5.18.3-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 389/879 irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f03a9670d27d23fe734a456f16e2579b21ec02b4 ]
The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO.
--- drivers/irqchip/irq-aspeed-scu-ic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/irqchip/irq-aspeed-scu-ic.c +2 -2
@@ -157,8 +157,8 @@ static int aspeed_scu_ic_of_init_common(struct aspeed_scu_ic *scu_ic, } irq =irq_of_parse_and_map (node,0 ); -if (irq <0 ) { - rc = irq; +if (!irq) { + rc = -EINVAL ; goto err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 390/879 x86/mm: Cleanup the control_va_addr_alignment() __setup handler
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 1ef64b1e89e6d4018da46e08ffc32779a31160c7 ]
Clean up control_va_addr_alignment():
a. Make '=' required instead of optional (as documented). b. Print a warning if an invalid option value is used.
c. Return 1 from the __setup handler when an invalid option value is
used. This prevents the kernel from polluting init's (limited) environment space with the entire string.
--- arch/x86/kernel/sys_x86_64.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
arch/x86/kernel/sys_x86_64.c +2 -5
@@ -68,9 +68,6 @@ static int __init control_va_addr_alignment(char *str)if (*str ==0 )return 1 ; -if (*str =='=' ) - str++; -if (!strcmp (str,"32" )) va_align.flags =ALIGN_VA_32 ;else if (!strcmp (str,"64" ))
@@ -80,11 +77,11 @@ static int __init control_va_addr_alignment(char *str)else if (!strcmp (str,"on" )) va_align.flags =ALIGN_VA_32 |ALIGN_VA_64 ;else -return 0 ; +pr_warn ("invalid option value: 'align_va_addr=%s'\n" , str);return 1 ; } -__setup ("align_va_addr" , control_va_addr_alignment); +__setup ("align_va_addr=" , control_va_addr_alignment); SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len, unsigned long, prot, unsigned long, flags,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 391/879 arm64: fix types in copy_highpage()
In reply to Greg Kroah-HartmanFrom: Tong Tiangen <[email protected]>
[ Upstream commit 921d161f15d6b090599f6a8c23f131969edbd1fa ]
In copy_highpage() the kto and kfrom local variables are pointers to struct page, but these are used to hold arbitrary pointers to kernel memory . Each call to page_address() returns a void pointer to memory associated with the relevant page, and copy_page() expects void pointers to this memory.
This inconsistency was introduced in commit 2563776b41c3 ("arm64: mte:
Tags-aware copy_{user_,}highpage() implementations") and while this doesn't appear to be harmful in practice it is clearly wrong.
Correct this by making kto and kfrom void pointers.
--- arch/arm64/mm/copypage.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/mm/copypage.c +2 -2
@@ -16,8 +16,8 @@void copy_highpage (struct page *to,struct page *from) { -struct page *kto =page_address (to); -struct page *kfrom =page_address (from); +void *kto =page_address (to); +void *kfrom =page_address (from);copy_page (kto, kfrom);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 392/879 regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET
In reply to Greg Kroah-HartmanFrom: Zev Weiss <[email protected]>
[ Upstream commit c3e3ca05dae37f8f74bb80358efd540911cbc2c8 ]
Since the introduction of regulator->enable_count, a driver that did an exclusive get on an already-enabled regulator would end up with enable_count initialized to 0 but rdev->use_count initialized to 1. With that starting point the regulator is effectively stuck enabled, because if the driver attempted to disable it it would fail the enable_count underflow check in _regulator_handle_consumer_disable().
The EXCLUSIVE_GET path in _regulator_get() now initializes enable_count along with rdev->use_count so that the regulator can be disabled without underflowing the former.
--- drivers/regulator/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/regulator/core.c +5 -2
@@ -2133,10 +2133,13 @@ struct regulator *_regulator_get(struct device *dev, const char *id, rdev->exclusive =1 ; ret =_regulator_is_enabled (rdev); -if (ret >0 ) +if (ret >0 ) { rdev->use_count =1 ; -else + regulator->enable_count =1 ; + }else { rdev->use_count =0 ; + regulator->enable_count =0 ; + } } link =device_link_add (dev, &rdev->dev,DL_FLAG_STATELESS );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 393/879 wl1251: dynamically allocate memory used for DMA
In reply to Greg Kroah-HartmanFrom: H. Nikolaus Schaller <[email protected]>
[ Upstream commit 454744754cbf2c21b3fc7344e46e10bee2768094 ]
With introduction of vmap'ed stacks, stack parameters can no longer be used for DMA and now leads to kernel panic.
It happens at several places for the wl1251 (e.g. when accessed through SDIO) making it unuseable on e.g. the OpenPandora.
We solve this by allocating temporary buffers or use wl1251_read32().
Tested on v5.18-rc5 with OpenPandora.
--- drivers/net/wireless/ti/wl1251/event.c | 22 ++++++++++++++-------- drivers/net/wireless/ti/wl1251/io.c | 20 ++++++++++++++------ drivers/net/wireless/ti/wl1251/tx.c | 15 +++++++++++---- 3 files changed, 39 insertions(+), 18 deletions(-)
drivers/net/wireless/ti/wl1251/event.c +14 -8
@@ -169,11 +169,9 @@ int wl1251_event_wait(struct wl1251 *wl, u32 mask, int timeout_ms)msleep (1 );/* read from both event fields */ -wl1251_mem_read (wl, wl->mbox_ptr[0 ], &events_vector, -sizeof (events_vector)); + events_vector =wl1251_mem_read32 (wl, wl->mbox_ptr[0 ]); event = events_vector & mask; -wl1251_mem_read (wl, wl->mbox_ptr[1 ], &events_vector, -sizeof (events_vector)); + events_vector =wl1251_mem_read32 (wl, wl->mbox_ptr[1 ]); event |= events_vector & mask; }while (!event);
@@ -202,7 +200,7 @@ void wl1251_event_mbox_config(struct wl1251 *wl)int wl1251_event_handle (struct wl1251 *wl,u8 mbox_num) { -struct event_mailbox mbox; +struct event_mailbox *mbox;int ret;wl1251_debug (DEBUG_EVENT ,"EVENT on mbox %d" , mbox_num);
@@ -210,12 +208,20 @@ int wl1251_event_handle(struct wl1251 *wl, u8 mbox_num)if (mbox_num >1 )return -EINVAL ; + mbox =kmalloc (sizeof (*mbox),GFP_KERNEL ); +if (!mbox) { +wl1251_error ("can not allocate mbox buffer" ); +return -ENOMEM ; + } +/* first we read the mbox descriptor */ -wl1251_mem_read (wl, wl->mbox_ptr[mbox_num], &mbox, -sizeof (struct event_mailbox )); +wl1251_mem_read (wl, wl->mbox_ptr[mbox_num], mbox, +sizeof (*mbox));/* process the descriptor */ - ret =wl1251_event_process (wl, &mbox); + ret =wl1251_event_process (wl, mbox); +kfree (mbox); +if (ret <0 )return ret;
drivers/net/wireless/ti/wl1251/io.c +14 -6
@@ -121,7 +121,13 @@ void wl1251_set_partition(struct wl1251 *wl, u32 mem_start, u32 mem_size, u32 reg_start, u32 reg_size) { - struct wl1251_partition partition[2]; + struct wl1251_partition_set *partition; + + partition =kmalloc (sizeof (*partition),GFP_KERNEL ); +if (!partition) { +wl1251_error ("can not allocate partition buffer" ); +return ; + }wl1251_debug (DEBUG_SPI ,"mem_start %08X mem_size %08X" , mem_start, mem_size);
@@ -164,10 +170,10 @@ void wl1251_set_partition(struct wl1251 *wl, reg_start, reg_size); } - partition[0 ].start = mem_start; - partition[0 ].size = mem_size; - partition[1 ].start = reg_start; - partition[1 ].size = reg_size; + partition->mem.start = mem_start; + partition->mem.size = mem_size; + partition->reg.start = reg_start; + partition->reg.size = reg_size; wl->physical_mem_addr = mem_start; wl->physical_reg_addr = reg_start;
@@ -176,5 +182,7 @@ void wl1251_set_partition(struct wl1251 *wl, wl->virtual_reg_addr = mem_size; wl->if_ops->write (wl,HW_ACCESS_PART0_SIZE_ADDR , partition, -sizeof (partition)); +sizeof (*partition)); + +kfree (partition); }
drivers/net/wireless/ti/wl1251/tx.c +11 -4
@@ -443,19 +443,25 @@ static void wl1251_tx_packet_cb(struct wl1251 *wl,void wl1251_tx_complete (struct wl1251 *wl) {int i, result_index, num_complete =0 , queue_len; -struct tx_result result[FW_TX_CMPLT_BLOCK_SIZE ], *result_ptr; +struct tx_result *result, *result_ptr;unsigned long flags;if (unlikely (wl->state !=WL1251_STATE_ON ))return ; + result =kmalloc_array (FW_TX_CMPLT_BLOCK_SIZE ,sizeof (*result),GFP_KERNEL ); +if (!result) { +wl1251_error ("can not allocate result buffer" ); +return ; + } +/* First we read the result */ -wl1251_mem_read (wl, wl->data_path->tx_complete_addr, - result,sizeof (result)); +wl1251_mem_read (wl, wl->data_path->tx_complete_addr, result, +FW_TX_CMPLT_BLOCK_SIZE *sizeof (*result)); result_index = wl->next_tx_complete; -for (i =0 ; i <ARRAY_SIZE (result); i++) { +for (i =0 ; i <FW_TX_CMPLT_BLOCK_SIZE ; i++) { result_ptr = &result[result_index]; if (result_ptr->done_1 == 1 &&
@@ -538,6 +544,7 @@ void wl1251_tx_complete(struct wl1251 *wl) } +kfree (result); wl->next_tx_complete = result_index; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 394/879 linkage: Fix issue with missing symbol size
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 3ff5f7840979aa36d47a6a00694826c78d63bf3c ]
Occasionally, typically when a function doesn't end with 'ret', an alias on that function will have 0 size.
The difference between what GCC generates and our linkage magic, is that GCC doesn't appear to provide .size for the alias'ed symbol at all. And indeed, removing this directive cures the issue.
Additionally, GCC also doesn't emit .type for alias symbols either, so also omit that.
--- include/linux/linkage.h | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
include/linux/linkage.h +6 -9
@@ -171,12 +171,9 @@/* SYM_ALIAS -- use only if you have to */ #ifndef SYM_ALIAS -#define SYM_ALIAS (alias, name, sym_type, linkage) \ - linkage(alias) ASM_NL \ - .set alias, name ASM_NL \ - .type alias sym_type ASM_NL \ - .set .L__sym_size_##alias, .L__sym_size_##name ASM_NL \ - .size alias, .L__sym_size_##alias +#define SYM_ALIAS (alias, name, linkage) \ + linkage(alias) ASM_NL \ + .set alias, name ASM_NL#endif /* === code annotations === */
@@ -261,7 +258,7 @@*/ #ifndef SYM_FUNC_ALIAS #define SYM_FUNC_ALIAS (alias, name) \ - SYM_ALIAS(alias, name, SYM_T_FUNC, SYM_L_GLOBAL) + SYM_ALIAS(alias, name, SYM_L_GLOBAL)#endif /*
@@ -269,7 +266,7 @@*/ #ifndef SYM_FUNC_ALIAS_LOCAL #define SYM_FUNC_ALIAS_LOCAL (alias, name) \ - SYM_ALIAS(alias, name, SYM_T_FUNC, SYM_L_LOCAL) + SYM_ALIAS(alias, name, SYM_L_LOCAL)#endif /*
@@ -277,7 +274,7 @@*/ #ifndef SYM_FUNC_ALIAS_WEAK #define SYM_FUNC_ALIAS_WEAK (alias, name) \ - SYM_ALIAS(alias, name, SYM_T_FUNC, SYM_L_WEAK) + SYM_ALIAS(alias, name, SYM_L_WEAK)#endif /* SYM_CODE_START -- use for non-C (special) functions */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 395/879 ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init()
In reply to Greg Kroah-HartmanFrom: Ilkka Koskinen <[email protected]>
[ Upstream commit 988d7a14408db4183202f16bb02b8149b9da3727 ]
When building with W=1, we get the following warning:
drivers/acpi/arm64/agdi.c:88:13: warning: no previous prototype for ‘acpi_agdi_init’ [-Wmissing-prototypes]
void __init acpi_agdi_init(void)
Include AGDI driver's header file to pull in the prototype definition for acpi_agdi_init() to get rid of the compiler warning
--- drivers/acpi/arm64/agdi.c | 1 + 1 file changed, 1 insertion(+)
drivers/acpi/arm64/agdi.c +1 -0
@@ -9,6 +9,7 @@#define pr_fmt (fmt) "ACPI: AGDI: " fmt#include <linux/acpi.h> +#include <linux/acpi_agdi.h> #include <linux/arm_sdei.h> #include <linux/io.h> #include <linux/kernel.h>
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 396/879 drm/msm/disp/dpu1: avoid clearing hw interrupts if hw_intr is null during drm uninit
In reply to Greg Kroah-HartmanFrom: Vinod Polimera <[email protected]>
[ Upstream commit 01013ba9bbddc62f7d011163cebfd7ed06bb698b ]
If edp modeset init is failed due to panel being not ready and probe defers during drm bind, avoid clearing irqs and dereference hw_intr when hw_intr is null.
BUG: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: dpu_core_irq_uninstall+0x50/0xb0 dpu_irq_uninstall+0x18/0x24 msm_drm_uninit+0xd8/0x16c msm_drm_bind+0x580/0x5fc try_to_bring_up_master+0x168/0x1c0 __component_add+0xb4/0x178 component_add+0x1c/0x28 dp_display_probe+0x38c/0x400 platform_probe+0xb0/0xd0 really_probe+0xcc/0x2c8 __driver_probe_device+0xbc/0xe8 driver_probe_device+0x48/0xf0 __device_attach_driver+0xa0/0xc8 bus_for_each_drv+0x8c/0xd8 __device_attach+0xc4/0x150 device_initial_probe+0x1c/0x28
Changes in V2:
- Update commit message and coreect fixes tag.
Patchwork: https://patchwork.freedesktop.org/patch/484430/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c +3 -0
@@ -599,6 +599,9 @@ void dpu_core_irq_uninstall(struct dpu_kms *dpu_kms) {int i; +if (!dpu_kms->hw_intr) +return ; +pm_runtime_get_sync (&dpu_kms->pdev->dev);for (i =0 ; i < dpu_kms->hw_intr->total_irqs; i++)if (!list_empty (&dpu_kms->hw_intr->irq_cb_tbl[i]))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 397/879 drm/msm/dsi: fix address for second DSI PHY on SDM660
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 9208c707650354dff5b164b586837454f7285124 ]
Correct a typo in the address of the second DSI PHY in the SDM660 device config.
Patchwork: https://patchwork.freedesktop.org/patch/484697/
--- drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c +1 -1
@@ -1062,7 +1062,7 @@ const struct msm_dsi_phy_cfg dsi_phy_14nm_660_cfgs = { }, .min_pll_rate = VCO_MIN_RATE, .max_pll_rate = VCO_MAX_RATE, - .io_start = { 0xc994400, 0xc996000 }, + .io_start = { 0xc994400, 0xc996400 }, .num_dsi_phy = 2, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 398/879 drm/msm/dp: fix event thread stuck in wait_event after kthread_stop()
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 2f9b5b3ae2eb625b75a898212a76f3b8c6d0d2b0 ]
Event thread supposed to exit from its while loop after kthread_stop(). However there may has possibility that event thread is pending in the middle of wait_event due to condition checking never become true. To make sure event thread exit its loop after kthread_stop(), this patch OR kthread_should_stop() into wait_event's condition checking so that event thread will exit its loop after kernal_stop().
Changes in v2:
-- correct spelling error at commit title
Changes in v3:
-- remove unnecessary parenthesis
-- while(1) to replace while (!kthread_should_stop())
Patchwork: https://patchwork.freedesktop.org/patch/484576/
--- drivers/gpu/drm/msm/dp/dp_display.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/dp/dp_display.c +9 -4
@@ -1107,15 +1107,20 @@ static int hpd_event_thread(void *data) dp_priv = (struct dp_display_private *)data; -while (!kthread_should_stop ()) { +while (1 ) {if (timeout_mode) {wait_event_timeout (dp_priv->event_q, - (dp_priv->event_pndx == dp_priv->event_gndx), -EVENT_TIMEOUT ); + (dp_priv->event_pndx == dp_priv->event_gndx) || +kthread_should_stop (),EVENT_TIMEOUT ); }else {wait_event_interruptible (dp_priv->event_q, - (dp_priv->event_pndx != dp_priv->event_gndx)); + (dp_priv->event_pndx != dp_priv->event_gndx) || +kthread_should_stop ()); } + +if (kthread_should_stop ()) +break ; +spin_lock_irqsave (&dp_priv->event_lock, flag); todo = &dp_priv->event_list[dp_priv->event_gndx];if (todo->delay) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 399/879 drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
In reply to Greg Kroah-HartmanFrom: Jessica Zhang <[email protected]>
[ Upstream commit d59be579fa932c46b908f37509f319cbd4ca9a68 ]
mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring the modeset lock, but currently mdp5_pipe_release doesn't check for if an error is returned. Because of this, there is a possibility of mdp5_pipe_release hitting a NULL dereference error.
To avoid this, let's have mdp5_pipe_release check if mdp5_get_global_state returns an error and propogate that error.
Changes since v1:
- Separated declaration and initialization of *new_state to avoid compiler warning
- Fixed some spelling mistakes in commit message
Changes since v2:
- Return 0 in case where hwpipe is NULL as this is considered normal behavior
- Added 2nd patch in series to fix a similar NULL dereference issue in mdp5_mixer_release
Patchwork: https://patchwork.freedesktop.org/patch/485179/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 28 insertions(+), 9 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +11 -4
@@ -119,18 +119,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane,return 0 ; } -void mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe) +int mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe) {struct msm_drm_private *priv = s->dev->dev_private;struct mdp5_kms *mdp5_kms =to_mdp5_kms (to_mdp_kms (priv->kms));struct mdp5_global_state *state =mdp5_get_global_state (s); -struct mdp5_hw_pipe_state *new_state = &state->hwpipe; +struct mdp5_hw_pipe_state *new_state;if (!hwpipe) -return ; +return 0 ; + +if (IS_ERR (state)) +return PTR_ERR (state); + + new_state = &state->hwpipe;if (WARN_ON (!new_state->hwpipe_to_plane[hwpipe->idx])) -return ; +return -EINVAL ;DBG ("%s: release from plane %s" , hwpipe->name, new_state->hwpipe_to_plane[hwpipe->idx]->name);
@@ -141,6 +146,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) } new_state->hwpipe_to_plane[hwpipe->idx] =NULL ; + +return 0 ; }void mdp5_pipe_destroy (struct mdp5_hw_pipe *hwpipe)
drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h +1 -1
@@ -37,7 +37,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, uint32_t caps, uint32_t blkcfg, struct mdp5_hw_pipe **hwpipe, struct mdp5_hw_pipe **r_hwpipe); -void mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe); +int mdp5_pipe_release (struct drm_atomic_state *s,struct mdp5_hw_pipe *hwpipe);struct mdp5_hw_pipe *mdp5_pipe_init (enum mdp5_pipe pipe,uint32_t reg_offset,uint32_t caps);
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +16 -4
@@ -314,12 +314,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, mdp5_state->r_hwpipe =NULL ; -mdp5_pipe_release (state->state, old_hwpipe); -mdp5_pipe_release (state->state, old_right_hwpipe); + ret =mdp5_pipe_release (state->state, old_hwpipe); +if (ret) +return ret; + + ret =mdp5_pipe_release (state->state, old_right_hwpipe); +if (ret) +return ret; + } }else { -mdp5_pipe_release (state->state, mdp5_state->hwpipe); -mdp5_pipe_release (state->state, mdp5_state->r_hwpipe); + ret =mdp5_pipe_release (state->state, mdp5_state->hwpipe); +if (ret) +return ret; + + ret =mdp5_pipe_release (state->state, mdp5_state->r_hwpipe); +if (ret) +return ret; + mdp5_state->hwpipe = mdp5_state->r_hwpipe =NULL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 400/879 drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
In reply to Greg Kroah-HartmanFrom: Jessica Zhang <[email protected]>
[ Upstream commit ca75f6f7c6f89365e40f10f641b15981b1f07c31 ]
There is a possibility for mdp5_get_global_state to return -EDEADLK when acquiring the modeset lock, but currently global_state in mdp5_mixer_release doesn't check for if an error is returned.
To avoid a NULL dereference error, let's have mdp5_mixer_release check if an error is returned and propagate that error.
Patchwork: https://patchwork.freedesktop.org/patch/485181/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 10 ++++++++-- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 ++-- 3 files changed, 21 insertions(+), 8 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +8 -2
@@ -612,9 +612,15 @@ static int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc,if (ret)return ret; -mdp5_mixer_release (new_crtc_state->state, old_mixer); + ret =mdp5_mixer_release (new_crtc_state->state, old_mixer); +if (ret) +return ret; +if (old_r_mixer) { -mdp5_mixer_release (new_crtc_state->state, old_r_mixer); + ret =mdp5_mixer_release (new_crtc_state->state, old_r_mixer); +if (ret) +return ret; +if (!need_right_mixer) pipeline->r_mixer =NULL ; }
drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c +11 -4
@@ -116,21 +116,28 @@ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc,return 0 ; } -void mdp5_mixer_release (struct drm_atomic_state *s,struct mdp5_hw_mixer *mixer) +int mdp5_mixer_release (struct drm_atomic_state *s,struct mdp5_hw_mixer *mixer) {struct mdp5_global_state *global_state =mdp5_get_global_state (s); -struct mdp5_hw_mixer_state *new_state = &global_state->hwmixer; +struct mdp5_hw_mixer_state *new_state;if (!mixer) -return ; +return 0 ; + +if (IS_ERR (global_state)) +return PTR_ERR (global_state); + + new_state = &global_state->hwmixer;if (WARN_ON (!new_state->hwmixer_to_crtc[mixer->idx])) -return ; +return -EINVAL ;DBG ("%s: release from crtc %s" , mixer->name, new_state->hwmixer_to_crtc[mixer->idx]->name); new_state->hwmixer_to_crtc[mixer->idx] =NULL ; + +return 0 ; }void mdp5_mixer_destroy (struct mdp5_hw_mixer *mixer)
drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h +2 -2
@@ -30,7 +30,7 @@ void mdp5_mixer_destroy(struct mdp5_hw_mixer *lm);int mdp5_mixer_assign (struct drm_atomic_state *s,struct drm_crtc *crtc,uint32_t caps,struct mdp5_hw_mixer **mixer,struct mdp5_hw_mixer **r_mixer); -void mdp5_mixer_release (struct drm_atomic_state *s, -struct mdp5_hw_mixer *mixer); +int mdp5_mixer_release (struct drm_atomic_state *s, +struct mdp5_hw_mixer *mixer);#endif /* __MDP5_LM_H__ */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 401/879 drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit cf575e31611eb6dccf08fad02e57e35b2187704d ]
The msm_gem_prime_get_sg_table() needs to return error pointers on error. This is called from drm_gem_map_dma_buf() and returning a NULL will lead to a crash in that function.
Patchwork: https://patchwork.freedesktop.org/patch/485023/
--- drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_gem_prime.c +1 -1
@@ -17,7 +17,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj)int npages = obj->size >>PAGE_SHIFT ;if (WARN_ON (!msm_obj->pages))/* should have already pinned! */ -return NULL ; +return ERR_PTR (-ENOMEM );return drm_prime_pages_to_sg (obj->dev, msm_obj->pages, npages); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 402/879 media: uvcvideo: Fix missing check to determine if element is found in list
In reply to Greg Kroah-HartmanFrom: Xiaomeng Tong <[email protected]>
[ Upstream commit 261f33388c29f6f3c12a724e6d89172b7f6d5996 ]
The list iterator will point to a bogus position containing HEAD if the list is empty or the element is not found in list. This case should be checked before any use of the iterator, otherwise it will lead to a invalid memory access. The missing check here is before "pin = iterm->id;", just add check here to fix the security bug.
In addition, the list iterator value will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the element is not found in list, considering the (mis)use here: "if (iterm == NULL".
Use a new value 'it' as the list iterator, while use the old value 'iterm' as a dedicated pointer to point to the found element, which
1. can fix this bug, due to 'iterm' is NULL only if it's not found.
2. do not need to change all the uses of 'iterm' after the loop.
3. can also limit the scope of the list iterator 'it' *only inside* the traversal loop by simply declaring 'it' inside the loop in the future, as usage of the iterator outside of the list_for_each_entry is considered harmful. https://lkml.org/lkml/2022/2/17/1032
--- drivers/media/usb/uvc/uvc_v4l2.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/media/usb/uvc/uvc_v4l2.c +11 -9
@@ -871,29 +871,31 @@ static int uvc_ioctl_enum_input(struct file *file, void *fh,struct uvc_video_chain *chain = handle->chain;const struct uvc_entity *selector = chain->selector;struct uvc_entity *iterm =NULL ; +struct uvc_entity *it;u32 index = input->index; -int pin =0 ;if (selector ==NULL || (chain->dev->quirks &UVC_QUIRK_IGNORE_SELECTOR_UNIT )) {if (index !=0 )return -EINVAL ; -list_for_each_entry (iterm, &chain->entities, chain) { -if (UVC_ENTITY_IS_ITERM (iterm)) +list_for_each_entry (it, &chain->entities, chain) { +if (UVC_ENTITY_IS_ITERM (it)) { + iterm = it;break ; + } } - pin = iterm->id; }else if (index < selector->bNrInPins) { - pin = selector->baSourceID[index]; -list_for_each_entry (iterm, &chain->entities, chain) { -if (!UVC_ENTITY_IS_ITERM (iterm)) +list_for_each_entry (it, &chain->entities, chain) { +if (!UVC_ENTITY_IS_ITERM (it))continue ; -if (iterm->id == pin) +if (it->id == selector->baSourceID[index]) { + iterm = it;break ; + } } } -if (iterm ==NULL || iterm->id != pin) +if (iterm ==NULL )return -EINVAL ;memset (input,0 ,sizeof (*input));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 403/879 arm64: stackleak: fix current_top_of_stack()
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit e85094c31ddb794ac41c299a5a7a68243148f829 ]
Due to some historical confusion, arm64's current_top_of_stack() isn't what the stackleak code expects. This could in theory result in a number of problems, and practically results in an unnecessary performance hit. We can avoid this by aligning the arm64 implementation with the x86 implementation.
The arm64 implementation of current_top_of_stack() was added specifically for stackleak in commit:
0b3e336601b82c6a ("arm64: Add support for STACKLEAK gcc plugin")
This was intended to be equivalent to the x86 implementation, but the implementation, semantics, and performance characteristics differ wildly:
* On x86, current_top_of_stack() returns the top of the current task's task stack, regardless of which stack is in active use.
The implementation accesses a percpu variable which the x86 entry code maintains, and returns the location immediately above the pt_regs on the task stack (above which x86 has some padding).
* On arm64 current_top_of_stack() returns the top of the stack in active use (i.e. the one which is currently being used).
The implementation checks the SP against a number of potentially-accessible stacks, and will BUG() if no stack is found.
The core stackleak_erase() code determines the upper bound of stack to erase with:
| if (on_thread_stack()) | boundary = current_stack_pointer; | else | boundary = current_top_of_stack();
On arm64 stackleak_erase() is always called on a task stack, and on_thread_stack() should always be true. On x86, stackleak_erase() is mostly called on a trampoline stack, and is sometimes called on a task stack.
Currently, this results in a lot of unnecessary code being generated for arm64 for the impossible !on_thread_stack() case. Some of this is inlined, bloating stackleak_erase(), while portions of this are left out-of-line and permitted to be instrumented (which would be a functional problem if that code were reachable).
As a first step towards improving this, this patch aligns arm64's implementation of current_top_of_stack() with x86's, always returning the top of the current task's stack. With GCC 11.1.0 this results in the bulk of the unnecessary code being removed, including all of the out-of-line instrumentable code.
While I don't believe there's a functional problem in practice I've marked this as a fix since the semantic was clearly wrong, the fix itself is simple, and other code might rely upon this in future.
--- arch/arm64/include/asm/processor.h | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
arch/arm64/include/asm/processor.h +4 -6
@@ -381,12 +381,10 @@ long get_tagged_addr_ctrl(struct task_struct *task);* of header definitions for the use of task_stack_page. */ -#define current_top_of_stack () \ -({ \ - struct stack_info _info; \ - BUG_ON(!on_accessible_stack(current, current_stack_pointer, 1, &_info)); \ - _info.high; \ -}) +/* +* The top of the current task's task stack +*/ +#define current_top_of_stack () ((unsigned long)current->stack + THREAD_SIZE)#define on_thread_stack () (on_task_stack(current, current_stack_pointer, 1, NULL))#endif /* __ASSEMBLY__ */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 404/879 iomap: iomap_write_failed fix
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit b71450e2cc4b3c79f33c5bd276d152af9bd54f79 ]
The @lend parameter of truncate_pagecache_range() should be the offset of the last byte of the hole, not the first byte beyond it.
--- fs/iomap/buffered-io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/iomap/buffered-io.c +2 -1
@@ -531,7 +531,8 @@ iomap_write_failed(struct inode *inode, loff_t pos, unsigned len)* write started inside the existing inode size. */ if (pos + len > i_size) -truncate_pagecache_range (inode,max (pos, i_size), pos + len); +truncate_pagecache_range (inode,max (pos, i_size), + pos + len -1 ); } static int iomap_read_folio_sync(loff_t block_start, struct folio *folio,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 405/879 spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a2b331ac11e1cac56f5b7d367e9f3c5796deaaed ]
It will cause null-ptr-deref if platform_get_resource_byname() returns NULL, we need check the return value.
--- drivers/spi/spi-fsl-qspi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/spi/spi-fsl-qspi.c +4 -0
@@ -876,6 +876,10 @@ static int fsl_qspi_probe(struct platform_device *pdev) res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"QuadSPI-memory" ); +if (!res) { + ret = -EINVAL ; + goto err_put_ctrl; + } q->memmap_phy = res->start;/* Since there are 4 cs, map size required is 4 times ahb_buf_size */ q->ahb_addr = devm_ioremap(dev, q->memmap_phy,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 406/879 selftests/bpf: Prevent skeleton generation race
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 1e2666e029e5cc2b81dbd7c85af5bcc8c80524e0 ]
Prevent "classic" and light skeleton generation rules from stomping on each other's toes due to the use of the same <obj>.linked{1,2,3}.o naming pattern. There is no coordination and synchronizataion between .skel.h and .lskel.h rules, so they can easily overwrite each other's intermediate object files, leading to errors like:
/bin/sh: line 1: 170928 Bus error (core dumped)
/data/users/andriin/linux/tools/testing/selftests/bpf/tools/sbin/bpftool gen skeleton /data/users/andriin/linux/tools/testing/selftests/bpf/test_ksyms_weak.linked3.o name test_ksyms_weak
Quoted 1 line
/data/users/andriin/linux/tools/testing/selftests/bpf/test_ksyms_weak.skel.h
make: *** [Makefile:507: /data/users/andriin/linux/tools/testing/selftests/bpf/test_ksyms_weak.skel.h] Error 135
make: *** Deleting file '/data/users/andriin/linux/tools/testing/selftests/bpf/test_ksyms_weak.skel.h'
Fix by using different suffix for light skeleton rule.
--- tools/testing/selftests/bpf/Makefile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/Makefile +5 -5
@@ -415,11 +415,11 @@ $(TRUNNER_BPF_SKELS): %.skel.h: %.o $(BPFTOOL) | $(TRUNNER_OUTPUT) $(TRUNNER_BPF_LSKELS): %.lskel.h: %.o $(BPFTOOL) | $(TRUNNER_OUTPUT) $$(call msg,GEN-SKEL,$(TRUNNER_BINARY),$$@) - $(Q)$$(BPFTOOL) gen object $$(<:.o=.linked1.o) $$< - $(Q)$$(BPFTOOL) gen object $$(<:.o=.linked2.o) $$(<:.o=.linked1.o) - $(Q)$$(BPFTOOL) gen object $$(<:.o=.linked3.o) $$(<:.o=.linked2.o) - $(Q)diff $$(<:.o=.linked2.o) $$(<:.o=.linked3.o) - $(Q)$$(BPFTOOL) gen skeleton -L $$(<:.o=.linked3.o) name $$(notdir $$(<:.o=_lskel)) > $$@ + $(Q)$$(BPFTOOL) gen object $$(<:.o=.llinked1.o) $$< + $(Q)$$(BPFTOOL) gen object $$(<:.o=.llinked2.o) $$(<:.o=.llinked1.o) + $(Q)$$(BPFTOOL) gen object $$(<:.o=.llinked3.o) $$(<:.o=.llinked2.o) + $(Q)diff $$(<:.o=.llinked2.o) $$(<:.o=.llinked3.o) + $(Q)$$(BPFTOOL) gen skeleton -L $$(<:.o=.llinked3.o) name $$(notdir $$(<:.o=_lskel)) > $$@ $(TRUNNER_BPF_SKELS_LINKED): $(TRUNNER_BPF_OBJS) $(BPFTOOL) | $(TRUNNER_OUTPUT) $$(call msg,LINK-BPF,$(TRUNNER_BINARY),$$(@:.skel.h=.o))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 407/879 Revert "cpufreq: Fix possible race in cpufreq online error path"
In reply to Greg Kroah-HartmanFrom: Viresh Kumar <[email protected]>
[ Upstream commit 85f0e42bd65d01b351d561efb38e584d4c596553 ]
This reverts commit f346e96267cd76175d6c201b40f770c0116a8a04.
The commit tried to fix a possible real bug but it made it even worse. The fix was simply buggy as now an error out to out_offline_policy or out_exit_policy will try to release a semaphore which was never taken in the first place. This works fine only if we failed late, i.e. via out_destroy_policy.
--- drivers/cpufreq/cpufreq.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/cpufreq/cpufreq.c +2 -3
@@ -1534,6 +1534,8 @@ static int cpufreq_online(unsigned int cpu)for_each_cpu (j, policy->real_cpus)remove_cpu_dev_symlink (policy,get_cpu_device (j)); +up_write (&policy->rwsem); + out_offline_policy:if (cpufreq_driver->offline) cpufreq_driver->offline (policy);
@@ -1542,9 +1544,6 @@ static int cpufreq_online(unsigned int cpu)if (cpufreq_driver->exit) cpufreq_driver->exit (policy); -cpumask_clear (policy->cpus); -up_write (&policy->rwsem); - out_free_policy:cpufreq_policy_free (policy);return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 408/879 regulator: qcom_smd: Fix up PM8950 regulator configuration
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
[ Upstream commit b11b3d21a94d66bc05d1142e0b210bfa316c62be ]
Following changes have been made:
- S5, L4, L18, L20 and L21 were removed (S5 is managed by SPMI, whereas the rest seems not to exist [or at least it's blocked by Sony Loire /MSM8956/ RPM firmware])
- Supply maps have were adjusted to reflect regulator changes.
