used to check for errors.
--- drivers/spi/spi-img-spfi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-img-spfi.c +1 -1
@@ -731,7 +731,7 @@ static int img_spfi_resume(struct device *dev)int ret; ret =pm_runtime_get_sync (dev); -if (ret) { +if (ret <0 ) {pm_runtime_put_noidle (dev);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 154/452 cpufreq: Fix possible race in cpufreq online error path
In reply to Greg Kroah-HartmanFrom: Schspa Shi <[email protected]>
[ Upstream commit f346e96267cd76175d6c201b40f770c0116a8a04 ]
When cpufreq online fails, the policy->cpus mask is not cleared and policy->rwsem is released too early, so the driver can be invoked via the cpuinfo_cur_freq sysfs attribute while its ->offline() or ->exit() callbacks are being run.
Take policy->clk as an example:
static int cpufreq_online(unsigned int cpu)
{
...
// policy->cpus != 0 at this time
down_write(&policy->rwsem);
ret = cpufreq_add_dev_interface(policy);
up_write(&policy->rwsem);
return 0;
out_destroy_policy:
for_each_cpu(j, policy->real_cpus)
remove_cpu_dev_symlink(policy, get_cpu_device(j));
up_write(&policy->rwsem);
...
out_exit_policy:
if (cpufreq_driver->exit)
cpufreq_driver->exit(policy);
clk_put(policy->clk);
// policy->clk is a wild pointer
...
^
|
Another process access
__cpufreq_get
cpufreq_verify_current_freq
cpufreq_generic_get
// acces wild pointer of policy->clk;
|
|
out_offline_policy: |
cpufreq_policy_free(policy); |
// deleted here, and will wait for no body reference
cpufreq_policy_put_kobj(policy);
}Address this by modifying cpufreq_online() to release policy->rwsem in the error path after the driver callbacks have run and to clear policy->cpus before releasing the semaphore.
--- drivers/cpufreq/cpufreq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/cpufreq/cpufreq.c +3 -2
@@ -1515,8 +1515,6 @@ static int cpufreq_online(unsigned int cpu)for_each_cpu (j, policy->real_cpus)remove_cpu_dev_symlink (policy,get_cpu_device (j)); -up_write (&policy->rwsem); - out_offline_policy:if (cpufreq_driver->offline) cpufreq_driver->offline (policy);
@@ -1525,6 +1523,9 @@ static int cpufreq_online(unsigned int cpu)if (cpufreq_driver->exit) cpufreq_driver->exit (policy); +cpumask_clear (policy->cpus); +up_write (&policy->rwsem); + out_free_policy:cpufreq_policy_free (policy);return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 155/452 ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 2dc509305cf956381532792cb8dceef2b1504765 ]
The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to ensure that it is within the bitmap.
drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept()
error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()'
--- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +8 -0
@@ -1006,6 +1006,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, goto rx_next; } +if (rxstatus->rs_keyix >=ATH_KEYMAX && + rxstatus->rs_keyix !=ATH9K_RXKEYIX_INVALID ) { +ath_dbg (common,ANY , +"Invalid keyix, dropping (keyix: %d)\n" , + rxstatus->rs_keyix); + goto rx_next; + } +/* Get the RX status information */ memset (rx_status,0 ,sizeof (struct ieee80211_rx_status ));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 156/452 media: hantro: Empty encoder capture buffers by default
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit 309373a3571ef7175bd9da0c9b13476a718e8478 ]
The payload size for encoder capture buffers is set by the driver upon finishing encoding each frame, based on the encoded length returned from hardware, and whatever header and padding length used. Setting a non-zero default serves no real purpose, and also causes issues if the capture buffer is returned to userspace unused, confusing the application.
Instead, always set the payload size to 0 for encoder capture buffers when preparing them.
--- drivers/staging/media/hantro/hantro_v4l2.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/staging/media/hantro/hantro_v4l2.c +6 -2
@@ -644,8 +644,12 @@ static int hantro_buf_prepare(struct vb2_buffer *vb)* (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets * it to buffer length). */ -if (V4L2_TYPE_IS_CAPTURE (vq->type)) -vb2_set_plane_payload (vb,0 , pix_fmt->plane_fmt[0 ].sizeimage); +if (V4L2_TYPE_IS_CAPTURE (vq->type)) { +if (ctx->is_encoder) +vb2_set_plane_payload (vb,0 ,0 ); +else +vb2_set_plane_payload (vb,0 , pix_fmt->plane_fmt[0 ].sizeimage); + }return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 157/452 drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 0f73a559f916b618c0c05186bd644c90cc9e9695 ]
The DE signal is active high on this display, fill in the missing bus_flags. This aligns panel_desc with its display_timing .
--- drivers/gpu/drm/panel/panel-simple.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/panel/panel-simple.c +1 -0
@@ -2144,6 +2144,7 @@ static const struct panel_desc innolux_g070y2_l01 = { .unprepare = 800, }, .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG, + .bus_flags = DRM_BUS_FLAG_DE_HIGH, .connector_type = DRM_MODE_CONNECTOR_LVDS, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 158/452 ALSA: pcm: Check for null pointer of pointer substream before dereferencing it
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 011b559be832194f992f73d6c0d5485f5925a10b ]
Pointer substream is being dereferenced on the assignment of pointer card before substream is being null checked with the macro PCM_RUNTIME_CHECK. Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the the pointer check before card is assigned.
--- sound/core/pcm_memory.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/core/pcm_memory.c +2 -1
@@ -434,7 +434,6 @@ EXPORT_SYMBOL(snd_pcm_lib_malloc_pages);*/ int snd_pcm_lib_free_pages (struct snd_pcm_substream *substream) { -struct snd_card *card = substream->pcm->card;struct snd_pcm_runtime *runtime;if (PCM_RUNTIME_CHECK (substream))
@@ -443,6 +442,8 @@ int snd_pcm_lib_free_pages(struct snd_pcm_substream *substream)if (runtime->dma_area ==NULL )return 0 ;if (runtime->dma_buffer_p != &substream->dma_buffer) { +struct snd_card *card = substream->pcm->card; +/* it's a newly allocated buffer. release it now. */ do_free_pages (card, runtime->dma_buffer_p);kfree (runtime->dma_buffer_p);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 159/452 inotify: show inotify mask flags in proc fdinfo
In reply to Greg Kroah-HartmanFrom: Amir Goldstein <[email protected]>
[ Upstream commit a32e697cda27679a0327ae2cafdad8c7170f548f ]
The inotify mask flags IN_ONESHOT and IN_EXCL_UNLINK are not "internal to kernel" and should be exposed in procfs fdinfo so CRIU can restore them.
--- fs/notify/fdinfo.c | 11 ++--------- fs/notify/inotify/inotify.h | 12 ++++++++++++ fs/notify/inotify/inotify_user.c | 2 +- 3 files changed, 15 insertions(+), 10 deletions(-)
fs/notify/fdinfo.c +2 -9
@@ -83,16 +83,9 @@ static void inotify_fdinfo(struct seq_file *m, struct fsnotify_mark *mark) inode_mark = container_of(mark, struct inotify_inode_mark, fsn_mark); inode =igrab (fsnotify_conn_inode (mark->connector));if (inode) { -/* -* IN_ALL_EVENTS represents all of the mask bits -* that we expose to userspace. There is at -* least one bit (FS_EVENT_ON_CHILD) which is -* used only internally to the kernel. -*/ -u32 mask = mark->mask &IN_ALL_EVENTS ; -seq_printf (m,"inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:%x " , +seq_printf (m,"inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:0 " , inode_mark->wd, inode->i_ino, inode->i_sb->s_dev, - mask, mark->ignored_mask); +inotify_mark_user_mask (mark));show_mark_fhandle (m, inode);seq_putc (m,'\n' );iput (inode);
fs/notify/inotify/inotify.h +12 -0
@@ -22,6 +22,18 @@ static inline struct inotify_event_info *INOTIFY_E(struct fsnotify_event *fse) return container_of(fse, struct inotify_event_info, fse); } +/* +* INOTIFY_USER_FLAGS represents all of the mask bits that we expose to +* userspace. There is at least one bit (FS_EVENT_ON_CHILD) which is +* used only internally to the kernel. +*/ +#define INOTIFY_USER_MASK (IN_ALL_EVENTS | IN_ONESHOT | IN_EXCL_UNLINK) + +static inline __u32 inotify_mark_user_mask (struct fsnotify_mark *fsn_mark) +{ +return fsn_mark->mask &INOTIFY_USER_MASK ; +} +extern void inotify_ignored_and_remove_idr (struct fsnotify_mark *fsn_mark,struct fsnotify_group *group); extern int inotify_handle_inode_event(struct fsnotify_mark *inode_mark,
fs/notify/inotify/inotify_user.c +1 -1
@@ -88,7 +88,7 @@ static inline __u32 inotify_arg_to_mask(struct inode *inode, u32 arg) mask |=FS_EVENT_ON_CHILD ;/* mask off the flags used to open the fd */ - mask |= (arg & (IN_ALL_EVENTS |IN_ONESHOT |IN_EXCL_UNLINK )); + mask |= (arg &INOTIFY_USER_MASK );return mask; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 160/452 fsnotify: fix wrong lockdep annotations
In reply to Greg Kroah-HartmanFrom: Amir Goldstein <[email protected]>
[ Upstream commit 623af4f538b5df9b416e1b82f720af7371b4c771 ]
Commit 6960b0d909cd ("fsnotify: change locking order") changed some of the mark_mutex locks in direct reclaim path to use:
mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
This change is explained:
"...It uses nested locking to avoid deadlock in case we do the final
iput() on an inode which still holds marks and thus would take the mutex again when calling fsnotify_inode_delete() in destroy_inode()."
The problem is that the mutex_lock_nested() is not a nested lock at all. In fact, it has the opposite effect of preventing lockdep from warning about a very possible deadlock.
Due to these wrong annotations, a deadlock that was introduced with nfsd filecache in kernel v5.4 went unnoticed in v5.4.y for over two years until it was reported recently by Khazhismel Kumykov, only to find out that the deadlock was already fixed in kernel v5.5.
Fix the wrong lockdep annotations.
--- fs/notify/mark.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/notify/mark.c +3 -3
@@ -430,7 +430,7 @@ void fsnotify_free_mark(struct fsnotify_mark *mark)void fsnotify_destroy_mark (struct fsnotify_mark *mark,struct fsnotify_group *group) { -mutex_lock_nested (&group->mark_mutex,SINGLE_DEPTH_NESTING ); +mutex_lock (&group->mark_mutex);fsnotify_detach_mark (mark);mutex_unlock (&group->mark_mutex);fsnotify_free_mark (mark);
@@ -742,7 +742,7 @@ void fsnotify_clear_marks_by_group(struct fsnotify_group *group,* move marks to free to to_free list in one go and then free marks in * to_free list one by one. */ -mutex_lock_nested (&group->mark_mutex,SINGLE_DEPTH_NESTING ); +mutex_lock (&group->mark_mutex);list_for_each_entry_safe (mark, lmark, &group->marks_list, g_list) {if ((1U << mark->connector->type) & type_mask)list_move (&mark->g_list, &to_free);
@@ -751,7 +751,7 @@ void fsnotify_clear_marks_by_group(struct fsnotify_group *group, clear:while (1 ) { -mutex_lock_nested (&group->mark_mutex,SINGLE_DEPTH_NESTING ); +mutex_lock (&group->mark_mutex);if (list_empty (head)) {mutex_unlock (&group->mark_mutex);break ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 161/452 of: overlay: do not break notify on NOTIFY_{OK|STOP}
In reply to Greg Kroah-HartmanFrom: Nuno Sá <[email protected]>
[ Upstream commit 5f756a2eaa4436d7d3dc1e040147f5e992ae34b5 ]
We should not break overlay notifications on NOTIFY_{OK|STOP} otherwise we might break on the first fragment. We should only stop notifications if a *real* errno is returned by one of the listeners.
--- drivers/of/overlay.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/of/overlay.c +1 -3
@@ -170,9 +170,7 @@ static int overlay_notify(struct overlay_changeset *ovcs, ret =blocking_notifier_call_chain (&overlay_notify_chain, action, &nd); -if (ret ==NOTIFY_OK || ret ==NOTIFY_STOP ) -return 0 ; -if (ret) { +if (notifier_to_errno (ret)) { ret =notifier_to_errno (ret);pr_err ("overlay changeset %s notifier error %d, target: %pOF\n" , of_overlay_action_name[action], ret, nd.target);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 162/452 drm/msm/dpu: adjust display_v_end for eDP and DP
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit e18aeea7f5efb9508722c8c7fd4d32e6f8cdfe50 ]
The “DP timing” requires the active region to be defined in the bottom-right corner of the frame dimensions which is different with DSI. Therefore both display_h_end and display_v_end need to be adjusted accordingly. However current implementation has only display_h_end adjusted.
Patchwork: https://patchwork.freedesktop.org/patch/476277/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c +1 -0
@@ -146,6 +146,7 @@ static void dpu_hw_intf_setup_timing_engine(struct dpu_hw_intf *ctx, active_v_end = active_v_start + (p->yres * hsync_period) -1 ; display_v_start += p->hsync_pulse_width + p->h_back_porch; + display_v_end -= p->h_front_porch; active_hctl = (active_h_end <<16 ) | active_h_start; display_hctl = active_hctl;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 163/452 scsi: ufs: qcom: Fix ufs_qcom_resume()
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit bee40dc167da159ea5b939c074e1da258610a3d6 ]
Clearing hba->is_sys_suspended if ufs_qcom_resume() succeeds is wrong. That variable must only be cleared if all actions involved in a resume succeed. Hence remove the statement that clears hba->is_sys_suspended from ufs_qcom_resume().
--- drivers/scsi/ufs/ufs-qcom.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/scsi/ufs/ufs-qcom.c +1 -6
@@ -623,12 +623,7 @@ static int ufs_qcom_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)return err; } - err =ufs_qcom_ice_resume (host); -if (err) -return err; - - hba->is_sys_suspended = false; -return 0 ; +return ufs_qcom_ice_resume (host); }static void ufs_qcom_dev_ref_clk_ctrl (struct ufs_qcom_host *host,bool enable)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 164/452 scsi: ufs: core: Exclude UECxx from SFR dump list
In reply to Greg Kroah-HartmanFrom: Kiwoong Kim <[email protected]>
[ Upstream commit ef60031022eb6d972aac86ca26c98c33e1289436 ]
Some devices may return invalid or zeroed data during an UIC error condition. In addition, reading these SFRs will clear them. This means the subsequent error handling will not be able to see them and therefore no error handling will be scheduled.
Skip reading these SFRs in ufshcd_dump_regs().
--- drivers/scsi/ufs/ufshcd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd.c +6 -1
@@ -107,8 +107,13 @@ int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len,if (!regs)return -ENOMEM ; -for (pos =0 ; pos < len; pos +=4 ) +for (pos =0 ; pos < len; pos +=4 ) { +if (offset ==0 && + pos >=REG_UIC_ERROR_CODE_PHY_ADAPTER_LAYER && + pos <=REG_UIC_ERROR_CODE_DME ) +continue ; regs[pos /4 ] =ufshcd_readl (hba, offset + pos); + }ufshcd_hex_dump (prefix, regs, len);kfree (regs);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 165/452 selftests/resctrl: Fix null pointer dereference on open failed
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit c7b607fa9325ccc94982774c505176677117689c ]
Currently if opening /dev/null fails to open then file pointer fp is null and further access to fp via fprintf will cause a null pointer dereference. Fix this by returning a negative error value when a null fp is detected.
Detected using cppcheck static analysis:tools/testing/selftests/resctrl/fill_buf.c:124:6: note: Assuming that condition '!fp' is not redundant
if (!fp)
^
tools/testing/selftests/resctrl/fill_buf.c:126:10: note: Null pointer dereference
fprintf(fp, "Sum: %d ", ret);
--- tools/testing/selftests/resctrl/fill_buf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/testing/selftests/resctrl/fill_buf.c +3 -1
@@ -121,8 +121,10 @@ static int fill_cache_read(unsigned char *start_ptr, unsigned char *end_ptr,/* Consume read result so that reading memory is not optimized out. */ fp =fopen ("/dev/null" ,"w" ); -if (!fp) +if (!fp) {perror ("Unable to write to /dev/null" ); +return -1 ; + }fprintf (fp,"Sum: %d " , ret);fclose (fp);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 166/452 libbpf: Fix logic for finding matching program for CO-RE relocation
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 966a7509325395c51c5f6d89e7352b0585e4804b ]
Fix the bug in bpf_object__relocate_core() which can lead to finding invalid matching BPF program when processing CO-RE relocation. IF matching program is not found, last encountered program will be assumed to be correct program and thus error detection won't detect the problem.
--- tools/lib/bpf/libbpf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/lib/bpf/libbpf.c +3 -2
@@ -5928,9 +5928,10 @@ bpf_object__relocate_core(struct bpf_object *obj, const char *targ_btf_path)*/ prog =NULL ;for (i =0 ; i < obj->nr_programs; i++) { - prog = &obj->programs[i]; -if (strcmp (prog->sec_name, sec_name) ==0 ) +if (strcmp (obj->programs[i].sec_name, sec_name) ==0 ) { + prog = &obj->programs[i];break ; + } }if (!prog) {pr_warn ("sec '%s': failed to find a BPF program\n" , sec_name);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 167/452 mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check()
In reply to Greg Kroah-HartmanFrom: Chen-Tsung Hsieh <[email protected]>
[ Upstream commit 70dd83d737d8900b2d98db6dc6b928c596334d37 ]
Read back Status Register 1 to ensure that the written byte match the received value and return -EIO if read back test failed.
Without this patch, spi_nor_write_16bit_sr_and_check() only check the second half of the 16bit. It causes errors like spi_nor_sr_unlock() return success incorrectly when spi_nor_write_16bit_sr_and_check() doesn't write SR successfully.
--- drivers/mtd/spi-nor/core.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/mtd/spi-nor/core.c +9 -0
@@ -827,6 +827,15 @@ static int spi_nor_write_16bit_sr_and_check(struct spi_nor *nor, u8 sr1)if (ret)return ret; + ret =spi_nor_read_sr (nor, sr_cr); +if (ret) +return ret; + +if (sr1 != sr_cr[0 ]) { +dev_dbg (nor->dev,"SR: Read back test failed\n" ); +return -EIO ; + } +if (nor->flags &SNOR_F_NO_READ_CR )return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 168/452 x86/pm: Fix false positive kmemleak report in msr_build_context()
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
[ Upstream commit b0b592cf08367719e1d1ef07c9f136e8c17f7ec3 ]
Since
e2a1256b17b1 ("x86/speculation: Restore speculation related MSRs during S3 resume")
kmemleak reports this issue:
unreferenced object 0xffff888009cedc00 (size 256):
comm "swapper/0", pid 1, jiffies 4294693823 (age 73.764s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 ........H.......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
msr_build_context (include/linux/slab.h:621)
pm_check_save_msr (arch/x86/power/cpu.c:520)
do_one_initcall (init/main.c:1298)
kernel_init_freeable (init/main.c:1370)
kernel_init (init/main.c:1504)
ret_from_fork (arch/x86/entry/entry_64.S:304)Reproducer:
- boot the VM with a debug kernel config (see
https://github.com/multipath-tcp/mptcp_net-next/issues/268)
- wait ~1 minute
- start a kmemleak scan
The root cause here is alignment within the packed struct saved_context (from suspend_64.h). Kmemleak only searches for pointers that are aligned (see how pointers are scanned in kmemleak.c), but pahole shows that the saved_msrs struct member and all members after it in the structure are unaligned:
struct saved_context {
struct pt_regs regs; /* 0 168 */
/* --- cacheline 2 boundary (128 bytes) was 40 bytes ago --- */
u16 ds; /* 168 2 */...
u64 misc_enable; /* 232 8 */
bool misc_enable_saved; /* 240 1 */
/* Note below odd offset values for the remainder of this struct */
struct saved_msrs saved_msrs; /* 241 16 */
/* --- cacheline 4 boundary (256 bytes) was 1 bytes ago --- */
long unsigned int efer; /* 257 8 */
u16 gdt_pad; /* 265 2 */
struct desc_ptr gdt_desc; /* 267 10 */
u16 idt_pad; /* 277 2 */
struct desc_ptr idt; /* 279 10 */
u16 ldt; /* 289 2 */
u16 tss; /* 291 2 */
long unsigned int tr; /* 293 8 */
long unsigned int safety; /* 301 8 */
long unsigned int return_address; /* 309 8 */
/* size: 317, cachelines: 5, members: 25 */
/* last cacheline: 61 bytes */
} __attribute__((__packed__));
Move misc_enable_saved to the end of the struct declaration so that saved_msrs fits in before the cacheline 4 boundary.
The comment above the saved_context declaration says to fix wakeup_64.S file and __save/__restore_processor_state() if the struct is modified:
it looks like all the accesses in wakeup_64.S are done through offsets which are computed at build-time. Update that comment accordingly.
At the end, the false positive kmemleak report is due to a limitation from kmemleak but it is always good to avoid unaligned members for optimisation purposes.
Please note that it looks like this issue is not new, e.g.
https://lore.kernel.org/all/[email protected]/
https://lore.kernel.org/all/[email protected]/
[ bp: Massage + cleanup commit message. ]
--- arch/x86/include/asm/suspend_32.h | 2 +- arch/x86/include/asm/suspend_64.h | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-)
arch/x86/include/asm/suspend_32.h +1 -1
@@ -21,7 +21,6 @@ struct saved_context {#endif unsigned long cr0, cr2, cr3, cr4;u64 misc_enable; -bool misc_enable_saved;struct saved_msrs saved_msrs;struct desc_ptr gdt_desc;struct desc_ptr idt;
@@ -30,6 +29,7 @@ struct saved_context {unsigned long tr;unsigned long safety;unsigned long return_address; +bool misc_enable_saved; } __attribute__((packed));/* routines for saving/restoring kernel state */
arch/x86/include/asm/suspend_64.h +8 -4
@@ -14,9 +14,13 @@* Image of the saved processor state, used by the low level ACPI suspend to * RAM code and by the low level hibernation code. * -* If you modify it, fix arch/x86/kernel/acpi/wakeup_64.S and make sure that -* __save/__restore_processor_state(), defined in arch/x86/kernel/suspend_64.c, -* still work as required. +* If you modify it, check how it is used in arch/x86/kernel/acpi/wakeup_64.S +* and make sure that __save/__restore_processor_state(), defined in +* arch/x86/power/cpu.c, still work as required. +* +* Because the structure is packed, make sure to avoid unaligned members. For +* optimisation purposes but also because tools like kmemleak only search for +* pointers that are aligned. */ struct saved_context {struct pt_regs regs;
@@ -36,7 +40,6 @@ struct saved_context {unsigned long cr0, cr2, cr3, cr4;u64 misc_enable; -bool misc_enable_saved;struct saved_msrs saved_msrs;unsigned long efer;u16 gdt_pad;/* Unused */
@@ -48,6 +51,7 @@ struct saved_context {unsigned long tr;unsigned long safety;unsigned long return_address; +bool misc_enable_saved; } __attribute__((packed));#define loaddebug (thread,register) \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 169/452 mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a28ed09dafee20da51eb26452950839633afd824 ]
It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref.
And use devm_platform_get_and_ioremap_resource() to simplify code.
--- drivers/mtd/nand/raw/cadence-nand-controller.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/mtd/nand/raw/cadence-nand-controller.c +2 -3
@@ -2983,11 +2983,10 @@ static int cadence_nand_dt_probe(struct platform_device *ofdev)if (IS_ERR (cdns_ctrl->reg))return PTR_ERR (cdns_ctrl->reg); - res =platform_get_resource (ofdev,IORESOURCE_MEM ,1 ); - cdns_ctrl->io.dma = res->start; - cdns_ctrl->io.virt =devm_ioremap_resource (&ofdev->dev, res); + cdns_ctrl->io.virt =devm_platform_get_and_ioremap_resource (ofdev,1 , &res);if (IS_ERR (cdns_ctrl->io.virt))return PTR_ERR (cdns_ctrl->io.virt); + cdns_ctrl->io.dma = res->start; dt->clk =devm_clk_get (cdns_ctrl->dev,"nf_clk" );if (IS_ERR (dt->clk))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 170/452 x86/speculation: Add missing prototype for unpriv_ebpf_notify()
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit 2147c438fde135d6c145a96e373d9348e7076f7f ]
Fix the following warnings seen with "make W=1":
kernel/sysctl.c:183:13: warning: no previous prototype for ‘unpriv_ebpf_notify’ [-Wmissing-prototypes]
183 | void __weak unpriv_ebpf_notify(int new_state)
| ^~~~~~~~~~~~~~~~~~
arch/x86/kernel/cpu/bugs.c:659:6: warning: no previous prototype for ‘unpriv_ebpf_notify’ [-Wmissing-prototypes]
659 | void unpriv_ebpf_notify(int new_state)
| ^~~~~~~~~~~~~~~~~~
--- include/linux/bpf.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/bpf.h +2 -0
@@ -1730,6 +1730,8 @@ void bpf_offload_dev_netdev_unregister(struct bpf_offload_dev *offdev, struct net_device *netdev);bool bpf_offload_dev_match (struct bpf_prog *prog,struct net_device *netdev); +void unpriv_ebpf_notify (int new_state); +#if defined(CONFIG_NET ) && defined(CONFIG_BPF_SYSCALL )int bpf_prog_offload_init (struct bpf_prog *prog,union bpf_attr *attr);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 171/452 ASoC: rk3328: fix disabling mclk on pclk probe failure
In reply to Greg Kroah-HartmanFrom: Nicolas Frattaroli <[email protected]>
[ Upstream commit dd508e324cdde1c06ace08a8143fa50333a90703 ]
If preparing/enabling the pclk fails, the probe function should unprepare and disable the previously prepared and enabled mclk, which it doesn't do. This commit rectifies this.
--- sound/soc/codecs/rk3328_codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/rk3328_codec.c +1 -1
@@ -481,7 +481,7 @@ static int rk3328_platform_probe(struct platform_device *pdev) ret =clk_prepare_enable (rk3328->pclk);if (ret <0 ) {dev_err (&pdev->dev,"failed to enable acodec pclk\n" ); -return ret; + goto err_unprepare_mclk; } base =devm_platform_ioremap_resource (pdev,0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 172/452 perf tools: Add missing headers needed by util/data.h
In reply to Greg Kroah-HartmanFrom: Yang Jihong <[email protected]>
[ Upstream commit 4d27cf1d9de5becfa4d1efb2ea54dba1b9fc962a ]
'struct perf_data' in util/data.h uses the "u64" data type, which is defined in "linux/types.h".
If we only include util/data.h, the following compilation error occurs:
util/data.h:38:3: error: unknown type name ‘u64’
u64 version;
^~~Solution: include "linux/types.h." to add the needed type definitions.
--- tools/perf/util/data.h | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/data.h +1 -0
@@ -3,6 +3,7 @@#define __PERF_DATA_H#include <stdbool.h> +#include <linux/types.h> enum perf_data_mode {PERF_DATA_MODE_WRITE ,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 173/452 drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
In reply to Greg Kroah-HartmanFrom: Vinod Polimera <[email protected]>
[ Upstream commit fa5186b279ecf44b14fb435540d2065be91cb1ed ]
BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3 Call trace: dpu_vbif_init_memtypes+0x40/0xb8 dpu_runtime_resume+0xcc/0x1c0 pm_generic_runtime_resume+0x30/0x44 __genpd_runtime_resume+0x68/0x7c genpd_runtime_resume+0x134/0x258 __rpm_callback+0x98/0x138 rpm_callback+0x30/0x88 rpm_resume+0x36c/0x49c __pm_runtime_resume+0x80/0xb0 dpu_core_irq_uninstall+0x30/0xb0 dpu_irq_uninstall+0x18/0x24 msm_drm_uninit+0xd8/0x16c
Patchwork: https://patchwork.freedesktop.org/patch/483255/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +3 -1
@@ -678,8 +678,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)for (i =0 ; i < dpu_kms->catalog->vbif_count; i++) {u32 vbif_idx = dpu_kms->catalog->vbif[i].id; -if ((vbif_idx <VBIF_MAX ) && dpu_kms->hw_vbif[vbif_idx]) +if ((vbif_idx <VBIF_MAX ) && dpu_kms->hw_vbif[vbif_idx]) {dpu_hw_vbif_destroy (dpu_kms->hw_vbif[vbif_idx]); + dpu_kms->hw_vbif[vbif_idx] =NULL ; + } } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 174/452 drm/msm/dp: stop event kernel thread when DP unbind
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 570d3e5d28db7a94557fa179167a9fb8642fb8a1 ]
Current DP driver implementation, event thread is kept running after DP display is unbind. This patch fix this problem by disabling DP irq and stop event thread to exit gracefully at dp_display_unbind().
Changes in v2:
-- start event thread at dp_display_bind()
Changes in v3:
-- disable all HDP interrupts at unbind
-- replace dp_hpd_event_setup() with dp_hpd_event_thread_start() -- replace dp_hpd_event_stop() with dp_hpd_event_thread_stop() -- move init_waitqueue_head(&dp->event_q) to probe() -- move spin_lock_init(&dp->event_lock) to probe()
Changes in v4:
-- relocate both dp_display_bind() and dp_display_unbind() to bottom of file
Changes in v5:
-- cancel relocation of both dp_display_bind() and dp_display_unbind()
Changes in v6:
-- move empty event q to dp_event_thread_start()
Changes in v7:
-- call ktheread_stop() directly instead of dp_hpd_event_thread_stop() function
Changes in v8:
-- return error immediately if audio registration failed.
Changes in v9:
-- return error immediately if event thread create failed.
Changes in v10:
-- delete extra DRM_ERROR("failed to create DP event thread\n");
Patchwork: https://patchwork.freedesktop.org/patch/482399/
--- drivers/gpu/drm/msm/dp/dp_display.c | 39 +++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 8 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +31 -8
@@ -111,6 +111,7 @@ struct dp_display_private {u32 hpd_state;u32 event_pndx;u32 event_gndx; +struct task_struct *ev_tsk;struct dp_event event_list[DP_EVENT_Q_MAX ];spinlock_t event_lock;
@@ -194,6 +195,8 @@ void dp_display_signal_audio_complete(struct msm_dp *dp_display)complete_all (&dp->audio_comp); } +static int dp_hpd_event_thread_start (struct dp_display_private *dp_priv); +static int dp_display_bind (struct device *dev,struct device *master,void *data) {
@@ -234,9 +237,18 @@ static int dp_display_bind(struct device *dev, struct device *master, } rc =dp_register_audio_driver (dev, dp->audio); -if (rc) +if (rc) {DRM_ERROR ("Audio registration Dp failed\n" ); + goto end; + } + rc =dp_hpd_event_thread_start (dp); +if (rc) { +DRM_ERROR ("Event thread create failed\n" ); + goto end; + } + +return 0 ; end:return rc; }
@@ -255,6 +267,11 @@ static void dp_display_unbind(struct device *dev, struct device *master,return ; } +/* disable all HPD interrupts */ +dp_catalog_hpd_config_intr (dp->catalog,DP_DP_HPD_INT_MASK , false); + +kthread_stop (dp->ev_tsk); +dp_power_client_deinit (dp->power);dp_aux_unregister (dp->aux); priv->dp =NULL ;
@@ -981,7 +998,7 @@ static int hpd_event_thread(void *data) dp_priv = (struct dp_display_private *)data; -while (1 ) { +while (!kthread_should_stop ()) {if (timeout_mode) { wait_event_timeout(dp_priv->event_q, (dp_priv->event_pndx == dp_priv->event_gndx),
@@ -1062,12 +1079,17 @@ static int hpd_event_thread(void *data)return 0 ; } -static void dp_hpd_event_setup (struct dp_display_private *dp_priv) +static int dp_hpd_event_thread_start (struct dp_display_private *dp_priv) { -init_waitqueue_head (&dp_priv->event_q); -spin_lock_init (&dp_priv->event_lock); +/* set event q to empty */ + dp_priv->event_gndx =0 ; + dp_priv->event_pndx =0 ; -kthread_run (hpd_event_thread, dp_priv,"dp_hpd_handler" ); + dp_priv->ev_tsk =kthread_run (hpd_event_thread, dp_priv,"dp_hpd_handler" ); +if (IS_ERR (dp_priv->ev_tsk)) +return PTR_ERR (dp_priv->ev_tsk); + +return 0 ; }static irqreturn_t dp_display_irq_handler (int irq,void *dev_id)
@@ -1167,8 +1189,11 @@ static int dp_display_probe(struct platform_device *pdev)return -EPROBE_DEFER ; } +/* setup event q */ mutex_init (&dp->event_mutex); g_dp_display = &dp->dp_display; +init_waitqueue_head (&dp->event_q); +spin_lock_init (&dp->event_lock);/* Store DP audio handle inside DP display */ g_dp_display->dp_audio = dp->audio;
@@ -1308,8 +1333,6 @@ void msm_dp_irq_postinstall(struct msm_dp *dp_display) dp = container_of(dp_display, struct dp_display_private, dp_display); -dp_hpd_event_setup (dp); -dp_add_event (dp,EV_HPD_INIT_SETUP ,0 ,100 ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 175/452 drm/msm/dp: fix error check return value of irq_of_parse_and_map()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit e92d0d93f86699b7b25c7906613fdc374d66c8ca ]
The irq_of_parse_and_map() function returns 0 on failure, and does not return an negative value.
Patchwork: https://patchwork.freedesktop.org/patch/483176/
--- drivers/gpu/drm/msm/dp/dp_display.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +3 -4
@@ -1147,10 +1147,9 @@ int dp_display_request_irq(struct msm_dp *dp_display) dp = container_of(dp_display, struct dp_display_private, dp_display); dp->irq =irq_of_parse_and_map (dp->pdev->dev.of_node,0 ); -if (dp->irq <0 ) { - rc = dp->irq; -DRM_ERROR ("failed to get irq: %d\n" , rc); -return rc; +if (!dp->irq) { +DRM_ERROR ("failed to get irq\n" ); +return -EINVAL ; } rc = devm_request_irq(&dp->pdev->dev, dp->irq,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 176/452 drm/msm/dsi: fix error checks and return values for DSI xmit functions
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit f0e7e9ed379c012c4d6b09a09b868accc426223c ]
As noticed by Dan ([1] an the followup thread) there are multiple issues with the return values for MSM DSI command transmission callback. In the error case it can easily return a positive value when it should have returned a proper error code.
This commits attempts to fix these issues both in TX and in RX paths.
