5.19.17-rc1 review
Subsystems (9)
Greg Kroah-Hartman
maintainerPATCH 279/717 mISDN: fix use-after-free bugs in l1oip timer handlers
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit 2568a7e0832ee30b0a351016d03062ab4e0e0a3f ]
The l1oip_cleanup() traverses the l1oip_ilist and calls release_card() to cleanup module and stack. However, release_card() calls del_timer() to delete the timers such as keep_tl and timeout_tl. If the timer handler is running, the del_timer() will not stop it and result in UAF bugs. One of the processes is shown below:
(cleanup routine) | (timer handler)
release_card() | l1oip_timeout()
... |
del_timer() | ...
... |
kfree(hc) //FREE |
| hc->timeout_on = 0 //USEFix by calling del_timer_sync() in release_card(), which makes sure the timer handlers have finished before the resources, such as l1oip and so on, have been deallocated.
What's more, the hc->workq and hc->socket_thread can kick those timers right back in. We add a bool flag to show if card is released. Then, check this flag in hc->workq and hc->socket_thread.
--- drivers/isdn/mISDN/l1oip.h | 1 + drivers/isdn/mISDN/l1oip_core.c | 13 +++++++------ 2 files changed, 8 insertions(+), 6 deletions(-)
drivers/isdn/mISDN/l1oip.h +1 -0
@@ -59,6 +59,7 @@ struct l1oip {int bundle;/* bundle channels in one frm */ int codec;/* codec to use for transmis. */ int limit;/* limit number of bchannels */ +bool shutdown;/* if card is released */ /* timer */ struct timer_list keep_tl;
drivers/isdn/mISDN/l1oip_core.c +7 -6
@@ -275,7 +275,7 @@ l1oip_socket_send(struct l1oip *hc, u8 localcodec, u8 channel, u32 chanmask, p = frame;/* restart timer */ -if (time_before (hc->keep_tl.expires, jiffies +5 *HZ )) +if (time_before (hc->keep_tl.expires, jiffies +5 *HZ ) && !hc->shutdown)mod_timer (&hc->keep_tl, jiffies +L1OIP_KEEPALIVE *HZ );else hc->keep_tl.expires = jiffies +L1OIP_KEEPALIVE *HZ ;
@@ -601,7 +601,9 @@ l1oip_socket_parse(struct l1oip *hc, struct sockaddr_in *sin, u8 *buf, int len) goto multiframe;/* restart timer */ -if (time_before (hc->timeout_tl.expires, jiffies +5 *HZ ) || !hc->timeout_on) { +if ((time_before (hc->timeout_tl.expires, jiffies +5 *HZ ) || + !hc->timeout_on) && + !hc->shutdown) { hc->timeout_on =1 ;mod_timer (&hc->timeout_tl, jiffies +L1OIP_TIMEOUT *HZ ); }else /* only adjust timer */
@@ -1232,11 +1234,10 @@ release_card(struct l1oip *hc) {int ch; -if (timer_pending (&hc->keep_tl)) -del_timer (&hc->keep_tl); + hc->shutdown = true; -if (timer_pending (&hc->timeout_tl)) -del_timer (&hc->timeout_tl); +del_timer_sync (&hc->keep_tl); +del_timer_sync (&hc->timeout_tl);cancel_work_sync (&hc->workq);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 280/717 sctp: handle the error returned from sctp_auth_asoc_init_active_key
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 022152aaebe116a25c39818a07e175a8cd3c1e11 ]
When it returns an error from sctp_auth_asoc_init_active_key(), the active_key is actually not updated. The old sh_key will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot:
sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 sctp_set_owner_w net/sctp/socket.c:132 [inline] sctp_sendmsg_to_asoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctp_sendmsg+0x1053/0x1d50 net/sctp/socket.c:2025 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734
This patch is to fix it by not replacing the sh_key when it returns errors from sctp_auth_asoc_init_active_key() in sctp_auth_set_key(). For sctp_auth_set_active_key(), old active_key_id will be set back to asoc->active_key_id when the same thing happens.
--- net/sctp/auth.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
net/sctp/auth.c +14 -4
@@ -863,12 +863,17 @@ int sctp_auth_set_key(struct sctp_endpoint *ep, }list_del_init (&shkey->key_list); -sctp_auth_shkey_release (shkey);list_add (&cur_key->key_list, sh_keys); -if (asoc && asoc->active_key_id == auth_key->sca_keynumber) -sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL ); +if (asoc && asoc->active_key_id == auth_key->sca_keynumber && +sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL )) { +list_del_init (&cur_key->key_list); +sctp_auth_shkey_release (cur_key); +list_add (&shkey->key_list, sh_keys); +return -ENOMEM ; + } +sctp_auth_shkey_release (shkey);return 0 ; }
@@ -902,8 +907,13 @@ int sctp_auth_set_active_key(struct sctp_endpoint *ep,return -EINVAL ;if (asoc) { +__u16 active_key_id = asoc->active_key_id; + asoc->active_key_id = key_id; -sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL ); +if (sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL )) { + asoc->active_key_id = active_key_id; +return -ENOMEM ; + } }else ep->active_key_id = key_id;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 281/717 tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
In reply to Greg Kroah-HartmanFrom: Neal Cardwell <[email protected]>
[ Upstream commit f4ce91ce12a7c6ead19b128ffa8cff6e3ded2a14 ]
This commit fixes a bug in the tracking of max_packets_out and is_cwnd_limited. This bug can cause the connection to fail to remember that is_cwnd_limited is true, causing the connection to fail to grow cwnd when it should, causing throughput to be lower than it should be.
The following event sequence is an example that triggers the bug:
(a) The connection is cwnd_limited, but packets_out is not at its peak due to TSO deferral deciding not to send another skb yet. In such cases the connection can advance max_packets_seq and set tp->is_cwnd_limited to true and max_packets_out to a small number.
(b) Then later in the round trip the connection is pacing-limited (not cwnd-limited), and packets_out is larger. In such cases the connection would raise max_packets_out to a bigger number but (unexpectedly) flip tp->is_cwnd_limited from true to false.
This commit fixes that bug.
One straightforward fix would be to separately track (a) the next window after max_packets_out reaches a maximum, and (b) the next window after tp->is_cwnd_limited is set to true. But this would require consuming an extra u32 sequence number.
Instead, to save space we track only the most important information. Specifically, we track the strongest available signal of the degree to which the cwnd is fully utilized:
(1) If the connection is cwnd-limited then we remember that fact for the current window.
(2) If the connection not cwnd-limited then we track the maximum number of outstanding packets in the current window.
In particular, note that the new logic cannot trigger the buggy (a)/(b) sequence above because with the new logic a condition where tp->packets_out > tp->max_packets_out can only trigger an update of tp->is_cwnd_limited if tp->is_cwnd_limited is false.
This first showed up in a testing of a BBRv2 dev branch, but this buggy behavior highlighted a general issue with the tcp_cwnd_validate() logic that can cause cwnd to fail to increase at the proper rate for any TCP congestion control, including Reno or CUBIC.
--- include/linux/tcp.h | 2 +- include/net/tcp.h | 5 ++++- net/ipv4/tcp.c | 2 ++ net/ipv4/tcp_output.c | 19 ++++++++++++------- 4 files changed, 19 insertions(+), 9 deletions(-)
include/linux/tcp.h +1 -1
@@ -265,7 +265,7 @@ struct tcp_sock {u32 packets_out;/* Packets which are "in flight" */ u32 retrans_out;/* Retransmitted packets out */ u32 max_packets_out;/* max packets_out in last window */ -u32 max_packets_seq;/* right edge of max_packets_out flight */ +u32 cwnd_usage_seq;/* right edge of cwnd usage tracking flight */ u16 urg_data;/* Saved octet of OOB data and control flags */ u8 ecn_flags;/* ECN status bits. */
include/net/tcp.h +4 -1
@@ -1289,11 +1289,14 @@ static inline bool tcp_is_cwnd_limited(const struct sock *sk) {const struct tcp_sock *tp =tcp_sk (sk); +if (tp->is_cwnd_limited) +return true; +/* If in slow start, ensure cwnd grows to twice what was ACKed. */ if (tcp_in_slow_start (tp))return tcp_snd_cwnd (tp) <2 * tp->max_packets_out; -return tp->is_cwnd_limited; +return false; }/* BBR congestion control needs pacing.
net/ipv4/tcp.c +2 -0
@@ -3042,6 +3042,8 @@ int tcp_disconnect(struct sock *sk, int flags) tp->snd_ssthresh =TCP_INFINITE_SSTHRESH ;tcp_snd_cwnd_set (tp,TCP_INIT_CWND ); tp->snd_cwnd_cnt =0 ; + tp->is_cwnd_limited =0 ; + tp->max_packets_out =0 ; tp->window_clamp =0 ; tp->delivered =0 ; tp->delivered_ce =0 ;
net/ipv4/tcp_output.c +12 -7
@@ -1875,15 +1875,20 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited)const struct tcp_congestion_ops *ca_ops =inet_csk (sk)->icsk_ca_ops;struct tcp_sock *tp =tcp_sk (sk); -/* Track the maximum number of outstanding packets in each -* window, and remember whether we were cwnd-limited then. +/* Track the strongest available signal of the degree to which the cwnd +* is fully utilized. If cwnd-limited then remember that fact for the +* current window. If not cwnd-limited then track the maximum number of +* outstanding packets in the current window. (If cwnd-limited then we +* chose to not update tp->max_packets_out to avoid an extra else +* clause with no functional impact.) */ -if (!before (tp->snd_una, tp->max_packets_seq) || - tp->packets_out > tp->max_packets_out || - is_cwnd_limited) { - tp->max_packets_out = tp->packets_out; - tp->max_packets_seq = tp->snd_nxt; +if (!before (tp->snd_una, tp->cwnd_usage_seq) || + is_cwnd_limited || + (!tp->is_cwnd_limited && + tp->packets_out > tp->max_packets_out)) { tp->is_cwnd_limited = is_cwnd_limited; + tp->max_packets_out = tp->packets_out; + tp->cwnd_usage_seq = tp->snd_nxt; }if (tcp_is_cwnd_limited (sk)) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 282/717 spi: Ensure that sg_table wont be used after being freed
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit 8e9204cddcc3fea9affcfa411715ba4f66e97587 ]
SPI code checks for non-zero sgt->orig_nents to determine if the buffer has been DMA-mapped. Ensure that sg_table is really zeroed after free to avoid potential NULL pointer dereference if the given SPI xfer object is reused again without being DMA-mapped.
--- drivers/spi/spi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi.c +2 -0
@@ -1047,6 +1047,8 @@ void spi_unmap_buf(struct spi_controller *ctlr, struct device *dev,if (sgt->orig_nents) {dma_unmap_sg (dev, sgt->sgl, sgt->orig_nents, dir);sg_free_table (sgt); + sgt->orig_nents =0 ; + sgt->nents =0 ; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 283/717 Bluetooth: hci_sync: Fix not indicating power state
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 6abf0dae8c3c927f54e62c46faf8aba580ba0d04 ]
When setting power state using legacy/non-mgmt API
(e.g hcitool hci0 up) the likes of mgmt_set_powered_complete won't be called causing clients of the MGMT API to not be notified of the change of the state.
--- net/bluetooth/hci_sync.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/hci_sync.c +1 -0
@@ -4033,6 +4033,7 @@ int hci_dev_open_sync(struct hci_dev *hdev) hci_dev_test_flag(hdev, HCI_MGMT) && hdev->dev_type == HCI_PRIMARY) { ret =hci_powered_update_sync (hdev); +mgmt_power_on (hdev, ret); } }else {/* Init failed, cleanup */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 284/717 hwmon: (pmbus/mp2888) Fix sensors readouts for MPS Multi-phase mp2888 controller
In reply to Greg Kroah-HartmanFrom: Oleksandr Shamray <[email protected]>
[ Upstream commit 525dd5aed67a2f4f7278116fb92a24e6a53e2622 ]
Fix scale factors for reading MPS Multi-phase mp2888 controller. Fixed sensors:
- PIN/POUT: based on vendor documentation, set bscale factor 0.5W/LSB
- IOUT: based on vendor documentation, set scale factor 0.25 A/LSB
--- drivers/hwmon/pmbus/mp2888.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/hwmon/pmbus/mp2888.c +6 -7
@@ -34,7 +34,7 @@ struct mp2888_data {int curr_sense_gain; }; -#define to_mp2888_data (x) container_of(x, struct mp2888_data, info) +#define to_mp2888_data (x) container_of(x, struct mp2888_data, info)static int mp2888_read_byte_data (struct i2c_client *client,int page,int reg) {
@@ -109,7 +109,7 @@ mp2888_read_phase(struct i2c_client *client, struct mp2888_data *data, int page,* - Kcs is the DrMOS current sense gain of power stage, which is obtained from the * register MP2888_MFR_VR_CONFIG1, bits 13-12 with the following selection of DrMOS * (data->curr_sense_gain): -* 00b - 5µA/A, 01b - 8.5µA/A, 10b - 9.7µA/A, 11b - 10µA/A. +* 00b - 8.5µA/A, 01b - 9.7µA/A, 1b - 10µA/A, 11b - 5µA/A. * - Rcs is the internal phase current sense resistor. This parameter depends on hardware * assembly. By default it is set to 1kΩ. In case of different assembly, user should * scale this parameter by dividing it by Rcs.
@@ -118,10 +118,9 @@ mp2888_read_phase(struct i2c_client *client, struct mp2888_data *data, int page,* because sampling of current occurrence of bit weight has a big deviation, especially for * light load. */ - ret =DIV_ROUND_CLOSEST (ret *100 -9800 , data->curr_sense_gain); - ret = (data->phase_curr_resolution) ? ret *2 : ret; + ret =DIV_ROUND_CLOSEST (ret *200 -19600 , data->curr_sense_gain);/* Scale according to total current resolution. */ - ret = (data->total_curr_resolution) ? ret *8 : ret *4 ; + ret = (data->total_curr_resolution) ? ret *2 : ret;return ret; }
@@ -212,7 +211,7 @@ static int mp2888_read_word_data(struct i2c_client *client, int page, int phase, ret =pmbus_read_word_data (client, page, phase, reg);if (ret <0 )return ret; - ret = data->total_curr_resolution ? ret *2 : ret; + ret = data->total_curr_resolution ? ret :DIV_ROUND_CLOSEST (ret,2 );break ;case PMBUS_POUT_OP_WARN_LIMIT : ret =pmbus_read_word_data (client, page, phase, reg);
@@ -223,7 +222,7 @@ static int mp2888_read_word_data(struct i2c_client *client, int page, int phase,* set 1. Actual power is reported with 0.5W or 1W respectively resolution. Scaling * is needed to match both. */ - ret = data->total_curr_resolution ? ret *4 : ret *2 ; + ret = data->total_curr_resolution ? ret *2 : ret;break ;/* * The below registers are not implemented by device or implemented not according to the
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 285/717 net: rds: dont hold sock lock when cancelling work from rds_tcp_reset_callbacks()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit a91b750fd6629354460282bbf5146c01b05c4859 ]
syzbot is reporting lockdep warning at rds_tcp_reset_callbacks() [1], for commit ac3615e7f3cffe2a ("RDS: TCP: Reduce code duplication in rds_tcp_reset_callbacks()") added cancel_delayed_work_sync() into a section protected by lock_sock() without realizing that rds_send_xmit() might call lock_sock().
We don't need to protect cancel_delayed_work_sync() using lock_sock(), for even if rds_{send,recv}_worker() re-queued this work while __flush_work()
from cancel_delayed_work_sync() was waiting for this work to complete,
retried rds_{send,recv}_worker() is no-op due to the absence of RDS_CONN_UP bit.
--- net/rds/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/tcp.c +1 -1
@@ -166,10 +166,10 @@ void rds_tcp_reset_callbacks(struct socket *sock,*/ atomic_set (&cp->cp_state,RDS_CONN_RESETTING );wait_event (cp->cp_waitq, !test_bit (RDS_IN_XMIT , &cp->cp_flags)); -lock_sock (osock->sk);/* reset receive side state for rds_tcp_data_recv() for osock */ cancel_delayed_work_sync (&cp->cp_send_w);cancel_delayed_work_sync (&cp->cp_recv_w); +lock_sock (osock->sk);if (tc->t_tinc) {rds_inc_put (&tc->t_tinc->ti_inc); tc->t_tinc =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 286/717 af_unix: Fix memory leaks of the whole sk due to OOB skb.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 7a62ed61367b8fd01bae1e18e30602c25060d824 ]
syzbot reported a sequence of memory leaks, and one of them indicated we failed to free a whole sk:
unreferenced object 0xffff8880126e0000 (size 1088):
comm "syz-executor419", pid 326, jiffies 4294773607 (age 12.609s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 7d 00 00 00 00 00 00 00 ........}.......
01 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:
[<000000006fefe750>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:1970
[<0000000074006db5>] sk_alloc+0x3b/0x800 net/core/sock.c:2029
[<00000000728cd434>] unix_create1+0xaf/0x920 net/unix/af_unix.c:928
[<00000000a279a139>] unix_create+0x113/0x1d0 net/unix/af_unix.c:997
[<0000000068259812>] __sock_create+0x2ab/0x550 net/socket.c:1516
[<00000000da1521e1>] sock_create net/socket.c:1566 [inline]
[<00000000da1521e1>] __sys_socketpair+0x1a8/0x550 net/socket.c:1698
[<000000007ab259e1>] __do_sys_socketpair net/socket.c:1751 [inline]
[<000000007ab259e1>] __se_sys_socketpair net/socket.c:1748 [inline]
[<000000007ab259e1>] __x64_sys_socketpair+0x97/0x100 net/socket.c:1748
[<000000007dedddc1>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<000000007dedddc1>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
[<000000009456679f>] entry_SYSCALL_64_after_hwframe+0x63/0xcdWe can reproduce this issue by creating two AF_UNIX SOCK_STREAM sockets, send()ing an OOB skb to each other, and close()ing them without consuming the OOB skbs.
int skpair[2]; socketpair(AF_UNIX, SOCK_STREAM, 0, skpair); send(skpair[0], "x", 1, MSG_OOB); send(skpair[1], "x", 1, MSG_OOB); close(skpair[0]); close(skpair[1]);
Currently, we free an OOB skb in unix_sock_destructor() which is called via __sk_free(), but it's too late because the receiver's unix_sk(sk)->oob_skb is accounted against the sender's sk->sk_wmem_alloc and __sk_free() is called only when sk->sk_wmem_alloc is 0.
In the repro sequences, we do not consume the OOB skb, so both two sk's sock_put() never reach __sk_free() due to the positive sk->sk_wmem_alloc. Then, no one can consume the OOB skb nor call __sk_free(), and we finally leak the two whole sk.
Thus, we must free the unconsumed OOB skb earlier when close()ing the socket.
--- net/unix/af_unix.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
net/unix/af_unix.c +7 -6
@@ -548,12 +548,6 @@ static void unix_sock_destructor(structskb_queue_purge (&sk->sk_receive_queue); -#if IS_ENABLED (CONFIG_AF_UNIX_OOB ) -if (u->oob_skb) { -kfree_skb (u->oob_skb); - u->oob_skb =NULL ; - } -#endif WARN_ON (refcount_read (&sk->sk_wmem_alloc));WARN_ON (!sk_unhashed (sk));WARN_ON (sk->sk_socket);
@@ -598,6 +592,13 @@ static void unix_release_sock(struct socunix_state_unlock (sk); +#if IS_ENABLED (CONFIG_AF_UNIX_OOB ) +if (u->oob_skb) { +kfree_skb (u->oob_skb); + u->oob_skb =NULL ; + } +#endif +wake_up_interruptible_all (&u->peer_wait);if (skpair !=NULL ) {
Greg Kroah-Hartman
maintainerPATCH 287/717 net: prestera: acl: Add check for kmemdup
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 9e6fd874c7bb47b6a4295abc4c81b2f41b97e970 ]
As the kemdup could return NULL, it should be better to check the return value and return error if fails.
Moreover, the return value of prestera_acl_ruleset_keymask_set() should be checked by cascade.