--- drivers/regulator/qcom_smd-regulator.c | 35 +++++++++++++------------- 1 file changed, 17 insertions(+), 18 deletions(-)
drivers/regulator/qcom_smd-regulator.c +17 -18
@@ -944,32 +944,31 @@ static const struct rpm_regulator_data rpm_pm8950_regulators[] = { { "s2", QCOM_SMD_RPM_SMPA, 2, &pm8950_hfsmps, "vdd_s2" }, { "s3", QCOM_SMD_RPM_SMPA, 3, &pm8950_hfsmps, "vdd_s3" }, { "s4", QCOM_SMD_RPM_SMPA, 4, &pm8950_hfsmps, "vdd_s4" }, - { "s5", QCOM_SMD_RPM_SMPA, 5, &pm8950_ftsmps2p5, "vdd_s5" }, +/* S5 is managed via SPMI. */ { "s6", QCOM_SMD_RPM_SMPA, 6, &pm8950_hfsmps, "vdd_s6" }, { "l1", QCOM_SMD_RPM_LDOA, 1, &pm8950_ult_nldo, "vdd_l1_l19" }, { "l2", QCOM_SMD_RPM_LDOA, 2, &pm8950_ult_nldo, "vdd_l2_l23" }, { "l3", QCOM_SMD_RPM_LDOA, 3, &pm8950_ult_nldo, "vdd_l3" }, - { "l4", QCOM_SMD_RPM_LDOA, 4, &pm8950_ult_pldo, "vdd_l4_l5_l6_l7_l16" }, - { "l5", QCOM_SMD_RPM_LDOA, 5, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, - { "l6", QCOM_SMD_RPM_LDOA, 6, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, - { "l7", QCOM_SMD_RPM_LDOA, 7, &pm8950_pldo_lv, "vdd_l4_l5_l6_l7_l16" }, +/* L4 seems not to exist. */ + { "l5", QCOM_SMD_RPM_LDOA, 5, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, + { "l6", QCOM_SMD_RPM_LDOA, 6, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, + { "l7", QCOM_SMD_RPM_LDOA, 7, &pm8950_pldo_lv, "vdd_l5_l6_l7_l16" }, { "l8", QCOM_SMD_RPM_LDOA, 8, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, { "l9", QCOM_SMD_RPM_LDOA, 9, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, { "l10", QCOM_SMD_RPM_LDOA, 10, &pm8950_ult_nldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l11", QCOM_SMD_RPM_LDOA, 11, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l12", QCOM_SMD_RPM_LDOA, 12, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l13", QCOM_SMD_RPM_LDOA, 13, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l14", QCOM_SMD_RPM_LDOA, 14, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l15", QCOM_SMD_RPM_LDOA, 15, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l16", QCOM_SMD_RPM_LDOA, 16, &pm8950_ult_pldo, "vdd_l4_l5_l6_l7_l16"}, - { "l17", QCOM_SMD_RPM_LDOA, 17, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l18", QCOM_SMD_RPM_LDOA, 18, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18"}, - { "l19", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l1_l19"}, - { "l20", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l20"}, - { "l21", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l21"}, - { "l22", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l8_l11_l12_l17_l22"}, - { "l23", QCOM_SMD_RPM_LDOA, 18, &pm8950_pldo, "vdd_l2_l23"}, + { "l11", QCOM_SMD_RPM_LDOA, 11, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l12", QCOM_SMD_RPM_LDOA, 12, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l13", QCOM_SMD_RPM_LDOA, 13, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l14", QCOM_SMD_RPM_LDOA, 14, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l15", QCOM_SMD_RPM_LDOA, 15, &pm8950_ult_pldo, "vdd_l9_l10_l13_l14_l15_l18" }, + { "l16", QCOM_SMD_RPM_LDOA, 16, &pm8950_ult_pldo, "vdd_l5_l6_l7_l16" }, + { "l17", QCOM_SMD_RPM_LDOA, 17, &pm8950_ult_pldo, "vdd_l8_l11_l12_l17_l22" }, +/* L18 seems not to exist. */ + { "l19", QCOM_SMD_RPM_LDOA, 19, &pm8950_pldo, "vdd_l1_l19" }, +/* L20 & L21 seem not to exist. */ + { "l22", QCOM_SMD_RPM_LDOA, 22, &pm8950_pldo, "vdd_l8_l11_l12_l17_l22" }, + { "l23", QCOM_SMD_RPM_LDOA, 23, &pm8950_pldo, "vdd_l2_l23" }, {} };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 409/879 samples: bpf: Dont fail for a missing VMLINUX_BTF when VMLINUX_H is provided
In reply to Greg Kroah-HartmanFrom: Jerome Marchand <[email protected]>
[ Upstream commit ec24704492d8791a52a75a39e3ad762b6e017bc6 ]
samples/bpf build currently always fails if it can't generate vmlinux.h from vmlinux, even when vmlinux.h is directly provided by VMLINUX_H variable, which makes VMLINUX_H pointless. Only fails when neither method works.
--- samples/bpf/Makefile | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
samples/bpf/Makefile +4 -5
@@ -368,16 +368,15 @@ VMLINUX_BTF ?= $(abspath $(firstword $(wildcard $(VMLINUX_BTF_PATHS)))) $(obj)/vmlinux.h: $(VMLINUX_BTF) $(BPFTOOL) ifeq ($(VMLINUX_H),) +ifeq ($(VMLINUX_BTF),) + $(error Cannot find a vmlinux for VMLINUX_BTF at any of "$(VMLINUX_BTF_PATHS)",\ + build the kernel or set VMLINUX_BTF or VMLINUX_H variable) +endif $(Q)$(BPFTOOL) btf dump file $(VMLINUX_BTF) format c > $@ else $(Q)cp "$(VMLINUX_H)" $@ endif -ifeq ($(VMLINUX_BTF),) - $(error Cannot find a vmlinux for VMLINUX_BTF at any of "$(VMLINUX_BTF_PATHS)",\ - build the kernel or set VMLINUX_BTF variable) -endif - clean-files += vmlinux.h # Get Clang's default includes on this system, as opposed to those seen by
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 410/879 perf/amd/ibs: Use interrupt regs ip for stack unwinding
In reply to Greg Kroah-HartmanFrom: Ravi Bangoria <[email protected]>
[ Upstream commit 3d47083b9ff46863e8374ad3bb5edb5e464c75f8 ]
IbsOpRip is recorded when IBS interrupt is triggered. But there is a skid from the time IBS interrupt gets triggered to the time the interrupt is presented to the core. Meanwhile processor would have moved ahead and thus IbsOpRip will be inconsistent with rsp and rbp recorded as part of the interrupt regs. This causes issues while unwinding stack using the ORC unwinder as it needs consistent rip, rsp and rbp. Fix this by using rip from interrupt regs instead of IbsOpRip for stack unwinding.
--- arch/x86/events/amd/ibs.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
arch/x86/events/amd/ibs.c +18 -0
@@ -304,6 +304,16 @@ static int perf_ibs_init(struct perf_event *event) hwc->config_base = perf_ibs->msr; hwc->config = config; +/* +* rip recorded by IbsOpRip will not be consistent with rsp and rbp +* recorded as part of interrupt regs. Thus we need to use rip from +* interrupt regs while unwinding call stack. Setting _EARLY flag +* makes sure we unwind call-stack before perf sample rip is set to +* IbsOpRip. +*/ +if (event->attr.sample_type &PERF_SAMPLE_CALLCHAIN ) + event->attr.sample_type |= __PERF_SAMPLE_CALLCHAIN_EARLY; +return 0 ; }
@@ -687,6 +697,14 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) data.raw = &raw; } +/* +* rip recorded by IbsOpRip will not be consistent with rsp and rbp +* recorded as part of interrupt regs. Thus we need to use rip from +* interrupt regs while unwinding call stack. +*/ +if (event->attr.sample_type &PERF_SAMPLE_CALLCHAIN ) + data.callchain =perf_callchain (event, iregs); + throttle =perf_event_overflow (event, &data, ®s); out:if (throttle) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 411/879 ath11k: Dont check arvif->is_started before sending management frames
In reply to Greg Kroah-HartmanFrom: Baochen Qiang <[email protected]>
[ Upstream commit 355333a217541916576351446b5832fec7930566 ]
Commit 66307ca04057 ("ath11k: fix mgmt_tx_wmi cmd sent to FW for deleted vdev") wants both of below two conditions are true before sending management frames:
1: ar->allocated_vdev_map & (1LL << arvif->vdev_id) 2: arvif->is_started
Actually the second one is not necessary because with the first one we can make sure the vdev is present.
Also use ar->conf_mutex to synchronize vdev delete and mgmt. TX.
This issue is found in case of Passpoint scenario where ath11k needs to send action frames before vdev is started.
Fix it by removing the second condition.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1
--- drivers/net/wireless/ath/ath11k/mac.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/mac.c +3 -2
@@ -5520,8 +5520,8 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) } arvif =ath11k_vif_to_arvif (skb_cb->vif); -if (ar->allocated_vdev_map & (1LL << arvif->vdev_id) && - arvif->is_started) { +mutex_lock (&ar->conf_mutex); +if (ar->allocated_vdev_map & (1LL << arvif->vdev_id)) { ret =ath11k_mac_mgmt_tx_wmi (ar, arvif, skb);if (ret) { ath11k_warn(ar->ab, "failed to tx mgmt frame, vdev_id %d :%d\n",
@@ -5539,6 +5539,7 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) arvif->is_started);ath11k_mgmt_over_wmi_tx_drop (ar, skb); } +mutex_unlock (&ar->conf_mutex); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 412/879 scsi: lpfc: Fix element offset in __lpfc_sli_release_iocbq_s4()
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 84c6f99e39074d45f75986e42ca28e27c140fd0d ]
The prior commit that moved from iocb elements to explicit wqe elements missed a name change.
Correct __lpfc_sli_release_iocbq_s4() to reference wqe rather than iocb.
--- drivers/scsi/lpfc/lpfc_sli.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/lpfc/lpfc_sli.c +1 -1
@@ -1373,7 +1373,7 @@ static void __lpfc_sli_release_iocbq_s4(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq) { struct lpfc_sglq *sglq; -size_t start_clean = offsetof(struct lpfc_iocbq , iocb); +size_t start_clean = offsetof(struct lpfc_iocbq , wqe);unsigned long iflag =0 ;struct lpfc_sli_ring *pring;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 413/879 scsi: lpfc: Fix dmabuf ptr assignment in lpfc_ct_reject_event()
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 596fc8adb171dce3751a359018e2ade612af8d97 ]
Upon driver receipt of a CT cmd for type = 0xFA (Management Server) and subtype = 0x11 (Fabric Device Management Interface), the driver is responding with garbage CT cmd data when it should send a properly formed RJT.
The __lpfc_prep_xmit_seq64_s4() routine was using the wrong buffer for the reject.
Fix by converting the routine to use the buffer specified in the bde within the wqe rather than the ill-set bmp element.
--- drivers/scsi/lpfc/lpfc_sli.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-)
drivers/scsi/lpfc/lpfc_sli.c +3 -12
@@ -10800,24 +10800,15 @@ __lpfc_sli_prep_xmit_seq64_s4(struct lpfc_iocbq *cmdiocbq, {union lpfc_wqe128 *wqe;struct ulp_bde64 *bpl; -struct ulp_bde64_le *bde; wqe = &cmdiocbq->wqe;memset (wqe,0 ,sizeof (*wqe));/* Words 0 - 2 */ bpl = (struct ulp_bde64 *)bmp->virt; -if (cmdiocbq->cmd_flag & (LPFC_IO_LIBDFC |LPFC_IO_LOOPBACK )) { - wqe->xmit_sequence.bde.addrHigh = bpl->addrHigh; - wqe->xmit_sequence.bde.addrLow = bpl->addrLow; - wqe->xmit_sequence.bde.tus.w = bpl->tus.w; - }else { - bde = (struct ulp_bde64_le *)&wqe->xmit_sequence.bde; - bde->addr_low =cpu_to_le32 (putPaddrLow (bmp->phys)); - bde->addr_high =cpu_to_le32 (putPaddrHigh (bmp->phys)); - bde->type_size =cpu_to_le32 (bpl->tus.f.bdeSize); - bde->type_size |=cpu_to_le32 (ULP_BDE64_TYPE_BDE_64 ); - } + wqe->xmit_sequence.bde.addrHigh = bpl->addrHigh; + wqe->xmit_sequence.bde.addrLow = bpl->addrLow; + wqe->xmit_sequence.bde.tus.w = bpl->tus.w;/* Word 5 */ bf_set (wqe_ls, &wqe->xmit_sequence.wge_ctl, last_seq);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 414/879 wilc1000: fix crash observed in AP mode with cfg80211_register_netdevice()
In reply to Greg Kroah-HartmanFrom: Ajay Singh <[email protected]>
[ Upstream commit 868f0e28290c7a33e8cb79bfe97ebdcbb756e048 ]
Monitor(mon.) interface is used for handling the AP mode and 'ieee80211_ptr' reference is not getting set for it. Like earlier implementation, use register_netdevice() instead of cfg80211_register_netdevice() which expects valid 'ieee80211_ptr' reference to avoid the possible crash.
--- drivers/net/wireless/microchip/wilc1000/mon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/microchip/wilc1000/mon.c +2 -2
@@ -233,7 +233,7 @@ struct net_device *wilc_wfi_init_mon_interface(struct wilc *wl, wl->monitor_dev->netdev_ops = &wilc_wfi_netdev_ops; wl->monitor_dev->needs_free_netdev = true; -if (cfg80211_register_netdevice (wl->monitor_dev)) { +if (register_netdevice (wl->monitor_dev)) {netdev_err (real_dev,"register_netdevice failed\n" );free_netdev (wl->monitor_dev);return NULL ;
@@ -251,7 +251,7 @@ void wilc_wfi_deinit_mon_interface(struct wilc *wl, bool rtnl_locked)return ;if (rtnl_locked) -cfg80211_unregister_netdevice (wl->monitor_dev); +unregister_netdevice (wl->monitor_dev);else unregister_netdev (wl->monitor_dev); wl->monitor_dev =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 415/879 HID: amd_sfh: Modify the bus name
In reply to Greg Kroah-HartmanFrom: Basavaraj Natikar <[email protected]>
[ Upstream commit 206c3c2d85de8847fb732a5fb71443bacd287216 ]
Modifying the amd-sfh bus name to meaningful name.
--- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 2 +- drivers/hid/amd-sfh-hid/amd_sfh_hid.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/hid/amd-sfh-hid/amd_sfh_hid.c +1 -1
@@ -141,7 +141,7 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) hid->driver_data = hid_data; cli_data->hid_sensor_hubs[cur_hid_dev] = hid; - hid->bus =BUS_AMD_AMDTP ; + hid->bus =BUS_AMD_SFH ; hid->vendor =AMD_SFH_HID_VENDOR ; hid->product =AMD_SFH_HID_PRODUCT ; snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "hid-amdtp",
drivers/hid/amd-sfh-hid/amd_sfh_hid.h +1 -1
@@ -12,7 +12,7 @@#define AMDSFH_HID_H #define MAX_HID_DEVICES 5 -#define BUS_AMD_AMDTP 0x20 +#define BUS_AMD_SFH 0x20#define AMD_SFH_HID_VENDOR 0x1022#define AMD_SFH_HID_PRODUCT 0x0001
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 416/879 HID: amd_sfh: Modify the hid name
In reply to Greg Kroah-HartmanFrom: Basavaraj Natikar <[email protected]>
[ Upstream commit 10f865cdcf37d26ae5e9595a7b4f9e06538e84e5 ]
Modifying the amd-sfh hid name to meaningful name.
--- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/amd-sfh-hid/amd_sfh_hid.c +1 -1
@@ -144,7 +144,7 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) hid->bus =BUS_AMD_SFH ; hid->vendor =AMD_SFH_HID_VENDOR ; hid->product =AMD_SFH_HID_PRODUCT ; -snprintf (hid->name,sizeof (hid->name),"%s %04X:%04X" ,"hid-amdtp" , +snprintf (hid->name,sizeof (hid->name),"%s %04X:%04X" ,"hid-amdsfh" , hid->vendor, hid->product); rc =hid_add_device (hid);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 417/879 ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 41cd312dfe980af869c3503b4d38e62ed20dd3b7 ]
of_find_i2c_device_by_node() takes a reference, In error paths, we should call put_device() to drop the reference to aviod refount leak.
--- sound/soc/fsl/imx-sgtl5000.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
sound/soc/fsl/imx-sgtl5000.c +8 -6
@@ -120,19 +120,19 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) data =devm_kzalloc (&pdev->dev,sizeof (*data),GFP_KERNEL );if (!data) { ret = -ENOMEM ; - goto fail; + goto put_device; } comp =devm_kzalloc (&pdev->dev,3 *sizeof (*comp),GFP_KERNEL );if (!comp) { ret = -ENOMEM ; - goto fail; + goto put_device; } data->codec_clk =clk_get (&codec_dev->dev,NULL );if (IS_ERR (data->codec_clk)) { ret =PTR_ERR (data->codec_clk); - goto fail; + goto put_device; } data->clk_frequency =clk_get_rate (data->codec_clk);
@@ -158,10 +158,10 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) data->card.dev = &pdev->dev; ret =snd_soc_of_parse_card_name (&data->card,"model" );if (ret) - goto fail; + goto put_device; ret =snd_soc_of_parse_audio_routing (&data->card,"audio-routing" );if (ret) - goto fail; + goto put_device; data->card.num_links =1 ; data->card.owner =THIS_MODULE ; data->card.dai_link = &data->dai;
@@ -174,7 +174,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) ret =devm_snd_soc_register_card (&pdev->dev, &data->card);if (ret) {dev_err_probe (&pdev->dev, ret,"snd_soc_register_card failed\n" ); - goto fail; + goto put_device; }of_node_put (ssi_np);
@@ -182,6 +182,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)return 0 ; +put_device: +put_device (&codec_dev->dev); fail:if (data && !IS_ERR (data->codec_clk))clk_put (data->codec_clk);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 418/879 ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit ed46731d8e86c8d65f5fc717671e1f1f6c3146d2 ]
of_find_device_by_node() takes reference, we should use put_device() to release it. when devm_kzalloc() fails, it doesn't have a put_device(), it will cause refcount leak.
Add missing put_device() to fix this.
--- sound/soc/fsl/imx-hdmi.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/fsl/imx-hdmi.c +1 -0
@@ -126,6 +126,7 @@ static int imx_hdmi_probe(struct platform_device *pdev) data =devm_kzalloc (&pdev->dev,sizeof (*data),GFP_KERNEL );if (!data) { ret = -ENOMEM ; +put_device (&cpu_pdev->dev); goto fail; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 419/879 ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 2be84f73785fa9ed6443e3c5b158730266f1c2ee ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done.
--- sound/soc/mxs/mxs-saif.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/mxs/mxs-saif.c +1 -0
@@ -754,6 +754,7 @@ static int mxs_saif_probe(struct platform_device *pdev) saif->master_id = saif->id; }else { ret =of_alias_get_id (master,"saif" ); +of_node_put (master);if (ret <0 )return ret;else
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 420/879 regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit afaa7b933ef00a2d3262f4d1252087613fb5c06d ]
of_node_get() returns a node with refcount incremented. Calling of_node_put() to drop the reference when not needed anymore.
--- drivers/regulator/pfuze100-regulator.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/regulator/pfuze100-regulator.c +2 -0
@@ -521,6 +521,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) parent =of_get_child_by_name (np,"regulators" );if (!parent) {dev_err (dev,"regulators node not found\n" ); +of_node_put (np);return -EINVAL ; }
@@ -550,6 +551,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip) }of_node_put (parent); +of_node_put (np);if (ret <0 ) {dev_err (dev,"Error parsing regulator init data: %d\n" , ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 421/879 PM: EM: Decrement policy counter
In reply to Greg Kroah-HartmanFrom: Pierre Gondois <[email protected]>
[ Upstream commit c9d8923bfbcb63f15ea6cb2b5c8426fc3d96f643 ]
In commit e458716a92b57 ("PM: EM: Mark inefficiencies in CPUFreq"), cpufreq_cpu_get() is called without a cpufreq_cpu_put(), permanently increasing the reference counts of the policy struct.
Decrement the reference count once the policy struct is not used anymore.
--- kernel/power/energy_model.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/power/energy_model.c +2 -0
@@ -259,6 +259,8 @@ static void em_cpufreq_update_efficiencies(struct device *dev) found++; } +cpufreq_cpu_put (policy); +if (!found)return ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 422/879 dma-direct: dont fail on highmem CMA pages in dma_direct_alloc_pages
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 92826e967535db2eb117db227b1191aaf98e4bb3 ]
When dma_direct_alloc_pages encounters a highmem page it just gives up currently. But what we really should do is to try memory using the page allocator instead - without this platforms with a global highmem CMA pool will fail all dma_alloc_pages allocations.
--- kernel/dma/direct.c | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-)
kernel/dma/direct.c +10 -17
@@ -115,7 +115,7 @@ static struct page *dma_direct_alloc_swiotlb(struct device *dev, size_t size) }static struct page *__dma_direct_alloc_pages (struct device *dev,size_t size, -gfp_t gfp) +gfp_t gfp,bool allow_highmem) {int node =dev_to_node (dev);struct page *page =NULL ;
@@ -129,9 +129,12 @@ static struct page *__dma_direct_alloc_pages(struct device *dev, size_t size, gfp |=dma_direct_optimal_gfp_mask (dev, dev->coherent_dma_mask, &phys_limit); page =dma_alloc_contiguous (dev, size, gfp); -if (page && !dma_coherent_ok (dev,page_to_phys (page), size)) { -dma_free_contiguous (dev, page, size); - page =NULL ; +if (page) { +if (!dma_coherent_ok (dev,page_to_phys (page), size) || + (!allow_highmem &&PageHighMem (page))) { +dma_free_contiguous (dev, page, size); + page =NULL ; + } } again:if (!page)
@@ -189,7 +192,7 @@ static void *dma_direct_alloc_no_mapping(struct device *dev, size_t size, {struct page *page; - page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO); + page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO, true);if (!page)return NULL ;
@@ -262,7 +265,7 @@ void *dma_direct_alloc(struct device *dev, size_t size,return dma_direct_alloc_from_pool (dev, size, dma_handle, gfp);/* we always manually zero the memory once we are done */ - page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO); + page =__dma_direct_alloc_pages (dev, size, gfp & ~__GFP_ZERO, true);if (!page)return NULL ;
@@ -370,19 +373,9 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size,if (force_dma_unencrypted (dev) &&dma_direct_use_pool (dev, gfp))return dma_direct_alloc_from_pool (dev, size, dma_handle, gfp); - page =__dma_direct_alloc_pages (dev, size, gfp); + page =__dma_direct_alloc_pages (dev, size, gfp, false);if (!page)return NULL ; -if (PageHighMem (page)) { -/* -* Depending on the cma= arguments and per-arch setup -* dma_alloc_contiguous could return highmem pages. -* Without remapping there is no way to return them here, -* so log an error and fail. -*/ -dev_info (dev,"Rejecting highmem page from CMA.\n" ); - goto out_free_pages; - } ret =page_address (page);if (dma_set_decrypted (dev, ret, size))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 423/879 ASoC: samsung: Fix refcount leak in aries_audio_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit bf4a9b2467b775717d0e9034ad916888e19713a3 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. If extcon_find_edev_by_node() fails, it doesn't call of_node_put() Calling of_node_put() after extcon_find_edev_by_node() to fix this.
--- sound/soc/samsung/aries_wm8994.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/samsung/aries_wm8994.c +1 -1
@@ -585,10 +585,10 @@ static int aries_audio_probe(struct platform_device *pdev) extcon_np =of_parse_phandle (np,"extcon" ,0 ); priv->usb_extcon =extcon_find_edev_by_node (extcon_np); +of_node_put (extcon_np);if (IS_ERR (priv->usb_extcon))return dev_err_probe (dev,PTR_ERR (priv->usb_extcon),"Failed to get extcon device" ); -of_node_put (extcon_np); priv->adc =devm_iio_channel_get (dev,"headset-detect" );if (IS_ERR (priv->adc))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 424/879 block: Fix the bio.bi_opf comment
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 5d2ae14276e698c76fa0c8ce870103f343b38263 ]
Commit ef295ecf090d modified the Linux kernel such that the bottom bits of the bi_opf member contain the operation instead of the topmost bits. That commit did not update the comment next to bi_opf. Hence this patch.
Quoted 1 line
From commit
ef295ecf090d:
-#define bio_op(bio) ((bio)->bi_opf >> BIO_OP_SHIFT)
+#define bio_op(bio) ((bio)->bi_opf & REQ_OP_MASK)
--- include/linux/blk_types.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
include/linux/blk_types.h +2 -3
@@ -246,9 +246,8 @@ typedef unsigned int blk_qc_t;struct bio {struct bio *bi_next;/* request queue link */ struct block_device *bi_bdev; -unsigned int bi_opf;/* bottom bits req flags, -* top bits REQ_OP. Use -* accessors. +unsigned int bi_opf;/* bottom bits REQ_OP, top bits +* req_flags. */ unsigned short bi_flags;/* BIO_* below */ unsigned short bi_ioprio;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 425/879 kselftest/cgroup: fix test_stress.sh to use OUTPUT dir
In reply to Greg Kroah-HartmanFrom: Phil Auld <[email protected]>
[ Upstream commit 54de76c0123915e7533ce352de30a1f2d80fe81f ]
Running cgroup kselftest with O= fails to run the with_stress test due to hardcoded ./test_core. Find test_core binary using the OUTPUT directory.
--- tools/testing/selftests/cgroup/test_stress.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/cgroup/test_stress.sh +1 -1
@@ -1,4 +1,4 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 -./with_stress.sh -s subsys -s fork ./test_core +./with_stress.sh -s subsys -s fork ${OUTPUT}/test_core
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 426/879 scripts/faddr2line: Fix overlapping text section failures
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit 1d1a0e7c5100d332583e20b40aa8c0a8ed3d7849 ]
There have been some recent reports of faddr2line failures:
$ scripts/faddr2line sound/soundcore.ko sound_devnode+0x5/0x35 bad symbol size: base: 0x0000000000000000 end: 0x0000000000000000
$ ./scripts/faddr2line vmlinux.o enter_from_user_mode+0x24 bad symbol size: base: 0x0000000000005fe0 end: 0x0000000000005fe0
The problem is that faddr2line is based on 'nm', which has a major
limitation: it doesn't know how to distinguish between different text sections. So if an offset exists in multiple text sections in the object, it may fail.
Rewrite faddr2line to be section-aware, by basing it on readelf.
--- scripts/faddr2line | 150 +++++++++++++++++++++++++++++---------------- 1 file changed, 97 insertions(+), 53 deletions(-)
scripts/faddr2line +97 -53
@@ -44,17 +44,6 @@ set -o errexit set -o nounset -READELF="${CROSS_COMPILE:-}readelf" -ADDR2LINE="${CROSS_COMPILE:-}addr2line" -SIZE="${CROSS_COMPILE:-}size" -NM="${CROSS_COMPILE:-}nm" - -command -v awk >/dev/null 2>&1 || die "awk isn't installed" -command -v ${READELF} >/dev/null 2>&1 || die "readelf isn't installed" -command -v ${ADDR2LINE} >/dev/null 2>&1 || die "addr2line isn't installed" -command -v ${SIZE} >/dev/null 2>&1 || die "size isn't installed" -command -v ${NM} >/dev/null 2>&1 || die "nm isn't installed" - usage() { echo "usage: faddr2line [--list] <object file> <func+offset> <func+offset>..." >&2 exit 1
@@ -69,6 +58,14 @@ die() { exit 1 } +READELF="${CROSS_COMPILE:-}readelf" +ADDR2LINE="${CROSS_COMPILE:-}addr2line" +AWK="awk" + +command -v ${AWK} >/dev/null 2>&1 || die "${AWK} isn't installed" +command -v ${READELF} >/dev/null 2>&1 || die "${READELF} isn't installed" +command -v ${ADDR2LINE} >/dev/null 2>&1 || die "${ADDR2LINE} isn't installed" + # Try to figure out the source directory prefix so we can remove it from the # addr2line output. HACK ALERT: This assumes that start_kernel() is in # init/main.c! This only works for vmlinux. Otherwise it falls back to
@@ -76,7 +73,7 @@ die() { find_dir_prefix() { local objfile=$1 - local start_kernel_addr=$(${READELF} -sW $objfile | awk '$8 == "start_kernel" {printf "0x%s", $2}') + local start_kernel_addr=$(${READELF} --symbols --wide $objfile | ${AWK} '$8 == "start_kernel" {printf "0x%s", $2}') [[ -z $start_kernel_addr ]] && return local file_line=$(${ADDR2LINE} -e $objfile $start_kernel_addr)
@@ -97,86 +94,133 @@ __faddr2line() { local dir_prefix=$3 local print_warnings=$4 - local func=${func_addr%+*} + local sym_name=${func_addr%+*} local offset=${func_addr#*+} offset=${offset%/*} - local size= - [[ $func_addr =~ "/" ]] && size=${func_addr#*/} + local user_size= + [[ $func_addr =~ "/" ]] && user_size=${func_addr#*/} - if [[ -z $func ]] || [[ -z $offset ]] || [[ $func = $func_addr ]]; then + if [[ -z $sym_name ]] || [[ -z $offset ]] || [[ $sym_name = $func_addr ]]; then warn "bad func+offset $func_addr" DONE=1 return fi # Go through each of the object's symbols which match the func name. - # In rare cases there might be duplicates. - file_end=$(${SIZE} -Ax $objfile | awk '$1 == ".text" {print $2}') - while read symbol; do - local fields=($symbol) - local sym_base=0x${fields[0]} - local sym_type=${fields[1]} - local sym_end=${fields[3]} - - # calculate the size - local sym_size=$(($sym_end - $sym_base)) + # In rare cases there might be duplicates, in which case we print all + # matches. + while read line; do + local fields=($line) + local sym_addr=0x${fields[1]} + local sym_elf_size=${fields[2]} + local sym_sec=${fields[6]} + + # Get the section size: + local sec_size=$(${READELF} --section-headers --wide $objfile | + sed 's/\[ /\[/' | + ${AWK} -v sec=$sym_sec '$1 == "[" sec "]" { print "0x" $6; exit }') + + if [[ -z $sec_size ]]; then + warn "bad section size: section: $sym_sec" + DONE=1 + return + fi + + # Calculate the symbol size. + # + # Unfortunately we can't use the ELF size, because kallsyms + # also includes the padding bytes in its size calculation. For + # kallsyms, the size calculation is the distance between the + # symbol and the next symbol in a sorted list. + local sym_size + local cur_sym_addr + local found=0 + while read line; do + local fields=($line) + cur_sym_addr=0x${fields[1]} + local cur_sym_elf_size=${fields[2]} + local cur_sym_name=${fields[7]:-} + + if [[ $cur_sym_addr = $sym_addr ]] && + [[ $cur_sym_elf_size = $sym_elf_size ]] && + [[ $cur_sym_name = $sym_name ]]; then + found=1 + continue + fi + + if [[ $found = 1 ]]; then + sym_size=$(($cur_sym_addr - $sym_addr)) + [[ $sym_size -lt $sym_elf_size ]] && continue; + found=2 + break + fi + done < <(${READELF} --symbols --wide $objfile | ${AWK} -v sec=$sym_sec '$7 == sec' | sort --key=2) + + if [[ $found = 0 ]]; then + warn "can't find symbol: sym_name: $sym_name sym_sec: $sym_sec sym_addr: $sym_addr sym_elf_size: $sym_elf_size" + DONE=1 + return + fi + + # If nothing was found after the symbol, assume it's the last + # symbol in the section. + [[ $found = 1 ]] && sym_size=$(($sec_size - $sym_addr)) + if [[ -z $sym_size ]] || [[ $sym_size -le 0 ]]; then - warn "bad symbol size: base: $sym_base end: $sym_end" + warn "bad symbol size: sym_addr: $sym_addr cur_sym_addr: $cur_sym_addr" DONE=1 return fi + sym_size=0x$(printf %x $sym_size) - # calculate the address - local addr=$(($sym_base + $offset)) + # Calculate the section address from user-supplied offset: + local addr=$(($sym_addr + $offset)) if [[ -z $addr ]] || [[ $addr = 0 ]]; then - warn "bad address: $sym_base + $offset" + warn "bad address: $sym_addr + $offset" DONE=1 return fi addr=0x$(printf %x $addr) - # weed out non-function symbols - if [[ $sym_type != t ]] && [[ $sym_type != T ]]; then - [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to non-function symbol of type '$sym_type'" - continue - fi - - # if the user provided a size, make sure it matches the symbol's size - if [[ -n $size ]] && [[ $size -ne $sym_size ]]; then + # If the user provided a size, make sure it matches the symbol's size: + if [[ -n $user_size ]] && [[ $user_size -ne $sym_size ]]; then [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to size mismatch ($size != $sym_size)" + echo "skipping $sym_name address at $addr due to size mismatch ($user_size != $sym_size)" continue; fi - # make sure the provided offset is within the symbol's range + # Make sure the provided offset is within the symbol's range: if [[ $offset -gt $sym_size ]]; then [[ $print_warnings = 1 ]] && - echo "skipping $func address at $addr due to size mismatch ($offset > $sym_size)" + echo "skipping $sym_name address at $addr due to size mismatch ($offset > $sym_size)" continue fi - # separate multiple entries with a blank line + # In case of duplicates or multiple addresses specified on the + # cmdline, separate multiple entries with a blank line: [[ $FIRST = 0 ]] && echo FIRST=0 - # pass real address to addr2line - echo "$func+$offset/$sym_size:" - local file_lines=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;") - [[ -z $file_lines ]] && return + echo "$sym_name+$offset/$sym_size:" + # Pass section address to addr2line and strip absolute paths + # from the output: + local output=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;") + [[ -z $output ]] && continue + + # Default output (non --list): if [[ $LIST = 0 ]]; then - echo "$file_lines" | while read -r line + echo "$output" | while read -r line do echo $line done DONE=1; - return + continue fi - # show each line with context - echo "$file_lines" | while read -r line + # For --list, show each line with its corresponding source code: + echo "$output" | while read -r line do echo echo $line
@@ -184,12 +228,12 @@ __faddr2line() { n1=$[$n-5] n2=$[$n+5] f=$(echo $line | sed 's/.*at \(.\+\):.*/\1/g') - awk 'NR>=strtonum("'$n1'") && NR<=strtonum("'$n2'") { if (NR=='$n') printf(">%d<", NR); else printf(" %d ", NR); printf("\t%s\n", $0)}' $f + ${AWK} 'NR>=strtonum("'$n1'") && NR<=strtonum("'$n2'") { if (NR=='$n') printf(">%d<", NR); else printf(" %d ", NR); printf("\t%s\n", $0)}' $f done DONE=1 - done < <(${NM} -n $objfile | awk -v fn=$func -v end=$file_end '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, "0x"$1 } END {if (found == 1) print line, end; }') + done < <(${READELF} --symbols --wide $objfile | ${AWK} -v fn=$sym_name '$4 == "FUNC" && $8 == fn') } [[ $# -lt 2 ]] && usage
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 427/879 media: aspeed: Fix an error handling path in aspeed_video_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 310fda622bbd38be17fb444f7f049b137af3bc0d ]
A dma_free_coherent() call is missing in the error handling path of the probe, as already done in the remove function.
In fact, this call is included in aspeed_video_free_buf(). So use the latter both in the error handling path of the probe and in the remove function.
It is easier to see the relation with aspeed_video_alloc_buf() this way.
--- drivers/media/platform/aspeed/aspeed-video.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/platform/aspeed/aspeed-video.c +2 -2
@@ -1993,6 +1993,7 @@ static int aspeed_video_probe(struct platform_device *pdev) rc =aspeed_video_setup_video (video);if (rc) { +aspeed_video_free_buf (video, &video->jpeg);clk_unprepare (video->vclk);clk_unprepare (video->eclk);return rc;
@@ -2024,8 +2025,7 @@ static int aspeed_video_remove(struct platform_device *pdev)v4l2_device_unregister (v4l2_dev); -dma_free_coherent (video->dev,VE_JPEG_HEADER_SIZE , video->jpeg.virt, - video->jpeg.dma); +aspeed_video_free_buf (video, &video->jpeg);of_reserved_mem_device_release (dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 428/879 media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 5c0db68ce0faeb000c3540d095eb272d671a6e03 ]
If probe fails then we need to call pm_runtime_disable() to balance out the previous pm_runtime_enable() call.
--- drivers/media/platform/samsung/exynos4-is/fimc-is.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/samsung/exynos4-is/fimc-is.c +3 -1
@@ -830,7 +830,7 @@ static int fimc_is_probe(struct platform_device *pdev) ret =pm_runtime_resume_and_get (dev);if (ret <0 ) - goto err_irq; + goto err_pm_disable;vb2_dma_contig_set_max_seg_size (dev,DMA_BIT_MASK (32 ));
@@ -864,6 +864,8 @@ static int fimc_is_probe(struct platform_device *pdev)pm_runtime_put_noidle (dev);if (!pm_runtime_enabled (dev))fimc_is_runtime_suspend (dev); +err_pm_disable: +pm_runtime_disable (dev); err_irq:free_irq (is->irq, is); err_clk:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 429/879 mt76: mt7915: fix DBDC default band selection on MT7915D
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 96c777708bcac53f73a1c079e416495647f69553 ]
This code was accidentally dropped while adding 6 GHz support
--- drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c +2 -0
@@ -152,6 +152,8 @@ static void mt7915_eeprom_parse_band_config(struct mt7915_phy *phy) phy->mt76->cap.has_2ghz = true;return ; } + }else if (val ==MT_EE_BAND_SEL_DEFAULT && dev->dbdc_support) { + val = phy->band_idx ?MT_EE_BAND_SEL_5GHZ :MT_EE_BAND_SEL_2GHZ ; }switch (val) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 430/879 mt76: mt7921: honor pm user configuration in mt7921_sniffer_interface_iter
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 47eea8ad62a1203ce20b365f7feba23fef62a487 ]
Honor runtime-pm user configuration in mt7921_sniffer_interface_iter routine if we do not have a monitor interface.
--- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7921/main.c +2 -2
@@ -489,8 +489,8 @@ mt7921_sniffer_interface_iter(void *priv, u8 *mac, struct ieee80211_vif *vif)bool monitor = !!(hw->conf.flags &IEEE80211_CONF_MONITOR );mt7921_mcu_set_sniffer (dev, vif, monitor); - pm->enable = !monitor; - pm->ds_enable = !monitor; + pm->enable = pm->enable_user && !monitor; + pm->ds_enable = pm->ds_enable_user && !monitor;mt76_connac_mcu_set_deep_sleep (&dev->mt76, pm->ds_enable);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 431/879 mt76: mt7915: fix unbounded shift in mt7915_mcu_beacon_mbss
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit aa796f12091aa4758366f5171fd9cba2ff574ba3 ]
Fix the following smatch static checker warning:
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c:1872 mt7915_mcu_beacon_mbss() error: undefined (user controlled) shift '(((1))) << (data[2])'
Rely on mac80211 definitions for ieee80211_bssid_index subelement.
--- .../net/wireless/mediatek/mt76/mt7915/mcu.c | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +13 -7
@@ -1854,7 +1854,8 @@ mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,continue ;for_each_element (sub_elem, elem->data +1 , elem->datalen -1 ) { -const u8 *data; +const struct ieee80211_bssid_index *idx; +const u8 *idx_ie;if (sub_elem->id || sub_elem->datalen <4 )continue ;/* not a valid BSS profile */
@@ -1862,14 +1863,19 @@ mt7915_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,/* Find WLAN_EID_MULTI_BSSID_IDX * in the merged nontransmitted profile */ - data =cfg80211_find_ie (WLAN_EID_MULTI_BSSID_IDX , - sub_elem->data, - sub_elem->datalen); -if (!data || data[1 ] <1 || !data[2 ]) + idx_ie =cfg80211_find_ie (WLAN_EID_MULTI_BSSID_IDX , + sub_elem->data, + sub_elem->datalen); +if (!idx_ie || idx_ie[1 ] <sizeof (*idx))continue ; - mbss->offset[data[2 ]] =cpu_to_le16 (data - skb->data); - mbss->bitmap |=cpu_to_le32 (BIT (data[2 ])); + idx = (void *)(idx_ie +2 ); +if (!idx->bssid_index || idx->bssid_index >31 ) +continue ; + + mbss->offset[idx->bssid_index] = +cpu_to_le16 (idx_ie - skb->data); + mbss->bitmap |=cpu_to_le32 (BIT (idx->bssid_index)); } } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 432/879 mt76: mt7921: Fix the error handling path of mt7921_pci_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 4e90db5e21eb3bb272fe47386dc3506755e209e9 ]
In case of error, some resources must be freed, as already done above and below the devm_kmemdup() and __mt7921e_mcu_drv_pmctrl() calls added in the commit in Fixes:.
--- drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7921/pci.c +5 -3
@@ -302,8 +302,10 @@ static int mt7921_pci_probe(struct pci_dev *pdev, dev->bus_ops = dev->mt76.bus; bus_ops =devm_kmemdup (dev->mt76.dev, dev->bus_ops,sizeof (*bus_ops),GFP_KERNEL ); -if (!bus_ops) -return -ENOMEM ; +if (!bus_ops) { + ret = -ENOMEM ; + goto err_free_dev; + } bus_ops->rr = mt7921_rr; bus_ops->wr = mt7921_wr;
@@ -312,7 +314,7 @@ static int mt7921_pci_probe(struct pci_dev *pdev, ret =__mt7921e_mcu_drv_pmctrl (dev);if (ret) -return ret; + goto err_free_dev; mdev->rev = (mt7921_l1_rr (dev,MT_HW_CHIPID ) <<16 ) | (mt7921_l1_rr (dev,MT_HW_REV ) &0xff );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 433/879 mt76: mt7915: fix possible uninitialized pointer dereference in mt7986_wmac_gpio_setup
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 9bd6823f5a64b6465708b244eecc9b7dd4b01bfc ]
Add default case for type switch in mt7986_wmac_gpio_setup routine in order to avoid a possible uninitialized pointer dereference.
--- drivers/net/wireless/mediatek/mt76/mt7915/soc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7915/soc.c +2 -0
@@ -210,6 +210,8 @@ static int mt7986_wmac_gpio_setup(struct mt7915_dev *dev)if (IS_ERR_OR_NULL (state))return -EINVAL ;break ; +default : +return -EINVAL ; } ret =pinctrl_select_state (pinctrl, state);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 434/879 mt76: mt7915: fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 62fdc974894eec80d678523458cf99bbdb887e22 ]
Fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector routine if the chip does not support dbdc and the hw reports band_idx set to 1.
--- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mac.c +5 -2
@@ -864,8 +864,11 @@ mt7915_mac_fill_rx_vector(struct mt7915_dev *dev, struct sk_buff *skb)int i; band_idx =le32_get_bits (rxv_hdr[1 ],MT_RXV_HDR_BAND_IDX ); -if (band_idx && !phy->band_idx) +if (band_idx && !phy->band_idx) { phy =mt7915_ext_phy (dev); +if (!phy) + goto out; + } rcpi =le32_to_cpu (rxv[6 ]); ib_rssi =le32_to_cpu (rxv[7 ]);
@@ -890,8 +893,8 @@ mt7915_mac_fill_rx_vector(struct mt7915_dev *dev, struct sk_buff *skb) phy->test.last_freq_offset = foe; phy->test.last_snr = snr; +out:#endif -dev_kfree_skb (skb); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 435/879 mt76: mt7915: do not pass data pointer to mt7915_mcu_muru_debug_set
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit badb6ffaa1439fce30fc6ef10571dcf45a622b44 ]
Fix typo in mt7915_muru_debug_set routine and pass muru_debug value to mt7915_mcu_muru_debug_set() instead of data pointer.
--- drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +1 -1
@@ -95,7 +95,7 @@ mt7915_muru_debug_set(void *data, u64 val)struct mt7915_dev *dev = data; dev->muru_debug = val; -mt7915_mcu_muru_debug_set (dev, data); +mt7915_mcu_muru_debug_set (dev, dev->muru_debug);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 436/879 mt76: mt7915: report rx mode value in mt7915_mac_fill_rx_rate
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 05268cf1789d99eda491c4a32f23a4c5b9bddeba ]
Report rx mode in mt7915_mac_fill_rx_rate routine in order to properly add he radiotap if mode is at least HE_SU.
--- .../net/wireless/mediatek/mt76/mt7915/mac.c | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mac.c +11 -11
@@ -309,7 +309,7 @@ mt7915_mac_decode_he_mu_radiotap(struct sk_buff *skb, __le32 *rxv) }static void -mt7915_mac_decode_he_radiotap (struct sk_buff *skb,__le32 *rxv,u32 mode) +mt7915_mac_decode_he_radiotap (struct sk_buff *skb,__le32 *rxv,u8 mode) {struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;static const struct ieee80211_radiotap_he known = {
@@ -474,10 +474,10 @@ static int mt7915_mac_fill_rx_rate(struct mt7915_dev *dev, struct mt76_rx_status *status, struct ieee80211_supported_band *sband, - __le32 *rxv) + __le32 *rxv, u8 *mode) { u32 v0, v2; -u8 stbc, gi, bw, dcm, mode, nss; +u8 stbc, gi, bw, dcm, nss;int i, idx;bool cck = false;
@@ -490,18 +490,18 @@ mt7915_mac_fill_rx_rate(struct mt7915_dev *dev,if (!is_mt7915 (&dev->mt76)) { stbc =FIELD_GET (MT_PRXV_HT_STBC , v0); gi =FIELD_GET (MT_PRXV_HT_SHORT_GI , v0); - mode =FIELD_GET (MT_PRXV_TX_MODE , v0); + *mode =FIELD_GET (MT_PRXV_TX_MODE , v0); dcm =FIELD_GET (MT_PRXV_DCM , v0); bw =FIELD_GET (MT_PRXV_FRAME_MODE , v0); }else { stbc =FIELD_GET (MT_CRXV_HT_STBC , v2); gi =FIELD_GET (MT_CRXV_HT_SHORT_GI , v2); - mode =FIELD_GET (MT_CRXV_TX_MODE , v2); + *mode =FIELD_GET (MT_CRXV_TX_MODE , v2); dcm = !!(idx &GENMASK (3 ,0 ) &MT_PRXV_TX_DCM ); bw =FIELD_GET (MT_CRXV_FRAME_MODE , v2); } -switch (mode) { +switch (*mode) {case MT_PHY_TYPE_CCK : cck = true; fallthrough;
@@ -546,7 +546,7 @@ mt7915_mac_fill_rx_rate(struct mt7915_dev *dev,case IEEE80211_STA_RX_BW_20 :break ;case IEEE80211_STA_RX_BW_40 : -if (mode &MT_PHY_TYPE_HE_EXT_SU && +if (*mode &MT_PHY_TYPE_HE_EXT_SU && (idx &MT_PRXV_TX_ER_SU_106T )) { status->bw =RATE_INFO_BW_HE_RU ; status->he_ru =
@@ -566,7 +566,7 @@ mt7915_mac_fill_rx_rate(struct mt7915_dev *dev, } status->enc_flags |=RX_ENC_FLAG_STBC_MASK * stbc; -if (mode <MT_PHY_TYPE_HE_SU && gi) +if (*mode <MT_PHY_TYPE_HE_SU && gi) status->enc_flags |=RX_ENC_FLAG_SHORT_GI ;return 0 ;
@@ -581,7 +581,6 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)struct ieee80211_supported_band *sband;__le32 *rxd = (__le32 *)skb->data;__le32 *rxv =NULL ; -u32 mode =0 ;u32 rxd0 =le32_to_cpu (rxd[0 ]);u32 rxd1 =le32_to_cpu (rxd[1 ]);u32 rxd2 =le32_to_cpu (rxd[2 ]);
@@ -590,10 +589,10 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb)u32 csum_mask =MT_RXD0_NORMAL_IP_SUM |MT_RXD0_NORMAL_UDP_TCP_SUM ;bool unicast, insert_ccmp_hdr = false;u8 remove_pad, amsdu_info; +u8 mode =0 , qos_ctl =0 ;bool hdr_trans;u16 hdr_gap;u16 seq_ctrl =0 ; -u8 qos_ctl =0 ;__le16 fc =0 ;int idx;
@@ -766,7 +765,8 @@ mt7915_mac_fill_rx(struct mt7915_dev *dev, struct sk_buff *skb) }if (!is_mt7915 (&dev->mt76) || (rxd1 &MT_RXD1_NORMAL_GROUP_5 )) { - ret =mt7915_mac_fill_rx_rate (dev, status, sband, rxv); + ret =mt7915_mac_fill_rx_rate (dev, status, sband, rxv, + &mode);if (ret <0 )return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 437/879 mt76: fix antenna config missing in 6G cap
In reply to Greg Kroah-HartmanFrom: Deren Wu <[email protected]>
[ Upstream commit abba345311a740d9dca1b5eb293b3b1c296715dd ]
To make sure we have the proper antenna config in 6g cap, move IEEE80211_VHT_CAP_[T/R]X_ANTENNA_PATTERN to stream init.
--- drivers/net/wireless/mediatek/mt76/mac80211.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/mac80211.c +2 -2
@@ -248,6 +248,8 @@ static void mt76_init_stream_cap(struct mt76_phy *phy, vht_cap->cap |=IEEE80211_VHT_CAP_TXSTBC ; else vht_cap->cap &= ~IEEE80211_VHT_CAP_TXSTBC; + vht_cap->cap |=IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN | +IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN ;for (i =0 ; i <8 ; i++) {if (i < nstream)
@@ -323,8 +325,6 @@ mt76_init_sband(struct mt76_phy *phy, struct mt76_sband *msband, vht_cap->cap |=IEEE80211_VHT_CAP_RXLDPC |IEEE80211_VHT_CAP_RXSTBC_1 |IEEE80211_VHT_CAP_SHORT_GI_80 | -IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN | -IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN | (3 <<IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT );return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 438/879 mt76: mt7921: fix kernel crash at mt7921_pci_remove
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit ad483ed9dd5193a54293269c852a29051813b7bd ]
The crash log shown it is possible that mt7921_irq_handler is called while devm_free_irq is being handled so mt76_free_device need to be postponed until devm_free_irq is completed to solve the crash we free the mt76 device too early.
[ 9299.339655] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 9299.339705] #PF: supervisor read access in kernel mode [ 9299.339735] #PF: error_code(0x0000) - not-present page [ 9299.339768] PGD 0 P4D 0 [ 9299.339786] Oops: 0000 [#1] SMP PTI [ 9299.339812] CPU: 1 PID: 1624 Comm: prepare-suspend Not tainted 5.15.14-1.fc32.qubes.x86_64 #1 [ 9299.339863] Hardware name: Xen HVM domU, BIOS 4.14.3 01/20/2022 [ 9299.339901] RIP: 0010:mt7921_irq_handler+0x1e/0x70 [mt7921e] [ 9299.340048] RSP: 0018:ffffa81b80c27cb0 EFLAGS: 00010082 [ 9299.340081] RAX: 0000000000000000 RBX: ffff98a4cb752020 RCX: ffffffffa96211c5 [ 9299.340123] RDX: 0000000000000000 RSI: 00000000000d4204 RDI: ffff98a4cb752020 [ 9299.340165] RBP: ffff98a4c28a62a4 R08: ffff98a4c37a96c0 R09: 0000000080150011 [ 9299.340207] R10: 0000000040000000 R11: 0000000000000000 R12: ffff98a4c4eaa080 [ 9299.340249] R13: ffff98a4c28a6360 R14: ffff98a4cb752020 R15: ffff98a4c28a6228 [ 9299.340297] FS: 00007260840d3740(0000) GS:ffff98a4ef700000(0000) knlGS:0000000000000000 [ 9299.340345] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9299.340383] CR2: 0000000000000008 CR3: 0000000004c56001 CR4: 0000000000770ee0 [ 9299.340432] PKRU: 55555554 [ 9299.340449] Call Trace: [ 9299.340467] <TASK> [ 9299.340485] __free_irq+0x221/0x350 [ 9299.340527] free_irq+0x30/0x70 [ 9299.340553] devm_free_irq+0x55/0x80 [ 9299.340579] mt7921_pci_remove+0x2f/0x40 [mt7921e] [ 9299.340616] pci_device_remove+0x3b/0xa0 [ 9299.340651] __device_release_driver+0x17a/0x240 [ 9299.340686] device_driver_detach+0x3c/0xa0 [ 9299.340714] unbind_store+0x113/0x130 [ 9299.340740] kernfs_fop_write_iter+0x124/0x1b0 [ 9299.340775] new_sync_write+0x15c/0x1f0 [ 9299.340806] vfs_write+0x1d2/0x270 [ 9299.340831] ksys_write+0x67/0xe0 [ 9299.340857] do_syscall_64+0x3b/0x90 [ 9299.340887] entry_SYSCALL_64_after_hwframe+0x44/0xae
--- drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7921/pci.c +1 -1
@@ -119,7 +119,6 @@ static void mt7921e_unregister_device(struct mt7921_dev *dev)mt7921_mcu_exit (dev);tasklet_disable (&dev->irq_tasklet); -mt76_free_device (&dev->mt76); }static u32 __mt7921_reg_addr (struct mt7921_dev *dev,u32 addr)
@@ -356,6 +355,7 @@ static void mt7921_pci_remove(struct pci_dev *pdev)mt7921e_unregister_device (dev);devm_free_irq (&pdev->dev, pdev->irq, dev); +mt76_free_device (&dev->mt76);pci_free_irq_vectors (pdev); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 439/879 mt76: do not attempt to reorder received 802.3 packets without agg session
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 3968a66475b40691c37b5e6c76975f699671e10e ]
Fixes potential latency / packet drop issues in cases where a BA session has not (yet) been established.
--- drivers/net/wireless/mediatek/mt76/agg-rx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/mediatek/mt76/agg-rx.c +3 -2
@@ -162,8 +162,9 @@ void mt76_rx_aggr_reorder(struct sk_buff *skb, struct sk_buff_head *frames)if (!sta)return ; -if (!status->aggr && !(status->flag &RX_FLAG_8023 )) { -mt76_rx_aggr_check_ctl (skb, frames); +if (!status->aggr) { +if (!(status->flag &RX_FLAG_8023 )) +mt76_rx_aggr_check_ctl (skb, frames);return ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 440/879 mt76: fix tx status related use-after-free race on station removal
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit fcfe1b5e162bf473c1d47760962cec8523c00466 ]
There is a small race window where ongoing tx activity can lead to a skb getting added to the status tracking idr after that idr has already been cleaned up, which will keep the wcid linked in the status poll list. Fix this by only adding status skbs if the wcid pointer is still assigned in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove
--- drivers/net/wireless/mediatek/mt76/mac80211.c | 2 ++ drivers/net/wireless/mediatek/mt76/tx.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mac80211.c +2 -0
@@ -1381,7 +1381,9 @@ void mt76_sta_pre_rcu_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,struct mt76_wcid *wcid = (struct mt76_wcid *)sta->drv_priv;mutex_lock (&dev->mutex); +spin_lock_bh (&dev->status_lock);rcu_assign_pointer (dev->wcid[wcid->idx],NULL ); +spin_unlock_bh (&dev->status_lock);mutex_unlock (&dev->mutex); }EXPORT_SYMBOL_GPL (mt76_sta_pre_rcu_remove);
drivers/net/wireless/mediatek/mt76/tx.c +1 -1
@@ -120,7 +120,7 @@ mt76_tx_status_skb_add(struct mt76_dev *dev, struct mt76_wcid *wcid,memset (cb,0 ,sizeof (*cb)); -if (!wcid) +if (!wcid || !rcu_access_pointer (dev->wcid[wcid->idx]))return MT_PACKET_ID_NO_ACK ;if (info->flags &IEEE80211_TX_CTL_NO_ACK )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 441/879 mt76: mt7915: fix twt table_mask to u16 in mt7915_dev
In reply to Greg Kroah-HartmanFrom: Peter Chiu <[email protected]>
[ Upstream commit 3620c8821ae15902eb995a32918e34b7a0c773a3 ]
mt7915 can support 16 twt stations so modify table_mask to u16.
--- drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +1 -1
@@ -319,7 +319,7 @@ struct mt7915_dev {void *cal;struct { -u8 table_mask; +u16 table_mask;u8 n_agrt; } twt;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 442/879 media: st-delta: Fix PM disable depth imbalance in delta_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 94e3dba710fe0afc772172305444250023fc2d30 ]
The pm_runtime_enable will decrease power disable depth. If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable().
--- drivers/media/platform/st/sti/delta/delta-v4l2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/st/sti/delta/delta-v4l2.c +4 -2
@@ -1859,7 +1859,7 @@ static int delta_probe(struct platform_device *pdev)if (ret) {dev_err (delta->dev,"%s failed to initialize firmware ipc channel\n" ,DELTA_PREFIX ); - goto err; + goto err_pm_disable; }/* register all available decoders */
@@ -1873,7 +1873,7 @@ static int delta_probe(struct platform_device *pdev)if (ret) {dev_err (delta->dev,"%s failed to register V4L2 device\n" ,DELTA_PREFIX ); - goto err; + goto err_pm_disable; } delta->work_queue =create_workqueue (DELTA_NAME );
@@ -1898,6 +1898,8 @@ static int delta_probe(struct platform_device *pdev)destroy_workqueue (delta->work_queue); err_v4l2:v4l2_device_unregister (&delta->v4l2_dev); +err_pm_disable: +pm_runtime_disable (dev); err:return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 443/879 media: atmel: atmel-isc: Fix PM disable depth imbalance in atmel_isc_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 395829c61a196a0821a703a49c4db3ac51daff73 ]
The pm_runtime_enable will decrease power disable depth. If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable().
--- drivers/media/platform/atmel/atmel-sama5d2-isc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/media/platform/atmel/atmel-sama5d2-isc.c +4 -1
@@ -562,7 +562,7 @@ static int atmel_isc_probe(struct platform_device *pdev) ret =clk_prepare_enable (isc->ispck);if (ret) {dev_err (dev,"failed to enable ispck: %d\n" , ret); - goto cleanup_subdev; + goto disable_pm; }/* ispck should be greater or equal to hclock */
@@ -580,6 +580,9 @@ static int atmel_isc_probe(struct platform_device *pdev) unprepare_clk:clk_disable_unprepare (isc->ispck); +disable_pm: +pm_runtime_disable (dev); + cleanup_subdev:isc_subdev_cleanup (isc);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 444/879 media: i2c: rdacm2x: properly set subdev entity function
In reply to Greg Kroah-HartmanFrom: Laurentiu Palcu <[email protected]>
[ Upstream commit d2facee67b4883bb3e7461a0a93fd70d0c7b7261 ]
The subdevice entity function was left unset, which produces a warning when probing the device:
mxc-md bus@58000000:camera: Entity type for entity rdacm20 19-0051 was not initialized!
This patch will set entity function to MEDIA_ENT_F_CAM_SENSOR and leave flags unset.
--- drivers/media/i2c/rdacm20.c | 2 +- drivers/media/i2c/rdacm21.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/rdacm20.c +1 -1
@@ -611,7 +611,7 @@ static int rdacm20_probe(struct i2c_client *client) goto error_free_ctrls; dev->pad.flags =MEDIA_PAD_FL_SOURCE ; - dev->sd.entity.flags |=MEDIA_ENT_F_CAM_SENSOR ; + dev->sd.entity.function =MEDIA_ENT_F_CAM_SENSOR ; ret =media_entity_pads_init (&dev->sd.entity,1 , &dev->pad);if (ret <0 ) goto error_free_ctrls;
drivers/media/i2c/rdacm21.c +1 -1
@@ -583,7 +583,7 @@ static int rdacm21_probe(struct i2c_client *client) goto error_free_ctrls; dev->pad.flags =MEDIA_PAD_FL_SOURCE ; - dev->sd.entity.flags |=MEDIA_ENT_F_CAM_SENSOR ; + dev->sd.entity.function =MEDIA_ENT_F_CAM_SENSOR ; ret =media_entity_pads_init (&dev->sd.entity,1 , &dev->pad);if (ret <0 ) goto error_free_ctrls;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 445/879 media: exynos4-is: Change clk_disable to clk_disable_unprepare
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9fadab72a6916c7507d7fedcd644859eef995078 ]
The corresponding API for clk_prepare_enable is clk_disable_unprepare, other than clk_disable.
Fix this by changing clk_disable to clk_disable_unprepare.
--- drivers/media/platform/samsung/exynos4-is/fimc-is.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/samsung/exynos4-is/fimc-is.c +1 -1
@@ -140,7 +140,7 @@ static int fimc_is_enable_clocks(struct fimc_is *is)dev_err (&is->pdev->dev,"clock %s enable failed\n" , fimc_is_clocks[i]);for (--i; i >=0 ; i--) -clk_disable (is->clocks[i]); +clk_disable_unprepare (is->clocks[i]);return ret; }pr_debug ("enabled clock: %s\n" , fimc_is_clocks[i]);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 446/879 media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 471bec68457aaf981add77b4f590d65dd7da1059 ]
Syzbot reported that -1 is used as array index. The problem was in missing validation check.
hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that.
hdw->workpoll initialization moved upper to prevent warning in __flush_work.
--- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/media/usb/pvrusb2/pvrusb2-hdw.c +5 -2
@@ -2569,6 +2569,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, }while (0 );mutex_unlock (&pvr2_unit_mtx); +INIT_WORK (&hdw->workpoll, pvr2_hdw_worker_poll); + +if (hdw->unit_number ==-1 ) + goto fail; + cnt1 =0 ; cnt2 =scnprintf (hdw->name+cnt1,sizeof (hdw->name)-cnt1,"pvrusb2" ); cnt1 += cnt2;
@@ -2580,8 +2585,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,if (cnt1 >=sizeof (hdw->name)) cnt1 =sizeof (hdw->name)-1 ; hdw->name[cnt1] =0 ; -INIT_WORK (&hdw->workpoll,pvr2_hdw_worker_poll); -pvr2_trace (PVR2_TRACE_INIT ,"Driver unit number is %d, name is %s" , hdw->unit_number,hdw->name);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 447/879 media: make RADIO_ADAPTERS tristate
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 215d49a41709610b9e82a49b27269cfaff1ef0b6 ]
Fix build errors when RADIO_TEA575X=y, VIDEO_BT848=m, and VIDEO_DEV=m.
The build errors occur due to [in drivers/media/Makefile]:
obj-$(CONFIG_VIDEO_DEV) += radio/
so the (would be) builtin tea575x.o is not being built.
This is also due to drivers/media/radio/Kconfig declaring a bool Kconfig symbol (RADIO_ADAPTERS) that depends on a tristate (VIDEO_DEV), so when VIDEO_DEV=m, RADIO_ADAPTERS becomes =y, and then the drivers that depend on RADIO_ADPATERS can be configured as builtin (=y) or as loadable modules (=m).
Fix this by converting RADIO_ADAPTERS to a tristate symbol instead of a bool symbol.
Fixes these build errors:
ERROR: modpost: "snd_tea575x_hw_init" [drivers/media/pci/bt8xx/bttv.ko] undefined!
ERROR: modpost: "snd_tea575x_set_freq" [drivers/media/pci/bt8xx/bttv.ko] undefined!
ERROR: modpost: "snd_tea575x_s_hw_freq_seek" [drivers/media/pci/bt8xx/bttv.ko] undefined!
ERROR: modpost: "snd_tea575x_enum_freq_bands" [drivers/media/pci/bt8xx/bttv.ko] undefined!
ERROR: modpost: "snd_tea575x_g_tuner" [drivers/media/pci/bt8xx/bttv.ko] undefined!
--- drivers/media/radio/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/radio/Kconfig +2 -2
@@ -4,10 +4,10 @@ # menuconfig RADIO_ADAPTERS - bool "Radio Adapters" + tristate "Radio Adapters" depends on VIDEO_DEV depends on MEDIA_RADIO_SUPPORT - default y + default VIDEO_DEV help Say Y here to enable selecting AM/FM radio adapters.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 448/879 media: vsp1: Fix offset calculation for plane cropping
In reply to Greg Kroah-HartmanFrom: Michael Rodin <[email protected]>
[ Upstream commit 5f25abec8f21b7527c1223a354d23c270befddb3 ]
The vertical subsampling factor is currently not considered in the offset calculation for plane cropping done in rpf_configure_partition. This causes a distortion (shift of the color plane) when formats with the vsub factor larger than 1 are used (e.g. NV12, see vsp1_video_formats in vsp1_pipe.c). This commit considers vsub factor for all planes except plane 0 (luminance).
Drop generalization of the offset calculation to reduce the binary size.
--- drivers/media/platform/renesas/vsp1/vsp1_rpf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/platform/renesas/vsp1/vsp1_rpf.c +3 -3
@@ -291,11 +291,11 @@ static void rpf_configure_partition(struct vsp1_entity *entity, + crop.left * fmtinfo->bpp[0 ] /8 ;if (format->num_planes >1 ) { +unsigned int bpl = format->plane_fmt[1 ].bytesperline;unsigned int offset; - offset = crop.top * format->plane_fmt[1 ].bytesperline - + crop.left / fmtinfo->hsub - * fmtinfo->bpp[1 ] /8 ; + offset = crop.top / fmtinfo->vsub * bpl + + crop.left / fmtinfo->hsub * fmtinfo->bpp[1 ] /8 ; mem.addr[1 ] += offset; mem.addr[2 ] += offset; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 449/879 media: atmel: atmel-sama5d2-isc: fix wrong mask in YUYV format check
In reply to Greg Kroah-HartmanFrom: Eugen Hristev <[email protected]>
[ Upstream commit 91f49b80983f7bffdea9498209b2b896231ac776 ]
While this does not happen in production, this check should be done versus the mask, as checking with the YCYC value may not include some bits that may be set.
It is correct and safe to check the whole mask.
--- drivers/media/platform/atmel/atmel-sama5d2-isc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/atmel/atmel-sama5d2-isc.c +1 -1
@@ -291,7 +291,7 @@ static void isc_sama5d2_config_rlp(struct isc_device *isc)* Thus, if the YCYC mode is selected, replace it with the * sama5d2-compliant mode which is YYCC . */ -if ((rlp_mode &ISC_RLP_CFG_MODE_YCYC ) ==ISC_RLP_CFG_MODE_YCYC ) { +if ((rlp_mode &ISC_RLP_CFG_MODE_MASK ) ==ISC_RLP_CFG_MODE_YCYC ) { rlp_mode &= ~ISC_RLP_CFG_MODE_MASK ; rlp_mode |=ISC_RLP_CFG_MODE_YYCC ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 450/879 media: hantro: HEVC: Fix tile info buffer value computation
In reply to Greg Kroah-HartmanFrom: Benjamin Gaignard <[email protected]>
[ Upstream commit d7f4149df818463c1d7094b35db6ebd79f46c7bd ]
Use pps->column_width_minus1[j] + 1 as value for the tile info buffer instead of pps->column_width_minus1[j + 1].
The patch fixes DBLK_E_VIXS_2, DBLK_F_VIXS_2, DBLK_G_VIXS_2, SAO_B_MediaTek_5, TILES_A_Cisco_2 and TILES_B_Cisco_1 tests in fluster.
--- drivers/staging/media/hantro/hantro_g2_hevc_dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/hantro/hantro_g2_hevc_dec.c +1 -1
@@ -60,7 +60,7 @@ static void prepare_tile_info_buffer(struct hantro_ctx *ctx) no_chroma =1 ;for (j =0 , tmp_w =0 ; j < num_tile_cols -1 ; j++) { tmp_w += pps->column_width_minus1[j] +1 ; - *p++ = pps->column_width_minus1[j +1 ]; + *p++ = pps->column_width_minus1[j] +1 ; *p++ = h;if (i ==0 && h ==1 && ctb_size ==16 ) no_chroma =1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 451/879 Bluetooth: mt7921s: Fix the incorrect pointer check
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 789f6b8ac3b15bca09b69d5699cad0bf6e2103aa ]
Fix the incorrect pointer check on ven_data.
--- drivers/bluetooth/btmtksdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/btmtksdio.c +1 -1
@@ -961,7 +961,7 @@ static int btmtksdio_get_codec_config_data(struct hci_dev *hdev, } *ven_data =kmalloc (sizeof (__u8),GFP_KERNEL ); -if (!ven_data) { +if (!*ven_data) { err = -ENOMEM ; goto error; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 452/879 Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
In reply to Greg Kroah-HartmanFrom: Ying Hsu <[email protected]>
[ Upstream commit 7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2 ]
Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace:
dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30
--- net/bluetooth/sco.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
net/bluetooth/sco.c +13 -8
@@ -574,19 +574,24 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen addr->sa_family != AF_BLUETOOTH)return -EINVAL ; -if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) -return -EBADFD ; +lock_sock (sk); +if (sk->sk_state !=BT_OPEN && sk->sk_state !=BT_BOUND ) { + err = -EBADFD ; + goto done; + } -if (sk->sk_type !=SOCK_SEQPACKET ) -return -EINVAL ; +if (sk->sk_type !=SOCK_SEQPACKET ) { + err = -EINVAL ; + goto done; + } hdev =hci_get_route (&sa->sco_bdaddr, &sco_pi (sk)->src,BDADDR_BREDR ); -if (!hdev) -return -EHOSTUNREACH ; +if (!hdev) { + err = -EHOSTUNREACH ; + goto done; + }hci_dev_lock (hdev); -lock_sock (sk); -/* Set destination address and psm */ bacpy (&sco_pi (sk)->dst, &sa->sco_bdaddr);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 453/879 Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit 50a3633ae5e98cf1b80ef5b73c9e341aee9ad896 ]
hci_is_adv_monitoring's function documentation states that it must be called under the hdev lock. Paths that leads to an unlocked call are:discov_update => start_discovery => interleaved_discov => active_scan
and: discov_update => start_discovery => active_scan
The solution is to take the lock in active_scan during the duration of the call to hci_is_adv_monitoring.
--- net/bluetooth/hci_request.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/hci_request.c +2 -0
@@ -2260,6 +2260,7 @@ static int active_scan(struct hci_request *req, unsigned long opt)if (err <0 ) own_addr_type =ADDR_LE_DEV_PUBLIC ; +hci_dev_lock (hdev);if (hci_is_adv_monitoring (hdev)) {/* Duplicate filter should be disabled when some advertisement * monitor is activated, otherwise AdvMon can only receive one
@@ -2276,6 +2277,7 @@ static int active_scan(struct hci_request *req, unsigned long opt)*/ filter_dup =LE_SCAN_FILTER_DUP_DISABLE ; } +hci_dev_unlock (hdev); hci_req_start_scan(req, LE_SCAN_ACTIVE, interval, hdev->le_scan_window_discovery, own_addr_type,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 454/879 Bluetooth: use hdev lock for accept_list and reject_list in conn req
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit fb048cae51bacdfbbda2954af3c213fdb1d484f4 ]
All accesses (both reads and modifications) to hdev->{accept,reject}_list are protected by hdev lock, except the ones in hci_conn_request_evt. This can cause a race condition in the form of a list corruption.
The solution is to protect these lists in hci_conn_request_evt as well.
I was unable to find the exact commit that introduced the issue for the reject list, I was only able to find it for the accept list.
--- net/bluetooth/hci_event.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
net/bluetooth/hci_event.c +9 -6
@@ -3225,10 +3225,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data,return ; } +hci_dev_lock (hdev); +if (hci_bdaddr_list_lookup (&hdev->reject_list, &ev->bdaddr,BDADDR_BREDR )) {hci_reject_conn (hdev, &ev->bdaddr); -return ; + goto unlock; }/* Require HCI_CONNECTABLE or an accept list entry to accept the
@@ -3240,13 +3242,11 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr, BDADDR_BREDR)) {hci_reject_conn (hdev, &ev->bdaddr); -return ; + goto unlock; }/* Connection accepted */ -hci_dev_lock (hdev); - ie =hci_inquiry_cache_lookup (hdev, &ev->bdaddr);if (ie)memcpy (ie->data.dev_class, ev->dev_class,3 );
@@ -3258,8 +3258,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, HCI_ROLE_SLAVE);if (!conn) {bt_dev_err (hdev,"no memory for new connection" ); -hci_dev_unlock (hdev); -return ; + goto unlock; } }
@@ -3299,6 +3298,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, conn->state =BT_CONNECT2 ;hci_connect_cfm (conn,0 ); } + +return ; +unlock: +hci_dev_unlock (hdev); }static u8 hci_to_mgmt_reason (u8 err)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 455/879 Bluetooth: protect le accept and resolv lists with hdev->lock
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit 5e2b6064cbc5fd582396768c5f9583f65085e368 ]
Concurrent operations from events on le_{accept,resolv}_list are currently unprotected by hdev->lock.
Most existing code do already protect the lists with that lock. This can be observed in hci_debugfs and hci_sync.
Add the protection for these events too.
--- net/bluetooth/hci_event.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
net/bluetooth/hci_event.c +12 -0
@@ -1835,7 +1835,9 @@ static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data,if (rp->status)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_clear (&hdev->le_accept_list); +hci_dev_unlock (hdev);return rp->status; }
@@ -1855,8 +1857,10 @@ static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data,if (!sent)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_add (&hdev->le_accept_list, &sent->bdaddr, sent->bdaddr_type); +hci_dev_unlock (hdev);return rp->status; }
@@ -1876,8 +1880,10 @@ static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data,if (!sent)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_del (&hdev->le_accept_list, &sent->bdaddr, sent->bdaddr_type); +hci_dev_unlock (hdev);return rp->status; }
@@ -1949,9 +1955,11 @@ static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data,if (!sent)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_add_with_irk (&hdev->le_resolv_list, &sent->bdaddr, sent->bdaddr_type, sent->peer_irk, sent->local_irk); +hci_dev_unlock (hdev);return rp->status; }
@@ -1971,8 +1979,10 @@ static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data,if (!sent)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_del_with_irk (&hdev->le_resolv_list, &sent->bdaddr, sent->bdaddr_type); +hci_dev_unlock (hdev);return rp->status; }
@@ -1987,7 +1997,9 @@ static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data,if (rp->status)return rp->status; +hci_dev_lock (hdev);hci_bdaddr_list_clear (&hdev->le_resolv_list); +hci_dev_unlock (hdev);return rp->status; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 456/879 Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 0fab6361c4ba17d1b43a991bef4238a3c1754d35 ]
We should not access skb buffer data anymore after hci_recv_frame was called.