[1]: https://lore.kernel.org/linux-arm-msm/20211001123617.GH2283@kili/
Patchwork: https://patchwork.freedesktop.org/patch/480501/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_host.c +14 -7
@@ -1371,10 +1371,10 @@ static int dsi_cmds2buf_tx(struct msm_dsi_host *msm_host,dsi_get_bpp (msm_host->format) /8 ; len =dsi_cmd_dma_add (msm_host, msg); -if (!len) { +if (len <0 ) {pr_err ("%s: failed to add cmd type = 0x%x\n" , __func__, msg->type); -return -EINVAL ; +return len; }/* for video mode, do not send cmds more than
@@ -1393,10 +1393,14 @@ static int dsi_cmds2buf_tx(struct msm_dsi_host *msm_host, } ret =dsi_cmd_dma_tx (msm_host, len); -if (ret < len) { -pr_err ("%s: cmd dma tx failed, type=0x%x, data0=0x%x, len=%d\n" , - __func__, msg->type, (*(u8 *)(msg->tx_buf)), len); -return -ECOMM ; +if (ret <0 ) { +pr_err ("%s: cmd dma tx failed, type=0x%x, data0=0x%x, len=%d, ret=%d\n" , + __func__, msg->type, (*(u8 *)(msg->tx_buf)), len, ret); +return ret; + }else if (ret < len) { +pr_err ("%s: cmd dma tx failed, type=0x%x, data0=0x%x, ret=%d len=%d\n" , + __func__, msg->type, (*(u8 *)(msg->tx_buf)), ret, len); +return -EIO ; }return len;
@@ -2139,9 +2143,12 @@ int msm_dsi_host_cmd_rx(struct mipi_dsi_host *host, } ret =dsi_cmds2buf_tx (msm_host, msg); -if (ret < msg->tx_len) { +if (ret <0 ) {pr_err ("%s: Read cmd Tx failed, %d\n" , __func__, ret);return ret; + }else if (ret < msg->tx_len) { +pr_err ("%s: Read cmd Tx failed, too short: %d\n" , __func__, ret); +return -ECOMM ; }/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 177/452 drm/msm/hdmi: check return value after calling platform_get_resource_byname()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a36e506711548df923ceb7ec9f6001375be799a5 ]
It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value.
Patchwork: https://patchwork.freedesktop.org/patch/482992/
--- drivers/gpu/drm/msm/hdmi/hdmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/msm/hdmi/hdmi.c +4 -0
@@ -142,6 +142,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)/* HDCP needs physical address of hdmi register */ res =platform_get_resource_byname (pdev,IORESOURCE_MEM , config->mmio_name); +if (!res) { + ret = -EINVAL ; + goto fail; + } hdmi->mmio_phy_addr = res->start; hdmi->qfprom_mmio = msm_ioremap(pdev,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 178/452 drm/msm/hdmi: fix error check return value of irq_of_parse_and_map()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit 03371e4fbdeb7f596cbceacb59e474248b6d95ac ]
The irq_of_parse_and_map() function returns 0 on failure, and does not return a negative value anyhow, so never enter this conditional branch.
Patchwork: https://patchwork.freedesktop.org/patch/483294/
--- drivers/gpu/drm/msm/hdmi/hdmi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/msm/hdmi/hdmi.c +3 -3
@@ -315,9 +315,9 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi, } hdmi->irq =irq_of_parse_and_map (pdev->dev.of_node,0 ); -if (hdmi->irq <0 ) { - ret = hdmi->irq; -DRM_DEV_ERROR (dev->dev,"failed to get irq: %d\n" , ret); +if (!hdmi->irq) { + ret = -EINVAL ; +DRM_DEV_ERROR (dev->dev,"failed to get irq\n" ); goto fail; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 179/452 drm/msm: add missing include to msm_drv.c
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 8123fe83c3a3448bbfa5b5b1cacfdfe7d076fca6 ]
Add explicit include of drm_bridge.h to the msm_drv.c to fix the following warning:
drivers/gpu/drm/msm/msm_drv.c:236:17: error: implicit declaration of function 'drm_bridge_remove'; did you mean 'drm_bridge_detach'? [-Werror=implicit-function-declaration]
Patchwork: https://patchwork.freedesktop.org/patch/484310/
--- drivers/gpu/drm/msm/msm_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/msm_drv.c +1 -0
@@ -10,6 +10,7 @@#include <linux/uaccess.h> #include <uapi/linux/sched/types.h> +#include <drm/drm_bridge.h> #include <drm/drm_drv.h> #include <drm/drm_file.h> #include <drm/drm_ioctl.h>
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 180/452 drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H
In reply to Greg Kroah-HartmanFrom: Jagan Teki <[email protected]>
[ Upstream commit 7eafbecd2288c542ea15ea20cf1a7e64a25c21bc ]
AM-1280800N3TZQW-T00H panel support 8 bpc not 6 bpc as per recent testing in i.MX8MM platform.
Fix it.
--- drivers/gpu/drm/panel/panel-simple.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panel/panel-simple.c +1 -1
@@ -676,7 +676,7 @@ static const struct drm_display_mode ampire_am_1280800n3tzqw_t00h_mode = {static const struct panel_desc ampire_am_1280800n3tzqw_t00h = { .modes = &ire_am_1280800n3tzqw_t00h_mode, .num_modes =1 , - .bpc =6 , + .bpc =8 , .size = { .width =217 , .height =136 ,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 181/452 drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit f8c242908ad15bbd604d3bcb54961b7d454c43f8 ]
It will cause null-ptr-deref in resource_size(), if platform_get_resource() returns NULL, move calling resource_size() after devm_ioremap_resource() that will check 'res' to avoid null-ptr-deref.
--- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/rockchip/rockchip_drm_vop.c +1 -1
@@ -2097,10 +2097,10 @@ static int vop_bind(struct device *dev, struct device *master, void *data)vop_win_init (vop); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - vop->len =resource_size (res); vop->regs =devm_ioremap_resource (dev, res);if (IS_ERR (vop->regs))return PTR_ERR (vop->regs); + vop->len =resource_size (res); res =platform_get_resource (pdev,IORESOURCE_MEM ,1 );if (res) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 182/452 perf tools: Use Python devtools for version autodetection rather than runtime
In reply to Greg Kroah-HartmanFrom: James Clark <[email protected]>
[ Upstream commit 630af16eee495f583db5202c3613d1b191f10694 ]
This fixes the issue where the build will fail if only the Python2 runtime is installed but the Python3 devtools are installed. Currently the workaround is 'make PYTHON=python3'.
Fix it by autodetecting Python based on whether python[x]-config exists rather than just python[x] because both are needed for the build. Then -config is stripped to find the Python runtime.
Testing
=======
* Auto detect links with Python3 when the v3 devtools are installed and only Python 2 runtime is installed
* Auto detect links with Python2 when both devtools are installed
* Sensible warning is printed if no Python devtools are installed
* 'make PYTHON=x' still automatically sets PYTHON_CONFIG=x-config
* 'make PYTHON=x' fails if x-config doesn't exist
* 'make PYTHON=python3' overrides Python2 devtools
* 'make PYTHON=python2' overrides Python3 devtools
* 'make PYTHON_CONFIG=x-config' works
* 'make PYTHON=x PYTHON_CONFIG=x' works
* 'make PYTHON=missing' reports an error
* 'make PYTHON_CONFIG=missing' reports an error
--- tools/perf/Makefile.config | 39 ++++++++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 12 deletions(-)
tools/perf/Makefile.config +27 -12
@@ -222,18 +222,33 @@ ifdef PARSER_DEBUG endif # Try different combinations to accommodate systems that only have -# python[2][-config] in weird combinations but always preferring -# python2 and python2-config as per pep-0394. If python2 or python -# aren't found, then python3 is used. -PYTHON_AUTO := python -PYTHON_AUTO := $(if $(call get-executable,python3),python3,$(PYTHON_AUTO)) -PYTHON_AUTO := $(if $(call get-executable,python),python,$(PYTHON_AUTO)) -PYTHON_AUTO := $(if $(call get-executable,python2),python2,$(PYTHON_AUTO)) -override PYTHON := $(call get-executable-or-default,PYTHON,$(PYTHON_AUTO)) -PYTHON_AUTO_CONFIG := \ - $(if $(call get-executable,$(PYTHON)-config),$(PYTHON)-config,python-config) -override PYTHON_CONFIG := \ - $(call get-executable-or-default,PYTHON_CONFIG,$(PYTHON_AUTO_CONFIG)) +# python[2][3]-config in weird combinations in the following order of +# priority from lowest to highest: +# * python3-config +# * python-config +# * python2-config as per pep-0394. +# * $(PYTHON)-config (If PYTHON is user supplied but PYTHON_CONFIG isn't) +# +PYTHON_AUTO := python-config +PYTHON_AUTO := $(if $(call get-executable,python3-config),python3-config,$(PYTHON_AUTO)) +PYTHON_AUTO := $(if $(call get-executable,python-config),python-config,$(PYTHON_AUTO)) +PYTHON_AUTO := $(if $(call get-executable,python2-config),python2-config,$(PYTHON_AUTO)) + +# If PYTHON is defined but PYTHON_CONFIG isn't, then take $(PYTHON)-config as if it was the user +# supplied value for PYTHON_CONFIG. Because it's "user supplied", error out if it doesn't exist. +ifdef PYTHON + ifndef PYTHON_CONFIG + PYTHON_CONFIG_AUTO := $(call get-executable,$(PYTHON)-config) + PYTHON_CONFIG := $(if $(PYTHON_CONFIG_AUTO),$(PYTHON_CONFIG_AUTO),\ + $(call $(error $(PYTHON)-config not found))) + endif +endif + +# Select either auto detected python and python-config or use user supplied values if they are +# defined. get-executable-or-default fails with an error if the first argument is supplied but +# doesn't exist. +override PYTHON_CONFIG := $(call get-executable-or-default,PYTHON_CONFIG,$(PYTHON_AUTO)) +override PYTHON := $(call get-executable-or-default,PYTHON,$(subst -config,,$(PYTHON_AUTO))) grep-libs = $(filter -l%,$(1)) strip-libs = $(filter-out -l%,$(1))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 183/452 virtio_blk: fix the discard_granularity and discard_alignment queue limits
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 62952cc5bccd89b76d710de1d0b43244af0f2903 ]
The discard_alignment queue limit is named a bit misleading means the offset into the block device at which the discard granularity starts.
On the other hand the discard_sector_alignment from the virtio 1.1 looks similar to what Linux uses as discard granularity (even if not very well described):
"discard_sector_alignment can be used by OS when splitting a request
based on alignment. "
And at least qemu does set it to the discard granularity.
So stop setting the discard_alignment and use the virtio discard_sector_alignment to set the discard granularity.
--- drivers/block/virtio_blk.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/block/virtio_blk.c +4 -3
@@ -865,11 +865,12 @@ static int virtblk_probe(struct virtio_device *vdev)blk_queue_io_opt (q, blk_size * opt_io_size);if (virtio_has_feature (vdev,VIRTIO_BLK_F_DISCARD )) { - q->limits.discard_granularity = blk_size; - virtio_cread(vdev, struct virtio_blk_config, discard_sector_alignment, &v); - q->limits.discard_alignment = v ? v <<SECTOR_SHIFT :0 ; +if (v) + q->limits.discard_granularity = v <<SECTOR_SHIFT ; +else + q->limits.discard_granularity = blk_size; virtio_cread(vdev, struct virtio_blk_config, max_discard_sectors, &v);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 184/452 x86: Fix return value of __setup handlers
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 12441ccdf5e2f5a01a46e344976cbbd3d46845c9 ]
__setup() handlers should return 1 to obsolete_checksetup() in init/main.c to indicate that the boot option has been handled. A return of 0 causes the boot option/value to be listed as an Unknown kernel parameter and added to init's (limited) argument (no '=') or environment (with '=') strings. So return 1 from these x86 __setup handlers.
Examples:
Unknown kernel command line parameters "apicpmtimer
BOOT_IMAGE=/boot/bzImage-517rc8 vdso=1 ring3mwait=disable", will be passed to user space.
Run /sbin/init as init process
with arguments:
/sbin/init
apicpmtimer
with environment:
HOME=/
TERM=linux
BOOT_IMAGE=/boot/bzImage-517rc8
vdso=1
ring3mwait=disable--- arch/x86/entry/vdso/vma.c | 2 +- arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/cpu/intel.c | 2 +- arch/x86/mm/pat/memtype.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
arch/x86/entry/vdso/vma.c +1 -1
@@ -440,7 +440,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)static __init int vdso_setup (char *s) { vdso64_enabled =simple_strtoul (s,NULL ,0 ); -return 0 ; +return 1 ; }__setup ("vdso=" , vdso_setup);
arch/x86/kernel/apic/apic.c +1 -1
@@ -168,7 +168,7 @@ static __init int setup_apicpmtimer(char *s) { apic_calibrate_pmtmr =1 ;notsc_setup (NULL ); -return 0 ; +return 1 ; }__setup ("apicpmtimer" , setup_apicpmtimer);#endif
arch/x86/kernel/cpu/intel.c +1 -1
@@ -88,7 +88,7 @@ static bool ring3mwait_disabled __read_mostly;static int __init ring3mwait_disable (char *__unused) { ring3mwait_disabled = true; -return 0 ; +return 1 ; }__setup ("ring3mwait=disable" , ring3mwait_disable);
arch/x86/mm/pat/memtype.c +1 -1
@@ -101,7 +101,7 @@ int pat_debug_enable;static int __init pat_debug_setup (char *str) { pat_debug_enable =1 ; -return 0 ; +return 1 ; }__setup ("debugpat" , pat_debug_setup);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 185/452 irqchip/exiu: Fix acknowledgment of edge triggered interrupts
In reply to Greg Kroah-HartmanFrom: Daniel Thompson <[email protected]>
[ Upstream commit 4efc851c36e389f7ed432edac0149acc5f94b0c7 ]
Currently the EXIU uses the fasteoi interrupt flow that is configured by it's parent (irq-gic-v3.c). With this flow the only chance to clear the interrupt request happens during .irq_eoi() and (obviously) this happens after the interrupt handler has run. EXIU requires edge triggered interrupts to be acked prior to interrupt handling. Without this we risk incorrect interrupt dismissal when a new interrupt is delivered after the handler reads and acknowledges the peripheral but before the irq_eoi() takes place.
Fix this by clearing the interrupt request from .irq_ack() if we are configured for edge triggered interrupts. This requires adopting the fasteoi-ack flow instead of the fasteoi to ensure the ack gets called.
These changes have been tested using the power button on a Developerbox/SC2A11 combined with some hackery in gpio-keys so I can play with the different trigger mode [and an mdelay(500) so I can can check what happens on a double click in both modes].
--- arch/arm64/Kconfig.platforms | 1 + drivers/irqchip/irq-sni-exiu.c | 25 ++++++++++++++++++++++--- 2 files changed, 23 insertions(+), 3 deletions(-)
arch/arm64/Kconfig.platforms +1 -0
@@ -250,6 +250,7 @@ config ARCH_STRATIX10 config ARCH_SYNQUACER bool "Socionext SynQuacer SoC Family" + select IRQ_FASTEOI_HIERARCHY_HANDLERS config ARCH_TEGRA bool "NVIDIA Tegra SoC Family"
drivers/irqchip/irq-sni-exiu.c +22 -3
@@ -37,11 +37,26 @@ struct exiu_irq_data {u32 spi_base; }; -static void exiu_irq_eoi (struct irq_data *d) +static void exiu_irq_ack (struct irq_data *d) {struct exiu_irq_data *data =irq_data_get_irq_chip_data (d);writel (BIT (d->hwirq), data->base +EIREQCLR ); +} + +static void exiu_irq_eoi (struct irq_data *d) +{ +struct exiu_irq_data *data =irq_data_get_irq_chip_data (d); + +/* +* Level triggered interrupts are latched and must be cleared during +* EOI or the interrupt will be jammed on. Of course if a level +* triggered interrupt is still asserted then the write will not clear +* the interrupt. +*/ +if (irqd_is_level_type (d)) +writel (BIT (d->hwirq), data->base +EIREQCLR ); +irq_chip_eoi_parent (d); }
@@ -91,10 +106,13 @@ static int exiu_irq_set_type(struct irq_data *d, unsigned int type)writel_relaxed (val, data->base +EILVL ); val =readl_relaxed (data->base +EIEDG ); -if (type ==IRQ_TYPE_LEVEL_LOW || type ==IRQ_TYPE_LEVEL_HIGH ) +if (type ==IRQ_TYPE_LEVEL_LOW || type ==IRQ_TYPE_LEVEL_HIGH ) { val &= ~BIT (d->hwirq); -else +irq_set_handler_locked (d, handle_fasteoi_irq); + }else { val |=BIT (d->hwirq); +irq_set_handler_locked (d, handle_fasteoi_ack_irq); + }writel_relaxed (val, data->base +EIEDG );writel_relaxed (BIT (d->hwirq), data->base +EIREQCLR );
@@ -104,6 +122,7 @@ static int exiu_irq_set_type(struct irq_data *d, unsigned int type)static struct irq_chip exiu_irq_chip = { .name ="EXIU" , + .irq_ack = exiu_irq_ack, .irq_eoi = exiu_irq_eoi, .irq_enable = exiu_irq_enable, .irq_mask = exiu_irq_mask,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 186/452 irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 50f0f26e7c8665763d0d7d3372dbcf191f94d077 ]
The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO.
--- drivers/irqchip/irq-aspeed-i2c-ic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/irqchip/irq-aspeed-i2c-ic.c +2 -2
@@ -79,8 +79,8 @@ static int __init aspeed_i2c_ic_of_init(struct device_node *node, } i2c_ic->parent_irq =irq_of_parse_and_map (node,0 ); -if (i2c_ic->parent_irq <0 ) { - ret = i2c_ic->parent_irq; +if (!i2c_ic->parent_irq) { + ret = -EINVAL ; goto err_iounmap; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 187/452 irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f03a9670d27d23fe734a456f16e2579b21ec02b4 ]
The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO.
--- drivers/irqchip/irq-aspeed-scu-ic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/irqchip/irq-aspeed-scu-ic.c +2 -2
@@ -159,8 +159,8 @@ static int aspeed_scu_ic_of_init_common(struct aspeed_scu_ic *scu_ic, } irq =irq_of_parse_and_map (node,0 ); -if (irq <0 ) { - rc = irq; +if (!irq) { + rc = -EINVAL ; goto err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 188/452 x86/mm: Cleanup the control_va_addr_alignment() __setup handler
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 1ef64b1e89e6d4018da46e08ffc32779a31160c7 ]
Clean up control_va_addr_alignment():
a. Make '=' required instead of optional (as documented). b. Print a warning if an invalid option value is used.
c. Return 1 from the __setup handler when an invalid option value is
used. This prevents the kernel from polluting init's (limited) environment space with the entire string.
--- arch/x86/kernel/sys_x86_64.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
arch/x86/kernel/sys_x86_64.c +2 -5
@@ -68,9 +68,6 @@ static int __init control_va_addr_alignment(char *str)if (*str ==0 )return 1 ; -if (*str =='=' ) - str++; -if (!strcmp (str,"32" )) va_align.flags =ALIGN_VA_32 ;else if (!strcmp (str,"64" ))
@@ -80,11 +77,11 @@ static int __init control_va_addr_alignment(char *str)else if (!strcmp (str,"on" )) va_align.flags =ALIGN_VA_32 |ALIGN_VA_64 ;else -return 0 ; +pr_warn ("invalid option value: 'align_va_addr=%s'\n" , str);return 1 ; } -__setup ("align_va_addr" , control_va_addr_alignment); +__setup ("align_va_addr=" , control_va_addr_alignment); SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len, unsigned long, prot, unsigned long, flags,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 189/452 arm64: fix types in copy_highpage()
In reply to Greg Kroah-HartmanFrom: Tong Tiangen <[email protected]>
[ Upstream commit 921d161f15d6b090599f6a8c23f131969edbd1fa ]
In copy_highpage() the kto and kfrom local variables are pointers to struct page, but these are used to hold arbitrary pointers to kernel memory . Each call to page_address() returns a void pointer to memory associated with the relevant page, and copy_page() expects void pointers to this memory.
This inconsistency was introduced in commit 2563776b41c3 ("arm64: mte:
Tags-aware copy_{user_,}highpage() implementations") and while this doesn't appear to be harmful in practice it is clearly wrong.
Correct this by making kto and kfrom void pointers.
--- arch/arm64/mm/copypage.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/mm/copypage.c +2 -2
@@ -16,8 +16,8 @@void copy_highpage (struct page *to,struct page *from) { -struct page *kto =page_address (to); -struct page *kfrom =page_address (from); +void *kto =page_address (to); +void *kfrom =page_address (from);copy_page (kto, kfrom);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 190/452 regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET
In reply to Greg Kroah-HartmanFrom: Zev Weiss <[email protected]>
[ Upstream commit c3e3ca05dae37f8f74bb80358efd540911cbc2c8 ]
Since the introduction of regulator->enable_count, a driver that did an exclusive get on an already-enabled regulator would end up with enable_count initialized to 0 but rdev->use_count initialized to 1. With that starting point the regulator is effectively stuck enabled, because if the driver attempted to disable it it would fail the enable_count underflow check in _regulator_handle_consumer_disable().
The EXCLUSIVE_GET path in _regulator_get() now initializes enable_count along with rdev->use_count so that the regulator can be disabled without underflowing the former.
--- drivers/regulator/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/regulator/core.c +5 -2
@@ -2027,10 +2027,13 @@ struct regulator *_regulator_get(struct device *dev, const char *id, rdev->exclusive =1 ; ret =_regulator_is_enabled (rdev); -if (ret >0 ) +if (ret >0 ) { rdev->use_count =1 ; -else + regulator->enable_count =1 ; + }else { rdev->use_count =0 ; + regulator->enable_count =0 ; + } } link =device_link_add (dev, &rdev->dev,DL_FLAG_STATELESS );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 191/452 drm/msm/dp: fix event thread stuck in wait_event after kthread_stop()
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 2f9b5b3ae2eb625b75a898212a76f3b8c6d0d2b0 ]
Event thread supposed to exit from its while loop after kthread_stop(). However there may has possibility that event thread is pending in the middle of wait_event due to condition checking never become true. To make sure event thread exit its loop after kthread_stop(), this patch OR kthread_should_stop() into wait_event's condition checking so that event thread will exit its loop after kernal_stop().
Changes in v2:
-- correct spelling error at commit title
Changes in v3:
-- remove unnecessary parenthesis
-- while(1) to replace while (!kthread_should_stop())
Patchwork: https://patchwork.freedesktop.org/patch/484576/
--- drivers/gpu/drm/msm/dp/dp_display.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +9 -4
@@ -998,15 +998,20 @@ static int hpd_event_thread(void *data) dp_priv = (struct dp_display_private *)data; -while (!kthread_should_stop ()) { +while (1 ) {if (timeout_mode) {wait_event_timeout (dp_priv->event_q, - (dp_priv->event_pndx == dp_priv->event_gndx), -EVENT_TIMEOUT ); + (dp_priv->event_pndx == dp_priv->event_gndx) || +kthread_should_stop (),EVENT_TIMEOUT ); }else {wait_event_interruptible (dp_priv->event_q, - (dp_priv->event_pndx != dp_priv->event_gndx)); + (dp_priv->event_pndx != dp_priv->event_gndx) || +kthread_should_stop ()); } + +if (kthread_should_stop ()) +break ; +spin_lock_irqsave (&dp_priv->event_lock, flag); todo = &dp_priv->event_list[dp_priv->event_gndx];if (todo->delay) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 192/452 drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
In reply to Greg Kroah-HartmanFrom: Jessica Zhang <[email protected]>
[ Upstream commit d59be579fa932c46b908f37509f319cbd4ca9a68 ]
mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring the modeset lock, but currently mdp5_pipe_release doesn't check for if an error is returned. Because of this, there is a possibility of mdp5_pipe_release hitting a NULL dereference error.
To avoid this, let's have mdp5_pipe_release check if mdp5_get_global_state returns an error and propogate that error.
Changes since v1:
- Separated declaration and initialization of *new_state to avoid compiler warning
- Fixed some spelling mistakes in commit message
Changes since v2:
- Return 0 in case where hwpipe is NULL as this is considered normal behavior
- Added 2nd patch in series to fix a similar NULL dereference issue in mdp5_mixer_release
Patchwork: https://patchwork.freedesktop.org/patch/485179/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 28 insertions(+), 9 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +11 -4
@@ -119,18 +119,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane,return 0 ; } -void mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe) +int mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe) {struct msm_drm_private *priv = s->dev->dev_private;struct mdp5_kms *mdp5_kms =to_mdp5_kms (to_mdp_kms (priv->kms));struct mdp5_global_state *state =mdp5_get_global_state (s); -struct mdp5_hw_pipe_state *new_state = &state->hwpipe; +struct mdp5_hw_pipe_state *new_state;if (!hwpipe) -return ; +return 0 ; + +if (IS_ERR (state)) +return PTR_ERR (state); + + new_state = &state->hwpipe;if (WARN_ON (!new_state->hwpipe_to_plane[hwpipe->idx])) -return ; +return -EINVAL ;DBG ("%s: release from plane %s" , hwpipe->name, new_state->hwpipe_to_plane[hwpipe->idx]->name);
@@ -141,6 +146,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) } new_state->hwpipe_to_plane[hwpipe->idx] =NULL ; + +return 0 ; }void mdp5_pipe_destroy (struct mdp5_hw_pipe *hwpipe)
drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h +1 -1
@@ -37,7 +37,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, uint32_t caps, uint32_t blkcfg, struct mdp5_hw_pipe **hwpipe, struct mdp5_hw_pipe **r_hwpipe); -void mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe); +int mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe);struct mdp5_hw_pipe *mdp5_pipe_init (enum mdp5_pipe pipe,uint32_t reg_offset,uint32_t caps);
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +16 -4
@@ -393,12 +393,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, mdp5_state->r_hwpipe =NULL ; -mdp5_pipe_release (state->state, old_hwpipe); -mdp5_pipe_release (state->state, old_right_hwpipe); + ret =mdp5_pipe_release (state->state, old_hwpipe); +if (ret) +return ret; + + ret =mdp5_pipe_release (state->state, old_right_hwpipe); +if (ret) +return ret; + } }else { -mdp5_pipe_release (state->state, mdp5_state->hwpipe); -mdp5_pipe_release (state->state, mdp5_state->r_hwpipe); + ret =mdp5_pipe_release (state->state, mdp5_state->hwpipe); +if (ret) +return ret; + + ret =mdp5_pipe_release (state->state, mdp5_state->r_hwpipe); +if (ret) +return ret; + mdp5_state->hwpipe = mdp5_state->r_hwpipe =NULL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 193/452 drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
In reply to Greg Kroah-HartmanFrom: Jessica Zhang <[email protected]>
[ Upstream commit ca75f6f7c6f89365e40f10f641b15981b1f07c31 ]
There is a possibility for mdp5_get_global_state to return -EDEADLK when acquiring the modeset lock, but currently global_state in mdp5_mixer_release doesn't check for if an error is returned.
To avoid a NULL dereference error, let's have mdp5_mixer_release check if an error is returned and propagate that error.
Patchwork: https://patchwork.freedesktop.org/patch/485181/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 10 ++++++++-- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 ++-- 3 files changed, 21 insertions(+), 8 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +8 -2
@@ -608,9 +608,15 @@ int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc,if (ret)return ret; -mdp5_mixer_release (new_crtc_state->state, old_mixer); + ret =mdp5_mixer_release (new_crtc_state->state, old_mixer); +if (ret) +return ret; +if (old_r_mixer) { -mdp5_mixer_release (new_crtc_state->state, old_r_mixer); + ret =mdp5_mixer_release (new_crtc_state->state, old_r_mixer); +if (ret) +return ret; +if (!need_right_mixer) pipeline->r_mixer =NULL ; }
drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c +11 -4
@@ -116,21 +116,28 @@ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc,return 0 ; } -void mdp5_mixer_release (struct drm_atomic_state *s,struct mdp5_hw_mixer *mixer) +int mdp5_mixer_release (struct drm_atomic_state *s,struct mdp5_hw_mixer *mixer) {struct mdp5_global_state *global_state =mdp5_get_global_state (s); -struct mdp5_hw_mixer_state *new_state = &global_state->hwmixer; +struct mdp5_hw_mixer_state *new_state;if (!mixer) -return ; +return 0 ; + +if (IS_ERR (global_state)) +return PTR_ERR (global_state); + + new_state = &global_state->hwmixer;if (WARN_ON (!new_state->hwmixer_to_crtc[mixer->idx])) -return ; +return -EINVAL ;DBG ("%s: release from crtc %s" , mixer->name, new_state->hwmixer_to_crtc[mixer->idx]->name); new_state->hwmixer_to_crtc[mixer->idx] =NULL ; + +return 0 ; }void mdp5_mixer_destroy (struct mdp5_hw_mixer *mixer)
drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h +2 -2
@@ -30,7 +30,7 @@ void mdp5_mixer_destroy(struct mdp5_hw_mixer *lm);int mdp5_mixer_assign (struct drm_atomic_state *s,struct drm_crtc *crtc,uint32_t caps,struct mdp5_hw_mixer **mixer,struct mdp5_hw_mixer **r_mixer); -void mdp5_mixer_release (struct drm_atomic_state *s, -struct mdp5_hw_mixer *mixer); +int mdp5_mixer_release (struct drm_atomic_state *s, +struct mdp5_hw_mixer *mixer);#endif /* __MDP5_LM_H__ */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 194/452 drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit cf575e31611eb6dccf08fad02e57e35b2187704d ]
The msm_gem_prime_get_sg_table() needs to return error pointers on error. This is called from drm_gem_map_dma_buf() and returning a NULL will lead to a crash in that function.
Patchwork: https://patchwork.freedesktop.org/patch/485023/
--- drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_gem_prime.c +1 -1
@@ -17,7 +17,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj)int npages = obj->size >>PAGE_SHIFT ;if (WARN_ON (!msm_obj->pages))/* should have already pinned! */ -return NULL ; +return ERR_PTR (-ENOMEM );return drm_prime_pages_to_sg (obj->dev, msm_obj->pages, npages); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 195/452 media: uvcvideo: Fix missing check to determine if element is found in list
In reply to Greg Kroah-HartmanFrom: Xiaomeng Tong <[email protected]>
[ Upstream commit 261f33388c29f6f3c12a724e6d89172b7f6d5996 ]
The list iterator will point to a bogus position containing HEAD if the list is empty or the element is not found in list. This case should be checked before any use of the iterator, otherwise it will lead to a invalid memory access. The missing check here is before "pin = iterm->id;", just add check here to fix the security bug.
In addition, the list iterator value will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the element is not found in list, considering the (mis)use here: "if (iterm == NULL".
Use a new value 'it' as the list iterator, while use the old value 'iterm' as a dedicated pointer to point to the found element, which
1. can fix this bug, due to 'iterm' is NULL only if it's not found.
2. do not need to change all the uses of 'iterm' after the loop.
3. can also limit the scope of the list iterator 'it' *only inside* the traversal loop by simply declaring 'it' inside the loop in the future, as usage of the iterator outside of the list_for_each_entry is considered harmful. https://lkml.org/lkml/2022/2/17/1032
--- drivers/media/usb/uvc/uvc_v4l2.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/media/usb/uvc/uvc_v4l2.c +11 -9
@@ -863,29 +863,31 @@ static int uvc_ioctl_enum_input(struct file *file, void *fh,struct uvc_video_chain *chain = handle->chain;const struct uvc_entity *selector = chain->selector;struct uvc_entity *iterm =NULL ; +struct uvc_entity *it;u32 index = input->index; -int pin =0 ;if (selector ==NULL || (chain->dev->quirks &UVC_QUIRK_IGNORE_SELECTOR_UNIT )) {if (index !=0 )return -EINVAL ; -list_for_each_entry (iterm, &chain->entities, chain) { -if (UVC_ENTITY_IS_ITERM (iterm)) +list_for_each_entry (it, &chain->entities, chain) { +if (UVC_ENTITY_IS_ITERM (it)) { + iterm = it;break ; + } } - pin = iterm->id; }else if (index < selector->bNrInPins) { - pin = selector->baSourceID[index]; -list_for_each_entry (iterm, &chain->entities, chain) { -if (!UVC_ENTITY_IS_ITERM (iterm)) +list_for_each_entry (it, &chain->entities, chain) { +if (!UVC_ENTITY_IS_ITERM (it))continue ; -if (iterm->id == pin) +if (it->id == selector->baSourceID[index]) { + iterm = it;break ; + } } } -if (iterm ==NULL || iterm->id != pin) +if (iterm ==NULL )return -EINVAL ;memset (input,0 ,sizeof (*input));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 196/452 iomap: iomap_write_failed fix
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit b71450e2cc4b3c79f33c5bd276d152af9bd54f79 ]
The @lend parameter of truncate_pagecache_range() should be the offset of the last byte of the hole, not the first byte beyond it.
--- fs/iomap/buffered-io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/iomap/buffered-io.c +2 -1
@@ -528,7 +528,8 @@ iomap_write_failed(struct inode *inode, loff_t pos, unsigned len)* write started inside the existing inode size. */ if (pos + len > i_size) -truncate_pagecache_range (inode,max (pos, i_size), pos + len); +truncate_pagecache_range (inode,max (pos, i_size), + pos + len -1 ); } static int
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 197/452 spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a2b331ac11e1cac56f5b7d367e9f3c5796deaaed ]
It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value.
--- drivers/spi/spi-fsl-qspi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/spi/spi-fsl-qspi.c +4 -0
@@ -876,6 +876,10 @@ static int fsl_qspi_probe(struct platform_device *pdev) res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"QuadSPI-memory" ); +if (!res) { + ret = -EINVAL ; + goto err_put_ctrl; + } q->memmap_phy = res->start;/* Since there are 4 cs, map size required is 4 times ahb_buf_size */ q->ahb_addr = devm_ioremap(dev, q->memmap_phy,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 198/452 Revert "cpufreq: Fix possible race in cpufreq online error path"
In reply to Greg Kroah-HartmanFrom: Viresh Kumar <[email protected]>
[ Upstream commit 85f0e42bd65d01b351d561efb38e584d4c596553 ]
This reverts commit f346e96267cd76175d6c201b40f770c0116a8a04.
The commit tried to fix a possible real bug but it made it even worse. The fix was simply buggy as now an error out to out_offline_policy or out_exit_policy will try to release a semaphore which was never taken in the first place. This works fine only if we failed late, i.e. via out_destroy_policy.
--- drivers/cpufreq/cpufreq.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/cpufreq/cpufreq.c +2 -3
@@ -1515,6 +1515,8 @@ static int cpufreq_online(unsigned int cpu)for_each_cpu (j, policy->real_cpus)remove_cpu_dev_symlink (policy,get_cpu_device (j)); +up_write (&policy->rwsem); + out_offline_policy:if (cpufreq_driver->offline) cpufreq_driver->offline (policy);
@@ -1523,9 +1525,6 @@ static int cpufreq_online(unsigned int cpu)if (cpufreq_driver->exit) cpufreq_driver->exit (policy); -cpumask_clear (policy->cpus); -up_write (&policy->rwsem); - out_free_policy:cpufreq_policy_free (policy);return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 199/452 regulator: qcom_smd: Fix up PM8950 regulator configuration
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
[ Upstream commit b11b3d21a94d66bc05d1142e0b210bfa316c62be ]
Following changes have been made:
- S5, L4, L18, L20 and L21 were removed (S5 is managed by SPMI, whereas the rest seems not to exist [or at least it's blocked by Sony Loire /MSM8956/ RPM firmware])
- Supply maps have were adjusted to reflect regulator changes.