--- drivers/net/ethernet/marvell/prestera/prestera_acl.c | 8 ++++++-- drivers/net/ethernet/marvell/prestera/prestera_acl.h | 4 ++-- drivers/net/ethernet/marvell/prestera/prestera_flower.c | 6 +++++- 3 files changed, 13 insertions(+), 5 deletions(-)
drivers/net/ethernet/marvell/prestera/prestera_acl.c +6 -2
@@ -162,10 +162,14 @@ prestera_acl_ruleset_create(struct prestera_acl *acl,return ERR_PTR (err); } -void prestera_acl_ruleset_keymask_set (struct prestera_acl_ruleset *ruleset, -void *keymask) +int prestera_acl_ruleset_keymask_set (struct prestera_acl_ruleset *ruleset, +void *keymask) { ruleset->keymask =kmemdup (keymask,ACL_KEYMASK_SIZE ,GFP_KERNEL ); +if (!ruleset->keymask) +return -ENOMEM ; + +return 0 ; }int prestera_acl_ruleset_offload (struct prestera_acl_ruleset *ruleset)
drivers/net/ethernet/marvell/prestera/prestera_acl.h +2 -2
@@ -185,8 +185,8 @@ struct prestera_acl_ruleset * prestera_acl_ruleset_lookup(struct prestera_acl *acl, struct prestera_flow_block *block, u32 chain_index); -void prestera_acl_ruleset_keymask_set (struct prestera_acl_ruleset *ruleset, -void *keymask); +int prestera_acl_ruleset_keymask_set (struct prestera_acl_ruleset *ruleset, +void *keymask);bool prestera_acl_ruleset_is_offload (struct prestera_acl_ruleset *ruleset);int prestera_acl_ruleset_offload (struct prestera_acl_ruleset *ruleset);void prestera_acl_ruleset_put (struct prestera_acl_ruleset *ruleset);
drivers/net/ethernet/marvell/prestera/prestera_flower.c +5 -1
@@ -428,7 +428,9 @@ int prestera_flower_tmplt_create(struct prestera_flow_block *block, }/* preserve keymask/template to this ruleset */ -prestera_acl_ruleset_keymask_set (ruleset, rule.re_key.match.mask); + err =prestera_acl_ruleset_keymask_set (ruleset, rule.re_key.match.mask); +if (err) + goto err_ruleset_keymask_set;/* skip error, as it is not possible to reject template operation, * so, keep the reference to the ruleset for rules to be added
@@ -444,6 +446,8 @@ int prestera_flower_tmplt_create(struct prestera_flow_block *block,list_add_rcu (&template->list, &block->template_list);return 0 ; +err_ruleset_keymask_set: +prestera_acl_ruleset_put (ruleset); err_ruleset_get:kfree (template); err_malloc:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 288/717 eth: lan743x: reject extts for non-pci11x1x devices
In reply to Greg Kroah-HartmanFrom: Raju Lakkaraju <[email protected]>
[ Upstream commit cb4b12071a4b68df323c339f60805834246b3e9e ]
Remove PTP_PF_EXTTS support for non-PCI11x1x devices since they do not support the PTP-IO Input event triggered timestamping mechanisms added
--- drivers/net/ethernet/microchip/lan743x_ptp.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/microchip/lan743x_ptp.c +7 -0
@@ -1049,6 +1049,10 @@ static int lan743x_ptpci_verify_pin_config(struct ptp_clock_info *ptp, enum ptp_pin_function func, unsigned int chan) { +struct lan743x_ptp *lan_ptp = + container_of(ptp, struct lan743x_ptp, ptp_clock_info); +struct lan743x_adapter *adapter = + container_of(lan_ptp, struct lan743x_adapter, ptp);int result =0 ;/* Confirm the requested function is supported. Parameter
@@ -1057,7 +1061,10 @@ static int lan743x_ptpci_verify_pin_config(struct ptp_clock_info *ptp,switch (func) {case PTP_PF_NONE :case PTP_PF_PEROUT : +break ;case PTP_PF_EXTTS : +if (!adapter->is_pci11x1x) + result =-1 ;break ;case PTP_PF_PHYSYNC :default :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 289/717 bnx2x: fix potential memory leak in bnx2x_tpa_stop()
In reply to Greg Kroah-HartmanFrom: Jianglei Nie <[email protected]>
[ Upstream commit b43f9acbb8942b05252be83ac25a81cec70cc192 ]
bnx2x_tpa_stop() allocates a memory chunk from new_data with bnx2x_frag_alloc(). The new_data should be freed when gets some error. But when "pad + len > fp->rx_buf_size" is true, bnx2x_tpa_stop() returns without releasing the new_data, which will lead to a memory leak.
We should free the new_data with bnx2x_frag_free() when "pad + len > fp->rx_buf_size" is true.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +1 -0
@@ -789,6 +789,7 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,BNX2X_ERR ("skb_put is about to fail... pad %d len %d rx_buf_size %d\n" , pad, len, fp->rx_buf_size);bnx2x_panic (); +bnx2x_frag_free (fp, new_data); return; }#endif
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 290/717 eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address
In reply to Greg Kroah-HartmanFrom: Zheng Wang <[email protected]>
[ Upstream commit 12aece8b01507a2d357a1861f470e83621fbb6f2 ]
This frees "mac" and tries to display its address as part of the error message on the next line. Swap the order.
--- drivers/net/ethernet/sunplus/spl2sw_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/sunplus/spl2sw_driver.c +1 -1
@@ -248,8 +248,8 @@ static int spl2sw_nvmem_get_mac_address(struct device *dev, struct device_node */* Check if mac address is valid */ if (!is_valid_ether_addr (mac)) { -kfree (mac);dev_info (dev,"Invalid mac address in nvmem (%pM)!\n" , mac); +kfree (mac);return -EINVAL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 291/717 net: wwan: iosm: Call mutex_init before locking it
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit ba0fbdb95da5ddd8db457ce6ba09d16dd979a294 ]
wwan_register_ops calls wwan_create_default_link, which ends up in the ipc_wwan_newlink callback that locks ipc_wwan->if_mutex. However, this mutex is not yet initialized by that point. Fix it by moving mutex_init above the wwan_register_ops call. This also makes the order of operations in ipc_wwan_init symmetric to ipc_wwan_deinit.
--- drivers/net/wwan/iosm/iosm_ipc_wwan.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wwan/iosm/iosm_ipc_wwan.c +3 -2
@@ -323,15 +323,16 @@ struct iosm_wwan *ipc_wwan_init(struct iosm_imem *ipc_imem, struct device *dev) ipc_wwan->dev = dev; ipc_wwan->ipc_imem = ipc_imem; +mutex_init (&ipc_wwan->if_mutex); +/* WWAN core will create a netdev for the default IP MUX channel */ if (wwan_register_ops (ipc_wwan->dev, &iosm_wwan_ops, ipc_wwan,IP_MUX_SESSION_DEFAULT )) { +mutex_destroy (&ipc_wwan->if_mutex);kfree (ipc_wwan);return NULL ; } -mutex_init (&ipc_wwan->if_mutex); -return ipc_wwan; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 292/717 net/ieee802154: reject zero-sized raw_sendmsg()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit 3a4d061c699bd3eedc80dc97a4b2a2e1af83c6f5 ]
syzbot is hitting skb_assert_len() warning at raw_sendmsg() for ieee802154 socket. What commit dc633700f00f726e ("net/af_packet: check len when min_header_len equals to 0") does also applies to ieee802154 socket.
--- net/ieee802154/socket.c | 3 +++ 1 file changed, 3 insertions(+)
net/ieee802154/socket.c +3 -0
@@ -251,6 +251,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)return -EOPNOTSUPP ; } +if (!size) +return -EINVAL ; +lock_sock (sk);if (!sk->sk_bound_dev_if) dev =dev_getfirstbyhwtype (sock_net (sk),ARPHRD_IEEE802154 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 293/717 once: add DO_ONCE_SLOW() for sleepable contexts
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 62c07983bef9d3e78e71189441e1a470f0d1e653 ]
Christophe Leroy reported a ~80ms latency spike
happening at first TCP connect() time.
This is because __inet_hash_connect() uses get_random_once()
to populate a perturbation table which became quite big
after commit 4c2c8f03a5ab ("tcp: increase source port perturb table to 2^16")
get_random_once() uses DO_ONCE(), which block hard irqs for the duration of the operation.
This patch adds DO_ONCE_SLOW() which uses a mutex instead of a spinlock for operations where we prefer to stay in process context.
Then __inet_hash_connect() can use get_random_slow_once() to populate its perturbation table.
--- include/linux/once.h | 28 ++++++++++++++++++++++++++++ lib/once.c | 30 ++++++++++++++++++++++++++++++ net/ipv4/inet_hashtables.c | 4 ++-- 3 files changed, 60 insertions(+), 2 deletions(-)
include/linux/once.h +28 -0
@@ -5,10 +5,18 @@#include <linux/types.h> #include <linux/jump_label.h> +/* Helpers used from arbitrary contexts. +* Hard irqs are blocked, be cautious. +*/ bool __do_once_start (bool *done,unsigned long *flags);void __do_once_done (bool *done,struct static_key_true *once_key,unsigned long *flags,struct module *mod); +/* Variant for process contexts only. */ +bool __do_once_slow_start (bool *done); +void __do_once_slow_done (bool *done,struct static_key_true *once_key, +struct module *mod); +/* Call a function exactly once. The idea of DO_ONCE() is to perform * a function call such as initialization of random seeds, etc, only * once, where DO_ONCE() can live in the fast-path. After @func has
@@ -52,9 +60,29 @@ void __do_once_done(bool *done, struct static_key_true *once_key, ___ret; \ }) +/* Variant of DO_ONCE() for process/sleepable contexts. */ +#define DO_ONCE_SLOW (func, ...) \ + ({ \ + bool ___ret = false; \ + static bool __section(".data.once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + ___ret = __do_once_slow_start(&___done); \ + if (unlikely(___ret)) { \ + func(__VA_ARGS__); \ + __do_once_slow_done(&___done, &___once_key, \ + THIS_MODULE); \ + } \ + } \ + ___ret; \ + }) +#define get_random_once (buf, nbytes) \ DO_ONCE(get_random_bytes, (buf), (nbytes))#define get_random_once_wait (buf, nbytes) \ DO_ONCE(get_random_bytes_wait, (buf), (nbytes)) \ +#define get_random_slow_once (buf, nbytes) \ + DO_ONCE_SLOW(get_random_bytes, (buf), (nbytes)) +#endif /* _LINUX_ONCE_H */
lib/once.c +30 -0
@@ -66,3 +66,33 @@ void __do_once_done(bool *done, struct static_key_true *once_key,once_disable_jump (once_key, mod); }EXPORT_SYMBOL (__do_once_done); + +static DEFINE_MUTEX (once_mutex); + +bool __do_once_slow_start (bool *done) +__acquires (once_mutex) +{ +mutex_lock (&once_mutex); +if (*done) { +mutex_unlock (&once_mutex); +/* Keep sparse happy by restoring an even lock count on +* this mutex. In case we return here, we don't call into +* __do_once_done but return early in the DO_ONCE_SLOW() macro. +*/ +__acquire (once_mutex); +return false; + } + +return true; +} +EXPORT_SYMBOL (__do_once_slow_start); + +void __do_once_slow_done (bool *done,struct static_key_true *once_key, +struct module *mod) +__releases (once_mutex) +{ + *done = true; +mutex_unlock (&once_mutex); +once_disable_jump (once_key, mod); +} +EXPORT_SYMBOL (__do_once_slow_done);
net/ipv4/inet_hashtables.c +2 -2
@@ -729,8 +729,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,if (likely (remaining >1 )) remaining &= ~1U ; -net_get_random_once (table_perturb, -INET_TABLE_PERTURB_SIZE *sizeof (*table_perturb)); +get_random_slow_once (table_perturb, +INET_TABLE_PERTURB_SIZE *sizeof (*table_perturb)); index = port_offset & (INET_TABLE_PERTURB_SIZE -1 ); offset =READ_ONCE (table_perturb[index]) + (port_offset >>32 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 294/717 net: mvpp2: fix mvpp2 debugfs leak
In reply to Greg Kroah-HartmanFrom: Russell King (Oracle) <[email protected]>
[ Upstream commit 0152dfee235e87660f52a117fc9f70dc55956bb4 ]
When mvpp2 is unloaded, the driver specific debugfs directory is not removed, which technically leads to a memory leak. However, this directory is only created when the first device is probed, so the hardware is present. Removing the module is only something a developer would to when e.g. testing out changes, so the module would be reloaded. So this memory leak is minor.
The original attempt in commit fe2c9c61f668 ("net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()") that was labelled as a memory leak fix was not, it fixed a refcount leak, but in doing so created a problem when the module is reloaded - the directory already exists, but mvpp2_root is NULL, so we lose all debugfs entries. This fix has been reverted.
This is the alternative fix, where we remove the offending directory whenever the driver is unloaded.
--- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 ++++++++-- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 ++++++++++++- 3 files changed, 21 insertions(+), 3 deletions(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2.h +1 -0
@@ -1530,6 +1530,7 @@ u32 mvpp2_read(struct mvpp2 *priv, u32 offset);void mvpp2_dbgfs_init (struct mvpp2 *priv,const char *name);void mvpp2_dbgfs_cleanup (struct mvpp2 *priv); +void mvpp2_dbgfs_exit (void );void mvpp23_rx_fifo_fc_en (struct mvpp2 *priv,int port,bool en);
drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +8 -2
@@ -691,6 +691,13 @@ static int mvpp2_dbgfs_port_init(struct dentry *parent,return 0 ; } +static struct dentry *mvpp2_root; + +void mvpp2_dbgfs_exit (void ) +{ +debugfs_remove (mvpp2_root); +} +void mvpp2_dbgfs_cleanup (struct mvpp2 *priv) {debugfs_remove_recursive (priv->dbgfs_dir);
@@ -700,10 +707,9 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv)void mvpp2_dbgfs_init (struct mvpp2 *priv,const char *name) { -struct dentry *mvpp2_dir, *mvpp2_root; +struct dentry *mvpp2_dir;int ret, i; - mvpp2_root =debugfs_lookup (MVPP2_DRIVER_NAME ,NULL );if (!mvpp2_root) mvpp2_root =debugfs_create_dir (MVPP2_DRIVER_NAME ,NULL );
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +12 -1
@@ -7706,7 +7706,18 @@ static struct platform_driver mvpp2_driver = { }, }; -module_platform_driver (mvpp2_driver); +static int __init mvpp2_driver_init (void ) +{ +return platform_driver_register (&mvpp2_driver); +} +module_init (mvpp2_driver_init); + +static void __exit mvpp2_driver_exit(void) +{ +platform_driver_unregister (&mvpp2_driver); +mvpp2_dbgfs_exit (); +} +module_exit (mvpp2_driver_exit);MODULE_DESCRIPTION ("Marvell PPv2 Ethernet Driver - www.marvell.com" );MODULE_AUTHOR ("Marcin Wojtas <[email protected]>" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 295/717 drm: bridge: adv7511: fix CEC power down control register offset
In reply to Greg Kroah-HartmanFrom: Alvin Šipraga <[email protected]>
[ Upstream commit 1d22b6033ea113a4c3850dfa2c0770885c81aec8 ]
The ADV7511_REG_CEC_CTRL = 0xE2 register is part of the main register map - not the CEC register map. As such, we shouldn't apply an offset to the register address. Doing so will cause us to address a bogus register for chips with a CEC register map offset (e.g. ADV7533).
--- drivers/gpu/drm/bridge/adv7511/adv7511.h | 5 +---- drivers/gpu/drm/bridge/adv7511/adv7511_cec.c | 4 ++-- 2 files changed, 3 insertions(+), 6 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511.h +1 -4
@@ -394,10 +394,7 @@ void adv7511_cec_irq_process(struct adv7511 *adv7511, unsigned int irq1);#else static inline int adv7511_cec_init (struct device *dev,struct adv7511 *adv7511) { -unsigned int offset = adv7511->type ==ADV7533 ? -ADV7533_REG_CEC_OFFSET :0 ; - -regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL + offset, +regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL ,ADV7511_CEC_CTRL_POWER_DOWN );return 0 ; }
drivers/gpu/drm/bridge/adv7511/adv7511_cec.c +2 -2
@@ -359,7 +359,7 @@ int adv7511_cec_init(struct device *dev, struct adv7511 *adv7511) goto err_cec_alloc; } -regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL + offset,0 ); +regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL ,0 );/* cec soft reset */ regmap_write (adv7511->regmap_cec,ADV7511_REG_CEC_SOFT_RESET + offset,0x01 );
@@ -386,7 +386,7 @@ int adv7511_cec_init(struct device *dev, struct adv7511 *adv7511)dev_info (dev,"Initializing CEC failed with error %d, disabling CEC\n" , ret); err_cec_parse_dt: -regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL + offset, +regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL ,ADV7511_CEC_CTRL_POWER_DOWN );return ret == -EPROBE_DEFER ? ret :0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 296/717 drm: bridge: adv7511: unregister cec i2c device after cec adapter
In reply to Greg Kroah-HartmanFrom: Alvin Šipraga <[email protected]>
[ Upstream commit 40cdb02cb9f965732eb543d47f15bef8d10f0f5f ]
cec_unregister_adapter() assumes that the underlying adapter ops are callable. For example, if the CEC adapter currently has a valid physical address, then the unregistration procedure will invalidate the physical address by setting it to f.f.f.f. Whence the following kernel oops observed after removing the adv7511 module:
Unable to handle kernel execution of user memory at virtual address 0000000000000000
Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP
Call trace:
0x0
adv7511_cec_adap_log_addr+0x1ac/0x1c8 [adv7511]
cec_adap_unconfigure+0x44/0x90 [cec]
__cec_s_phys_addr.part.0+0x68/0x230 [cec]
__cec_s_phys_addr+0x40/0x50 [cec]
cec_unregister_adapter+0xb4/0x118 [cec]
adv7511_remove+0x60/0x90 [adv7511]
i2c_device_remove+0x34/0xe0
device_release_driver_internal+0x114/0x1f0
driver_detach+0x54/0xe0
bus_remove_driver+0x60/0xd8
driver_unregister+0x34/0x60
i2c_del_driver+0x2c/0x68
adv7511_exit+0x1c/0x67c [adv7511]
__arm64_sys_delete_module+0x154/0x288
invoke_syscall+0x48/0x100
el0_svc_common.constprop.0+0x48/0xe8
do_el0_svc+0x28/0x88
el0_svc+0x1c/0x50
el0t_64_sync_handler+0xa8/0xb0
el0t_64_sync+0x15c/0x160
Code: bad PC value
---[ end trace 0000000000000000 ]---Protect against this scenario by unregistering i2c_cec after unregistering the CEC adapter. Duly disable the CEC clock afterwards too.
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +2 -3
@@ -1340,9 +1340,6 @@ static int adv7511_remove(struct i2c_client *i2c) {struct adv7511 *adv7511 =i2c_get_clientdata (i2c); -i2c_unregister_device (adv7511->i2c_cec); -clk_disable_unprepare (adv7511->cec_clk); -adv7511_uninit_regulators (adv7511);drm_bridge_remove (&adv7511->bridge);
@@ -1350,6 +1347,8 @@ static int adv7511_remove(struct i2c_client *i2c)adv7511_audio_exit (adv7511);cec_unregister_adapter (adv7511->cec_adap); +i2c_unregister_device (adv7511->i2c_cec); +clk_disable_unprepare (adv7511->cec_clk);i2c_unregister_device (adv7511->i2c_packet);i2c_unregister_device (adv7511->i2c_edid);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 297/717 drm/bridge: Avoid uninitialized variable warning
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 7d1202738efda60155d98b370b3c70d336be0eea ]
This code works, but technically it uses "num_in_bus_fmts" before it has been initialized so it leads to static checker warnings and probably KMEMsan warnings at run time. Initialize the variable to zero to silence the warning.
--- drivers/gpu/drm/drm_bridge.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_bridge.c +2 -2
@@ -823,8 +823,8 @@ static int select_bus_fmt_recursive(struct drm_bridge *first_bridge, struct drm_connector_state *conn_state, u32 out_bus_fmt) { +unsigned int i, num_in_bus_fmts =0 ;struct drm_bridge_state *cur_state; -unsigned int num_in_bus_fmts, i;struct drm_bridge *prev_bridge;u32 *in_bus_fmts;int ret;
@@ -945,7 +945,7 @@ drm_atomic_bridge_chain_select_bus_fmts(struct drm_bridge *bridge,struct drm_connector *conn = conn_state->connector;struct drm_encoder *encoder = bridge->encoder;struct drm_bridge_state *last_bridge_state; -unsigned int i, num_out_bus_fmts; +unsigned int i, num_out_bus_fmts =0 ;struct drm_bridge *last_bridge;u32 *out_bus_fmts;int ret =0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 298/717 drm/mipi-dsi: Detach devices when removing the host
In reply to Greg Kroah-HartmanFrom: Maxime Ripard <[email protected]>
[ Upstream commit 668a8f17b5290d04ef7343636a5588a0692731a1 ]
Whenever the MIPI-DSI host is unregistered, the code of mipi_dsi_host_unregister() loops over every device currently found on that bus and will unregister it.
However, it doesn't detach it from the bus first, which leads to all kind of resource leaks if the host wants to perform some clean up whenever a device is detached.
--- drivers/gpu/drm/drm_mipi_dsi.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_mipi_dsi.c +1 -0
@@ -346,6 +346,7 @@ static int mipi_dsi_remove_device_fn(struct device *dev, void *priv) {struct mipi_dsi_device *dsi =to_mipi_dsi_device (dev); +mipi_dsi_detach (dsi);mipi_dsi_device_unregister (dsi);return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 299/717 drm/bridge: it6505: Power on downstream device in .atomic_enable
In reply to Greg Kroah-HartmanFrom: Pin-Yen Lin <[email protected]>
[ Upstream commit fbc1fdaa8338ec4ebd862d918a0ce3e12033e8a3 ]
Send DPCD DP_SET_POWER_D0 command to the monitor in .atomic_enable callback. Without this command, some monitors won't show up again after changing the resolution.
--- drivers/gpu/drm/bridge/ite-it6505.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/bridge/ite-it6505.c +3 -0
@@ -2945,6 +2945,9 @@ static void it6505_bridge_atomic_enable(struct drm_bridge *bridge,if (ret)dev_err (dev,"Failed to setup AVI infoframe: %d" , ret); +it6505_drm_dp_link_set_power (&it6505->aux, &it6505->link, +DP_SET_POWER_D0 ); +it6505_update_video_parameter (it6505, mode); ret =it6505_send_video_infoframe (it6505, &frame);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 300/717 drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit 64b88afbd92fbf434759d1896a7cf705e1c00e79 ]
Previous commit fixed checking of the ERR_PTR value returned by drm_gem_shmem_get_sg_table(), but it missed to zero out the shmem->pages, which will crash virtio_gpu_cleanup_object(). Add the missing zeroing of the shmem->pages.