[ 39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0
[ 39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker
[ 39.634962] Call trace:
[ 39.634974] dump_backtrace+0x0/0x3b8
[ 39.634999] show_stack+0x20/0x2c
[ 39.635016] dump_stack_lvl+0x60/0x78
[ 39.635040] print_address_description+0x70/0x2f0
[ 39.635062] kasan_report+0x154/0x194
[ 39.635079] __asan_report_load1_noabort+0x44/0x50
[ 39.635099] btmtksdio_recv_event+0x1b0/0x1c4
[ 39.635129] btmtksdio_txrx_work+0x6cc/0xac4
[ 39.635157] process_one_work+0x560/0xc5c
[ 39.635177] worker_thread+0x7ec/0xcc0
[ 39.635195] kthread+0x2d0/0x3d0
[ 39.635215] ret_from_fork+0x10/0x20
[ 39.635247] Allocated by task 0:
[ 39.635260] (stack is not available)
[ 39.635281] Freed by task 2392:
[ 39.635295] kasan_save_stack+0x38/0x68
[ 39.635319] kasan_set_track+0x28/0x3c
[ 39.635338] kasan_set_free_info+0x28/0x4c
[ 39.635357] ____kasan_slab_free+0x104/0x150
[ 39.635374] __kasan_slab_free+0x18/0x28
[ 39.635391] slab_free_freelist_hook+0x114/0x248
[ 39.635410] kfree+0xf8/0x2b4
[ 39.635427] skb_free_head+0x58/0x98
[ 39.635447] skb_release_data+0x2f4/0x410
[ 39.635464] skb_release_all+0x50/0x60
[ 39.635481] kfree_skb+0xc8/0x25c
[ 39.635498] hci_event_packet+0x894/0xca4 [bluetooth]
[ 39.635721] hci_rx_work+0x1c8/0x68c [bluetooth]
[ 39.635925] process_one_work+0x560/0xc5c
[ 39.635951] worker_thread+0x7ec/0xcc0
[ 39.635970] kthread+0x2d0/0x3d0
[ 39.635990] ret_from_fork+0x10/0x20
[ 39.636021] The buggy address belongs to the object at ffffff80cf28a600
which belongs to the cache kmalloc-512 of size 512
[ 39.636039] The buggy address is located 13 bytes inside of
512-byte region [ffffff80cf28a600, ffffff80cf28a800)--- drivers/bluetooth/btmtksdio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/bluetooth/btmtksdio.c +2 -1
@@ -379,6 +379,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb) {struct btmtksdio_dev *bdev =hci_get_drvdata (hdev);struct hci_event_hdr *hdr = (void *)skb->data; +u8 evt = hdr->evt;int err;/* When someone waits for the WMT event, the skb is being cloned
@@ -396,7 +397,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb)if (err <0 ) goto err_free_skb; -if (hdr->evt ==HCI_EV_WMT ) { +if (evt ==HCI_EV_WMT ) {if (test_and_clear_bit (BTMTKSDIO_TX_WAIT_VND_EVT , &bdev->tx_state)) {/* Barrier to sync with other CPUs */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 457/879 Bluetooth: btmtksdio: fix possible FW initialization failure
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit 7469720563e01f479ec5afe06bd6f440f965d523 ]
According to FW advised sequence, mt7921s need to re-acquire privilege immediately after the firmware download is complete before normal running. Otherwise, it is still possible the bus may be stuck in an abnormal status that causes FW initialization failure in the current driver.
--- drivers/bluetooth/btmtksdio.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/bluetooth/btmtksdio.c +8 -8
@@ -864,6 +864,14 @@ static int mt79xx_setup(struct hci_dev *hdev, const char *fwname)return err; } + err =btmtksdio_fw_pmctrl (bdev); +if (err <0 ) +return err; + + err =btmtksdio_drv_pmctrl (bdev); +if (err <0 ) +return err; +/* Enable Bluetooth protocol */ wmt_params.op =BTMTK_WMT_FUNC_CTRL ; wmt_params.flag =0 ;
@@ -1109,14 +1117,6 @@ static int btmtksdio_setup(struct hci_dev *hdev)if (err <0 )return err; - err =btmtksdio_fw_pmctrl (bdev); -if (err <0 ) -return err; - - err =btmtksdio_drv_pmctrl (bdev); -if (err <0 ) -return err; -/* Enable SCO over I2S/PCM */ err =btmtksdio_sco_setting (hdev);if (err <0 ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 458/879 Bluetooth: btmtksdio: fix the reset takes too long
In reply to Greg Kroah-HartmanFrom: Sean Wang <[email protected]>
[ Upstream commit baabb7f530e8a3f0085d12f4ea0bada4115515d3 ]
Sending WMT command during the reset in progress is invalid and would get no response from firmware until the reset is complete, so we ignore the WMT command here to resolve the issue which causes the whole reset process taking too long.
--- drivers/bluetooth/btmtksdio.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/bluetooth/btmtksdio.c +5 -0
@@ -1189,6 +1189,10 @@ static int btmtksdio_shutdown(struct hci_dev *hdev)*/ pm_runtime_get_sync (bdev->dev); +/* wmt command only works until the reset is complete */ +if (test_bit (BTMTKSDIO_HW_RESET_ACTIVE , &bdev->tx_state)) + goto ignore_wmt_cmd; +/* Disable the device */ wmt_params.op =BTMTK_WMT_FUNC_CTRL ; wmt_params.flag =0 ;
@@ -1202,6 +1206,7 @@ static int btmtksdio_shutdown(struct hci_dev *hdev)return err; } +ignore_wmt_cmd:pm_runtime_put_noidle (bdev->dev);pm_runtime_disable (bdev->dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 459/879 media: mediatek: vcodec: Fix v4l2 compliance decoder cmd test fail
In reply to Greg Kroah-HartmanFrom: Yunfei Dong <[email protected]>
[ Upstream commit 08a83828825cbf3bc2c9f582a4cd4da9f40c77d6 ]
Will return -EINVAL using standard framework api when test stateless decoder with cmd VIDIOC_(TRY)DECODER_CMD. Disable them to adjust v4l2 compliance test for user driver(GStreamer/Chrome) won't use decoder cmd.
--- .../media/platform/mediatek/vcodec/mtk_vcodec_dec.c | 13 +------------ .../platform/mediatek/vcodec/mtk_vcodec_dec_drv.c | 3 +++ 2 files changed, 4 insertions(+), 12 deletions(-)
drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c +1 -12
@@ -47,14 +47,7 @@ static struct mtk_q_data *mtk_vdec_get_q_data(struct mtk_vcodec_ctx *ctx,static int vidioc_try_decoder_cmd (struct file *file,void *priv,struct v4l2_decoder_cmd *cmd) { -struct mtk_vcodec_ctx *ctx =fh_to_ctx (priv); - -/* Use M2M stateless helper if relevant */ -if (ctx->dev->vdec_pdata->uses_stateless_api) -return v4l2_m2m_ioctl_stateless_try_decoder_cmd (file, priv, - cmd); -else -return v4l2_m2m_ioctl_try_decoder_cmd (file, priv, cmd); +return v4l2_m2m_ioctl_try_decoder_cmd (file, priv, cmd); }
@@ -69,10 +62,6 @@ static int vidioc_decoder_cmd(struct file *file, void *priv,if (ret)return ret; -/* Use M2M stateless helper if relevant */ -if (ctx->dev->vdec_pdata->uses_stateless_api) -return v4l2_m2m_ioctl_stateless_decoder_cmd (file, priv, cmd); -mtk_v4l2_debug (1 ,"decoder cmd=%u" , cmd->cmd); dst_vq =v4l2_m2m_get_vq (ctx->m2m_ctx,V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE );
drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c +3 -0
@@ -400,6 +400,9 @@ static int mtk_vcodec_probe(struct platform_device *pdev) }if (dev->vdec_pdata->uses_stateless_api) { +v4l2_disable_ioctl (vfd_dec,VIDIOC_DECODER_CMD ); +v4l2_disable_ioctl (vfd_dec,VIDIOC_TRY_DECODER_CMD ); + dev->mdev_dec.dev = &pdev->dev;strscpy (dev->mdev_dec.model,MTK_VCODEC_DEC_NAME ,sizeof (dev->mdev_dec.model));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 460/879 io_uring: avoid io-wq -EAGAIN looping for !IOPOLL
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
[ Upstream commit e0deb6a025ae8c850dc8685be39fb27b06c88736 ]
If an opcode handler semi-reliably returns -EAGAIN, io_wq_submit_work() might continue busily hammer the same handler over and over again, which is not ideal. The -EAGAIN handling in question was put there only for IOPOLL, so restrict it to IOPOLL mode only where there is no other recourse than to retry as we cannot wait.
--- fs/io_uring.c | 2 ++ 1 file changed, 2 insertions(+)
fs/io_uring.c +2 -0
@@ -7327,6 +7327,8 @@ static void io_wq_submit_work(struct io_wq_work *work)* wait for request slots on the block side. */ if (!needs_poll) { +if (!(req->ctx->flags &IORING_SETUP_IOPOLL )) +break ;cond_resched ();continue ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 461/879 io_uring: only wake when the correct events are set
In reply to Greg Kroah-HartmanFrom: Dylan Yudaken <[email protected]>
[ Upstream commit 1b1d7b4bf1d9948c8dba5ee550459ce7c65ac019 ]
The check for waking up a request compares the poll_t bits, however this will always contain some common flags so this always wakes up.
For files with single wait queues such as sockets this can cause the request to be sent to the async worker unnecesarily. Further if it is non-blocking will complete the request with EAGAIN which is not desired.
Here exclude these common events, making sure to not exclude POLLERR which might be important.
--- fs/io_uring.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/io_uring.c +3 -2
@@ -5981,6 +5981,7 @@ static void io_poll_cancel_req(struct io_kiocb *req)#define wqe_to_req (wait) ((void *)((unsigned long) (wait)->private & ~1))#define wqe_is_double (wait) ((unsigned long) (wait)->private & 1) +#define IO_ASYNC_POLL_COMMON (EPOLLONESHOT | POLLPRI)static int io_poll_wake (struct wait_queue_entry *wait,unsigned mode,int sync,void *key)
@@ -6015,7 +6016,7 @@ static int io_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync, }/* for instances that support it check for an event match first */ -if (mask && !(mask & poll->events)) +if (mask && !(mask & (poll->events & ~IO_ASYNC_POLL_COMMON )))return 0 ;if (io_poll_get_ownership (req)) {
@@ -6171,7 +6172,7 @@ static int io_arm_poll_handler(struct io_kiocb *req, unsigned issue_flags)struct io_ring_ctx *ctx = req->ctx;struct async_poll *apoll;struct io_poll_table ipt; -__poll_t mask =EPOLLONESHOT |POLLERR |POLLPRI ; +__poll_t mask =IO_ASYNC_POLL_COMMON |POLLERR ;int ret;if (!def->pollin && !def->pollout)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 462/879 irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit adf14453d2c037ab529040c1186ea32e277e783a ]
There are cases where a context synchronization event is necessary between an IRQ being raised and being handled, and there are races such that we cannot rely upon the exception entry being subsequent to the interrupt being raised.
We identified and fixes this for regular IRQs in commit:
39a06b67c2c1256b ("irqchip/gic: Ensure we have an ISB between ack and ->handle_irq")
Unfortunately, we forgot to do the same for psuedo-NMIs when support for those was added in commit:
f32c926651dcd168 ("irqchip/gic-v3: Handle pseudo-NMIs")
Which means that when pseudo-NMIs are used for PMU support, we'll hit the same problem.
Apply the same fix as for regular IRQs. Note that when EOI mode 1 is in use, the call to gic_write_eoir() will provide an ISB.
--- drivers/irqchip/irq-gic-v3.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/irqchip/irq-gic-v3.c +3 -0
@@ -654,6 +654,9 @@ static inline void gic_handle_nmi(u32 irqnr, struct pt_regs *regs)if (static_branch_likely (&supports_deactivate_key))gic_write_eoir (irqnr); +else +isb () +/* * Leave the PSR.I bit set to prevent other NMIs to be * received while handling this one.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 463/879 irqchip/gic-v3: Refactor ISB + EOIR at ack time
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit 6efb50923771f392122f5ce69dfc43b08f16e449 ]
There are cases where a context synchronization event is necessary between an IRQ being raised and being handled, and there are races such that we cannot rely upon the exception entry being subsequent to the interrupt being raised. To fix this, we place an ISB between a read of IAR and the subsequent invocation of an IRQ handler.
When EOI mode 1 is in use, we need to EOI an interrupt prior to invoking its handler, and we have a write to EOIR for this. As this write to EOIR requires an ISB, and this is provided by the gic_write_eoir() helper, we omit the usual ISB in this case, with the logic being:
| if (static_branch_likely(&supports_deactivate_key)) | gic_write_eoir(irqnr); | else | isb();
This is somewhat opaque, and it would be a little clearer if there were an unconditional ISB, with only the write to EOIR being conditional, e.g.
| if (static_branch_likely(&supports_deactivate_key)) | write_gicreg(irqnr, ICC_EOIR1_EL1); | | isb();
This patch rewrites the code that way, with this logic factored into a new helper function with comments explaining what the ISB is for, as were originally laid out in commit:
39a06b67c2c1256b ("irqchip/gic: Ensure we have an ISB between ack and ->handle_irq")
Note that since then, we removed the IAR polling in commit:
342677d70ab92142 ("irqchip/gic-v3: Remove acknowledge loop")
... which removed one of the two race conditions.
For consistency, other portions of the driver are made to manipulate EOIR using write_gicreg() and explcit ISBs, and the gic_write_eoir() helper function is removed.
There should be no functional change as a result of this patch.
--- arch/arm/include/asm/arch_gicv3.h | 7 +---- arch/arm64/include/asm/arch_gicv3.h | 6 ---- drivers/irqchip/irq-gic-v3.c | 43 ++++++++++++++++++++++------- 3 files changed, 34 insertions(+), 22 deletions(-)
arch/arm/include/asm/arch_gicv3.h +1 -6
@@ -48,6 +48,7 @@ static inline u32 read_ ## a64(void) \return read_sysreg (a32); \ } \ +CPUIF_MAP(ICC_EOIR1, ICC_EOIR1_EL1) CPUIF_MAP(ICC_PMR, ICC_PMR_EL1) CPUIF_MAP(ICC_AP0R0, ICC_AP0R0_EL1)CPUIF_MAP (ICC_AP0R1 ,ICC_AP0R1_EL1 )
@@ -63,12 +64,6 @@ CPUIF_MAP(ICC_AP1R3, ICC_AP1R3_EL1)/* Low-level accessors */ -static inline void gic_write_eoir (u32 irq) -{ -write_sysreg (irq,ICC_EOIR1 ); -isb (); -} -static inline void gic_write_dir (u32 val) {write_sysreg (val,ICC_DIR );
arch/arm64/include/asm/arch_gicv3.h +0 -6
@@ -26,12 +26,6 @@* sets the GP register's most significant bits to 0 with an explicit cast. */ -static inline void gic_write_eoir (u32 irq) -{ -write_sysreg_s (irq,SYS_ICC_EOIR1_EL1 ); -isb (); -} - static __always_inline void gic_write_dir(u32 irq) {write_sysreg_s (irq,SYS_ICC_DIR_EL1 );
drivers/irqchip/irq-gic-v3.c +33 -10
70 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 464/879 irqchip/gic-v3: Fix priority mask handling
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit 614ab80c96474682157cabb14f8c8602b3422e90 ]
When a kernel is built with CONFIG_ARM64_PSEUDO_NMI=y and pseudo-NMIs are enabled at runtime, GICv3's gic_handle_irq() can leave DAIF and ICC_PMR_EL1 in an unexpected state in some cases, breaking subsequent usage of local_irq_enable() and resulting in softirqs being run with IRQs erroneously masked (possibly resulting in deadlocks).
This can happen when an IRQ exception is taken from a context where regular IRQs were unmasked, and either:
(1) ICC_IAR1_EL1 indicates a special INTID (e.g. as a result of an IRQ being withdrawn since the IRQ exception was taken).
(2) ICC_IAR1_EL1 and ICC_RPR_EL1 indicate an NMI was acknowledged.
When an NMI is taken from a context where regular IRQs were masked, there is no problem.
When CONFIG_ARM64_DEBUG_PRIORITY_MASKING=y, this can be detected with perf, e.g.
| # ./perf record -a -g -e cycles:k ls -alR / > /dev/null 2>&1 | ------------[ cut here ]------------ | WARNING: CPU: 0 PID: 14 at arch/arm64/include/asm/irqflags.h:32 arch_local_irq_enable+0x4c/0x6c | Modules linked in: | CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 5.18.0-rc5-00004-g876c38e3d20b #12 | Hardware name: linux,dummy-virt (DT) | pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : arch_local_irq_enable+0x4c/0x6c | lr : __do_softirq+0x110/0x5d8 | sp : ffff8000080bbbc0 | pmr_save: 000000f0 | x29: ffff8000080bbbc0 x28: ffff316ac3a6ca40 x27: 0000000000000000 | x26: 0000000000000000 x25: ffffa04611c06008 x24: ffffa04611c06008 | x23: 0000000040400005 x22: 0000000000000200 x21: ffff8000080bbe20 | x20: ffffa0460fe10320 x19: 0000000000000009 x18: 0000000000000000 | x17: ffff91252dfa9000 x16: ffff800008004000 x15: 0000000000004000 | x14: 0000000000000028 x13: ffffa0460fe17578 x12: ffffa0460fed4294 | x11: ffffa0460fedc168 x10: ffffffffffffff80 x9 : ffffa0460fe10a70 | x8 : ffffa0460fedc168 x7 : 000000000000b762 x6 : 00000000057c3bdf | x5 : ffff8000080bbb18 x4 : 0000000000000000 x3 : 0000000000000001 | x2 : ffff91252dfa9000 x1 : 0000000000000060 x0 : 00000000000000f0 | Call trace: | arch_local_irq_enable+0x4c/0x6c | __irq_exit_rcu+0x180/0x1ac | irq_exit_rcu+0x1c/0x44 | el1_interrupt+0x4c/0xe4 | el1h_64_irq_handler+0x18/0x24 | el1h_64_irq+0x74/0x78 | smpboot_thread_fn+0x68/0x2c0 | kthread+0x124/0x130 | ret_from_fork+0x10/0x20 | irq event stamp: 193241 | hardirqs last enabled at (193240): [<ffffa0460fe10a9c>] __do_softirq+0x10c/0x5d8 | hardirqs last disabled at (193241): [<ffffa0461102ffe4>] el1_dbg+0x24/0x90 | softirqs last enabled at (193234): [<ffffa0460fe10e00>] __do_softirq+0x470/0x5d8 | softirqs last disabled at (193239): [<ffffa0460fea9944>] __irq_exit_rcu+0x180/0x1ac | ---[ end trace 0000000000000000 ]---
The necessary manipulation of DAIF and ICC_PMR_EL1 depends on the interrupted context, but the structure of gic_handle_irq() makes this also depend on whether the GIC reports an IRQ, NMI, or special INTID:
* When the interrupted context had regular IRQs masked (and hence the interrupt must be an NMI), the entry code performs the NMI entry/exit and gic_handle_irq() should return with DAIF and ICC_PMR_EL1 unchanged.
This is handled correctly today.
* When the interrupted context had regular IRQs unmasked, the entry code performs IRQ entry/exit, but expects gic_handle_irq() to always update ICC_PMR_EL1 and DAIF.IF to unmask NMIs (but not regular IRQs) prior to returning (which it must do prior to invoking any regular IRQ handler).
This unbalanced calling convention is necessary because we don't know whether an NMI has been taken until acknowledged by a read from ICC_IAR1_EL1, and so we need to perform the read with NMI masked in case an NMI has been taken (and needs to be handled with NMIs masked).
Unfortunately, this is not handled consistently:
- When ICC_IAR1_EL1 reports a special INTID, gic_handle_irq() returns immediately without manipulating ICC_PMR_EL1 and DAIF.
- When RPR_EL1 indicates an NMI, gic_handle_irq() calls gic_handle_nmi() to invoke the NMI handler, then returns without manipulating ICC_PMR_EL1 and DAIF.
- For regular IRQs, gic_handle_irq() manipulates ICC_PMR_EL1 and DAIF prior to invoking the IRQ handler.
There were related problems with special INTID handling in the past, where if an exception was taken from a context with regular IRQs masked and ICC_IAR_EL1 reported a special INTID, gic_handle_irq() would erroneously unmask NMIs in NMI context permitted an unexpected nested NMI. That case specifically was fixed by commit:
a97709f563a078e2 ("irqchip/gic-v3: Do not enable irqs when handling spurious interrups")
... but unfortunately that commit added an inverse problem, where if an exception was taken from a context with regular IRQs *unmasked* and ICC_IAR_EL1 reported a special INTID, gic_handle_irq() would erroneously fail to unmask NMIs (and consequently regular IRQs could not be unmasked during softirq processing). Before and after that commit, if an NMI was taken from a context with regular IRQs unmasked gic_handle_irq() would not unmask NMIs prior to returning, leading to the same problem with softirq handling.
This patch fixes this by restructuring gic_handle_irq(), splitting it into separate irqson/irqsoff helper functions which consistently perform the DAIF + ICC_PMR1_EL1 manipulation based upon the interrupted context, regardless of the event indicated by ICC_IAR1_EL1.
The special INTID handling is moved into the low-level IRQ/NMI handler invocation helper functions, so that early returns don't prevent the required manipulation of DAIF + ICC_PMR_EL1.
--- drivers/irqchip/irq-gic-v3.c | 147 +++++++++++++++++++++-------------- 1 file changed, 89 insertions(+), 58 deletions(-)
drivers/irqchip/irq-gic-v3.c +89 -58
@@ -673,78 +673,69 @@ static inline void gic_complete_ack(u32 irqnr)isb (); } -static inline void gic_handle_nmi (u32 irqnr,struct pt_regs *regs) +static bool gic_rpr_is_nmi_prio (void ) { -bool irqs_enabled =interrupts_enabled (regs); -int err; +if (!gic_supports_nmi ()) +return false; -if (irqs_enabled) -nmi_enter (); +return unlikely (gic_read_rpr () ==GICD_INT_RPR_PRI (GICD_INT_NMI_PRI )); +} + +static bool gic_irqnr_is_special (u32 irqnr) +{ +return irqnr >=1020 && irqnr <=1023 ; +} + +static void __gic_handle_irq (u32 irqnr,struct pt_regs *regs) +{ +if (gic_irqnr_is_special (irqnr)) +return ;gic_complete_ack (irqnr); -/* -* Leave the PSR.I bit set to prevent other NMIs to be -* received while handling this one. -* PSR.I will be restored when we ERET to the -* interrupted context. -*/ - err =generic_handle_domain_nmi (gic_data.domain, irqnr); -if (err) +if (generic_handle_domain_irq (gic_data.domain, irqnr)) { +WARN_ONCE (true,"Unexpected interrupt (irqnr %u)\n" , irqnr);gic_deactivate_unhandled (irqnr); - -if (irqs_enabled) -nmi_exit (); + } } -static u32 do_read_iar (struct pt_regs *regs) +static void __gic_handle_nmi (u32 irqnr,struct pt_regs *regs) { -u32 iar; - -if (gic_supports_nmi () &&unlikely (!interrupts_enabled (regs))) { -u64 pmr; - -/* -* We were in a context with IRQs disabled. However, the -* entry code has set PMR to a value that allows any -* interrupt to be acknowledged, and not just NMIs. This can -* lead to surprising effects if the NMI has been retired in -* the meantime, and that there is an IRQ pending. The IRQ -* would then be taken in NMI context, something that nobody -* wants to debug twice. -* -* Until we sort this, drop PMR again to a level that will -* actually only allow NMIs before reading IAR, and then -* restore it to what it was. -*/ - pmr =gic_read_pmr (); -gic_pmr_mask_irqs (); -isb (); +if (gic_irqnr_is_special (irqnr)) +return ; - iar =gic_read_iar (); +gic_complete_ack (irqnr); -gic_write_pmr (pmr); - }else { - iar =gic_read_iar (); +if (generic_handle_domain_nmi (gic_data.domain, irqnr)) { +WARN_ONCE (true,"Unexpected pseudo-NMI (irqnr %u)\n" , irqnr); +gic_deactivate_unhandled (irqnr); } - -return iar; } -static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs) +/* +* An exception has been taken from a context with IRQs enabled, and this could +* be an IRQ or an NMI. +* +* The entry code called us with DAIF.IF set to keep NMIs masked. We must clear +* DAIF.IF (and update ICC_PMR_EL1 to mask regular IRQs) prior to returning, +* after handling any NMI but before handling any IRQ. +* +* The entry code has performed IRQ entry, and if an NMI is detected we must +* perform NMI entry/exit around invoking the handler. +*/ +static void __gic_handle_irq_from_irqson (struct pt_regs *regs) { +bool is_nmi;u32 irqnr; - irqnr =do_read_iar (regs); + irqnr =gic_read_iar (); -/* Check for special IDs first */ -if ((irqnr >=1020 && irqnr <=1023 )) -return ; + is_nmi =gic_rpr_is_nmi_prio (); -if (gic_supports_nmi () && -unlikely (gic_read_rpr () ==GICD_INT_RPR_PRI (GICD_INT_NMI_PRI ))) { -gic_handle_nmi (irqnr, regs); -return ; +if (is_nmi) { +nmi_enter (); +__gic_handle_nmi (irqnr, regs); +nmi_exit (); }if (gic_prio_masking_enabled ()) {
@@ -752,12 +743,52 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regsgic_arch_enable_irqs (); } -gic_complete_ack (irqnr); +if (!is_nmi) +__gic_handle_irq (irqnr, regs); +} -if (generic_handle_domain_irq (gic_data.domain, irqnr)) { -WARN_ONCE (true,"Unexpected interrupt received!\n" ); -gic_deactivate_unhandled (irqnr); - } +/* +* An exception has been taken from a context with IRQs disabled, which can only +* be an NMI. +* +* The entry code called us with DAIF.IF set to keep NMIs masked. We must leave +* DAIF.IF (and ICC_PMR_EL1) unchanged. +* +* The entry code has performed NMI entry. +*/ +static void __gic_handle_irq_from_irqsoff (struct pt_regs *regs) +{ +u64 pmr; +u32 irqnr; + +/* +* We were in a context with IRQs disabled. However, the +* entry code has set PMR to a value that allows any +* interrupt to be acknowledged, and not just NMIs. This can +* lead to surprising effects if the NMI has been retired in +* the meantime, and that there is an IRQ pending. The IRQ +* would then be taken in NMI context, something that nobody +* wants to debug twice. +* +* Until we sort this, drop PMR again to a level that will +* actually only allow NMIs before reading IAR, and then +* restore it to what it was. +*/ + pmr =gic_read_pmr (); +gic_pmr_mask_irqs (); +isb (); + irqnr =gic_read_iar (); +gic_write_pmr (pmr); + +__gic_handle_nmi (irqnr, regs); +} + +static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs) +{ +if (unlikely (gic_supports_nmi () && !interrupts_enabled (regs))) +__gic_handle_irq_from_irqsoff (regs); +else +__gic_handle_irq_from_irqson (regs); }static u32 gic_get_pribits (void )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 465/879 nvme: set dma alignment to dword
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit 52fde2c07da606f3f120af4f734eadcfb52b04be ]
The nvme specification only requires qword alignment for segment descriptors, and the driver already guarantees that. The spec has always allowed user data to be dword aligned, which is what the queue's attribute is for, so relax the alignment requirement to that value.
While we could allow byte alignment for some controllers when using SGLs, we still need to support PRP, and that only allows dword.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -1771,7 +1771,7 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,blk_queue_max_segments (q,min_t (u32, max_segments,USHRT_MAX )); }blk_queue_virt_boundary (q,NVME_CTRL_PAGE_SIZE -1 ); -blk_queue_dma_alignment (q,7 ); +blk_queue_dma_alignment (q,3 );blk_queue_write_cache (q, vwc, vwc); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 466/879 m68k: math-emu: Fix dependencies of math emulation support
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit ed6bc6bf0a7d75e80eb1df883c09975ebb74e590 ]
If CONFIG_M54xx=y, CONFIG_MMU=y, and CONFIG_M68KFPU_EMU=y:
{standard input}:272: Error: invalid instruction for this architecture; needs 68000 or higher (68000 [68ec000, 68hc000, 68hc001, 68008, 68302, 68306, 68307, 68322, 68356], 68010, 68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060], cpu32 [68330, 68331, 68332, 68333, 68334, 68336, 68340, 68341, 68349, 68360], fidoa [fido]) -- statement `sub.b %d1,%d3' ignored
{standard input}:609: Error: invalid instruction for this architecture; needs 68020 or higher (68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060]) -- statement `bfextu 4(%a1){%d0,#8},%d0' ignored
{standard input}:752: Error: operands mismatch -- statement `mulu.l 4(%a0),%d3:%d0' ignored
{standard input}:1155: Error: operands mismatch -- statement `divu.l %d0,%d3:%d7' ignoredThe math emulation support code is intended for 68020 and higher, and uses several instructions or instruction modes not available on coldfire or 68000.
Originally, the dependency of M68KFPU_EMU on MMU was fine, as MMU support was only available on 68020 or higher. But this assumption was broken by the introduction of MMU support for M547x and M548x.
Drop the dependency on MMU, as the code should work fine on 68020 and up without MMU (which are not yet supported by Linux, though). Add dependencies on M68KCLASSIC (to rule out Coldfire) and FPU (kernel has some type of floating-point support --- be it hardware or software emulated, to rule out anything below 68020).
--- arch/m68k/Kconfig.cpu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/Kconfig.cpu +1 -1
@@ -327,7 +327,7 @@ comment "Processor Specific Options" config M68KFPU_EMU bool "Math emulation support" - depends on MMU + depends on M68KCLASSIC && FPU help At some point in the future, this will cause floating-point math instructions to be emulated by the kernel on machines that lack a
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 467/879 net: annotate races around sk->sk_bound_dev_if
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 4c971d2f3548e4f11b1460ac048f5307e4b39fdb ]
UDP sendmsg() is lockless, and reads sk->sk_bound_dev_if while this field can be changed by another thread.
Adds minimal annotations to avoid KCSAN splats for UDP. Following patches will add more annotations to potential lockless readers.
BUG: KCSAN: data-race in __ip6_datagram_connect / udpv6_sendmsg
write to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0:
__ip6_datagram_connect+0x6e2/0x930 net/ipv6/datagram.c:221 ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272 inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576 __sys_connect_file net/socket.c:1900 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1917 __do_sys_connect net/socket.c:1927 [inline] __se_sys_connect net/socket.c:1924 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:1924 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
read to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1:
udpv6_sendmsg+0xc60/0x16e0 net/ipv6/udp.c:1436 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:652 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0x00000000 -> 0xffffff9b
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 7670 Comm: syz-executor.3 Tainted: G W 5.18.0-rc1-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
I chose to not add Fixes: tag because race has minor consequences and stable teams busy enough.
--- include/net/ip.h | 2 +- include/net/sock.h | 5 +++-- net/ipv6/datagram.c | 6 +++--- net/ipv6/udp.c | 11 ++++++----- 4 files changed, 13 insertions(+), 11 deletions(-)
include/net/ip.h +1 -1
@@ -94,7 +94,7 @@ static inline void ipcm_init_sk(struct ipcm_cookie *ipcm, ipcm->sockc.mark = inet->sk.sk_mark; ipcm->sockc.tsflags = inet->sk.sk_tsflags; - ipcm->oif = inet->sk.sk_bound_dev_if; + ipcm->oif =READ_ONCE (inet->sk.sk_bound_dev_if); ipcm->addr = inet->inet_saddr; }
include/net/sock.h +3 -2
@@ -2866,13 +2866,14 @@ static inline void sk_pacing_shift_update(struct sock *sk, int val)*/ static inline bool sk_dev_equal_l3scope (struct sock *sk,int dif) { +int bound_dev_if =READ_ONCE (sk->sk_bound_dev_if);int mdif; -if (!sk->sk_bound_dev_if || sk->sk_bound_dev_if == dif) +if (!bound_dev_if || bound_dev_if == dif)return true; mdif =l3mdev_master_ifindex_by_index (sock_net (sk), dif); -if (mdif && mdif == sk->sk_bound_dev_if) +if (mdif && mdif == bound_dev_if)return true;return false;
net/ipv6/datagram.c +3 -3
@@ -218,11 +218,11 @@ int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, err = -EINVAL ; goto out; } - sk->sk_bound_dev_if = usin->sin6_scope_id; +WRITE_ONCE (sk->sk_bound_dev_if, usin->sin6_scope_id); }if (!sk->sk_bound_dev_if && (addr_type &IPV6_ADDR_MULTICAST )) - sk->sk_bound_dev_if = np->mcast_oif; +WRITE_ONCE (sk->sk_bound_dev_if, np->mcast_oif);/* Connect to link-local address requires an interface */ if (!sk->sk_bound_dev_if) {
@@ -798,7 +798,7 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk,if (src_idx) {if (fl6->flowi6_oif && src_idx != fl6->flowi6_oif && - (sk->sk_bound_dev_if != fl6->flowi6_oif || + (READ_ONCE (sk->sk_bound_dev_if) != fl6->flowi6_oif || !sk_dev_equal_l3scope (sk, src_idx)))return -EINVAL ; fl6->flowi6_oif = src_idx;
net/ipv6/udp.c +6 -5
@@ -105,7 +105,7 @@ static int compute_score(struct sock *sk, struct net *net, const struct in6_addr *daddr, unsigned short hnum, int dif, int sdif) { - int score; + int bound_dev_if, score;struct inet_sock *inet;bool dev_match;
@@ -132,10 +132,11 @@ static int compute_score(struct sock *sk, struct net *net, score++; } - dev_match =udp_sk_bound_dev_eq (net, sk->sk_bound_dev_if, dif, sdif); + bound_dev_if =READ_ONCE (sk->sk_bound_dev_if); + dev_match =udp_sk_bound_dev_eq (net, bound_dev_if, dif, sdif);if (!dev_match)return -1 ; -if (sk->sk_bound_dev_if) +if (bound_dev_if) score++;if (READ_ONCE (sk->sk_incoming_cpu) ==raw_smp_processor_id ())
@@ -789,7 +790,7 @@ static bool __udp_v6_is_mcast_sock(struct net *net, struct sock *sk, (inet->inet_dport && inet->inet_dport != rmt_port) || (!ipv6_addr_any (&sk->sk_v6_daddr) && !ipv6_addr_equal (&sk->sk_v6_daddr, rmt_addr)) || - !udp_sk_bound_dev_eq (net, sk->sk_bound_dev_if, dif, sdif) || + !udp_sk_bound_dev_eq (net,READ_ONCE (sk->sk_bound_dev_if), dif, sdif) || (!ipv6_addr_any (&sk->sk_v6_rcv_saddr) && !ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr))) return false;
@@ -1433,7 +1434,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) }if (!fl6->flowi6_oif) - fl6->flowi6_oif = sk->sk_bound_dev_if; + fl6->flowi6_oif =READ_ONCE (sk->sk_bound_dev_if);if (!fl6->flowi6_oif) fl6->flowi6_oif = np->sticky_pktinfo.ipi6_ifindex;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 468/879 sctp: read sk->sk_bound_dev_if once in sctp_rcv()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a20ea298071f46effa3aaf965bf9bb34c901db3f ]
sctp_rcv() reads sk->sk_bound_dev_if twice while the socket is not locked. Another cpu could change this field under us.