--- drivers/regulator/qcom_smd-regulator.c | 35 +++++++++++++------------- 1 file changed, 17 insertions(+), 18 deletions(-)
drivers/regulator/qcom_smd-regulator.c +17 -18
@@ -844,32 +844,31 @@ static const struct rpm_regulator_data rpm_pm8950_regulators[] = { { "s2", QCOM_SMD_RPM_SMPA, 2, &pm8950_hfsmps, "vdd_s2" }, { "s3", QCOM_SMD_RPM_SMPA, 3, &pm8950_hfsmps, "vdd_s3" }, { "s4", QCOM_SMD_RPM_SMPA, 4, &pm8950_hfsmps, "vdd_s4" }, - { "s5", QCOM_SMD_RPM_SMPA, 5, &pm8950_ftsmps2p5, "vdd_s5" }, +/* S5 is managed via SPMI. */ { "s6", QCOM_SMD_RPM_SMPA, 6, &pm8950_hfsmps, "vdd_s6" }, { "l1", QCOM_SMD_RPM_LDOA, 1, &pm8950_ult_nldo, "vdd_l1_l19" }, { "l2", QCOM_SMD_RPM_LDOA, 2, &pm8950_ult_nldo, "vdd_l2_l23" }, { "l3", QCOM_SMD_RPM_LDOA, 3, &pm8950_ult_nldo, "vdd_l3" }, - { "l4", QCOM_SMD_RPM_LDOA, 4, &pm8950_ult_pldo, "vdd_l4_l5_l6_l7_l16" }, - { "l5", QCOM_SMD_RPM_LDOA, 5, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, - { "l6", QCOM_SMD_RPM_LDOA, 6, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, - { "l7", QCOM_SMD_RPM_LDOA, 7, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, +/* L4 seems not to exist. */ + { "l5", QCOM_SMD_RPM_LDOA, 5, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, + { "l6", QCOM_SMD_RPM_LDOA, 6, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, + { "l7", QCOM_SMD_RPM_LDOA, 7, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, { "l8", QCOM_SMD_RPM_LDOA, 8, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, { "l9", QCOM_SMD_RPM_LDOA, 9, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, { "l10", QCOM_SMD_RPM_LDOA, 10, &pm8950_ult_nldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l11", QCOM_SMD_RPM_LDOA, 11, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l12", QCOM_SMD_RPM_LDOA, 12, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l13", QCOM_SMD_RPM_LDOA, 13, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l14", QCOM_SMD_RPM_LDOA, 14, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l15", QCOM_SMD_RPM_LDOA, 15, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l16", QCOM_SMD_RPM_LDOA, 16, &pm8950_ult_pldo, "vdd_l4_l5_l6_l7_l16"}, - { "l17", QCOM_SMD_RPM_LDOA, 17, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l18", QCOM_SMD_RPM_LDOA, 18, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l19", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l1_l19"}, - { "l20", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l20"}, - { "l21", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l21"}, - { "l22", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l23", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l2_l23"}, + { "l11", QCOM_SMD_RPM_LDOA, 11, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l12", QCOM_SMD_RPM_LDOA, 12, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l13", QCOM_SMD_RPM_LDOA, 13, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l14", QCOM_SMD_RPM_LDOA, 14, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l15", QCOM_SMD_RPM_LDOA, 15, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l16", QCOM_SMD_RPM_LDOA, 16, &pm8950_ult_pldo, "vdd_l5_l6_l7_l16" }, + { "l17", QCOM_SMD_RPM_LDOA, 17, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, +/* L18 seems not to exist. */ + { "l19", QCOM_SMD_RPM_LDOA, 19, &pm8950_pldo, "vdd_l1_l19" }, +/* L20 & L21 seem not to exist. */ + { "l22", QCOM_SMD_RPM_LDOA, 22, &pm8950_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l23", QCOM_SMD_RPM_LDOA, 23, &pm8950_pldo, "vdd_l2_l23" }, {} };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 200/452 perf/amd/ibs: Use interrupt regs ip for stack unwinding
In reply to Greg Kroah-HartmanFrom: Ravi Bangoria <[email protected]>
[ Upstream commit 3d47083b9ff46863e8374ad3bb5edb5e464c75f8 ]
IbsOpRip is recorded when IBS interrupt is triggered. But there is a skid from the time IBS interrupt gets triggered to the time the interrupt is presented to the core. Meanwhile processor would have moved ahead and thus IbsOpRip will be inconsistent with rsp and rbp recorded as part of the interrupt regs. This causes issues while unwinding stack using the ORC unwinder as it needs consistent rip, rsp and rbp. Fix this by using rip from interrupt regs instead of IbsOpRip for stack unwinding.
--- arch/x86/events/amd/ibs.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
arch/x86/events/amd/ibs.c +18 -0
@@ -312,6 +312,16 @@ static int perf_ibs_init(struct perf_event *event) hwc->config_base = perf_ibs->msr; hwc->config = config; +/* +* rip recorded by IbsOpRip will not be consistent with rsp and rbp +* recorded as part of interrupt regs. Thus we need to use rip from +* interrupt regs while unwinding call stack. Setting _EARLY flag +* makes sure we unwind call-stack before perf sample rip is set to +* IbsOpRip. +*/ +if (event->attr.sample_type &PERF_SAMPLE_CALLCHAIN ) + event->attr.sample_type |= __PERF_SAMPLE_CALLCHAIN_EARLY; +return 0 ; }
@@ -692,6 +702,14 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) data.raw = &raw; } +/* +* rip recorded by IbsOpRip will not be consistent with rsp and rbp +* recorded as part of interrupt regs. Thus we need to use rip from +* interrupt regs while unwinding call stack. +*/ +if (event->attr.sample_type &PERF_SAMPLE_CALLCHAIN ) + data.callchain =perf_callchain (event, iregs); + throttle =perf_event_overflow (event, &data, ®s); out:if (throttle) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 201/452 ath11k: Dont check arvif->is_started before sending management frames
In reply to Greg Kroah-HartmanFrom: Baochen Qiang <[email protected]>
[ Upstream commit 355333a217541916576351446b5832fec7930566 ]
Commit 66307ca04057 ("ath11k: fix mgmt_tx_wmi cmd sent to FW for deleted vdev") wants both of below two conditions are true before sending management frames:
1: ar->allocated_vdev_map & (1LL << arvif->vdev_id) 2: arvif->is_started
Actually the second one is not necessary because with the first one we can make sure the vdev is present.
Also use ar->conf_mutex to synchronize vdev delete and mgmt. TX.
This issue is found in case of Passpoint scenario where ath11k needs to send action frames before vdev is started.
Fix it by removing the second condition.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
--- drivers/net/wireless/ath/ath11k/mac.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +3 -2
@@ -4008,8 +4008,8 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) } arvif =ath11k_vif_to_arvif (skb_cb->vif); -if (ar->allocated_vdev_map & (1LL << arvif->vdev_id) && - arvif->is_started) { +mutex_lock (&ar->conf_mutex); +if (ar->allocated_vdev_map & (1LL << arvif->vdev_id)) { ret =ath11k_mac_mgmt_tx_wmi (ar, arvif, skb);if (ret) { ath11k_warn(ar->ab, "failed to tx mgmt frame, vdev_id %d :%d\n",
@@ -4025,6 +4025,7 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) arvif->is_started);ieee80211_free_txskb (ar->hw, skb); } +mutex_unlock (&ar->conf_mutex); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 202/452 ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 41cd312dfe980af869c3503b4d38e62ed20dd3b7 ]
of_find_i2c_device_by_node() takes a reference, In error paths, we should call put_device() to drop the reference to aviod refount leak.
--- sound/soc/fsl/imx-sgtl5000.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
sound/soc/fsl/imx-sgtl5000.c +8 -6
@@ -120,19 +120,19 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) data =devm_kzalloc (&pdev->dev,sizeof (*data),GFP_KERNEL );if (!data) { ret = -ENOMEM ; - goto fail; + goto put_device; } comp =devm_kzalloc (&pdev->dev,3 *sizeof (*comp),GFP_KERNEL );if (!comp) { ret = -ENOMEM ; - goto fail; + goto put_device; } data->codec_clk =clk_get (&codec_dev->dev,NULL );if (IS_ERR (data->codec_clk)) { ret =PTR_ERR (data->codec_clk); - goto fail; + goto put_device; } data->clk_frequency =clk_get_rate (data->codec_clk);
@@ -158,10 +158,10 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) data->card.dev = &pdev->dev; ret =snd_soc_of_parse_card_name (&data->card,"model" );if (ret) - goto fail; + goto put_device; ret =snd_soc_of_parse_audio_routing (&data->card,"audio-routing" );if (ret) - goto fail; + goto put_device; data->card.num_links =1 ; data->card.owner =THIS_MODULE ; data->card.dai_link = &data->dai;
@@ -176,7 +176,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)if (ret != -EPROBE_DEFER )dev_err (&pdev->dev,"snd_soc_register_card failed (%d)\n" , ret); - goto fail; + goto put_device; }of_node_put (ssi_np);
@@ -184,6 +184,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)return 0 ; +put_device: +put_device (&codec_dev->dev); fail:if (data && !IS_ERR (data->codec_clk))clk_put (data->codec_clk);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 203/452 ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 2be84f73785fa9ed6443e3c5b158730266f1c2ee ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done.
--- sound/soc/mxs/mxs-saif.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/mxs/mxs-saif.c +1 -0
@@ -764,6 +764,7 @@ static int mxs_saif_probe(struct platform_device *pdev) saif->master_id = saif->id; }else { ret =of_alias_get_id (master,"saif" ); +of_node_put (master);if (ret <0 )return ret;else
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 204/452 regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit afaa7b933ef00a2d3262f4d1252087613fb5c06d ]
of_node_get() returns a node with refcount incremented. Calling of_node_put() to drop the reference when not needed anymore.
--- drivers/regulator/pfuze100-regulator.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/regulator/pfuze100-regulator.c +2 -0
@@ -531,6 +531,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) parent =of_get_child_by_name (np,"regulators" );if (!parent) {dev_err (dev,"regulators node not found\n" ); +of_node_put (np);return -EINVAL ; }
@@ -560,6 +561,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) }of_node_put (parent); +of_node_put (np);if (ret <0 ) {dev_err (dev,"Error parsing regulator init data: %d\n" , ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 205/452 ASoC: samsung: Use dev_err_probe() helper
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
[ Upstream commit 27c6eaebcf75e4fac145d17c7fa76bc64b60d24c ]
Use the dev_err_probe() helper, instead of open-coding the same operation.
--- sound/soc/samsung/aries_wm8994.c | 17 +++++++---------- sound/soc/samsung/arndale.c | 5 ++--- sound/soc/samsung/littlemill.c | 5 ++--- sound/soc/samsung/lowland.c | 5 ++--- sound/soc/samsung/odroid.c | 4 +--- sound/soc/samsung/smdk_wm8994.c | 4 ++-- sound/soc/samsung/smdk_wm8994pcm.c | 4 ++-- sound/soc/samsung/snow.c | 9 +++------ sound/soc/samsung/speyside.c | 5 ++--- sound/soc/samsung/tm2_wm5110.c | 3 +-- sound/soc/samsung/tobermory.c | 5 ++--- 11 files changed, 26 insertions(+), 40 deletions(-)
sound/soc/samsung/aries_wm8994.c +7 -10
@@ -585,19 +585,16 @@ static int aries_audio_probe(struct platform_device *pdev) extcon_np =of_parse_phandle (np,"extcon" ,0 ); priv->usb_extcon =extcon_find_edev_by_node (extcon_np); -if (IS_ERR (priv->usb_extcon)) { -if (PTR_ERR (priv->usb_extcon) != -EPROBE_DEFER ) -dev_err (dev,"Failed to get extcon device" ); -return PTR_ERR (priv->usb_extcon); - } +if (IS_ERR (priv->usb_extcon)) +return dev_err_probe (dev,PTR_ERR (priv->usb_extcon), +"Failed to get extcon device" );of_node_put (extcon_np); priv->adc =devm_iio_channel_get (dev,"headset-detect" ); -if (IS_ERR (priv->adc)) { -if (PTR_ERR (priv->adc) != -EPROBE_DEFER ) -dev_err (dev,"Failed to get ADC channel" ); -return PTR_ERR (priv->adc); - } +if (IS_ERR (priv->adc)) +return dev_err_probe (dev,PTR_ERR (priv->adc), +"Failed to get ADC channel" ); +if (priv->adc->channel->type !=IIO_VOLTAGE )return -EINVAL ;
sound/soc/samsung/arndale.c +2 -3
@@ -174,9 +174,8 @@ static int arndale_audio_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (card->dev, card);if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (&pdev->dev, -"snd_soc_register_card() failed: %d\n" , ret); +dev_err_probe (&pdev->dev, ret, +"snd_soc_register_card() failed\n" ); goto err_put_of_nodes; }return 0 ;
sound/soc/samsung/littlemill.c +2 -3
@@ -325,9 +325,8 @@ static int littlemill_probe(struct platform_device *pdev) card->dev = &pdev->dev; ret =devm_snd_soc_register_card (&pdev->dev, card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card() failed: %d\n" , - ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card() failed\n" );return ret; }
sound/soc/samsung/lowland.c +2 -3
@@ -183,9 +183,8 @@ static int lowland_probe(struct platform_device *pdev) card->dev = &pdev->dev; ret =devm_snd_soc_register_card (&pdev->dev, card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card() failed: %d\n" , - ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card() failed\n" );return ret; }
sound/soc/samsung/odroid.c +1 -3
@@ -311,9 +311,7 @@ static int odroid_audio_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (dev, card);if (ret <0 ) { -if (ret != -EPROBE_DEFER ) -dev_err (dev,"snd_soc_register_card() failed: %d\n" , - ret); +dev_err_probe (dev, ret,"snd_soc_register_card() failed\n" ); goto err_put_clk_i2s; }
sound/soc/samsung/smdk_wm8994.c +2 -2
@@ -178,8 +178,8 @@ static int smdk_audio_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (&pdev->dev, card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card() failed:%d\n" , ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card() failed\n" );return ret; }
sound/soc/samsung/smdk_wm8994pcm.c +2 -2
@@ -118,8 +118,8 @@ static int snd_smdk_probe(struct platform_device *pdev) smdk_pcm.dev = &pdev->dev; ret =devm_snd_soc_register_card (&pdev->dev, &smdk_pcm); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card failed %d\n" , ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card failed\n" );return ret; }
sound/soc/samsung/snow.c +3 -6
@@ -215,12 +215,9 @@ static int snow_probe(struct platform_device *pdev)snd_soc_card_set_drvdata (card, priv); ret =devm_snd_soc_register_card (dev, card); -if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (&pdev->dev, -"snd_soc_register_card failed (%d)\n" , ret); -return ret; - } +if (ret) +return dev_err_probe (&pdev->dev, ret, +"snd_soc_register_card failed\n" );return ret; }
sound/soc/samsung/speyside.c +2 -3
@@ -330,9 +330,8 @@ static int speyside_probe(struct platform_device *pdev) card->dev = &pdev->dev; ret =devm_snd_soc_register_card (&pdev->dev, card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card() failed: %d\n" , - ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card() failed\n" );return ret; }
sound/soc/samsung/tm2_wm5110.c +1 -2
@@ -611,8 +611,7 @@ static int tm2_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (dev, card);if (ret <0 ) { -if (ret != -EPROBE_DEFER ) -dev_err (dev,"Failed to register card: %d\n" , ret); +dev_err_probe (dev, ret,"Failed to register card\n" ); goto dai_node_put; }
sound/soc/samsung/tobermory.c +2 -3
@@ -229,9 +229,8 @@ static int tobermory_probe(struct platform_device *pdev) card->dev = &pdev->dev; ret =devm_snd_soc_register_card (&pdev->dev, card); -if (ret && ret != -EPROBE_DEFER ) -dev_err (&pdev->dev,"snd_soc_register_card() failed: %d\n" , - ret); +if (ret) +dev_err_probe (&pdev->dev, ret,"snd_soc_register_card() failed\n" );return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 206/452 ASoC: samsung: Fix refcount leak in aries_audio_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit bf4a9b2467b775717d0e9034ad916888e19713a3 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. If extcon_find_edev_by_node() fails, it doesn't call of_node_put() Calling of_node_put() after extcon_find_edev_by_node() to fix this.
--- sound/soc/samsung/aries_wm8994.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/samsung/aries_wm8994.c +1 -1
@@ -585,10 +585,10 @@ static int aries_audio_probe(struct platform_device *pdev) extcon_np =of_parse_phandle (np,"extcon" ,0 ); priv->usb_extcon =extcon_find_edev_by_node (extcon_np); +of_node_put (extcon_np);if (IS_ERR (priv->usb_extcon))return dev_err_probe (dev,PTR_ERR (priv->usb_extcon),"Failed to get extcon device" ); -of_node_put (extcon_np); priv->adc =devm_iio_channel_get (dev,"headset-detect" );if (IS_ERR (priv->adc))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 207/452 kselftest/cgroup: fix test_stress.sh to use OUTPUT dir
In reply to Greg Kroah-HartmanFrom: Phil Auld <[email protected]>
[ Upstream commit 54de76c0123915e7533ce352de30a1f2d80fe81f ]
Running cgroup kselftest with O= fails to run the with_stress test due to hardcoded ./test_core. Find test_core binary using the OUTPUT directory.
--- tools/testing/selftests/cgroup/test_stress.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/cgroup/test_stress.sh +1 -1
@@ -1,4 +1,4 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 -./with_stress.sh -s subsys -s fork ./test_core +./with_stress.sh -s subsys -s fork ${OUTPUT}/test_core
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 208/452 scripts/faddr2line: Fix overlapping text section failures
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit 1d1a0e7c5100d332583e20b40aa8c0a8ed3d7849 ]
There have been some recent reports of faddr2line failures:
$ scripts/faddr2line sound/soundcore.ko sound_devnode+0x5/0x35 bad symbol size: base: 0x0000000000000000 end: 0x0000000000000000
$ ./scripts/faddr2line vmlinux.o enter_from_user_mode+0x24 bad symbol size: base: 0x0000000000005fe0 end: 0x0000000000005fe0
The problem is that faddr2line is based on 'nm', which has a major
limitation: it doesn't know how to distinguish between different text sections. So if an offset exists in multiple text sections in the object, it may fail.
Rewrite faddr2line to be section-aware, by basing it on readelf.
--- scripts/faddr2line | 150 +++++++++++++++++++++++++++++---------------- 1 file changed, 97 insertions(+), 53 deletions(-)
scripts/faddr2line +97 -53
@@ -44,17 +44,6 @@ set -o errexit set -o nounset -READELF="${CROSS_COMPILE:-}readelf" -ADDR2LINE="${CROSS_COMPILE:-}addr2line" -SIZE="${CROSS_COMPILE:-}size" -NM="${CROSS_COMPILE:-}nm" - -command -v awk >/dev/null 2>&1 || die "awk isn't installed" -command -v ${READELF} >/dev/null 2>&1 || die "readelf isn't installed" -command -v ${ADDR2LINE} >/dev/null 2>&1 || die "addr2line isn't installed" -command -v ${SIZE} >/dev/null 2>&1 || die "size isn't installed" -command -v ${NM} >/dev/null 2>&1 || die "nm isn't installed" - usage() { echo "usage: faddr2line [--list] <object file> <func+offset> <func+offset>..." >&2 exit 1
@@ -69,6 +58,14 @@ die() { exit 1 } +READELF="${CROSS_COMPILE:-}readelf" +ADDR2LINE="${CROSS_COMPILE:-}addr2line" +AWK="awk" + +command -v ${AWK} >/dev/null 2>&1 || die "${AWK} isn't installed" +command -v ${READELF} >/dev/null 2>&1 || die "${READELF} isn't installed" +command -v ${ADDR2LINE} >/dev/null 2>&1 || die "${ADDR2LINE} isn't installed" + # Try to figure out the source directory prefix so we can remove it from the # addr2line output. HACK ALERT: This assumes that start_kernel() is in # init/main.c! This only works for vmlinux. Otherwise it falls back to
@@ -76,7 +73,7 @@ die() { find_dir_prefix() { local objfile=$1 - local start_kernel_addr=$(${READELF} -sW $objfile | awk '$8 == "start_kernel" {printf "0x%s", $2}') + local start_kernel_addr=$(${READELF} --symbols --wide $objfile | ${AWK} '$8 == "start_kernel" {printf "0x%s", $2}') [[ -z $start_kernel_addr ]] && return local file_line=$(${ADDR2LINE} -e $objfile $start_kernel_addr)
@@ -97,86 +94,133 @@ __faddr2line() { local dir_prefix=$3 local print_warnings=$4 - local func=${func_addr%+*} + local sym_name=${func_addr%+*} local offset=${func_addr#*+} offset=${offset%/*} - local size= - [[ $func_addr =~ "/" ]] && size=${func_addr#*/} + local user_size= + [[ $func_addr =~ "/" ]] && user_size=${func_addr#*/} - if [[ -z $func ]] || [[ -z $offset ]] || [[ $func = $func_addr ]]; then + if [[ -z $sym_name ]] || [[ -z $offset ]] || [[ $sym_name = $func_addr ]]; then warn "bad func+offset $func_addr" DONE=1 return fi # Go through each of the object's symbols which match the func name. - # In rare cases there might be duplicates. - file_end=$(${SIZE} -Ax $objfile | awk '$1 == ".text" {print $2}') - while read symbol; do - local fields=($symbol) - local sym_base=0x${fields[0]} - local sym_type=${fields[1]} - local sym_end=${fields[3]} - - # calculate the size - local sym_size=$(($sym_end - $sym_base)) + # In rare cases there might be duplicates, in which case we print all + # matches. + while read line; do + local fields=($line) + local sym_addr=0x${fields[1]} + local sym_elf_size=${fields[2]} + local sym_sec=${fields[6]} + + # Get the section size: + local sec_size=$(${READELF} --section-headers --wide $objfile | + sed 's/\[ /\[/' | + ${AWK} -v sec=$sym_sec '$1 == "[" sec "]" { print "0x" $6; exit }') + + if [[ -z $sec_size ]]; then + warn "bad section size: section: $sym_sec" + DONE=1 + return + fi + + # Calculate the symbol size. + # + # Unfortunately we can't use the ELF size, because kallsyms + # also includes the padding bytes in its size calculation. For + # kallsyms, the size calculation is the distance between the + # symbol and the next symbol in a sorted list. + local sym_size + local cur_sym_addr + local found=0 + while read line; do + local fields=($line) + cur_sym_addr=0x${fields[1]} + local cur_sym_elf_size=${fields[2]} + local cur_sym_name=${fields[7]:-} + + if [[ $cur_sym_addr = $sym_addr ]] && + [[ $cur_sym_elf_size = $sym_elf_size ]] && + [[ $cur_sym_name = $sym_name ]]; then + found=1 + continue + fi + + if [[ $found = 1 ]]; then + sym_size=$(($cur_sym_addr - $sym_addr)) + [[ $sym_size -lt $sym_elf_size ]] && continue; + found=2 + break + fi + done < <(${READELF} --symbols --wide $objfile | ${AWK} -v sec=$sym_sec '$7 == sec' | sort --key=2) + + if [[ $found = 0 ]]; then + warn "can't find symbol: sym_name: $sym_name sym_sec: $sym_sec sym_addr: $sym_addr sym_elf_size: $sym_elf_size" + DONE=1 + return + fi + + # If nothing was found after the symbol, assume it's the last + # symbol in the section. + [[ $found = 1 ]] && sym_size=$(($sec_size - $sym_addr)) + if [[ -z $sym_size ]] || [[ $sym_size -le 0 ]]; then - warn "bad symbol size: base: $sym_base end: $sym_end" + warn "bad symbol size: sym_addr: $sym_addr cur_sym_addr: $cur_sym_addr" DONE=1 return fi + sym_size=0x$(printf %x $sym_size) - # calculate the address - local addr=$(($sym_base + $offset)) + # Calculate the section address from user-supplied offset: + local addr=$(($sym_addr + $offset)) if [[ -z $addr ]] || [[ $addr = 0 ]]; then - warn "bad address: $sym_base + $offset" + warn "bad address: $sym_addr + $offset" DONE=1 return fi addr=0x$(printf %x $addr) - # weed out non-function symbols - if [[ $sym_type != t ]] && [[ $sym_type != T ]]; then - [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to non-function symbol of type '$sym_type'" - continue - fi - - # if the user provided a size, make sure it matches the symbol's size - if [[ -n $size ]] && [[ $size -ne $sym_size ]]; then + # If the user provided a size, make sure it matches the symbol's size: + if [[ -n $user_size ]] && [[ $user_size -ne $sym_size ]]; then [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to size mismatch ($size != $sym_size)" + echo "skipping $sym_name address at $addr due to size mismatch ($user_size != $sym_size)" continue; fi - # make sure the provided offset is within the symbol's range + # Make sure the provided offset is within the symbol's range: if [[ $offset -gt $sym_size ]]; then [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to size mismatch ($offset > $sym_size)" + echo "skipping $sym_name address at $addr due to size mismatch ($offset > $sym_size)" continue fi - # separate multiple entries with a blank line + # In case of duplicates or multiple addresses specified on the + # cmdline, separate multiple entries with a blank line: [[ $FIRST = 0 ]] && echo FIRST=0 - # pass real address to addr2line - echo "$func+$offset/$sym_size:" - local file_lines=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;") - [[ -z $file_lines ]] && return + echo "$sym_name+$offset/$sym_size:" + # Pass section address to addr2line and strip absolute paths + # from the output: + local output=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;") + [[ -z $output ]] && continue + + # Default output (non --list): if [[ $LIST = 0 ]]; then - echo "$file_lines" | while read -r line + echo "$output" | while read -r line do echo $line done DONE=1; - return + continue fi - # show each line with context - echo "$file_lines" | while read -r line + # For --list, show each line with its corresponding source code: + echo "$output" | while read -r line do echo echo $line
@@ -184,12 +228,12 @@ __faddr2line() { n1=$[$n-5] n2=$[$n+5] f=$(echo $line | sed 's/.*at \(.\+\):.*/\1/g') - awk 'NR>=strtonum("'$n1'") && NR<=strtonum("'$n2'") { if (NR=='$n') printf(">%d<", NR); else printf(" %d ", NR); printf("\t%s\n", $0)}' $f + ${AWK} 'NR>=strtonum("'$n1'") && NR<=strtonum("'$n2'") { if (NR=='$n') printf(">%d<", NR); else printf(" %d ", NR); printf("\t%s\n", $0)}' $f done DONE=1 - done < <(${NM} -n $objfile | awk -v fn=$func -v end=$file_end '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, "0x"$1 } END {if (found == 1) print line, end; }') + done < <(${READELF} --symbols --wide $objfile | ${AWK} -v fn=$sym_name '$4 == "FUNC" && $8 == fn') } [[ $# -lt 2 ]] && usage
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 209/452 media: aspeed: Fix an error handling path in aspeed_video_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 310fda622bbd38be17fb444f7f049b137af3bc0d ]
A dma_free_coherent() call is missing in the error handling path of the probe, as already done in the remove function.
In fact, this call is included in aspeed_video_free_buf(). So use the latter both in the error handling path of the probe and in the remove function.
It is easier to see the relation with aspeed_video_alloc_buf() this way.
--- drivers/media/platform/aspeed-video.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/platform/aspeed-video.c +2 -2
@@ -1723,6 +1723,7 @@ static int aspeed_video_probe(struct platform_device *pdev) rc =aspeed_video_setup_video (video);if (rc) { +aspeed_video_free_buf (video, &video->jpeg);clk_unprepare (video->vclk);clk_unprepare (video->eclk);return rc;
@@ -1748,8 +1749,7 @@ static int aspeed_video_remove(struct platform_device *pdev)v4l2_device_unregister (v4l2_dev); -dma_free_coherent (video->dev,VE_JPEG_HEADER_SIZE , video->jpeg.virt, - video->jpeg.dma); +aspeed_video_free_buf (video, &video->jpeg);of_reserved_mem_device_release (dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 210/452 media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 5c0db68ce0faeb000c3540d095eb272d671a6e03 ]
If probe fails then we need to call pm_runtime_disable() to balance out the previous pm_runtime_enable() call.
--- drivers/media/platform/exynos4-is/fimc-is.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/exynos4-is/fimc-is.c +3 -1
@@ -830,7 +830,7 @@ static int fimc_is_probe(struct platform_device *pdev) ret =pm_runtime_resume_and_get (dev);if (ret <0 ) - goto err_irq; + goto err_pm_disable;vb2_dma_contig_set_max_seg_size (dev,DMA_BIT_MASK (32 ));
@@ -864,6 +864,8 @@ static int fimc_is_probe(struct platform_device *pdev)pm_runtime_put_noidle (dev);if (!pm_runtime_enabled (dev))fimc_is_runtime_suspend (dev); +err_pm_disable: +pm_runtime_disable (dev); err_irq:free_irq (is->irq, is); err_clk:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 211/452 media: st-delta: Fix PM disable depth imbalance in delta_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 94e3dba710fe0afc772172305444250023fc2d30 ]
The pm_runtime_enable will decrease power disable depth. If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable().
--- drivers/media/platform/sti/delta/delta-v4l2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/sti/delta/delta-v4l2.c +4 -2
@@ -1862,7 +1862,7 @@ static int delta_probe(struct platform_device *pdev)if (ret) {dev_err (delta->dev,"%s failed to initialize firmware ipc channel\n" ,DELTA_PREFIX ); - goto err; + goto err_pm_disable; }/* register all available decoders */
@@ -1876,7 +1876,7 @@ static int delta_probe(struct platform_device *pdev)if (ret) {dev_err (delta->dev,"%s failed to register V4L2 device\n" ,DELTA_PREFIX ); - goto err; + goto err_pm_disable; } delta->work_queue =create_workqueue (DELTA_NAME );
@@ -1901,6 +1901,8 @@ static int delta_probe(struct platform_device *pdev)destroy_workqueue (delta->work_queue); err_v4l2:v4l2_device_unregister (&delta->v4l2_dev); +err_pm_disable: +pm_runtime_disable (dev); err:return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 212/452 media: exynos4-is: Change clk_disable to clk_disable_unprepare
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9fadab72a6916c7507d7fedcd644859eef995078 ]
The corresponding API for clk_prepare_enable is clk_disable_unprepare, other than clk_disable.
Fix this by changing clk_disable to clk_disable_unprepare.
--- drivers/media/platform/exynos4-is/fimc-is.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/exynos4-is/fimc-is.c +1 -1
@@ -140,7 +140,7 @@ static int fimc_is_enable_clocks(struct fimc_is *is)dev_err (&is->pdev->dev,"clock %s enable failed\n" , fimc_is_clocks[i]);for (--i; i >=0 ; i--) -clk_disable (is->clocks[i]); +clk_disable_unprepare (is->clocks[i]);return ret; }pr_debug ("enabled clock: %s\n" , fimc_is_clocks[i]);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 213/452 media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 471bec68457aaf981add77b4f590d65dd7da1059 ]
Syzbot reported that -1 is used as array index. The problem was in missing validation check.
hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that.
hdw->workpoll initialization moved upper to prevent warning in __flush_work.
--- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/media/usb/pvrusb2/pvrusb2-hdw.c +5 -2
@@ -2569,6 +2569,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, }while (0 );mutex_unlock (&pvr2_unit_mtx); +INIT_WORK (&hdw->workpoll, pvr2_hdw_worker_poll); + +if (hdw->unit_number ==-1 ) + goto fail; + cnt1 =0 ; cnt2 =scnprintf (hdw->name+cnt1,sizeof (hdw->name)-cnt1,"pvrusb2" ); cnt1 += cnt2;
@@ -2580,8 +2585,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,if (cnt1 >=sizeof (hdw->name)) cnt1 =sizeof (hdw->name)-1 ; hdw->name[cnt1] =0 ; -INIT_WORK (&hdw->workpoll,pvr2_hdw_worker_poll); -pvr2_trace (PVR2_TRACE_INIT ,"Driver unit number is %d, name is %s" , hdw->unit_number,hdw->name);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 214/452 media: vsp1: Fix offset calculation for plane cropping
In reply to Greg Kroah-HartmanFrom: Michael Rodin <[email protected]>
[ Upstream commit 5f25abec8f21b7527c1223a354d23c270befddb3 ]
The vertical subsampling factor is currently not considered in the offset calculation for plane cropping done in rpf_configure_partition. This causes a distortion (shift of the color plane) when formats with the vsub factor larger than 1 are used (e.g. NV12, see vsp1_video_formats in vsp1_pipe.c). This commit considers vsub factor for all planes except plane 0 (luminance).
Drop generalization of the offset calculation to reduce the binary size.
--- drivers/media/platform/vsp1/vsp1_rpf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/platform/vsp1/vsp1_rpf.c +3 -3
@@ -291,11 +291,11 @@ static void rpf_configure_partition(struct vsp1_entity *entity, + crop.left * fmtinfo->bpp[0 ] /8 ;if (format->num_planes >1 ) { +unsigned int bpl = format->plane_fmt[1 ].bytesperline;unsigned int offset; - offset = crop.top * format->plane_fmt[1 ].bytesperline - + crop.left / fmtinfo->hsub - * fmtinfo->bpp[1 ] /8 ; + offset = crop.top / fmtinfo->vsub * bpl + + crop.left / fmtinfo->hsub * fmtinfo->bpp[1 ] /8 ; mem.addr[1 ] += offset; mem.addr[2 ] += offset; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 215/452 Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
In reply to Greg Kroah-HartmanFrom: Ying Hsu <[email protected]>
[ Upstream commit 7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2 ]
Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace:
dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30
--- net/bluetooth/sco.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
net/bluetooth/sco.c +13 -8
@@ -575,19 +575,24 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen addr->sa_family != AF_BLUETOOTH)return -EINVAL ; -if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) -return -EBADFD ; +lock_sock (sk); +if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) { + err = -EBADFD ; + goto done; + } -if (sk->sk_type !=SOCK_SEQPACKET ) -return -EINVAL ; +if (sk->sk_type !=SOCK_SEQPACKET ) { + err = -EINVAL ; + goto done; + } hdev =hci_get_route (&sa->sco_bdaddr, &sco_pi (sk)->src,BDADDR_BREDR ); -if (!hdev) -return -EHOSTUNREACH ; +if (!hdev) { + err = -EHOSTUNREACH ; + goto done; + }hci_dev_lock (hdev); -lock_sock (sk); -/* Set destination address and psm */ bacpy (&sco_pi (sk)->dst, &sa->sco_bdaddr);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 216/452 Bluetooth: Interleave with allowlist scan
In reply to Greg Kroah-HartmanFrom: Howard Chung <[email protected]>
[ Upstream commit c4f1f408168cd6a83d973e98e1cd1888e4d3d907 ]
This patch implements the interleaving between allowlist scan and no-filter scan. It'll be used to save power when at least one monitor is registered and at least one pending connection or one device to be scanned for.
The durations of the allowlist scan and the no-filter scan are controlled by MGMT command: Set Default System Configuration. The default values are set randomly for now.