--- drivers/gpu/drm/virtio/virtgpu_object.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/virtio/virtgpu_object.c +1 -0
@@ -170,6 +170,7 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev, shmem->pages =drm_gem_shmem_get_sg_table (&bo->base);if (IS_ERR (shmem->pages)) {drm_gem_shmem_unpin (&bo->base); + shmem->pages =NULL ;return PTR_ERR (shmem->pages); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 301/717 drm/bridge: tc358767: Add of_node_put() when breaking out of loop
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 14e7157afb055248ed34901fcd6fbf54201cfea1 ]
In tc_probe_bridge_endpoint(), we should call of_node_put() when breaking out of the for_each_endpoint_of_node() which will automatically increase and decrease the refcount.
--- drivers/gpu/drm/bridge/tc358767.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/bridge/tc358767.c +3 -2
@@ -1986,9 +1986,10 @@ static int tc_probe_bridge_endpoint(struct tc_data *tc)for_each_endpoint_of_node (dev->of_node, node) {of_graph_parse_endpoint (node, &endpoint); -if (endpoint.port >2 ) +if (endpoint.port >2 ) { +of_node_put (node);return -EINVAL ; - + } mode |=BIT (endpoint.port); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 302/717 drm/bridge: parade-ps8640: Fix regulator supply order
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit fc94224c2e0ae8d83ac511a3ef4962178505469d ]
The datasheet says that VDD12 must be enabled and at full voltage before VDD33 is enabled.
Reorder the bulk regulator supply names so that VDD12 is enabled before VDD33. Any enable ramp delays should be handled by setting proper constraints on the regulators.
--- drivers/gpu/drm/bridge/parade-ps8640.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/bridge/parade-ps8640.c +2 -2
@@ -596,8 +596,8 @@ static int ps8640_probe(struct i2c_client *client)if (!ps_bridge)return -ENOMEM ; - ps_bridge->supplies[0 ].supply ="vdd33" ; - ps_bridge->supplies[1 ].supply ="vdd12" ; + ps_bridge->supplies[0 ].supply ="vdd12" ; + ps_bridge->supplies[1 ].supply ="vdd33" ; ret =devm_regulator_bulk_get (dev,ARRAY_SIZE (ps_bridge->supplies), ps_bridge->supplies);if (ret)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 303/717 drm/dp_mst: fix drm_dp_dpcd_read return value checks
In reply to Greg Kroah-HartmanFrom: Simon Ser <[email protected]>
[ Upstream commit 2ac6cdd581f48c8f68747156fde5868486a44985 ]
drm_dp_dpcd_read returns the number of bytes read. The previous code would print garbage on DPCD error, and would exit with on error on success.
--- drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/display/drm_dp_mst_topology.c +3 -3
@@ -4916,14 +4916,14 @@ void drm_dp_mst_dump_topology(struct seq_file *m,seq_printf (m,"dpcd: %*ph\n" ,DP_RECEIVER_CAP_SIZE , buf); ret =drm_dp_dpcd_read (mgr->aux,DP_FAUX_CAP , buf,2 ); -if (ret) { +if (ret !=2 ) {seq_printf (m,"faux/mst read failed\n" ); goto out; }seq_printf (m,"faux/mst: %*ph\n" ,2 , buf); ret =drm_dp_dpcd_read (mgr->aux,DP_MSTM_CTRL , buf,1 ); -if (ret) { +if (ret !=1 ) {seq_printf (m,"mst ctrl read failed\n" ); goto out; }
@@ -4931,7 +4931,7 @@ void drm_dp_mst_dump_topology(struct seq_file *m,/* dump the standard OUI branch header */ ret =drm_dp_dpcd_read (mgr->aux,DP_BRANCH_OUI , buf,DP_BRANCH_OUI_HEADER_SIZE ); -if (ret) { +if (ret !=DP_BRANCH_OUI_HEADER_SIZE ) {seq_printf (m,"branch oui read failed\n" ); goto out; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 304/717 drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit e0686dc6f2252e009c455fe99e2ce9d62a60eb47 ]
The reference 'child' in the iteration of for_each_available_child_of_node() is only escaped out into a local variable which is only used to check its value. So we still need to the of_node_put() when breaking of the for_each_available_child_of_node() which will automatically increase and decrease the refcount.
--- drivers/gpu/drm/pl111/pl111_versatile.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/pl111/pl111_versatile.c +1 -0
@@ -402,6 +402,7 @@ static int pl111_vexpress_clcd_init(struct device *dev, struct device_node *np,if (of_device_is_compatible (child,"arm,pl111" )) { has_coretile_clcd = true; ct_clcd = child; +of_node_put (child);break ; }if (of_device_is_compatible (child,"arm,hdlcd" )) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 305/717 ASoC: mt6359: fix tests for platform_get_irq() failure
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 51eea3a6fb4d39c2cc71824e6eee5949d7ae4d1c ]
The platform_get_irq() returns negative error codes. It can't actually return zero, but if it did that should be treated as success.
--- sound/soc/codecs/mt6359-accdet.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/mt6359-accdet.c +3 -3
@@ -965,7 +965,7 @@ static int mt6359_accdet_probe(struct platform_device *pdev)mutex_init (&priv->res_lock); priv->accdet_irq =platform_get_irq (pdev,0 ); -if (priv->accdet_irq) { +if (priv->accdet_irq >=0 ) { ret = devm_request_threaded_irq(&pdev->dev, priv->accdet_irq, NULL, mt6359_accdet_irq, IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
@@ -979,7 +979,7 @@ static int mt6359_accdet_probe(struct platform_device *pdev)if (priv->caps &ACCDET_PMIC_EINT0 ) { priv->accdet_eint0 =platform_get_irq (pdev,1 ); -if (priv->accdet_eint0) { +if (priv->accdet_eint0 >=0 ) { ret = devm_request_threaded_irq(&pdev->dev, priv->accdet_eint0, NULL, mt6359_accdet_irq,
@@ -994,7 +994,7 @@ static int mt6359_accdet_probe(struct platform_device *pdev) } }else if (priv->caps &ACCDET_PMIC_EINT1 ) { priv->accdet_eint1 =platform_get_irq (pdev,2 ); -if (priv->accdet_eint1) { +if (priv->accdet_eint1 >=0 ) { ret = devm_request_threaded_irq(&pdev->dev, priv->accdet_eint1, NULL, mt6359_accdet_irq,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 306/717 drm/msm: Make .remove and .shutdown HW shutdown consistent
In reply to Greg Kroah-HartmanFrom: Javier Martinez Canillas <[email protected]>
[ Upstream commit 0a58d2ae572adaec8d046f8d35b40c2c32ac7468 ]
Drivers' .remove and .shutdown callbacks are executed on different code paths. The former is called when a device is removed from the bus, while the latter is called at system shutdown time to quiesce the device.
This means that some overlap exists between the two, because both have to take care of properly shutting down the hardware. But currently the logic used in these two callbacks isn't consistent in msm drivers, which could lead to kernel panic.
For example, on .remove the component is deleted and its .unbind callback leads to the hardware being shutdown but only if the DRM device has been marked as registered.
That check doesn't exist in the .shutdown logic and this can lead to the driver calling drm_atomic_helper_shutdown() for a DRM device that hasn't been properly initialized.
A situation like this can happen if drivers for expected sub-devices fail to probe, since the .bind callback will never be executed. If that is the case, drm_atomic_helper_shutdown() will attempt to take mutexes that are only initialized if drm_mode_config_init() is called during a device bind.
This bug was attempted to be fixed in commit 623f279c7781 ("drm/msm: fix shutdown hook in case GPU components failed to bind"), but unfortunately it still happens in some cases as the one mentioned above, i.e:
systemd-shutdown[1]: Powering off.
kvm: exiting hardware virtualization
platform wifi-firmware.0: Removing from iommu group 12 platform video-firmware.0: Removing from iommu group 10
------------[ cut here ]------------
WARNING: CPU: 6 PID: 1 at drivers/gpu/drm/drm_modeset_lock.c:317 drm_modeset_lock_all_ctx+0x3c4/0x3d0
...
Hardware name: Google CoachZ (rev3+) (DT)
pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : drm_modeset_lock_all_ctx+0x3c4/0x3d0
lr : drm_modeset_lock_all_ctx+0x48/0x3d0
sp : ffff80000805bb80
x29: ffff80000805bb80 x28: ffff327c00128000 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000001 x24: ffffc95d820ec030
x23: ffff327c00bbd090 x22: ffffc95d8215eca0 x21: ffff327c039c5800
x20: ffff327c039c5988 x19: ffff80000805bbe8 x18: 0000000000000034
x17: 000000040044ffff x16: ffffc95d80cac920 x15: 0000000000000000
x14: 0000000000000315 x13: 0000000000000315 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff80000805bc28 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : ffff327c00128000 x1 : 0000000000000000 x0 : ffff327c039c59b0
Call trace:
drm_modeset_lock_all_ctx+0x3c4/0x3d0
drm_atomic_helper_shutdown+0x70/0x134
msm_drv_shutdown+0x30/0x40
platform_shutdown+0x28/0x40
device_shutdown+0x148/0x350
kernel_power_off+0x38/0x80
__do_sys_reboot+0x288/0x2c0
__arm64_sys_reboot+0x28/0x34
invoke_syscall+0x48/0x114
el0_svc_common.constprop.0+0x44/0xec
do_el0_svc+0x2c/0xc0
el0_svc+0x2c/0x84
el0t_64_sync_handler+0x11c/0x150
el0t_64_sync+0x18c/0x190
---[ end trace 0000000000000000 ]---
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010eab1000
[0000000000000018] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
...
Hardware name: Google CoachZ (rev3+) (DT)
pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ww_mutex_lock+0x28/0x32c
lr : drm_modeset_lock_all_ctx+0x1b0/0x3d0
sp : ffff80000805bb50
x29: ffff80000805bb50 x28: ffff327c00128000 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000001 x24: 0000000000000018
x23: ffff80000805bc10 x22: ffff327c039c5ad8 x21: ffff327c039c5800
x20: ffff80000805bbe8 x19: 0000000000000018 x18: 0000000000000034
x17: 000000040044ffff x16: ffffc95d80cac920 x15: 0000000000000000
x14: 0000000000000315 x13: 0000000000000315 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff80000805bc28 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : ffff327c00128000 x1 : 0000000000000000 x0 : 0000000000000018
Call trace:
ww_mutex_lock+0x28/0x32c
drm_modeset_lock_all_ctx+0x1b0/0x3d0
drm_atomic_helper_shutdown+0x70/0x134
msm_drv_shutdown+0x30/0x40
platform_shutdown+0x28/0x40
device_shutdown+0x148/0x350
kernel_power_off+0x38/0x80
__do_sys_reboot+0x288/0x2c0
__arm64_sys_reboot+0x28/0x34
invoke_syscall+0x48/0x114
el0_svc_common.constprop.0+0x44/0xec
do_el0_svc+0x2c/0xc0
el0_svc+0x2c/0x84
el0t_64_sync_handler+0x11c/0x150
el0t_64_sync+0x18c/0x190
Code: aa0103f4 d503201f d2800001 aa0103e3 (c8e37c02)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
Kernel Offset: 0x495d77c00000 from 0xffff800008000000
PHYS_OFFSET: 0xffffcd8500000000
CPU features: 0x800,00c2a015,19801c82
Memory Limit: none
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]------ drivers/gpu/drm/msm/msm_drv.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/msm_drv.c +9 -4
@@ -1169,10 +1169,15 @@ void msm_drv_shutdown(struct platform_device *pdev)struct msm_drm_private *priv =platform_get_drvdata (pdev);struct drm_device *drm = priv ? priv->dev :NULL ; -if (!priv || !priv->kms) -return ; - -drm_atomic_helper_shutdown (drm); +/* +* Shutdown the hw if we're far enough along where things might be on. +* If we run this too early, we'll end up panicking in any variety of +* places. Since we don't register the drm device until late in +* msm_drm_init, drm_dev->registered is used as an indicator that the +* shutdown will be successful. +*/ +if (drm && drm->registered) +drm_atomic_helper_shutdown (drm); }static struct platform_driver msm_platform_driver = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 307/717 platform/chrome: fix double-free in chromeos_laptop_prepare()
In reply to Greg Kroah-HartmanFrom: Rustam Subkhankulov <[email protected]>
[ Upstream commit 6ad4194d6a1e1d11b285989cd648ef695b4a93c0 ]
If chromeos_laptop_prepare_i2c_peripherals() fails after allocating memory for 'cros_laptop->i2c_peripherals', this memory is freed at 'err_out' label and nonzero value is returned. Then chromeos_laptop_destroy() is called, resulting in double-free error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/platform/chrome/chromeos_laptop.c | 24 ++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
drivers/platform/chrome/chromeos_laptop.c +13 -11
@@ -740,6 +740,7 @@ static int __init chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop, const struct chromeos_laptop *src) { + struct i2c_peripheral *i2c_peripherals;struct i2c_peripheral *i2c_dev;struct i2c_board_info *info;int i;
@@ -748,17 +749,15 @@ chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop,if (!src->num_i2c_peripherals)return 0 ; - cros_laptop->i2c_peripherals =kmemdup (src->i2c_peripherals, - src->num_i2c_peripherals * -sizeof (*src->i2c_peripherals), -GFP_KERNEL ); -if (!cros_laptop->i2c_peripherals) + i2c_peripherals =kmemdup (src->i2c_peripherals, + src->num_i2c_peripherals * +sizeof (*src->i2c_peripherals), +GFP_KERNEL ); +if (!i2c_peripherals)return -ENOMEM ; - cros_laptop->num_i2c_peripherals = src->num_i2c_peripherals; - -for (i =0 ; i < cros_laptop->num_i2c_peripherals; i++) { - i2c_dev = &cros_laptop->i2c_peripherals[i]; +for (i =0 ; i < src->num_i2c_peripherals; i++) { + i2c_dev = &i2c_peripherals[i]; info = &i2c_dev->board_info; error =chromeos_laptop_setup_irq (i2c_dev);
@@ -775,16 +774,19 @@ chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop, } } + cros_laptop->i2c_peripherals = i2c_peripherals; + cros_laptop->num_i2c_peripherals = src->num_i2c_peripherals; +return 0 ; err_out:while (--i >=0 ) { - i2c_dev = &cros_laptop->i2c_peripherals[i]; + i2c_dev = &i2c_peripherals[i]; info = &i2c_dev->board_info;if (!IS_ERR_OR_NULL (info->fwnode))fwnode_remove_software_node (info->fwnode); } -kfree (cros_laptop->i2c_peripherals); +kfree (i2c_peripherals);return error; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 308/717 platform/chrome: fix memory corruption in ioctl
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 8a07b45fd3c2dda24fad43639be5335a4595196a ]
If "s_mem.bytes" is larger than the buffer size it leads to memory corruption.
--- drivers/platform/chrome/cros_ec_chardev.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/chrome/cros_ec_chardev.c +3 -0
@@ -327,6 +327,9 @@ static long cros_ec_chardev_ioctl_readmem(struct cros_ec_dev *ec,if (copy_from_user (&s_mem, arg,sizeof (s_mem)))return -EFAULT ; +if (s_mem.bytes >sizeof (s_mem.buffer)) +return -EINVAL ; + num = ec_dev->cmd_readmem (ec_dev, s_mem.offset, s_mem.bytes, s_mem.buffer);if (num <=0 )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 309/717 drm/virtio: Fix same-context optimization
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
[ Upstream commit 3007dc2af6e86ac00b4daf7414142637fdf50bfa ]
When VIRTGPU_EXECBUF_RING_IDX is used, we should be considering the timeline that the EB if running on rather than the global driver fence context.
--- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/virtio/virtgpu_ioctl.c +1 -1
@@ -168,7 +168,7 @@ static int virtio_gpu_execbuffer_ioctl(struct drm_device *dev, void *data,* array contains any fence from a foreign context. */ ret =0 ; -if (!dma_fence_match_context (in_fence, vgdev->fence_drv.context)) +if (!dma_fence_match_context (in_fence, fence_ctx + ring_idx)) ret =dma_fence_wait (in_fence, true);dma_fence_put (in_fence);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 310/717 ASoC: soc-pcm.c: call __soc_pcm_close() in soc_pcm_close()
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
[ Upstream commit 6bbabd28805f36baf6d0f3eb082db032a638f612 ]
commit b7898396f4bbe16 ("ASoC: soc-pcm: Fix and cleanup DPCM locking") added __soc_pcm_close() for non-lock version of soc_pcm_close(). But soc_pcm_close() is not using it. It is no problem, but confusable.
static int __soc_pcm_close(...)
{
=> return soc_pcm_clean(rtd, substream, 0);
}
static int soc_pcm_close(...)
{
...
snd_soc_dpcm_mutex_lock(rtd);
=> soc_pcm_clean(rtd, substream, 0);
snd_soc_dpcm_mutex_unlock(rtd);
return 0;
}This patch use it.
--- sound/soc/soc-pcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-pcm.c +1 -1
@@ -723,7 +723,7 @@ static int soc_pcm_close(struct snd_pcm_substream *substream)struct snd_soc_pcm_runtime *rtd =asoc_substream_to_rtd (substream);snd_soc_dpcm_mutex_lock (rtd); -soc_pcm_clean (rtd, substream,0 ); +__soc_pcm_close (rtd, substream);snd_soc_dpcm_mutex_unlock (rtd);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 311/717 ASoC: tas2764: Allow mono streams
In reply to Greg Kroah-HartmanFrom: Martin Povišer <[email protected]>
[ Upstream commit 23204d928a27146d13e11c9383632775345ecca8 ]
The part is a mono speaker amp, but it can do downmix and switch between left and right channel, so the right channel range is 1 to 2.
(This mirrors commit bf54d97a835d ("ASoC: tas2770: Allow mono streams") which was a fix to the tas2770 driver.)
--- sound/soc/codecs/tas2764.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/tas2764.c +1 -1
@@ -485,7 +485,7 @@ static struct snd_soc_dai_driver tas2764_dai_driver[] = { .id = 0, .playback = { .stream_name = "ASI1 Playback", - .channels_min = 2, + .channels_min = 1, .channels_max = 2, .rates = TAS2764_RATES, .formats = TAS2764_FORMATS,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 312/717 ASoC: tas2764: Drop conflicting set_bias_level power setting
In reply to Greg Kroah-HartmanFrom: Martin Povišer <[email protected]>
[ Upstream commit 09273f38832406db19a8907a934687cc10660a6b ]
The driver is setting the PWR_CTRL field in both the set_bias_level callback and on DAPM events of the DAC widget (and also in the mute_stream method). Drop the set_bias_level callback altogether as the power setting it does is in conflict with the other code paths.
(This mirrors commit c8a6ae3fe1c8 ("ASoC: tas2770: Drop conflicting set_bias_level power setting") which was a fix to the tas2770 driver.)
--- sound/soc/codecs/tas2764.c | 33 --------------------------------- 1 file changed, 33 deletions(-)
sound/soc/codecs/tas2764.c +0 -33
@@ -50,38 +50,6 @@ static void tas2764_reset(struct tas2764_priv *tas2764)usleep_range (1000 ,2000 ); } -static int tas2764_set_bias_level (struct snd_soc_component *component, -enum snd_soc_bias_level level) -{ -struct tas2764_priv *tas2764 =snd_soc_component_get_drvdata (component); - -switch (level) { -case SND_SOC_BIAS_ON : -snd_soc_component_update_bits (component,TAS2764_PWR_CTRL , -TAS2764_PWR_CTRL_MASK , -TAS2764_PWR_CTRL_ACTIVE ); -break ; -case SND_SOC_BIAS_STANDBY : -case SND_SOC_BIAS_PREPARE : -snd_soc_component_update_bits (component,TAS2764_PWR_CTRL , -TAS2764_PWR_CTRL_MASK , -TAS2764_PWR_CTRL_MUTE ); -break ; -case SND_SOC_BIAS_OFF : -snd_soc_component_update_bits (component,TAS2764_PWR_CTRL , -TAS2764_PWR_CTRL_MASK , -TAS2764_PWR_CTRL_SHUTDOWN ); -break ; - -default : -dev_err (tas2764->dev, -"wrong power level setting %d\n" , level); -return -EINVAL ; - } - -return 0 ; -} -#ifdef CONFIG_PM static int tas2764_codec_suspend (struct snd_soc_component *component) {
@@ -549,7 +517,6 @@ static const struct snd_soc_component_driver soc_component_driver_tas2764 = { .probe = tas2764_codec_probe, .suspend = tas2764_codec_suspend, .resume = tas2764_codec_resume, - .set_bias_level = tas2764_set_bias_level, .controls = tas2764_snd_controls, .num_controls = ARRAY_SIZE(tas2764_snd_controls), .dapm_widgets = tas2764_dapm_widgets,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 313/717 ASoC: tas2764: Fix mute/unmute
In reply to Greg Kroah-HartmanFrom: Martin Povišer <[email protected]>
[ Upstream commit f5ad67f13623548e5aff847f89700c178aaf2a98 ]
Because the PWR_CTRL field is modeled as the power state of the DAC widget, and at the same time it is used to implement mute/unmute, we need some additional book-keeping to have the right end result no matter the sequence of calls. Without this fix, one permanently mutes an ongoing stream by toggling the associated speaker pin control.
(This mirrors commit 1e5907bcb3a3 ("ASoC: tas2770: Fix handling of mute/unmute") which was a fix to the tas2770 driver.)