--- net/sctp/input.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sctp/input.c +3 -1
@@ -92,6 +92,7 @@ int sctp_rcv(struct sk_buff *skb)struct sctp_chunk *chunk;union sctp_addr src;union sctp_addr dest; +int bound_dev_if;int family;struct sctp_af *af;struct net *net =dev_net (skb->dev);
@@ -169,7 +170,8 @@ int sctp_rcv(struct sk_buff *skb)* If a frame arrives on an interface and the receiving socket is * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB */ -if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif (skb))) { + bound_dev_if =READ_ONCE (sk->sk_bound_dev_if); +if (bound_dev_if && (bound_dev_if != af->skb_iif (skb))) {if (transport) {sctp_transport_put (transport); asoc =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 469/879 net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init
In reply to Greg Kroah-HartmanFrom: Zheng Bin <[email protected]>
[ Upstream commit 382d917bfc1e92339dae3c8a636b2730e8bb5132 ]
hinic_pf_to_mgmt_init misses destroy_workqueue in error path, this patch fixes that.
--- drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c +2 -0
@@ -643,6 +643,7 @@ int hinic_pf_to_mgmt_init(struct hinic_pf_to_mgmt *pf_to_mgmt, err =alloc_msg_buf (pf_to_mgmt);if (err) {dev_err (&pdev->dev,"Failed to allocate msg buffers\n" ); +destroy_workqueue (pf_to_mgmt->workq);hinic_health_reporters_destroy (hwdev->devlink_dev);return err; }
@@ -650,6 +651,7 @@ int hinic_pf_to_mgmt_init(struct hinic_pf_to_mgmt *pf_to_mgmt, err =hinic_api_cmd_init (pf_to_mgmt->cmd_chain, hwif);if (err) {dev_err (&pdev->dev,"Failed to initialize cmd chains\n" ); +destroy_workqueue (pf_to_mgmt->workq);hinic_health_reporters_destroy (hwdev->devlink_dev);return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 470/879 ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit a34840c4eb3278a7c29c9c57a65ce7541c66f9f2 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- sound/soc/ti/j721e-evm.c | 44 ++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 11 deletions(-)
sound/soc/ti/j721e-evm.c +33 -11
@@ -630,17 +630,18 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, codec_node =of_parse_phandle (node,"ti,cpb-codec" ,0 );if (!codec_node) {dev_err (priv->dev,"CPB codec node is not provided\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_dai_node; } domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_CPB ]; ret =j721e_get_clocks (priv->dev, &domain->codec,"cpb-codec-scki" );if (ret) -return ret; + goto put_codec_node; ret =j721e_get_clocks (priv->dev, &domain->mcasp,"cpb-mcasp-auxclk" );if (ret) -return ret; + goto put_codec_node;/* * Common Processor Board, two links
@@ -650,8 +651,10 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, comp_count =6 ; compnent =devm_kzalloc (priv->dev, comp_count *sizeof (*compnent),GFP_KERNEL ); -if (!compnent) -return -ENOMEM ; +if (!compnent) { + ret = -ENOMEM ; + goto put_codec_node; + } comp_idx =0 ; priv->dai_links[*link_idx].cpus = &compnent[comp_idx++];
@@ -702,6 +705,12 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, (*conf_idx)++;return 0 ; + +put_codec_node: +of_node_put (codec_node); +put_dai_node: +of_node_put (dai_node); +return ret; } static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx,
@@ -726,23 +735,25 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, codeca_node =of_parse_phandle (node,"ti,ivi-codec-a" ,0 );if (!codeca_node) {dev_err (priv->dev,"IVI codec-a node is not provided\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_dai_node; } codecb_node =of_parse_phandle (node,"ti,ivi-codec-b" ,0 );if (!codecb_node) {dev_warn (priv->dev,"IVI codec-b node is not provided\n" ); -return 0 ; + ret =0 ; + goto put_codeca_node; } domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_IVI ]; ret =j721e_get_clocks (priv->dev, &domain->codec,"ivi-codec-scki" );if (ret) -return ret; + goto put_codecb_node; ret =j721e_get_clocks (priv->dev, &domain->mcasp,"ivi-mcasp-auxclk" );if (ret) -return ret; + goto put_codecb_node;/* * IVI extension, two links
@@ -754,8 +765,10 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, comp_count =8 ; compnent =devm_kzalloc (priv->dev, comp_count *sizeof (*compnent),GFP_KERNEL ); -if (!compnent) -return -ENOMEM ; +if (!compnent) { + ret = -ENOMEM ; + goto put_codecb_node; + } comp_idx =0 ; priv->dai_links[*link_idx].cpus = &compnent[comp_idx++];
@@ -816,6 +829,15 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, (*conf_idx)++;return 0 ; + + +put_codecb_node: +of_node_put (codecb_node); +put_codeca_node: +of_node_put (codeca_node); +put_dai_node: +of_node_put (dai_node); +return ret; }static int j721e_soc_probe (struct platform_device *pdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 471/879 kselftest/arm64: bti: force static linking
In reply to Greg Kroah-HartmanFrom: Andre Przywara <[email protected]>
[ Upstream commit d7a49291d786b4400996afe3afcc3ef5eeb6f0ef ]
The "bti" selftests are built with -nostdlib, which apparently automatically creates a statically linked binary, which is what we want and need for BTI (to avoid interactions with the dynamic linker).
However this is not true when building a PIE binary, which some toolchains (Ubuntu) configure as the default.
When compiling btitest with such a toolchain, it will create a dynamically linked binary, which will probably fail some tests, as the dynamic linker might not support BTI:
===================
TAP version 13
1..18
not ok 1 nohint_func/call_using_br_x0
not ok 2 nohint_func/call_using_br_x16
not ok 3 nohint_func/call_using_blr
....
===================
To make sure we create static binaries, add an explicit -static on the linker command line. This forces static linking even if the toolchain defaults to PIE builds, and fixes btitest runs on BTI enabled machines.
--- tools/testing/selftests/arm64/bti/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/arm64/bti/Makefile +2 -2
@@ -39,7 +39,7 @@ BTI_OBJS = \ teststubs-bti.o \ trampoline-bti.o gen/btitest: $(BTI_OBJS) - $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -o $@ $^ + $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -static -o $@ $^ NOBTI_OBJS = \ test-nobti.o \
@@ -50,7 +50,7 @@ NOBTI_OBJS = \ teststubs-nobti.o \ trampoline-nobti.o gen/nobtitest: $(NOBTI_OBJS) - $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -o $@ $^ + $(CC) $(CFLAGS_BTI) $(CFLAGS_COMMON) -nostdlib -static -o $@ $^ # Including KSFT lib.mk here will also mangle the TEST_GEN_PROGS list # to account for any OUTPUT target-dirs optionally provided by
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 472/879 media: ov7670: remove ov7670_power_off from ov7670_remove
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 5bf19572e31375368f19edd2dbb2e0789518bb99 ]
In ov7670_probe, it always invokes ov7670_power_off() no matter the execution is successful or failed. So we cannot invoke it agiain in ov7670_remove().
Fix this by removing ov7670_power_off from ov7670_remove.
--- drivers/media/i2c/ov7670.c | 1 - 1 file changed, 1 deletion(-)
drivers/media/i2c/ov7670.c +0 -1
@@ -2017,7 +2017,6 @@ static int ov7670_remove(struct i2c_client *client)v4l2_async_unregister_subdev (sd);v4l2_ctrl_handler_free (&info->hdl);media_entity_cleanup (&info->sd.entity); -ov7670_power_off (sd);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 473/879 media: i2c: ov2640: Depend on V4L2_ASYNC
In reply to Greg Kroah-HartmanFrom: Mike Pagano <[email protected]>
[ Upstream commit 8429b358975f11574f747ca8ef20d524d8247682 ]
Add V4L2_ASYNC as a dependency to match other drivers and prevent failures when compile testing.
--- drivers/media/i2c/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/media/i2c/Kconfig +1 -0
@@ -372,6 +372,7 @@ config VIDEO_OV13B10 config VIDEO_OV2640 tristate "OmniVision OV2640 sensor support" depends on VIDEO_DEV && I2C + select V4L2_ASYNC help This is a Video4Linux2 sensor driver for the OmniVision OV2640 camera.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 474/879 media: i2c: ov5648: fix wrong pointer passed to IS_ERR() and PTR_ERR()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit a6dd5265c21c28d0a782befe41a97c347e78f22f ]
IS_ERR() and PTR_ERR() use wrong pointer, it should be sensor->dovdd, fix it.
--- drivers/media/i2c/ov5648.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/i2c/ov5648.c +2 -2
@@ -2498,9 +2498,9 @@ static int ov5648_probe(struct i2c_client *client)/* DOVDD: digital I/O */ sensor->dovdd =devm_regulator_get (dev,"dovdd" ); -if (IS_ERR (sensor->dvdd)) { +if (IS_ERR (sensor->dovdd)) {dev_err (dev,"cannot get DOVDD (digital I/O) regulator\n" ); - ret =PTR_ERR (sensor->dvdd); + ret =PTR_ERR (sensor->dovdd); goto error_endpoint; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 475/879 media: rkvdec: Stop overclocking the decoder
In reply to Greg Kroah-HartmanFrom: Nicolas Dufresne <[email protected]>
[ Upstream commit 9998943f6dfc5d5472bfab2e38527fb6ba5e9da7 ]
While this overclock hack seems to work on some implementations (some ChromeBooks, RockPi4) it also causes instability on other implementations (notably LibreComputer Renegade, but there were more reports in the LibreELEC project, where this has been removed). While performance is indeed affected (tested with GStreamer), 4K playback still works as long as you don't operate in lock step and keep at least 1 frame ahead of time in the decode queue.
After discussion with ChromeOS members, it would seem that their implementation indeed used to synchronously decode each frame, so this hack was simply compensating for their code being less efficient. In my opinion, this hack should not have been included upstream.
--- drivers/staging/media/rkvdec/rkvdec.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/staging/media/rkvdec/rkvdec.c +0 -6
@@ -1027,12 +1027,6 @@ static int rkvdec_probe(struct platform_device *pdev)if (ret)return ret; -/* -* Bump ACLK to max. possible freq. (500 MHz) to improve performance -* When 4k video playback. -*/ -clk_set_rate (rkvdec->clocks[0 ].clk,500 *1000 *1000 ); - rkvdec->regs =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (rkvdec->regs))return PTR_ERR (rkvdec->regs);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 476/879 media: rkvdec: h264: Fix dpb_valid implementation
In reply to Greg Kroah-HartmanFrom: Nicolas Dufresne <[email protected]>
[ Upstream commit 7ab889f09dfa70e8097ec1b9186fd228124112cb ]
The ref builder only provided references that are marked as valid in the dpb. Thus the current implementation of dpb_valid would always set the flag to 1. This is not representing missing frames (this is called 'non-existing' pictures in the spec). In some context, these non-existing pictures still need to occupy a slot in the reference list according to the spec.
--- drivers/staging/media/rkvdec/rkvdec-h264.c | 33 ++++++++++++++++------ 1 file changed, 24 insertions(+), 9 deletions(-)
drivers/staging/media/rkvdec/rkvdec-h264.c +24 -9
@@ -112,6 +112,7 @@ struct rkvdec_h264_run {const struct v4l2_ctrl_h264_sps *sps;const struct v4l2_ctrl_h264_pps *pps;const struct v4l2_ctrl_h264_scaling_matrix *scaling_matrix; +int ref_buf_idx[V4L2_H264_NUM_DPB_ENTRIES ]; };struct rkvdec_h264_ctx {
@@ -725,6 +726,26 @@ static void assemble_hw_pps(struct rkvdec_ctx *ctx, } } +static void lookup_ref_buf_idx (struct rkvdec_ctx *ctx, +struct rkvdec_h264_run *run) +{ +const struct v4l2_ctrl_h264_decode_params *dec_params = run->decode_params; +u32 i; + +for (i =0 ; i <ARRAY_SIZE (dec_params->dpb); i++) { +struct v4l2_m2m_ctx *m2m_ctx = ctx->fh.m2m_ctx; +const struct v4l2_h264_dpb_entry *dpb = run->decode_params->dpb; +struct vb2_queue *cap_q = &m2m_ctx->cap_q_ctx.q; +int buf_idx =-1 ; + +if (dpb[i].flags &V4L2_H264_DPB_ENTRY_FLAG_ACTIVE ) + buf_idx =vb2_find_timestamp (cap_q, + dpb[i].reference_ts,0 ); + + run->ref_buf_idx[i] = buf_idx; + } +} +static void assemble_hw_rps (struct rkvdec_ctx *ctx,struct rkvdec_h264_run *run) {
@@ -762,7 +783,7 @@ static void assemble_hw_rps(struct rkvdec_ctx *ctx,for (j =0 ; j <RKVDEC_NUM_REFLIST ; j++) {for (i =0 ; i < h264_ctx->reflists.num_valid; i++) { -u8 dpb_valid =0 ; +bool dpb_valid = run->ref_buf_idx[i] >=0 ;u8 idx =0 ;switch (j) {
@@ -779,8 +800,6 @@ static void assemble_hw_rps(struct rkvdec_ctx *ctx,if (idx >=ARRAY_SIZE (dec_params->dpb))continue ; - dpb_valid = !!(dpb[idx].flags & -V4L2_H264_DPB_ENTRY_FLAG_ACTIVE );set_ps_field (hw_rps,DPB_INFO (i, j), idx | dpb_valid <<4 );
@@ -859,13 +878,8 @@ get_ref_buf(struct rkvdec_ctx *ctx, struct rkvdec_h264_run *run, unsigned int dpb_idx) {struct v4l2_m2m_ctx *m2m_ctx = ctx->fh.m2m_ctx; -const struct v4l2_h264_dpb_entry *dpb = run->decode_params->dpb;struct vb2_queue *cap_q = &m2m_ctx->cap_q_ctx.q; -int buf_idx =-1 ; - -if (dpb[dpb_idx].flags &V4L2_H264_DPB_ENTRY_FLAG_ACTIVE ) - buf_idx =vb2_find_timestamp (cap_q, - dpb[dpb_idx].reference_ts,0 ); +int buf_idx = run->ref_buf_idx[dpb_idx];/* * If a DPB entry is unused or invalid, address of current destination
@@ -1102,6 +1116,7 @@ static int rkvdec_h264_run(struct rkvdec_ctx *ctx)assemble_hw_scaling_list (ctx, &run);assemble_hw_pps (ctx, &run); +lookup_ref_buf_idx (ctx, &run);assemble_hw_rps (ctx, &run);config_registers (ctx, &run);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 477/879 media: rkvdec: h264: Fix bit depth wrap in pps packet
In reply to Greg Kroah-HartmanFrom: Jonas Karlman <[email protected]>
[ Upstream commit a074aa4760d1dad0bd565c0f66e7250f5f219ab0 ]
The luma and chroma bit depth fields in the pps packet are 3 bits wide. 8 is wrongly added to the bit depth values written to these 3 bit fields. Because only the 3 LSB are written, the hardware was configured correctly.
Correct this by not adding 8 to the luma and chroma bit depth value.
--- drivers/staging/media/rkvdec/rkvdec-h264.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/media/rkvdec/rkvdec-h264.c +2 -2
@@ -662,8 +662,8 @@ static void assemble_hw_pps(struct rkvdec_ctx *ctx,WRITE_PPS (0xff ,PROFILE_IDC );WRITE_PPS (1 ,CONSTRAINT_SET3_FLAG );WRITE_PPS (sps->chroma_format_idc,CHROMA_FORMAT_IDC ); -WRITE_PPS (sps->bit_depth_luma_minus8 +8 ,BIT_DEPTH_LUMA ); -WRITE_PPS (sps->bit_depth_chroma_minus8 +8 ,BIT_DEPTH_CHROMA ); +WRITE_PPS (sps->bit_depth_luma_minus8,BIT_DEPTH_LUMA ); +WRITE_PPS (sps->bit_depth_chroma_minus8,BIT_DEPTH_CHROMA );WRITE_PPS (0 ,QPPRIME_Y_ZERO_TRANSFORM_BYPASS_FLAG );WRITE_PPS (sps->log2_max_frame_num_minus4,LOG2_MAX_FRAME_NUM_MINUS4 );WRITE_PPS (sps->max_num_ref_frames,MAX_NUM_REF_FRAMES );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 478/879 regulator: scmi: Fix refcount leak in scmi_regulator_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 68d6c8476fd4f448e70e0ab31ff972838ac41dae ]
of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- drivers/regulator/scmi-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/scmi-regulator.c +1 -1
@@ -352,7 +352,7 @@ static int scmi_regulator_probe(struct scmi_device *sdev)return ret; } } - +of_node_put (np);/* * Register a regulator for each valid regulator-DT-entry that we * can successfully reach via SCMI and has a valid associated voltage
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 479/879 blk-cgroup: always terminate io.stat lines
In reply to Greg Kroah-HartmanFrom: Wolfgang Bumiller <[email protected]>
[ Upstream commit 3607849df47822151b05df440759e2dc70160755 ]
With the removal of seq_get_buf in blkcg_print_one_stat, we cannot make adding the newline conditional on there being relevant stats because the name was already written out unconditionally.
Otherwise we may end up with multiple device names in one line which is confusing and doesn't follow the nested-keyed file format.
--- block/blk-cgroup.c | 9 ++------- block/blk-cgroup.h | 2 +- block/blk-iocost.c | 5 ++--- block/blk-iolatency.c | 8 +++----- 4 files changed, 8 insertions(+), 16 deletions(-)
block/blk-cgroup.c +2 -7
@@ -905,7 +905,6 @@ static void blkcg_print_one_stat(struct blkcg_gq *blkg, struct seq_file *s) {struct blkg_iostat_set *bis = &blkg->iostat;u64 rbytes, wbytes, rios, wios, dbytes, dios; -bool has_stats = false;const char *dname;unsigned seq;int i;
@@ -931,14 +930,12 @@ static void blkcg_print_one_stat(struct blkcg_gq *blkg, struct seq_file *s) }while (u64_stats_fetch_retry (&bis->sync, seq));if (rbytes || wbytes || rios || wios) { - has_stats = true;seq_printf (s,"rbytes=%llu wbytes=%llu rios=%llu wios=%llu dbytes=%llu dios=%llu" , rbytes, wbytes, rios, wios, dbytes, dios); }if (blkcg_debug_stats &&atomic_read (&blkg->use_delay)) { - has_stats = true;seq_printf (s," use_delay=%d delay_nsec=%llu" ,atomic_read (&blkg->use_delay),atomic64_read (&blkg->delay_nsec));
@@ -950,12 +947,10 @@ static void blkcg_print_one_stat(struct blkcg_gq *blkg, struct seq_file *s)if (!blkg->pd[i] || !pol->pd_stat_fn)continue ; -if (pol->pd_stat_fn (blkg->pd[i], s)) - has_stats = true; + pol->pd_stat_fn (blkg->pd[i], s); } -if (has_stats) -seq_printf (s,"\n" ); +seq_puts (s,"\n" ); }static int blkcg_print_stat (struct seq_file *sf,void *v)
block/blk-cgroup.h +1 -1
@@ -63,7 +63,7 @@ typedef void (blkcg_pol_online_pd_fn)(struct blkg_policy_data *pd);typedef void (blkcg_pol_offline_pd_fn )(struct blkg_policy_data *pd);typedef void (blkcg_pol_free_pd_fn )(struct blkg_policy_data *pd);typedef void (blkcg_pol_reset_pd_stats_fn )(struct blkg_policy_data *pd); -typedef bool (blkcg_pol_stat_pd_fn )(struct blkg_policy_data *pd, +typedef void (blkcg_pol_stat_pd_fn )(struct blkg_policy_data *pd,struct seq_file *s);struct blkcg_policy {
block/blk-iocost.c +2 -3
@@ -3005,13 +3005,13 @@ static void ioc_pd_free(struct blkg_policy_data *pd)kfree (iocg); } -static bool ioc_pd_stat (struct blkg_policy_data *pd,struct seq_file *s) +static void ioc_pd_stat (struct blkg_policy_data *pd,struct seq_file *s) {struct ioc_gq *iocg =pd_to_iocg (pd);struct ioc *ioc = iocg->ioc;if (!ioc->enabled) -return false; +return ;if (iocg->level ==0 ) { unsigned vp10k = DIV64_U64_ROUND_CLOSEST(
@@ -3027,7 +3027,6 @@ static bool ioc_pd_stat(struct blkg_policy_data *pd, struct seq_file *s) iocg->last_stat.wait_us, iocg->last_stat.indebt_us, iocg->last_stat.indelay_us); -return true; } static u64 ioc_weight_prfill(struct seq_file *sf, struct blkg_policy_data *pd,
block/blk-iolatency.c +3 -5
@@ -891,7 +891,7 @@ static int iolatency_print_limit(struct seq_file *sf, void *v)return 0 ; } -static bool iolatency_ssd_stat (struct iolatency_grp *iolat,struct seq_file *s) +static void iolatency_ssd_stat (struct iolatency_grp *iolat,struct seq_file *s) {struct latency_stat stat;int cpu;
@@ -914,17 +914,16 @@ static bool iolatency_ssd_stat(struct iolatency_grp *iolat, struct seq_file *s) (unsigned long long )stat.ps.missed, (unsigned long long )stat.ps.total, iolat->rq_depth.max_depth); -return true; } -static bool iolatency_pd_stat (struct blkg_policy_data *pd,struct seq_file *s) +static void iolatency_pd_stat (struct blkg_policy_data *pd,struct seq_file *s) {struct iolatency_grp *iolat =pd_to_lat (pd);unsigned long long avg_lat;unsigned long long cur_win;if (!blkcg_debug_stats) -return false; +return ;if (iolat->ssd)return iolatency_ssd_stat (iolat, s);
@@ -937,7 +936,6 @@ static bool iolatency_pd_stat(struct blkg_policy_data *pd, struct seq_file *s)else seq_printf (s," depth=%u avg_lat=%llu win=%llu" , iolat->rq_depth.max_depth, avg_lat, cur_win); -return true; } static struct blkg_policy_data *iolatency_pd_alloc(gfp_t gfp,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 480/879 erofs: fix buffer copy overflow of ztailpacking feature
In reply to Greg Kroah-HartmanFrom: Gao Xiang <[email protected]>
[ Upstream commit dcbe6803fffd387f72b48c2373b5f5ed12a5804b ]
I got some KASAN report as below:
[ 46.959738] ================================================================== [ 46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188 ... [ 46.960430] Call Trace: [ 46.960430] <TASK> [ 46.960430] dump_stack_lvl+0x41/0x5e [ 46.960430] print_report.cold+0xb2/0x6b7 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_report+0x8a/0x140 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_check_range+0x14d/0x1d0 [ 46.960430] memcpy+0x20/0x60 [ 46.960430] z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] z_erofs_decompress_pcluster+0xaae/0x1080
The root cause is that the tail pcluster won't be a complete filesystem block anymore. So if ztailpacking is used, the second part of an uncompressed tail pcluster may not be ``rq->pageofs_out``.
--- fs/erofs/decompressor.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/erofs/decompressor.c +3 -2
@@ -322,6 +322,7 @@ static int z_erofs_shifted_transform(struct z_erofs_decompress_req *rq,PAGE_ALIGN (rq->pageofs_out + rq->outputsize) >>PAGE_SHIFT ; const unsigned int righthalf = min_t(unsigned int, rq->outputsize,PAGE_SIZE - rq->pageofs_out); +const unsigned int lefthalf = rq->outputsize - righthalf;unsigned char *src, *dst;if (nrpages_out >2 ) {
@@ -344,10 +345,10 @@ static int z_erofs_shifted_transform(struct z_erofs_decompress_req *rq,if (nrpages_out ==2 ) {DBG_BUGON (!rq->out[1 ]);if (rq->out[1 ] == *rq->in) { -memmove (src, src + righthalf, rq->pageofs_out); +memmove (src, src + righthalf, lefthalf); }else { dst =kmap_atomic (rq->out[1 ]); -memcpy (dst, src + righthalf, rq->pageofs_out); +memcpy (dst, src + righthalf, lefthalf);kunmap_atomic (dst); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 481/879 net/mlx5e: Correct the calculation of max channels for rep
In reply to Greg Kroah-HartmanFrom: Moshe Tal <[email protected]>
[ Upstream commit 6d0ba49321a40a8dada22c223bbe91c063b08db4 ]
Correct the calculation of maximum channels of rep to better utilize the hardware resources and allow a larger scale of reps.
This will allow creation of all virtual ports configured.
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 9 +++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 10 ++++++++-- 3 files changed, 18 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +1 -0
@@ -1221,6 +1221,7 @@ mlx5e_tx_mpwqe_supported(struct mlx5_core_dev *mdev)MLX5_CAP_ETH (mdev, enhanced_multi_pkt_send_wqe); } +int mlx5e_get_pf_num_tirs (struct mlx5_core_dev *mdev); int mlx5e_priv_init(struct mlx5e_priv *priv, const struct mlx5e_profile *profile, struct net_device *netdev,
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +9 -0
@@ -5251,6 +5251,15 @@ mlx5e_calc_max_nch(struct mlx5_core_dev *mdev, struct net_device *netdev,return max_nch; } +int mlx5e_get_pf_num_tirs (struct mlx5_core_dev *mdev) +{ +/* Indirect TIRS: 2 sets of TTCs (inner + outer steering) +* and 1 set of direct TIRS +*/ +return 2 *MLX5E_NUM_INDIR_TIRS + +mlx5e_profile_max_num_channels (mdev, &mlx5e_nic_profile); +} +/* mlx5e generic netdev management API (move to en_common.c) */ int mlx5e_priv_init(struct mlx5e_priv *priv, const struct mlx5e_profile *profile,
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +8 -2
@@ -604,10 +604,16 @@ bool mlx5e_eswitch_vf_rep(const struct net_device *netdev)return netdev->netdev_ops == &mlx5e_netdev_ops_rep; } +/* One indirect TIR set for outer. Inner not supported in reps. */ +#define REP_NUM_INDIR_TIRS MLX5E_NUM_INDIR_TIRS +static int mlx5e_rep_max_nch_limit (struct mlx5_core_dev *mdev) { -return (1 <<MLX5_CAP_GEN (mdev, log_max_tir)) / -mlx5_eswitch_get_total_vports (mdev); +int max_tir_num =1 <<MLX5_CAP_GEN (mdev, log_max_tir); +int num_vports =mlx5_eswitch_get_total_vports (mdev); + +return (max_tir_num -mlx5e_get_pf_num_tirs (mdev) + - (num_vports *REP_NUM_INDIR_TIRS )) / num_vports; }static void mlx5e_build_rep_params (struct net_device *netdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 482/879 ext4: reject the commit option on ext2 filesystems
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit cb8435dc8ba33bcafa41cf2aa253794320a3b8df ]
The 'commit' option is only applicable for ext3 and ext4 filesystems, and has never been accepted by the ext2 filesystem driver, so the ext4 driver shouldn't allow it on ext2 filesystems.
This fixes a failure in xfstest ext4/053.
--- fs/ext4/super.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/super.c +1 -0
@@ -1913,6 +1913,7 @@ static const struct mount_opts { MOPT_EXT4_ONLY | MOPT_CLEAR}, {Opt_warn_on_error, EXT4_MOUNT_WARN_ON_ERROR, MOPT_SET}, {Opt_nowarn_on_error, EXT4_MOUNT_WARN_ON_ERROR, MOPT_CLEAR}, + {Opt_commit, 0, MOPT_NO_EXT2}, {Opt_nojournal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM, MOPT_EXT4_ONLY | MOPT_CLEAR}, {Opt_journal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 483/879 drm/msm/dsi: dont powerup at modeset time for parade-ps8640
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit ec7981e6c614254937b37ce0af9eac09901c05c5 ]
Commit 7d8e9a90509f ("drm/msm/dsi: move DSI host powerup to modeset time") caused sc7180 Chromebooks that use the parade-ps8640 bridge chip to fail to turn the display back on after it turns off.
Unfortunately, it doesn't look easy to fix the parade-ps8640 driver to handle the new power sequence. The Linux driver has almost nothing in it and most of the logic for this bridge chip is in black-box firmware that the bridge chip uses.
Also unfortunately, reverting the patch will break "tc358762".
The long term solution here is probably Dave Stevenson's series [1] that would give more flexibility. However, that is likely not a quick fix.
For the short term, we'll look at the compatible of the next bridge in the chain and go back to the old way for the Parade PS8640 bridge chip. If it's found that other bridge chips also need this workaround then we can add them to the list or consider inverting the condition. However, the hope is that the framework will not take too much longer to land and we won't have to add anything other than ps8640 here.
[1] https://lore.kernel.org/r/[email protected]
--- drivers/gpu/drm/msm/dsi/dsi_manager.c | 32 ++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/dsi/dsi_manager.c +31 -1
@@ -34,6 +34,32 @@ static struct msm_dsi_manager msm_dsim_glb;#define IS_SYNC_NEEDED () (msm_dsim_glb.is_sync_needed)#define IS_MASTER_DSI_LINK (id) (msm_dsim_glb.master_dsi_link_id == id) +#ifdef CONFIG_OF +static bool dsi_mgr_power_on_early (struct drm_bridge *bridge) +{ +struct drm_bridge *next_bridge =drm_bridge_get_next_bridge (bridge); + +/* +* If the next bridge in the chain is the Parade ps8640 bridge chip +* then don't power on early since it seems to violate the expectations +* of the firmware that the bridge chip is running. +* +* NOTE: this is expected to be a temporary special case. It's expected +* that we'll eventually have a framework that allows the next level +* bridge to indicate whether it needs us to power on before it or +* after it. When that framework is in place then we'll use it and +* remove this special case. +*/ +return !(next_bridge && next_bridge->of_node && +of_device_is_compatible (next_bridge->of_node,"parade,ps8640" )); +} +#else +static inline bool dsi_mgr_power_on_early (struct drm_bridge *bridge) +{ +return true; +} +#endif +static inline struct msm_dsi *dsi_mgr_get_dsi (int id) {return msm_dsim_glb.dsi[id];
@@ -389,6 +415,9 @@ static void dsi_mgr_bridge_pre_enable(struct drm_bridge *bridge)if (is_bonded_dsi && !IS_MASTER_DSI_LINK (id))return ; +if (!dsi_mgr_power_on_early (bridge)) +dsi_mgr_bridge_power_on (bridge); +/* Always call panel functions once, because even for dual panels, * there is only one drm_panel instance. */
@@ -570,7 +599,8 @@ static void dsi_mgr_bridge_mode_set(struct drm_bridge *bridge,if (is_bonded_dsi && other_dsi)msm_dsi_host_set_display_mode (other_dsi->host, adjusted_mode); -dsi_mgr_bridge_power_on (bridge); +if (dsi_mgr_power_on_early (bridge)) +dsi_mgr_bridge_power_on (bridge); }static const struct drm_connector_funcs dsi_mgr_connector_funcs = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 484/879 drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit c56de483093d7ad0782327f95dda7da97bc4c315 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore.
a6xx_gmu_init() passes the node to of_find_device_by_node() and of_dma_configure(), of_find_device_by_node() will takes its reference, of_dma_configure() doesn't need the node after usage.
Add missing of_node_put() to avoid refcount leak.
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +1 -0
@@ -1919,6 +1919,7 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)BUG_ON (!node); ret =a6xx_gmu_init (a6xx_gpu, node); +of_node_put (node);if (ret) {a6xx_destroy (&(a6xx_gpu->base.base));return ERR_PTR (ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 485/879 drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 947a844bb3ebff0f4736d244d792ce129f6700d7 ]
drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo needs to be put when msm_gem_get_and_pin_iova fails.
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +3 -1
@@ -997,8 +997,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc, ret =msm_gem_get_and_pin_iova (cursor_bo, kms->aspace, &mdp5_crtc->cursor.iova); -if (ret) +if (ret) { +drm_gem_object_put (cursor_bo);return -EINVAL ; + }pm_runtime_get_sync (&pdev->dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 486/879 x86/sev: Annotate stack change in the #VC handler
In reply to Greg Kroah-HartmanFrom: Lai Jiangshan <[email protected]>
[ Upstream commit c42b145181aafd59ed31ccd879493389e3ea5a08 ]
In idtentry_vc(), vc_switch_off_ist() determines a safe stack to switch to, off of the IST stack. Annotate the new stack switch with ENCODE_FRAME_POINTER in case UNWINDER_FRAME_POINTER is used.
A stack walk before looks like this:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc7+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl dump_stack kernel_exc_vmm_communication asm_exc_vmm_communication ? native_read_msr ? __x2apic_disable.part.0 ? x2apic_setup ? cpu_init ? trap_init ? start_kernel ? x86_64_start_reservations ? x86_64_start_kernel ? secondary_startup_64_no_verify </TASK>
and with the fix, the stack dump is exact:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc7+ #3 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl dump_stack kernel_exc_vmm_communication asm_exc_vmm_communication RIP: 0010:native_read_msr Code: ... < snipped regs > ? __x2apic_disable.part.0 x2apic_setup cpu_init trap_init start_kernel x86_64_start_reservations x86_64_start_kernel secondary_startup_64_no_verify </TASK>
[ bp: Test in a SEV-ES guest and rewrite the commit message to
explain what exactly this does. ]
--- arch/x86/entry/entry_64.S | 1 + 1 file changed, 1 insertion(+)
arch/x86/entry/entry_64.S +1 -0
@@ -508,6 +508,7 @@ SYM_CODE_START(\asmsym) call vc_switch_off_ist movq %rax, %rsp /* Switch to new stack */ + ENCODE_FRAME_POINTER UNWIND_HINT_REGS /* Update pt_regs */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 487/879 drm/msm: dont free the IRQ if it was not requested
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 577e2a9dfc8fba7938aaf75db63fae7e328cc3cb ]
As msm_drm_uninit() is called from the msm_drm_init() error path, additional care should be necessary as not to call the free_irq() for the IRQ that was not requested before (because an error occured earlier than the request_irq() call).
This fixed the issue reported with the following backtrace:
[ 8.571329] Trying to free already-free IRQ 187 [ 8.571339] WARNING: CPU: 0 PID: 76 at kernel/irq/manage.c:1895 free_irq+0x1e0/0x35c [ 8.588746] Modules linked in: pmic_glink pdr_interface fastrpc qrtr_smd snd_soc_hdmi_codec msm fsa4480 gpu_sched drm_dp_aux_bus qrtr i2c_qcom_geni crct10dif_ce qcom_stats qcom_q6v5_pas drm_display_helper gpi qcom_pil_info drm_kms_helper qcom_q6v5 qcom_sysmon qcom_common qcom_glink_smem qcom_rng mdt_loader qmi_helpers phy_qcom_qmp ufs_qcom typec qnoc_sm8350 socinfo rmtfs_mem fuse drm ipv6 [ 8.624154] CPU: 0 PID: 76 Comm: kworker/u16:2 Not tainted 5.18.0-rc5-next-20220506-00033-g6cee8cab6089-dirty #419 [ 8.624161] Hardware name: Qualcomm Technologies, Inc. SM8350 HDK (DT) [ 8.641496] Workqueue: events_unbound deferred_probe_work_func [ 8.647510] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 8.654681] pc : free_irq+0x1e0/0x35c [ 8.658454] lr : free_irq+0x1e0/0x35c [ 8.662228] sp : ffff800008ab3950 [ 8.665642] x29: ffff800008ab3950 x28: 0000000000000000 x27: ffff16350f56a700 [ 8.672994] x26: ffff1635025df080 x25: ffff16350251badc x24: ffff16350251bb90 [ 8.680343] x23: 0000000000000000 x22: 00000000000000bb x21: ffff16350e8f9800 [ 8.687690] x20: ffff16350251ba00 x19: ffff16350cbd5880 x18: ffffffffffffffff [ 8.695039] x17: 0000000000000000 x16: ffffa2dd12179434 x15: ffffa2dd1431d02d [ 8.702391] x14: 0000000000000000 x13: ffffa2dd1431d028 x12: 662d79646165726c [ 8.709740] x11: ffffa2dd13fd2438 x10: 000000000000000a x9 : 00000000000000bb [ 8.717111] x8 : ffffa2dd13fd23f0 x7 : ffff800008ab3750 x6 : 00000000fffff202 [ 8.724487] x5 : ffff16377e870a18 x4 : 00000000fffff202 x3 : ffff735a6ae1b000 [ 8.731851] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff1635015f8000 [ 8.739217] Call trace: [ 8.741755] free_irq+0x1e0/0x35c [ 8.745198] msm_drm_uninit.isra.0+0x14c/0x294 [msm] [ 8.750548] msm_drm_bind+0x28c/0x5d0 [msm] [ 8.755081] try_to_bring_up_aggregate_device+0x164/0x1d0 [ 8.760657] __component_add+0xa0/0x170 [ 8.764626] component_add+0x14/0x20 [ 8.768337] dp_display_probe+0x2a4/0x464 [msm] [ 8.773242] platform_probe+0x68/0xe0 [ 8.777043] really_probe.part.0+0x9c/0x28c [ 8.781368] __driver_probe_device+0x98/0x144 [ 8.785871] driver_probe_device+0x40/0x140 [ 8.790191] __device_attach_driver+0xb4/0x120 [ 8.794788] bus_for_each_drv+0x78/0xd0 [ 8.798751] __device_attach+0xdc/0x184 [ 8.802713] device_initial_probe+0x14/0x20 [ 8.807031] bus_probe_device+0x9c/0xa4 [ 8.810991] deferred_probe_work_func+0x88/0xc0 [ 8.815667] process_one_work+0x1d0/0x320 [ 8.819809] worker_thread+0x14c/0x444 [ 8.823688] kthread+0x10c/0x110 [ 8.827036] ret_from_fork+0x10/0x20
Patchwork: https://patchwork.freedesktop.org/patch/485422/
--- drivers/gpu/drm/msm/msm_drv.c | 7 ++++++- drivers/gpu/drm/msm/msm_kms.h | 1 + 2 files changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_drv.c +6 -1
@@ -113,6 +113,8 @@ static int msm_irq_postinstall(struct drm_device *dev)static int msm_irq_install (struct drm_device *dev,unsigned int irq) { +struct msm_drm_private *priv = dev->dev_private; +struct msm_kms *kms = priv->kms;int ret;if (irq ==IRQ_NOTCONNECTED )
@@ -124,6 +126,8 @@ static int msm_irq_install(struct drm_device *dev, unsigned int irq)if (ret)return ret; + kms->irq_requested = true; + ret =msm_irq_postinstall (dev);if (ret) {free_irq (irq, dev);
@@ -139,7 +143,8 @@ static void msm_irq_uninstall(struct drm_device *dev)struct msm_kms *kms = priv->kms; kms->funcs->irq_uninstall (kms); -free_irq (kms->irq, dev); +if (kms->irq_requested) +free_irq (kms->irq, dev); }struct msm_vblank_work {
drivers/gpu/drm/msm/msm_kms.h +1 -0
@@ -148,6 +148,7 @@ struct msm_kms {/* irq number to be passed on to msm_irq_install */ int irq; +bool irq_requested;/* mapper-id used to request GEM buffer mapped for scanout: */ struct msm_gem_address_space *aspace;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 488/879 selftests/bpf: Add missed ima_setup.sh in Makefile
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 70a1b25326dd77e145157ccf1a31c1948032eec4 ]
When build bpf test and install it to another folder, e.g.
make -j10 install -C tools/testing/selftests/ TARGETS="bpf" \
SKIP_TARGETS="" INSTALL_PATH=/tmp/kselftests
The ima_setup.sh is missed in target folder, which makes test_ima failed.