--- include/net/bluetooth/hci_core.h | 10 +++ net/bluetooth/hci_core.c | 3 + net/bluetooth/hci_request.c | 128 +++++++++++++++++++++++++++++-- net/bluetooth/mgmt_config.c | 10 +++ 4 files changed, 144 insertions(+), 7 deletions(-)
include/net/bluetooth/hci_core.h +10 -0
@@ -364,6 +364,8 @@ struct hci_dev {__u8 ssp_debug_mode;__u8 hw_error_code;__u32 clock; +__u16 advmon_allowlist_duration; +__u16 advmon_no_filter_duration;__u16 devid_source;__u16 devid_vendor;
@@ -545,6 +547,14 @@ struct hci_dev {struct delayed_work rpa_expired;bdaddr_t rpa; +enum { +INTERLEAVE_SCAN_NONE , +INTERLEAVE_SCAN_NO_FILTER , +INTERLEAVE_SCAN_ALLOWLIST + } interleave_scan_state; + +struct delayed_work interleave_scan; +#if IS_ENABLED (CONFIG_BT_LEDS )struct led_trigger *power_led;#endif
net/bluetooth/hci_core.c +3 -0
@@ -3606,6 +3606,9 @@ struct hci_dev *hci_alloc_dev(void) hdev->cur_adv_instance =0x00 ; hdev->adv_instance_timeout =0 ; + hdev->advmon_allowlist_duration =300 ; + hdev->advmon_no_filter_duration =500 ; + hdev->sniff_max_interval =800 ; hdev->sniff_min_interval =80 ;
net/bluetooth/hci_request.c +121 -7
169 lines not on this page · raw message
net/bluetooth/mgmt_config.c +10 -0
@@ -67,6 +67,8 @@ int read_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,HDEV_PARAM_U16 (0x001a , le_supv_timeout),HDEV_PARAM_U16_JIFFIES_TO_MSECS (0x001b , def_le_autoconnect_timeout), +HDEV_PARAM_U16 (0x001d , advmon_allowlist_duration), + HDEV_PARAM_U16(0x001e, advmon_no_filter_duration), };struct mgmt_rp_read_def_system_config *rp = (void *)params;
@@ -138,6 +140,8 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data,case 0x0019 :case 0x001a :case 0x001b : +case 0x001d : +case 0x001e :if (len !=sizeof (u16)) {bt_dev_warn (hdev,"invalid length %d, exp %zu for type %d" , len,sizeof (u16), type);
@@ -251,6 +255,12 @@ int set_def_system_config(struct sock *sk, struct hci_dev *hdev, void *data, hdev->def_le_autoconnect_timeout =msecs_to_jiffies (TLV_GET_LE16 (buffer));break ; +case 0x0001d : + hdev->advmon_allowlist_duration =TLV_GET_LE16 (buffer); +break ; +case 0x0001e : + hdev->advmon_no_filter_duration =TLV_GET_LE16 (buffer); +break ;default :bt_dev_warn (hdev,"unsupported parameter %u" , type);break ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 217/452 Bluetooth: L2CAP: Rudimentary typo fixes
In reply to Greg Kroah-HartmanFrom: Bhaskar Chowdhury <[email protected]>
[ Upstream commit 5153ceb9e622f4e27de461404edc73324da70f8c ]
s/minium/minimum/
s/procdure/procedure/
--- net/bluetooth/l2cap_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/bluetooth/l2cap_core.c +2 -2
@@ -1689,7 +1689,7 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)smp_conn_security (hcon, hcon->pending_sec_level);/* For LE slave connections, make sure the connection interval -* is in the range of the minium and maximum interval that has +* is in the range of the minimum and maximum interval that has * been configured for this connection. If not, then trigger * the connection update procedure. */
@@ -7540,7 +7540,7 @@ static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,BT_DBG ("chan %p, len %d" , chan, skb->len);/* If we receive data on a fixed channel before the info req/rsp -* procdure is done simply assume that the channel is supported +* procedure is done simply assume that the channel is supported * and mark it as ready. */ if (chan->chan_type ==L2CAP_CHAN_FIXED )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 218/452 Bluetooth: LL privacy allow RPA
In reply to Greg Kroah-HartmanFrom: Sathish Narasimman <[email protected]>
[ Upstream commit 8ce85ada0a05e21a5386ba5c417c52ab00fcd0d1 ]
allow RPA to add bd address to whitelist
--- net/bluetooth/hci_request.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/hci_request.c +4 -0
@@ -842,6 +842,10 @@ static u8 update_white_list(struct hci_request *req)*/ bool allow_rpa = hdev->suspended; +if (use_ll_privacy (hdev) && +hci_dev_test_flag (hdev,HCI_ENABLE_LL_PRIVACY )) + allow_rpa = true; +/* Go through the current white list programmed into the * controller one by one and check if that address is still * in the list of pending connections or list of devices to
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 219/452 Bluetooth: use inclusive language in HCI role comments
In reply to Greg Kroah-HartmanFrom: Archie Pusaka <[email protected]>
[ Upstream commit 74be523ce6bed0531e4f31c3e1387909589e9bfe ]
This patch replaces some non-inclusive terms based on the appropriate language mapping table compiled by the Bluetooth SIG:
https://specificationrefs.bluetooth.com/language-mapping/Appropriate_Language_Mapping_Table.pdf
Specifically, these terms are replaced:
master -> initiator (for smp) or central (everything else) slave -> responder (for smp) or peripheral (everything else)
The #define preprocessor terms are unchanged for now to not disturb dependent APIs.
--- net/bluetooth/hci_conn.c | 8 ++++---- net/bluetooth/hci_event.c | 6 +++--- net/bluetooth/l2cap_core.c | 2 +- net/bluetooth/smp.c | 6 +++--- 4 files changed, 11 insertions(+), 11 deletions(-)
net/bluetooth/hci_conn.c +4 -4
@@ -240,7 +240,7 @@ int hci_disconnect(struct hci_conn *conn, __u8 reason) {BT_DBG ("hcon %p" , conn); -/* When we are master of an established connection and it enters +/* When we are central of an established connection and it enters * the disconnect timeout, then go ahead and try to read the * current clock offset. Processing of the result is done * within the event handling and hci_clock_offset_evt function.
@@ -1065,16 +1065,16 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,hci_req_init (&req, hdev); -/* Disable advertising if we're active. For master role +/* Disable advertising if we're active. For central role * connections most controllers will refuse to connect if -* advertising is enabled, and for slave role connections we +* advertising is enabled, and for peripheral role connections we * anyway have to disable it in order to start directed * advertising. */ if (hci_dev_test_flag (hdev,HCI_LE_ADV ))__hci_req_disable_advertising (&req); -/* If requested to connect as slave use directed advertising */ +/* If requested to connect as peripheral use directed advertising */ if (conn->role ==HCI_ROLE_SLAVE ) {/* If we're active scanning most controllers are unable * to initiate advertising. Simply reject the attempt.
net/bluetooth/hci_event.c +3 -3
@@ -2759,9 +2759,9 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)bacpy (&cp.bdaddr, &ev->bdaddr);if (lmp_rswitch_capable (hdev) && (mask &HCI_LM_MASTER )) - cp.role =0x00 ;/* Become master */ + cp.role =0x00 ;/* Become central */ else - cp.role =0x01 ;/* Remain slave */ + cp.role =0x01 ;/* Remain peripheral */ hci_send_cmd (hdev,HCI_OP_ACCEPT_CONN_REQ ,sizeof (cp), &cp); }else if (!(flags &HCI_PROTO_DEFER )) {
@@ -5153,7 +5153,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, conn->dst_type = bdaddr_type;/* If we didn't have a hci_conn object previously -* but we're in master role this must be something +* but we're in central role this must be something * initiated using a white list. Since white list based * connections are not "first class citizens" we don't * have full tracking of them. Therefore, we go ahead
net/bluetooth/l2cap_core.c +1 -1
@@ -1688,7 +1688,7 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)if (hcon->out)smp_conn_security (hcon, hcon->pending_sec_level); -/* For LE slave connections, make sure the connection interval +/* For LE peripheral connections, make sure the connection interval * is in the range of the minimum and maximum interval that has * been configured for this connection. If not, then trigger * the connection update procedure.
net/bluetooth/smp.c +3 -3
@@ -909,8 +909,8 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth, hcon->pending_sec_level =BT_SECURITY_HIGH ; } -/* If both devices have Keyoard-Display I/O, the master -* Confirms and the slave Enters the passkey. +/* If both devices have Keyboard-Display I/O, the initiator +* Confirms and the responder Enters the passkey. */ if (smp->method ==OVERLAP ) {if (hcon->role ==HCI_ROLE_MASTER )
@@ -3076,7 +3076,7 @@ static void bredr_pairing(struct l2cap_chan *chan)if (!test_bit (HCI_CONN_ENCRYPT , &hcon->flags))return ; -/* Only master may initiate SMP over BR/EDR */ +/* Only initiator may initiate SMP over BR/EDR */ if (hcon->role !=HCI_ROLE_MASTER )return ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 220/452 Bluetooth: use inclusive language when filtering devices
In reply to Greg Kroah-HartmanFrom: Archie Pusaka <[email protected]>
[ Upstream commit 3d4f9c00492b4e21641e5140a5e78cb50b58d60b ]
This patch replaces some non-inclusive terms based on the appropriate language mapping table compiled by the Bluetooth SIG:
https://specificationrefs.bluetooth.com/language-mapping/Appropriate_Language_Mapping_Table.pdf
Specifically, these terms are replaced:
blacklist -> reject list
whitelist -> accept list
--- include/net/bluetooth/hci.h | 16 +++--- include/net/bluetooth/hci_core.h | 8 +-- net/bluetooth/hci_core.c | 24 ++++----- net/bluetooth/hci_debugfs.c | 8 +-- net/bluetooth/hci_event.c | 70 ++++++++++++------------- net/bluetooth/hci_request.c | 89 ++++++++++++++++---------------- net/bluetooth/hci_sock.c | 12 ++--- net/bluetooth/l2cap_core.c | 4 +- net/bluetooth/mgmt.c | 14 ++--- 9 files changed, 123 insertions(+), 122 deletions(-)
include/net/bluetooth/hci.h +8 -8
@@ -1503,7 +1503,7 @@ struct hci_cp_le_set_scan_enable { } __packed;#define HCI_LE_USE_PEER_ADDR 0x00 -#define HCI_LE_USE_WHITELIST 0x01 +#define HCI_LE_USE_ACCEPT_LIST 0x01#define HCI_OP_LE_CREATE_CONN 0x200dstruct hci_cp_le_create_conn {
@@ -1523,22 +1523,22 @@ struct hci_cp_le_create_conn {#define HCI_OP_LE_CREATE_CONN_CANCEL 0x200e -#define HCI_OP_LE_READ_WHITE_LIST_SIZE 0x200f -struct hci_rp_le_read_white_list_size { +#define HCI_OP_LE_READ_ACCEPT_LIST_SIZE 0x200f +struct hci_rp_le_read_accept_list_size {__u8 status;__u8 size; } __packed; -#define HCI_OP_LE_CLEAR_WHITE_LIST 0x2010 +#define HCI_OP_LE_CLEAR_ACCEPT_LIST 0x2010 -#define HCI_OP_LE_ADD_TO_WHITE_LIST 0x2011 -struct hci_cp_le_add_to_white_list { +#define HCI_OP_LE_ADD_TO_ACCEPT_LIST 0x2011 +struct hci_cp_le_add_to_accept_list {__u8 bdaddr_type;bdaddr_t bdaddr; } __packed; -#define HCI_OP_LE_DEL_FROM_WHITE_LIST 0x2012 -struct hci_cp_le_del_from_white_list { +#define HCI_OP_LE_DEL_FROM_ACCEPT_LIST 0x2012 +struct hci_cp_le_del_from_accept_list {__u8 bdaddr_type;bdaddr_t bdaddr; } __packed;
include/net/bluetooth/hci_core.h +4 -4
@@ -308,7 +308,7 @@ struct hci_dev {__u8 max_page;__u8 features[HCI_MAX_PAGES ][8 ];__u8 le_features[8 ]; -__u8 le_white_list_size; +__u8 le_accept_list_size;__u8 le_resolv_list_size;__u8 le_num_of_adv_sets;__u8 le_states[8 ];
@@ -499,14 +499,14 @@ struct hci_dev {struct hci_conn_hash conn_hash;struct list_head mgmt_pending; -struct list_head blacklist; -struct list_head whitelist; +struct list_head reject_list; +struct list_head accept_list;struct list_head uuids;struct list_head link_keys;struct list_head long_term_keys;struct list_head identity_resolving_keys;struct list_head remote_oob_data; -struct list_head le_white_list; +struct list_head le_accept_list;struct list_head le_resolv_list;struct list_head le_conn_params;struct list_head pend_le_conns;
net/bluetooth/hci_core.c +12 -12
@@ -742,14 +742,14 @@ static int hci_init3_req(struct hci_request *req, unsigned long opt) }if (hdev->commands[26 ] &0x40 ) { -/* Read LE White List Size */ -hci_req_add (req,HCI_OP_LE_READ_WHITE_LIST_SIZE , +/* Read LE Accept List Size */ +hci_req_add (req,HCI_OP_LE_READ_ACCEPT_LIST_SIZE ,0 ,NULL ); }if (hdev->commands[26 ] &0x80 ) { -/* Clear LE White List */ -hci_req_add (req,HCI_OP_LE_CLEAR_WHITE_LIST ,0 ,NULL ); +/* Clear LE Accept List */ +hci_req_add (req,HCI_OP_LE_CLEAR_ACCEPT_LIST ,0 ,NULL ); }if (hdev->commands[34 ] &0x40 ) {
@@ -3548,13 +3548,13 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,/* Suspend consists of two actions: * - First, disconnect everything and make the controller not * connectable (disabling scanning) -* - Second, program event filter/whitelist and enable scan +* - Second, program event filter/accept list and enable scan */ ret =hci_change_suspend_state (hdev,BT_SUSPEND_DISCONNECT );if (!ret) state =BT_SUSPEND_DISCONNECT ; -/* Only configure whitelist if disconnect succeeded and wake +/* Only configure accept list if disconnect succeeded and wake * isn't being prevented. */ if (!ret && !(hdev->prevent_wake && hdev->prevent_wake (hdev))) {
@@ -3657,14 +3657,14 @@ struct hci_dev *hci_alloc_dev(void)mutex_init (&hdev->req_lock);INIT_LIST_HEAD (&hdev->mgmt_pending); -INIT_LIST_HEAD (&hdev->blacklist); -INIT_LIST_HEAD (&hdev->whitelist); +INIT_LIST_HEAD (&hdev->reject_list); +INIT_LIST_HEAD (&hdev->accept_list);INIT_LIST_HEAD (&hdev->uuids);INIT_LIST_HEAD (&hdev->link_keys);INIT_LIST_HEAD (&hdev->long_term_keys);INIT_LIST_HEAD (&hdev->identity_resolving_keys);INIT_LIST_HEAD (&hdev->remote_oob_data); -INIT_LIST_HEAD (&hdev->le_white_list); +INIT_LIST_HEAD (&hdev->le_accept_list);INIT_LIST_HEAD (&hdev->le_resolv_list);INIT_LIST_HEAD (&hdev->le_conn_params);INIT_LIST_HEAD (&hdev->pend_le_conns);
@@ -3880,8 +3880,8 @@ void hci_cleanup_dev(struct hci_dev *hdev)destroy_workqueue (hdev->req_workqueue);hci_dev_lock (hdev); -hci_bdaddr_list_clear (&hdev->blacklist); -hci_bdaddr_list_clear (&hdev->whitelist); +hci_bdaddr_list_clear (&hdev->reject_list); +hci_bdaddr_list_clear (&hdev->accept_list);hci_uuids_clear (hdev);hci_link_keys_clear (hdev);hci_smp_ltks_clear (hdev);
@@ -3889,7 +3889,7 @@ void hci_cleanup_dev(struct hci_dev *hdev)hci_remote_oob_data_clear (hdev);hci_adv_instances_clear (hdev);hci_adv_monitors_clear (hdev); -hci_bdaddr_list_clear (&hdev->le_white_list); +hci_bdaddr_list_clear (&hdev->le_accept_list);hci_bdaddr_list_clear (&hdev->le_resolv_list);hci_conn_params_clear_all (hdev);hci_discovery_filter_clear (hdev);
net/bluetooth/hci_debugfs.c +4 -4
@@ -125,7 +125,7 @@ static int device_list_show(struct seq_file *f, void *ptr)struct bdaddr_list *b;hci_dev_lock (hdev); -list_for_each_entry (b, &hdev->whitelist, list) +list_for_each_entry (b, &hdev->accept_list, list)seq_printf (f,"%pMR (type %u)\n" , &b->bdaddr, b->bdaddr_type);list_for_each_entry (p, &hdev->le_conn_params, list) { seq_printf(f, "%pMR (type %u) %u\n", &p->addr, p->addr_type,
@@ -144,7 +144,7 @@ static int blacklist_show(struct seq_file *f, void *p)struct bdaddr_list *b;hci_dev_lock (hdev); -list_for_each_entry (b, &hdev->blacklist, list) +list_for_each_entry (b, &hdev->reject_list, list)seq_printf (f,"%pMR (type %u)\n" , &b->bdaddr, b->bdaddr_type);hci_dev_unlock (hdev);
@@ -734,7 +734,7 @@ static int white_list_show(struct seq_file *f, void *ptr)struct bdaddr_list *b;hci_dev_lock (hdev); -list_for_each_entry (b, &hdev->le_white_list, list) +list_for_each_entry (b, &hdev->le_accept_list, list)seq_printf (f,"%pMR (type %u)\n" , &b->bdaddr, b->bdaddr_type);hci_dev_unlock (hdev);
@@ -1145,7 +1145,7 @@ void hci_debugfs_create_le(struct hci_dev *hdev) &force_static_address_fops);debugfs_create_u8 ("white_list_size" ,0444 , hdev->debugfs, - &hdev->le_white_list_size); + &hdev->le_accept_list_size);debugfs_create_file ("white_list" ,0444 , hdev->debugfs, hdev, &white_list_fops); debugfs_create_u8("resolv_list_size", 0444, hdev->debugfs,
net/bluetooth/hci_event.c +35 -35
179 lines not on this page · raw message
net/bluetooth/hci_request.c +45 -44
237 lines not on this page · raw message
net/bluetooth/hci_sock.c +6 -6
@@ -897,7 +897,7 @@ static int hci_sock_release(struct socket *sock)return 0 ; } -static int hci_sock_blacklist_add (struct hci_dev *hdev,void __user *arg) +static int hci_sock_reject_list_add (struct hci_dev *hdev,void __user *arg) {bdaddr_t bdaddr;int err;
@@ -907,14 +907,14 @@ static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)hci_dev_lock (hdev); - err =hci_bdaddr_list_add (&hdev->blacklist, &bdaddr,BDADDR_BREDR ); + err =hci_bdaddr_list_add (&hdev->reject_list, &bdaddr,BDADDR_BREDR );hci_dev_unlock (hdev);return err; } -static int hci_sock_blacklist_del (struct hci_dev *hdev,void __user *arg) +static int hci_sock_reject_list_del (struct hci_dev *hdev,void __user *arg) {bdaddr_t bdaddr;int err;
@@ -924,7 +924,7 @@ static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)hci_dev_lock (hdev); - err =hci_bdaddr_list_del (&hdev->blacklist, &bdaddr,BDADDR_BREDR ); + err =hci_bdaddr_list_del (&hdev->reject_list, &bdaddr,BDADDR_BREDR );hci_dev_unlock (hdev);
@@ -964,12 +964,12 @@ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,case HCIBLOCKADDR :if (!capable (CAP_NET_ADMIN ))return -EPERM ; -return hci_sock_blacklist_add (hdev, (void __user *)arg); +return hci_sock_reject_list_add (hdev, (void __user *)arg);case HCIUNBLOCKADDR :if (!capable (CAP_NET_ADMIN ))return -EPERM ; -return hci_sock_blacklist_del (hdev, (void __user *)arg); +return hci_sock_reject_list_del (hdev, (void __user *)arg); }return -ENOIOCTLCMD ;
net/bluetooth/l2cap_core.c +2 -2
@@ -7652,7 +7652,7 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)* at least ensure that we ignore incoming data from them. */ if (hcon->type ==LE_LINK && -hci_bdaddr_list_lookup (&hcon->hdev->blacklist, &hcon->dst, +hci_bdaddr_list_lookup (&hcon->hdev->reject_list, &hcon->dst,bdaddr_dst_type (hcon))) {kfree_skb (skb);return ;
@@ -8108,7 +8108,7 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) dst_type =bdaddr_dst_type (hcon);/* If device is blocked, do not create channels for it */ -if (hci_bdaddr_list_lookup (&hdev->blacklist, &hcon->dst, dst_type)) +if (hci_bdaddr_list_lookup (&hdev->reject_list, &hcon->dst, dst_type))return ;/* Find fixed channels and notify them of the new connection. We
net/bluetooth/mgmt.c +7 -7
@@ -4041,7 +4041,7 @@ static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,memset (&rp,0 ,sizeof (rp));if (cp->addr.type ==BDADDR_BREDR ) { - br_params =hci_bdaddr_list_lookup_with_flags (&hdev->whitelist, + br_params =hci_bdaddr_list_lookup_with_flags (&hdev->accept_list, &cp->addr.bdaddr, cp->addr.type);if (!br_params)
@@ -4109,7 +4109,7 @@ static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,hci_dev_lock (hdev);if (cp->addr.type ==BDADDR_BREDR ) { - br_params =hci_bdaddr_list_lookup_with_flags (&hdev->whitelist, + br_params =hci_bdaddr_list_lookup_with_flags (&hdev->accept_list, &cp->addr.bdaddr, cp->addr.type);
@@ -4979,7 +4979,7 @@ static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,hci_dev_lock (hdev); - err =hci_bdaddr_list_add (&hdev->blacklist, &cp->addr.bdaddr, + err =hci_bdaddr_list_add (&hdev->reject_list, &cp->addr.bdaddr, cp->addr.type);if (err <0 ) { status =MGMT_STATUS_FAILED ;
@@ -5015,7 +5015,7 @@ static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,hci_dev_lock (hdev); - err =hci_bdaddr_list_del (&hdev->blacklist, &cp->addr.bdaddr, + err =hci_bdaddr_list_del (&hdev->reject_list, &cp->addr.bdaddr, cp->addr.type);if (err <0 ) { status =MGMT_STATUS_INVALID_PARAMS ;
@@ -6506,7 +6506,7 @@ static int add_device(struct sock *sk, struct hci_dev *hdev, goto unlock; } - err =hci_bdaddr_list_add_with_flags (&hdev->whitelist, + err =hci_bdaddr_list_add_with_flags (&hdev->accept_list, &cp->addr.bdaddr, cp->addr.type,0 );if (err)
@@ -6604,7 +6604,7 @@ static int remove_device(struct sock *sk, struct hci_dev *hdev, }if (cp->addr.type ==BDADDR_BREDR ) { - err =hci_bdaddr_list_del (&hdev->whitelist, + err =hci_bdaddr_list_del (&hdev->accept_list, &cp->addr.bdaddr, cp->addr.type);if (err) {
@@ -6675,7 +6675,7 @@ static int remove_device(struct sock *sk, struct hci_dev *hdev, goto unlock; } -list_for_each_entry_safe (b, btmp, &hdev->whitelist, list) { +list_for_each_entry_safe (b, btmp, &hdev->accept_list, list) {device_removed (sk, hdev, &b->bdaddr, b->bdaddr_type);list_del (&b->list);kfree (b);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 221/452 Bluetooth: use hdev lock for accept_list and reject_list in conn req
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit fb048cae51bacdfbbda2954af3c213fdb1d484f4 ]
All accesses (both reads and modifications) to hdev->{accept,reject}_list are protected by hdev lock, except the ones in hci_conn_request_evt. This can cause a race condition in the form of a list corruption.
The solution is to protect these lists in hci_conn_request_evt as well.
I was unable to find the exact commit that introduced the issue for the reject list, I was only able to find it for the accept list.
--- net/bluetooth/hci_event.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/bluetooth/hci_event.c +9 -6
@@ -2709,10 +2709,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)return ; } +hci_dev_lock (hdev); +if (hci_bdaddr_list_lookup (&hdev->reject_list, &ev->bdaddr,BDADDR_BREDR )) {hci_reject_conn (hdev, &ev->bdaddr); -return ; + goto unlock; }/* Require HCI_CONNECTABLE or an accept list entry to accept the
@@ -2724,13 +2726,11 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr, BDADDR_BREDR)) {hci_reject_conn (hdev, &ev->bdaddr); -return ; + goto unlock; }/* Connection accepted */ -hci_dev_lock (hdev); - ie =hci_inquiry_cache_lookup (hdev, &ev->bdaddr);if (ie)memcpy (ie->data.dev_class, ev->dev_class,3 );
@@ -2742,8 +2742,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) HCI_ROLE_SLAVE);if (!conn) {bt_dev_err (hdev,"no memory for new connection" ); -hci_dev_unlock (hdev); -return ; + goto unlock; } }
@@ -2783,6 +2782,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) conn->state =BT_CONNECT2 ;hci_connect_cfm (conn,0 ); } + +return ; +unlock: +hci_dev_unlock (hdev); }static u8 hci_to_mgmt_reason (u8 err)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 222/452 nvme: set dma alignment to dword
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit 52fde2c07da606f3f120af4f734eadcfb52b04be ]
The nvme specification only requires qword alignment for segment descriptors, and the driver already guarantees that. The spec has always allowed user data to be dword aligned, which is what the queue's attribute is for, so relax the alignment requirement to that value.
While we could allow byte alignment for some controllers when using SGLs, we still need to support PRP, and that only allows dword.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -2024,7 +2024,7 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,blk_queue_max_segments (q,min_t (u32, max_segments,USHRT_MAX )); }blk_queue_virt_boundary (q,NVME_CTRL_PAGE_SIZE -1 ); -blk_queue_dma_alignment (q,7 ); +blk_queue_dma_alignment (q,3 );blk_queue_write_cache (q, vwc, vwc); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 223/452 m68k: math-emu: Fix dependencies of math emulation support
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit ed6bc6bf0a7d75e80eb1df883c09975ebb74e590 ]
If CONFIG_M54xx=y, CONFIG_MMU=y, and CONFIG_M68KFPU_EMU=y:
{standard input}:272: Error: invalid instruction for this architecture; needs 68000 or higher (68000 [68ec000, 68hc000, 68hc001, 68008, 68302, 68306, 68307, 68322, 68356], 68010, 68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060], cpu32 [68330, 68331, 68332, 68333, 68334, 68336, 68340, 68341, 68349, 68360], fidoa [fido]) -- statement `sub.b %d1,%d3' ignored
{standard input}:609: Error: invalid instruction for this architecture; needs 68020 or higher (68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060]) -- statement `bfextu 4(%a1){%d0,#8},%d0' ignored
{standard input}:752: Error: operands mismatch -- statement `mulu.l 4(%a0),%d3:%d0' ignored
{standard input}:1155: Error: operands mismatch -- statement `divu.l %d0,%d3:%d7' ignoredThe math emulation support code is intended for 68020 and higher, and uses several instructions or instruction modes not available on coldfire or 68000.
Originally, the dependency of M68KFPU_EMU on MMU was fine, as MMU support was only available on 68020 or higher. But this assumption was broken by the introduction of MMU support for M547x and M548x.
Drop the dependency on MMU, as the code should work fine on 68020 and up without MMU (which are not yet supported by Linux, though). Add dependencies on M68KCLASSIC (to rule out Coldfire) and FPU (kernel has some type of floating-point support --- be it hardware or software emulated, to rule out anything below 68020).
--- arch/m68k/Kconfig.cpu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/Kconfig.cpu +1 -1
@@ -312,7 +312,7 @@ comment "Processor Specific Options" config M68KFPU_EMU bool "Math emulation support" - depends on MMU + depends on M68KCLASSIC && FPU help At some point in the future, this will cause floating-point math instructions to be emulated by the kernel on machines that lack a
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 224/452 lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
[ Upstream commit 3df98d79215ace13d1e91ddfc5a67a0f5acbd83f ]
As pointed out by Herbert in a recent related patch, the LSM hooks do not have the necessary address family information to use the flowi struct safely. As none of the LSMs currently use any of the protocol specific flowi information, replace the flowi pointers with pointers to the address family independent flowi_common struct.
--- .../chelsio/inline_crypto/chtls/chtls_cm.c | 2 +- drivers/net/wireguard/socket.c | 4 ++-- include/linux/lsm_hook_defs.h | 4 ++-- include/linux/lsm_hooks.h | 2 +- include/linux/security.h | 23 +++++++++++-------- include/net/flow.h | 10 ++++++++ include/net/route.h | 6 ++--- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 ++--- net/ipv4/icmp.c | 4 ++-- net/ipv4/inet_connection_sock.c | 4 ++-- net/ipv4/ip_output.c | 2 +- net/ipv4/ping.c | 2 +- net/ipv4/raw.c | 2 +- net/ipv4/syncookies.c | 2 +- net/ipv4/udp.c | 2 +- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 6 ++--- net/ipv6/inet6_connection_sock.c | 4 ++-- net/ipv6/netfilter/nf_reject_ipv6.c | 2 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 2 +- net/ipv6/syncookies.c | 2 +- net/ipv6/tcp_ipv6.c | 4 ++-- net/ipv6/udp.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/netfilter/nf_synproxy_core.c | 2 +- net/xfrm/xfrm_state.c | 6 +++-- security/security.c | 17 +++++++------- security/selinux/hooks.c | 4 ++-- security/selinux/include/xfrm.h | 2 +- security/selinux/xfrm.c | 13 ++++++----- 33 files changed, 85 insertions(+), 66 deletions(-)
drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c +1 -1
@@ -1150,7 +1150,7 @@ static struct sock *chtls_recv_sock(struct sock *lsk, fl6.daddr = ip6h->saddr; fl6.fl6_dport =inet_rsk (oreq)->ir_rmt_port; fl6.fl6_sport =htons (inet_rsk (oreq)->ir_num); -security_req_classify_flow (oreq,flowi6_to_flowi (&fl6)); +security_req_classify_flow (oreq,flowi6_to_flowi_common (&fl6)); dst =ip6_dst_lookup_flow (sock_net (lsk), lsk, &fl6,NULL );if (IS_ERR (dst)) goto free_sk;
drivers/net/wireguard/socket.c +2 -2
@@ -49,7 +49,7 @@ static int send4(struct wg_device *wg, struct sk_buff *skb, rt =dst_cache_get_ip4 (cache, &fl.saddr);if (!rt) { -security_sk_classify_flow (sock,flowi4_to_flowi (&fl)); +security_sk_classify_flow (sock,flowi4_to_flowi_common (&fl));if (unlikely (!inet_confirm_addr (sock_net (sock),NULL ,0 , fl.saddr,RT_SCOPE_HOST ))) { endpoint->src4.s_addr =0 ;
@@ -129,7 +129,7 @@ static int send6(struct wg_device *wg, struct sk_buff *skb, dst =dst_cache_get_ip6 (cache, &fl.saddr);if (!dst) { -security_sk_classify_flow (sock,flowi6_to_flowi (&fl)); +security_sk_classify_flow (sock,flowi6_to_flowi_common (&fl));if (unlikely (!ipv6_addr_any (&fl.saddr) && !ipv6_chk_addr (sock_net (sock), &fl.saddr,NULL ,0 ))) { endpoint->src6 = fl.saddr = in6addr_any;
include/linux/lsm_hook_defs.h +2 -2
@@ -311,7 +311,7 @@ LSM_HOOK(int, 0, secmark_relabel_packet, u32 secid) LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_inc, void) LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_dec, void) LSM_HOOK(void, LSM_RET_VOID, req_classify_flow, const struct request_sock *req, - struct flowi *fl) + struct flowi_common *flic) LSM_HOOK(int, 0, tun_dev_alloc_security, void **security) LSM_HOOK(void, LSM_RET_VOID, tun_dev_free_security, void *security)LSM_HOOK (int,0 , tun_dev_create, void)
@@ -351,7 +351,7 @@ LSM_HOOK(int, 0, xfrm_state_delete_security, struct xfrm_state *x) LSM_HOOK(int, 0, xfrm_policy_lookup, struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir) LSM_HOOK(int, 1, xfrm_state_pol_flow_match, struct xfrm_state *x, - struct xfrm_policy *xp, const struct flowi *fl) + struct xfrm_policy *xp, const struct flowi_common *flic) LSM_HOOK(int, 0, xfrm_decode_session, struct sk_buff *skb, u32 *secid, int ckall)#endif /* CONFIG_SECURITY_NETWORK_XFRM */
include/linux/lsm_hooks.h +1 -1
@@ -1105,7 +1105,7 @@* @xfrm_state_pol_flow_match: * @x contains the state to match. * @xp contains the policy to check for a match. -* @fl contains the flow to check for a match. +* @flic contains the flowi_common struct to check for a match. * Return 1 if there is a match. * @xfrm_decode_session: * @skb points to skb to decode.