--- sound/soc/codecs/tas2764.c | 57 +++++++++++++++++++++----------------- 1 file changed, 32 insertions(+), 25 deletions(-)
sound/soc/codecs/tas2764.c +32 -25
@@ -34,6 +34,9 @@ struct tas2764_priv {int v_sense_slot;int i_sense_slot; + +bool dac_powered; +bool unmuted; };static void tas2764_reset (struct tas2764_priv *tas2764)
@@ -50,6 +53,26 @@ static void tas2764_reset(struct tas2764_priv *tas2764)usleep_range (1000 ,2000 ); } +static int tas2764_update_pwr_ctrl (struct tas2764_priv *tas2764) +{ +struct snd_soc_component *component = tas2764->component; +unsigned int val; +int ret; + +if (tas2764->dac_powered) + val = tas2764->unmuted ? +TAS2764_PWR_CTRL_ACTIVE :TAS2764_PWR_CTRL_MUTE ; +else + val =TAS2764_PWR_CTRL_SHUTDOWN ; + + ret =snd_soc_component_update_bits (component,TAS2764_PWR_CTRL , +TAS2764_PWR_CTRL_MASK , val); +if (ret <0 ) +return ret; + +return 0 ; +} +#ifdef CONFIG_PM static int tas2764_codec_suspend (struct snd_soc_component *component) {
@@ -82,9 +105,7 @@ static int tas2764_codec_resume(struct snd_soc_component *component)usleep_range (1000 ,2000 ); } - ret =snd_soc_component_update_bits (component,TAS2764_PWR_CTRL , -TAS2764_PWR_CTRL_MASK , -TAS2764_PWR_CTRL_ACTIVE ); + ret =tas2764_update_pwr_ctrl (tas2764);if (ret <0 )return ret;
@@ -118,14 +139,12 @@ static int tas2764_dac_event(struct snd_soc_dapm_widget *w,switch (event) {case SND_SOC_DAPM_POST_PMU : - ret =snd_soc_component_update_bits (component,TAS2764_PWR_CTRL , -TAS2764_PWR_CTRL_MASK , -TAS2764_PWR_CTRL_MUTE ); + tas2764->dac_powered = true; + ret =tas2764_update_pwr_ctrl (tas2764);break ;case SND_SOC_DAPM_PRE_PMD : - ret =snd_soc_component_update_bits (component,TAS2764_PWR_CTRL , -TAS2764_PWR_CTRL_MASK , -TAS2764_PWR_CTRL_SHUTDOWN ); + tas2764->dac_powered = false; + ret =tas2764_update_pwr_ctrl (tas2764);break ;default :dev_err (tas2764->dev,"Unsupported event\n" );
@@ -170,17 +189,11 @@ static const struct snd_soc_dapm_route tas2764_audio_map[] = {static int tas2764_mute (struct snd_soc_dai *dai,int mute,int direction) { -struct snd_soc_component *component = dai->component; -int ret; - - ret =snd_soc_component_update_bits (component,TAS2764_PWR_CTRL , -TAS2764_PWR_CTRL_MASK , - mute ?TAS2764_PWR_CTRL_MUTE :0 ); +struct tas2764_priv *tas2764 = +snd_soc_component_get_drvdata (dai->component); -if (ret <0 ) -return ret; - -return 0 ; + tas2764->unmuted = !mute; +return tas2764_update_pwr_ctrl (tas2764); }static int tas2764_set_bitwidth (struct tas2764_priv *tas2764,int bitwidth)
@@ -494,12 +507,6 @@ static int tas2764_codec_probe(struct snd_soc_component *component)if (ret <0 )return ret; - ret =snd_soc_component_update_bits (component,TAS2764_PWR_CTRL , -TAS2764_PWR_CTRL_MASK , -TAS2764_PWR_CTRL_MUTE ); -if (ret <0 ) -return ret; -return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 314/717 platform/x86: msi-laptop: Fix old-ec check for backlight registering
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 83ac7a1c2ed5f17caa07cbbc84bad3c05dc3bf22 ]
Commit 2cc6c717799f ("msi-laptop: Port to new backlight interface selection API") replaced this check:
if (!quirks->old_ec_model || acpi_video_backlight_support())
pr_info("Brightness ignored, ...");
else
do_register();With:
if (quirks->old_ec_model || acpi_video_get_backlight_type() == acpi_backlight_vendor) do_register();
But since the do_register() part was part of the else branch, the entire condition should be inverted. So not only the 2 statements on either side of the || should be inverted, but the || itself should be replaced with a &&.
In practice this has likely not been an issue because the new-ec models (old_ec_model==false) likely all support ACPI video backlight control, making acpi_video_get_backlight_type() return acpi_backlight_video turning the second part of the || also false when old_ec_model == false.
--- drivers/platform/x86/msi-laptop.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/platform/x86/msi-laptop.c +1 -2
@@ -1048,8 +1048,7 @@ static int __init msi_init(void)return -EINVAL ;/* Register backlight stuff */ - -if (quirks->old_ec_model || +if (quirks->old_ec_model &&acpi_video_get_backlight_type () == acpi_backlight_vendor) {struct backlight_properties props;memset (&props,0 ,sizeof (struct backlight_properties ));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 315/717 platform/x86: msi-laptop: Fix resource cleanup
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 5523632aa10f906dfe2eb714ee748590dc7fc6b1 ]
Fix the input-device not getting free-ed on probe-errors and fix the msi_touchpad_dwork not getting cancelled on neither probe-errors nor on remove.
--- drivers/platform/x86/msi-laptop.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/x86/msi-laptop.c +3 -0
@@ -1116,6 +1116,8 @@ static int __init msi_init(void) fail_create_group:if (quirks->load_scm_model) {i8042_remove_filter (msi_laptop_i8042_filter); +cancel_delayed_work_sync (&msi_touchpad_dwork); +input_unregister_device (msi_laptop_input_dev);cancel_delayed_work_sync (&msi_rfkill_dwork);cancel_work_sync (&msi_rfkill_work);rfkill_cleanup ();
@@ -1136,6 +1138,7 @@ static void __exit msi_cleanup(void) {if (quirks->load_scm_model) {i8042_remove_filter (msi_laptop_i8042_filter); +cancel_delayed_work_sync (&msi_touchpad_dwork);input_unregister_device (msi_laptop_input_dev);cancel_delayed_work_sync (&msi_rfkill_dwork);cancel_work_sync (&msi_rfkill_work);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 316/717 platform/chrome: cros_ec_typec: Correct alt mode index
In reply to Greg Kroah-HartmanFrom: Prashant Malani <[email protected]>
[ Upstream commit 4e477663e396f48c5cfc5f2d75d4b514f409516a ]
Alt mode indices used by USB PD (Power Delivery) start with 1, not 0.
Update the alt mdoe registration code to factor this in to the alt mode descriptor.
--- drivers/platform/chrome/cros_ec_typec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/chrome/cros_ec_typec.c +1 -1
@@ -669,7 +669,7 @@ static int cros_typec_register_altmodes(struct cros_typec_data *typec, int port_for (j =0 ; j < sop_disc->svids[i].mode_count; j++) {memset (&desc,0 ,sizeof (desc)); desc.svid = sop_disc->svids[i].svid; - desc.mode = j; + desc.mode = j +1 ; desc.vdo = sop_disc->svids[i].mode_vdo[j];if (is_partner)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 317/717 drm/amdgpu: add missing pci_disable_device() in amdgpu_pmops_runtime_resume()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 6b11af6d1c8f5d4135332bb932baaa06e511173d ]
Add missing pci_disable_device() if amdgpu_device_resume() fails.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +4 -1
@@ -2548,8 +2548,11 @@ static int amdgpu_pmops_runtime_resume(struct device *dev)amdgpu_device_baco_exit (drm_dev); } ret =amdgpu_device_resume (drm_dev, false); -if (ret) +if (ret) { +if (amdgpu_device_supports_px (drm_dev)) +pci_disable_device (pdev);return ret; + }if (amdgpu_device_supports_px (drm_dev)) drm_dev->switch_power_state =DRM_SWITCH_POWER_ON ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 318/717 drm/bridge: megachips: Fix a null pointer dereference bug
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 1ff673333d46d2c1b053ebd0c1c7c7c79e36943e ]
When removing the module we will get the following warning:
[ 31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered [ 31.912484] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI [ 31.913338] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130 [ 31.921825] Call Trace: [ 31.922533] stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw] [ 31.923139] i2c_device_remove+0x181/0x1f0
The two bridges (stdp2690, stdp4028) do not probe at the same time, so the driver does not call ge_b850v3_resgiter() when probing, causing the driver to try to remove the object that has not been initialized.
Fix this by checking whether both the bridges are probed.
--- drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +3 -1
@@ -296,7 +296,9 @@ static void ge_b850v3_lvds_remove(void)* This check is to avoid both the drivers * removing the bridge in their remove() function */ -if (!ge_b850v3_lvds_ptr) +if (!ge_b850v3_lvds_ptr || + !ge_b850v3_lvds_ptr->stdp2690_i2c || + !ge_b850v3_lvds_ptr->stdp4028_i2c) goto out;drm_bridge_remove (&ge_b850v3_lvds_ptr->bridge);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 319/717 drm/bridge: it6505: Fix the order of DP_SET_POWER commands
In reply to Greg Kroah-HartmanFrom: Pin-yen Lin <[email protected]>
[ Upstream commit 7c1dceaffd99247bf443606730515b54d6285969 ]
Send DP_SET_POWER_D3 command to the downstream before stopping DP, so the suspend process will not be interrupted by the HPD interrupt. Also modify the order in .atomic_enable callback to make the callbacks symmetric.
--- drivers/gpu/drm/bridge/ite-it6505.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/bridge/ite-it6505.c +4 -4
@@ -2945,9 +2945,6 @@ static void it6505_bridge_atomic_enable(struct drm_bridge *bridge,if (ret)dev_err (dev,"Failed to setup AVI infoframe: %d" , ret); -it6505_drm_dp_link_set_power (&it6505->aux, &it6505->link, -DP_SET_POWER_D0 ); -it6505_update_video_parameter (it6505, mode); ret =it6505_send_video_infoframe (it6505, &frame);
@@ -2957,6 +2954,9 @@ static void it6505_bridge_atomic_enable(struct drm_bridge *bridge,it6505_int_mask_enable (it6505);it6505_video_reset (it6505); + +it6505_drm_dp_link_set_power (&it6505->aux, &it6505->link, +DP_SET_POWER_D0 ); } static void it6505_bridge_atomic_disable(struct drm_bridge *bridge,
@@ -2968,9 +2968,9 @@ static void it6505_bridge_atomic_disable(struct drm_bridge *bridge,DRM_DEV_DEBUG_DRIVER (dev,"start" );if (it6505->powered) { -it6505_video_disable (it6505);it6505_drm_dp_link_set_power (&it6505->aux, &it6505->link,DP_SET_POWER_D3 ); +it6505_video_disable (it6505); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 320/717 ASoC: rsnd: Add check for rsnd_mod_power_on
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 376be51caf8871419bbcbb755e1e615d30dc3153 ]
As rsnd_mod_power_on() can return negative numbers, it should be better to check the return value and deal with the exception.
--- sound/soc/sh/rcar/ctu.c | 6 +++++- sound/soc/sh/rcar/dvc.c | 6 +++++- sound/soc/sh/rcar/mix.c | 6 +++++- sound/soc/sh/rcar/src.c | 5 ++++- sound/soc/sh/rcar/ssi.c | 4 +++- 5 files changed, 22 insertions(+), 5 deletions(-)
sound/soc/sh/rcar/ctu.c +5 -1
@@ -171,7 +171,11 @@ static int rsnd_ctu_init(struct rsnd_mod *mod,struct rsnd_dai_stream *io, struct rsnd_priv *priv) { -rsnd_mod_power_on (mod ); + int ret; + + ret =rsnd_mod_power_on (mod); +if (ret <0 ) +return ret;rsnd_ctu_activation (mod);
sound/soc/sh/rcar/dvc.c +5 -1
@@ -186,7 +186,11 @@ static int rsnd_dvc_init(struct rsnd_mod *mod,struct rsnd_dai_stream *io, struct rsnd_priv *priv) { -rsnd_mod_power_on (mod ); + int ret; + + ret =rsnd_mod_power_on (mod); +if (ret <0 ) +return ret;rsnd_dvc_activation (mod);
sound/soc/sh/rcar/mix.c +5 -1
@@ -146,7 +146,11 @@ static int rsnd_mix_init(struct rsnd_mod *mod,struct rsnd_dai_stream *io, struct rsnd_priv *priv) { -rsnd_mod_power_on (mod ); + int ret; + + ret =rsnd_mod_power_on (mod); +if (ret <0 ) +return ret;rsnd_mix_activation (mod);
sound/soc/sh/rcar/src.c +4 -1
@@ -463,11 +463,14 @@ static int rsnd_src_init(struct rsnd_mod *mod, struct rsnd_priv *priv) {struct rsnd_src *src =rsnd_mod_to_src (mod); +int ret;/* reset sync convert_rate */ src->sync.val =0 ; -rsnd_mod_power_on (mod); + ret =rsnd_mod_power_on (mod); +if (ret <0 ) +return ret;rsnd_src_activation (mod);
sound/soc/sh/rcar/ssi.c +3 -1
@@ -480,7 +480,9 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, ssi->usrcnt++; -rsnd_mod_power_on (mod); + ret =rsnd_mod_power_on (mod); +if (ret <0 ) +return ret;rsnd_ssi_config_init (mod, io);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 321/717 ASoC: wm_adsp: Handle optional legacy support
In reply to Greg Kroah-HartmanFrom: Cristian Ciocaltea <[email protected]>
[ Upstream commit 35c8ae25c4fdeabf490e005692795a3be17ca5f6 ]
The tracing capabilities for the speaker protection fw enabled via commit c55b3e46cb99 ("ASoC: wm_adsp: Add trace caps to speaker protection FW") are not be available on all platforms, such as the Valve's Steam Deck which is based on the Halo Core DSP.
As a consequence, whenever the firmware is loaded, a rather misleading 'Failed to parse legacy: -19' error message is written to the kernel ring buffer:
[ 288.977412] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: Firmware version: 3 [ 288.978002] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: cs35l41-dsp1-spk-prot.wmfw: Fri 02 Apr 2021 21:03:50 W. Europe Daylight Time [ 289.094065] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: Firmware: 400a4 vendor: 0x2 v0.33.0, 2 algorithms [ 289.095073] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: 0: ID cd v29.53.0 XM@94 YM@e [ 289.095665] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: 1: ID f20b v0.0.1 XM@170 YM@0 [ 289.096275] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: Protection: C:\Users\ocanavan\Desktop\cirrusTune_july2021.bin [ 291.172383] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: Failed to parse legacy: -19
Update wm_adsp_buffer_init() to print a more descriptive info message when wm_adsp_buffer_parse_legacy() returns -ENODEV.
--- sound/soc/codecs/wm_adsp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/codecs/wm_adsp.c +3 -1
@@ -1617,7 +1617,9 @@ static int wm_adsp_buffer_init(struct wm_adsp *dsp)if (list_empty (&dsp->buffer_list)) {/* Fall back to legacy support */ ret =wm_adsp_buffer_parse_legacy (dsp); -if (ret) +if (ret == -ENODEV ) +adsp_info (dsp,"Legacy support not available\n" ); +else if (ret)adsp_warn (dsp,"Failed to parse legacy: %d\n" , ret); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 322/717 ALSA: hda: beep: Simplify keep-power-at-enable behavior
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 4c8d695cb9bc5f6fd298a586602947b2fc099a64 ]
The recent fix for IDT codecs to keep the power up while the beep is enabled can be better integrated into the beep helper code. This patch cleans up the code with refactoring.
--- sound/pci/hda/hda_beep.c | 15 +++++++++++++-- sound/pci/hda/hda_beep.h | 1 + sound/pci/hda/patch_sigmatel.c | 25 ++----------------------- 3 files changed, 16 insertions(+), 25 deletions(-)
sound/pci/hda/hda_beep.c +13 -2
@@ -118,6 +118,12 @@ static int snd_hda_beep_event(struct input_dev *dev, unsigned int type,return 0 ; } +static void turn_on_beep (struct hda_beep *beep) +{ +if (beep->keep_power_at_enable) +snd_hda_power_up_pm (beep->codec); +} +static void turn_off_beep (struct hda_beep *beep) {cancel_work_sync (&beep->beep_work);
@@ -125,6 +131,8 @@ static void turn_off_beep(struct hda_beep *beep)/* turn off beep */ generate_tone (beep,0 ); } +if (beep->keep_power_at_enable) +snd_hda_power_down_pm (beep->codec); }/**
@@ -140,7 +148,9 @@ int snd_hda_enable_beep_device(struct hda_codec *codec, int enable) enable = !!enable;if (beep->enabled != enable) { beep->enabled = enable; -if (!enable) +if (enable) +turn_on_beep (beep); +else turn_off_beep (beep);return 1 ; }
@@ -167,7 +177,8 @@ static int beep_dev_disconnect(struct snd_device *device)input_unregister_device (beep->dev); else input_free_device(beep->dev); -turn_off_beep (beep); +if (beep->enabled) +turn_off_beep (beep);return 0 ; }
sound/pci/hda/hda_beep.h +1 -0
@@ -25,6 +25,7 @@ struct hda_beep { unsigned int enabled:1; unsigned int linear_tone:1; /* linear tone for IDT/STAC codec */ unsigned int playing:1; + unsigned int keep_power_at_enable:1; /* set by driver */struct work_struct beep_work;/* scheduled task for beep event */ struct mutex mutex;void (*power_hook)(struct hda_beep *beep,bool on);
sound/pci/hda/patch_sigmatel.c +2 -23
@@ -4311,6 +4311,8 @@ static int stac_parse_auto_config(struct hda_codec *codec)if (codec->beep) {/* IDT/STAC codecs have linear beep tone parameter */ codec->beep->linear_tone = spec->linear_tone_beep; +/* keep power up while beep is enabled */ + codec->beep->keep_power_at_enable =1 ;/* if no beep switch is available, make its own one */ caps =query_amp_caps (codec, nid,HDA_OUTPUT );if (!(caps &AC_AMPCAP_MUTE )) {
@@ -4444,28 +4446,6 @@ static int stac_suspend(struct hda_codec *codec) return 0; } - -static int stac_check_power_status (struct hda_codec *codec,hda_nid_t nid) -{ -#ifdef CONFIG_SND_HDA_INPUT_BEEP -struct sigmatel_spec *spec = codec->spec; -#endif -int ret =snd_hda_gen_check_power_status (codec, nid); - -#ifdef CONFIG_SND_HDA_INPUT_BEEP -if (nid == spec->gen.beep_nid && codec->beep) { -if (codec->beep->enabled != spec->beep_power_on) { - spec->beep_power_on = codec->beep->enabled; -if (spec->beep_power_on) -snd_hda_power_up_pm (codec); -else -snd_hda_power_down_pm (codec); - } - ret |= spec->beep_power_on; - } -#endif -return ret; -}#else #define stac_suspend NULL#endif /* CONFIG_PM */
@@ -4478,7 +4458,6 @@ static const struct hda_codec_ops stac_patch_ops = { .unsol_event = snd_hda_jack_unsol_event, #ifdef CONFIG_PM .suspend = stac_suspend, - .check_power_status = stac_check_power_status,#endif };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 323/717 drm/virtio: set fb_modifiers_not_supported
In reply to Greg Kroah-HartmanFrom: Chia-I Wu <[email protected]>
[ Upstream commit 85faca8ca0f659263b5fb2385e4c231cc075bd84 ]
Without this, the drm core advertises LINEAR modifier which is incorrect.
Also userspace virgl does not support modifiers. For example, it causes chrome on ozone/drm to fail with "Failed to create scanout buffer".
--- drivers/gpu/drm/virtio/virtgpu_display.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/virtio/virtgpu_display.c +2 -0
@@ -348,6 +348,8 @@ int virtio_gpu_modeset_init(struct virtio_gpu_device *vgdev) vgdev->ddev->mode_config.max_width =XRES_MAX ; vgdev->ddev->mode_config.max_height =YRES_MAX ; + vgdev->ddev->mode_config.fb_modifiers_not_supported = true; +for (i =0 ; i < vgdev->num_scanouts; ++i)vgdev_output_init (vgdev, i);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 324/717 drm/bochs: fix blanking
In reply to Greg Kroah-HartmanFrom: Gerd Hoffmann <[email protected]>
[ Upstream commit e740ceb53e4579a7a4063712cebecac3c343b189 ]
VGA_IS1_RC is the color mode register (VGA_IS1_RM the one for monochrome mode, note C vs. M at the end). So when using VGA_IS1_RC make sure the vga device is actually in color mode and set the corresponding bit in the misc register.
Reproducible when booting VMs in UEFI mode with some edk2 versions (edk2 fix is on the way too). Doesn't happen in BIOS mode because in that case the vgabios already flips the bit.
--- drivers/gpu/drm/tiny/bochs.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/tiny/bochs.c +2 -0
@@ -306,6 +306,8 @@ static void bochs_hw_fini(struct drm_device *dev)static void bochs_hw_blank (struct bochs_device *bochs,bool blank) {DRM_DEBUG_DRIVER ("hw_blank %d\n" , blank); +/* enable color bit (so VGA_IS1_RC access works) */ +bochs_vga_writeb (bochs,VGA_MIS_W ,VGA_MIS_COLOR );/* discard ar_flip_flop */ (void )bochs_vga_readb (bochs,VGA_IS1_RC );/* blank or unblank; we need only update index and set 0x20 */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 325/717 ASoC: SOF: mediatek: mt8195: Import namespace SND_SOC_SOF_MTK_COMMON
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 404bec4c8f6c38ae5fa208344f1086d38026e93d ]
Here we're using function mtk_adsp_dump() from mtk-adsp-common:
explicitly import its namespace.