Fix it by adding ima_setup.sh to TEST_PROGS_EXTENDED.
--- tools/testing/selftests/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/Makefile +1 -1
@@ -75,7 +75,7 @@ TEST_PROGS := test_kmod.sh \ test_xsk.sh TEST_PROGS_EXTENDED := with_addr.sh \ - with_tunnels.sh \ + with_tunnels.sh ima_setup.sh \ test_xdp_vlan.sh test_bpftool.py # Compile but not part of 'make run_tests'
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 489/879 drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path
In reply to Greg Kroah-HartmanFrom: Abhinav Kumar <[email protected]>
[ Upstream commit 64b22a0da12adb571c01edd671ee43634ebd7e41 ]
If there are errors while trying to enable the pm in the bind path, it will lead to unclocked access of hw revision register thereby crashing the device.
This will not address why the pm_runtime_get_sync() fails but at the very least we should be able to prevent the crash by handling the error and bailing out earlier.
changes in v2:
- use pm_runtime_resume_and_get() instead of pm_runtime_get_sync()
Patchwork: https://patchwork.freedesktop.org/patch/486721/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +3 -1
@@ -1058,7 +1058,9 @@ static int dpu_kms_hw_init(struct msm_kms *kms)dpu_kms_parse_data_bus_icc_path (dpu_kms); -pm_runtime_get_sync (&dpu_kms->pdev->dev); + rc =pm_runtime_resume_and_get (&dpu_kms->pdev->dev); +if (rc <0 ) + goto error; dpu_kms->core_rev =readl_relaxed (dpu_kms->mmio +0x0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 490/879 drm/i915: Fix CFI violation with show_dynamic_id()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 58606220a2f1407a7516c547f09a1ba7b4350a73 ]
When an attribute group is created with sysfs_create_group(), the ->sysfs_ops() callback is set to kobj_sysfs_ops, which sets the ->show() callback to kobj_attr_show(). kobj_attr_show() uses container_of() to get the ->show() callback from the attribute it was passed, meaning the ->show() callback needs to be the same type as the ->show() callback in 'struct kobj_attribute'.
However, show_dynamic_id() has the type of the ->show() callback in 'struct device_attribute', which causes a CFI violation when opening the 'id' sysfs node under drm/card0/metrics. This happens to work because the layout of 'struct kobj_attribute' and 'struct device_attribute' are the same, so the container_of() cast happens to allow the ->show() callback to still work.
Change the type of show_dynamic_id() to match the ->show() callback in 'struct kobj_attributes' and update the type of sysfs_metric_id to match, which resolves the CFI violation.
--- drivers/gpu/drm/i915/i915_perf.c | 4 ++-- drivers/gpu/drm/i915/i915_perf_types.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/i915_perf.c +2 -2
@@ -4050,8 +4050,8 @@ static struct i915_oa_reg *alloc_oa_regs(struct i915_perf *perf,return ERR_PTR (err); } -static ssize_t show_dynamic_id (struct device *dev, -struct device_attribute *attr, +static ssize_t show_dynamic_id (struct kobject *kobj, +struct kobj_attribute *attr,char *buf) { struct i915_oa_config *oa_config =
drivers/gpu/drm/i915/i915_perf_types.h +1 -1
@@ -55,7 +55,7 @@ struct i915_oa_config {struct attribute_group sysfs_metric;struct attribute *attrs[2 ]; -struct device_attribute sysfs_metric_id; +struct kobj_attribute sysfs_metric_id;struct kref ref;struct rcu_head rcu;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 491/879 thermal/drivers/bcm2711: Dont clamp temperature at zero
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 106e0121e243de4da7d634338089a68a8da2abe9 ]
The thermal sensor on BCM2711 is capable of negative temperatures, so don't clamp the measurements at zero. Since this was the only use for variable t, drop it.
This change based on a patch by Dom Cobley, who also tested the fix.
--- drivers/thermal/broadcom/bcm2711_thermal.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/thermal/broadcom/bcm2711_thermal.c +1 -4
@@ -38,7 +38,6 @@ static int bcm2711_get_temp(void *data, int *temp)int offset =thermal_zone_get_offset (priv->thermal);u32 val;int ret; -long t; ret =regmap_read (priv->regmap,AVS_RO_TEMP_STATUS , &val);if (ret)
@@ -50,9 +49,7 @@ static int bcm2711_get_temp(void *data, int *temp) val &=AVS_RO_TEMP_STATUS_DATA_MSK ;/* Convert a HW code to a temperature reading (millidegree celsius) */ - t = slope * val + offset; - - *temp = t <0 ?0 : t; + *temp = slope * val + offset;return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 492/879 thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe
In reply to Greg Kroah-HartmanFrom: Zheng Yongjun <[email protected]>
[ Upstream commit e20d136ec7d6f309989c447638365840d3424c8e ]
platform_get_resource() may return NULL, add proper check to avoid potential NULL dereferencing.
--- drivers/thermal/broadcom/sr-thermal.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/broadcom/sr-thermal.c +3 -0
@@ -60,6 +60,9 @@ static int sr_thermal_probe(struct platform_device *pdev)return -ENOMEM ; res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); +if (!res) +return -ENOENT ; + sr_thermal->regs = (void __iomem *)devm_memremap (&pdev->dev, res->start,resource_size (res),MEMREMAP_WB );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 493/879 thermal/core: Fix memory leak in __thermal_cooling_device_register()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 98a160e898c0f4a979af9de3ab48b4b1d42d1dbb ]
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff888010080000 (size 264312):
comm "182", pid 102533, jiffies 4296434960 (age 10.100s) hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff 40 7f 1f b9 ff ff ff ff ........@.......
backtrace:
[<0000000038b2f4fc>] kmalloc_order_trace+0x1d/0x110 mm/slab_common.c:969
[<00000000ebcb8da5>] __kmalloc+0x373/0x420 include/linux/slab.h:510
[<0000000084137f13>] thermal_cooling_device_setup_sysfs+0x15d/0x2d0 include/linux/slab.h:586
[<00000000352b8755>] __thermal_cooling_device_register+0x332/0xa60 drivers/thermal/thermal_core.c:927
[<00000000fb9f331b>] devm_thermal_of_cooling_device_register+0x6b/0xf0 drivers/thermal/thermal_core.c:1041
[<000000009b8012d2>] max6650_probe.cold+0x557/0x6aa drivers/hwmon/max6650.c:211
[<00000000da0b7e04>] i2c_device_probe+0x472/0xac0 drivers/i2c/i2c-core-base.c:561If device_register() fails, thermal_cooling_device_destroy_sysfs() need be called to free the memory allocated in thermal_cooling_device_setup_sysfs().
--- drivers/thermal/thermal_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/thermal/thermal_core.c +1 -0
@@ -947,6 +947,7 @@ __thermal_cooling_device_register(struct device_node *np,return cdev; out_kfree_type: +thermal_cooling_device_destroy_sysfs (cdev);kfree (cdev->type);put_device (&cdev->device); cdev =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 494/879 thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 09700c504d8e63faffd2a2235074e8c5d130cb8f ]
of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- drivers/thermal/imx_sc_thermal.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/thermal/imx_sc_thermal.c +4 -2
@@ -94,8 +94,8 @@ static int imx_sc_thermal_probe(struct platform_device *pdev) sensor =devm_kzalloc (&pdev->dev,sizeof (*sensor),GFP_KERNEL );if (!sensor) {of_node_put (child); -of_node_put (sensor_np); -return -ENOMEM ; + ret = -ENOMEM ; + goto put_node; } ret = thermal_zone_of_get_sensor_id(child,
@@ -124,7 +124,9 @@ static int imx_sc_thermal_probe(struct platform_device *pdev)dev_warn (&pdev->dev,"failed to add hwmon sysfs attributes\n" ); } +put_node:of_node_put (sensor_np); +of_node_put (np);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 495/879 bfq: Relax waker detection for shared queues
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit f950667356ce90a41b446b726d4595a10cb65415 ]
Currently we look for waker only if current queue has no requests. This makes sense for bfq queues with a single process however for shared queues when there is a larger number of processes the condition that queue has no requests is difficult to meet because often at least one process has some request in flight although all the others are waiting for the waker to do the work and this harms throughput. Relax the "no queued request for bfq queue" condition to "the current task has no queued requests yet". For this, we also need to start tracking number of requests in flight for each task.
This patch (together with the following one) restores the performance for dbench with 128 clients that regressed with commit c65e6fd460b4 ("bfq: Do not let waker requests skip proper accounting") because this commit makes requests of wakers properly enter BFQ queues and thus these queues become ineligible for the old waker detection logic. Dbench results:
Vanilla 5.18-rc3 5.18-rc3 + revert 5.18-rc3 patched Mean 1237.36 ( 0.00%) 950.16 * 23.21%* 988.35 * 20.12%*
Numbers are time to complete workload so lower is better.
--- block/bfq-iosched.c | 5 +++-- block/bfq-iosched.h | 1 + 2 files changed, 4 insertions(+), 2 deletions(-)
block/bfq-iosched.c +3 -2
@@ -2133,7 +2133,6 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq,if (!bfqd->last_completed_rq_bfqq || bfqd->last_completed_rq_bfqq == bfqq ||bfq_bfqq_has_short_ttime (bfqq) || - bfqq->dispatched >0 || now_ns - bfqd->last_completion >=4 *NSEC_PER_MSEC || bfqd->last_completed_rq_bfqq == bfqq->waker_bfqq)return ;
@@ -2210,7 +2209,7 @@ static void bfq_add_request(struct request *rq) bfqq->queued[rq_is_sync (rq)]++; bfqd->queued++; -if (RB_EMPTY_ROOT (&bfqq->sort_list) &&bfq_bfqq_sync (bfqq)) { +if (bfq_bfqq_sync (bfqq) &&RQ_BIC (rq)->requests <=1 ) {bfq_check_waker (bfqd, bfqq, now_ns);/*
@@ -6563,6 +6562,7 @@ static void bfq_finish_requeue_request(struct request *rq)bfq_completed_request (bfqq, bfqd); }bfq_finish_requeue_request_body (bfqq); +RQ_BIC (rq)->requests--;spin_unlock_irqrestore (&bfqd->lock, flags);/*
@@ -6796,6 +6796,7 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)bfqq_request_allocated (bfqq); bfqq->ref++; + bic->requests++;bfq_log_bfqq (bfqd, bfqq,"get_request %p: bfqq %p, %d" , rq, bfqq, bfqq->ref);
block/bfq-iosched.h +1 -0
@@ -468,6 +468,7 @@ struct bfq_io_cq {struct bfq_queue *stable_merge_bfqq;bool stably_merged;/* non splittable if true */ +unsigned int requests;/* Number of requests this process has in flight */ };/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 496/879 bfq: Allow current waker to defend against a tentative one
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit c5ac56bb6110e42e79d3106866658376b2e48ab9 ]
The code in bfq_check_waker() ignores wake up events from the current waker. This makes it more likely we select a new tentative waker although the current one is generating more wake up events. Treat current waker the same way as any other process and allow it to reset the waker detection logic.
--- block/bfq-iosched.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
block/bfq-iosched.c +1 -2
@@ -2133,8 +2133,7 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq,if (!bfqd->last_completed_rq_bfqq || bfqd->last_completed_rq_bfqq == bfqq ||bfq_bfqq_has_short_ttime (bfqq) || - now_ns - bfqd->last_completion >=4 *NSEC_PER_MSEC || - bfqd->last_completed_rq_bfqq == bfqq->waker_bfqq) + now_ns - bfqd->last_completion >=4 *NSEC_PER_MSEC )return ;/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 497/879 ASoC: codecs: lpass: Fix passing zero to PTR_ERR
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
[ Upstream commit 81e7b165c45e94188ae8f1134b57f27d1f35452f ]
sound/soc/codecs/lpass-macro-common.c:28 lpass_macro_pds_init() warn: passing zero to 'PTR_ERR' sound/soc/codecs/lpass-macro-common.c:38 lpass_macro_pds_init() warn: passing zero to 'PTR_ERR' sound/soc/codecs/lpass-macro-common.c:54 lpass_macro_pds_init() warn: passing zero to 'ERR_PTR'
dev_pm_domain_attach_by_name() may return NULL, set 'ret' as -ENODATA to fix this warning.
--- sound/soc/codecs/lpass-macro-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/lpass-macro-common.c +2 -2
@@ -25,7 +25,7 @@ struct lpass_macro *lpass_macro_pds_init(struct device *dev) l_pds->macro_pd =dev_pm_domain_attach_by_name (dev,"macro" );if (IS_ERR_OR_NULL (l_pds->macro_pd)) { - ret =PTR_ERR (l_pds->macro_pd); + ret = l_pds->macro_pd ?PTR_ERR (l_pds->macro_pd) : -ENODATA ; goto macro_err; }
@@ -35,7 +35,7 @@ struct lpass_macro *lpass_macro_pds_init(struct device *dev) l_pds->dcodec_pd =dev_pm_domain_attach_by_name (dev,"dcodec" );if (IS_ERR_OR_NULL (l_pds->dcodec_pd)) { - ret =PTR_ERR (l_pds->dcodec_pd); + ret = l_pds->dcodec_pd ?PTR_ERR (l_pds->dcodec_pd) : -ENODATA ; goto dcodec_err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 498/879 ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit be2af740e2a9c7134f2d8ab4f104006e110b13de ]
Fix the missing clk_disable_unprepare() before return from wm2000_anc_transition() in the error handling case.
--- sound/soc/codecs/wm2000.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm2000.c +3 -3
@@ -536,7 +536,7 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, {struct i2c_client *i2c = wm2000->i2c;int i, j; -int ret; +int ret =0 ;if (wm2000->anc_mode == mode)return 0 ;
@@ -566,13 +566,13 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, ret = anc_transitions[i].step[j](i2c, anc_transitions[i].analogue);if (ret !=0 ) -return ret; +break ; }if (anc_transitions[i].dest ==ANC_OFF )clk_disable_unprepare (wm2000->mclk); -return 0 ; +return ret; }static int wm2000_anc_set_mode (struct wm2000_priv *wm2000)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 499/879 cpuidle: psci: Fix regression leading to no genpd governor
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
[ Upstream commit 34be27517cb763ea367da21e3cdee5d1bc40f47f ]
While factoring out the PM domain related code from PSCI domain driver into a set of library functions, a regression when initializing the genpds got introduced. More precisely, we fail to assign a genpd governor, so let's fix this.
--- drivers/cpuidle/cpuidle-psci-domain.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpuidle/cpuidle-psci-domain.c +2 -2
@@ -52,7 +52,7 @@ static int psci_pd_init(struct device_node *np, bool use_osi)struct generic_pm_domain *pd;struct psci_pd_provider *pd_provider;struct dev_power_governor *pd_gov; -int ret = -ENOMEM , state_count =0 ; +int ret = -ENOMEM ; pd =dt_idle_pd_alloc (np, psci_dt_parse_state_node);if (!pd)
@@ -71,7 +71,7 @@ static int psci_pd_init(struct device_node *np, bool use_osi) pd->flags |=GENPD_FLAG_ALWAYS_ON ;/* Use governor for CPU PM domains if it has some states to manage. */ - pd_gov = state_count >0 ? &pm_domain_cpu_gov :NULL ; + pd_gov = pd->states ? &pm_domain_cpu_gov :NULL ; ret =pm_genpd_init (pd, pd_gov, false);if (ret)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 500/879 cpuidle: riscv-sbi: Fix code to allow a genpd governor to be used
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
[ Upstream commit a6653fb584b5f6ac60ddd5d86ddd49a1f3945a04 ]
The intent is to use a genpd governor when there are some states that needs to be managed. Although, the current code ends up to never assign a governor, let's fix this.
--- drivers/cpuidle/cpuidle-riscv-sbi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpuidle/cpuidle-riscv-sbi.c +2 -2
@@ -414,7 +414,7 @@ static int sbi_pd_init(struct device_node *np)struct generic_pm_domain *pd;struct sbi_pd_provider *pd_provider;struct dev_power_governor *pd_gov; -int ret = -ENOMEM , state_count =0 ; +int ret = -ENOMEM ; pd =dt_idle_pd_alloc (np, sbi_dt_parse_state_node);if (!pd)
@@ -433,7 +433,7 @@ static int sbi_pd_init(struct device_node *np) pd->flags |=GENPD_FLAG_ALWAYS_ON ;/* Use governor for CPU PM domains if it has some states to manage. */ - pd_gov = state_count >0 ? &pm_domain_cpu_gov :NULL ; + pd_gov = pd->states ? &pm_domain_cpu_gov :NULL ; ret =pm_genpd_init (pd, pd_gov, false);if (ret)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 501/879 platform/x86: intel_cht_int33fe: Set driver data
In reply to Greg Kroah-HartmanFrom: Heikki Krogerus <[email protected]>
[ Upstream commit 3ce827bf9cfecaf2cbfd9a9d44f0db9f40882780 ]
Module removal fails because cht_int33fe_typec_remove() tries to access driver data that does not exist. Fixing by assigning the data at the end of probe.
--- drivers/platform/x86/intel/chtwc_int33fe.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/platform/x86/intel/chtwc_int33fe.c +2 -0
@@ -389,6 +389,8 @@ static int cht_int33fe_typec_probe(struct platform_device *pdev) goto out_unregister_fusb302; } +platform_set_drvdata (pdev, data); +return 0 ; out_unregister_fusb302:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 502/879 PM: domains: Fix initialization of genpds next_wakeup
In reply to Greg Kroah-HartmanFrom: Ulf Hansson <[email protected]>
[ Upstream commit 622d9b5577f19a6472db21df042fea8f5fefe244 ]
In the genpd governor we walk the list of child-domains to take into account their next_wakeup. If the child-domain itself, doesn't have a governor assigned to it, we can end up using the next_wakeup value before it has been properly initialized. To prevent a possible incorrect behaviour in the governor, let's initialize next_wakeup to KTIME_MAX.
--- drivers/base/power/domain.c | 1 + 1 file changed, 1 insertion(+)
drivers/base/power/domain.c +1 -0
@@ -1997,6 +1997,7 @@ int pm_genpd_init(struct generic_pm_domain *genpd, genpd->device_count =0 ; genpd->max_off_time_ns =-1 ; genpd->max_off_time_changed = true; + genpd->next_wakeup =KTIME_MAX ; genpd->provider =NULL ; genpd->has_provider = false; genpd->accounting_time =ktime_get ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 503/879 net: macb: Fix PTP one step sync support
In reply to Greg Kroah-HartmanFrom: Harini Katakam <[email protected]>
[ Upstream commit 5cebb40bc9554aafcc492431181f43c6231b0459 ]
PTP one step sync packets cannot have CSUM padding and insertion in SW since time stamp is inserted on the fly by HW.
In addition, ptp4l version 3.0 and above report an error when skb timestamps are reported for packets that not processed for TX TS after transmission.
Add a helper to identify PTP one step sync and fix the above two errors. Add a common mask for PTP header flag field "twoStepflag". Also reset ptp OSS bit when one step is not selected.
--- drivers/net/ethernet/cadence/macb_main.c | 40 +++++++++++++++++++++--- drivers/net/ethernet/cadence/macb_ptp.c | 4 ++- include/linux/ptp_classify.h | 3 ++ 3 files changed, 42 insertions(+), 5 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +36 -4
@@ -36,6 +36,7 @@#include <linux/iopoll.h> #include <linux/phy/phy.h> #include <linux/pm_runtime.h> +#include <linux/ptp_classify.h> #include <linux/reset.h> #include "macb.h"
@@ -1124,6 +1125,36 @@ static void macb_tx_error_task(struct work_struct *work)spin_unlock_irqrestore (&bp->lock, flags); } +static bool ptp_one_step_sync (struct sk_buff *skb) +{ +struct ptp_header *hdr; +unsigned int ptp_class; +u8 msgtype; + +/* No need to parse packet if PTP TS is not involved */ +if (likely (!(skb_shinfo (skb)->tx_flags &SKBTX_HW_TSTAMP ))) + goto not_oss; + +/* Identify and return whether PTP one step sync is being processed */ + ptp_class =ptp_classify_raw (skb); +if (ptp_class ==PTP_CLASS_NONE ) + goto not_oss; + + hdr =ptp_parse_header (skb, ptp_class); +if (!hdr) + goto not_oss; + +if (hdr->flag_field[0 ] &PTP_FLAG_TWOSTEP ) + goto not_oss; + + msgtype =ptp_get_msgtype (hdr, ptp_class); +if (msgtype ==PTP_MSGTYPE_SYNC ) +return true; + +not_oss: +return false; +} +static void macb_tx_interrupt (struct macb_queue *queue) {unsigned int tail;
@@ -1168,8 +1199,8 @@ static void macb_tx_interrupt(struct macb_queue *queue)/* First, update TX stats if needed */ if (skb) { -if (unlikely (skb_shinfo (skb)->tx_flags & -SKBTX_HW_TSTAMP ) && +if (unlikely (skb_shinfo (skb)->tx_flags &SKBTX_HW_TSTAMP ) && + !ptp_one_step_sync (skb) &&gem_ptp_do_txstamp (queue, skb, desc) ==0 ) {/* skb now belongs to timestamp buffer * and will be removed later
@@ -1999,7 +2030,8 @@ static unsigned int macb_tx_map(struct macb *bp, ctrl |=MACB_BF (TX_LSO , lso_ctrl); ctrl |=MACB_BF (TX_TCP_SEQ_SRC , seq_ctrl);if ((bp->dev->features &NETIF_F_HW_CSUM ) && - skb->ip_summed !=CHECKSUM_PARTIAL && !lso_ctrl) + skb->ip_summed !=CHECKSUM_PARTIAL && !lso_ctrl && + !ptp_one_step_sync (skb)) ctrl |=MACB_BIT (TX_NOCRC ); }else /* Only set MSS/MFS on payload descriptors
@@ -2097,7 +2129,7 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)if (!(ndev->features &NETIF_F_HW_CSUM ) || !((*skb)->ip_summed !=CHECKSUM_PARTIAL ) || -skb_shinfo (*skb)->gso_size)/* Not available for GSO */ +skb_shinfo (*skb)->gso_size ||ptp_one_step_sync (*skb))return 0 ;if (padlen <=0 ) {
drivers/net/ethernet/cadence/macb_ptp.c +3 -1
@@ -470,8 +470,10 @@ int gem_set_hwtst(struct net_device *dev, struct ifreq *ifr, int cmd)case HWTSTAMP_TX_ONESTEP_SYNC :if (gem_ptp_set_one_step_sync (bp,1 ) !=0 )return -ERANGE ; - fallthrough; + tx_bd_control =TSTAMP_ALL_FRAMES ; +break ;case HWTSTAMP_TX_ON : +gem_ptp_set_one_step_sync (bp,0 ); tx_bd_control =TSTAMP_ALL_FRAMES ;break ;default :
include/linux/ptp_classify.h +3 -0
@@ -43,6 +43,9 @@#define OFF_PTP_SOURCE_UUID 22/* PTPv1 only */ #define OFF_PTP_SEQUENCE_ID 30 +/* PTP header flag fields */ +#define PTP_FLAG_TWOSTEP BIT(1) +/* Below defines should actually be removed at some point in time. */ #define IP6_HLEN 40#define UDP_HLEN 8
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 504/879 scsi: hisi_sas: Fix rescan after deleting a disk
In reply to Greg Kroah-HartmanFrom: John Garry <[email protected]>
[ Upstream commit e9dedc13bb11bc553754abecb322e5e41d1b4fef ]
Removing an ATA device via sysfs means that the device may not be found through re-scanning:
root@ubuntu:/home/john# lsscsi [0:0:0:0] disk SanDisk LT0200MO P404 /dev/sda [0:0:1:0] disk ATA HGST HUS724040AL A8B0 /dev/sdb [0:0:8:0] enclosu 12G SAS Expander RevB - root@ubuntu:/home/john# echo 1 > /sys/block/sdb/device/delete root@ubuntu:/home/john# echo "- - -" > /sys/class/scsi_host/host0/scan root@ubuntu:/home/john# lsscsi [0:0:0:0] disk SanDisk LT0200MO P404 /dev/sda [0:0:8:0] enclosu 12G SAS Expander RevB - root@ubuntu:/home/john#
The problem is that the rescan of the device may conflict with the device in being re-initialized, as follows:
- In the rescan we call hisi_sas_slave_alloc() in store_scan() -> sas_user_scan() -> [__]scsi_scan_target() -> scsi_probe_and_add_lunc() -> scsi_alloc_sdev() -> hisi_sas_slave_alloc() -> hisi_sas_init_device() In hisi_sas_init_device() we issue an IT nexus reset for ATA devices
- That IT nexus causes the remote PHY to go down and this triggers a bcast event
- In parallel libsas processes the bcast event, finds that the phy is down and marks the device as gone
The hard reset issued in hisi_sas_init_device() is unncessary - as described in the code comment - so remove it. Also set dev status as HISI_SAS_DEV_NORMAL as the hisi_sas_init_device() call.
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 47 ++++++++++----------------- 1 file changed, 18 insertions(+), 29 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_main.c +18 -29
@@ -709,8 +709,6 @@ static int hisi_sas_init_device(struct domain_device *device)struct scsi_lun lun;int retry =HISI_SAS_DISK_RECOVER_CNT ;struct hisi_hba *hisi_hba =dev_to_hisi_hba (device); -struct device *dev = hisi_hba->dev; -struct sas_phy *local_phy;switch (device->dev_type) {case SAS_END_DEVICE :
@@ -729,30 +727,18 @@ static int hisi_sas_init_device(struct domain_device *device)case SAS_SATA_PM_PORT :case SAS_SATA_PENDING :/* -* send HARD RESET to clear previous affiliation of -* STP target port +* If an expander is swapped when a SATA disk is attached then +* we should issue a hard reset to clear previous affiliation +* of STP target port, see SPL (chapter 6.19.4). +* +* However we don't need to issue a hard reset here for these +* reasons: +* a. When probing the device, libsas/libata already issues a +* hard reset in sas_probe_sata() -> ata_sas_async_probe(). +* Note that in hisi_sas_debug_I_T_nexus_reset() we take care +* to issue a hard reset by checking the dev status (== INIT). +* b. When resetting the controller, this is simply unnecessary. */ - local_phy =sas_get_local_phy (device); -if (!scsi_is_sas_phy_local (local_phy) && - !test_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags)) { -unsigned long deadline =ata_deadline (jiffies,20000 ); -struct sata_device *sata_dev = &device->sata_dev; -struct ata_host *ata_host = sata_dev->ata_host; -struct ata_port_operations *ops = ata_host->ops; -struct ata_port *ap = sata_dev->ap; -struct ata_link *link; -unsigned int classes; - -ata_for_each_link (link, ap,EDGE ) - rc = ops->hardreset (link, &classes, - deadline); - } -sas_put_local_phy (local_phy); -if (rc) { -dev_warn (dev,"SATA disk hardreset fail: %d\n" , rc); -return rc; - } -while (retry-- >0 ) { rc =hisi_sas_softreset_ata_disk (device);if (!rc)
@@ -768,15 +754,19 @@ static int hisi_sas_init_device(struct domain_device *device)int hisi_sas_slave_alloc (struct scsi_device *sdev) { -struct domain_device *ddev; +struct domain_device *ddev =sdev_to_domain_dev (sdev); +struct hisi_sas_device *sas_dev = ddev->lldd_dev;int rc; rc =sas_slave_alloc (sdev);if (rc)return rc; - ddev =sdev_to_domain_dev (sdev); -return hisi_sas_init_device (ddev); + rc =hisi_sas_init_device (ddev); +if (rc) +return rc; + sas_dev->dev_status =HISI_SAS_DEV_NORMAL ; +return 0 ; }EXPORT_SYMBOL_GPL (hisi_sas_slave_alloc);
@@ -826,7 +816,6 @@ static int hisi_sas_dev_found(struct domain_device *device)dev_info (dev,"dev[%d:%x] found\n" , sas_dev->device_id, sas_dev->dev_type); - sas_dev->dev_status =HISI_SAS_DEV_NORMAL ;return 0 ; err_out:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 505/879 scsi: hisi_sas: Fix memory ordering in hisi_sas_task_deliver()
In reply to Greg Kroah-HartmanFrom: John Garry <[email protected]>
[ Upstream commit 6c6ac8b7773f05f93dc4e4044686e059d1f78dea ]
The memories for the slot should be observed to be written prior to observing the slot as ready.
Prior to commit 26fc0ea74fcb ("scsi: libsas: Drop SAS_TASK_AT_INITIATOR"), we had a spin_lock() + spin_unlock() immediately before marking the slot as ready. The spin_unlock() - with release semantics - caused the slot memory to be observed to be written.
Now that the spin_lock() + spin_unlock() is gone, use a smp_wmb().
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/hisi_sas/hisi_sas_main.c +2 -0
@@ -446,6 +446,8 @@ void hisi_sas_task_deliver(struct hisi_hba *hisi_hba,return ; } +/* Make slot memories observable before marking as ready */ +smp_wmb ();WRITE_ONCE (slot->ready,1 );spin_lock (&dq->lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 506/879 NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit b413b0cb008646e9f24ce5253cb3cf7ee217aff6 ]
There are sleep in atomic context bugs when the request to secure element of st21nfca is timeout. The root cause is that kzalloc and alloc_skb with GFP_KERNEL parameter and mutex_lock are called in st21nfca_se_wt_timeout which is a timer handler. The call tree shows the execution paths that could lead to bugs:
(Interrupt context)st21nfca_se_wt_timeout
nfc_hci_send_event
nfc_hci_hcp_message_tx
kzalloc(..., GFP_KERNEL) //may sleep
alloc_skb(..., GFP_KERNEL) //may sleep
mutex_lock() //may sleep
This patch moves the operations that may sleep into a work item. The work item will run in another kernel thread which is in process context to execute the bottom half of the interrupt. So it could prevent atomic context from sleeping.
--- drivers/nfc/st21nfca/se.c | 17 ++++++++++++++--- drivers/nfc/st21nfca/st21nfca.h | 1 + 2 files changed, 15 insertions(+), 3 deletions(-)
drivers/nfc/st21nfca/se.c +14 -3
@@ -241,7 +241,7 @@ int st21nfca_hci_se_io(struct nfc_hci_dev *hdev, u32 se_idx, }EXPORT_SYMBOL (st21nfca_hci_se_io); -static void st21nfca_se_wt_timeout (struct timer_list *t) +static void st21nfca_se_wt_work (struct work_struct *work) {/* * No answer from the secure element
@@ -254,8 +254,9 @@ static void st21nfca_se_wt_timeout(struct timer_list *t)*/ /* hardware reset managed through VCC_UICC_OUT power supply */ u8 param =0x01 ; -struct st21nfca_hci_info *info =from_timer (info, t, - se_info.bwi_timer); +struct st21nfca_hci_info *info =container_of (work, + struct st21nfca_hci_info, + se_info.timeout_work); info->se_info.bwi_active = false;
@@ -271,6 +272,13 @@ static void st21nfca_se_wt_timeout(struct timer_list *t) info->se_info.cb (info->se_info.cb_context,NULL ,0 , -ETIME ); } +static void st21nfca_se_wt_timeout (struct timer_list *t) +{ +struct st21nfca_hci_info *info =from_timer (info, t, se_info.bwi_timer); + +schedule_work (&info->se_info.timeout_work); +} +static void st21nfca_se_activation_timeout (struct timer_list *t) { struct st21nfca_hci_info *info = from_timer(info, t,
@@ -360,6 +368,7 @@ int st21nfca_apdu_reader_event_received(struct nfc_hci_dev *hdev,switch (event) {case ST21NFCA_EVT_TRANSMIT_DATA :del_timer_sync (&info->se_info.bwi_timer); +cancel_work_sync (&info->se_info.timeout_work); info->se_info.bwi_active = false; r =nfc_hci_send_event (hdev,ST21NFCA_DEVICE_MGNT_GATE ,ST21NFCA_EVT_SE_END_OF_APDU_TRANSFER ,NULL ,0 );
@@ -389,6 +398,7 @@ void st21nfca_se_init(struct nfc_hci_dev *hdev)struct st21nfca_hci_info *info =nfc_hci_get_clientdata (hdev);init_completion (&info->se_info.req_completion); +INIT_WORK (&info->se_info.timeout_work, st21nfca_se_wt_work);/* initialize timers */ timer_setup (&info->se_info.bwi_timer, st21nfca_se_wt_timeout,0 ); info->se_info.bwi_active = false;
@@ -416,6 +426,7 @@ void st21nfca_se_deinit(struct nfc_hci_dev *hdev)if (info->se_info.se_active)del_timer_sync (&info->se_info.se_active_timer); +cancel_work_sync (&info->se_info.timeout_work); info->se_info.bwi_active = false; info->se_info.se_active = false; }
drivers/nfc/st21nfca/st21nfca.h +1 -0
@@ -141,6 +141,7 @@ struct st21nfca_se_info {se_io_cb_t cb;void *cb_context; +struct work_struct timeout_work; };struct st21nfca_hci_info {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 507/879 bonding: fix missed rcu protection
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 9b80ccda233fa6c59de411bf889cc4d0e028f2c7 ]
When removing the rcu_read_lock in bond_ethtool_get_ts_info() as discussed [1], I didn't notice it could be called via setsockopt, which doesn't hold rcu lock, as syzbot pointed:
stack backtrace: CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline] bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595 __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554 ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568 sock_timestamping_bind_phc net/core/sock.c:869 [inline] sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916 sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221 __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223 __do_sys_setsockopt net/socket.c:2238 [inline] __se_sys_setsockopt net/socket.c:2235 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f8902c8eb39
Fix it by adding rcu_read_lock and take a ref on the real_dev. Since dev_hold() and dev_put() can take NULL these days, we can skip checking if real_dev exist.