include/linux/security.h +14 -9
@@ -170,7 +170,7 @@ struct sk_buff;struct sock ;struct sockaddr ;struct socket ; -struct flowi ; +struct flowi_common ;struct dst_entry ;struct xfrm_selector ;struct xfrm_policy ;
@@ -1363,8 +1363,9 @@ int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, uint security_sk_alloc (struct sock *sk,int family,gfp_t priority);void security_sk_free (struct sock *sk);void security_sk_clone (const struct sock *sk,struct sock *newsk); -void security_sk_classify_flow (struct sock *sk,struct flowi *fl); -void security_req_classify_flow (const struct request_sock *req,struct flowi *fl); +void security_sk_classify_flow (struct sock *sk,struct flowi_common *flic); +void security_req_classify_flow (const struct request_sock *req, +struct flowi_common *flic);void security_sock_graft (struct sock *sk,struct socket *parent);int security_inet_conn_request (struct sock *sk,struct sk_buff *skb,struct request_sock *req);
@@ -1515,11 +1516,13 @@ static inline void security_sk_clone(const struct sock *sk, struct sock *newsk) { } -static inline void security_sk_classify_flow (struct sock *sk,struct flowi *fl) +static inline void security_sk_classify_flow (struct sock *sk, +struct flowi_common *flic) { } -static inline void security_req_classify_flow (const struct request_sock *req,struct flowi *fl) +static inline void security_req_classify_flow (const struct request_sock *req, +struct flowi_common *flic) { }
@@ -1646,9 +1649,9 @@ void security_xfrm_state_free(struct xfrm_state *x);int security_xfrm_policy_lookup (struct xfrm_sec_ctx *ctx,u32 fl_secid,u8 dir);int security_xfrm_state_pol_flow_match (struct xfrm_state *x,struct xfrm_policy *xp, -const struct flowi *fl); +const struct flowi_common *flic);int security_xfrm_decode_session (struct sk_buff *skb,u32 *secid); -void security_skb_classify_flow (struct sk_buff *skb,struct flowi *fl); +void security_skb_classify_flow (struct sk_buff *skb,struct flowi_common *flic);#else /* CONFIG_SECURITY_NETWORK_XFRM */
@@ -1700,7 +1703,8 @@ static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_s }static inline int security_xfrm_state_pol_flow_match (struct xfrm_state *x, -struct xfrm_policy *xp,const struct flowi *fl) +struct xfrm_policy *xp, +const struct flowi_common *flic) {return 1 ; }
@@ -1710,7 +1714,8 @@ static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)return 0 ; } -static inline void security_skb_classify_flow (struct sk_buff *skb,struct flowi *fl) +static inline void security_skb_classify_flow (struct sk_buff *skb, +struct flowi_common *flic) { }
include/net/flow.h +10 -0
@@ -195,11 +195,21 @@ static inline struct flowi *flowi4_to_flowi(struct flowi4 *fl4) return container_of(fl4, struct flowi, u.ip4); } +static inline struct flowi_common *flowi4_to_flowi_common (struct flowi4 *fl4) +{ +return &(flowi4_to_flowi (fl4)->u.__fl_common); +} +static inline struct flowi *flowi6_to_flowi (struct flowi6 *fl6) { return container_of(fl6, struct flowi, u.ip6); } +static inline struct flowi_common *flowi6_to_flowi_common (struct flowi6 *fl6) +{ +return &(flowi6_to_flowi (fl6)->u.__fl_common); +} +static inline struct flowi *flowidn_to_flowi (struct flowidn *fldn) { return container_of(fldn, struct flowi, u.dn);
include/net/route.h +3 -3
@@ -165,7 +165,7 @@ static inline struct rtable *ip_route_output_ports(struct net *net, struct flowi sk ?inet_sk_flowi_flags (sk) :0 , daddr, saddr, dport, sport, sock_net_uid(net, sk));if (sk) -security_sk_classify_flow (sk,flowi4_to_flowi (fl4)); +security_sk_classify_flow (sk,flowi4_to_flowi_common (fl4));return ip_route_output_flow (net, fl4, sk); }
@@ -322,7 +322,7 @@ static inline struct rtable *ip_route_connect(struct flowi4 *fl4,ip_rt_put (rt);flowi4_update_output (fl4, oif, tos, fl4->daddr, fl4->saddr); } -security_sk_classify_flow (sk,flowi4_to_flowi (fl4)); +security_sk_classify_flow (sk,flowi4_to_flowi_common (fl4));return ip_route_output_flow (net, fl4, sk); }
@@ -338,7 +338,7 @@ static inline struct rtable *ip_route_newports(struct flowi4 *fl4, struct rtableflowi4_update_output (fl4, sk->sk_bound_dev_if,RT_CONN_FLAGS (sk), fl4->daddr, fl4->saddr); -security_sk_classify_flow (sk,flowi4_to_flowi (fl4)); +security_sk_classify_flow (sk,flowi4_to_flowi_common (fl4));return ip_route_output_flow (sock_net (sk), fl4, sk); }return rt;
net/dccp/ipv4.c +1 -1
@@ -464,7 +464,7 @@ static struct dst_entry* dccp_v4_route_skb(struct net *net, struct sock *sk, .fl4_dport = dccp_hdr(skb)->dccph_sport, }; -security_skb_classify_flow (skb,flowi4_to_flowi (&fl4)); +security_skb_classify_flow (skb,flowi4_to_flowi_common (&fl4)); rt =ip_route_output_flow (net, &fl4, sk);if (IS_ERR (rt)) {IP_INC_STATS (net,IPSTATS_MIB_OUTNOROUTES );
net/dccp/ipv6.c +3 -3
@@ -203,7 +203,7 @@ static int dccp_v6_send_response(const struct sock *sk, struct request_sock *req fl6.flowi6_oif = ireq->ir_iif; fl6.fl6_dport = ireq->ir_rmt_port; fl6.fl6_sport =htons (ireq->ir_num); -security_req_classify_flow (req,flowi6_to_flowi (&fl6)); +security_req_classify_flow (req,flowi6_to_flowi_common (&fl6));rcu_read_lock ();
@@ -279,7 +279,7 @@ static void dccp_v6_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb) fl6.flowi6_oif =inet6_iif (rxskb); fl6.fl6_dport =dccp_hdr (skb)->dccph_dport; fl6.fl6_sport =dccp_hdr (skb)->dccph_sport; -security_skb_classify_flow (rxskb,flowi6_to_flowi (&fl6)); +security_skb_classify_flow (rxskb,flowi6_to_flowi_common (&fl6));/* sk = NULL, but it is safe for now. RST socket required. */ dst =ip6_dst_lookup_flow (sock_net (ctl_sk), ctl_sk, &fl6,NULL );
@@ -912,7 +912,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr, fl6.flowi6_oif = sk->sk_bound_dev_if; fl6.fl6_dport = usin->sin6_port; fl6.fl6_sport = inet->inet_sport; -security_sk_classify_flow (sk,flowi6_to_flowi (&fl6)); +security_sk_classify_flow (sk,flowi6_to_flowi_common (&fl6)); opt =rcu_dereference_protected (np->opt,lockdep_sock_is_held (sk)); final_p =fl6_update_dst (&fl6, opt, &final);
net/ipv4/icmp.c +2 -2
@@ -447,7 +447,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb) fl4.flowi4_tos =RT_TOS (ip_hdr (skb)->tos); fl4.flowi4_proto =IPPROTO_ICMP ; fl4.flowi4_oif =l3mdev_master_ifindex (skb->dev); -security_skb_classify_flow (skb,flowi4_to_flowi (&fl4)); +security_skb_classify_flow (skb,flowi4_to_flowi_common (&fl4)); rt =ip_route_output_key (net, &fl4);if (IS_ERR (rt)) goto out_unlock;
@@ -503,7 +503,7 @@ static struct rtable *icmp_route_lookup(struct net *net, route_lookup_dev =icmp_get_route_lookup_dev (skb_in); fl4->flowi4_oif =l3mdev_master_ifindex (route_lookup_dev); -security_skb_classify_flow (skb_in,flowi4_to_flowi (fl4)); +security_skb_classify_flow (skb_in,flowi4_to_flowi_common (fl4)); rt =ip_route_output_key_hash (net, fl4, skb_in);if (IS_ERR (rt))return rt;
net/ipv4/inet_connection_sock.c +2 -2
@@ -602,7 +602,7 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk, (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr, ireq->ir_loc_addr, ireq->ir_rmt_port, htons(ireq->ir_num), sk->sk_uid); -security_req_classify_flow (req,flowi4_to_flowi (fl4)); +security_req_classify_flow (req,flowi4_to_flowi_common (fl4)); rt =ip_route_output_flow (net, fl4, sk);if (IS_ERR (rt)) goto no_route;
@@ -640,7 +640,7 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk, (opt && opt->opt.srr) ? opt->opt.faddr : ireq->ir_rmt_addr, ireq->ir_loc_addr, ireq->ir_rmt_port, htons(ireq->ir_num), sk->sk_uid); -security_req_classify_flow (req,flowi4_to_flowi (fl4)); +security_req_classify_flow (req,flowi4_to_flowi_common (fl4)); rt =ip_route_output_flow (net, fl4, sk);if (IS_ERR (rt)) goto no_route;
net/ipv4/ip_output.c +1 -1
@@ -1712,7 +1712,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, daddr, saddr,tcp_hdr (skb)->source,tcp_hdr (skb)->dest, arg->uid); -security_skb_classify_flow (skb,flowi4_to_flowi (&fl4)); +security_skb_classify_flow (skb,flowi4_to_flowi_common (&fl4)); rt =ip_route_output_key (net, &fl4);if (IS_ERR (rt))return ;
net/ipv4/ping.c +1 -1
@@ -796,7 +796,7 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) fl4.fl4_icmp_type = user_icmph.type; fl4.fl4_icmp_code = user_icmph.code; -security_sk_classify_flow (sk,flowi4_to_flowi (&fl4)); +security_sk_classify_flow (sk,flowi4_to_flowi_common (&fl4)); rt =ip_route_output_flow (net, &fl4, sk);if (IS_ERR (rt)) { err =PTR_ERR (rt);
net/ipv4/raw.c +1 -1
@@ -640,7 +640,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) goto done; } -security_sk_classify_flow (sk,flowi4_to_flowi (&fl4)); +security_sk_classify_flow (sk,flowi4_to_flowi_common (&fl4)); rt =ip_route_output_flow (net, &fl4, sk);if (IS_ERR (rt)) { err =PTR_ERR (rt);
net/ipv4/syncookies.c +1 -1
@@ -424,7 +424,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)inet_sk_flowi_flags (sk), opt->srr ? opt->faddr : ireq->ir_rmt_addr, ireq->ir_loc_addr, th->source, th->dest, sk->sk_uid); -security_req_classify_flow (req,flowi4_to_flowi (&fl4)); +security_req_classify_flow (req,flowi4_to_flowi_common (&fl4)); rt =ip_route_output_key (sock_net (sk), &fl4);if (IS_ERR (rt)) {reqsk_free (req);
net/ipv4/udp.c +1 -1
@@ -1204,7 +1204,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) faddr, saddr, dport, inet->inet_sport, sk->sk_uid); -security_sk_classify_flow (sk,flowi4_to_flowi (fl4)); +security_sk_classify_flow (sk,flowi4_to_flowi_common (fl4)); rt =ip_route_output_flow (net, fl4, sk);if (IS_ERR (rt)) { err =PTR_ERR (rt);
net/ipv6/af_inet6.c +1 -1
@@ -819,7 +819,7 @@ int inet6_sk_rebuild_header(struct sock *sk) fl6.fl6_dport = inet->inet_dport; fl6.fl6_sport = inet->inet_sport; fl6.flowi6_uid = sk->sk_uid; -security_sk_classify_flow (sk,flowi6_to_flowi (&fl6)); +security_sk_classify_flow (sk,flowi6_to_flowi_common (&fl6));rcu_read_lock (); final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt),
net/ipv6/datagram.c +1 -1
@@ -60,7 +60,7 @@ static void ip6_datagram_flow_key_init(struct flowi6 *fl6, struct sock *sk)if (!fl6->flowi6_oif &&ipv6_addr_is_multicast (&fl6->daddr)) fl6->flowi6_oif = np->mcast_oif; -security_sk_classify_flow (sk,flowi6_to_flowi (fl6)); +security_sk_classify_flow (sk,flowi6_to_flowi_common (fl6)); }int ip6_datagram_dst_update (struct sock *sk,bool fix_sk_saddr)
net/ipv6/icmp.c +3 -3
@@ -573,7 +573,7 @@ void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, fl6.fl6_icmp_code = code; fl6.flowi6_uid =sock_net_uid (net,NULL ); fl6.mp_hash =rt6_multipath_hash (net, &fl6, skb,NULL ); -security_skb_classify_flow (skb,flowi6_to_flowi (&fl6)); +security_skb_classify_flow (skb,flowi6_to_flowi_common (&fl6)); np =inet6_sk (sk);
@@ -755,7 +755,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb) fl6.fl6_icmp_type =ICMPV6_ECHO_REPLY ; fl6.flowi6_mark = mark; fl6.flowi6_uid =sock_net_uid (net,NULL ); -security_skb_classify_flow (skb,flowi6_to_flowi (&fl6)); +security_skb_classify_flow (skb,flowi6_to_flowi_common (&fl6));local_bh_disable (); sk =icmpv6_xmit_lock (net);
@@ -1008,7 +1008,7 @@ void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6, fl6->fl6_icmp_type = type; fl6->fl6_icmp_code =0 ; fl6->flowi6_oif = oif; -security_sk_classify_flow (sk,flowi6_to_flowi (fl6)); +security_sk_classify_flow (sk,flowi6_to_flowi_common (fl6)); } static void __net_exit icmpv6_sk_exit(struct net *net)
net/ipv6/inet6_connection_sock.c +2 -2
@@ -46,7 +46,7 @@ struct dst_entry *inet6_csk_route_req(const struct sock *sk, fl6->fl6_dport = ireq->ir_rmt_port; fl6->fl6_sport =htons (ireq->ir_num); fl6->flowi6_uid = sk->sk_uid; -security_req_classify_flow (req,flowi6_to_flowi (fl6)); +security_req_classify_flow (req,flowi6_to_flowi_common (fl6)); dst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_p);if (IS_ERR (dst))
@@ -95,7 +95,7 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk, fl6->fl6_sport = inet->inet_sport; fl6->fl6_dport = inet->inet_dport; fl6->flowi6_uid = sk->sk_uid; -security_sk_classify_flow (sk,flowi6_to_flowi (fl6)); +security_sk_classify_flow (sk,flowi6_to_flowi_common (fl6));rcu_read_lock (); final_p =fl6_update_dst (fl6,rcu_dereference (np->opt), &final);
net/ipv6/netfilter/nf_reject_ipv6.c +1 -1
@@ -179,7 +179,7 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook) fl6.flowi6_oif =l3mdev_master_ifindex (skb_dst (oldskb)->dev); fl6.flowi6_mark =IP6_REPLY_MARK (net, oldskb->mark); -security_skb_classify_flow (oldskb,flowi6_to_flowi (&fl6)); +security_skb_classify_flow (oldskb,flowi6_to_flowi_common (&fl6)); dst =ip6_route_output (net,NULL , &fl6);if (dst->error) {dst_release (dst);
net/ipv6/ping.c +1 -1
@@ -111,7 +111,7 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) fl6.flowi6_uid = sk->sk_uid; fl6.fl6_icmp_type = user_icmph.icmp6_type; fl6.fl6_icmp_code = user_icmph.icmp6_code; -security_sk_classify_flow (sk,flowi6_to_flowi (&fl6)); +security_sk_classify_flow (sk,flowi6_to_flowi_common (&fl6));ipcm6_init_sk (&ipc6, np); ipc6.sockc.mark = sk->sk_mark;
net/ipv6/raw.c +1 -1
@@ -915,7 +915,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) fl6.flowi6_oif = np->mcast_oif; else if (!fl6.flowi6_oif) fl6.flowi6_oif = np->ucast_oif; -security_sk_classify_flow (sk,flowi6_to_flowi (&fl6)); +security_sk_classify_flow (sk,flowi6_to_flowi_common (&fl6));if (hdrincl) fl6.flowi6_flags |=FLOWI_FLAG_KNOWN_NH ;
net/ipv6/syncookies.c +1 -1
@@ -234,7 +234,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) fl6.fl6_dport = ireq->ir_rmt_port; fl6.fl6_sport =inet_sk (sk)->inet_sport; fl6.flowi6_uid = sk->sk_uid; -security_req_classify_flow (req,flowi6_to_flowi (&fl6)); +security_req_classify_flow (req,flowi6_to_flowi_common (&fl6)); dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst))
net/ipv6/tcp_ipv6.c +2 -2
@@ -278,7 +278,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, opt =rcu_dereference_protected (np->opt,lockdep_sock_is_held (sk)); final_p =fl6_update_dst (&fl6, opt, &final); -security_sk_classify_flow (sk,flowi6_to_flowi (&fl6)); +security_sk_classify_flow (sk,flowi6_to_flowi_common (&fl6)); dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) {
@@ -975,7 +975,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 fl6.fl6_dport = t1->dest; fl6.fl6_sport = t1->source; fl6.flowi6_uid =sock_net_uid (net, sk &&sk_fullsock (sk) ? sk :NULL ); -security_skb_classify_flow (skb,flowi6_to_flowi (&fl6)); +security_skb_classify_flow (skb,flowi6_to_flowi_common (&fl6));/* Pass a socket to ip6_dst_lookup either it is for RST * Underlying function will use this to retrieve the network
net/ipv6/udp.c +1 -1
@@ -1497,7 +1497,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) }else if (!fl6.flowi6_oif) fl6.flowi6_oif = np->ucast_oif; -security_sk_classify_flow (sk,flowi6_to_flowi (&fl6)); +security_sk_classify_flow (sk,flowi6_to_flowi_common (&fl6));if (ipc6.tclass <0 ) ipc6.tclass = np->tclass;
net/l2tp/l2tp_ip6.c +1 -1
@@ -606,7 +606,7 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)else if (!fl6.flowi6_oif) fl6.flowi6_oif = np->ucast_oif; -security_sk_classify_flow (sk,flowi6_to_flowi (&fl6)); +security_sk_classify_flow (sk,flowi6_to_flowi_common (&fl6));if (ipc6.tclass <0 ) ipc6.tclass = np->tclass;
net/netfilter/nf_synproxy_core.c +1 -1
@@ -854,7 +854,7 @@ synproxy_send_tcp_ipv6(struct net *net, fl6.fl6_sport = nth->source; fl6.fl6_dport = nth->dest;security_skb_classify_flow ((struct sk_buff *)skb, -flowi6_to_flowi (&fl6)); +flowi6_to_flowi_common (&fl6)); err =nf_ip6_route (net, &dst,flowi6_to_flowi (&fl6), false);if (err) { goto free_nskb;
net/xfrm/xfrm_state.c +4 -2
@@ -1020,7 +1020,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,if ((x->sel.family && (x->sel.family != family || !xfrm_selector_match (&x->sel, fl, family))) || - !security_xfrm_state_pol_flow_match (x, pol, fl)) + !security_xfrm_state_pol_flow_match (x, pol, + &fl->u.__fl_common))return ; if (!*best ||
@@ -1035,7 +1036,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,if ((!x->sel.family || (x->sel.family == family &&xfrm_selector_match (&x->sel, fl, family))) && -security_xfrm_state_pol_flow_match (x, pol, fl)) +security_xfrm_state_pol_flow_match (x, pol, + &fl->u.__fl_common)) *error = -ESRCH ; } }
security/security.c +9 -8
@@ -2223,15 +2223,16 @@ void security_sk_clone(const struct sock *sk, struct sock *newsk) }EXPORT_SYMBOL (security_sk_clone); -void security_sk_classify_flow (struct sock *sk,struct flowi *fl) +void security_sk_classify_flow (struct sock *sk,struct flowi_common *flic) { -call_void_hook (sk_getsecid, sk, &fl->flowi_secid); +call_void_hook (sk_getsecid, sk, &flic->flowic_secid); }EXPORT_SYMBOL (security_sk_classify_flow); -void security_req_classify_flow (const struct request_sock *req,struct flowi *fl) +void security_req_classify_flow (const struct request_sock *req, +struct flowi_common *flic) { -call_void_hook (req_classify_flow, req, fl); +call_void_hook (req_classify_flow, req, flic); }EXPORT_SYMBOL (security_req_classify_flow);
@@ -2423,7 +2424,7 @@ int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)int security_xfrm_state_pol_flow_match (struct xfrm_state *x,struct xfrm_policy *xp, -const struct flowi *fl) +const struct flowi_common *flic) {struct security_hook_list *hp;int rc =LSM_RET_DEFAULT (xfrm_state_pol_flow_match);
@@ -2439,7 +2440,7 @@ int security_xfrm_state_pol_flow_match(struct xfrm_state *x,*/ hlist_for_each_entry (hp, &security_hook_heads.xfrm_state_pol_flow_match, list) { - rc = hp->hook.xfrm_state_pol_flow_match (x, xp, fl); + rc = hp->hook.xfrm_state_pol_flow_match (x, xp, flic);break ; }return rc;
@@ -2450,9 +2451,9 @@ int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)return call_int_hook (xfrm_decode_session,0 , skb, secid,1 ); } -void security_skb_classify_flow (struct sk_buff *skb,struct flowi *fl) +void security_skb_classify_flow (struct sk_buff *skb,struct flowi_common *flic) { -int rc =call_int_hook (xfrm_decode_session,0 , skb, &fl->flowi_secid, +int rc =call_int_hook (xfrm_decode_session,0 , skb, &flic->flowic_secid,0 );BUG_ON (rc);
security/selinux/hooks.c +2 -2
@@ -5448,9 +5448,9 @@ static void selinux_secmark_refcount_dec(void) }static void selinux_req_classify_flow (const struct request_sock *req, -struct flowi *fl) +struct flowi_common *flic) { - fl->flowi_secid = req->secid; + flic->flowic_secid = req->secid; }static int selinux_tun_dev_alloc_security (void **security)
security/selinux/include/xfrm.h +1 -1
@@ -26,7 +26,7 @@ int selinux_xfrm_state_delete(struct xfrm_state *x);int selinux_xfrm_policy_lookup (struct xfrm_sec_ctx *ctx,u32 fl_secid,u8 dir);int selinux_xfrm_state_pol_flow_match (struct xfrm_state *x,struct xfrm_policy *xp, -const struct flowi *fl); +const struct flowi_common *flic);#ifdef CONFIG_SECURITY_NETWORK_XFRM extern atomic_t selinux_xfrm_refcount;
security/selinux/xfrm.c +7 -6
@@ -175,9 +175,10 @@ int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)*/ int selinux_xfrm_state_pol_flow_match (struct xfrm_state *x,struct xfrm_policy *xp, -const struct flowi *fl) +const struct flowi_common *flic) {u32 state_sid; +u32 flic_sid;if (!xp->security)if (x->security)
@@ -196,17 +197,17 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,return 0 ; state_sid = x->security->ctx_sid; + flic_sid = flic->flowic_secid; -if (fl->flowi_secid != state_sid) +if (flic_sid != state_sid)return 0 ;/* We don't need a separate SA Vs. policy polmatch check since the SA * is now of the same label as the flow and a flow Vs. policy polmatch * check had already happened in selinux_xfrm_policy_lookup() above. */ -return (avc_has_perm (&selinux_state, - fl->flowi_secid, state_sid, -SECCLASS_ASSOCIATION ,ASSOCIATION__SENDTO , -NULL ) ?0 :1 ); +return (avc_has_perm (&selinux_state, flic_sid, state_sid, +SECCLASS_ASSOCIATION ,ASSOCIATION__SENDTO , +NULL ) ?0 :1 ); }static u32 selinux_xfrm_skb_sid_egress (struct sk_buff *skb)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 225/452 sctp: read sk->sk_bound_dev_if once in sctp_rcv()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a20ea298071f46effa3aaf965bf9bb34c901db3f ]
sctp_rcv() reads sk->sk_bound_dev_if twice while the socket is not locked. Another cpu could change this field under us.
--- net/sctp/input.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sctp/input.c +3 -1
@@ -92,6 +92,7 @@ int sctp_rcv(struct sk_buff *skb)struct sctp_chunk *chunk;union sctp_addr src;union sctp_addr dest; +int bound_dev_if;int family;struct sctp_af *af;struct net *net =dev_net (skb->dev);
@@ -169,7 +170,8 @@ int sctp_rcv(struct sk_buff *skb)* If a frame arrives on an interface and the receiving socket is * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB */ -if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif (skb))) { + bound_dev_if =READ_ONCE (sk->sk_bound_dev_if); +if (bound_dev_if && (bound_dev_if != af->skb_iif (skb))) {if (transport) {sctp_transport_put (transport); asoc =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 226/452 net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init
In reply to Greg Kroah-HartmanFrom: Zheng Bin <[email protected]>
[ Upstream commit 382d917bfc1e92339dae3c8a636b2730e8bb5132 ]
hinic_pf_to_mgmt_init misses destroy_workqueue in error path, this patch fixes that.
--- drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c +2 -0
@@ -647,6 +647,7 @@ int hinic_pf_to_mgmt_init(struct hinic_pf_to_mgmt *pf_to_mgmt, err =alloc_msg_buf (pf_to_mgmt);if (err) {dev_err (&pdev->dev,"Failed to allocate msg buffers\n" ); +destroy_workqueue (pf_to_mgmt->workq);hinic_health_reporters_destroy (hwdev->devlink_dev);return err; }
@@ -654,6 +655,7 @@ int hinic_pf_to_mgmt_init(struct hinic_pf_to_mgmt *pf_to_mgmt, err =hinic_api_cmd_init (pf_to_mgmt->cmd_chain, hwif);if (err) {dev_err (&pdev->dev,"Failed to initialize cmd chains\n" ); +destroy_workqueue (pf_to_mgmt->workq);hinic_health_reporters_destroy (hwdev->devlink_dev);return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 227/452 ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit a34840c4eb3278a7c29c9c57a65ce7541c66f9f2 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- sound/soc/ti/j721e-evm.c | 44 ++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 11 deletions(-)
sound/soc/ti/j721e-evm.c +33 -11
@@ -631,17 +631,18 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, codec_node =of_parse_phandle (node,"ti,cpb-codec" ,0 );if (!codec_node) {dev_err (priv->dev,"CPB codec node is not provided\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_dai_node; } domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_CPB ]; ret =j721e_get_clocks (priv->dev, &domain->codec,"cpb-codec-scki" );if (ret) -return ret; + goto put_codec_node; ret =j721e_get_clocks (priv->dev, &domain->mcasp,"cpb-mcasp-auxclk" );if (ret) -return ret; + goto put_codec_node;/* * Common Processor Board, two links
@@ -651,8 +652,10 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, comp_count =6 ; compnent =devm_kzalloc (priv->dev, comp_count *sizeof (*compnent),GFP_KERNEL ); -if (!compnent) -return -ENOMEM ; +if (!compnent) { + ret = -ENOMEM ; + goto put_codec_node; + } comp_idx =0 ; priv->dai_links[*link_idx].cpus = &compnent[comp_idx++];
@@ -703,6 +706,12 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, (*conf_idx)++;return 0 ; + +put_codec_node: +of_node_put (codec_node); +put_dai_node: +of_node_put (dai_node); +return ret; } static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx,
@@ -727,23 +736,25 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, codeca_node =of_parse_phandle (node,"ti,ivi-codec-a" ,0 );if (!codeca_node) {dev_err (priv->dev,"IVI codec-a node is not provided\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_dai_node; } codecb_node =of_parse_phandle (node,"ti,ivi-codec-b" ,0 );if (!codecb_node) {dev_warn (priv->dev,"IVI codec-b node is not provided\n" ); -return 0 ; + ret =0 ; + goto put_codeca_node; } domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_IVI ]; ret =j721e_get_clocks (priv->dev, &domain->codec,"ivi-codec-scki" );if (ret) -return ret; + goto put_codecb_node; ret =j721e_get_clocks (priv->dev, &domain->mcasp,"ivi-mcasp-auxclk" );if (ret) -return ret; + goto put_codecb_node;/* * IVI extension, two links
@@ -755,8 +766,10 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, comp_count =8 ; compnent =devm_kzalloc (priv->dev, comp_count *sizeof (*compnent),GFP_KERNEL ); -if (!compnent) -return -ENOMEM ; +if (!compnent) { + ret = -ENOMEM ; + goto put_codecb_node; + } comp_idx =0 ; priv->dai_links[*link_idx].cpus = &compnent[comp_idx++];
@@ -817,6 +830,15 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, (*conf_idx)++;return 0 ; + + +put_codecb_node: +of_node_put (codecb_node); +put_codeca_node: +of_node_put (codeca_node); +put_dai_node: +of_node_put (dai_node); +return ret; }static int j721e_soc_probe (struct platform_device *pdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 228/452 media: ov7670: remove ov7670_power_off from ov7670_remove
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 5bf19572e31375368f19edd2dbb2e0789518bb99 ]
In ov7670_probe, it always invokes ov7670_power_off() no matter the execution is successful or failed. So we cannot invoke it agiain in ov7670_remove().
Fix this by removing ov7670_power_off from ov7670_remove.
--- drivers/media/i2c/ov7670.c | 1 - 1 file changed, 1 deletion(-)
drivers/media/i2c/ov7670.c +0 -1
@@ -2000,7 +2000,6 @@ static int ov7670_remove(struct i2c_client *client)v4l2_async_unregister_subdev (sd);v4l2_ctrl_handler_free (&info->hdl);media_entity_cleanup (&info->sd.entity); -ov7670_power_off (sd);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 229/452 media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource()
In reply to Greg Kroah-HartmanFrom: Cai Huoqing <[email protected]>
[ Upstream commit 5a3683d60e56f4faa9552d3efafd87ef106dd393 ]
Use the devm_platform_ioremap_resource() helper instead of calling platform_get_resource() and devm_ioremap_resource() separately
--- drivers/staging/media/rkvdec/rkvdec.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/staging/media/rkvdec/rkvdec.c +1 -3
@@ -1000,7 +1000,6 @@ static const char * const rkvdec_clk_names[] = {static int rkvdec_probe (struct platform_device *pdev) {struct rkvdec_dev *rkvdec; -struct resource *res;unsigned int i;int ret, irq;
@@ -1032,8 +1031,7 @@ static int rkvdec_probe(struct platform_device *pdev)*/ clk_set_rate (rkvdec->clocks[0 ].clk,500 *1000 *1000 ); - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - rkvdec->regs =devm_ioremap_resource (&pdev->dev, res); + rkvdec->regs =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (rkvdec->regs))return PTR_ERR (rkvdec->regs);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 230/452 media: rkvdec: Stop overclocking the decoder
In reply to Greg Kroah-HartmanFrom: Nicolas Dufresne <[email protected]>
[ Upstream commit 9998943f6dfc5d5472bfab2e38527fb6ba5e9da7 ]
While this overclock hack seems to work on some implementations (some ChromeBooks, RockPi4) it also causes instability on other implementations (notably LibreComputer Renegade, but there were more reports in the LibreELEC project, where this has been removed). While performance is indeed affected (tested with GStreamer), 4K playback still works as long as you don't operate in lock step and keep at least 1 frame ahead of time in the decode queue.
After discussion with ChromeOS members, it would seem that their implementation indeed used to synchronously decode each frame, so this hack was simply compensating for their code being less efficient. In my opinion, this hack should not have been included upstream.
--- drivers/staging/media/rkvdec/rkvdec.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/staging/media/rkvdec/rkvdec.c +0 -6
@@ -1025,12 +1025,6 @@ static int rkvdec_probe(struct platform_device *pdev)if (ret)return ret; -/* -* Bump ACLK to max. possible freq. (500 MHz) to improve performance -* When 4k video playback. -*/ -clk_set_rate (rkvdec->clocks[0 ].clk,500 *1000 *1000 ); - rkvdec->regs =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (rkvdec->regs))return PTR_ERR (rkvdec->regs);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 231/452 media: rkvdec: h264: Fix dpb_valid implementation
In reply to Greg Kroah-HartmanFrom: Nicolas Dufresne <[email protected]>
[ Upstream commit 7ab889f09dfa70e8097ec1b9186fd228124112cb ]
The ref builder only provided references that are marked as valid in the dpb. Thus the current implementation of dpb_valid would always set the flag to 1. This is not representing missing frames (this is called 'non-existing' pictures in the spec). In some context, these non-existing pictures still need to occupy a slot in the reference list according to the spec.
--- drivers/staging/media/rkvdec/rkvdec-h264.c | 33 ++++++++++++++++------ 1 file changed, 24 insertions(+), 9 deletions(-)
drivers/staging/media/rkvdec/rkvdec-h264.c +24 -9
@@ -112,6 +112,7 @@ struct rkvdec_h264_run {const struct v4l2_ctrl_h264_sps *sps;const struct v4l2_ctrl_h264_pps *pps;const struct v4l2_ctrl_h264_scaling_matrix *scaling_matrix; +int ref_buf_idx[V4L2_H264_NUM_DPB_ENTRIES ]; };struct rkvdec_h264_ctx {
@@ -725,6 +726,26 @@ static void assemble_hw_pps(struct rkvdec_ctx *ctx, } } +static void lookup_ref_buf_idx (struct rkvdec_ctx *ctx, +struct rkvdec_h264_run *run) +{ +const struct v4l2_ctrl_h264_decode_params *dec_params = run->decode_params; +u32 i; + +for (i =0 ; i <ARRAY_SIZE (dec_params->dpb); i++) { +struct v4l2_m2m_ctx *m2m_ctx = ctx->fh.m2m_ctx; +const struct v4l2_h264_dpb_entry *dpb = run->decode_params->dpb; +struct vb2_queue *cap_q = &m2m_ctx->cap_q_ctx.q; +int buf_idx =-1 ; + +if (dpb[i].flags &V4L2_H264_DPB_ENTRY_FLAG_ACTIVE ) + buf_idx =vb2_find_timestamp (cap_q, + dpb[i].reference_ts,0 ); + + run->ref_buf_idx[i] = buf_idx; + } +} +static void assemble_hw_rps (struct rkvdec_ctx *ctx,struct rkvdec_h264_run *run) {
@@ -762,7 +783,7 @@ static void assemble_hw_rps(struct rkvdec_ctx *ctx,for (j =0 ; j <RKVDEC_NUM_REFLIST ; j++) {for (i =0 ; i < h264_ctx->reflists.num_valid; i++) { -u8 dpb_valid =0 ; +bool dpb_valid = run->ref_buf_idx[i] >=0 ;u8 idx =0 ;switch (j) {
@@ -779,8 +800,6 @@ static void assemble_hw_rps(struct rkvdec_ctx *ctx,if (idx >=ARRAY_SIZE (dec_params->dpb))continue ; - dpb_valid = !!(dpb[idx].flags & -V4L2_H264_DPB_ENTRY_FLAG_ACTIVE );set_ps_field (hw_rps,DPB_INFO (i, j), idx | dpb_valid <<4 );
@@ -859,13 +878,8 @@ get_ref_buf(struct rkvdec_ctx *ctx, struct rkvdec_h264_run *run, unsigned int dpb_idx) {struct v4l2_m2m_ctx *m2m_ctx = ctx->fh.m2m_ctx; -const struct v4l2_h264_dpb_entry *dpb = run->decode_params->dpb;struct vb2_queue *cap_q = &m2m_ctx->cap_q_ctx.q; -int buf_idx =-1 ; - -if (dpb[dpb_idx].flags &V4L2_H264_DPB_ENTRY_FLAG_ACTIVE ) - buf_idx =vb2_find_timestamp (cap_q, - dpb[dpb_idx].reference_ts,0 ); +int buf_idx = run->ref_buf_idx[dpb_idx];/* * If a DPB entry is unused or invalid, address of current destination
@@ -1102,6 +1116,7 @@ static int rkvdec_h264_run(struct rkvdec_ctx *ctx)assemble_hw_scaling_list (ctx, &run);assemble_hw_pps (ctx, &run); +lookup_ref_buf_idx (ctx, &run);assemble_hw_rps (ctx, &run);config_registers (ctx, &run);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 232/452 media: rkvdec: h264: Fix bit depth wrap in pps packet
In reply to Greg Kroah-HartmanFrom: Jonas Karlman <[email protected]>
[ Upstream commit a074aa4760d1dad0bd565c0f66e7250f5f219ab0 ]
The luma and chroma bit depth fields in the pps packet are 3 bits wide. 8 is wrongly added to the bit depth values written to these 3 bit fields. Because only the 3 LSB are written, the hardware was configured correctly.
Correct this by not adding 8 to the luma and chroma bit depth value.
--- drivers/staging/media/rkvdec/rkvdec-h264.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/media/rkvdec/rkvdec-h264.c +2 -2
@@ -662,8 +662,8 @@ static void assemble_hw_pps(struct rkvdec_ctx *ctx,WRITE_PPS (0xff ,PROFILE_IDC );WRITE_PPS (1 ,CONSTRAINT_SET3_FLAG );WRITE_PPS (sps->chroma_format_idc,CHROMA_FORMAT_IDC ); -WRITE_PPS (sps->bit_depth_luma_minus8 +8 ,BIT_DEPTH_LUMA ); -WRITE_PPS (sps->bit_depth_chroma_minus8 +8 ,BIT_DEPTH_CHROMA ); +WRITE_PPS (sps->bit_depth_luma_minus8,BIT_DEPTH_LUMA ); +WRITE_PPS (sps->bit_depth_chroma_minus8,BIT_DEPTH_CHROMA );WRITE_PPS (0 ,QPPRIME_Y_ZERO_TRANSFORM_BYPASS_FLAG );WRITE_PPS (sps->log2_max_frame_num_minus4,LOG2_MAX_FRAME_NUM_MINUS4 );WRITE_PPS (sps->max_num_ref_frames,MAX_NUM_REF_FRAMES );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 233/452 ext4: reject the commit option on ext2 filesystems
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit cb8435dc8ba33bcafa41cf2aa253794320a3b8df ]
The 'commit' option is only applicable for ext3 and ext4 filesystems, and has never been accepted by the ext2 filesystem driver, so the ext4 driver shouldn't allow it on ext2 filesystems.