--- sound/soc/sof/mediatek/mt8195/mt8195.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/sof/mediatek/mt8195/mt8195.c +1 -0
@@ -634,4 +634,5 @@ static struct platform_driver snd_sof_of_mt8195_driver = {module_platform_driver (snd_sof_of_mt8195_driver);MODULE_IMPORT_NS (SND_SOC_SOF_XTENSA ); +MODULE_IMPORT_NS (SND_SOC_SOF_MTK_COMMON );MODULE_LICENSE ("Dual BSD/GPL" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 326/717 drm/omap: dss: Fix refcount leak bugs
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 8b42057e62120813ebe9274f508fa785b7cab33a ]
In dss_init_ports() and __dss_uninit_ports(), we should call of_node_put() for the reference returned by of_graph_get_port_by_id() in fail path or when it is not used anymore.
--- drivers/gpu/drm/omapdrm/dss/dss.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/omapdrm/dss/dss.c +3 -0
@@ -1176,6 +1176,7 @@ static void __dss_uninit_ports(struct dss_device *dss, unsigned int num_ports)default :break ; } +of_node_put (port); } }
@@ -1208,11 +1209,13 @@ static int dss_init_ports(struct dss_device *dss)default :break ; } +of_node_put (port); }return 0 ; error: +of_node_put (port);__dss_uninit_ports (dss, i);return r; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 327/717 drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue()
In reply to Greg Kroah-HartmanFrom: Rafael Mendonca <[email protected]>
[ Upstream commit 7136f956c73c4ba50bfeb61653dfd6a9669ea915 ]
If construction of the array of work queues to handle hpd_rx_irq offload work fails, we need to unwind. Destroy all the created workqueues and the allocated memory for the hpd_rx_irq_offload_work_queue struct array.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +9 -1
@@ -1363,13 +1363,21 @@ static struct hpd_rx_irq_offload_work_queue *hpd_rx_irq_create_workqueue(structif (hpd_rx_offload_wq[i].wq ==NULL ) {DRM_ERROR ("create amdgpu_dm_hpd_rx_offload_wq fail!" ); -return NULL ; + goto out_err; }spin_lock_init (&hpd_rx_offload_wq[i].offload_lock); }return hpd_rx_offload_wq; + +out_err: +for (i =0 ; i < max_caps; i++) { +if (hpd_rx_offload_wq[i].wq) +destroy_workqueue (hpd_rx_offload_wq[i].wq); + } +kfree (hpd_rx_offload_wq); +return NULL ; }struct amdgpu_stutter_quirk {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 328/717 mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 5cbedf52608cc3cbc1c2a9a861fb671620427a20 ]
If clk_prepare_enable() fails, there is no point in calling clk_disable_unprepare() in the error handling path.
Move the out_clk label at the right place.
--- drivers/mmc/host/au1xmmc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/host/au1xmmc.c +2 -1
@@ -1097,8 +1097,9 @@ static int au1xmmc_probe(struct platform_device *pdev)if (host->platdata && host->platdata->cd_setup && !(mmc->caps &MMC_CAP_NEEDS_POLL )) host->platdata->cd_setup (mmc,0 ); -out_clk: +clk_disable_unprepare (host->clk); +out_clk:clk_put (host->clk); out_irq:free_irq (host->irq, host);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 329/717 ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit bfb735a3ceff0bab6473bac275da96f9b2a06dec ]
In eukrea_tlv320_probe(), we need to hold the reference returned from of_find_compatible_node() which has increased the refcount and then call of_node_put() with it when done.
--- sound/soc/fsl/eukrea-tlv320.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/soc/fsl/eukrea-tlv320.c +5 -3
@@ -86,7 +86,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)int ret;int int_port =0 , ext_port;struct device_node *np = pdev->dev.of_node; -struct device_node *ssi_np =NULL , *codec_np =NULL ; +struct device_node *ssi_np =NULL , *codec_np =NULL , *tmp_np =NULL ; eukrea_tlv320.dev = &pdev->dev;if (np) {
@@ -143,7 +143,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev) }if (machine_is_eukrea_cpuimx27 () || -of_find_compatible_node (NULL ,NULL ,"fsl,imx21-audmux" )) { + (tmp_np =of_find_compatible_node (NULL ,NULL ,"fsl,imx21-audmux" ))) { imx_audmux_v1_configure_port(MX27_AUDMUX_HPCR1_SSI0, IMX_AUDMUX_V1_PCR_SYN | IMX_AUDMUX_V1_PCR_TFSDIR |
@@ -158,10 +158,11 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)IMX_AUDMUX_V1_PCR_SYN |IMX_AUDMUX_V1_PCR_RXDSEL (MX27_AUDMUX_HPCR1_SSI0 ) ); +of_node_put (tmp_np); }else if (machine_is_eukrea_cpuimx25sd () ||machine_is_eukrea_cpuimx35sd () ||machine_is_eukrea_cpuimx51sd () || -of_find_compatible_node (NULL ,NULL ,"fsl,imx31-audmux" )) { + (tmp_np =of_find_compatible_node (NULL ,NULL ,"fsl,imx31-audmux" ))) {if (!np) ext_port =machine_is_eukrea_cpuimx25sd () ?4 :3 ;
@@ -178,6 +179,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)IMX_AUDMUX_V2_PTCR_SYN ,IMX_AUDMUX_V2_PDCR_RXDSEL (int_port) ); +of_node_put (tmp_np); }else {if (np) {/* The eukrea,asoc-tlv320 driver was explicitly
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 330/717 drm/msm: lookup the ICC paths in both mdp5/dpu and mdss devices
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 5ccdcecaf8f732f593e359ebfb65de96b11bae66 ]
The commit 6874f48bb8b0 ("drm/msm: make mdp5/dpu devices master components") changed the MDP5 driver to look for the interconnect paths in the MDSS device rather than in the MDP5 device itself. This was left unnoticed since on my testing devices the interconnects probably didn't reach the sync state.
Rather than just using the MDP5 device for ICC path lookups for the MDP5 devices, introduce an additional helper to check both MDP5/DPU and MDSS nodes. This will be helpful for the MDP5->DPU conversion, since the driver will have to check both nodes.
Patchwork: https://patchwork.freedesktop.org/patch/496488/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 7 ++----- drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 9 +++------ drivers/gpu/drm/msm/msm_drv.h | 2 ++ drivers/gpu/drm/msm/msm_io_utils.c | 22 ++++++++++++++++++++++ 4 files changed, 29 insertions(+), 11 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +2 -5
@@ -383,12 +383,9 @@ static int dpu_kms_parse_data_bus_icc_path(struct dpu_kms *dpu_kms)struct icc_path *path1;struct drm_device *dev = dpu_kms->dev;struct device *dpu_dev = dev->dev; -struct device *mdss_dev = dpu_dev->parent; -/* Interconnects are a part of MDSS device tree binding, not the -* MDP/DPU device. */ - path0 =of_icc_get (mdss_dev,"mdp0-mem" ); - path1 =of_icc_get (mdss_dev,"mdp1-mem" ); + path0 =msm_icc_get (dpu_dev,"mdp0-mem" ); + path1 =msm_icc_get (dpu_dev,"mdp1-mem" );if (IS_ERR_OR_NULL (path0))return PTR_ERR_OR_ZERO (path0);
drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c +3 -6
@@ -921,12 +921,9 @@ static int mdp5_init(struct platform_device *pdev, struct drm_device *dev)static int mdp5_setup_interconnect (struct platform_device *pdev) { -/* Interconnects are a part of MDSS device tree binding, not the -* MDP5 device. */ -struct device *mdss_dev = pdev->dev.parent; -struct icc_path *path0 =of_icc_get (mdss_dev,"mdp0-mem" ); -struct icc_path *path1 =of_icc_get (mdss_dev,"mdp1-mem" ); -struct icc_path *path_rot =of_icc_get (mdss_dev,"rotator-mem" ); +struct icc_path *path0 =msm_icc_get (&pdev->dev,"mdp0-mem" ); +struct icc_path *path1 =msm_icc_get (&pdev->dev,"mdp1-mem" ); +struct icc_path *path_rot =msm_icc_get (&pdev->dev,"rotator-mem" );if (IS_ERR (path0))return PTR_ERR (path0);
drivers/gpu/drm/msm/msm_drv.h +2 -0
@@ -442,6 +442,8 @@ void __iomem *msm_ioremap_size(struct platform_device *pdev, const char *name, phys_addr_t *size);void __iomem *msm_ioremap_quiet (struct platform_device *pdev,const char *name); +struct icc_path *msm_icc_get (struct device *dev,const char *name); +#define msm_writel (data, addr) writel((data), (addr))#define msm_readl (addr) readl((addr))
drivers/gpu/drm/msm/msm_io_utils.c +22 -0
@@ -5,6 +5,8 @@* Author: Rob Clark <[email protected]> */ +#include <linux/interconnect.h> +#include "msm_drv.h" /*
@@ -124,3 +126,23 @@ void msm_hrtimer_work_init(struct msm_hrtimer_work *work, work->worker = worker;kthread_init_work (&work->work, fn); } + +struct icc_path *msm_icc_get (struct device *dev,const char *name) +{ +struct device *mdss_dev = dev->parent; +struct icc_path *path; + + path =of_icc_get (dev, name); +if (path) +return path; + +/* +* If there are no interconnects attached to the corresponding device +* node, of_icc_get() will return NULL. +* +* If the MDP5/DPU device node doesn't have interconnects, lookup the +* path in the parent (MDSS) device. +*/ +return of_icc_get (mdss_dev, name); + +}
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 331/717 drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7538f80ae0d98bf51eb89eee5344aec219902d42 ]
Remove loops over hw_vbif. Instead always VBIF's idx as an index in the array. This fixes an error in dpu_kms_hw_init(), where we fill dpu_kms->hw_vbif[i], but check for an error pointer at dpu_kms->hw_vbif[vbif_idx].
Patchwork: https://patchwork.freedesktop.org/patch/489569/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 12 ++++------ drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c | 29 +++++++++++------------- 2 files changed, 18 insertions(+), 23 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +5 -7
@@ -825,12 +825,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)_dpu_kms_mmu_destroy (dpu_kms);if (dpu_kms->catalog) { -for (i =0 ; i < dpu_kms->catalog->vbif_count; i++) { -u32 vbif_idx = dpu_kms->catalog->vbif[i].id; - -if ((vbif_idx <VBIF_MAX ) && dpu_kms->hw_vbif[vbif_idx]) { -dpu_hw_vbif_destroy (dpu_kms->hw_vbif[vbif_idx]); - dpu_kms->hw_vbif[vbif_idx] =NULL ; +for (i =0 ; i <ARRAY_SIZE (dpu_kms->hw_vbif); i++) { +if (dpu_kms->hw_vbif[i]) { +dpu_hw_vbif_destroy (dpu_kms->hw_vbif[i]); + dpu_kms->hw_vbif[i] =NULL ; } } }
@@ -1132,7 +1130,7 @@ static int dpu_kms_hw_init(struct msm_kms *kms)for (i =0 ; i < dpu_kms->catalog->vbif_count; i++) {u32 vbif_idx = dpu_kms->catalog->vbif[i].id; - dpu_kms->hw_vbif[i] =dpu_hw_vbif_init (vbif_idx, + dpu_kms->hw_vbif[vbif_idx] =dpu_hw_vbif_init (vbif_idx, dpu_kms->vbif[vbif_idx], dpu_kms->catalog);if (IS_ERR_OR_NULL (dpu_kms->hw_vbif[vbif_idx])) { rc =PTR_ERR (dpu_kms->hw_vbif[vbif_idx]);
drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c +13 -16
@@ -11,6 +11,14 @@#include "dpu_hw_vbif.h" #include "dpu_trace.h" +static struct dpu_hw_vbif *dpu_get_vbif (struct dpu_kms *dpu_kms,enum dpu_vbif vbif_idx) +{ +if (vbif_idx <ARRAY_SIZE (dpu_kms->hw_vbif)) +return dpu_kms->hw_vbif[vbif_idx]; + +return NULL ; +} +/** * _dpu_vbif_wait_for_xin_halt - wait for the xin to halt * @vbif: Pointer to hardware vbif driver
@@ -148,20 +156,15 @@ static u32 _dpu_vbif_get_ot_limit(struct dpu_hw_vbif *vbif,void dpu_vbif_set_ot_limit (struct dpu_kms *dpu_kms,struct dpu_vbif_set_ot_params *params) { -struct dpu_hw_vbif *vbif =NULL ; +struct dpu_hw_vbif *vbif;struct dpu_hw_mdp *mdp;bool forced_on = false;u32 ot_lim; -int ret, i; +int ret; mdp = dpu_kms->hw_mdp; -for (i =0 ; i <ARRAY_SIZE (dpu_kms->hw_vbif); i++) { -if (dpu_kms->hw_vbif[i] && - dpu_kms->hw_vbif[i]->idx == params->vbif_idx) - vbif = dpu_kms->hw_vbif[i]; - } - + vbif =dpu_get_vbif (dpu_kms, params->vbif_idx);if (!vbif || !mdp) {DRM_DEBUG_ATOMIC ("invalid arguments vbif %d mdp %d\n" , vbif !=NULL , mdp !=NULL );
@@ -204,7 +207,7 @@ void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms,void dpu_vbif_set_qos_remap (struct dpu_kms *dpu_kms,struct dpu_vbif_set_qos_params *params) { -struct dpu_hw_vbif *vbif =NULL ; +struct dpu_hw_vbif *vbif;struct dpu_hw_mdp *mdp;bool forced_on = false;const struct dpu_vbif_qos_tbl *qos_tbl;
@@ -216,13 +219,7 @@ void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms, } mdp = dpu_kms->hw_mdp; -for (i =0 ; i <ARRAY_SIZE (dpu_kms->hw_vbif); i++) { -if (dpu_kms->hw_vbif[i] && - dpu_kms->hw_vbif[i]->idx == params->vbif_idx) { - vbif = dpu_kms->hw_vbif[i]; -break ; - } - } + vbif =dpu_get_vbif (dpu_kms, params->vbif_idx);if (!vbif || !vbif->cap) {DPU_ERROR ("invalid vbif %d\n" , params->vbif_idx);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 332/717 drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit aa0bff10af1c4b92e6b56e3e1b7f81c660d3ba78 ]
At current implementation there is an extra 0 at 1.62G link rate which cause no correct pixel_div selected for 1.62G link rate to calculate mvid and nvid. This patch delete the extra 0 to have mvid and nvid be calculated correctly.
Changes in v2:
-- fix Fixes tag's text
Changes in v3:
-- fix misspelling of "Reviewed-by"
Patchwork: https://patchwork.freedesktop.org/patch/499328/
--- drivers/gpu/drm/msm/dp/dp_catalog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/dp/dp_catalog.c +1 -1
@@ -431,7 +431,7 @@ void dp_catalog_ctrl_config_msa(struct dp_catalog *dp_catalog,if (rate == link_rate_hbr3) pixel_div =6 ; -else if (rate ==1620000 || rate ==270000 ) +else if (rate ==162000 || rate ==270000 ) pixel_div =2 ;else if (rate == link_rate_hbr2) pixel_div =4 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 333/717 ALSA: usb-audio: Properly refcounting clock rate
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 9a737e7f8b371e97eb649904276407cee2c9cf30 ]
We fixed the bug introduced by the patch for managing the shared clocks at the commit 809f44a0cc5a ("ALSA: usb-audio: Clear fixed clock rate at closing EP"), but it was merely a workaround. By this change, the clock reference rate is cleared at each EP close, hence the still remaining EP may need a re-setup of rate unnecessarily.
This patch introduces the proper refcounting for the clock reference object so that the clock setup is done only when needed.
--- sound/usb/endpoint.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
sound/usb/endpoint.c +7 -4
@@ -39,6 +39,7 @@ struct snd_usb_iface_ref {struct snd_usb_clock_ref {unsigned char clock;atomic_t locked; +int opened;int rate;struct list_head list; };
@@ -802,6 +803,7 @@ snd_usb_endpoint_open(struct snd_usb_aud ep =NULL ; goto unlock; } + ep->clock_ref->opened++; } ep->cur_audiofmt = fp;
@@ -925,8 +927,10 @@ void snd_usb_endpoint_close(struct snd_uendpoint_set_interface (chip, ep, false);if (!--ep->opened) { -if (ep->clock_ref && !atomic_read (&ep->clock_ref->locked)) - ep->clock_ref->rate =0 ; +if (ep->clock_ref) { +if (!--ep->clock_ref->opened) + ep->clock_ref->rate =0 ; + } ep->iface =0 ; ep->altsetting =0 ; ep->cur_audiofmt =NULL ;
@@ -1633,8 +1637,7 @@ void snd_usb_endpoint_stop(struct snd_usWRITE_ONCE (ep->sync_source->sync_sink,NULL );stop_urbs (ep, false, keep_pending);if (ep->clock_ref) -if (!atomic_dec_return (&ep->clock_ref->locked)) - ep->clock_ref->rate =0 ; +atomic_dec (&ep->clock_ref->locked); } }
Greg Kroah-Hartman
maintainerPATCH 334/717 drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()
In reply to Greg Kroah-HartmanFrom: Rafael Mendonca <[email protected]>
[ Upstream commit a40c7f61d12fbd1e785e59140b9efd57127c0c33 ]
If the copy of the description string from userspace fails, then the page for the instance descriptor doesn't get freed before returning -EFAULT, which leads to a memleak.
--- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/vmwgfx/vmwgfx_msg.c +1 -0
@@ -1076,6 +1076,7 @@ int vmw_mksstat_add_ioctl(struct drm_device *dev, void *data,if (desc_len <0 ) {atomic_set (&dev_priv->mksstat_user_pids[slot],0 ); +__free_page (page);return -EFAULT ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 335/717 virtio-gpu: fix shift wrapping bug in virtio_gpu_fence_event_create()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 37a78445763a5921bb54e9bad01937d0dfa521c1 ]
The ->ring_idx_mask variable is a u64 so static checkers, Smatch in this case, complain if the BIT() is not also a u64.
drivers/gpu/drm/virtio/virtgpu_ioctl.c:50 virtio_gpu_fence_event_create()
warn: should '(1 << ring_idx)' be a 64 bit type?
--- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/virtio/virtgpu_ioctl.c +1 -1
@@ -47,7 +47,7 @@ static int virtio_gpu_fence_event_create(struct drm_device *dev,struct virtio_gpu_fence_event *e =NULL ;int ret; -if (!(vfpriv->ring_idx_mask & (1 << ring_idx))) +if (!(vfpriv->ring_idx_mask &BIT_ULL (ring_idx)))return 0 ; e =kzalloc (sizeof (*e),GFP_KERNEL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 336/717 ASoC: codecs: tx-macro: fix kcontrol put
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit c1057a08af438e0cf5450c1d977a3011198ed2f8 ]
tx_macro_tx_mixer_put() and tx_macro_dec_mode_put() currently returns zero eventhough it changes the value.
Fix this, so that change notifications are sent correctly.
--- sound/soc/codecs/lpass-tx-macro.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
sound/soc/codecs/lpass-tx-macro.c +11 -2
@@ -823,17 +823,23 @@ static int tx_macro_tx_mixer_put(struct snd_kcontrol *kcontrol,struct tx_macro *tx =snd_soc_component_get_drvdata (component);if (enable) { +if (tx->active_decimator[dai_id] == dec_id) +return 0 ; +set_bit (dec_id, &tx->active_ch_mask[dai_id]); tx->active_ch_cnt[dai_id]++; tx->active_decimator[dai_id] = dec_id; }else { +if (tx->active_decimator[dai_id] ==-1 ) +return 0 ; + tx->active_ch_cnt[dai_id]--;clear_bit (dec_id, &tx->active_ch_mask[dai_id]); tx->active_decimator[dai_id] =-1 ; }snd_soc_dapm_mixer_update_power (widget->dapm, kcontrol, enable, update); -return 0 ; +return 1 ; } static int tx_macro_enable_dec(struct snd_soc_dapm_widget *w,
@@ -1019,9 +1025,12 @@ static int tx_macro_dec_mode_put(struct snd_kcontrol *kcontrol,int path = e->shift_l;struct tx_macro *tx =snd_soc_component_get_drvdata (component); +if (tx->dec_mode[path] == value) +return 0 ; + tx->dec_mode[path] = value; -return 0 ; +return 1 ; } static int tx_macro_get_bcs(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 337/717 ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit abb4e4349afe7eecdb0499582f1c777031e3a7c8 ]
If clk_hw_register() fails, the corresponding clk should not be unregistered.
To handle errors from loops, clean up partial iterations before doing the goto. So add a clk_hw_unregister().
Then use a while (--i >= 0) loop in the unwind section.
--- sound/soc/codecs/da7219.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/codecs/da7219.c +3 -2
@@ -2196,6 +2196,7 @@ static int da7219_register_dai_clks(struct snd_soc_component *component) dai_clk_lookup =clkdev_hw_create (dai_clk_hw, init.name,"%s" ,dev_name (dev));if (!dai_clk_lookup) { +clk_hw_unregister (dai_clk_hw); ret = -ENOMEM ; goto err; }else {
@@ -2217,12 +2218,12 @@ static int da7219_register_dai_clks(struct snd_soc_component *component)return 0 ; err: -do { +while (--i >=0 ) {if (da7219->dai_clks_lookup[i])clkdev_drop (da7219->dai_clks_lookup[i]);clk_hw_unregister (&da7219->dai_clks_hw[i]); - }while (i-- >0 ); + }if (np)kfree (da7219->clk_hw_data);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 338/717 ALSA: dmaengine: increment buffer pointer atomically
In reply to Greg Kroah-HartmanFrom: Andreas Pape <[email protected]>
[ Upstream commit d1c442019594692c64a70a86ad88eb5b6db92216 ]
Setting pointer and afterwards checking for wraparound leads to the possibility of returning the inconsistent pointer position.