[1] https://lore.kernel.org/netdev/27565.1642742439@famine/
--- drivers/net/bonding/bond_main.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/net/bonding/bond_main.c +12 -3
@@ -5591,16 +5591,23 @@ static int bond_ethtool_get_ts_info(struct net_device *bond_dev,const struct ethtool_ops *ops;struct net_device *real_dev;struct phy_device *phydev; +int ret =0 ; +rcu_read_lock (); real_dev =bond_option_active_slave_get_rcu (bond); +dev_hold (real_dev); +rcu_read_unlock (); +if (real_dev) { ops = real_dev->ethtool_ops; phydev = real_dev->phydev;if (phy_has_tsinfo (phydev)) { -return phy_ts_info (phydev, info); + ret =phy_ts_info (phydev, info); + goto out; }else if (ops->get_ts_info) { -return ops->get_ts_info (real_dev, info); + ret = ops->get_ts_info (real_dev, info); + goto out; } }
@@ -5608,7 +5615,9 @@ static int bond_ethtool_get_ts_info(struct net_device *bond_dev,SOF_TIMESTAMPING_SOFTWARE ; info->phc_index =-1 ; -return 0 ; +out: +dev_put (real_dev); +return ret; }static const struct ethtool_ops bond_ethtool_ops = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 508/879 ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv()
In reply to Greg Kroah-HartmanFrom: Alexey Khoroshilov <[email protected]>
[ Upstream commit f7a344468105ef8c54086dfdc800e6f5a8417d3e ]
Validation of signed input should be done before casting to unsigned int.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/soc/codecs/max98090.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/codecs/max98090.c +4 -2
@@ -393,7 +393,8 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol,struct soc_mixer_control *mc = (struct soc_mixer_control *)kcontrol->private_value;unsigned int mask = (1 <<fls (mc->max)) -1 ; -unsigned int sel = ucontrol->value.integer.value[0 ]; +int sel_unchecked = ucontrol->value.integer.value[0 ]; +unsigned int sel;unsigned int val =snd_soc_component_read (component, mc->reg);unsigned int *select;
@@ -413,8 +414,9 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, val = (val >> mc->shift) & mask; -if (sel <0 || sel > mc->max) +if (sel_unchecked <0 || sel_unchecked > mc->max)return -EINVAL ; + sel = sel_unchecked; *select = sel;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 509/879 perf parse-events: Support different format of the topdown event name
In reply to Greg Kroah-HartmanFrom: Kan Liang <[email protected]>
[ Upstream commit e7d1374ed5cb346efd9b3df03814dbc0767adb4e ]
The evsel->name may have a different format for a topdown event, a pure topdown name (e.g., topdown-fe-bound), or a PMU name + a topdown name (e.g., cpu/topdown-fe-bound/). The cpu/topdown-fe-bound/ kind format isn't supported by the arch_evlist__leader(). This format is a very common format for a hybrid platform, which requires specifying the PMU name for each event.
Without the patch,
$ perf stat -e '{instructions,slots,cpu/topdown-fe-bound/}' -a sleep 1Performance counter stats for 'system wide':
<not counted> instructions
<not counted> slots
<not supported> cpu/topdown-fe-bound/1.003482041 seconds time elapsed
Some events weren't counted. Try disabling the NMI watchdog:
echo 0 > /proc/sys/kernel/nmi_watchdog
perf stat ...
echo 1 > /proc/sys/kernel/nmi_watchdog
The events in group usually have to be from the same PMU. Try reorganizing the group.
With the patch,
$ perf stat -e '{instructions,slots,cpu/topdown-fe-bound/}' -a sleep 1Performance counter stats for 'system wide':
157,383,996 slots
25,011,711 instructions
27,441,686 cpu/topdown-fe-bound/1.003530890 seconds time elapsed
--- tools/perf/arch/x86/util/evlist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/arch/x86/util/evlist.c +1 -1
@@ -36,7 +36,7 @@ struct evsel *arch_evlist__leader(struct list_head *list)if (slots == first)return first; } -if (!strncasecmp (evsel->name,"topdown" ,7 )) +if (strcasestr (evsel->name,"topdown" )) has_topdown = true;if (slots && has_topdown)return slots;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 510/879 net: stmmac: fix out-of-bounds access in a selftest
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit fe5c5fc145edcf98a759b895f52b646730eeb7be ]
GCC 12 points out that struct tc_action is smaller than struct tcf_action:
drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c: In function ‘stmmac_test_rxp’:drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c:1132:21: warning: array subscript ‘struct tcf_gact[0]’ is partly outside array bounds of ‘unsigned char[272]’ [-Warray-bounds]
1132 | gact->tcf_action = TC_ACT_SHOT;
| ^~
--- .../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c +6 -7
@@ -1084,8 +1084,9 @@ static int stmmac_test_rxp(struct stmmac_priv *priv)unsigned char addr[ETH_ALEN ] = {0xde ,0xad ,0xbe ,0xef ,0x00 ,0x00 };struct tc_cls_u32_offload cls_u32 = { };struct stmmac_packet_attrs attr = { }; -struct tc_action **actions, *act; +struct tc_action **actions;struct tc_u32_sel *sel; +struct tcf_gact *gact;struct tcf_exts *exts;int ret, i, nk =1 ;
@@ -1110,8 +1111,8 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) goto cleanup_exts; } - act =kcalloc (nk,sizeof (*act),GFP_KERNEL ); -if (!act) { + gact =kcalloc (nk,sizeof (*gact),GFP_KERNEL ); +if (!gact) { ret = -ENOMEM ; goto cleanup_actions; }
@@ -1126,9 +1127,7 @@ static int stmmac_test_rxp(struct stmmac_priv *priv) exts->nr_actions = nk; exts->actions = actions;for (i =0 ; i < nk; i++) { -struct tcf_gact *gact =to_gact (&act[i]); - - actions[i] = &act[i]; + actions[i] = (struct tc_action *)&gact[i]; gact->tcf_action =TC_ACT_SHOT ; }
@@ -1152,7 +1151,7 @@ static int stmmac_test_rxp(struct stmmac_priv *priv)stmmac_tc_setup_cls_u32 (priv, priv, &cls_u32); cleanup_act: -kfree (act); +kfree (gact); cleanup_actions:kfree (actions); cleanup_exts:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 511/879 amt: fix gateway mode stuck
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 937956ba404e70a765ca5aa39d3d7564d86a8872 ]
If a gateway can not receive any response to requests from a relay, gateway resets status from SENT_REQUEST to INIT and variable about a relay as well. And then it should start the full establish step from sending a discovery message and receiving advertisement message. But, after failure in amt_req_work() it continues sending a request message step with flushed(invalid) relay information and sets SENT_REQUEST. So, a gateway can't be established with a relay.
In order to avoid this situation, it stops sending the request message step if it fails.
--- drivers/net/amt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/amt.c +4 -2
@@ -943,7 +943,7 @@ static void amt_req_work(struct work_struct *work)if (amt->status <AMT_STATUS_RECEIVED_ADVERTISEMENT ) goto out; -if (amt->req_cnt++ >AMT_MAX_REQ_COUNT ) { +if (amt->req_cnt >AMT_MAX_REQ_COUNT ) {netdev_dbg (amt->dev,"Gateway is not ready" ); amt->qi =AMT_INIT_REQ_TIMEOUT ; amt->ready4 = false;
@@ -951,13 +951,15 @@ static void amt_req_work(struct work_struct *work) amt->remote_ip =0 ;__amt_update_gw_status (amt,AMT_STATUS_INIT , false); amt->req_cnt =0 ; + goto out; }spin_unlock_bh (&amt->lock);amt_send_request (amt, false);amt_send_request (amt, true); -amt_update_gw_status (amt,AMT_STATUS_SENT_REQUEST , true);spin_lock_bh (&amt->lock); +__amt_update_gw_status (amt,AMT_STATUS_SENT_REQUEST , true); + amt->req_cnt++; out: exp =min_t (u32, (1 * (1 << amt->req_cnt)),AMT_MAX_REQ_TIMEOUT );mod_delayed_work (amt_wq, &amt->req_wq,msecs_to_jiffies (exp *1000 ));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 512/879 amt: fix memory leak for advertisement message
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit fe29794c3585d039fefebaa2b5a4932a627ad4fd ]
When a gateway receives an advertisement message, it extracts relay information and then it should be freed.
But the advertisement handler doesn't free it.
So, memory leak would occur.
--- drivers/net/amt.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/amt.c +2 -3
@@ -2698,9 +2698,8 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb) err = true; goto drop; } -if (amt_advertisement_handler (amt, skb)) - amt->dev->stats.rx_dropped++; - goto out; + err =amt_advertisement_handler (amt, skb); +break ;case AMT_MSG_MULTICAST_DATA :if (iph->saddr != amt->remote_ip) {netdev_dbg (amt->dev,"Invalid Relay IP\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 513/879 hv_netvsc: Fix potential dereference of NULL pointer
In reply to Greg Kroah-HartmanFrom: Yongzhi Liu <[email protected]>
[ Upstream commit eb4c0788964730d12e8dd520bd8f5217ca48321c ]
The return value of netvsc_devinfo_get()
needs to be checked to avoid use of NULL
pointer in case of an allocation failure.
--- drivers/net/hyperv/netvsc_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/hyperv/netvsc_drv.c +4 -1
@@ -2671,7 +2671,10 @@ static int netvsc_suspend(struct hv_device *dev)/* Save the current config info */ ndev_ctx->saved_netvsc_dev_info =netvsc_devinfo_get (nvdev); - +if (!ndev_ctx->saved_netvsc_dev_info) { + ret = -ENOMEM ; + goto out; + } ret =netvsc_detach (net, nvdev); out:rtnl_unlock ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 514/879 hwmon: (dimmtemp) Fix bitmap handling
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 9baabde04de64137e86b39112c6259f3da512bd6 ]
Building arm:allmodconfig may fail with the following error.
In function 'fortify_memcpy_chk',
inlined from 'bitmap_copy' at include/linux/bitmap.h:261:2, inlined from 'bitmap_copy_clear_tail' at include/linux/bitmap.h:270:2, inlined from 'bitmap_from_u64' at include/linux/bitmap.h:622:2, inlined from 'check_populated_dimms' at
drivers/hwmon/peci/dimmtemp.c:284:2:include/linux/fortify-string.h:344:25: error:
call to '__write_overflow_field' declared with attribute warning:
detected write beyond size of field (1st parameter)
The problematic code is
bitmap_from_u64(priv->dimm_mask, dimm_mask);
dimm_mask is declared as u64, but the bitmap in priv->dimm_mask is only 24 bit wide. On 32-bit systems, this results in writes over the end of the bitmap.
Fix the problem by using u32 instead of u64 for dimm_mask. This is currently sufficient, and a compile time check to ensure that the number of dimms does not exceed the bit map size is already in place.
--- drivers/hwmon/peci/dimmtemp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hwmon/peci/dimmtemp.c +3 -3
@@ -219,7 +219,7 @@ static int check_populated_dimms(struct peci_dimmtemp *priv)int chan_rank_max = priv->gen_info->chan_rank_max;int dimm_idx_max = priv->gen_info->dimm_idx_max;u32 chan_rank_empty =0 ; -u64 dimm_mask =0 ; +u32 dimm_mask =0 ;int chan_rank, dimm_idx, ret;u32 pcs;
@@ -278,9 +278,9 @@ static int check_populated_dimms(struct peci_dimmtemp *priv)return -EAGAIN ; } -dev_dbg (priv->dev,"Scanned populated DIMMs: %#llx\n" , dimm_mask); +dev_dbg (priv->dev,"Scanned populated DIMMs: %#x\n" , dimm_mask); -bitmap_from_u64 (priv->dimm_mask, dimm_mask); +bitmap_from_arr32 (priv->dimm_mask, &dimm_mask,DIMM_NUMS_MAX );return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 515/879 hwmon: (pmbus) Check PEC support before reading other registers
In reply to Greg Kroah-HartmanFrom: Adam Wujek <[email protected]>
[ Upstream commit d1baf7a3a3177d46a7149858beddb88a9eca7a54 ]
Make sure that the support of PEC is determined before the read of other registers. Otherwise the validation of PEC can trigger an error on the read of STATUS_BYTE or STATUS_WORD registers.
The problematic scenario is the following. A device with enabled PEC support is up and running and a kernel driver is loaded. Then the driver is unloaded (or device unbound), the HW device is reconfigured externally (e.g. by i2cset) to advertise itself as not supporting PEC. Without the move of the code, at the second load of the driver (or bind) the STATUS_BYTE or STATUS_WORD register is always read with PEC enabled, which is likely to cause a read error resulting with fail of a driver load (or bind).
--- drivers/hwmon/pmbus/pmbus_core.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-)
drivers/hwmon/pmbus/pmbus_core.c +15 -13
@@ -2308,6 +2308,21 @@ static int pmbus_init_common(struct i2c_client *client, struct pmbus_data *data,struct device *dev = &client->dev;int page, ret; +/* +* Figure out if PEC is enabled before accessing any other register. +* Make sure PEC is disabled, will be enabled later if needed. +*/ + client->flags &= ~I2C_CLIENT_PEC ; + +/* Enable PEC if the controller and bus supports it */ +if (!(data->flags &PMBUS_NO_CAPABILITY )) { + ret =i2c_smbus_read_byte_data (client,PMBUS_CAPABILITY ); +if (ret >=0 && (ret &PB_CAPABILITY_ERROR_CHECK )) { +if (i2c_check_functionality (client->adapter,I2C_FUNC_SMBUS_PEC )) + client->flags |=I2C_CLIENT_PEC ; + } + } +/* * Some PMBus chips don't support PMBUS_STATUS_WORD, so try * to use PMBUS_STATUS_BYTE instead if that is the case.
@@ -2326,19 +2341,6 @@ static int pmbus_init_common(struct i2c_client *client, struct pmbus_data *data, data->has_status_word = true; } -/* Make sure PEC is disabled, will be enabled later if needed */ - client->flags &= ~I2C_CLIENT_PEC ; - -/* Enable PEC if the controller and bus supports it */ -if (!(data->flags &PMBUS_NO_CAPABILITY )) { - ret =i2c_smbus_read_byte_data (client,PMBUS_CAPABILITY ); -if (ret >=0 && (ret &PB_CAPABILITY_ERROR_CHECK )) { -if (i2c_check_functionality (client->adapter,I2C_FUNC_SMBUS_PEC )) { - client->flags |=I2C_CLIENT_PEC ; - } - } - } -/* * Check if the chip is write protected. If it is, we can not clear * faults, and we should not try it. Also, in that case, writes into
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 516/879 rxrpc: Fix locking issue
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit ad25f5cb39872ca14bcbe00816ae65c22fe04b89 ]
There's a locking issue with the per-netns list of calls in rxrpc. The pieces of code that add and remove a call from the list use write_lock() and the calls procfile uses read_lock() to access it. However, the timer callback function may trigger a removal by trying to queue a call for processing and finding that it's already queued - at which point it has a spare refcount that it has to do something with. Unfortunately, if it puts the call and this reduces the refcount to 0, the call will be removed from the list. Unfortunately, since the _bh variants of the locking functions aren't used, this can deadlock.
================================
WARNING: inconsistent lock state
5.18.0-rc3-build4+ #10 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/2/25 [HC0[0]:SC1[1]:HE1:SE0] takes:ffff888107ac4038 (&rxnet->call_lock){+.?.}-{2:2}, at: rxrpc_put_call+0x103/0x14b {SOFTIRQ-ON-W} state was registered at:
...
Possible unsafe locking scenario:
CPU0
----
lock(&rxnet->call_lock);
<Interrupt>
lock(&rxnet->call_lock);*** DEADLOCK ***
1 lock held by ksoftirqd/2/25:
#0: ffff8881008ffdb0 ((&call->timer)){+.-.}-{0:0}, at: call_timer_fn+0x5/0x23d
Changes
=======
ver #2)
- Changed to using list_next_rcu() rather than rcu_dereference() directly.
--- fs/seq_file.c | 32 ++++++++++++++++++++++++++++++++ include/linux/list.h | 10 ++++++++++ include/linux/seq_file.h | 4 ++++ net/rxrpc/ar-internal.h | 2 +- net/rxrpc/call_accept.c | 6 +++--- net/rxrpc/call_object.c | 18 +++++++++--------- net/rxrpc/net_ns.c | 2 +- net/rxrpc/proc.c | 10 ++-------- 8 files changed, 62 insertions(+), 22 deletions(-)
fs/seq_file.c +32 -0
@@ -931,6 +931,38 @@ struct list_head *seq_list_next(void *v, struct list_head *head, loff_t *ppos) }EXPORT_SYMBOL (seq_list_next); +struct list_head *seq_list_start_rcu (struct list_head *head,loff_t pos) +{ +struct list_head *lh; + +list_for_each_rcu (lh, head) +if (pos-- ==0 ) +return lh; + +return NULL ; +} +EXPORT_SYMBOL (seq_list_start_rcu); + +struct list_head *seq_list_start_head_rcu (struct list_head *head,loff_t pos) +{ +if (!pos) +return head; + +return seq_list_start_rcu (head, pos -1 ); +} +EXPORT_SYMBOL (seq_list_start_head_rcu); + +struct list_head *seq_list_next_rcu (void *v,struct list_head *head, +loff_t *ppos) +{ +struct list_head *lh; + + lh =list_next_rcu ((struct list_head *)v); + ++*ppos; +return lh == head ?NULL : lh; +} +EXPORT_SYMBOL (seq_list_next_rcu); +/** * seq_hlist_start - start an iteration of a hlist * @head: the head of the hlist
include/linux/list.h +10 -0
@@ -579,6 +579,16 @@ static inline void list_splice_tail_init(struct list_head *list,#define list_for_each (pos, head) \ for (pos = (head)->next; !list_is_head(pos, (head)); pos = pos->next) +/** +* list_for_each_rcu - Iterate over a list in an RCU-safe fashion +* @pos: the &struct list_head to use as a loop cursor. +* @head: the head for your list. +*/ +#define list_for_each_rcu (pos, head) \ + for (pos = rcu_dereference((head)->next); \ + !list_is_head(pos, (head)); \ + pos = rcu_dereference(pos->next)) +/** * list_for_each_continue - continue iteration over a list * @pos: the &struct list_head to use as a loop cursor.
include/linux/seq_file.h +4 -0
@@ -277,6 +277,10 @@ extern struct list_head *seq_list_start_head(struct list_head *head,extern struct list_head *seq_list_next (void *v,struct list_head *head,loff_t *ppos); +extern struct list_head *seq_list_start_rcu (struct list_head *head,loff_t pos); +extern struct list_head *seq_list_start_head_rcu (struct list_head *head,loff_t pos); +extern struct list_head *seq_list_next_rcu (void *v,struct list_head *head,loff_t *ppos); +/* * Helpers for iteration over hlist_head-s in seq_files */
net/rxrpc/ar-internal.h +1 -1
@@ -68,7 +68,7 @@ struct rxrpc_net {struct proc_dir_entry *proc_net;/* Subdir in /proc/net */ u32 epoch;/* Local epoch for detecting local-end reset */ struct list_head calls;/* List of calls active in this namespace */ -rwlock_t call_lock;/* Lock for ->calls */ +spinlock_t call_lock;/* Lock for ->calls */ atomic_t nr_calls;/* Count of allocated calls */ atomic_t nr_conns;
net/rxrpc/call_accept.c +3 -3
@@ -140,9 +140,9 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx,write_unlock (&rx->call_lock); rxnet = call->rxnet; -write_lock (&rxnet->call_lock); -list_add_tail (&call->link, &rxnet->calls); -write_unlock (&rxnet->call_lock); +spin_lock_bh (&rxnet->call_lock); +list_add_tail_rcu (&call->link, &rxnet->calls); +spin_unlock_bh (&rxnet->call_lock); b->call_backlog[call_head] = call;smp_store_release (&b->call_backlog_head, (call_head +1 ) & (size -1 ));
net/rxrpc/call_object.c +9 -9
@@ -337,9 +337,9 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,write_unlock (&rx->call_lock); rxnet = call->rxnet; -write_lock (&rxnet->call_lock); -list_add_tail (&call->link, &rxnet->calls); -write_unlock (&rxnet->call_lock); +spin_lock_bh (&rxnet->call_lock); +list_add_tail_rcu (&call->link, &rxnet->calls); +spin_unlock_bh (&rxnet->call_lock);/* From this point on, the call is protected by its own lock. */ release_sock (&rx->sk);
@@ -631,9 +631,9 @@ void rxrpc_put_call(struct rxrpc_call *call, enum rxrpc_call_trace op) ASSERTCMP(call->state, ==, RXRPC_CALL_COMPLETE);if (!list_empty (&call->link)) { -write_lock (&rxnet->call_lock); +spin_lock_bh (&rxnet->call_lock);list_del_init (&call->link); -write_unlock (&rxnet->call_lock); +spin_unlock_bh (&rxnet->call_lock); }rxrpc_cleanup_call (call);
@@ -705,7 +705,7 @@ void rxrpc_destroy_all_calls(struct rxrpc_net *rxnet)_enter ("" );if (!list_empty (&rxnet->calls)) { -write_lock (&rxnet->call_lock); +spin_lock_bh (&rxnet->call_lock);while (!list_empty (&rxnet->calls)) { call = list_entry(rxnet->calls.next,
@@ -720,12 +720,12 @@ void rxrpc_destroy_all_calls(struct rxrpc_net *rxnet) rxrpc_call_states[call->state], call->flags, call->events); -write_unlock (&rxnet->call_lock); +spin_unlock_bh (&rxnet->call_lock);cond_resched (); -write_lock (&rxnet->call_lock); +spin_lock_bh (&rxnet->call_lock); } -write_unlock (&rxnet->call_lock); +spin_unlock_bh (&rxnet->call_lock); }atomic_dec (&rxnet->nr_calls);
net/rxrpc/net_ns.c +1 -1
@@ -50,7 +50,7 @@ static __net_init int rxrpc_init_net(struct net *net) rxnet->epoch |=RXRPC_RANDOM_EPOCH ;INIT_LIST_HEAD (&rxnet->calls); -rwlock_init (&rxnet->call_lock); +spin_lock_init (&rxnet->call_lock);atomic_set (&rxnet->nr_calls,1 );atomic_set (&rxnet->nr_conns,1 );
net/rxrpc/proc.c +2 -8
@@ -26,29 +26,23 @@ static const char *const rxrpc_conn_states[RXRPC_CONN__NR_STATES] = {*/ static void *rxrpc_call_seq_start (struct seq_file *seq,loff_t *_pos)__acquires (rcu) - __acquires(rxnet->call_lock) {struct rxrpc_net *rxnet =rxrpc_net (seq_file_net (seq));rcu_read_lock (); -read_lock (&rxnet->call_lock); -return seq_list_start_head (&rxnet->calls, *_pos); +return seq_list_start_head_rcu (&rxnet->calls, *_pos); }static void *rxrpc_call_seq_next (struct seq_file *seq,void *v,loff_t *pos) {struct rxrpc_net *rxnet =rxrpc_net (seq_file_net (seq)); -return seq_list_next (v, &rxnet->calls, pos); +return seq_list_next_rcu (v, &rxnet->calls, pos); }static void rxrpc_call_seq_stop (struct seq_file *seq,void *v) - __releases(rxnet->call_lock)__releases (rcu) { -struct rxrpc_net *rxnet =rxrpc_net (seq_file_net (seq)); - -read_unlock (&rxnet->call_lock);rcu_read_unlock (); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 517/879 rxrpc: Fix listen() setting the bar too high for the prealloc rings
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 88e22159750b0d55793302eeed8ee603f5c1a95c ]
AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we're using CIRC_CNT().
This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won't then be able to get rid of them because it'll think the ring is empty. rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call->peer isn't yet set.
Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity.
BUG: kernel NULL pointer dereference, address: 0000000000000086 ... RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc] Call Trace: <TASK> ? __wake_up_common_lock+0x7a/0x90 ? rxrpc_notify_socket+0x8e/0x140 [rxrpc] ? rxrpc_abort_call+0x4c/0x60 [rxrpc] rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc] rxrpc_release+0xc9/0x1c0 [rxrpc] __sock_release+0x37/0xa0 sock_close+0x11/0x20 __fput+0x89/0x240 task_work_run+0x59/0x90 do_exit+0x319/0xaa0
--- net/rxrpc/sysctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/rxrpc/sysctl.c +2 -2
@@ -12,7 +12,7 @@static struct ctl_table_header *rxrpc_sysctl_reg_table;static const unsigned int four =4 ; -static const unsigned int thirtytwo =32 ; +static const unsigned int max_backlog =RXRPC_BACKLOG_MAX -1 ;static const unsigned int n_65535 =65535 ;static const unsigned int n_max_acks =RXRPC_RXTX_BUFF_SIZE -1 ;static const unsigned long one_jiffy =1 ;
@@ -89,7 +89,7 @@ static struct ctl_table rxrpc_sysctl_table[] = { .mode = 0644, .proc_handler = proc_dointvec_minmax, .extra1 = (void *)&four, - .extra2 = (void *)&thirtytwo, + .extra2 = (void *)&max_backlog, }, { .procname = "rx_window_size",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 518/879 rxrpc: Dont try to resend the request if were receiving the reply
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 114af61f88fbe34d641b13922d098ffec4c1be1b ]
rxrpc has a timer to trigger resending of unacked data packets in a call. This is not cancelled when a client call switches to the receive phase on the basis that most calls don't last long enough for it to ever expire. However, if it *does* expire after we've started to receive the reply, we shouldn't then go into trying to retransmit or pinging the server to find out if an ack got lost.
Fix this by skipping the resend code if we're into receiving the reply to a client call.
--- net/rxrpc/call_event.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/rxrpc/call_event.c +2 -1
@@ -406,7 +406,8 @@ void rxrpc_process_call(struct work_struct *work) goto recheck_state; } -if (test_and_clear_bit (RXRPC_CALL_EV_RESEND , &call->events)) { +if (test_and_clear_bit (RXRPC_CALL_EV_RESEND , &call->events) && + call->state !=RXRPC_CALL_CLIENT_RECV_REPLY ) {rxrpc_resend (call, now); goto recheck_state; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 519/879 rxrpc: Fix overlapping ACK accounting
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 8940ba3cfe4841928777fd45eaa92051522c7f0c ]
Fix accidental overlapping of Rx-phase ACK accounting with Tx-phase ACK accounting through variables shared between the two. call->acks_* members refer to ACKs received in the Tx phase and call->ackr_* members to ACKs sent/to be sent during the Rx phase.
--- net/rxrpc/ar-internal.h | 7 ++++--- net/rxrpc/input.c | 16 ++++++++-------- 2 files changed, 12 insertions(+), 11 deletions(-)
net/rxrpc/ar-internal.h +4 -3
@@ -676,10 +676,9 @@ struct rxrpc_call {spinlock_t input_lock;/* Lock for packet input to this call */ -/* receive-phase ACK management */ +/* Receive-phase ACK management (ACKs we send). */ u8 ackr_reason;/* reason to ACK */ rxrpc_serial_t ackr_serial;/* serial of packet being ACK'd */ -rxrpc_serial_t ackr_first_seq;/* first sequence number received */ rxrpc_seq_t ackr_prev_seq;/* previous sequence number received */ rxrpc_seq_t ackr_consumed;/* Highest packet shown consumed */ rxrpc_seq_t ackr_seen;/* Highest packet shown seen */
@@ -692,8 +691,10 @@ struct rxrpc_call {#define RXRPC_CALL_RTT_AVAIL_MASK 0xf#define RXRPC_CALL_RTT_PEND_SHIFT 8 -/* transmission-phase ACK management */ +/* Transmission-phase ACK management (ACKs we've received). */ ktime_t acks_latest_ts;/* Timestamp of latest ACK received */ +rxrpc_seq_t acks_first_seq;/* first sequence number received */ +rxrpc_seq_t acks_prev_seq;/* previous sequence number received */ rxrpc_seq_t acks_lowest_nak;/* Lowest NACK in the buffer (or ==tx_hard_ack) */ rxrpc_seq_t acks_lost_top;/* tx_top at the time lost-ack ping sent */ rxrpc_serial_t acks_lost_ping;/* Serial number of probe ACK */
net/rxrpc/input.c +8 -8
@@ -812,7 +812,7 @@ static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks,static bool rxrpc_is_ack_valid (struct rxrpc_call *call,rxrpc_seq_t first_pkt,rxrpc_seq_t prev_pkt) { -rxrpc_seq_t base =READ_ONCE (call->ackr_first_seq); +rxrpc_seq_t base =READ_ONCE (call->acks_first_seq);if (after (first_pkt, base))return true;/* The window advanced */
@@ -820,7 +820,7 @@ static bool rxrpc_is_ack_valid(struct rxrpc_call *call,if (before (first_pkt, base))return false;/* firstPacket regressed */ -if (after_eq (prev_pkt, call->ackr_prev_seq)) +if (after_eq (prev_pkt, call->acks_prev_seq))return true;/* previousPacket hasn't regressed. */ /* Some rx implementations put a serial number in previousPacket. */
@@ -933,8 +933,8 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)/* Discard any out-of-order or duplicate ACKs (outside lock). */ if (!rxrpc_is_ack_valid (call, first_soft_ack, prev_pkt)) {trace_rxrpc_rx_discard_ack (call->debug_id, ack_serial, - first_soft_ack, call->ackr_first_seq, - prev_pkt, call->ackr_prev_seq); + first_soft_ack, call->acks_first_seq, + prev_pkt, call->acks_prev_seq);return ; }
@@ -949,14 +949,14 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)/* Discard any out-of-order or duplicate ACKs (inside lock). */ if (!rxrpc_is_ack_valid (call, first_soft_ack, prev_pkt)) {trace_rxrpc_rx_discard_ack (call->debug_id, ack_serial, - first_soft_ack, call->ackr_first_seq, - prev_pkt, call->ackr_prev_seq); + first_soft_ack, call->acks_first_seq, + prev_pkt, call->acks_prev_seq); goto out; } call->acks_latest_ts = skb->tstamp; - call->ackr_first_seq = first_soft_ack; - call->ackr_prev_seq = prev_pkt; + call->acks_first_seq = first_soft_ack; + call->acks_prev_seq = prev_pkt;/* Parse rwind and mtu sizes if provided. */ if (buf.info.rxMTU)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 520/879 rxrpc: Dont let ack.previousPacket regress
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 81524b6312535897707f2942695da1d359a5e56b ]
The previousPacket field in the rx ACK packet should never go backwards - it's now the highest DATA sequence number received, not the last on received (it used to be used for out of sequence detection).
--- net/rxrpc/ar-internal.h | 4 ++-- net/rxrpc/input.c | 4 +++- net/rxrpc/output.c | 2 +- 3 files changed, 6 insertions(+), 4 deletions(-)
net/rxrpc/ar-internal.h +2 -2
@@ -679,7 +679,7 @@ struct rxrpc_call {/* Receive-phase ACK management (ACKs we send). */ u8 ackr_reason;/* reason to ACK */ rxrpc_serial_t ackr_serial;/* serial of packet being ACK'd */ -rxrpc_seq_t ackr_prev_seq;/* previous sequence number received */ +rxrpc_seq_t ackr_highest_seq;/* Higest sequence number received */ rxrpc_seq_t ackr_consumed;/* Highest packet shown consumed */ rxrpc_seq_t ackr_seen;/* Highest packet shown seen */
@@ -694,7 +694,7 @@ struct rxrpc_call {/* Transmission-phase ACK management (ACKs we've received). */ ktime_t acks_latest_ts;/* Timestamp of latest ACK received */ rxrpc_seq_t acks_first_seq;/* first sequence number received */ -rxrpc_seq_t acks_prev_seq;/* previous sequence number received */ +rxrpc_seq_t acks_prev_seq;/* Highest previousPacket received */ rxrpc_seq_t acks_lowest_nak;/* Lowest NACK in the buffer (or ==tx_hard_ack) */ rxrpc_seq_t acks_lost_top;/* tx_top at the time lost-ack ping sent */ rxrpc_serial_t acks_lost_ping;/* Serial number of probe ACK */
net/rxrpc/input.c +3 -1
@@ -453,7 +453,6 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) !rxrpc_receiving_reply(call)) goto unlock; - call->ackr_prev_seq = seq0; hard_ack =READ_ONCE (call->rx_hard_ack); nr_subpackets = sp->nr_subpackets;
@@ -534,6 +533,9 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) ack_serial = serial; } +if (after (seq0, call->ackr_highest_seq)) + call->ackr_highest_seq = seq0; +/* Queue the packet. We use a couple of memory barriers here as need * to make sure that rx_top is perceived to be set after the buffer * pointer and that the buffer pointer is set after the annotation and
net/rxrpc/output.c +1 -1
@@ -89,7 +89,7 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn, pkt->ack.bufferSpace =htons (8 ); pkt->ack.maxSkew =htons (0 ); pkt->ack.firstPacket =htonl (hard_ack +1 ); - pkt->ack.previousPacket =htonl (call->ackr_prev_seq); + pkt->ack.previousPacket =htonl (call->ackr_highest_seq); pkt->ack.serial =htonl (serial); pkt->ack.reason = reason; pkt->ack.nAcks = top - hard_ack;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 521/879 rxrpc: Fix decision on when to generate an IDLE ACK
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 9a3dedcf18096e8f7f22b8777d78c4acfdea1651 ]
Fix the decision on when to generate an IDLE ACK by keeping a count of the number of packets we've received, but not yet soft-ACK'd, and the number of packets we've processed, but not yet hard-ACK'd, rather than trying to keep track of which DATA sequence numbers correspond to those points.
We then generate an ACK when either counter exceeds 2. The counters are both cleared when we transcribe the information into any sort of ACK packet for transmission. IDLE and DELAY ACKs are skipped if both counters are 0 (ie. no change).
--- include/trace/events/rxrpc.h | 2 +- net/rxrpc/ar-internal.h | 4 ++-- net/rxrpc/input.c | 11 +++++++++-- net/rxrpc/output.c | 18 +++++++++++------- net/rxrpc/recvmsg.c | 8 +++----- 5 files changed, 26 insertions(+), 17 deletions(-)
include/trace/events/rxrpc.h +1 -1
@@ -1509,7 +1509,7 @@ TRACE_EVENT(rxrpc_call_reset, __entry->call_serial = call->rx_serial; __entry->conn_serial = call->conn->hi_serial; __entry->tx_seq = call->tx_hard_ack; - __entry->rx_seq = call->ackr_seen; + __entry->rx_seq = call->rx_hard_ack; ), TP_printk("c=%08x %08x:%08x r=%08x/%08x tx=%08x rx=%08x",
net/rxrpc/ar-internal.h +2 -2
@@ -680,8 +680,8 @@ struct rxrpc_call {u8 ackr_reason;/* reason to ACK */ rxrpc_serial_t ackr_serial;/* serial of packet being ACK'd */ rxrpc_seq_t ackr_highest_seq;/* Higest sequence number received */ -rxrpc_seq_t ackr_consumed;/* Highest packet shown consumed */ -rxrpc_seq_t ackr_seen;/* Highest packet shown seen */ +atomic_t ackr_nr_unacked;/* Number of unacked packets */ +atomic_t ackr_nr_consumed;/* Number of packets needing hard ACK */ /* RTT management */ rxrpc_serial_t rtt_serial[4 ];/* Serial number of DATA or PING sent */
net/rxrpc/input.c +9 -2
@@ -412,8 +412,8 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) {struct rxrpc_skb_priv *sp =rxrpc_skb (skb);enum rxrpc_call_state state; -unsigned int j, nr_subpackets; -rxrpc_serial_t serial = sp->hdr.serial, ack_serial =0 ; +unsigned int j, nr_subpackets, nr_unacked =0 ; +rxrpc_serial_t serial = sp->hdr.serial, ack_serial = serial;rxrpc_seq_t seq0 = sp->hdr.seq, hard_ack;bool immediate_ack = false, jumbo_bad = false;u8 ack =0 ;
@@ -569,6 +569,8 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) sp =NULL ; } + nr_unacked++; +if (last) {set_bit (RXRPC_CALL_RX_LAST , &call->flags);if (!ack) {
@@ -588,9 +590,14 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb) } call->rx_expect_next = seq +1 ; } +if (!ack) + ack_serial = serial; } ack: +if (atomic_add_return (nr_unacked, &call->ackr_nr_unacked) >2 && !ack) + ack =RXRPC_ACK_IDLE ; +if (ack) rxrpc_propose_ACK(call, ack, ack_serial, immediate_ack, true,
net/rxrpc/output.c +11 -7
@@ -74,11 +74,18 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn, u8 reason) {rxrpc_serial_t serial; +unsigned int tmp;rxrpc_seq_t hard_ack, top, seq;int ix;u32 mtu, jmax;u8 *ackp = pkt->acks; + tmp =atomic_xchg (&call->ackr_nr_unacked,0 ); + tmp |=atomic_xchg (&call->ackr_nr_consumed,0 ); +if (!tmp && (reason ==RXRPC_ACK_DELAY || + reason ==RXRPC_ACK_IDLE )) +return 0 ; +/* Barrier against rxrpc_input_data(). */ serial = call->ackr_serial; hard_ack =READ_ONCE (call->rx_hard_ack);
@@ -223,6 +230,10 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping, n =rxrpc_fill_out_ack (conn, call, pkt, &hard_ack, &top, reason);spin_unlock_bh (&call->lock); +if (n ==0 ) { +kfree (pkt); +return 0 ; + } iov[0 ].iov_base = pkt; iov[0 ].iov_len =sizeof (pkt->whdr) +sizeof (pkt->ack) + n;
@@ -259,13 +270,6 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,ntohl (pkt->ack.serial), false, true, rxrpc_propose_ack_retry_tx); - }else { -spin_lock_bh (&call->lock); -if (after (hard_ack, call->ackr_consumed)) - call->ackr_consumed = hard_ack; -if (after (top, call->ackr_seen)) - call->ackr_seen = top; -spin_unlock_bh (&call->lock); }rxrpc_set_keepalive (call);
net/rxrpc/recvmsg.c +3 -5
@@ -260,11 +260,9 @@ static void rxrpc_rotate_rx_window(struct rxrpc_call *call)rxrpc_end_rx_phase (call, serial); }else {/* Check to see if there's an ACK that needs sending. */ -if (after_eq (hard_ack, call->ackr_consumed +2 ) || -after_eq (top, call->ackr_seen +2 ) || - (hard_ack == top &&after (hard_ack, call->ackr_consumed))) -rxrpc_propose_ACK (call,RXRPC_ACK_DELAY , serial, - true, true, +if (atomic_inc_return (&call->ackr_nr_consumed) >2 ) +rxrpc_propose_ACK (call,RXRPC_ACK_IDLE , serial, + true, false, rxrpc_propose_ack_rotate_rx);if (call->ackr_reason && call->ackr_reason !=RXRPC_ACK_DELAY )rxrpc_send_ack_packet (call, false,NULL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 522/879 hinic: Avoid some over memory allocation
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 15d221d0c345b76947911a3ac91897ffe2f1cc4e ]
'prod_idx' (atomic_t) is larger than 'shadow_idx' (u16), so some memory is over-allocated.
--- drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c +1 -1
@@ -386,7 +386,7 @@ static int alloc_wqes_shadow(struct hinic_wq *wq)return -ENOMEM ; wq->shadow_idx =devm_kcalloc (&pdev->dev, wq->num_q_pages, -sizeof (wq->prod_idx),GFP_KERNEL ); +sizeof (*wq->shadow_idx),GFP_KERNEL );if (!wq->shadow_idx) goto err_shadow_idx;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 523/879 dpaa2-eth: retrieve the virtual address before dma_unmap
In reply to Greg Kroah-HartmanFrom: Ioana Ciornei <[email protected]>
[ Upstream commit 06d129946a71f3159b3b40ee95549183edf2c79d ]
The TSO header was DMA unmapped before the virtual address was retrieved and then used to free the buffer. This meant that we were actually removing the DMA map and then trying to search for it to help in retrieving the virtual address. This lead to a invalid virtual address being used in the kfree call.
Fix this by calling dpaa2_iova_to_virt() prior to the dma_unmap call.
[ 487.231819] Unable to handle kernel paging request at virtual address fffffd9807000008
(...)
[ 487.354061] Hardware name: SolidRun LX2160A Honeycomb (DT) [ 487.359535] pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 487.366485] pc : kfree+0xac/0x304 [ 487.369799] lr : kfree+0x204/0x304 [ 487.373191] sp : ffff80000c4eb120 [ 487.376493] x29: ffff80000c4eb120 x28: ffff662240c46400 x27: 0000000000000001 [ 487.383621] x26: 0000000000000001 x25: ffff662246da0cc0 x24: ffff66224af78000 [ 487.390748] x23: ffffad184f4ce008 x22: ffffad1850185000 x21: ffffad1838d13cec [ 487.397874] x20: ffff6601c0000000 x19: fffffd9807000000 x18: 0000000000000000 [ 487.405000] x17: ffffb910cdc49000 x16: ffffad184d7d9080 x15: 0000000000004000 [ 487.412126] x14: 0000000000000008 x13: 000000000000ffff x12: 0000000000000000 [ 487.419252] x11: 0000000000000004 x10: 0000000000000001 x9 : ffffad184d7d927c [ 487.426379] x8 : 0000000000000000 x7 : 0000000ffffffd1d x6 : ffff662240a94900 [ 487.433505] x5 : 0000000000000003 x4 : 0000000000000009 x3 : ffffad184f4ce008 [ 487.440632] x2 : ffff662243eec000 x1 : 0000000100000100 x0 : fffffc0000000000 [ 487.447758] Call trace: [ 487.450194] kfree+0xac/0x304 [ 487.453151] dpaa2_eth_free_tx_fd.isra.0+0x33c/0x3e0 [fsl_dpaa2_eth] [ 487.459507] dpaa2_eth_tx_conf+0x100/0x2e0 [fsl_dpaa2_eth] [ 487.464989] dpaa2_eth_poll+0xdc/0x380 [fsl_dpaa2_eth]
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +3 -1
@@ -1097,6 +1097,7 @@ static void dpaa2_eth_free_tx_fd(struct dpaa2_eth_priv *priv,u32 fd_len =dpaa2_fd_get_len (fd);struct dpaa2_sg_entry *sgt;int should_free_skb =1 ; +void *tso_hdr;int i; fd_addr =dpaa2_fd_get_addr (fd);
@@ -1136,9 +1137,10 @@ static void dpaa2_eth_free_tx_fd(struct dpaa2_eth_priv *priv, priv->tx_data_offset);/* Unmap and free the header */ + tso_hdr =dpaa2_iova_to_virt (priv->iommu_domain,dpaa2_sg_get_addr (sgt));dma_unmap_single (dev,dpaa2_sg_get_addr (sgt),TSO_HEADER_SIZE ,DMA_TO_DEVICE ); -kfree (dpaa2_iova_to_virt (priv->iommu_domain,dpaa2_sg_get_addr (sgt))); +kfree (tso_hdr);/* Unmap the other SG entries for the data */ for (i =1 ; i < swa->tso.num_sg; i++)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 524/879 dpaa2-eth: use the correct software annotation field
In reply to Greg Kroah-HartmanFrom: Ioana Ciornei <[email protected]>
[ Upstream commit d5f4e19a85670b4e5697654f4a4e086e064f8a47 ]
The incorrect software annotation field was being used, swa->sg.sgt_size instead of swa->tso.sgt_size, which meant that the SGT buffer was unmapped with a wrong size.
This is also confirmed by the DMA API debug prints which showed the following:
[ 38.962434] DMA-API: fsl_dpaa2_eth dpni.2: device driver frees DMA memory with different size [device address=0x0000fffffafba740] [map size=224 bytes] [unmap size=0 bytes] [ 38.980496] WARNING: CPU: 11 PID: 1131 at kernel/dma/debug.c:973 check_unmap+0x58c/0x9b0 [ 38.988586] Modules linked in: [ 38.991631] CPU: 11 PID: 1131 Comm: iperf3 Not tainted 5.18.0-rc7-00117-g59130eeb2b8f #1972 [ 38.999970] Hardware name: NXP Layerscape LX2160ARDB (DT)
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +1 -1
@@ -1148,7 +1148,7 @@ static void dpaa2_eth_free_tx_fd(struct dpaa2_eth_priv *priv, dpaa2_sg_get_len(&sgt[i]), DMA_TO_DEVICE);/* Unmap the SGT buffer */ -dma_unmap_single (dev, fd_addr, swa->sg.sgt_size, +dma_unmap_single (dev, fd_addr, swa->tso.sgt_size,DMA_BIDIRECTIONAL );if (!swa->tso.is_last_fd)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 525/879 dpaa2-eth: unmap the SGT buffer before accessing its contents
In reply to Greg Kroah-HartmanFrom: Ioana Ciornei <[email protected]>
[ Upstream commit 0a09c5b8cb8f75344da7d90c771b84f7cdeaea04 ]
DMA unmap the Scatter/Gather table before going through the array to unmap and free each of the header and data chunks. This is so we do not touch the data between the dma_map and dma_unmap calls.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +4 -4
@@ -1136,6 +1136,10 @@ static void dpaa2_eth_free_tx_fd(struct dpaa2_eth_priv *priv, sgt = (struct dpaa2_sg_entry *)(buffer_start + priv->tx_data_offset); +/* Unmap the SGT buffer */ +dma_unmap_single (dev, fd_addr, swa->tso.sgt_size, +DMA_BIDIRECTIONAL ); +/* Unmap and free the header */ tso_hdr =dpaa2_iova_to_virt (priv->iommu_domain,dpaa2_sg_get_addr (sgt)); dma_unmap_single(dev, dpaa2_sg_get_addr(sgt), TSO_HEADER_SIZE,
@@ -1147,10 +1151,6 @@ static void dpaa2_eth_free_tx_fd(struct dpaa2_eth_priv *priv,dma_unmap_single (dev,dpaa2_sg_get_addr (&sgt[i]),dpaa2_sg_get_len (&sgt[i]),DMA_TO_DEVICE ); -/* Unmap the SGT buffer */ -dma_unmap_single (dev, fd_addr, swa->tso.sgt_size, -DMA_BIDIRECTIONAL ); -if (!swa->tso.is_last_fd) should_free_skb =0 ; }else {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 526/879 net: dsa: restrict SMSC_LAN9303_I2C kconfig
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 0a3ad7d323686fbaae8688326cc5ea0d185c6fca ]
Since kconfig 'select' does not follow dependency chains, if symbol KSA selects KSB, then KSA should also depend on the same symbols that KSB depends on, in order to prevent Kconfig warnings and possible build errors.
Change NET_DSA_SMSC_LAN9303_I2C and NET_DSA_SMSC_LAN9303_MDIO so that they are limited to VLAN_8021Q if the latter is enabled. This prevents the Kconfig warning:
WARNING: unmet direct dependencies detected for NET_DSA_SMSC_LAN9303
Depends on [m]: NETDEVICES [=y] && NET_DSA [=y] && (VLAN_8021Q [=m] || VLAN_8021Q [=m]=n) Selected by [y]:
- NET_DSA_SMSC_LAN9303_I2C [=y] && NETDEVICES [=y] && NET_DSA [=y] && I2C [=y]
--- drivers/net/dsa/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/dsa/Kconfig +2 -1
@@ -72,7 +72,6 @@ source "drivers/net/dsa/realtek/Kconfig" config NET_DSA_SMSC_LAN9303 tristate - depends on VLAN_8021Q || VLAN_8021Q=n select NET_DSA_TAG_LAN9303 select REGMAP help
@@ -82,6 +81,7 @@ config NET_DSA_SMSC_LAN9303 config NET_DSA_SMSC_LAN9303_I2C tristate "SMSC/Microchip LAN9303 3-ports 10/100 ethernet switch in I2C managed mode" depends on I2C + depends on VLAN_8021Q || VLAN_8021Q=n select NET_DSA_SMSC_LAN9303 select REGMAP_I2C help
@@ -91,6 +91,7 @@ config NET_DSA_SMSC_LAN9303_I2C config NET_DSA_SMSC_LAN9303_MDIO tristate "SMSC/Microchip LAN9303 3-ports 10/100 ethernet switch in MDIO managed mode" select NET_DSA_SMSC_LAN9303 + depends on VLAN_8021Q || VLAN_8021Q=n help Enable access functions if the SMSC/Microchip LAN9303 is configured for MDIO managed mode.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 527/879 net/smc: postpone sk_refcnt increment in connect()
In reply to Greg Kroah-HartmanFrom: liuyacan <[email protected]>
[ Upstream commit 75c1edf23b95a9c66923d9269d8e86e4dbde151f ]
Same trigger condition as commit 86434744. When setsockopt runs in parallel to a connect(), and switch the socket into fallback mode. Then the sk_refcnt is incremented in smc_connect(), but its state stay in SMC_INIT (NOT SMC_ACTIVE). This cause the corresponding sk_refcnt decrement in __smc_release() will not be performed.
--- net/smc/af_smc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/smc/af_smc.c +1 -1
@@ -1564,9 +1564,9 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr,if (rc && rc != -EINPROGRESS ) goto out; -sock_hold (&smc->sk);/* sock put in passive closing */ if (smc->use_fallback) goto out; +sock_hold (&smc->sk);/* sock put in passive closing */ if (flags &O_NONBLOCK ) {if (queue_work (smc_hs_wq, &smc->connect_work)) smc->connect_nonblock =1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 528/879 net/smc: fix listen processing for SMC-Rv2
In reply to Greg Kroah-HartmanFrom: liuyacan <[email protected]>
[ Upstream commit 8c3b8dc5cc9bf6d273ebe18b16e2d6882bcfb36d ]
In the process of checking whether RDMAv2 is available, the current implementation first sets ini->smcrv2.ib_dev_v2, and then allocates smc buf desc, but the latter may fail. Unfortunately, the caller will only check the former. In this case, a NULL pointer reference will occur in smc_clc_send_confirm_accept() when accessing conn->rmb_desc.
This patch does two things:
1. Use the return code to determine whether V2 is available.
2. If the return code is NODEV, continue to check whether V1 is available.
--- net/smc/af_smc.c | 44 +++++++++++++++++++++++++++----------------- 1 file changed, 27 insertions(+), 17 deletions(-)
net/smc/af_smc.c +27 -17
@@ -2093,13 +2093,13 @@ static int smc_listen_rdma_reg(struct smc_sock *new_smc, bool local_first)return 0 ; } -static void smc_find_rdma_v2_device_serv (struct smc_sock *new_smc, -struct smc_clc_msg_proposal *pclc, -struct smc_init_info *ini) +static int smc_find_rdma_v2_device_serv (struct smc_sock *new_smc, +struct smc_clc_msg_proposal *pclc, +struct smc_init_info *ini) {struct smc_clc_v2_extension *smc_v2_ext;u8 smcr_version; -int rc; +int rc =0 ;if (!(ini->smcr_version &SMC_V2 ) || !smcr_indicated (ini->smc_type_v2)) goto not_found;
@@ -2117,26 +2117,31 @@ static void smc_find_rdma_v2_device_serv(struct smc_sock *new_smc, ini->smcrv2.saddr = new_smc->clcsock->sk->sk_rcv_saddr; ini->smcrv2.daddr =smc_ib_gid_to_ipv4 (smc_v2_ext->roce); rc =smc_find_rdma_device (new_smc, ini); -if (rc) { -smc_find_ism_store_rc (rc, ini); +if (rc) goto not_found; - } +if (!ini->smcrv2.uses_gateway)memcpy (ini->smcrv2.nexthop_mac, pclc->lcl.mac,ETH_ALEN ); smcr_version = ini->smcr_version; ini->smcr_version =SMC_V2 ; rc =smc_listen_rdma_init (new_smc, ini); -if (!rc) - rc =smc_listen_rdma_reg (new_smc, ini->first_contact_local); -if (!rc) -return ; - ini->smcr_version = smcr_version; -smc_find_ism_store_rc (rc, ini); +if (rc) { + ini->smcr_version = smcr_version; + goto not_found; + } + rc =smc_listen_rdma_reg (new_smc, ini->first_contact_local); +if (rc) { + ini->smcr_version = smcr_version; + goto not_found; + } +return 0 ; not_found: + rc = rc ?:SMC_CLC_DECL_NOSMCDEV ; ini->smcr_version &= ~SMC_V2 ; ini->check_smcrv2 = false; +return rc; } static int smc_find_rdma_v1_device_serv(struct smc_sock *new_smc,
@@ -2169,6 +2174,7 @@ static int smc_listen_find_device(struct smc_sock *new_smc, struct smc_init_info *ini) {int prfx_rc; +int rc;/* check for ISM device matching V2 proposed device */ smc_find_ism_v2_device_serv (new_smc, pclc, ini);
@@ -2196,14 +2202,18 @@ static int smc_listen_find_device(struct smc_sock *new_smc,return ini->rc ?:SMC_CLC_DECL_NOSMCDDEV ;/* check if RDMA V2 is available */ -smc_find_rdma_v2_device_serv (new_smc, pclc, ini); -if (ini->smcrv2.ib_dev_v2) + rc =smc_find_rdma_v2_device_serv (new_smc, pclc, ini); +if (!rc)return 0 ; +/* skip V1 check if V2 is unavailable for non-Device reason */ +if (rc !=SMC_CLC_DECL_NOSMCDEV && + rc !=SMC_CLC_DECL_NOSMCRDEV && + rc !=SMC_CLC_DECL_NOSMCDDEV ) +return rc; +/* check if RDMA V1 is available */ if (!prfx_rc) { -int rc; - rc =smc_find_rdma_v1_device_serv (new_smc, pclc, ini);smc_find_ism_store_rc (rc, ini);return (!rc) ?0 : ini->rc;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 529/879 dma-direct: dont over-decrypt memory
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
[ Upstream commit 4a37f3dd9a83186cb88d44808ab35b78375082c9 ]
The original x86 sev_alloc() only called set_memory_decrypted() on memory returned by alloc_pages_node(), so the page order calculation fell out of that logic. However, the common dma-direct code has several potential allocators, not all of which are guaranteed to round up the underlying allocation to a power-of-two size, so carrying over that calculation for the encryption/decryption size was a mistake. Fix it by rounding to a *number* of pages, rather than an order.
Until recently there was an even worse interaction with DMA_DIRECT_REMAP where we could have ended up decrypting part of the next adjacent vmalloc area, only averted by no architecture actually supporting both configs at once. Don't ask how I found that one out...
--- kernel/dma/direct.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/dma/direct.c +2 -2
@@ -79,7 +79,7 @@ static int dma_set_decrypted(struct device *dev, void *vaddr, size_t size) {if (!force_dma_unencrypted (dev))return 0 ; -return set_memory_decrypted ((unsigned long )vaddr,1 <<get_order (size)); +return set_memory_decrypted ((unsigned long )vaddr,PFN_UP (size)); }static int dma_set_encrypted (struct device *dev,void *vaddr,size_t size)
@@ -88,7 +88,7 @@ static int dma_set_encrypted(struct device *dev, void *vaddr, size_t size)if (!force_dma_unencrypted (dev))return 0 ; - ret =set_memory_encrypted ((unsigned long )vaddr,1 <<get_order (size)); + ret =set_memory_encrypted ((unsigned long )vaddr,PFN_UP (size));if (ret)pr_warn_ratelimited ("leaking DMA memory that can't be re-encrypted\n" );return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 530/879 Bluetooth: hci_conn: Fix hci_connect_le_sync
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit c9f73a2178c12fb24d2807634209559d6a836e08 ]
The handling of connection failures shall be handled by the request completion callback as already done by hci_cs_le_create_conn, also make sure to use hci_conn_failed instead of hci_le_conn_failed as the later don't actually call hci_conn_del to cleanup.
--- net/bluetooth/hci_conn.c | 5 +++-- net/bluetooth/hci_event.c | 8 +++++--- 2 files changed, 8 insertions(+), 5 deletions(-)
net/bluetooth/hci_conn.c +3 -2
@@ -943,10 +943,11 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)bt_dev_err (hdev,"request failed to create LE connection: err %d" , err); -if (!conn) +/* Check if connection is still pending */ +if (conn !=hci_lookup_le_connect (hdev)) goto done; -hci_le_conn_failed (conn, err); +hci_conn_failed (conn, err); done:hci_dev_unlock (hdev);
net/bluetooth/hci_event.c +5 -3
@@ -5632,10 +5632,12 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, status =HCI_ERROR_INVALID_PARAMETERS ; } -if (status) { -hci_conn_failed (conn, status); +/* All connection failure handling is taken care of by the +* hci_conn_failed function which is triggered by the HCI +* request completion callbacks used for connecting. +*/ +if (status) goto unlock; - }if (conn->dst_type ==ADDR_LE_DEV_PUBLIC ) addr_type =BDADDR_LE_PUBLIC ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 531/879 Revert "net/smc: fix listen processing for SMC-Rv2"
In reply to Greg Kroah-HartmanFrom: liuyacan <[email protected]>
[ Upstream commit 9029ac03f20a5999bc5627277c6cf008ab8e23ed ]
This reverts commit 8c3b8dc5cc9bf6d273ebe18b16e2d6882bcfb36d.
Some rollback issue will be fixed in other patches in the future.
--- net/smc/af_smc.c | 44 +++++++++++++++++--------------------------- 1 file changed, 17 insertions(+), 27 deletions(-)
net/smc/af_smc.c +17 -27
@@ -2093,13 +2093,13 @@ static int smc_listen_rdma_reg(struct smc_sock *new_smc, bool local_first)return 0 ; } -static int smc_find_rdma_v2_device_serv (struct smc_sock *new_smc, -struct smc_clc_msg_proposal *pclc, -struct smc_init_info *ini) +static void smc_find_rdma_v2_device_serv (struct smc_sock *new_smc, +struct smc_clc_msg_proposal *pclc, +struct smc_init_info *ini) {struct smc_clc_v2_extension *smc_v2_ext;u8 smcr_version; -int rc =0 ; +int rc;if (!(ini->smcr_version &SMC_V2 ) || !smcr_indicated (ini->smc_type_v2)) goto not_found;
@@ -2117,31 +2117,26 @@ static int smc_find_rdma_v2_device_serv(struct smc_sock *new_smc, ini->smcrv2.saddr = new_smc->clcsock->sk->sk_rcv_saddr; ini->smcrv2.daddr =smc_ib_gid_to_ipv4 (smc_v2_ext->roce); rc =smc_find_rdma_device (new_smc, ini); -if (rc) +if (rc) { +smc_find_ism_store_rc (rc, ini); goto not_found; - + }if (!ini->smcrv2.uses_gateway)memcpy (ini->smcrv2.nexthop_mac, pclc->lcl.mac,ETH_ALEN ); smcr_version = ini->smcr_version; ini->smcr_version =SMC_V2 ; rc =smc_listen_rdma_init (new_smc, ini); -if (rc) { - ini->smcr_version = smcr_version; - goto not_found; - } - rc =smc_listen_rdma_reg (new_smc, ini->first_contact_local); -if (rc) { - ini->smcr_version = smcr_version; - goto not_found; - } -return 0 ; +if (!rc) + rc =smc_listen_rdma_reg (new_smc, ini->first_contact_local); +if (!rc) +return ; + ini->smcr_version = smcr_version; +smc_find_ism_store_rc (rc, ini); not_found: - rc = rc ?:SMC_CLC_DECL_NOSMCDEV ; ini->smcr_version &= ~SMC_V2 ; ini->check_smcrv2 = false; -return rc; } static int smc_find_rdma_v1_device_serv(struct smc_sock *new_smc,
@@ -2174,7 +2169,6 @@ static int smc_listen_find_device(struct smc_sock *new_smc, struct smc_init_info *ini) {int prfx_rc; -int rc;/* check for ISM device matching V2 proposed device */ smc_find_ism_v2_device_serv (new_smc, pclc, ini);
@@ -2202,18 +2196,14 @@ static int smc_listen_find_device(struct smc_sock *new_smc,return ini->rc ?:SMC_CLC_DECL_NOSMCDDEV ;/* check if RDMA V2 is available */ - rc =smc_find_rdma_v2_device_serv (new_smc, pclc, ini); -if (!rc) +smc_find_rdma_v2_device_serv (new_smc, pclc, ini); +if (ini->smcrv2.ib_dev_v2)return 0 ; -/* skip V1 check if V2 is unavailable for non-Device reason */ -if (rc !=SMC_CLC_DECL_NOSMCDEV && - rc !=SMC_CLC_DECL_NOSMCRDEV && - rc !=SMC_CLC_DECL_NOSMCDDEV ) -return rc; -/* check if RDMA V1 is available */ if (!prfx_rc) { +int rc; + rc =smc_find_rdma_v1_device_serv (new_smc, pclc, ini);smc_find_ism_store_rc (rc, ini);return (!rc) ?0 : ini->rc;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 532/879 media: lirc: revert removal of unused feature flags
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
[ Upstream commit e5499dd7253c8382d03f687f19a854adcc688357 ]
Commit b2a90f4fcb14 ("media: lirc: remove unused lirc features") removed feature flags which were never implemented, but they are still used by the lirc daemon went built from source.
Reinstate these symbols in order not to break the lirc build.
--- include/uapi/linux/lirc.h | 7 +++++++ 1 file changed, 7 insertions(+)
include/uapi/linux/lirc.h +7 -0
@@ -84,6 +84,13 @@#define LIRC_CAN_SEND (x) ((x)&LIRC_CAN_SEND_MASK)#define LIRC_CAN_REC (x) ((x)&LIRC_CAN_REC_MASK) +/* +* Unused features. These features were never implemented, in tree or +* out of tree. These definitions are here so not to break the lircd build. +*/ +#define LIRC_CAN_SET_REC_FILTER 0 +#define LIRC_CAN_NOTIFY_DECODE 0 +/*** IOCTL commands for lirc driver ***/ #define LIRC_GET_FEATURES _IOR('i', 0x00000000, __u32)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 533/879 arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399
In reply to Greg Kroah-HartmanFrom: Shawn Lin <[email protected]>
[ Upstream commit 4246d0bab2a8685e3d4aec2cb0ef8c526689ce96 ]
drive-impedance-ohm is introduced for emmc phy instead of pcie phy.
--- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399.dtsi +1 -1
@@ -1534,6 +1534,7 @@ reg = <0xf780 0x24>; clocks = <&sdhci>; clock-names = "emmcclk"; + drive-impedance-ohm = <50>; #phy-cells = <0>; status = "disabled"; };
@@ -1544,7 +1545,6 @@ clock-names = "refclk"; #phy-cells = <1>; resets = <&cru SRST_PCIEPHY>; - drive-impedance-ohm = <50>; reset-names = "phy"; status = "disabled"; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 534/879 arm64: dts: mt8192: Fix nor_flash status disable typo
In reply to Greg Kroah-HartmanFrom: Allen-KH Cheng <[email protected]>
[ Upstream commit 27f0eb16b0d417c155e96b5d3b89074699944e09 ]
Correct nor_flash status disable typo of mt8192 SoC.
--- arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8192.dtsi +1 -1
@@ -679,7 +679,7 @@ assigned-clock-parents = <&clk26m>; #address-cells = <1>; #size-cells = <0>; - status = "disable"; + status = "disabled"; }; audsys: clock-controller@11210000 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 535/879 PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit dff6139015dc68e93be3822a7bd406a1d138628b ]
acpi_pci_bridge_d3(dev) returns "true" if "dev" is a hotplug bridge that can handle hotplug events while in D3. Previously this meant either:
- "dev" has a _PS0 or _PR0 method (acpi_pci_power_manageable()), or
- The Root Port above "dev" has a _DSD with a "HotPlugSupportInD3" property with value 1.
This did not consider _PRW, which tells us about wakeup GPEs (ACPI v6.4, sec 7.3.13). Without a wakeup GPE, from an ACPI perspective the Root Port has no way of generating wakeup signals, so hotplug events will be lost if we use D3.
Similarly, it did not consider _S0W, which tells us the deepest D-state from which a device can wake itself (sec 7.3.20). If _S0W tells us the device cannot wake from D3, hotplug events will again be lost if we use D3.
Some platforms, e.g., AMD Yellow Carp, supply "HotPlugSupportInD3" without _PRW or with an _S0W that says the Root Port cannot wake from D3. On those platforms, we previously put bridges in D3hot, hotplug events were lost, and hotplugged devices would not be recognized without manually rescanning.
Allow bridges to be put in D3 only if the Root Port can generate wakeup GPEs (wakeup.flags.valid), it can wake from D3 (_S0W), AND it has the "HotPlugSupportInD3" property.
Neither Windows 10 nor Windows 11 puts the bridge in D3 when the firmware is configured this way, and this change aligns the handling of the situation to be the same.
--- drivers/pci/pci-acpi.c | 41 ++++++++++++++++++++++++++++++----------- 1 file changed, 30 insertions(+), 11 deletions(-)
drivers/pci/pci-acpi.c +30 -11
@@ -974,9 +974,11 @@ bool acpi_pci_power_manageable(struct pci_dev *dev)bool acpi_pci_bridge_d3 (struct pci_dev *dev) { -const union acpi_object *obj; -struct acpi_device *adev;struct pci_dev *rpdev; +struct acpi_device *adev; +acpi_status status; +unsigned long long state; +const union acpi_object *obj;if (acpi_pci_disabled || !dev->is_hotplug_bridge)return false;
@@ -985,12 +987,6 @@ bool acpi_pci_bridge_d3(struct pci_dev *dev)if (acpi_pci_power_manageable (dev))return true; -/* -* The ACPI firmware will provide the device-specific properties through -* _DSD configuration object. Look for the 'HotPlugSupportInD3' property -* for the root port and if it is set we know the hierarchy behind it -* supports D3 just fine. -*/ rpdev =pcie_find_root_port (dev);if (!rpdev)return false;
@@ -999,11 +995,34 @@ bool acpi_pci_bridge_d3(struct pci_dev *dev)if (!adev)return false; -if (acpi_dev_get_property (adev,"HotPlugSupportInD3" , -ACPI_TYPE_INTEGER , &obj) <0 ) +/* +* If the Root Port cannot signal wakeup signals at all, i.e., it +* doesn't supply a wakeup GPE via _PRW, it cannot signal hotplug +* events from low-power states including D3hot and D3cold. +*/ +if (!adev->wakeup.flags.valid)return false; -return obj->integer.value ==1 ; +/* +* If the Root Port cannot wake itself from D3hot or D3cold, we +* can't use D3. +*/ + status =acpi_evaluate_integer (adev->handle,"_S0W" ,NULL , &state); +if (ACPI_SUCCESS (status) && state <ACPI_STATE_D3_HOT ) +return false; + +/* +* The "HotPlugSupportInD3" property in a Root Port _DSD indicates +* the Port can signal hotplug events while in D3. We assume any +* bridges *below* that Root Port can also signal hotplug events +* while in D3. +*/ +if (!acpi_dev_get_property (adev,"HotPlugSupportInD3" , +ACPI_TYPE_INTEGER , &obj) && + obj->integer.value ==1 ) +return true; + +return false; }int acpi_pci_set_power_state (struct pci_dev *dev,pci_power_t state)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 536/879 memory: samsung: exynos5422-dmc: Avoid some over memory allocation
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 56653827f0d7bc7c2d8bac0e119fd1521fa9990a ]
'dmc->counter' is a 'struct devfreq_event_dev **', so there is some over memory allocation. 'counters_size' should be computed with 'sizeof(struct devfreq_event_dev *)'.
Use 'sizeof(*dmc->counter)' instead to fix it.
While at it, use devm_kcalloc() instead of devm_kzalloc()+open coded multiplication.
--- drivers/memory/samsung/exynos5422-dmc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/memory/samsung/exynos5422-dmc.c +2 -3
@@ -1322,7 +1322,6 @@ static int exynos5_dmc_init_clks(struct exynos5_dmc *dmc)*/ static int exynos5_performance_counters_init (struct exynos5_dmc *dmc) { -int counters_size;int ret, i; dmc->num_counters = devfreq_event_get_edev_count(dmc->dev,
@@ -1332,8 +1331,8 @@ static int exynos5_performance_counters_init(struct exynos5_dmc *dmc)return dmc->num_counters; } - counters_size =sizeof (struct devfreq_event_dev ) * dmc->num_counters; - dmc->counter =devm_kzalloc (dmc->dev, counters_size,GFP_KERNEL ); + dmc->counter =devm_kcalloc (dmc->dev, dmc->num_counters, +sizeof (*dmc->counter),GFP_KERNEL );if (!dmc->counter)return -ENOMEM ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 537/879 ARM: dts: BCM5301X: Update pin controller node name
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
[ Upstream commit 130b5e32ba9d2d2313e39cf3f6d0729bff02b76a ]
This fixes:arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: cru-bus@100: 'pin-controller@1c0' does not match any of the regexes: '^clock-controller@[a-f0-9]+$', '^phy@[a-f0-9]+$', '^pinctrl@[a-f0-9]+$', '^syscon@[a-f0-9]+$', '^thermal@[a-f0-9]+$'
From schema: Documentation/devicetree/bindings/mfd/brcm,cru.yamlarch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: pin-controller@1c0: $nodename:0: 'pin-controller@1c0' does not match '^(pinctrl|pinmux)(@[0-9a-f]+)?$'
From schema: Documentation/devicetree/bindings/pinctrl/brcm,ns-pinmux.yaml
Ref: e7391b021e3f ("dt-bindings: mfd: brcm,cru: Rename pinctrl node")
--- arch/arm/boot/dts/bcm5301x.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/bcm5301x.dtsi +1 -1
@@ -455,7 +455,7 @@ reg = <0x180 0x4>; }; - pinctrl: pin-controller@1c0 { + pinctrl: pinctrl@1c0 { compatible = "brcm,bcm4708-pinmux"; reg = <0x1c0 0x24>; reg-names = "cru_gpio_control";
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 538/879 ARM: dts: suniv: F1C100: fix watchdog compatible
In reply to Greg Kroah-HartmanFrom: Andre Przywara <[email protected]>
[ Upstream commit 01a850ee61cbf0ab77dcbf26bb133fec2dd640d6 ]
The F1C100 series of SoCs actually have their watchdog IP being compatible with the newer Allwinner generation, not the older one.
The currently described sun4i-a10-wdt actually does not work, neither the watchdog functionality (just never fires), nor the reset part (reboot hangs).
Replace the compatible string with the one used by the newer generation. Verified to work with both the watchdog and reboot functionality on a LicheePi Nano.
Also add the missing interrupt line and clock source, to make it binding compliant.
--- arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/arm/boot/dts/suniv-f1c100s.dtsi +3 -1
@@ -104,8 +104,10 @@ wdt: watchdog@1c20ca0 { compatible = "allwinner,suniv-f1c100s-wdt", - "allwinner,sun4i-a10-wdt"; + "allwinner,sun6i-a31-wdt"; reg = <0x01c20ca0 0x20>; + interrupts = <16>; + clocks = <&osc32k>; }; uart0: serial@1c25000 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 539/879 soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 8fd3f18ea31a398ecce4a6d3804433658678b0a3 ]
The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done.
--- drivers/soc/qcom/smp2p.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/qcom/smp2p.c +1 -0
@@ -493,6 +493,7 @@ static int smp2p_parse_ipc(struct qcom_smp2p *smp2p) } smp2p->ipc_regmap =syscon_node_to_regmap (syscon); +of_node_put (syscon);if (IS_ERR (smp2p->ipc_regmap))return PTR_ERR (smp2p->ipc_regmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 540/879 soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit aad66a3c78da668f4506356c2fdb70b7a19ecc76 ]
The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done.
--- drivers/soc/qcom/smsm.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/qcom/smsm.c +1 -0
@@ -374,6 +374,7 @@ static int smsm_parse_ipc(struct qcom_smsm *smsm, unsigned host_id)return 0 ; host->ipc_regmap =syscon_node_to_regmap (syscon); +of_node_put (syscon);if (IS_ERR (host->ipc_regmap))return PTR_ERR (host->ipc_regmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 541/879 arm64: defconfig: reenable SM_DISPCC_8250
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit e77817b4953dcf59a83bfab18ca5af80d9231d72 ]
CONFIG_SM_DISPCC_8250 is not enabled by default, but it is still necessary for the Qualcomm RB5 board. Reenable it (as it was enabled before the commit dde8cd786e37 ("arm64: defconfig: rebuild default configuration")).
--- arch/arm64/configs/defconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm64/configs/defconfig +1 -0
@@ -1029,6 +1029,7 @@ CONFIG_SM_GCC_8350=y CONFIG_SM_GCC_8450=y CONFIG_SM_GPUCC_8150=y CONFIG_SM_GPUCC_8250=y +CONFIG_SM_DISPCC_8250=y CONFIG_QCOM_HFPLL=y CONFIG_CLK_GFM_LPASS_SM8250=m CONFIG_CLK_RCAR_USB2_CLOCK_SEL=y
Signature · 1 line
2.35.1