This fixes a failure in xfstest ext4/053.
--- fs/ext4/super.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/super.c +1 -0
@@ -1960,6 +1960,7 @@ static const struct mount_opts { MOPT_EXT4_ONLY | MOPT_CLEAR}, {Opt_warn_on_error, EXT4_MOUNT_WARN_ON_ERROR, MOPT_SET}, {Opt_nowarn_on_error, EXT4_MOUNT_WARN_ON_ERROR, MOPT_CLEAR}, + {Opt_commit, 0, MOPT_NO_EXT2}, {Opt_nojournal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM, MOPT_EXT4_ONLY | MOPT_CLEAR}, {Opt_journal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 234/452 drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit c56de483093d7ad0782327f95dda7da97bc4c315 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore.
a6xx_gmu_init() passes the node to of_find_device_by_node() and of_dma_configure(), of_find_device_by_node() will takes its reference, of_dma_configure() doesn't need the node after usage.
Add missing of_node_put() to avoid refcount leak.
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +1 -0
@@ -1308,6 +1308,7 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)BUG_ON (!node); ret =a6xx_gmu_init (a6xx_gpu, node); +of_node_put (node);if (ret) {a6xx_destroy (&(a6xx_gpu->base.base));return ERR_PTR (ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 235/452 drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 947a844bb3ebff0f4736d244d792ce129f6700d7 ]
drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo needs to be put when msm_gem_get_and_pin_iova fails.
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +3 -1
@@ -983,8 +983,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc, ret =msm_gem_get_and_pin_iova (cursor_bo, kms->aspace, &mdp5_crtc->cursor.iova); -if (ret) +if (ret) { +drm_gem_object_put (cursor_bo);return -EINVAL ; + }pm_runtime_get_sync (&pdev->dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 236/452 x86/sev: Annotate stack change in the #VC handler
In reply to Greg Kroah-HartmanFrom: Lai Jiangshan <[email protected]>
[ Upstream commit c42b145181aafd59ed31ccd879493389e3ea5a08 ]
In idtentry_vc(), vc_switch_off_ist() determines a safe stack to switch to, off of the IST stack. Annotate the new stack switch with ENCODE_FRAME_POINTER in case UNWINDER_FRAME_POINTER is used.
A stack walk before looks like this:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc7+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl dump_stack kernel_exc_vmm_communication asm_exc_vmm_communication ? native_read_msr ? __x2apic_disable.part.0 ? x2apic_setup ? cpu_init ? trap_init ? start_kernel ? x86_64_start_reservations ? x86_64_start_kernel ? secondary_startup_64_no_verify </TASK>
and with the fix, the stack dump is exact:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc7+ #3 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl dump_stack kernel_exc_vmm_communication asm_exc_vmm_communication RIP: 0010:native_read_msr Code: ... < snipped regs > ? __x2apic_disable.part.0 x2apic_setup cpu_init trap_init start_kernel x86_64_start_reservations x86_64_start_kernel secondary_startup_64_no_verify </TASK>
[ bp: Test in a SEV-ES guest and rewrite the commit message to
explain what exactly this does. ]
--- arch/x86/entry/entry_64.S | 1 + 1 file changed, 1 insertion(+)
arch/x86/entry/entry_64.S +1 -0
@@ -500,6 +500,7 @@ SYM_CODE_START(\asmsym) call vc_switch_off_ist movq %rax, %rsp /* Switch to new stack */ + ENCODE_FRAME_POINTER UNWIND_HINT_REGS /* Update pt_regs */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 237/452 drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path
In reply to Greg Kroah-HartmanFrom: Abhinav Kumar <[email protected]>
[ Upstream commit 64b22a0da12adb571c01edd671ee43634ebd7e41 ]
If there are errors while trying to enable the pm in the bind path, it will lead to unclocked access of hw revision register thereby crashing the device.
This will not address why the pm_runtime_get_sync() fails but at the very least we should be able to prevent the crash by handling the error and bailing out earlier.
changes in v2:
- use pm_runtime_resume_and_get() instead of pm_runtime_get_sync()
Patchwork: https://patchwork.freedesktop.org/patch/486721/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +3 -1
@@ -939,7 +939,9 @@ static int dpu_kms_hw_init(struct msm_kms *kms)dpu_kms_parse_data_bus_icc_path (dpu_kms); -pm_runtime_get_sync (&dpu_kms->pdev->dev); + rc =pm_runtime_resume_and_get (&dpu_kms->pdev->dev); +if (rc <0 ) + goto error; dpu_kms->core_rev =readl_relaxed (dpu_kms->mmio +0x0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 238/452 drm/i915: Fix CFI violation with show_dynamic_id()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 58606220a2f1407a7516c547f09a1ba7b4350a73 ]
When an attribute group is created with sysfs_create_group(), the ->sysfs_ops() callback is set to kobj_sysfs_ops, which sets the ->show() callback to kobj_attr_show(). kobj_attr_show() uses container_of() to get the ->show() callback from the attribute it was passed, meaning the ->show() callback needs to be the same type as the ->show() callback in 'struct kobj_attribute'.
However, show_dynamic_id() has the type of the ->show() callback in 'struct device_attribute', which causes a CFI violation when opening the 'id' sysfs node under drm/card0/metrics. This happens to work because the layout of 'struct kobj_attribute' and 'struct device_attribute' are the same, so the container_of() cast happens to allow the ->show() callback to still work.
Change the type of show_dynamic_id() to match the ->show() callback in 'struct kobj_attributes' and update the type of sysfs_metric_id to match, which resolves the CFI violation.
--- drivers/gpu/drm/i915/i915_perf.c | 4 ++-- drivers/gpu/drm/i915/i915_perf_types.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/i915_perf.c +2 -2
@@ -3964,8 +3964,8 @@ static struct i915_oa_reg *alloc_oa_regs(struct i915_perf *perf,return ERR_PTR (err); } -static ssize_t show_dynamic_id (struct device *dev, -struct device_attribute *attr, +static ssize_t show_dynamic_id (struct kobject *kobj, +struct kobj_attribute *attr,char *buf) { struct i915_oa_config *oa_config =
drivers/gpu/drm/i915/i915_perf_types.h +1 -1
@@ -54,7 +54,7 @@ struct i915_oa_config {struct attribute_group sysfs_metric;struct attribute *attrs[2 ]; -struct device_attribute sysfs_metric_id; +struct kobj_attribute sysfs_metric_id;struct kref ref;struct rcu_head rcu;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 239/452 thermal/drivers/bcm2711: Dont clamp temperature at zero
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 106e0121e243de4da7d634338089a68a8da2abe9 ]
The thermal sensor on BCM2711 is capable of negative temperatures, so don't clamp the measurements at zero. Since this was the only use for variable t, drop it.
This change based on a patch by Dom Cobley, who also tested the fix.
--- drivers/thermal/broadcom/bcm2711_thermal.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/thermal/broadcom/bcm2711_thermal.c +1 -4
@@ -38,7 +38,6 @@ static int bcm2711_get_temp(void *data, int *temp)int offset =thermal_zone_get_offset (priv->thermal);u32 val;int ret; -long t; ret =regmap_read (priv->regmap,AVS_RO_TEMP_STATUS , &val);if (ret)
@@ -50,9 +49,7 @@ static int bcm2711_get_temp(void *data, int *temp) val &=AVS_RO_TEMP_STATUS_DATA_MSK ;/* Convert a HW code to a temperature reading (millidegree celsius) */ - t = slope * val + offset; - - *temp = t <0 ?0 : t; + *temp = slope * val + offset;return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 240/452 thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe
In reply to Greg Kroah-HartmanFrom: Zheng Yongjun <[email protected]>
[ Upstream commit e20d136ec7d6f309989c447638365840d3424c8e ]
platform_get_resource() may return NULL, add proper check to avoid potential NULL dereferencing.
--- drivers/thermal/broadcom/sr-thermal.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/broadcom/sr-thermal.c +3 -0
@@ -60,6 +60,9 @@ static int sr_thermal_probe(struct platform_device *pdev)return -ENOMEM ; res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); +if (!res) +return -ENOENT ; + sr_thermal->regs = (void __iomem *)devm_memremap (&pdev->dev, res->start,resource_size (res),MEMREMAP_WB );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 241/452 thermal/drivers/core: Use a char pointer for the cooling device name
In reply to Greg Kroah-HartmanFrom: Daniel Lezcano <[email protected]>
[ Upstream commit 58483761810087e5ffdf36e84ac1bf26df909097 ]
We want to have any kind of name for the cooling devices as we do no longer want to rely on auto-numbering. Let's replace the cooling device's fixed array by a char pointer to be allocated dynamically when registering the cooling device, so we don't limit the length of the name.
Rework the error path at the same time as we have to rollback the allocations in case of error.
Tested with a dummy device having the name:
"Llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch"
A village on the island of Anglesey (Wales), known to have the longest name in Europe.
--- .../ethernet/mellanox/mlxsw/core_thermal.c | 2 +- drivers/thermal/thermal_core.c | 38 +++++++++++-------- include/linux/thermal.h | 2 +- 3 files changed, 24 insertions(+), 18 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/core_thermal.c +1 -1
@@ -133,7 +133,7 @@ static int mlxsw_get_cooling_device_idx(struct mlxsw_thermal *thermal,/* Allow mlxsw thermal zone binding to an external cooling device */ for (i =0 ; i <ARRAY_SIZE (mlxsw_thermal_external_allowed_cdev); i++) {if (strnstr (cdev->type, mlxsw_thermal_external_allowed_cdev[i], -sizeof (cdev->type))) +strlen (cdev->type)))return 0 ; }
drivers/thermal/thermal_core.c +22 -16
@@ -1092,10 +1092,7 @@ __thermal_cooling_device_register(struct device_node *np, {struct thermal_cooling_device *cdev;struct thermal_zone_device *pos =NULL ; -int result; - -if (type &&strlen (type) >=THERMAL_NAME_LENGTH ) -return ERR_PTR (-EINVAL ); +int ret;if (!ops || !ops->get_max_state || !ops->get_cur_state || !ops->set_cur_state)
@@ -1105,14 +1102,17 @@ __thermal_cooling_device_register(struct device_node *np,if (!cdev)return ERR_PTR (-ENOMEM ); - result =ida_simple_get (&thermal_cdev_ida,0 ,0 ,GFP_KERNEL ); -if (result <0 ) { -kfree (cdev); -return ERR_PTR (result); + ret =ida_simple_get (&thermal_cdev_ida,0 ,0 ,GFP_KERNEL ); +if (ret <0 ) + goto out_kfree_cdev; + cdev->id = ret; + + cdev->type =kstrdup (type ? type :"" ,GFP_KERNEL ); +if (!cdev->type) { + ret = -ENOMEM ; + goto out_ida_remove; } - cdev->id = result; -strlcpy (cdev->type, type ? :"" ,sizeof (cdev->type));mutex_init (&cdev->lock);INIT_LIST_HEAD (&cdev->thermal_instances); cdev->np = np;
@@ -1122,12 +1122,9 @@ __thermal_cooling_device_register(struct device_node *np, cdev->devdata = devdata;thermal_cooling_device_setup_sysfs (cdev);dev_set_name (&cdev->device,"cooling_device%d" , cdev->id); - result =device_register (&cdev->device); -if (result) { -ida_simple_remove (&thermal_cdev_ida, cdev->id); -put_device (&cdev->device); -return ERR_PTR (result); - } + ret =device_register (&cdev->device); +if (ret) + goto out_kfree_type;/* Add 'this' new cdev to the global cdev list */ mutex_lock (&thermal_list_lock);
@@ -1145,6 +1142,14 @@ __thermal_cooling_device_register(struct device_node *np,mutex_unlock (&thermal_list_lock);return cdev; + +out_kfree_type: +kfree (cdev->type); +put_device (&cdev->device); +out_ida_remove: +ida_simple_remove (&thermal_cdev_ida, cdev->id); +out_kfree_cdev: +return ERR_PTR (ret); }/**
@@ -1303,6 +1308,7 @@ void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev)ida_simple_remove (&thermal_cdev_ida, cdev->id);device_del (&cdev->device);thermal_cooling_device_destroy_sysfs (cdev); +kfree (cdev->type);put_device (&cdev->device); }EXPORT_SYMBOL_GPL (thermal_cooling_device_unregister);
include/linux/thermal.h +1 -1
@@ -92,7 +92,7 @@ struct thermal_cooling_device_ops {struct thermal_cooling_device {int id; -char type[THERMAL_NAME_LENGTH ]; +char *type;struct device device;struct device_node *np;void *devdata;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 242/452 thermal/core: Fix memory leak in __thermal_cooling_device_register()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 98a160e898c0f4a979af9de3ab48b4b1d42d1dbb ]
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff888010080000 (size 264312):
comm "182", pid 102533, jiffies 4296434960 (age 10.100s) hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff 40 7f 1f b9 ff ff ff ff ........@.......
backtrace:
[<0000000038b2f4fc>] kmalloc_order_trace+0x1d/0x110 mm/slab_common.c:969
[<00000000ebcb8da5>] __kmalloc+0x373/0x420 include/linux/slab.h:510
[<0000000084137f13>] thermal_cooling_device_setup_sysfs+0x15d/0x2d0 include/linux/slab.h:586
[<00000000352b8755>] __thermal_cooling_device_register+0x332/0xa60 drivers/thermal/thermal_core.c:927
[<00000000fb9f331b>] devm_thermal_of_cooling_device_register+0x6b/0xf0 drivers/thermal/thermal_core.c:1041
[<000000009b8012d2>] max6650_probe.cold+0x557/0x6aa drivers/hwmon/max6650.c:211
[<00000000da0b7e04>] i2c_device_probe+0x472/0xac0 drivers/i2c/i2c-core-base.c:561If device_register() fails, thermal_cooling_device_destroy_sysfs() need be called to free the memory allocated in thermal_cooling_device_setup_sysfs().
--- drivers/thermal/thermal_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/thermal/thermal_core.c +1 -0
@@ -1144,6 +1144,7 @@ __thermal_cooling_device_register(struct device_node *np,return cdev; out_kfree_type: +thermal_cooling_device_destroy_sysfs (cdev);kfree (cdev->type);put_device (&cdev->device); out_ida_remove:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 243/452 thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 09700c504d8e63faffd2a2235074e8c5d130cb8f ]
of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- drivers/thermal/imx_sc_thermal.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/thermal/imx_sc_thermal.c +4 -2
@@ -94,8 +94,8 @@ static int imx_sc_thermal_probe(struct platform_device *pdev) sensor =devm_kzalloc (&pdev->dev,sizeof (*sensor),GFP_KERNEL );if (!sensor) {of_node_put (child); -of_node_put (sensor_np); -return -ENOMEM ; + ret = -ENOMEM ; + goto put_node; } ret = thermal_zone_of_get_sensor_id(child,
@@ -124,7 +124,9 @@ static int imx_sc_thermal_probe(struct platform_device *pdev)dev_warn (&pdev->dev,"failed to add hwmon sysfs attributes\n" ); } +put_node:of_node_put (sensor_np); +of_node_put (np);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 244/452 ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit be2af740e2a9c7134f2d8ab4f104006e110b13de ]
Fix the missing clk_disable_unprepare() before return from wm2000_anc_transition() in the error handling case.
--- sound/soc/codecs/wm2000.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm2000.c +3 -3
@@ -536,7 +536,7 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, {struct i2c_client *i2c = wm2000->i2c;int i, j; -int ret; +int ret =0 ;if (wm2000->anc_mode == mode)return 0 ;
@@ -566,13 +566,13 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, ret = anc_transitions[i].step[j](i2c, anc_transitions[i].analogue);if (ret !=0 ) -return ret; +break ; }if (anc_transitions[i].dest ==ANC_OFF )clk_disable_unprepare (wm2000->mclk); -return 0 ; +return ret; }static int wm2000_anc_set_mode (struct wm2000_priv *wm2000)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 245/452 NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit b413b0cb008646e9f24ce5253cb3cf7ee217aff6 ]
There are sleep in atomic context bugs when the request to secure element of st21nfca is timeout. The root cause is that kzalloc and alloc_skb with GFP_KERNEL parameter and mutex_lock are called in st21nfca_se_wt_timeout which is a timer handler. The call tree shows the execution paths that could lead to bugs:
(Interrupt context)st21nfca_se_wt_timeout
nfc_hci_send_event
nfc_hci_hcp_message_tx
kzalloc(..., GFP_KERNEL) //may sleep
alloc_skb(..., GFP_KERNEL) //may sleep
mutex_lock() //may sleep
This patch moves the operations that may sleep into a work item. The work item will run in another kernel thread which is in process context to execute the bottom half of the interrupt. So it could prevent atomic context from sleeping.
--- drivers/nfc/st21nfca/se.c | 17 ++++++++++++++--- drivers/nfc/st21nfca/st21nfca.h | 1 + 2 files changed, 15 insertions(+), 3 deletions(-)
drivers/nfc/st21nfca/se.c +14 -3
@@ -241,7 +241,7 @@ int st21nfca_hci_se_io(struct nfc_hci_dev *hdev, u32 se_idx, }EXPORT_SYMBOL (st21nfca_hci_se_io); -static void st21nfca_se_wt_timeout (struct timer_list *t) +static void st21nfca_se_wt_work (struct work_struct *work) {/* * No answer from the secure element
@@ -254,8 +254,9 @@ static void st21nfca_se_wt_timeout(struct timer_list *t)*/ /* hardware reset managed through VCC_UICC_OUT power supply */ u8 param =0x01 ; -struct st21nfca_hci_info *info =from_timer (info, t, - se_info.bwi_timer); +struct st21nfca_hci_info *info =container_of (work, + struct st21nfca_hci_info, + se_info.timeout_work);pr_debug ("\n" );
@@ -273,6 +274,13 @@ static void st21nfca_se_wt_timeout(struct timer_list *t) info->se_info.cb (info->se_info.cb_context,NULL ,0 , -ETIME ); } +static void st21nfca_se_wt_timeout (struct timer_list *t) +{ +struct st21nfca_hci_info *info =from_timer (info, t, se_info.bwi_timer); + +schedule_work (&info->se_info.timeout_work); +} +static void st21nfca_se_activation_timeout (struct timer_list *t) { struct st21nfca_hci_info *info = from_timer(info, t,
@@ -364,6 +372,7 @@ int st21nfca_apdu_reader_event_received(struct nfc_hci_dev *hdev,switch (event) {case ST21NFCA_EVT_TRANSMIT_DATA :del_timer_sync (&info->se_info.bwi_timer); +cancel_work_sync (&info->se_info.timeout_work); info->se_info.bwi_active = false; r =nfc_hci_send_event (hdev,ST21NFCA_DEVICE_MGNT_GATE ,ST21NFCA_EVT_SE_END_OF_APDU_TRANSFER ,NULL ,0 );
@@ -393,6 +402,7 @@ void st21nfca_se_init(struct nfc_hci_dev *hdev)struct st21nfca_hci_info *info =nfc_hci_get_clientdata (hdev);init_completion (&info->se_info.req_completion); +INIT_WORK (&info->se_info.timeout_work, st21nfca_se_wt_work);/* initialize timers */ timer_setup (&info->se_info.bwi_timer, st21nfca_se_wt_timeout,0 ); info->se_info.bwi_active = false;
@@ -420,6 +430,7 @@ void st21nfca_se_deinit(struct nfc_hci_dev *hdev)if (info->se_info.se_active)del_timer_sync (&info->se_info.se_active_timer); +cancel_work_sync (&info->se_info.timeout_work); info->se_info.bwi_active = false; info->se_info.se_active = false; }
drivers/nfc/st21nfca/st21nfca.h +1 -0
@@ -141,6 +141,7 @@ struct st21nfca_se_info {se_io_cb_t cb;void *cb_context; +struct work_struct timeout_work; };struct st21nfca_hci_info {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 246/452 ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv()
In reply to Greg Kroah-HartmanFrom: Alexey Khoroshilov <[email protected]>
[ Upstream commit f7a344468105ef8c54086dfdc800e6f5a8417d3e ]
Validation of signed input should be done before casting to unsigned int.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/soc/codecs/max98090.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/codecs/max98090.c +4 -2
@@ -393,7 +393,8 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol,struct soc_mixer_control *mc = (struct soc_mixer_control *)kcontrol->private_value;unsigned int mask = (1 <<fls (mc->max)) -1 ; -unsigned int sel = ucontrol->value.integer.value[0 ]; +int sel_unchecked = ucontrol->value.integer.value[0 ]; +unsigned int sel;unsigned int val =snd_soc_component_read (component, mc->reg);unsigned int *select;
@@ -413,8 +414,9 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, val = (val >> mc->shift) & mask; -if (sel <0 || sel > mc->max) +if (sel_unchecked <0 || sel_unchecked > mc->max)return -EINVAL ; + sel = sel_unchecked; *select = sel;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 247/452 net: stmmac: selftests: Use kcalloc() instead of kzalloc()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 36371876e000012ae4440fcf3097c2f0ed0f83e7 ]
Use 2-factor multiplication argument form kcalloc() instead of kzalloc().
--- drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c +2 -2
@@ -1104,13 +1104,13 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) goto cleanup_sel; } - actions =kzalloc (nk *sizeof (*actions),GFP_KERNEL ); + actions =kcalloc (nk,sizeof (*actions),GFP_KERNEL );if (!actions) { ret = -ENOMEM ; goto cleanup_exts; } - act =kzalloc (nk *sizeof (*act),GFP_KERNEL ); + act =kcalloc (nk,sizeof (*act),GFP_KERNEL );if (!act) { ret = -ENOMEM ; goto cleanup_actions;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 248/452 net: stmmac: fix out-of-bounds access in a selftest
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit fe5c5fc145edcf98a759b895f52b646730eeb7be ]
GCC 12 points out that struct tc_action is smaller than struct tcf_action:
drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c: In function ‘stmmac_test_rxp’:drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c:1132:21: warning: array subscript ‘struct tcf_gact[0]’ is partly outside array bounds of ‘unsigned char[272]’ [-Warray-bounds]
1132 | gact->tcf_action = TC_ACT_SHOT;
| ^~
--- .../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c +6 -7
@@ -1084,8 +1084,9 @@ static int stmmac_test_rxp(struct stmmac_priv *priv)unsigned char addr[ETH_ALEN ] = {0xde ,0xad ,0xbe ,0xef ,0x00 ,0x00 };struct tc_cls_u32_offload cls_u32 = { };struct stmmac_packet_attrs attr = { }; -struct tc_action **actions, *act; +struct tc_action **actions;struct tc_u32_sel *sel; +struct tcf_gact *gact;struct tcf_exts *exts;int ret, i, nk =1 ;
@@ -1110,8 +1111,8 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) goto cleanup_exts; } - act =kcalloc (nk,sizeof (*act),GFP_KERNEL ); -if (!act) { + gact =kcalloc (nk,sizeof (*gact),GFP_KERNEL ); +if (!gact) { ret = -ENOMEM ; goto cleanup_actions; }
@@ -1126,9 +1127,7 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) exts->nr_actions = nk; exts->actions = actions;for (i =0 ; i < nk; i++) { -struct tcf_gact *gact =to_gact (&act[i]); - - actions[i] = &act[i]; + actions[i] = (struct tc_action *)&gact[i]; gact->tcf_action =TC_ACT_SHOT ; }
@@ -1152,7 +1151,7 @@ static int stmmac_test_rxp(struct stmmac_priv *priv)stmmac_tc_setup_cls_u32 (priv, priv, &cls_u32); cleanup_act: -kfree (act); +kfree (gact); cleanup_actions:kfree (actions); cleanup_exts:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 249/452 hv_netvsc: Fix potential dereference of NULL pointer
In reply to Greg Kroah-HartmanFrom: Yongzhi Liu <[email protected]>
[ Upstream commit eb4c0788964730d12e8dd520bd8f5217ca48321c ]
The return value of netvsc_devinfo_get()
needs to be checked to avoid use of NULL
pointer in case of an allocation failure.
--- drivers/net/hyperv/netvsc_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/hyperv/netvsc_drv.c +4 -1
@@ -2629,7 +2629,10 @@ static int netvsc_suspend(struct hv_device *dev)/* Save the current config info */ ndev_ctx->saved_netvsc_dev_info =netvsc_devinfo_get (nvdev); - +if (!ndev_ctx->saved_netvsc_dev_info) { + ret = -ENOMEM ; + goto out; + } ret =netvsc_detach (net, nvdev); out:rtnl_unlock ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 250/452 rxrpc: Fix listen() setting the bar too high for the prealloc rings
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 88e22159750b0d55793302eeed8ee603f5c1a95c ]
AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT().
This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty. rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set.
Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity.
BUG: kernel NULL pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: <TASK> ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0
--- net/rxrpc/sysctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/rxrpc/sysctl.c +2 -2
@@ -12,7 +12,7 @@static struct ctl_table_header *rxrpc_sysctl_reg_table;static const unsigned int four =4 ; -static const unsigned int thirtytwo =32 ; +static const unsigned int max_backlog =RXRPC_BACKLOG_MAX -1 ;static const unsigned int n_65535 =65535 ;static const unsigned int n_max_acks =RXRPC_RXTX_BUFF_SIZE -1 ;static const unsigned long one_jiffy =1 ;
@@ -89,7 +89,7 @@ static struct ctl_table rxrpc_sysctl_table[] = { .mode = 0644, .proc_handler = proc_dointvec_minmax, .extra1 = (void *)&four, - .extra2 = (void *)&thirtytwo, + .extra2 = (void *)&max_backlog, }, { .procname = "rx_window_size",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 251/452 rxrpc: Dont try to resend the request if were receiving the reply
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 114af61f88fbe34d641b13922d098ffec4c1be1b ]
rxrpc has a timer to trigger resending of unacked data packets in a call. This is not cancelled when a client call switches to the receive phase on the basis that most calls don't last long enough for it to ever expire. However, if it *does* expire after we've started to receive the reply, we shouldn't then go into trying to retransmit or pinging the server to find out if an ack got lost.
Fix this by skipping the resend code if we're into receiving the reply to a client call.
--- net/rxrpc/call_event.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/rxrpc/call_event.c +2 -1
@@ -406,7 +406,8 @@ void rxrpc_process_call(struct work_struct *work) goto recheck_state; } -if (test_and_clear_bit (RXRPC_CALL_EV_RESEND , &call->events)) { +if (test_and_clear_bit (RXRPC_CALL_EV_RESEND , &call->events) && + call->state !=RXRPC_CALL_CLIENT_RECV_REPLY ) {rxrpc_resend (call, now); goto recheck_state; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 252/452 rxrpc: Fix overlapping ACK accounting
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 8940ba3cfe4841928777fd45eaa92051522c7f0c ]
Fix accidental overlapping of Rx-phase ACK accounting with Tx-phase ACK accounting through variables shared between the two. call->acks_* members refer to ACKs received in the Tx phase and call->ackr_* members to ACKs sent/to be sent during the Rx phase.
--- net/rxrpc/ar-internal.h | 7 ++++--- net/rxrpc/input.c | 16 ++++++++-------- 2 files changed, 12 insertions(+), 11 deletions(-)
net/rxrpc/ar-internal.h +4 -3
@@ -659,10 +659,9 @@ struct rxrpc_call {spinlock_t input_lock;/* Lock for packet input to this call */ -/* receive-phase ACK management */ +/* Receive-phase ACK management (ACKs we send). */ u8 ackr_reason;/* reason to ACK */ rxrpc_serial_t ackr_serial;/* serial of packet being ACK'd */ -rxrpc_serial_t ackr_first_seq;/* first sequence number received */ rxrpc_seq_t ackr_prev_seq;/* previous sequence number received */ rxrpc_seq_t ackr_consumed;/* Highest packet shown consumed */ rxrpc_seq_t ackr_seen;/* Highest packet shown seen */
@@ -675,8 +674,10 @@ struct rxrpc_call {#define RXRPC_CALL_RTT_AVAIL_MASK 0xf#define RXRPC_CALL_RTT_PEND_SHIFT 8 -/* transmission-phase ACK management */ +/* Transmission-phase ACK management (ACKs we've received). */ ktime_t acks_latest_ts;/* Timestamp of latest ACK received */ +rxrpc_seq_t acks_first_seq;/* first sequence number received */ +rxrpc_seq_t acks_prev_seq;/* previous sequence number received */ rxrpc_seq_t acks_lowest_nak;/* Lowest NACK in the buffer (or ==tx_hard_ack) */ rxrpc_seq_t acks_lost_top;/* tx_top at the time lost-ack ping sent */ rxrpc_serial_t acks_lost_ping;/* Serial number of probe ACK */
net/rxrpc/input.c +8 -8
@@ -812,7 +812,7 @@ static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks,static bool rxrpc_is_ack_valid (struct rxrpc_call *call,rxrpc_seq_t first_pkt,rxrpc_seq_t prev_pkt) { -rxrpc_seq_t base =READ_ONCE (call->ackr_first_seq); +rxrpc_seq_t base =READ_ONCE (call->acks_first_seq);if (after (first_pkt, base))return true;/* The window advanced */
@@ -820,7 +820,7 @@ static bool rxrpc_is_ack_valid(struct rxrpc_call *call,if (before (first_pkt, base))return false;/* firstPacket regressed */ -if (after_eq (prev_pkt, call->ackr_prev_seq)) +if (after_eq (prev_pkt, call->acks_prev_seq))return true;/* previousPacket hasn't regressed. */ /* Some rx implementations put a serial number in previousPacket. */
@@ -906,8 +906,8 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)/* Discard any out-of-order or duplicate ACKs (outside lock). */ if (!rxrpc_is_ack_valid (call, first_soft_ack, prev_pkt)) {trace_rxrpc_rx_discard_ack (call->debug_id, ack_serial, - first_soft_ack, call->ackr_first_seq, - prev_pkt, call->ackr_prev_seq); + first_soft_ack, call->acks_first_seq, + prev_pkt, call->acks_prev_seq);return ; }
@@ -922,14 +922,14 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)/* Discard any out-of-order or duplicate ACKs (inside lock). */ if (!rxrpc_is_ack_valid (call, first_soft_ack, prev_pkt)) {trace_rxrpc_rx_discard_ack (call->debug_id, ack_serial, - first_soft_ack, call->ackr_first_seq, - prev_pkt, call->ackr_prev_seq); + first_soft_ack, call->acks_first_seq, + prev_pkt, call->acks_prev_seq); goto out; } call->acks_latest_ts = skb->tstamp; - call->ackr_first_seq = first_soft_ack; - call->ackr_prev_seq = prev_pkt; + call->acks_first_seq = first_soft_ack; + call->acks_prev_seq = prev_pkt;/* Parse rwind and mtu sizes if provided. */ if (buf.info.rxMTU)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 253/452 rxrpc: Dont let ack.previousPacket regress
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 81524b6312535897707f2942695da1d359a5e56b ]
The previousPacket field in the rx ACK packet should never go backwards - it's now the highest DATA sequence number received, not the last on received (it used to be used for out of sequence detection).
--- net/rxrpc/ar-internal.h | 4 ++-- net/rxrpc/input.c | 4 +++- net/rxrpc/output.c | 2 +- 3 files changed, 6 insertions(+), 4 deletions(-)
net/rxrpc/ar-internal.h +2 -2
@@ -662,7 +662,7 @@ struct rxrpc_call {/* Receive-phase ACK management (ACKs we send). */ u8 ackr_reason;/* reason to ACK */ rxrpc_serial_t ackr_serial;/* serial of packet being ACK'd */ -rxrpc_seq_t ackr_prev_seq;/* previous sequence number received */ +rxrpc_seq_t ackr_highest_seq;/* Higest sequence number received */ rxrpc_seq_t ackr_consumed;/* Highest packet shown consumed */ rxrpc_seq_t ackr_seen;/* Highest packet shown seen */
@@ -677,7 +677,7 @@ struct rxrpc_call {/* Transmission-phase ACK management (ACKs we've received). */ ktime_t acks_latest_ts;/* Timestamp of latest ACK received */ rxrpc_seq_t acks_first_seq;/* first sequence number received */ -rxrpc_seq_t acks_prev_seq;/* previous sequence number received */ +rxrpc_seq_t acks_prev_seq;/* Highest previousPacket received */ rxrpc_seq_t acks_lowest_nak;/* Lowest NACK in the buffer (or ==tx_hard_ack) */ rxrpc_seq_t acks_lost_top;/* tx_top at the time lost-ack ping sent */ rxrpc_serial_t acks_lost_ping;/* Serial number of probe ACK */
net/rxrpc/input.c +3 -1
@@ -453,7 +453,6 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) !rxrpc_receiving_reply(call)) goto unlock; - call->ackr_prev_seq = seq0; hard_ack =READ_ONCE (call->rx_hard_ack); nr_subpackets = sp->nr_subpackets;
@@ -534,6 +533,9 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) ack_serial = serial; } +if (after (seq0, call->ackr_highest_seq)) + call->ackr_highest_seq = seq0; +/* Queue the packet. We use a couple of memory barriers here as need * to make sure that rx_top is perceived to be set after the buffer * pointer and that the buffer pointer is set after the annotation and
net/rxrpc/output.c +1 -1
@@ -89,7 +89,7 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn, pkt->ack.bufferSpace =htons (8 ); pkt->ack.maxSkew =htons (0 ); pkt->ack.firstPacket =htonl (hard_ack +1 ); - pkt->ack.previousPacket =htonl (call->ackr_prev_seq); + pkt->ack.previousPacket =htonl (call->ackr_highest_seq); pkt->ack.serial =htonl (serial); pkt->ack.reason = reason; pkt->ack.nAcks = top - hard_ack;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 254/452 rxrpc: Fix decision on when to generate an IDLE ACK
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 9a3dedcf18096e8f7f22b8777d78c4acfdea1651 ]
Fix the decision on when to generate an IDLE ACK by keeping a count of the number of packets we've received, but not yet soft-ACK'd, and the number of packets we've processed, but not yet hard-ACK'd, rather than trying to keep track of which DATA sequence numbers correspond to those points.
We then generate an ACK when either counter exceeds 2. The counters are both cleared when we transcribe the information into any sort of ACK packet for transmission. IDLE and DELAY ACKs are skipped if both counters are 0 (ie. no change).