This patch increments buffer pointer atomically to avoid this issue.
--- sound/core/pcm_dmaengine.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/core/pcm_dmaengine.c +5 -3
@@ -131,12 +131,14 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_set_config_from_dai_data);static void dmaengine_pcm_dma_complete (void *arg) { +unsigned int new_pos;struct snd_pcm_substream *substream = arg;struct dmaengine_pcm_runtime_data *prtd =substream_to_prtd (substream); - prtd->pos +=snd_pcm_lib_period_bytes (substream); -if (prtd->pos >=snd_pcm_lib_buffer_bytes (substream)) - prtd->pos =0 ; + new_pos = prtd->pos +snd_pcm_lib_period_bytes (substream); +if (new_pos >=snd_pcm_lib_buffer_bytes (substream)) + new_pos =0 ; + prtd->pos = new_pos;snd_pcm_period_elapsed (substream); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 339/717 mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit cb58188ad90a61784a56a64f5107faaf2ad323e7 ]
A dma_free_coherent() call is missing in the error handling path of the probe, as already done in the remove function.
--- drivers/mmc/host/wmt-sdmmc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/mmc/host/wmt-sdmmc.c +4 -1
@@ -846,7 +846,7 @@ static int wmt_mci_probe(struct platform_device *pdev)if (IS_ERR (priv->clk_sdmmc)) {dev_err (&pdev->dev,"Error getting clock\n" ); ret =PTR_ERR (priv->clk_sdmmc); - goto fail5; + goto fail5_and_a_half; } ret =clk_prepare_enable (priv->clk_sdmmc);
@@ -863,6 +863,9 @@ static int wmt_mci_probe(struct platform_device *pdev)return 0 ; fail6:clk_put (priv->clk_sdmmc); +fail5_and_a_half: +dma_free_coherent (&pdev->dev, mmc->max_blk_count *16 , + priv->dma_desc_buffer, priv->dma_desc_device_addr); fail5:free_irq (dma_irq, priv); fail4:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 340/717 ASoC: stm32: dfsdm: Fix PM disable depth imbalance in stm32_adfsdm_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit b9a0da5b2edcae2a901b85c8cc42efc5bec4bd7b ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of stm32_adfsdm_probe.
--- sound/soc/stm/stm32_adfsdm.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/soc/stm/stm32_adfsdm.c +5 -3
@@ -334,8 +334,6 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)dev_set_drvdata (&pdev->dev, priv); -pm_runtime_enable (&pdev->dev); - ret =devm_snd_soc_register_component (&pdev->dev, &stm32_adfsdm_dai_component, &priv->dai_drv,1 );
@@ -365,9 +363,13 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)#endif ret =snd_soc_add_component (component,NULL ,0 ); -if (ret <0 ) +if (ret <0 ) {dev_err (&pdev->dev,"%s: Failed to register PCM platform\n" , __func__); +return ret; + } + +pm_runtime_enable (&pdev->dev);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 341/717 ASoC: stm32: spdifrx: Fix PM disable depth imbalance in stm32_spdifrx_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 0325cc0ac7980e1c7b744aab8df59afab6daeb43 ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of stm32_spdifrx_probe.
--- sound/soc/stm/stm32_spdifrx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/stm/stm32_spdifrx.c +2 -2
@@ -1001,8 +1001,6 @@ static int stm32_spdifrx_probe(struct platform_device *pdev)udelay (2 );reset_control_deassert (rst); -pm_runtime_enable (&pdev->dev); - pcm_config = &stm32_spdifrx_pcm_config; ret =snd_dmaengine_pcm_register (&pdev->dev, pcm_config,0 );if (ret)
@@ -1035,6 +1033,8 @@ static int stm32_spdifrx_probe(struct platform_device *pdev) FIELD_GET(SPDIFRX_VERR_MIN_MASK, ver)); } +pm_runtime_enable (&pdev->dev); +return ret; error:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 342/717 ASoC: stm: Fix PM disable depth imbalance in stm32_i2s_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 93618e5e05a3ce4aa6750268c5025bdb4cb7dc6e ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of stm32_i2s_probe.
--- sound/soc/stm/stm32_i2s.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/stm/stm32_i2s.c +2 -2
@@ -1135,8 +1135,6 @@ static int stm32_i2s_probe(struct platform_device *pdev)return dev_err_probe (&pdev->dev,PTR_ERR (i2s->regmap),"Regmap init error\n" ); -pm_runtime_enable (&pdev->dev); - ret =snd_dmaengine_pcm_register (&pdev->dev, &stm32_i2s_pcm_config,0 );if (ret)return dev_err_probe (&pdev->dev, ret,"PCM DMA register error\n" );
@@ -1179,6 +1177,8 @@ static int stm32_i2s_probe(struct platform_device *pdev) FIELD_GET(I2S_VERR_MIN_MASK, val)); } +pm_runtime_enable (&pdev->dev); +return ret; error:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 343/717 ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 41a736ac20602f64773e80f0f5b32cde1830a44a ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of wm8997_probe
--- sound/soc/codecs/wm8997.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm8997.c +3 -3
@@ -1162,9 +1162,6 @@ static int wm8997_probe(struct platform_device *pdev)regmap_update_bits (arizona->regmap, wm8997_digital_vu[i],WM8997_DIG_VU ,WM8997_DIG_VU ); -pm_runtime_enable (&pdev->dev); -pm_runtime_idle (&pdev->dev); -arizona_init_common (arizona); ret =arizona_init_vol_limit (arizona);
@@ -1183,6 +1180,9 @@ static int wm8997_probe(struct platform_device *pdev) goto err_spk_irqs; } +pm_runtime_enable (&pdev->dev); +pm_runtime_idle (&pdev->dev); +return ret; err_spk_irqs:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 344/717 ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 86b46bf1feb83898d89a2b4a8d08d21e9ea277a7 ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of wm5110_probe.
--- sound/soc/codecs/wm5110.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm5110.c +3 -3
@@ -2458,9 +2458,6 @@ static int wm5110_probe(struct platform_device *pdev)regmap_update_bits (arizona->regmap, wm5110_digital_vu[i],WM5110_DIG_VU ,WM5110_DIG_VU ); -pm_runtime_enable (&pdev->dev); -pm_runtime_idle (&pdev->dev); - ret =arizona_request_irq (arizona,ARIZONA_IRQ_DSP_IRQ1 ,"ADSP2 Compressed IRQ" , wm5110_adsp2_irq, wm5110);
@@ -2493,6 +2490,9 @@ static int wm5110_probe(struct platform_device *pdev) goto err_spk_irqs; } +pm_runtime_enable (&pdev->dev); +pm_runtime_idle (&pdev->dev); +return ret; err_spk_irqs:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 345/717 ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit fcbb60820cd3008bb44334a0395e5e57ccb77329 ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of wm5102_probe.
--- sound/soc/codecs/wm5102.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm5102.c +3 -3
@@ -2100,9 +2100,6 @@ static int wm5102_probe(struct platform_device *pdev)regmap_update_bits (arizona->regmap, wm5102_digital_vu[i],WM5102_DIG_VU ,WM5102_DIG_VU ); -pm_runtime_enable (&pdev->dev); -pm_runtime_idle (&pdev->dev); - ret =arizona_request_irq (arizona,ARIZONA_IRQ_DSP_IRQ1 ,"ADSP2 Compressed IRQ" , wm5102_adsp2_irq, wm5102);
@@ -2135,6 +2132,9 @@ static int wm5102_probe(struct platform_device *pdev) goto err_spk_irqs; } +pm_runtime_enable (&pdev->dev); +pm_runtime_idle (&pdev->dev); +return ret; err_spk_irqs:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 346/717 ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit b73f11e895e140537e7f8c7251211ccd3ce0782b ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of mt6660_i2c_probe.
--- sound/soc/codecs/mt6660.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
sound/soc/codecs/mt6660.c +6 -2
@@ -503,13 +503,17 @@ static int mt6660_i2c_probe(struct i2c_client *client)dev_err (chip->dev,"read chip revision fail\n" ); goto probe_fail; } -pm_runtime_set_active (chip->dev); -pm_runtime_enable (chip->dev); ret =devm_snd_soc_register_component (chip->dev, &mt6660_component_driver, &mt6660_codec_dai,1 ); +if (!ret) { +pm_runtime_set_active (chip->dev); +pm_runtime_enable (chip->dev); + } +return ret; + probe_fail:_mt6660_chip_power_on (chip,0 );mutex_destroy (&chip->io_lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 347/717 ALSA: hda/hdmi: Dont skip notification handling during PM operation
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit 5226c7b9784eee215e3914f440b3c2e1764f67a8 ]
The HDMI driver skips the notification handling from the graphics driver when the codec driver is being in the PM operation. This behavior was introduced by the commit eb399d3c99d8 ("ALSA: hda - Skip ELD notification during PM process"). This skip may cause a problem, as we may miss the ELD update when the connection/disconnection happens right at the runtime-PM operation of the audio codec.
Although this workaround was valid at that time, it's no longer true; the fix was required just because the ELD update procedure needed to wake up the audio codec, which had lead to a runtime-resume during a runtime-suspend. Meanwhile, the ELD update procedure doesn't need a codec wake up any longer since the commit 788d441a164c ("ALSA: hda - Use component ops for i915 HDMI/DP audio jack handling"); i.e. there is no much reason for skipping the notification.
Let's drop those checks for addressing the missing notification.
--- sound/pci/hda/patch_hdmi.c | 6 ------ 1 file changed, 6 deletions(-)
sound/pci/hda/patch_hdmi.c +0 -6
@@ -2747,9 +2747,6 @@ static void generic_acomp_pin_eld_notify(void *audio_ptr, int port, int dev_id)*/ if (codec->core.dev.power.power_state.event ==PM_EVENT_SUSPEND )return ; -/* ditto during suspend/resume process itself */ -if (snd_hdac_is_in_pm (&codec->core)) -return ;check_presence_and_report (codec, pin_nid, dev_id); }
@@ -2933,9 +2930,6 @@ static void intel_pin_eld_notify(void *audio_ptr, int port, int pipe)*/ if (codec->core.dev.power.power_state.event ==PM_EVENT_SUSPEND )return ; -/* ditto during suspend/resume process itself */ -if (snd_hdac_is_in_pm (&codec->core)) -return ;snd_hdac_i915_set_bclk (&codec->bus->core);check_presence_and_report (codec, pin_nid, dev_id);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 348/717 memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 61b3c876c1cbdb1efd1f52a1f348580e6e14efb6 ]
The break of for_each_available_child_of_node() needs a corresponding of_node_put() when the reference 'child' is not used anymore. Here we do not need to call of_node_put() in fail path as '!match' means no break.
While the of_platform_device_create() will created a new reference by 'child' but it has considered the refcounting.
--- drivers/memory/pl353-smc.c | 1 + 1 file changed, 1 insertion(+)
drivers/memory/pl353-smc.c +1 -0
@@ -122,6 +122,7 @@ static int pl353_smc_probe(struct amba_device *adev, const struct amba_id *id) }of_platform_device_create (child,NULL , &adev->dev); +of_node_put (child);return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 349/717 memory: of: Fix refcount leak bug in of_get_ddr_timings()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 05215fb32010d4afb68fbdbb4d237df6e2d4567b ]
We should add the of_node_put() when breaking out of for_each_child_of_node() as it will automatically increase and decrease the refcount.
--- drivers/memory/of_memory.c | 1 + 1 file changed, 1 insertion(+)
drivers/memory/of_memory.c +1 -0
@@ -134,6 +134,7 @@ const struct lpddr2_timings *of_get_ddr_timings(struct device_node *np_ddr,for_each_child_of_node (np_ddr, np_tim) {if (of_device_is_compatible (np_tim, tim_compat)) {if (of_do_get_timings (np_tim, &timings[i])) { +of_node_put (np_tim);devm_kfree (dev, timings); goto default_timings; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 350/717 memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 48af14fb0eaa63d9aa68f59fb0b205ec55a95636 ]
We should add the of_node_put() when breaking out of for_each_child_of_node() as it will automatically increase and decrease the refcount.
--- drivers/memory/of_memory.c | 1 + 1 file changed, 1 insertion(+)
drivers/memory/of_memory.c +1 -0
@@ -285,6 +285,7 @@ const struct lpddr3_timingsif (of_device_is_compatible (np_tim, tim_compat)) {if (of_lpddr3_do_get_timings (np_tim, &timings[i])) {devm_kfree (dev, timings); +of_node_put (np_tim); goto default_timings; } i++;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 351/717 locks: fix TOCTOU race when granting write lease
In reply to Greg Kroah-HartmanFrom: Amir Goldstein <[email protected]>
[ Upstream commit d6da19c9cace63290ccfccb1fc35151ffefc0bec ]
Thread A trying to acquire a write lease checks the value of i_readcount and i_writecount in check_conflicting_open() to verify that its own fd is the only fd referencing the file.
Thread B trying to open the file for read will call break_lease() in do_dentry_open() before incrementing i_readcount, which leaves a small window where thread A can acquire the write lease and then thread B completes the open of the file for read without breaking the write lease that was acquired by thread A.
Fix this race by incrementing i_readcount before checking for existing leases, same as the case with i_writecount.
Use a helper put_file_access() to decrement i_readcount or i_writecount in do_dentry_open() and __fput().
--- fs/file_table.c | 7 +------ fs/internal.h | 10 ++++++++++ fs/open.c | 11 ++++------- 3 files changed, 15 insertions(+), 13 deletions(-)
fs/file_table.c +1 -6
@@ -321,12 +321,7 @@ static void __fput(struct file *file) }fops_put (file->f_op);put_pid (file->f_owner.pid); -if ((mode & (FMODE_READ |FMODE_WRITE )) ==FMODE_READ ) -i_readcount_dec (inode); -if (mode &FMODE_WRITER ) { -put_write_access (inode); -__mnt_drop_write (mnt); - } +put_file_access (file);dput (dentry);if (unlikely (mode &FMODE_NEED_UNMOUNT ))dissolve_on_fput (mnt);
fs/internal.h +10 -0
@@ -102,6 +102,16 @@ extern void chroot_fs_refs(const struct path *, const struct path *);extern struct file *alloc_empty_file (int ,const struct cred *);extern struct file *alloc_empty_file_noaccount (int ,const struct cred *); +static inline void put_file_access (struct file *file) +{ +if ((file->f_mode & (FMODE_READ |FMODE_WRITE )) ==FMODE_READ ) { +i_readcount_dec (file->f_inode); + }else if (file->f_mode &FMODE_WRITER ) { +put_write_access (file->f_inode); +__mnt_drop_write (file->f_path.mnt); + } +} +/* * super.c */
fs/open.c +4 -7
@@ -810,7 +810,9 @@ static int do_dentry_open(struct file *f,return 0 ; } -if (f->f_mode &FMODE_WRITE && !special_file (inode->i_mode)) { +if ((f->f_mode & (FMODE_READ |FMODE_WRITE )) ==FMODE_READ ) { +i_readcount_inc (inode); + }else if (f->f_mode &FMODE_WRITE && !special_file (inode->i_mode)) { error =get_write_access (inode);if (unlikely (error)) goto cleanup_file;
@@ -850,8 +852,6 @@ static int do_dentry_open(struct file *f, goto cleanup_all; } f->f_mode |=FMODE_OPENED ; -if ((f->f_mode & (FMODE_READ |FMODE_WRITE )) ==FMODE_READ ) -i_readcount_inc (inode);if ((f->f_mode &FMODE_READ ) &&likely (f->f_op->read || f->f_op->read_iter)) f->f_mode |=FMODE_CAN_READ ;
@@ -902,10 +902,7 @@ static int do_dentry_open(struct file *f,if (WARN_ON_ONCE (error >0 )) error = -EINVAL ;fops_put (f->f_op); -if (f->f_mode &FMODE_WRITER ) { -put_write_access (inode); -__mnt_drop_write (f->f_path.mnt); - } +put_file_access (f); cleanup_file:path_put (&f->f_path); f->f_path.mnt =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 352/717 soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit af8f6f39b8afd772fda4f8e61823ef8c021bf382 ]
There are two refcount leak bugs in qcom_smsm_probe():
(1) The 'local_node' is escaped out from for_each_child_of_node() as the break of iteration, we should call of_node_put() for it in error path or when it is not used anymore.
(2) The 'node' is escaped out from for_each_available_child_of_node() as the 'goto', we should call of_node_put() for it in goto target.
--- drivers/soc/qcom/smsm.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/soc/qcom/smsm.c +13 -7
@@ -526,7 +526,7 @@ static int qcom_smsm_probe(struct platform_device *pdev)for (id =0 ; id < smsm->num_hosts; id++) { ret =smsm_parse_ipc (smsm, id);if (ret <0 ) -return ret; + goto out_put; }/* Acquire the main SMSM state vector */
@@ -534,13 +534,14 @@ static int qcom_smsm_probe(struct platform_device *pdev) smsm->num_entries * sizeof(u32));if (ret <0 && ret != -EEXIST ) {dev_err (&pdev->dev,"unable to allocate shared state entry\n" ); -return ret; + goto out_put; } states =qcom_smem_get (QCOM_SMEM_HOST_ANY ,SMEM_SMSM_SHARED_STATE ,NULL );if (IS_ERR (states)) {dev_err (&pdev->dev,"Unable to acquire shared state entry\n" ); -return PTR_ERR (states); + ret =PTR_ERR (states); + goto out_put; }/* Acquire the list of interrupt mask vectors */
@@ -548,13 +549,14 @@ static int qcom_smsm_probe(struct platform_device *pdev) ret =qcom_smem_alloc (QCOM_SMEM_HOST_ANY ,SMEM_SMSM_CPU_INTR_MASK , size);if (ret <0 && ret != -EEXIST ) {dev_err (&pdev->dev,"unable to allocate smsm interrupt mask\n" ); -return ret; + goto out_put; } intr_mask =qcom_smem_get (QCOM_SMEM_HOST_ANY ,SMEM_SMSM_CPU_INTR_MASK ,NULL );if (IS_ERR (intr_mask)) {dev_err (&pdev->dev,"unable to acquire shared memory interrupt mask\n" ); -return PTR_ERR (intr_mask); + ret =PTR_ERR (intr_mask); + goto out_put; }/* Setup the reference to the local state bits */
@@ -565,7 +567,8 @@ static int qcom_smsm_probe(struct platform_device *pdev) smsm->state =qcom_smem_state_register (local_node, &smsm_state_ops, smsm);if (IS_ERR (smsm->state)) {dev_err (smsm->dev,"failed to register qcom_smem_state\n" ); -return PTR_ERR (smsm->state); + ret =PTR_ERR (smsm->state); + goto out_put; }/* Register handlers for remote processor entries of interest. */
@@ -595,16 +598,19 @@ static int qcom_smsm_probe(struct platform_device *pdev) }platform_set_drvdata (pdev, smsm); +of_node_put (local_node);return 0 ; unwind_interfaces: +of_node_put (node);for (id =0 ; id < smsm->num_entries; id++)if (smsm->entries[id].domain)irq_domain_remove (smsm->entries[id].domain);qcom_smem_state_unregister (smsm->state); - +out_put: +of_node_put (local_node);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 353/717 soc: qcom: smem_state: Add refcounting for the state->of_node
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 90681f53b9381c23ff7762a3b13826d620c272de ]
In qcom_smem_state_register() and qcom_smem_state_release(), we should better use of_node_get() and of_node_put() for the reference creation and destruction of 'device_node'.
--- drivers/soc/qcom/smem_state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/soc/qcom/smem_state.c +2 -1
@@ -136,6 +136,7 @@ static void qcom_smem_state_release(struct kref *ref) struct qcom_smem_state *state = container_of(ref, struct qcom_smem_state, refcount);list_del (&state->list); +of_node_put (state->of_node);kfree (state); }
@@ -205,7 +206,7 @@ struct qcom_smem_state *qcom_smem_state_register(struct device_node *of_node,kref_init (&state->refcount); - state->of_node = of_node; + state->of_node =of_node_get (of_node); state->ops = *ops; state->priv = priv;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 354/717 ARM: dts: imx6qdl-kontron-samx6i: hook up DDC i2c bus
In reply to Greg Kroah-HartmanFrom: Lucas Stach <[email protected]>
[ Upstream commit afd8f77957e3e83adf21d9229c61ff37f44a177a ]
i2c2 is routed to the pins dedicated as DDC in the module standard. Reduce clock rate to 100kHz to be in line with VESA standard and hook this bus up to the HDMI node.
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +5 -1
@@ -263,6 +263,10 @@ phy-reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; }; +&hdmi { + ddc-i2c-bus = <&i2c2>; +}; + &i2c_intern { pmic@8 { compatible = "fsl,pfuze100";
@@ -387,7 +391,7 @@ /* HDMI_CTRL */ &i2c2 { - clock-frequency = <375000>; + clock-frequency = <100000>; pinctrl-names = "default"; pinctrl-0 = <&pinctrl_i2c2>; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 355/717 arm64: dts: renesas: r9a07g044: Fix SCI{Rx,Tx} interrupt types
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
[ Upstream commit f3b7bc89c97b98aa6f157d5f296695af8940a5ac ]
As per the latest RZ/G2L Hardware User's Manual (Rev.1.10 Apr, 2022), the interrupt type of SCI{Rx,Tx} is edge triggered.
--- arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/renesas/r9a07g044.dtsi +4 -4
@@ -394,8 +394,8 @@ compatible = "renesas,r9a07g044-sci", "renesas,sci"; reg = <0 0x1004d000 0 0x400>; interrupts = <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 406 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 407 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 406 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 407 IRQ_TYPE_EDGE_RISING>, <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "eri", "rxi", "txi", "tei"; clocks = <&cpg CPG_MOD R9A07G044_SCI0_CLKP>;
@@ -409,8 +409,8 @@ compatible = "renesas,r9a07g044-sci", "renesas,sci"; reg = <0 0x1004d400 0 0x400>; interrupts = <GIC_SPI 409 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 410 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 411 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 410 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 411 IRQ_TYPE_EDGE_RISING>, <GIC_SPI 412 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "eri", "rxi", "txi", "tei"; clocks = <&cpg CPG_MOD R9A07G044_SCI1_CLKP>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 356/717 arm64: dts: renesas: r9a07g054: Fix SCI{Rx,Tx} interrupt types
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
[ Upstream commit 13dec051c7f139eef345c55a60941843e72128f1 ]
As per the RZ/V2L Hardware User's Manual (Rev.1.00 Nov, 2021), the interrupt type of SCI{Rx,Tx} is edge triggered.
--- arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/renesas/r9a07g054.dtsi +4 -4
@@ -399,8 +399,8 @@ compatible = "renesas,r9a07g054-sci", "renesas,sci"; reg = <0 0x1004d000 0 0x400>; interrupts = <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 406 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 407 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 406 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 407 IRQ_TYPE_EDGE_RISING>, <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "eri", "rxi", "txi", "tei"; clocks = <&cpg CPG_MOD R9A07G054_SCI0_CLKP>;
@@ -414,8 +414,8 @@ compatible = "renesas,r9a07g054-sci", "renesas,sci"; reg = <0 0x1004d400 0 0x400>; interrupts = <GIC_SPI 409 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 410 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 411 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 410 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 411 IRQ_TYPE_EDGE_RISING>, <GIC_SPI 412 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "eri", "rxi", "txi", "tei"; clocks = <&cpg CPG_MOD R9A07G054_SCI1_CLKP>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 357/717 arm64: dts: renesas: r9a07g043: Fix SCI{Rx,Tx} interrupt types
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
[ Upstream commit 72a482dbaec4b9e4d54b81be6bdb8c016fd2f4bd ]
As per the RZ/G2UL Hardware User's Manual (Rev.1.00 Apr, 2022), the interrupt type of SCI{Rx,Tx} is edge triggered.
--- arch/arm64/boot/dts/renesas/r9a07g043.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/renesas/r9a07g043.dtsi +4 -4
@@ -334,8 +334,8 @@ compatible = "renesas,r9a07g043-sci", "renesas,sci"; reg = <0 0x1004d000 0 0x400>; interrupts = <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 406 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 407 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 406 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 407 IRQ_TYPE_EDGE_RISING>, <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "eri", "rxi", "txi", "tei"; clocks = <&cpg CPG_MOD R9A07G043_SCI0_CLKP>;
@@ -349,8 +349,8 @@ compatible = "renesas,r9a07g043-sci", "renesas,sci"; reg = <0 0x1004d400 0 0x400>; interrupts = <GIC_SPI 409 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 410 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 411 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 410 IRQ_TYPE_EDGE_RISING>, + <GIC_SPI 411 IRQ_TYPE_EDGE_RISING>, <GIC_SPI 412 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "eri", "rxi", "txi", "tei"; clocks = <&cpg CPG_MOD R9A07G043_SCI1_CLKP>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 358/717 dt-bindings: clock: exynosautov9: correct clock numbering of peric0/c1
In reply to Greg Kroah-HartmanFrom: Chanho Park <[email protected]>
[ Upstream commit b6740089b740b842d5e6ff55b4b2c3bf5961c69a ]
There are duplicated definitions of peric0 and peric1 cmu blocks. Thus, they should be defined correctly as numerical order.
--- .../dt-bindings/clock/samsung,exynosautov9.h | 56 +++++++++---------- 1 file changed, 28 insertions(+), 28 deletions(-)
include/dt-bindings/clock/samsung,exynosautov9.h +28 -28
@@ -226,21 +226,21 @@#define CLK_GOUT_PERIC0_IPCLK_8 28#define CLK_GOUT_PERIC0_IPCLK_9 29#define CLK_GOUT_PERIC0_IPCLK_10 30 -#define CLK_GOUT_PERIC0_IPCLK_11 30 -#define CLK_GOUT_PERIC0_PCLK_0 31 -#define CLK_GOUT_PERIC0_PCLK_1 32 -#define CLK_GOUT_PERIC0_PCLK_2 33 -#define CLK_GOUT_PERIC0_PCLK_3 34 -#define CLK_GOUT_PERIC0_PCLK_4 35 -#define CLK_GOUT_PERIC0_PCLK_5 36 -#define CLK_GOUT_PERIC0_PCLK_6 37 -#define CLK_GOUT_PERIC0_PCLK_7 38 -#define CLK_GOUT_PERIC0_PCLK_8 39 -#define CLK_GOUT_PERIC0_PCLK_9 40 -#define CLK_GOUT_PERIC0_PCLK_10 41 -#define CLK_GOUT_PERIC0_PCLK_11 42 +#define CLK_GOUT_PERIC0_IPCLK_11 31 +#define CLK_GOUT_PERIC0_PCLK_0 32 +#define CLK_GOUT_PERIC0_PCLK_1 33 +#define CLK_GOUT_PERIC0_PCLK_2 34 +#define CLK_GOUT_PERIC0_PCLK_3 35 +#define CLK_GOUT_PERIC0_PCLK_4 36 +#define CLK_GOUT_PERIC0_PCLK_5 37 +#define CLK_GOUT_PERIC0_PCLK_6 38 +#define CLK_GOUT_PERIC0_PCLK_7 39 +#define CLK_GOUT_PERIC0_PCLK_8 40 +#define CLK_GOUT_PERIC0_PCLK_9 41 +#define CLK_GOUT_PERIC0_PCLK_10 42 +#define CLK_GOUT_PERIC0_PCLK_11 43 -#define PERIC0_NR_CLK 43 +#define PERIC0_NR_CLK 44/* CMU_PERIC1 */ #define CLK_MOUT_PERIC1_BUS_USER 1
@@ -272,21 +272,21 @@#define CLK_GOUT_PERIC1_IPCLK_8 28#define CLK_GOUT_PERIC1_IPCLK_9 29#define CLK_GOUT_PERIC1_IPCLK_10 30 -#define CLK_GOUT_PERIC1_IPCLK_11 30 -#define CLK_GOUT_PERIC1_PCLK_0 31 -#define CLK_GOUT_PERIC1_PCLK_1 32 -#define CLK_GOUT_PERIC1_PCLK_2 33 -#define CLK_GOUT_PERIC1_PCLK_3 34 -#define CLK_GOUT_PERIC1_PCLK_4 35 -#define CLK_GOUT_PERIC1_PCLK_5 36 -#define CLK_GOUT_PERIC1_PCLK_6 37 -#define CLK_GOUT_PERIC1_PCLK_7 38 -#define CLK_GOUT_PERIC1_PCLK_8 39 -#define CLK_GOUT_PERIC1_PCLK_9 40 -#define CLK_GOUT_PERIC1_PCLK_10 41 -#define CLK_GOUT_PERIC1_PCLK_11 42 +#define CLK_GOUT_PERIC1_IPCLK_11 31 +#define CLK_GOUT_PERIC1_PCLK_0 32 +#define CLK_GOUT_PERIC1_PCLK_1 33 +#define CLK_GOUT_PERIC1_PCLK_2 34 +#define CLK_GOUT_PERIC1_PCLK_3 35 +#define CLK_GOUT_PERIC1_PCLK_4 36 +#define CLK_GOUT_PERIC1_PCLK_5 37 +#define CLK_GOUT_PERIC1_PCLK_6 38 +#define CLK_GOUT_PERIC1_PCLK_7 39 +#define CLK_GOUT_PERIC1_PCLK_8 40 +#define CLK_GOUT_PERIC1_PCLK_9 41 +#define CLK_GOUT_PERIC1_PCLK_10 42 +#define CLK_GOUT_PERIC1_PCLK_11 43 -#define PERIC1_NR_CLK 43 +#define PERIC1_NR_CLK 44/* CMU_PERIS */ #define CLK_MOUT_PERIS_BUS_USER 1
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 359/717 ARM: dts: turris-omnia: Fix mpp26 pin name and comment
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
[ Upstream commit 49e93898f0dc177e645c22d0664813567fd9ec00 ]
There is a bug in Turris Omnia's schematics, whereupon the MPP[26] pin, which is routed to CN11 pin header, is documented as SPI CS1, but MPP[26] pin does not support this function. Instead it controls chip select 2 if in "spi0" mode.
Fix the name of the pin node in pinctrl node and fix the comment in SPI node.
--- arch/arm/boot/dts/armada-385-turris-omnia.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/armada-385-turris-omnia.dts +2 -2
@@ -478,7 +478,7 @@ marvell,function = "spi0"; }; - spi0cs1_pins: spi0cs1-pins { + spi0cs2_pins: spi0cs2-pins { marvell,pins = "mpp26"; marvell,function = "spi0"; };
@@ -513,7 +513,7 @@ }; }; - /* MISO, MOSI, SCLK and CS1 are routed to pin header CN11 */ + /* MISO, MOSI, SCLK and CS2 are routed to pin header CN11 */ }; &uart0 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 360/717 ARM: dts: kirkwood: lsxl: fix serial line
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit 04eabc6ac10fda9424606d9a7ab6ab9a5d95350a ]
Commit 327e15428977 ("ARM: dts: kirkwood: consolidate common pinctrl settings") unknowingly broke the serial output on this board. Before this commit, the pinmux was still configured by the bootloader and the kernel didn't reconfigured it again. This was an oversight by the initial board support where the pinmux for the serial line was never configured by the kernel. But with this commit, the serial line will be reconfigured to the wrong pins. This is especially confusing, because the output still works, but the input doesn't. Presumingly, the input is reconfigured to MPP10, but the output is connected to both MPP11 and MPP5.
Override the pinmux in the board device tree.
--- arch/arm/boot/dts/kirkwood-lsxl.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm/boot/dts/kirkwood-lsxl.dtsi +5 -0
@@ -10,6 +10,11 @@ ocp@f1000000 { pinctrl: pin-controller@10000 { + /* Non-default UART pins */ + pmx_uart0: pmx-uart0 { + marvell,pins = "mpp4", "mpp5"; + }; + pmx_power_hdd: pmx-power-hdd { marvell,pins = "mpp10"; marvell,function = "gpo";
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 361/717 ARM: dts: kirkwood: lsxl: remove first ethernet port
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit 2d528eda7c96ce5c70f895854ecd5684bd5d80b9 ]
Both the Linkstation LS-CHLv2 and the LS-XHL have only one ethernet port. This has always been wrong, i.e. the board code used to set up both ports, but the driver will play nice and return -ENODEV if the assiciated PHY is not found. Nevertheless, it is wrong. Remove it.
--- arch/arm/boot/dts/kirkwood-lsxl.dtsi | 11 ----------- 1 file changed, 11 deletions(-)
arch/arm/boot/dts/kirkwood-lsxl.dtsi +0 -11
@@ -218,22 +218,11 @@ &mdio { status = "okay"; - ethphy0: ethernet-phy@0 { - reg = <0>; - }; - ethphy1: ethernet-phy@8 { reg = <8>; }; }; -ð0 { - status = "okay"; - ethernet0-port@0 { - phy-handle = <ðphy0>; - }; -}; - ð1 { status = "okay"; ethernet1-port@0 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 362/717 ia64: export memory_add_physaddr_to_nid to fix cxl build error
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 97c318bfbe84efded246e80428054f300042f110 ]
cxl_pmem.ko uses memory_add_physaddr_to_nid() but ia64 does not export it, so this causes a build error:
ERROR: modpost: "memory_add_physaddr_to_nid" [drivers/cxl/cxl_pmem.ko] undefined!
Fix this by exporting that function.
--- arch/ia64/mm/numa.c | 1 + 1 file changed, 1 insertion(+)
arch/ia64/mm/numa.c +1 -0
@@ -75,5 +75,6 @@ int memory_add_physaddr_to_nid(u64 addr)return 0 ;return nid; } +EXPORT_SYMBOL (memory_add_physaddr_to_nid);#endif #endif
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 363/717 soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit 2254182807fc09ba9dec9a42ef239e373796f1b2 ]
The DMA subsystem could be entirely disabled in Kconfig and then the TEGRA20_APB_DMA option isn't available too. Hence kernel configuration fails if DMADEVICES Kconfig option is disabled due to the unsatisfiable dependency.
The FUSE driver isn't a critical driver and currently it only provides NVMEM interface to userspace which isn't known to be widely used, and thus, it's fine if FUSE driver fails to load.
Let's remove the erroneous Kconfig dependency and let the FUSE driver to fail the probing if DMA is unavailable.
--- drivers/soc/tegra/Kconfig | 1 - 1 file changed, 1 deletion(-)
drivers/soc/tegra/Kconfig +0 -1
@@ -136,7 +136,6 @@ config SOC_TEGRA_FUSE def_bool y depends on ARCH_TEGRA select SOC_BUS - select TEGRA20_APB_DMA if ARCH_TEGRA_2x_SOC config SOC_TEGRA_FLOWCTRL bool
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 364/717 arm64: dts: ti: k3-j7200: fix main pinmux range
In reply to Greg Kroah-HartmanFrom: Matt Ranostay <[email protected]>
[ Upstream commit 0d0a0b4413460383331088b2203ba09a6971bc3a ]
Range size of 0x2b4 was incorrect since there isn't 173 configurable pins for muxing. Additionally there is a non-addressable region in the mapping which requires splitting into two ranges.
main_pmx0 -> 67 pinsmain_pmx1 -> 3 pins
--- arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts | 10 ++++++---- arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 11 ++++++++++- 2 files changed, 16 insertions(+), 5 deletions(-)
arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +6 -4
@@ -134,15 +134,17 @@ >; }; - main_usbss0_pins_default: main-usbss0-pins-default { + vdd_sd_dv_pins_default: vdd-sd-dv-pins-default { pinctrl-single,pins = < - J721E_IOPAD(0x120, PIN_OUTPUT, 0) /* (T4) USB0_DRVVBUS */ + J721E_IOPAD(0xd0, PIN_OUTPUT, 7) /* (T5) SPI0_D1.GPIO0_55 */ >; }; +}; - vdd_sd_dv_pins_default: vdd-sd-dv-pins-default { +&main_pmx1 { + main_usbss0_pins_default: main-usbss0-pins-default { pinctrl-single,pins = < - J721E_IOPAD(0xd0, PIN_OUTPUT, 7) /* (T5) SPI0_D1.GPIO0_55 */ + J721E_IOPAD(0x04, PIN_OUTPUT, 0) /* (T4) USB0_DRVVBUS */ >; }; };
arch/arm64/boot/dts/ti/k3-j7200-main.dtsi +10 -1
@@ -295,7 +295,16 @@ main_pmx0: pinctrl@11c000 { compatible = "pinctrl-single"; /* Proxy 0 addressing */ - reg = <0x00 0x11c000 0x00 0x2b4>; + reg = <0x00 0x11c000 0x00 0x10c>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; + }; + + main_pmx1: pinctrl@11c11c { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ + reg = <0x00 0x11c11c 0x00 0xc>; #pinctrl-cells = <1>; pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0xffffffff>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 365/717 ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit 3ba2d4bb9592bf7a6a3fe3dbe711ecfc3d004bab ]
According to s5k6a3 driver code, the reset line for the chip appears to be active low. This also matches the typical polarity of reset lines in general. Let's fix it up as having correct polarity in DTS is important when the driver will be switched over to gpiod API.
--- arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos4412-midas.dtsi +1 -1
@@ -585,7 +585,7 @@ clocks = <&camera 1>; clock-names = "extclk"; samsung,camclk-out = <1>; - gpios = <&gpm1 6 GPIO_ACTIVE_HIGH>; + gpios = <&gpm1 6 GPIO_ACTIVE_LOW>; port { is_s5k6a3_ep: endpoint {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 366/717 ARM: Drop CMDLINE_* dependency on ATAGS
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 136f4b1ec7c962ee37a787e095fd37b058d72bd3 ]
On arm32, the configuration options to specify the kernel command line type depend on ATAGS. However, the actual CMDLINE cofiguration option does not depend on ATAGS, and the code that handles this is not specific to ATAGS (see drivers/of/fdt.c:early_init_dt_scan_chosen()).
Hence users who desire to override the kernel command line on arm32 must enable support for ATAGS, even on a pure-DT system. Other architectures (arm64, loongarch, microblaze, nios2, powerpc, and riscv) do not impose such a restriction.
Hence drop the dependency on ATAGS.
--- arch/arm/Kconfig | 1 - 1 file changed, 1 deletion(-)
arch/arm/Kconfig +0 -1
@@ -1653,7 +1653,6 @@ config CMDLINE choice prompt "Kernel command line type" if CMDLINE != "" default CMDLINE_FROM_BOOTLOADER - depends on ATAGS config CMDLINE_FROM_BOOTLOADER bool "Use bootloader kernel arguments if available"
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 367/717 ext4: dont run ext4lazyinit for read-only filesystems
In reply to Greg Kroah-HartmanFrom: Josh Triplett <[email protected]>
[ Upstream commit 426d15ad11419066f7042ffa8fbf1b5c21a1ecbe ]
On a read-only filesystem, we won't invoke the block allocator, so we don't need to prefetch the block bitmaps.
This avoids starting and running the ext4lazyinit thread at all on a system with no read-write ext4 filesystems (for instance, a container VM with read-only filesystems underneath an overlayfs).
--- fs/ext4/super.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/ext4/super.c +3 -3
@@ -3953,9 +3953,9 @@ int ext4_register_li_request(struct super_block *sb, goto out; } -if (test_opt (sb,NO_PREFETCH_BLOCK_BITMAPS ) && - (first_not_zeroed == ngroups ||sb_rdonly (sb) || - !test_opt (sb,INIT_INODE_TABLE ))) +if (sb_rdonly (sb) || + (test_opt (sb,NO_PREFETCH_BLOCK_BITMAPS ) && + (first_not_zeroed == ngroups || !test_opt (sb,INIT_INODE_TABLE )))) goto out; elr =ext4_li_request_new (sb, first_not_zeroed);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 368/717 arm64: ftrace: fix module PLTs with mcount
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit 8cfb08575c6d4585f1ce0deeb189e5c824776b04 ]
Li Huafei reports that mcount-based ftrace with module PLTs was broken by commit:
a6253579977e4c6f ("arm64: ftrace: consistently handle PLTs.")
When a module PLTs are used and a module is loaded sufficiently far away from the kernel, we'll create PLTs for any branches which are out-of-range. These are separate from the special ftrace trampoline PLTs, which the module PLT code doesn't directly manipulate.
When mcount is in use this is a problem, as each mcount callsite in a module will be initialized to point to a module PLT, but since commit a6253579977e4c6f ftrace_make_nop() will assume that the callsite has been initialized to point to the special ftrace trampoline PLT, and ftrace_find_callable_addr() rejects other cases.
This means that when ftrace tries to initialize a callsite via ftrace_make_nop(), the call to ftrace_find_callable_addr() will find that the _mcount stub is out-of-range and is not handled by the ftrace PLT, resulting in a splat:
| ftrace_test: loading out-of-tree module taints kernel. | ftrace: no module PLT for _mcount | ------------[ ftrace bug ]------------ | ftrace failed to modify | [<ffff800029180014>] 0xffff800029180014 | actual: 44:00:00:94 | Initializing ftrace call sites | ftrace record flags: 2000000 | (0) | expected tramp: ffff80000802eb3c | ------------[ cut here ]------------ | WARNING: CPU: 3 PID: 157 at kernel/trace/ftrace.c:2120 ftrace_bug+0x94/0x270 | Modules linked in: | CPU: 3 PID: 157 Comm: insmod Tainted: G O 6.0.0-rc6-00151-gcd722513a189-dirty #22 | Hardware name: linux,dummy-virt (DT) | pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : ftrace_bug+0x94/0x270 | lr : ftrace_bug+0x21c/0x270 | sp : ffff80000b2bbaf0 | x29: ffff80000b2bbaf0 x28: 0000000000000000 x27: ffff0000c4d38000 | x26: 0000000000000001 x25: ffff800009d7e000 x24: ffff0000c4d86e00 | x23: 0000000002000000 x22: ffff80000a62b000 x21: ffff8000098ebea8 | x20: ffff0000c4d38000 x19: ffff80000aa24158 x18: ffffffffffffffff | x17: 0000000000000000 x16: 0a0d2d2d2d2d2d2d x15: ffff800009aa9118 | x14: 0000000000000000 x13: 6333626532303830 x12: 3030303866666666 | x11: 203a706d61727420 x10: 6465746365707865 x9 : 3362653230383030 | x8 : c0000000ffffefff x7 : 0000000000017fe8 x6 : 000000000000bff4 | x5 : 0000000000057fa8 x4 : 0000000000000000 x3 : 0000000000000001 | x2 : ad2cb14bb5438900 x1 : 0000000000000000 x0 : 0000000000000022 | Call trace: | ftrace_bug+0x94/0x270 | ftrace_process_locs+0x308/0x430 | ftrace_module_init+0x44/0x60 | load_module+0x15b4/0x1ce8 | __do_sys_init_module+0x1ec/0x238 | __arm64_sys_init_module+0x24/0x30 | invoke_syscall+0x54/0x118 | el0_svc_common.constprop.4+0x84/0x100 | do_el0_svc+0x3c/0xd0 | el0_svc+0x1c/0x50 | el0t_64_sync_handler+0x90/0xb8 | el0t_64_sync+0x15c/0x160 | ---[ end trace 0000000000000000 ]--- | ---------test_init-----------
Fix this by reverting to the old behaviour of ignoring the old instruction when initialising an mcount callsite in a module, which was the behaviour prior to commit a6253579977e4c6f.