--- include/trace/events/rxrpc.h | 2 +- net/rxrpc/ar-internal.h | 4 ++-- net/rxrpc/input.c | 11 +++++++++-- net/rxrpc/output.c | 18 +++++++++++------- net/rxrpc/recvmsg.c | 8 +++----- 5 files changed, 26 insertions(+), 17 deletions(-)
include/trace/events/rxrpc.h +1 -1
@@ -1509,7 +1509,7 @@ TRACE_EVENT(rxrpc_call_reset, __entry->call_serial = call->rx_serial; __entry->conn_serial = call->conn->hi_serial; __entry->tx_seq = call->tx_hard_ack; - __entry->rx_seq = call->ackr_seen; + __entry->rx_seq = call->rx_hard_ack; ), TP_printk("c=%08x %08x:%08x r=%08x/%08x tx=%08x rx=%08x",
net/rxrpc/ar-internal.h +2 -2
@@ -663,8 +663,8 @@ struct rxrpc_call {u8 ackr_reason;/* reason to ACK */ rxrpc_serial_t ackr_serial;/* serial of packet being ACK'd */ rxrpc_seq_t ackr_highest_seq;/* Higest sequence number received */ -rxrpc_seq_t ackr_consumed;/* Highest packet shown consumed */ -rxrpc_seq_t ackr_seen;/* Highest packet shown seen */ +atomic_t ackr_nr_unacked;/* Number of unacked packets */ +atomic_t ackr_nr_consumed;/* Number of packets needing hard ACK */ /* RTT management */ rxrpc_serial_t rtt_serial[4 ];/* Serial number of DATA or PING sent */
net/rxrpc/input.c +9 -2
@@ -412,8 +412,8 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) {struct rxrpc_skb_priv *sp =rxrpc_skb (skb);enum rxrpc_call_state state; -unsigned int j, nr_subpackets; -rxrpc_serial_t serial = sp->hdr.serial, ack_serial =0 ; +unsigned int j, nr_subpackets, nr_unacked =0 ; +rxrpc_serial_t serial = sp->hdr.serial, ack_serial = serial;rxrpc_seq_t seq0 = sp->hdr.seq, hard_ack;bool immediate_ack = false, jumbo_bad = false;u8 ack =0 ;
@@ -569,6 +569,8 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) sp =NULL ; } + nr_unacked++; +if (last) {set_bit (RXRPC_CALL_RX_LAST , &call->flags);if (!ack) {
@@ -588,9 +590,14 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) } call->rx_expect_next = seq +1 ; } +if (!ack) + ack_serial = serial; } ack: +if (atomic_add_return (nr_unacked, &call->ackr_nr_unacked) >2 && !ack) + ack =RXRPC_ACK_IDLE ; +if (ack) rxrpc_propose_ACK(call, ack, ack_serial, immediate_ack, true,
net/rxrpc/output.c +11 -7
@@ -74,11 +74,18 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn, u8 reason) {rxrpc_serial_t serial; +unsigned int tmp;rxrpc_seq_t hard_ack, top, seq;int ix;u32 mtu, jmax;u8 *ackp = pkt->acks; + tmp =atomic_xchg (&call->ackr_nr_unacked,0 ); + tmp |=atomic_xchg (&call->ackr_nr_consumed,0 ); +if (!tmp && (reason ==RXRPC_ACK_DELAY || + reason ==RXRPC_ACK_IDLE )) +return 0 ; +/* Barrier against rxrpc_input_data(). */ serial = call->ackr_serial; hard_ack =READ_ONCE (call->rx_hard_ack);
@@ -223,6 +230,10 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping, n =rxrpc_fill_out_ack (conn, call, pkt, &hard_ack, &top, reason);spin_unlock_bh (&call->lock); +if (n ==0 ) { +kfree (pkt); +return 0 ; + } iov[0 ].iov_base = pkt; iov[0 ].iov_len =sizeof (pkt->whdr) +sizeof (pkt->ack) + n;
@@ -259,13 +270,6 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,ntohl (pkt->ack.serial), false, true, rxrpc_propose_ack_retry_tx); - }else { -spin_lock_bh (&call->lock); -if (after (hard_ack, call->ackr_consumed)) - call->ackr_consumed = hard_ack; -if (after (top, call->ackr_seen)) - call->ackr_seen = top; -spin_unlock_bh (&call->lock); }rxrpc_set_keepalive (call);
net/rxrpc/recvmsg.c +3 -5
@@ -260,11 +260,9 @@ static void rxrpc_rotate_rx_window(struct rxrpc_call *call)rxrpc_end_rx_phase (call, serial); }else {/* Check to see if there's an ACK that needs sending. */ -if (after_eq (hard_ack, call->ackr_consumed +2 ) || -after_eq (top, call->ackr_seen +2 ) || - (hard_ack == top &&after (hard_ack, call->ackr_consumed))) -rxrpc_propose_ACK (call,RXRPC_ACK_DELAY , serial, - true, true, +if (atomic_inc_return (&call->ackr_nr_consumed) >2 ) +rxrpc_propose_ACK (call,RXRPC_ACK_IDLE , serial, + true, false, rxrpc_propose_ack_rotate_rx);if (call->ackr_reason && call->ackr_reason !=RXRPC_ACK_DELAY )rxrpc_send_ack_packet (call, false,NULL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 255/452 net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 9d922f5df53844228b9f7c62f2593f4f06c0b69b ]
Use 2-factor multiplication argument form devm_kcalloc() instead of devm_kzalloc().
--- .../ethernet/huawei/hinic/hinic_hw_api_cmd.c | 5 ++-- .../net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 10 ++++---- .../net/ethernet/huawei/hinic/hinic_hw_dev.c | 5 ++-- .../net/ethernet/huawei/hinic/hinic_hw_eqs.c | 9 ++++---- .../net/ethernet/huawei/hinic/hinic_hw_wq.c | 23 +++++++++---------- .../net/ethernet/huawei/hinic/hinic_main.c | 10 ++++---- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 9 ++++---- 7 files changed, 31 insertions(+), 40 deletions(-)
drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.c +2 -3
@@ -818,7 +818,6 @@ static int api_chain_init(struct hinic_api_cmd_chain *chain, {struct hinic_hwif *hwif = attr->hwif;struct pci_dev *pdev = hwif->pdev; -size_t cell_ctxt_size; chain->hwif = hwif; chain->chain_type = attr->chain_type;
@@ -830,8 +829,8 @@ static int api_chain_init(struct hinic_api_cmd_chain *chain,sema_init (&chain->sem,1 ); - cell_ctxt_size = chain->num_cells *sizeof (*chain->cell_ctxt); - chain->cell_ctxt =devm_kzalloc (&pdev->dev, cell_ctxt_size,GFP_KERNEL ); + chain->cell_ctxt =devm_kcalloc (&pdev->dev, chain->num_cells, +sizeof (*chain->cell_ctxt),GFP_KERNEL );if (!chain->cell_ctxt)return -ENOMEM ;
drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c +4 -6
@@ -796,11 +796,10 @@ static int init_cmdqs_ctxt(struct hinic_hwdev *hwdev,struct hinic_cmdq_ctxt *cmdq_ctxts;struct pci_dev *pdev = hwif->pdev;struct hinic_pfhwdev *pfhwdev; -size_t cmdq_ctxts_size;int err; - cmdq_ctxts_size =HINIC_MAX_CMDQ_TYPES *sizeof (*cmdq_ctxts); - cmdq_ctxts =devm_kzalloc (&pdev->dev, cmdq_ctxts_size,GFP_KERNEL ); + cmdq_ctxts =devm_kcalloc (&pdev->dev,HINIC_MAX_CMDQ_TYPES , +sizeof (*cmdq_ctxts),GFP_KERNEL );if (!cmdq_ctxts)return -ENOMEM ;
@@ -884,7 +883,6 @@ int hinic_init_cmdqs(struct hinic_cmdqs *cmdqs, struct hinic_hwif *hwif,struct hinic_func_to_io *func_to_io =cmdqs_to_func_to_io (cmdqs);struct pci_dev *pdev = hwif->pdev;struct hinic_hwdev *hwdev; -size_t saved_wqs_size;u16 max_wqe_size;int err;
@@ -895,8 +893,8 @@ int hinic_init_cmdqs(struct hinic_cmdqs *cmdqs, struct hinic_hwif *hwif,if (!cmdqs->cmdq_buf_pool)return -ENOMEM ; - saved_wqs_size =HINIC_MAX_CMDQ_TYPES *sizeof (struct hinic_wq ); - cmdqs->saved_wqs =devm_kzalloc (&pdev->dev, saved_wqs_size,GFP_KERNEL ); + cmdqs->saved_wqs =devm_kcalloc (&pdev->dev,HINIC_MAX_CMDQ_TYPES , +sizeof (*cmdqs->saved_wqs),GFP_KERNEL );if (!cmdqs->saved_wqs) { err = -ENOMEM ; goto err_saved_wqs;
drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c +2 -3
@@ -162,7 +162,6 @@ static int init_msix(struct hinic_hwdev *hwdev)struct hinic_hwif *hwif = hwdev->hwif;struct pci_dev *pdev = hwif->pdev;int nr_irqs, num_aeqs, num_ceqs; -size_t msix_entries_size;int i, err; num_aeqs =HINIC_HWIF_NUM_AEQS (hwif);
@@ -171,8 +170,8 @@ static int init_msix(struct hinic_hwdev *hwdev)if (nr_irqs >HINIC_HWIF_NUM_IRQS (hwif)) nr_irqs =HINIC_HWIF_NUM_IRQS (hwif); - msix_entries_size = nr_irqs *sizeof (*hwdev->msix_entries); - hwdev->msix_entries =devm_kzalloc (&pdev->dev, msix_entries_size, + hwdev->msix_entries =devm_kcalloc (&pdev->dev, nr_irqs, +sizeof (*hwdev->msix_entries),GFP_KERNEL );if (!hwdev->msix_entries)return -ENOMEM ;
drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c +4 -5
@@ -631,16 +631,15 @@ static int alloc_eq_pages(struct hinic_eq *eq)struct hinic_hwif *hwif = eq->hwif;struct pci_dev *pdev = hwif->pdev;u32 init_val, addr, val; -size_t addr_size;int err, pg; - addr_size = eq->num_pages *sizeof (*eq->dma_addr); - eq->dma_addr =devm_kzalloc (&pdev->dev, addr_size,GFP_KERNEL ); + eq->dma_addr =devm_kcalloc (&pdev->dev, eq->num_pages, +sizeof (*eq->dma_addr),GFP_KERNEL );if (!eq->dma_addr)return -ENOMEM ; - addr_size = eq->num_pages *sizeof (*eq->virt_addr); - eq->virt_addr =devm_kzalloc (&pdev->dev, addr_size,GFP_KERNEL ); + eq->virt_addr =devm_kcalloc (&pdev->dev, eq->num_pages, +sizeof (*eq->virt_addr),GFP_KERNEL );if (!eq->virt_addr) { err = -ENOMEM ; goto err_virt_addr_alloc;
drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c +11 -12
@@ -192,20 +192,20 @@ static int alloc_page_arrays(struct hinic_wqs *wqs) {struct hinic_hwif *hwif = wqs->hwif;struct pci_dev *pdev = hwif->pdev; -size_t size; - size = wqs->num_pages *sizeof (*wqs->page_paddr); - wqs->page_paddr =devm_kzalloc (&pdev->dev, size,GFP_KERNEL ); + wqs->page_paddr =devm_kcalloc (&pdev->dev, wqs->num_pages, +sizeof (*wqs->page_paddr),GFP_KERNEL );if (!wqs->page_paddr)return -ENOMEM ; - size = wqs->num_pages *sizeof (*wqs->page_vaddr); - wqs->page_vaddr =devm_kzalloc (&pdev->dev, size,GFP_KERNEL ); + wqs->page_vaddr =devm_kcalloc (&pdev->dev, wqs->num_pages, +sizeof (*wqs->page_vaddr),GFP_KERNEL );if (!wqs->page_vaddr) goto err_page_vaddr; - size = wqs->num_pages *sizeof (*wqs->shadow_page_vaddr); - wqs->shadow_page_vaddr =devm_kzalloc (&pdev->dev, size,GFP_KERNEL ); + wqs->shadow_page_vaddr =devm_kcalloc (&pdev->dev, wqs->num_pages, +sizeof (*wqs->shadow_page_vaddr), +GFP_KERNEL );if (!wqs->shadow_page_vaddr) goto err_page_shadow_vaddr;
@@ -378,15 +378,14 @@ static int alloc_wqes_shadow(struct hinic_wq *wq) {struct hinic_hwif *hwif = wq->hwif;struct pci_dev *pdev = hwif->pdev; -size_t size; - size = wq->num_q_pages * wq->max_wqe_size; - wq->shadow_wqe =devm_kzalloc (&pdev->dev, size,GFP_KERNEL ); + wq->shadow_wqe =devm_kcalloc (&pdev->dev, wq->num_q_pages, + wq->max_wqe_size,GFP_KERNEL );if (!wq->shadow_wqe)return -ENOMEM ; - size = wq->num_q_pages *sizeof (wq->prod_idx); - wq->shadow_idx =devm_kzalloc (&pdev->dev, size,GFP_KERNEL ); + wq->shadow_idx =devm_kcalloc (&pdev->dev, wq->num_q_pages, +sizeof (wq->prod_idx),GFP_KERNEL );if (!wq->shadow_idx) goto err_shadow_idx;
drivers/net/ethernet/huawei/hinic/hinic_main.c +4 -6
@@ -144,13 +144,12 @@ static int create_txqs(struct hinic_dev *nic_dev) {int err, i, j, num_txqs =hinic_hwdev_num_qps (nic_dev->hwdev);struct net_device *netdev = nic_dev->netdev; -size_t txq_size;if (nic_dev->txqs)return -EINVAL ; - txq_size = num_txqs *sizeof (*nic_dev->txqs); - nic_dev->txqs =devm_kzalloc (&netdev->dev, txq_size,GFP_KERNEL ); + nic_dev->txqs =devm_kcalloc (&netdev->dev, num_txqs, +sizeof (*nic_dev->txqs),GFP_KERNEL );if (!nic_dev->txqs)return -ENOMEM ;
@@ -242,13 +241,12 @@ static int create_rxqs(struct hinic_dev *nic_dev) {int err, i, j, num_rxqs =hinic_hwdev_num_qps (nic_dev->hwdev);struct net_device *netdev = nic_dev->netdev; -size_t rxq_size;if (nic_dev->rxqs)return -EINVAL ; - rxq_size = num_rxqs *sizeof (*nic_dev->rxqs); - nic_dev->rxqs =devm_kzalloc (&netdev->dev, rxq_size,GFP_KERNEL ); + nic_dev->rxqs =devm_kcalloc (&netdev->dev, num_rxqs, +sizeof (*nic_dev->rxqs),GFP_KERNEL );if (!nic_dev->rxqs)return -ENOMEM ;
drivers/net/ethernet/huawei/hinic/hinic_tx.c +4 -5
@@ -861,7 +861,6 @@ int hinic_init_txq(struct hinic_txq *txq, struct hinic_sq *sq,struct hinic_dev *nic_dev =netdev_priv (netdev);struct hinic_hwdev *hwdev = nic_dev->hwdev;int err, irqname_len; -size_t sges_size; txq->netdev = netdev; txq->sq = sq;
@@ -870,13 +869,13 @@ int hinic_init_txq(struct hinic_txq *txq, struct hinic_sq *sq, txq->max_sges =HINIC_MAX_SQ_BUFDESCS ; - sges_size = txq->max_sges *sizeof (*txq->sges); - txq->sges =devm_kzalloc (&netdev->dev, sges_size,GFP_KERNEL ); + txq->sges =devm_kcalloc (&netdev->dev, txq->max_sges, +sizeof (*txq->sges),GFP_KERNEL );if (!txq->sges)return -ENOMEM ; - sges_size = txq->max_sges *sizeof (*txq->free_sges); - txq->free_sges =devm_kzalloc (&netdev->dev, sges_size,GFP_KERNEL ); + txq->free_sges =devm_kcalloc (&netdev->dev, txq->max_sges, +sizeof (*txq->free_sges),GFP_KERNEL );if (!txq->free_sges) { err = -ENOMEM ; goto err_alloc_free_sges;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 256/452 hinic: Avoid some over memory allocation
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 15d221d0c345b76947911a3ac91897ffe2f1cc4e ]
'prod_idx' (atomic_t) is larger than 'shadow_idx' (u16), so some memory is over-allocated.
--- drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c +1 -1
@@ -385,7 +385,7 @@ static int alloc_wqes_shadow(struct hinic_wq *wq)return -ENOMEM ; wq->shadow_idx =devm_kcalloc (&pdev->dev, wq->num_q_pages, -sizeof (wq->prod_idx),GFP_KERNEL ); +sizeof (*wq->shadow_idx),GFP_KERNEL );if (!wq->shadow_idx) goto err_shadow_idx;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 257/452 net/smc: postpone sk_refcnt increment in connect()
In reply to Greg Kroah-HartmanFrom: liuyacan <[email protected]>
[ Upstream commit 75c1edf23b95a9c66923d9269d8e86e4dbde151f ]
Same trigger condition as commit 86434744. When setsockopt runs in parallel to a connect(), and switch the socket into fallback mode. Then the sk_refcnt is incremented in smc_connect(), but its state stay in SMC_INIT (NOT SMC_ACTIVE). This cause the corresponding sk_refcnt decrement in __smc_release() will not be performed.
--- net/smc/af_smc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/smc/af_smc.c +1 -1
@@ -1118,9 +1118,9 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr,if (rc && rc != -EINPROGRESS ) goto out; -sock_hold (&smc->sk);/* sock put in passive closing */ if (smc->use_fallback) goto out; +sock_hold (&smc->sk);/* sock put in passive closing */ if (flags &O_NONBLOCK ) {if (queue_work (smc_hs_wq, &smc->connect_work)) smc->connect_nonblock =1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 258/452 arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399
In reply to Greg Kroah-HartmanFrom: Shawn Lin <[email protected]>
[ Upstream commit 4246d0bab2a8685e3d4aec2cb0ef8c526689ce96 ]
drive-impedance-ohm is introduced for emmc phy instead of pcie phy.
--- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399.dtsi +1 -1
@@ -1471,6 +1471,7 @@ reg = <0xf780 0x24>; clocks = <&sdhci>; clock-names = "emmcclk"; + drive-impedance-ohm = <50>; #phy-cells = <0>; status = "disabled"; };
@@ -1481,7 +1482,6 @@ clock-names = "refclk"; #phy-cells = <1>; resets = <&cru SRST_PCIEPHY>; - drive-impedance-ohm = <50>; reset-names = "phy"; status = "disabled"; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 259/452 memory: samsung: exynos5422-dmc: Avoid some over memory allocation
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 56653827f0d7bc7c2d8bac0e119fd1521fa9990a ]
'dmc->counter' is a 'struct devfreq_event_dev **', so there is some over memory allocation. 'counters_size' should be computed with 'sizeof(struct devfreq_event_dev *)'.
Use 'sizeof(*dmc->counter)' instead to fix it.
While at it, use devm_kcalloc() instead of devm_kzalloc()+open coded multiplication.
--- drivers/memory/samsung/exynos5422-dmc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/memory/samsung/exynos5422-dmc.c +2 -3
@@ -1327,7 +1327,6 @@ static int exynos5_dmc_init_clks(struct exynos5_dmc *dmc)*/ static int exynos5_performance_counters_init (struct exynos5_dmc *dmc) { -int counters_size;int ret, i; dmc->num_counters = devfreq_event_get_edev_count(dmc->dev,
@@ -1337,8 +1336,8 @@ static int exynos5_performance_counters_init(struct exynos5_dmc *dmc)return dmc->num_counters; } - counters_size =sizeof (struct devfreq_event_dev ) * dmc->num_counters; - dmc->counter =devm_kzalloc (dmc->dev, counters_size,GFP_KERNEL ); + dmc->counter =devm_kcalloc (dmc->dev, dmc->num_counters, +sizeof (*dmc->counter),GFP_KERNEL );if (!dmc->counter)return -ENOMEM ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 260/452 ARM: dts: suniv: F1C100: fix watchdog compatible
In reply to Greg Kroah-HartmanFrom: Andre Przywara <[email protected]>
[ Upstream commit 01a850ee61cbf0ab77dcbf26bb133fec2dd640d6 ]
The F1C100 series of SoCs actually have their watchdog IP being compatible with the newer Allwinner generation, not the older one.
The currently described sun4i-a10-wdt actually does not work, neither the watchdog functionality (just never fires), nor the reset part (reboot hangs).
Replace the compatible string with the one used by the newer generation. Verified to work with both the watchdog and reboot functionality on a LicheePi Nano.
Also add the missing interrupt line and clock source, to make it binding compliant.
--- arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/arm/boot/dts/suniv-f1c100s.dtsi +3 -1
@@ -104,8 +104,10 @@ wdt: watchdog@1c20ca0 { compatible = "allwinner,suniv-f1c100s-wdt", - "allwinner,sun4i-a10-wdt"; + "allwinner,sun6i-a31-wdt"; reg = <0x01c20ca0 0x20>; + interrupts = <16>; + clocks = <&osc32k>; }; uart0: serial@1c25000 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 261/452 soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 8fd3f18ea31a398ecce4a6d3804433658678b0a3 ]
The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done.
--- drivers/soc/qcom/smp2p.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/qcom/smp2p.c +1 -0
@@ -420,6 +420,7 @@ static int smp2p_parse_ipc(struct qcom_smp2p *smp2p) } smp2p->ipc_regmap =syscon_node_to_regmap (syscon); +of_node_put (syscon);if (IS_ERR (smp2p->ipc_regmap))return PTR_ERR (smp2p->ipc_regmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 262/452 soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit aad66a3c78da668f4506356c2fdb70b7a19ecc76 ]
The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done.
--- drivers/soc/qcom/smsm.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/qcom/smsm.c +1 -0
@@ -359,6 +359,7 @@ static int smsm_parse_ipc(struct qcom_smsm *smsm, unsigned host_id)return 0 ; host->ipc_regmap =syscon_node_to_regmap (syscon); +of_node_put (syscon);if (IS_ERR (host->ipc_regmap))return PTR_ERR (host->ipc_regmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 263/452 PCI: cadence: Fix find_first_zero_bit() limit
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 0aa3a0937feeb91a0e4e438c3c063b749b194192 ]
The ep->ob_region_map bitmap is a long and it has BITS_PER_LONG bits.
--- drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pci/controller/cadence/pcie-cadence-ep.c +1 -2
@@ -154,8 +154,7 @@ static int cdns_pcie_ep_map_addr(struct pci_epc *epc, u8 fn, phys_addr_t addr,struct cdns_pcie *pcie = &ep->pcie;u32 r; - r =find_first_zero_bit (&ep->ob_region_map, -sizeof (ep->ob_region_map) *BITS_PER_LONG ); + r =find_first_zero_bit (&ep->ob_region_map,BITS_PER_LONG );if (r >= ep->max_regions -1 ) {dev_err (&epc->dev,"no free outbound region\n" );return -EINVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 264/452 PCI: rockchip: Fix find_first_zero_bit() limit
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 096950e230b8d83645c7cf408b9f399f58c08b96 ]
The ep->ob_region_map bitmap is a long and it has BITS_PER_LONG bits.
--- drivers/pci/controller/pcie-rockchip-ep.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pci/controller/pcie-rockchip-ep.c +1 -2
@@ -264,8 +264,7 @@ static int rockchip_pcie_ep_map_addr(struct pci_epc *epc, u8 fn,struct rockchip_pcie *pcie = &ep->rockchip;u32 r; - r =find_first_zero_bit (&ep->ob_region_map, -sizeof (ep->ob_region_map) *BITS_PER_LONG ); + r =find_first_zero_bit (&ep->ob_region_map,BITS_PER_LONG );/* * Region 0 is reserved for configuration space and shouldn't * be used elsewhere per TRM, so leave it out.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 265/452 PCI: dwc: Fix setting error return on MSI DMA mapping failure
In reply to Greg Kroah-HartmanFrom: Jiantao Zhang <[email protected]>
[ Upstream commit 88557685cd72cf0db686a4ebff3fad4365cb6071 ]
When dma_mapping_error() returns error because of no enough memory, but dw_pcie_host_init() returns success, which will mislead the callers.
--- drivers/pci/controller/dwc/pcie-designware-host.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pci/controller/dwc/pcie-designware-host.c +2 -1
@@ -392,7 +392,8 @@ int dw_pcie_host_init(struct pcie_port *pp)sizeof (pp->msi_msg),DMA_FROM_DEVICE , DMA_ATTR_SKIP_CPU_SYNC); -if (dma_mapping_error (pci->dev, pp->msi_data)) { + ret =dma_mapping_error (pci->dev, pp->msi_data); +if (ret) {dev_err (pci->dev,"Failed to map MSI data\n" ); pp->msi_data =0 ; goto err_free_msi;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 266/452 ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks
In reply to Greg Kroah-HartmanFrom: Thorsten Scherer <[email protected]>
[ Upstream commit 3d397a1277853498e8b7b305f2610881357c033f ]
Commit f3e7dae323ab ("ARM: dts: imx6qdl: add enet_out clk support") added another item to the list of clocks for the fec device. As imx6dl-eckelmann-ci4x10.dts only overwrites clocks, but not clock-names this resulted in an inconsistency with clocks having one item more than clock-names.
Also overwrite clock-names with the same value as in imx6qdl.dtsi. This is a no-op today, but prevents similar inconsistencies if the soc file will be changed in a similar way in the future.
--- arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts +5 -1
@@ -297,7 +297,11 @@ phy-mode = "rmii"; phy-reset-gpios = <&gpio1 18 GPIO_ACTIVE_LOW>; phy-handle = <&phy>; - clocks = <&clks IMX6QDL_CLK_ENET>, <&clks IMX6QDL_CLK_ENET>, <&rmii_clk>; + clocks = <&clks IMX6QDL_CLK_ENET>, + <&clks IMX6QDL_CLK_ENET>, + <&rmii_clk>, + <&clks IMX6QDL_CLK_ENET_REF>; + clock-names = "ipg", "ahb", "ptp", "enet_out"; status = "okay"; mdio {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 267/452 soc: qcom: llcc: Add MODULE_DEVICE_TABLE()
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit 5334a3b12a7233b31788de60d61bfd890059d783 ]
The llcc-qcom driver can be compiled as a module, but lacks MODULE_DEVICE_TABLE() and will therefore not be loaded automatically. Fix this.
--- drivers/soc/qcom/llcc-qcom.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/qcom/llcc-qcom.c +1 -0
@@ -496,6 +496,7 @@ static const struct of_device_id qcom_llcc_of_match[] = { { .compatible = "qcom,sdm845-llcc", .data = &sdm845_cfg }, { } }; +MODULE_DEVICE_TABLE (of, qcom_llcc_of_match);static struct platform_driver qcom_llcc_driver = { .driver = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 268/452 KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit c3634d25fbee88e2368a8e0903ae0d0670eb9e71 ]
Don't modify vmcs12 exit fields except EXIT_REASON and EXIT_QUALIFICATION when performing a nested VM-Exit due to failed VM-Entry. Per the SDM, only the two aformentioned fields are filled and "All other VM-exit information fields are unmodified".
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/nested.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
arch/x86/kvm/vmx/nested.c +10 -5
@@ -4143,12 +4143,12 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,/* update exit information fields: */ vmcs12->vm_exit_reason = vm_exit_reason; vmcs12->exit_qualification = exit_qualification; - vmcs12->vm_exit_intr_info = exit_intr_info; - - vmcs12->idt_vectoring_info_field =0 ; - vmcs12->vm_exit_instruction_len =vmcs_read32 (VM_EXIT_INSTRUCTION_LEN ); - vmcs12->vmx_instruction_info =vmcs_read32 (VMX_INSTRUCTION_INFO ); +/* +* On VM-Exit due to a failed VM-Entry, the VMCS isn't marked launched +* and only EXIT_REASON and EXIT_QUALIFICATION are updated, all other +* exit info fields are unmodified. +*/ if (!(vmcs12->vm_exit_reason &VMX_EXIT_REASONS_FAILED_VMENTRY )) { vmcs12->launch_state =1 ;
@@ -4160,8 +4160,13 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,* Transfer the event that L0 or L1 may wanted to inject into * L2 to IDT_VECTORING_INFO_FIELD. */ + vmcs12->idt_vectoring_info_field =0 ;vmcs12_save_pending_event (vcpu, vmcs12); + vmcs12->vm_exit_intr_info = exit_intr_info; + vmcs12->vm_exit_instruction_len =vmcs_read32 (VM_EXIT_INSTRUCTION_LEN ); + vmcs12->vmx_instruction_info =vmcs_read32 (VMX_INSTRUCTION_INFO ); +/* * According to spec, there's no need to store the guest's * MSRs if the exit is due to a VM-entry failure that occurs
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 269/452 KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 9bd1f0efa859b61950d109b32ff8d529cc33a3ad ]
Clear the IDT vectoring field in vmcs12 on next VM-Exit due to a double or triple fault. Per the SDM, a VM-Exit isn't considered to occur during event delivery if the exit is due to an intercepted double fault or a triple fault. Opportunistically move the default clearing (no event "pending") into the helper so that it's more obvious that KVM does indeed handle this case.
Note, the double fault case is worded rather wierdly in the SDM:
The original event results in a double-fault exception that causes the VM exit directly.
Temporarily ignoring injected events, double faults can _only_ occur if an exception occurs while attempting to deliver a different exception, i.e. there's _always_ an original event. And for injected double fault, while there's no original event, injected events are never subject to interception.
Presumably the SDM is calling out that a the vectoring info will be valid if a different exit occurs after a double fault, e.g. if a #PF occurs and is intercepted while vectoring #DF, then the vectoring info will show the double fault. In other words, the clause can simply be read as:
The VM exit is caused by a double-fault exception.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/nested.c | 32 ++++++++++++++++++++++++++++---- arch/x86/kvm/vmx/vmcs.h | 5 +++++ 2 files changed, 33 insertions(+), 4 deletions(-)
arch/x86/kvm/vmx/nested.c +28 -4
@@ -3668,12 +3668,34 @@ vmcs12_guest_cr4(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) }static void vmcs12_save_pending_event (struct kvm_vcpu *vcpu, -struct vmcs12 *vmcs12) +struct vmcs12 *vmcs12, +u32 vm_exit_reason,u32 exit_intr_info) {u32 idt_vectoring;unsigned int nr; -if (vcpu->arch.exception.injected) { +/* +* Per the SDM, VM-Exits due to double and triple faults are never +* considered to occur during event delivery, even if the double/triple +* fault is the result of an escalating vectoring issue. +* +* Note, the SDM qualifies the double fault behavior with "The original +* event results in a double-fault exception". It's unclear why the +* qualification exists since exits due to double fault can occur only +* while vectoring a different exception (injected events are never +* subject to interception), i.e. there's _always_ an original event. +* +* The SDM also uses NMI as a confusing example for the "original event +* causes the VM exit directly" clause. NMI isn't special in any way, +* the same rule applies to all events that cause an exit directly. +* NMI is an odd choice for the example because NMIs can only occur on +* instruction boundaries, i.e. they _can't_ occur during vectoring. +*/ +if ((u16 )vm_exit_reason ==EXIT_REASON_TRIPLE_FAULT || + ((u16 )vm_exit_reason ==EXIT_REASON_EXCEPTION_NMI && +is_double_fault (exit_intr_info))) { + vmcs12->idt_vectoring_info_field =0 ; + }else if (vcpu->arch.exception.injected) { nr = vcpu->arch.exception.nr; idt_vectoring = nr |VECTORING_INFO_VALID_MASK ;
@@ -3706,6 +3728,8 @@ static void vmcs12_save_pending_event(struct kvm_vcpu *vcpu, idt_vectoring |=INTR_TYPE_EXT_INTR ; vmcs12->idt_vectoring_info_field = idt_vectoring; + }else { + vmcs12->idt_vectoring_info_field =0 ; } }
@@ -4160,8 +4184,8 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,* Transfer the event that L0 or L1 may wanted to inject into * L2 to IDT_VECTORING_INFO_FIELD. */ - vmcs12->idt_vectoring_info_field =0 ; -vmcs12_save_pending_event (vcpu, vmcs12); +vmcs12_save_pending_event (vcpu, vmcs12, + vm_exit_reason, exit_intr_info); vmcs12->vm_exit_intr_info = exit_intr_info; vmcs12->vm_exit_instruction_len =vmcs_read32 (VM_EXIT_INSTRUCTION_LEN );
arch/x86/kvm/vmx/vmcs.h +5 -0
@@ -102,6 +102,11 @@ static inline bool is_breakpoint(u32 intr_info)return is_exception_n (intr_info,BP_VECTOR ); } +static inline bool is_double_fault (u32 intr_info) +{ +return is_exception_n (intr_info,DF_VECTOR ); +} +static inline bool is_page_fault (u32 intr_info) {return is_exception_n (intr_info,PF_VECTOR );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 270/452 platform/chrome: cros_ec: fix error handling in cros_ec_register()
In reply to Greg Kroah-HartmanFrom: Tzung-Bi Shih <[email protected]>
[ Upstream commit 2cd01bd6b117df07b1bc2852f08694fdd29e40ed ]
Fix cros_ec_register() to unregister platform devices if blocking_notifier_chain_register() fails.
Also use the single exit path to handle the platform device unregistration.
--- drivers/platform/chrome/cros_ec.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/platform/chrome/cros_ec.c +10 -6
@@ -175,6 +175,8 @@ int cros_ec_register(struct cros_ec_device *ec_dev) ec_dev->max_request =sizeof (struct ec_params_hello ); ec_dev->max_response =sizeof (struct ec_response_get_protocol_info ); ec_dev->max_passthru =0 ; + ec_dev->ec =NULL ; + ec_dev->pd =NULL ; ec_dev->din =devm_kzalloc (dev, ec_dev->din_size,GFP_KERNEL );if (!ec_dev->din)
@@ -231,18 +233,16 @@ int cros_ec_register(struct cros_ec_device *ec_dev)if (IS_ERR (ec_dev->pd)) {dev_err (ec_dev->dev,"Failed to create CrOS PD platform device\n" ); -platform_device_unregister (ec_dev->ec); -return PTR_ERR (ec_dev->pd); + err =PTR_ERR (ec_dev->pd); + goto exit; } }if (IS_ENABLED (CONFIG_OF ) && dev->of_node) { err =devm_of_platform_populate (dev);if (err) { -platform_device_unregister (ec_dev->pd); -platform_device_unregister (ec_dev->ec);dev_err (dev,"Failed to register sub-devices\n" ); -return err; + goto exit; } }
@@ -264,12 +264,16 @@ int cros_ec_register(struct cros_ec_device *ec_dev) err =blocking_notifier_chain_register (&ec_dev->event_notifier, &ec_dev->notifier_ready);if (err) -return err; + goto exit; }dev_info (dev,"Chrome EC device registered\n" );return 0 ; +exit: +platform_device_unregister (ec_dev->ec); +platform_device_unregister (ec_dev->pd); +return err; }EXPORT_SYMBOL (cros_ec_register);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 271/452 ARM: dts: imx6dl-colibri: Fix I2C pinmuxing
In reply to Greg Kroah-HartmanFrom: Max Krummenacher <[email protected]>
[ Upstream commit 5f5c579a34a87117c20b411df583ae816c1ec84f ]
Fix names of extra pingroup node and property for gpio bus recovery. Without the change i2c2 is not functional.
--- arch/arm/boot/dts/imx6qdl-colibri.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/imx6qdl-colibri.dtsi +3 -3
@@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0+ OR MIT /* - * Copyright 2014-2020 Toradex + * Copyright 2014-2022 Toradex * Copyright 2012 Freescale Semiconductor, Inc. * Copyright 2011 Linaro Ltd. */
@@ -132,7 +132,7 @@ clock-frequency = <100000>; pinctrl-names = "default", "gpio"; pinctrl-0 = <&pinctrl_i2c2>; - pinctrl-0 = <&pinctrl_i2c2_gpio>; + pinctrl-1 = <&pinctrl_i2c2_gpio>; scl-gpios = <&gpio2 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; sda-gpios = <&gpio3 16 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; status = "okay";
@@ -488,7 +488,7 @@ >; }; - pinctrl_i2c2_gpio: i2c2grp { + pinctrl_i2c2_gpio: i2c2gpiogrp { fsl,pins = < MX6QDL_PAD_EIM_EB2__GPIO2_IO30 0x4001b8b1 MX6QDL_PAD_EIM_D16__GPIO3_IO16 0x4001b8b1
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 272/452 platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 57b888ca2541785de2fcb90575b378921919b6c0 ]
Commit 413dda8f2c6f ("platform/chrome: cros_ec_chardev: Use cros_ec_cmd_xfer_status helper") inadvertendly changed the userspace ABI. Previously, cros_ec ioctls would only report errors if the EC communication failed, and otherwise return success and the result of the EC communication. An EC command execution failure was reported in the EC response field. The above mentioned commit changed this behavior, and the ioctl itself would fail. This breaks userspace commands trying to analyze the EC command execution error since the actual EC command response is no longer reported to userspace.
Fix the problem by re-introducing the cros_ec_cmd_xfer() helper, and use it to handle ioctl messages.
--- drivers/platform/chrome/cros_ec_chardev.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 50 +++++++++++++++++---- include/linux/platform_data/cros_ec_proto.h | 3 ++ 3 files changed, 45 insertions(+), 10 deletions(-)
drivers/platform/chrome/cros_ec_chardev.c +1 -1
@@ -301,7 +301,7 @@ static long cros_ec_chardev_ioctl_xcmd(struct cros_ec_dev *ec, void __user *arg) } s_cmd->command += ec->cmd_offset; - ret =cros_ec_cmd_xfer_status (ec->ec_dev, s_cmd); + ret =cros_ec_cmd_xfer (ec->ec_dev, s_cmd);/* Only copy data to userland if data was received. */ if (ret <0 ) goto exit;
drivers/platform/chrome/cros_ec_proto.c +41 -9
69 lines not on this page · raw message
include/linux/platform_data/cros_ec_proto.h +3 -0
@@ -216,6 +216,9 @@ int cros_ec_prepare_tx(struct cros_ec_device *ec_dev,int cros_ec_check_result (struct cros_ec_device *ec_dev,struct cros_ec_command *msg); +int cros_ec_cmd_xfer (struct cros_ec_device *ec_dev, +struct cros_ec_command *msg); +int cros_ec_cmd_xfer_status (struct cros_ec_device *ec_dev,struct cros_ec_command *msg);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 273/452 can: xilinx_can: mark bit timing constants as const
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
[ Upstream commit ae38fda02996d43d9fb09f16e81e0008704dd524 ]
This patch marks the bit timing constants as const.
--- drivers/net/can/xilinx_can.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/can/xilinx_can.c +2 -2
@@ -239,7 +239,7 @@ static const struct can_bittiming_const xcan_bittiming_const_canfd = { };/* AXI CANFD Data Bittiming constants as per AXI CANFD 1.0 specs */ -static struct can_bittiming_const xcan_data_bittiming_const_canfd = { +static const struct can_bittiming_const xcan_data_bittiming_const_canfd = { .name =DRIVER_NAME , .tseg1_min =1 , .tseg1_max =16 ,
@@ -265,7 +265,7 @@ static const struct can_bittiming_const xcan_bittiming_const_canfd2 = { };/* AXI CANFD 2.0 Data Bittiming constants as per AXI CANFD 2.0 spec */ -static struct can_bittiming_const xcan_data_bittiming_const_canfd2 = { +static const struct can_bittiming_const xcan_data_bittiming_const_canfd2 = { .name =DRIVER_NAME , .tseg1_min =1 , .tseg1_max =32 ,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 274/452 ARM: dts: stm32: Fix PHY post-reset delay on Avenger96
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit ef2d90708883f4025a801feb0ba8411a7a4387e1 ]
Per KSZ9031RNX PHY datasheet FIGURE 7-5: POWER-UP/POWER-DOWN/RESET TIMING Note 2: After the de-assertion of reset, wait a minimum of 100 μs before starting programming on the MIIM (MDC/MDIO) interface.
Add 1ms post-reset delay to guarantee this figure.
--- arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +1 -0
@@ -141,6 +141,7 @@ compatible = "snps,dwmac-mdio"; reset-gpios = <&gpioz 2 GPIO_ACTIVE_LOW>; reset-delay-us = <1000>; + reset-post-delay-us = <1000>; phy0: ethernet-phy@7 { reg = <7>;
Signature · 9 lines
2.35.1 _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Greg Kroah-Hartman
maintainerPATCH 275/452 ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
[ Upstream commit 2c663e5e5bbf2a5b85e0f76ccb69663f583c3e33 ]
The GPIOs 30 to 39 are connected to the Cypress CYW43438 (Wifi/BT). So fix the GPIO line names accordingly.
--- arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
arch/arm/boot/dts/bcm2835-rpi-zero-w.dts +12 -10
@@ -74,16 +74,18 @@ "GPIO27", "SDA0", "SCL0", - "NC", /* GPIO30 */ - "NC", /* GPIO31 */ - "NC", /* GPIO32 */ - "NC", /* GPIO33 */ - "NC", /* GPIO34 */ - "NC", /* GPIO35 */ - "NC", /* GPIO36 */ - "NC", /* GPIO37 */ - "NC", /* GPIO38 */ - "NC", /* GPIO39 */ + /* Used by BT module */ + "CTS0", + "RTS0", + "TXD0", + "RXD0", + /* Used by Wifi */ + "SD1_CLK", + "SD1_CMD", + "SD1_DATA0", + "SD1_DATA1", + "SD1_DATA2", + "SD1_DATA3", "CAM_GPIO1", /* GPIO40 */ "WL_ON", /* GPIO41 */ "NC", /* GPIO42 */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 276/452 ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
[ Upstream commit 9fd26fd02749ec964eb0d588a3bab9e09bf77927 ]
The GPIOs 46 & 47 are already used for a I2C interface to a SMPS. So fix the GPIO line names accordingly.
--- arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +2 -2
@@ -63,8 +63,8 @@ "GPIO43", "GPIO44", "GPIO45", - "GPIO46", - "GPIO47", + "SMPS_SCL", + "SMPS_SDA", /* Used by eMMC */ "SD_CLK_R", "SD_CMD_R",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 277/452 ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED
In reply to Greg Kroah-HartmanFrom: Phil Elwell <[email protected]>
[ Upstream commit 57f718aa4b93392fb1a8c0a874ab882b9e18136a ]
The red LED on the Raspberry Pi 3 B Plus is the power LED. So fix the GPIO line name accordingly.
--- arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +1 -1
@@ -45,7 +45,7 @@ #gpio-cells = <2>; gpio-line-names = "BT_ON", "WL_ON", - "STATUS_LED_R", + "PWR_LED_R", "LAN_RUN", "", "CAM_GPIO0",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 278/452 ARM: dts: bcm2835-rpi-b: Fix GPIO line names
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 97bd8659c1c46c23e4daea7e040befca30939950 ]
Recently this has been fixed in the vendor tree, so upstream this.
--- arch/arm/boot/dts/bcm2835-rpi-b.dts | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
arch/arm/boot/dts/bcm2835-rpi-b.dts +6 -7
@@ -53,18 +53,17 @@ "GPIO18", "NC", /* GPIO19 */ "NC", /* GPIO20 */ - "GPIO21", + "CAM_GPIO0", "GPIO22", "GPIO23", "GPIO24", "GPIO25", "NC", /* GPIO26 */ - "CAM_GPIO0", - /* Binary number representing build/revision */ - "CONFIG0", - "CONFIG1", - "CONFIG2", - "CONFIG3", + "GPIO27", + "GPIO28", + "GPIO29", + "GPIO30", + "GPIO31", "NC", /* GPIO32 */ "NC", /* GPIO33 */ "NC", /* GPIO34 */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 279/452 misc: ocxl: fix possible double free in ocxl_file_register_afu
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 950cf957fe34d40d63dfa3bf3968210430b6491e ]
info_release() will be called in device_unregister() when info->dev's reference count is 0. So there is no need to call ocxl_afu_put() and kfree() again.
Fix this by adding free_minor() and return to err_unregister error path.
--- drivers/misc/ocxl/file.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/misc/ocxl/file.c +2 -0
@@ -558,7 +558,9 @@ int ocxl_file_register_afu(struct ocxl_afu *afu) err_unregister:ocxl_sysfs_unregister_afu (info);// safe to call even if register failed +free_minor (info);device_unregister (&info->dev); +return rc; err_put:ocxl_afu_put (afu);free_minor (info);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 280/452 crypto: marvell/cesa - ECB does not IV
In reply to Greg Kroah-HartmanFrom: Corentin Labbe <[email protected]>
[ Upstream commit 4ffa1763622ae5752961499588f3f8874315f974 ]
The DES3 ECB has an IV size set but ECB does not need one.
--- drivers/crypto/marvell/cesa/cipher.c | 1 - 1 file changed, 1 deletion(-)
drivers/crypto/marvell/cesa/cipher.c +0 -1
@@ -614,7 +614,6 @@ struct skcipher_alg mv_cesa_ecb_des3_ede_alg = { .decrypt = mv_cesa_ecb_des3_ede_decrypt, .min_keysize = DES3_EDE_KEY_SIZE, .max_keysize = DES3_EDE_KEY_SIZE, - .ivsize = DES3_EDE_BLOCK_SIZE, .base = { .cra_name = "ecb(des3_ede)", .cra_driver_name = "mv-ecb-des3-ede",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 281/452 gpiolib: of: Introduce hook for missing gpio-ranges
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 3550bba25d5587a701e6edf20e20984d2ee72c78 ]
Since commit 2ab73c6d8323 ("gpio: Support GPIO controllers without pin-ranges") the device tree nodes of GPIO controller need the gpio-ranges property to handle gpio-hogs. Unfortunately it's impossible to guarantee that every new kernel is shipped with an updated device tree binary.
In order to provide backward compatibility with those older DTB, we need a callback within of_gpiochip_add_pin_range() so the relevant platform driver can handle this case.
--- drivers/gpio/gpiolib-of.c | 5 +++++ include/linux/gpio/driver.h | 12 ++++++++++++ 2 files changed, 17 insertions(+)
drivers/gpio/gpiolib-of.c +5 -0
@@ -933,6 +933,11 @@ static int of_gpiochip_add_pin_range(struct gpio_chip *chip)if (!np)return 0 ; +if (!of_property_read_bool (np,"gpio-ranges" ) && + chip->of_gpio_ranges_fallback) { +return chip->of_gpio_ranges_fallback (chip, np); + } + group_names =of_find_property (np, group_names_propname,NULL );for (;; index++) {
include/linux/gpio/driver.h +12 -0
@@ -477,6 +477,18 @@ struct gpio_chip {*/ int (*of_xlate)(struct gpio_chip *gc,const struct of_phandle_args *gpiospec,u32 *flags); + +/** +* @of_gpio_ranges_fallback: +* +* Optional hook for the case that no gpio-ranges property is defined +* within the device tree node "np" (usually DT before introduction +* of gpio-ranges). So this callback is helpful to provide the +* necessary backward compatibility for the pin ranges. +*/ +int (*of_gpio_ranges_fallback)(struct gpio_chip *gc, +struct device_node *np); +#endif /* CONFIG_OF_GPIO */ };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 282/452 pinctrl: bcm2835: implement hook for missing gpio-ranges
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit d2b67744fd99b06555b7e4d67302ede6c7c6a638 ]
The commit c8013355ead6 ("ARM: dts: gpio-ranges property is now required") fixed the GPIO probing issues caused by "pinctrl: bcm2835: Change init order for gpio hogs". This changed only the kernel DTS files. Unfortunately it isn't guaranteed that these files are shipped to all users.
So implement the necessary backward compatibility for BCM2835 and BCM2711 platform.
--- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/pinctrl/bcm/pinctrl-bcm2835.c +18 -0
@@ -351,6 +351,22 @@ static int bcm2835_gpio_direction_output(struct gpio_chip *chip,return pinctrl_gpio_direction_output (chip->base + offset); } +static int bcm2835_of_gpio_ranges_fallback (struct gpio_chip *gc, +struct device_node *np) +{ +struct pinctrl_dev *pctldev =of_pinctrl_get (np); + +of_node_put (np); + +if (!pctldev) +return 0 ; + +gpiochip_add_pin_range (gc,pinctrl_dev_get_devname (pctldev),0 ,0 , + gc->ngpio); + +return 0 ; +} +static const struct gpio_chip bcm2835_gpio_chip = { .label =MODULE_NAME , .owner =THIS_MODULE ,
@@ -365,6 +381,7 @@ static const struct gpio_chip bcm2835_gpio_chip = { .base = -1, .ngpio = BCM2835_NUM_GPIOS, .can_sleep = false, + .of_gpio_ranges_fallback = bcm2835_of_gpio_ranges_fallback, };static const struct gpio_chip bcm2711_gpio_chip = {
@@ -381,6 +398,7 @@ static const struct gpio_chip bcm2711_gpio_chip = { .base = -1, .ngpio = BCM2711_NUM_GPIOS, .can_sleep = false, + .of_gpio_ranges_fallback = bcm2835_of_gpio_ranges_fallback, }; static void bcm2835_gpio_irq_handle_bank(struct bcm2835_pinctrl *pc,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 283/452 arm: mediatek: select arch timer for mt7629
In reply to Greg Kroah-HartmanFrom: Chuanhong Guo <[email protected]>
[ Upstream commit d66aea197d534e23d4989eb72fca9c0c114b97c9 ]
This chip has an armv7 arch timer according to the dts. Select it in Kconfig to enforce the support for it.
Otherwise the system time is just completely wrong if user forget to enable ARM_ARCH_TIMER in kernel config.
--- arch/arm/mach-mediatek/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-mediatek/Kconfig +1 -0
@@ -30,6 +30,7 @@ config MACH_MT7623 config MACH_MT7629 bool "MediaTek MT7629 SoCs support" default ARCH_MEDIATEK + select HAVE_ARM_ARCH_TIMER config MACH_MT8127 bool "MediaTek MT8127 SoCs support"
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 284/452 powerpc/fadump: fix PT_LOAD segment for boot memory area
In reply to Greg Kroah-HartmanFrom: Hari Bathini <[email protected]>
[ Upstream commit 15eb77f873255cf9f4d703b63cfbd23c46579654 ]
Boot memory area is setup as separate PT_LOAD segment in the vmcore as it is moved by f/w, on crash, to a destination address provided by the kernel. Having separate PT_LOAD segment helps in handling the different physical address and offset for boot memory area in the vmcore.
Commit ced1bf52f477 ("powerpc/fadump: merge adjacent memory ranges to reduce PT_LOAD segements") inadvertly broke this pre-condition for cases where some of the first kernel memory is available adjacent to boot memory area. This scenario is rare but possible when memory for fadump could not be reserved adjacent to boot memory area owing to memory hole or such. Reading memory from a vmcore exported in such scenario provides incorrect data. Fix it by ensuring no other region is folded into boot memory area.
--- arch/powerpc/kernel/fadump.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/powerpc/kernel/fadump.c +6 -2
@@ -861,7 +861,6 @@ static int fadump_alloc_mem_ranges(struct fadump_mrange_info *mrange_info) sizeof(struct fadump_memory_range));return 0 ; } -static inline int fadump_add_mem_range (struct fadump_mrange_info *mrange_info,u64 base,u64 end) {
@@ -880,7 +879,12 @@ static inline int fadump_add_mem_range(struct fadump_mrange_info *mrange_info, start = mem_ranges[mrange_info->mem_range_cnt -1 ].base; size = mem_ranges[mrange_info->mem_range_cnt -1 ].size; -if ((start + size) == base) +/* +* Boot memory area needs separate PT_LOAD segment(s) as it +* is moved to a different location at the time of crash. +* So, fold only if the region is not boot memory area. +*/ +if ((start + size) == base && start >= fw_dump.boot_mem_top) is_adjacent = true; }if (!is_adjacent) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 285/452 mfd: ipaq-micro: Fix error check return value of platform_get_irq()
In reply to Greg Kroah-HartmanFrom: Lv Ruyi <[email protected]>
[ Upstream commit 3b49ae380ce1a3054e0c505dd9a356b82a5b48e8 ]
platform_get_irq() return negative value on failure, so null check of irq is incorrect. Fix it by comparing whether it is less than zero.
--- drivers/mfd/ipaq-micro.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/ipaq-micro.c +1 -1
@@ -403,7 +403,7 @@ static int __init micro_probe(struct platform_device *pdev)micro_reset_comm (micro); irq =platform_get_irq (pdev,0 ); -if (!irq) +if (irq <0 )return -EINVAL ; ret = devm_request_irq(&pdev->dev, irq, micro_serial_isr, IRQF_SHARED, "ipaq-micro",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 286/452 scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 54db804d5d7d36709d1ce70bde3b9a6c61b290b6 ]
Fix the following Wstringop-overflow warnings when building with GCC-11:
drivers/scsi/fcoe/fcoe.c: In function ‘fcoe_netdev_config’:drivers/scsi/fcoe/fcoe.c:744:32: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
744 | wwnn = fcoe_wwn_from_mac(ctlr->ctl_src_addr, 1, 0);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/scsi/fcoe/fcoe.c:744:32: note: referencing argument 1 of type ‘unsigned char *’
In file included from drivers/scsi/fcoe/fcoe.c:36:
./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~
drivers/scsi/fcoe/fcoe.c:747:32: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
747 | wwpn = fcoe_wwn_from_mac(ctlr->ctl_src_addr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
748 | 2, 0);
| ~~~~~
drivers/scsi/fcoe/fcoe.c:747:32: note: referencing argument 1 of type ‘unsigned char *’
In file included from drivers/scsi/fcoe/fcoe.c:36:
./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~ CC drivers/scsi/bnx2fc/bnx2fc_io.o
In function ‘bnx2fc_net_config’,
inlined from ‘bnx2fc_if_create’ at drivers/scsi/bnx2fc/bnx2fc_fcoe.c:1543:7:drivers/scsi/bnx2fc/bnx2fc_fcoe.c:833:32: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
833 | wwnn = fcoe_wwn_from_mac(ctlr->ctl_src_addr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
834 | 1, 0);
| ~~~~~
drivers/scsi/bnx2fc/bnx2fc_fcoe.c: In function ‘bnx2fc_if_create’:
drivers/scsi/bnx2fc/bnx2fc_fcoe.c:833:32: note: referencing argument 1 of type ‘unsigned char *’
In file included from drivers/scsi/bnx2fc/bnx2fc.h:53,
from drivers/scsi/bnx2fc/bnx2fc_fcoe.c:17:
./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~
In function ‘bnx2fc_net_config’,
inlined from ‘bnx2fc_if_create’ at drivers/scsi/bnx2fc/bnx2fc_fcoe.c:1543:7:
drivers/scsi/bnx2fc/bnx2fc_fcoe.c:839:32: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
839 | wwpn = fcoe_wwn_from_mac(ctlr->ctl_src_addr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
840 | 2, 0);
| ~~~~~
drivers/scsi/bnx2fc/bnx2fc_fcoe.c: In function ‘bnx2fc_if_create’:
drivers/scsi/bnx2fc/bnx2fc_fcoe.c:839:32: note: referencing argument 1 of type ‘unsigned char *’
In file included from drivers/scsi/bnx2fc/bnx2fc.h:53,
from drivers/scsi/bnx2fc/bnx2fc_fcoe.c:17:
./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~
drivers/scsi/qedf/qedf_main.c: In function ‘__qedf_probe’:
drivers/scsi/qedf/qedf_main.c:3520:30: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
3520 | qedf->wwnn = fcoe_wwn_from_mac(qedf->mac, 1, 0);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/scsi/qedf/qedf_main.c:3520:30: note: referencing argument 1 of type ‘unsigned char *’ In file included from drivers/scsi/qedf/qedf.h:9,
from drivers/scsi/qedf/qedf_main.c:23:./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~
drivers/scsi/qedf/qedf_main.c:3521:30: warning: ‘fcoe_wwn_from_mac’ accessing 32 bytes in a region of size 6 [-Wstringop-overflow=]
3521 | qedf->wwpn = fcoe_wwn_from_mac(qedf->mac, 2, 0);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/scsi/qedf/qedf_main.c:3521:30: note: referencing argument 1 of type ‘unsigned char *’ In file included from drivers/scsi/qedf/qedf.h:9,
from drivers/scsi/qedf/qedf_main.c:23:./include/scsi/libfcoe.h:252:5: note: in a call to function ‘fcoe_wwn_from_mac’
252 | u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
| ^~~~~~~~~~~~~~~~~by changing the array size to the correct value of ETH_ALEN in the argument declaration.
Also, fix a couple of checkpatch warnings:
WARNING: function definition argument 'unsigned int' should also have an identifier name
This helps with the ongoing efforts to globally enable -Wstringop-overflow.
--- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- include/scsi/libfcoe.h | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/fcoe/fcoe_ctlr.c +1 -1
@@ -1969,7 +1969,7 @@ EXPORT_SYMBOL(fcoe_ctlr_recv_flogi);* * Returns: u64 fc world wide name */ -u64 fcoe_wwn_from_mac (unsigned char mac[MAX_ADDR_LEN ], +u64 fcoe_wwn_from_mac (unsigned char mac[ETH_ALEN ],unsigned int scheme,unsigned int port) {u64 wwn;
include/scsi/libfcoe.h +2 -1
@@ -249,7 +249,8 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *, struct fc_lport *, struct fc_frame *);/* libfcoe funcs */ -u64 fcoe_wwn_from_mac (unsigned char mac[MAX_ADDR_LEN ],unsigned int ,unsigned int ); +u64 fcoe_wwn_from_mac (unsigned char mac[ETH_ALEN ],unsigned int scheme, +unsigned int port);int fcoe_libfc_config (struct fc_lport *,struct fcoe_ctlr *,const struct libfc_function_template *,int init_fcp);u32 fcoe_fc_crc (struct fc_frame *fp);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 287/452 firmware: arm_scmi: Fix list protocols enumeration in the base protocol
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit 8009120e0354a67068e920eb10dce532391361d0 ]
While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is currently validated in an improper way since the check employs a sum between unsigned integers that could overflow and cause the check itself to be silently bypassed if the returned value 'loop_num_ret' is big enough.
Fix the validation avoiding the addition.
--- drivers/firmware/arm_scmi/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/arm_scmi/base.c +1 -1
@@ -188,7 +188,7 @@ static int scmi_base_implementation_list_get(const struct scmi_handle *handle,break ; loop_num_ret =le32_to_cpu (*num_ret); -if (tot_num_ret + loop_num_ret >MAX_PROTOCOLS_IMP ) { +if (loop_num_ret >MAX_PROTOCOLS_IMP - tot_num_ret) {dev_err (dev,"No. of Protocol > MAX_PROTOCOLS_IMP" );break ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 288/452 nvdimm: Fix firmware activation deadlock scenarios
In reply to Greg Kroah-HartmanFrom: Dan Williams <[email protected]>
[ Upstream commit e6829d1bd3c4b58296ee9e412f7ed4d6cb390192 ]
Lockdep reports the following deadlock scenarios for CXL root device power-management, device_prepare(), operations, and device_shutdown() operations for 'nd_region' devices:
Chain exists of: &nvdimm_region_key --> &nvdimm_bus->reconfig_mutex --> system_transition_mutex Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(system_transition_mutex);
lock(&nvdimm_bus->reconfig_mutex);
lock(system_transition_mutex); lock(&nvdimm_region_key);
Chain exists of: &cxl_nvdimm_bridge_key --> acpi_scan_lock --> &cxl_root_key Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&cxl_root_key);
lock(acpi_scan_lock);
lock(&cxl_root_key); lock(&cxl_nvdimm_bridge_key);
These stem from holding nvdimm_bus_lock() over hibernate_quiet_exec() which walks the entire system device topology taking device_lock() along the way. The nvdimm_bus_lock() is protecting against unregistration, multiple simultaneous ops callers, and preventing activate_show() from racing activate_store(). For the first 2, the lock is redundant. Unregistration already flushes all ops users, and sysfs already prevents multiple threads to be active in an ops handler at the same time. For the last userspace should already be waiting for its last activate_store() to complete, and does not need activate_show() to flush the write side, so this lock usage can be deleted in these attributes.
--- drivers/nvdimm/core.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/nvdimm/core.c +0 -9
@@ -400,9 +400,7 @@ static ssize_t capability_show(struct device *dev,if (!nd_desc->fw_ops)return -EOPNOTSUPP ; -nvdimm_bus_lock (dev); cap = nd_desc->fw_ops->capability (nd_desc); -nvdimm_bus_unlock (dev);switch (cap) {case NVDIMM_FWA_CAP_QUIESCE :
@@ -427,10 +425,8 @@ static ssize_t activate_show(struct device *dev,if (!nd_desc->fw_ops)return -EOPNOTSUPP ; -nvdimm_bus_lock (dev); cap = nd_desc->fw_ops->capability (nd_desc); state = nd_desc->fw_ops->activate_state (nd_desc); -nvdimm_bus_unlock (dev);if (cap <NVDIMM_FWA_CAP_QUIESCE )return -EOPNOTSUPP ;
@@ -475,7 +471,6 @@ static ssize_t activate_store(struct device *dev,else return -EINVAL ; -nvdimm_bus_lock (dev); state = nd_desc->fw_ops->activate_state (nd_desc);switch (state) {
@@ -493,7 +488,6 @@ static ssize_t activate_store(struct device *dev,default : rc = -ENXIO ; } -nvdimm_bus_unlock (dev);if (rc ==0 ) rc = len;
@@ -516,10 +510,7 @@ static umode_t nvdimm_bus_firmware_visible(struct kobject *kobj, struct attributif (!nd_desc->fw_ops)return 0 ; -nvdimm_bus_lock (dev); cap = nd_desc->fw_ops->capability (nd_desc); -nvdimm_bus_unlock (dev); -if (cap <NVDIMM_FWA_CAP_QUIESCE )return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 289/452 nvdimm: Allow overwrite in the presence of disabled dimms
In reply to Greg Kroah-HartmanFrom: Dan Williams <[email protected]>
[ Upstream commit bb7bf697fed58eae9d3445944e457ab0de4da54f ]
It is not clear why the original implementation of overwrite support required the dimm driver to be active before overwrite could proceed. In fact that can lead to cases where the kernel retains an invalid cached copy of the labels from before the overwrite. Unfortunately the kernel has not only allowed that case, but enforced it.
Going forward, allow for overwrite to happen while the label area is offline, and follow-on with updates to 'ndctl sanitize-dimm --overwrite' to trigger the label area invalidation by default.
--- drivers/nvdimm/security.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/nvdimm/security.c +0 -5
@@ -379,11 +379,6 @@ static int security_overwrite(struct nvdimm *nvdimm, unsigned int keyid) || !nvdimm->sec.flags)return -EOPNOTSUPP ; -if (dev->driver ==NULL ) { -dev_dbg (dev,"Unable to overwrite while DIMM active.\n" ); -return -EINVAL ; - } - rc =check_security_state (nvdimm);if (rc)return rc;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 290/452 pinctrl: mvebu: Fix irq_of_parse_and_map() return value
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 71bc7cf3be65bab441e03667cf215c557712976c ]
The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO.
--- drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +1 -1
@@ -781,7 +781,7 @@ static int armada_37xx_irqchip_register(struct platform_device *pdev,for (i =0 ; i < nr_irq_parent; i++) {int irq =irq_of_parse_and_map (np, i); -if (irq <0 ) +if (!irq)continue ; girq->parents[i] = irq; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 291/452 drivers/base/node.c: fix compaction sysfs file leak
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit da63dc84befaa9e6079a0bc363ff0eaa975f9073 ]
Compaction sysfs file is created via compaction_register_node in register_node. But we forgot to remove it in unregister_node. Thus compaction sysfs file is leaked. Using compaction_unregister_node to fix this issue.
--- drivers/base/node.c | 1 + 1 file changed, 1 insertion(+)
drivers/base/node.c +1 -0
@@ -655,6 +655,7 @@ static int register_node(struct node *node, int num)*/ void unregister_node (struct node *node) { +compaction_unregister_node (node);hugetlb_unregister_node (node);/* no-op, if memoryless node */ node_remove_accesses (node);node_remove_caches (node);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 292/452 dax: fix cache flush on PMD-mapped pages
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
[ Upstream commit e583b5c472bd23d450e06f148dc1f37be74f7666 ]
The flush_cache_page() only remove a PAGE_SIZE sized range from the cache. However, it does not cover the full pages in a THP except a head page. Replace it with flush_cache_range() to fix this issue. This is just a documentation issue with the respect to properly documenting the expected usage of cache flushing before modifying the pmd. However, in practice this is not a problem due to the fact that DAX is not available on architectures with virtually indexed caches per:
commit d92576f1167c ("dax: does not work correctly with virtual aliasing caches")
--- fs/dax.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/dax.c +2 -1
@@ -846,7 +846,8 @@ static void dax_entry_mkclean(struct address_space *mapping, pgoff_t index,if (!pmd_dirty (*pmdp) && !pmd_write (*pmdp)) goto unlock_pmd; -flush_cache_page (vma, address, pfn); +flush_cache_range (vma, address, + address +HPAGE_PMD_SIZE ); pmd =pmdp_invalidate (vma, address, pmdp); pmd =pmd_wrprotect (pmd); pmd =pmd_mkclean (pmd);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 293/452 drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit f47f758cff59c68015d6b9b9c077110df7c2c828 ]
__add_memory_block() calls both put_device() and device_unregister() when storing the memory block into the xarray. This is incorrect because xarray doesn't take an additional reference and device_unregister() already calls put_device().
Triggering the issue looks really unlikely and its only effect should be to log a spurious warning about a ref counted issue.
--- drivers/base/memory.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/base/memory.c +2 -3
@@ -560,10 +560,9 @@ int register_memory(struct memory_block *memory) } ret =xa_err (xa_store (&memory_blocks, memory->dev.id, memory,GFP_KERNEL )); -if (ret) { -put_device (&memory->dev); +if (ret)device_unregister (&memory->dev); - } +return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 294/452 powerpc/8xx: export cpm_setbrg for modules
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 22f8e625ebabd7ed3185b82b44b4f12fc0402113 ]
Fix missing export for a loadable module build:
ERROR: modpost: "cpm_setbrg" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined!
--- arch/powerpc/platforms/8xx/cpm1.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/8xx/cpm1.c +1 -0
@@ -280,6 +280,7 @@ cpm_setbrg(uint brg, uint rate)out_be32 (bp, (((BRG_UART_CLK_DIV16 / rate) -1 ) <<1 ) |CPM_BRG_EN |CPM_BRG_DIV16 ); } +EXPORT_SYMBOL (cpm_setbrg);struct cpm_ioport16 {__be16 dir, par, odr_sor, dat, intr;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 295/452 pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 5376e3d904532e657fd7ca1a9b1ff3d351527b90 ]
It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref.
And use devm_platform_get_and_ioremap_resource() to simplify code.
--- drivers/pinctrl/renesas/core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/pinctrl/renesas/core.c +3 -4
@@ -71,12 +71,11 @@ static int sh_pfc_map_resources(struct sh_pfc *pfc,/* Fill them. */ for (i =0 ; i < num_windows; i++) { - res =platform_get_resource (pdev,IORESOURCE_MEM , i); - windows->phys = res->start; - windows->size =resource_size (res); - windows->virt =devm_ioremap_resource (pfc->dev, res); + windows->virt =devm_platform_get_and_ioremap_resource (pdev, i, &res);if (IS_ERR (windows->virt))return -ENOMEM ; + windows->phys = res->start; + windows->size =resource_size (res); windows++; }for (i =0 ; i < num_irqs; i++)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 296/452 powerpc/idle: Fix return value of __setup() handler
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit b793a01000122d2bd133ba451a76cc135b5e162c ]
__setup() handlers should return 1 to obsolete_checksetup() in init/main.c to indicate that the boot option has been handled.
A return of 0 causes the boot option/value to be listed as an Unknown kernel parameter and added to init's (limited) argument or environment strings.
Also, error return codes don't mean anything to obsolete_checksetup() -- only non-zero (usually 1) or zero. So return 1 from powersave_off().
--- arch/powerpc/kernel/idle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/idle.c +1 -1
@@ -37,7 +37,7 @@ static int __init powersave_off(char *arg) { ppc_md.power_save =NULL ; cpuidle_disable =IDLE_POWERSAVE_OFF ; -return 0 ; +return 1 ; }__setup ("powersave=off" , powersave_off);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 297/452 powerpc/4xx/cpm: Fix return value of __setup() handler
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 5bb99fd4090fe1acfdb90a97993fcda7f8f5a3d6 ]
__setup() handlers should return 1 to obsolete_checksetup() in init/main.c to indicate that the boot option has been handled.
A return of 0 causes the boot option/value to be listed as an Unknown kernel parameter and added to init's (limited) argument or environment strings.
Also, error return codes don't mean anything to obsolete_checksetup() -- only non-zero (usually 1) or zero. So return 1 from cpm_powersave_off().
--- arch/powerpc/platforms/4xx/cpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/4xx/cpm.c +1 -1
@@ -327,6 +327,6 @@ late_initcall(cpm_init);static int __init cpm_powersave_off (char *arg) { cpm.powersave_off =1 ; -return 0 ; +return 1 ; }__setup ("powersave=off" , cpm_powersave_off);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 298/452 ASoC: atmel-pdmic: Remove endianness flag on pdmic component
In reply to Greg Kroah-HartmanFrom: Charles Keepax <[email protected]>
[ Upstream commit 52857c3baa0e5ddeba7b2c84e56bb71c9674e048 ]
The endianness flag should have been removed when the driver was ported across from having both a CODEC and CPU side component, to just having a CPU component and using the dummy for the CODEC. The endianness flag is used to indicate that the device is completely ambivalent to the endianness of the data, typically due to the endianness being lost over the hardware link (ie. the link defines bit ordering). It's usage didn't have any effect when the driver had both a CPU and CODEC component, since the union of those equals the CPU side settings, but now causes the driver to falsely report it supports big endian. Correct this by removing the flag.
--- sound/soc/atmel/atmel-pdmic.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/atmel/atmel-pdmic.c +0 -1
@@ -481,7 +481,6 @@ static const struct snd_soc_component_driver atmel_pdmic_cpu_dai_component = { .num_controls = ARRAY_SIZE(atmel_pdmic_snd_controls), .idle_bias_on = 1, .use_pmdown_time = 1, - .endianness = 1, };/* ASoC sound card */
Signature · 1 line
2.35.1