--- arch/arm64/kernel/ftrace.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
arch/arm64/kernel/ftrace.c +16 -1
@@ -217,11 +217,26 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,unsigned long pc = rec->ip;u32 old =0 , new; + new =aarch64_insn_gen_nop (); + +/* +* When using mcount, callsites in modules may have been initalized to +* call an arbitrary module PLT (which redirects to the _mcount stub) +* rather than the ftrace PLT we'll use at runtime (which redirects to +* the ftrace trampoline). We can ignore the old PLT when initializing +* the callsite. +* +* Note: 'mod' is only set at module load time. +*/ +if (!IS_ENABLED (CONFIG_DYNAMIC_FTRACE_WITH_REGS ) && +IS_ENABLED (CONFIG_ARM64_MODULE_PLTS ) && mod) { +return aarch64_insn_patch_text_nosync ((void *)pc, new); + } +if (!ftrace_find_callable_addr (rec, mod, &addr))return -EINVAL ; old =aarch64_insn_gen_branch_imm (pc, addr,AARCH64_INSN_BRANCH_LINK ); - new =aarch64_insn_gen_nop ();return ftrace_modify_code (pc, old, new, true); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 369/717 ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit a08137bd1e0a7ce951dce9ce4a83e39d379b6e1b ]
EHCI Oxynos (drivers/usb/host/ehci-exynos.c) drives VBUS GPIO high when trying to power up the bus, therefore the GPIO in DTS must be marked as "active high". This will be important when EHCI driver is converted to gpiod API that respects declared polarities.
--- arch/arm/boot/dts/exynos4412-origen.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos4412-origen.dts +1 -1
@@ -95,7 +95,7 @@ }; &ehci { - samsung,vbus-gpio = <&gpx3 5 1>; + samsung,vbus-gpio = <&gpx3 5 GPIO_ACTIVE_HIGH>; status = "okay"; phys = <&exynos_usbphy 2>, <&exynos_usbphy 3>; phy-names = "hsic0", "hsic1";
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 370/717 iomap: iomap: fix memory corruption when recording errors during writeback
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit 3d5f3ba1ac28059bdf7000cae2403e4e984308d2 ]
Every now and then I see this crash on arm64:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8
Buffer I/O error on dev dm-0, logical block 8733687, async page read
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
user pgtable: 64k pages, 42-bit VAs, pgdp=0000000139750000
[00000000000000f8] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000, pmd=0000000000000000
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Buffer I/O error on dev dm-0, logical block 8733688, async page read Dumping ftrace buffer:
Buffer I/O error on dev dm-0, logical block 8733689, async page read
(ftrace buffer empty)
XFS (dm-0): log I/O error -5
Modules linked in: dm_thin_pool dm_persistent_data XFS (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ec/0x590 [xfs] (fs/xfs/xfs_trans_buf.c:296). dm_bio_prison
XFS (dm-0): Please unmount the filesystem and rectify the problem(s)
XFS (dm-0): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -5, agno 0
dm_bufio dm_log_writes xfs nft_chain_nat xt_REDIRECT nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_REJECT
potentially unexpected fatal signal 6.
nf_reject_ipv6
potentially unexpected fatal signal 6.
ipt_REJECT nf_reject_ipv4
CPU: 1 PID: 122166 Comm: fsstress Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7 rpcsec_gss_krb5 auth_rpcgss xt_tcpudp ip_set_hash_ip ip_set_hash_net xt_set nft_compat ip_set_hash_mac ip_set nf_tables Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 pstate: 60001000 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--) ip_tables pc : 000003fd6d7df200 x_tables lr : 000003fd6d7df1ec overlay nfsv4 CPU: 0 PID: 54031 Comm: u4:3 Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7405 Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 Workqueue: writeback wb_workfn sp : 000003ffd9522fd0 (flush-253:0) pstate: 60401005 (nZCv daif +PAN -UAO -TCO -DIT +SSBS BTYPE=--) pc : errseq_set+0x1c/0x100 x29: 000003ffd9522fd0 x28: 0000000000000023 x27: 000002acefeb6780 x26: 0000000000000005 x25: 0000000000000001 x24: 0000000000000000 x23: 00000000ffffffff x22: 0000000000000005 lr : __filemap_set_wb_err+0x24/0xe0 x21: 0000000000000006
sp : fffffe000f80f760
x29: fffffe000f80f760 x28: 0000000000000003 x27: fffffe000f80f9f8
x26: 0000000002523000 x25: 00000000fffffffb x24: fffffe000f80f868
x23: fffffe000f80fbb0 x22: fffffc0180c26a78 x21: 0000000002530000
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000001 x13: 0000000000470af3 x12: fffffc0058f70000
x11: 0000000000000040 x10: 0000000000001b20 x9 : fffffe000836b288 x8 : fffffc00eb9fd480 x7 : 0000000000f83659 x6 : 0000000000000000 x5 : 0000000000000869 x4 : 0000000000000005 x3 : 00000000000000f8
x20: 000003fd6d740020 x19: 000000000001dd36 x18: 0000000000000001
x17: 000003fd6d78704c x16: 0000000000000001 x15: 000002acfac87668 x2 : 0000000000000ffa x1 : 00000000fffffffb x0 : 00000000000000f8
Call trace: errseq_set+0x1c/0x100 __filemap_set_wb_err+0x24/0xe0 iomap_do_writepage+0x5e4/0xd5c write_cache_pages+0x208/0x674 iomap_writepages+0x34/0x60 xfs_vm_writepages+0x8c/0xcc [xfs 7a861f39c43631f15d3a5884246ba5035d4ca78b] x14: 0000000000000000 x13: 2064656e72757465 x12: 0000000000002180 x11: 000003fd6d8a82d0 x10: 0000000000000000 x9 : 000003fd6d8ae288 x8 : 0000000000000083 x7 : 00000000ffffffff x6 : 00000000ffffffee x5 : 00000000fbad2887 x4 : 000003fd6d9abb58 x3 : 000003fd6d740020 x2 : 0000000000000006 x1 : 000000000001dd36 x0 : 0000000000000000 CPU: 1 PID: 122167 Comm: fsstress Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7 do_writepages+0x90/0x1c4 __writeback_single_inode+0x4c/0x4ac Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 writeback_sb_inodes+0x214/0x4ac wb_writeback+0xf4/0x3b0 pstate: 60001000 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--) wb_workfn+0xfc/0x580 process_one_work+0x1e8/0x480 pc : 000003fd6d7df200 worker_thread+0x78/0x430
This crash is a result of iomap_writepage_map encountering some sort of error during writeback and wanting to set that error code in the file mapping so that fsync will report it. Unfortunately, the code dereferences folio->mapping after unlocking the folio, which means that another thread could have removed the page from the page cache (writeback doesn't hold the invalidation lock) and give it to somebody else.
At best we crash the system like above; at worst, we corrupt memory or set an error on some other unsuspecting file while failing to record the problems with *this* file. Regardless, fix the problem by reporting the error to the inode mapping.
NOTE: Commit 598ecfbaa742 lifted the XFS writeback code to iomap, so this fix should be backported to XFS in the 4.6-5.4 kernels in addition to iomap in the 5.5-5.19 kernels.
--- fs/iomap/buffered-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/iomap/buffered-io.c +1 -1
@@ -1412,7 +1412,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc,if (!count)folio_end_writeback (folio); done: -mapping_set_error (folio->mapping, error); +mapping_set_error (inode->i_mapping, error);return error; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 371/717 iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit bb73d5d9164c57c4bb916739a98e5cd8e0a5ed8c ]
All ADC HW versions handled by this driver (SAMA5D2, SAM9X60, SAMA7G5) have MR.TRACKTIM on 4 bits. Fix AT91_SAMA5D2_MR_TRACKTIM_MAX to reflect this.
--- drivers/iio/adc/at91-sama5d2_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/at91-sama5d2_adc.c +1 -1
@@ -77,7 +77,7 @@ struct at91_adc_reg_layout {#define AT91_SAMA5D2_MR_ANACH BIT(23)/* Tracking Time */ #define AT91_SAMA5D2_MR_TRACKTIM (v) ((v) << 24) -#define AT91_SAMA5D2_MR_TRACKTIM_MAX 0xff +#define AT91_SAMA5D2_MR_TRACKTIM_MAX 0xf/* Transfer Time */ #define AT91_SAMA5D2_MR_TRANSFER (v) ((v) << 28)#define AT91_SAMA5D2_MR_TRANSFER_MAX 0x3
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 372/717 iio: adc: at91-sama5d2_adc: check return status for pressure and touch
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit d84ace944a3b24529798dbae1340dea098473155 ]
Check return status of at91_adc_read_position() and at91_adc_read_pressure() in at91_adc_read_info_raw().
--- drivers/iio/adc/at91-sama5d2_adc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/iio/adc/at91-sama5d2_adc.c +6 -2
@@ -1544,8 +1544,10 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev, *val = tmp_val;mutex_unlock (&st->lock);iio_device_release_direct_mode (indio_dev); +if (ret >0 ) + ret =at91_adc_adjust_val_osr (st, val); -return at91_adc_adjust_val_osr (st, val); +return ret; }if (chan->type ==IIO_PRESSURE ) { ret =iio_device_claim_direct_mode (indio_dev);
@@ -1558,8 +1560,10 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev, *val = tmp_val;mutex_unlock (&st->lock);iio_device_release_direct_mode (indio_dev); +if (ret >0 ) + ret =at91_adc_adjust_val_osr (st, val); -return at91_adc_adjust_val_osr (st, val); +return ret; }/* in this case we have a voltage channel */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 373/717 iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 9780a23ed5a0a0a63683e078f576719a98d4fb70 ]
.read_raw()/.write_raw() could be called asynchronously from user space or other in kernel drivers. Without locking on st->lock these could be called asynchronously while there is a conversion in progress. Read will be harmless but changing registers while conversion is in progress may lead to inconsistent results. Thus, to avoid this lock st->lock.
--- drivers/iio/adc/at91-sama5d2_adc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/iio/adc/at91-sama5d2_adc.c +8 -4
@@ -1542,10 +1542,10 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev, ret =at91_adc_read_position (st, chan->channel, &tmp_val); *val = tmp_val; -mutex_unlock (&st->lock); -iio_device_release_direct_mode (indio_dev);if (ret >0 ) ret =at91_adc_adjust_val_osr (st, val); +mutex_unlock (&st->lock); +iio_device_release_direct_mode (indio_dev);return ret; }
@@ -1558,10 +1558,10 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev, ret =at91_adc_read_pressure (st, chan->channel, &tmp_val); *val = tmp_val; -mutex_unlock (&st->lock); -iio_device_release_direct_mode (indio_dev);if (ret >0 ) ret =at91_adc_adjust_val_osr (st, val); +mutex_unlock (&st->lock); +iio_device_release_direct_mode (indio_dev);return ret; }
@@ -1650,16 +1650,20 @@ static int at91_adc_write_raw(struct iio_dev *indio_dev,/* if no change, optimize out */ if (val == st->oversampling_ratio)return 0 ; +mutex_lock (&st->lock); st->oversampling_ratio = val;/* update ratio */ at91_adc_config_emr (st); +mutex_unlock (&st->lock);return 0 ;case IIO_CHAN_INFO_SAMP_FREQ :if (val < st->soc_info.min_sample_rate || val > st->soc_info.max_sample_rate)return -EINVAL ; +mutex_lock (&st->lock);at91_adc_setup_samp_freq (indio_dev, val); +mutex_unlock (&st->lock);return 0 ;default :return -EINVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 374/717 iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 808175e21d9b7f866eda742e8970f27b78afe5db ]
In case triggered buffers are enabled while system is suspended they will not work anymore after resume. For this call at91_adc_buffer_postdisable() on suspend and at91_adc_buffer_prepare() on resume. On tests it has been seen that at91_adc_buffer_postdisable() call is not necessary but it has been kept because it also does the book keeping for DMA. On resume path there is no need to call at91_adc_configure_touch() as it is embedded in at91_adc_buffer_prepare().
--- drivers/iio/adc/at91-sama5d2_adc.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/iio/adc/at91-sama5d2_adc.c +7 -7
@@ -2116,6 +2116,9 @@ static __maybe_unused int at91_adc_suspend(struct device *dev)struct iio_dev *indio_dev =dev_get_drvdata (dev);struct at91_adc_state *st =iio_priv (indio_dev); +if (iio_buffer_enabled (indio_dev)) +at91_adc_buffer_postdisable (indio_dev); +/* * Do a sofware reset of the ADC before we go to suspend. * this will ensure that all pins are free from being muxed by the ADC
@@ -2159,14 +2162,11 @@ static __maybe_unused int at91_adc_resume(struct device *dev)if (!iio_buffer_enabled (indio_dev))return 0 ; -/* check if we are enabling triggered buffer or the touchscreen */ -if (at91_adc_current_chan_is_touch (indio_dev)) -return at91_adc_configure_touch (st, true); -else -return at91_adc_configure_trigger (st->trig, true); + ret =at91_adc_buffer_prepare (indio_dev); +if (ret) + goto vref_disable_resume; -/* not needed but more explicit */ -return 0 ; +return at91_adc_configure_trigger (st->trig, true); vref_disable_resume:regulator_disable (st->vref);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 375/717 iio: inkern: only release the device node when done with it
In reply to Greg Kroah-HartmanFrom: Nuno Sá <[email protected]>
[ Upstream commit 79c3e84874c7d14f04ad58313b64955a0d2e9437 ]
'of_node_put()' can potentially release the memory pointed to by 'iiospec.np' which would leave us with an invalid pointer (and we would still pass it in 'of_xlate()'). Note that it is not guaranteed for the of_node lifespan to be attached to the device (to which is attached) lifespan so that there is (even though very unlikely) the possibility for the node to be freed while the device is still around. Thus, as there are indeed some of_xlate users which do access the node, a race is indeed possible.
As such, we can only release the node after we are done with it.
--- drivers/iio/inkern.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/iio/inkern.c +4 -2
@@ -165,9 +165,10 @@ static int __of_iio_channel_get(struct iio_channel *channel, idev =bus_find_device (&iio_bus_type,NULL , iiospec.np, iio_dev_node_match); -of_node_put (iiospec.np); -if (idev ==NULL ) +if (idev ==NULL ) { +of_node_put (iiospec.np);return -EPROBE_DEFER ; + } indio_dev =dev_to_iio_dev (idev); channel->indio_dev = indio_dev;
@@ -175,6 +176,7 @@ static int __of_iio_channel_get(struct iio_channel *channel, index = indio_dev->info->of_xlate (indio_dev, &iiospec); else index =__of_iio_simple_xlate (indio_dev, &iiospec); +of_node_put (iiospec.np);if (index <0 ) goto err_put; channel->channel = &indio_dev->channels[index];
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 376/717 iio: inkern: fix return value in devm_of_iio_channel_get_by_name()
In reply to Greg Kroah-HartmanFrom: Nuno Sá <[email protected]>
[ Upstream commit 9e878dbc0e8322f8b2f5ab0093c1e89926362dbe ]
of_iio_channel_get_by_name() can either return NULL or an error pointer so that only doing IS_ERR() is not enough. Fix it by checking the NULL pointer case and return -ENODEV in that case. Note this is done like this so that users of the function (which only check for error pointers) do not need to be changed. This is not ideal since we are losing error codes and as such, in a follow up change, things will be unified so that of_iio_channel_get_by_name() only returns error codes.
--- drivers/iio/inkern.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/iio/inkern.c +2 -0
@@ -412,6 +412,8 @@ struct iio_channel *devm_of_iio_channel_get_by_name(struct device *dev, channel =of_iio_channel_get_by_name (np, channel_name);if (IS_ERR (channel))return channel; +if (!channel) +return ERR_PTR (-ENODEV ); ret =devm_add_action_or_reset (dev, devm_iio_channel_free, channel);if (ret)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 377/717 iio: ABI: Fix wrong format of differential capacitance channel ABI.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
[ Upstream commit 1efc41035f1841acf0af2bab153158e27ce94f10 ]
in_ only occurs once in these attributes.
--- Documentation/ABI/testing/sysfs-bus-iio | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/ABI/testing/sysfs-bus-iio +1 -1
@@ -188,7 +188,7 @@ Description: Raw capacitance measurement from channel Y. Units after application of scale and offset are nanofarads. -What: /sys/.../iio:deviceX/in_capacitanceY-in_capacitanceZ_raw +What: /sys/.../iio:deviceX/in_capacitanceY-capacitanceZ_raw KernelVersion: 3.2 Contact: [email protected] Description:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 378/717 iio: magnetometer: yas530: Change data type of hard_offsets to signed
In reply to Greg Kroah-HartmanFrom: Jakob Hauser <[email protected]>
[ Upstream commit e137fafc8985cf152a4bb6f18ae83ebb06816df1 ]
The "hard_offsets" are currently unsigned u8 but they should be signed as they can get negative. They are signed in function yas5xx_meaure_offsets() and in the Yamaha drivers [1][2].
[1] https://github.com/NovaFusion/android_kernel_samsung_golden/blob/cm-12.1/drivers/sensor/compass/yas.h#L156
[2] https://github.com/msm8916-mainline/android_kernel_qcom_msm8916/blob/GT-I9195I/drivers/iio/magnetometer/yas_mag_drv-yas532.c#L91
--- drivers/iio/magnetometer/yamaha-yas530.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/magnetometer/yamaha-yas530.c +1 -1
@@ -132,7 +132,7 @@ struct yas5xx {unsigned int version;char name[16 ];struct yas5xx_calibration calibration; -u8 hard_offsets[3 ]; +s8 hard_offsets[3 ];struct iio_mount_matrix orientation;struct regmap *map;struct regulator_bulk_data regs[2 ];
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 379/717 RDMA/mlx5: Dont compare mkey tags in DEVX indirect mkey
In reply to Greg Kroah-HartmanFrom: Aharon Landau <[email protected]>
[ Upstream commit 13ad1125b941a5f257d9d3ae70485773abd34792 ]
According to the ib spec:
If the CI supports the Base Memory Management Extensions defined in this specification, the L_Key format must consist of:
24 bit index in the most significant bits of the R_Key, and 8 bit key in the least significant bits of the R_Key
Through a successful Allocate L_Key verb invocation, the CI must let the consumer own the key portion of the returned R_Key
Therefore, when creating a mkey using DEVX, the consumer is allowed to change the key part. The kernel should compare only the index part of a R_Key to determine equality with another R_Key.
Adding capability in order not to break backward compatibility.
--- drivers/infiniband/hw/mlx5/main.c | 3 +++ drivers/infiniband/hw/mlx5/odp.c | 3 ++- include/uapi/rdma/mlx5-abi.h | 1 + 3 files changed, 6 insertions(+), 1 deletion(-)
drivers/infiniband/hw/mlx5/main.c +3 -0
@@ -1826,6 +1826,9 @@ static int set_ucontext_resp(struct ib_ucontext *uctx,if (MLX5_CAP_GEN (dev->mdev, drain_sigerr)) resp->comp_mask |=MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_SQD2RTS ; + resp->comp_mask |= +MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_MKEY_UPDATE_TAG ; +return 0 ; }
drivers/infiniband/hw/mlx5/odp.c +2 -1
@@ -795,7 +795,8 @@ static bool mkey_is_eq(struct mlx5_ib_mkey *mmkey, u32 key) {if (!mmkey)return false; -if (mmkey->type ==MLX5_MKEY_MW ) +if (mmkey->type ==MLX5_MKEY_MW || + mmkey->type ==MLX5_MKEY_INDIRECT_DEVX )return mlx5_base_mkey (mmkey->key) ==mlx5_base_mkey (key);return mmkey->key == key; }
include/uapi/rdma/mlx5-abi.h +1 -0
@@ -104,6 +104,7 @@ enum mlx5_ib_alloc_ucontext_resp_mask {MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_ECE =1UL <<2 ,MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_SQD2RTS =1UL <<3 ,MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_REAL_TIME_TS =1UL <<4 , + MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_MKEY_UPDATE_TAG = 1UL << 5, }; enum mlx5_user_cmds_supp_uhw {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 380/717 usb: common: debug: Check non-standard control requests
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
[ Upstream commit b6155eaf6b05e558218b44b88a6cad03f15a586c ]
Previously usb_decode_ctrl() only decodes standard control requests, but it was used for non-standard requests also. If it's non-standard or unknown standard bRequest, print the Setup data values.
--- drivers/usb/common/debug.c | 96 +++++++++++++++++++++++++------------- 1 file changed, 64 insertions(+), 32 deletions(-)
drivers/usb/common/debug.c +64 -32
@@ -208,30 +208,28 @@ static void usb_decode_set_isoch_delay(__u8 wValue, char *str, size_t size)snprintf (str, size,"Set Isochronous Delay(Delay = %d ns)" , wValue); } -/** -* usb_decode_ctrl - Returns human readable representation of control request. -* @str: buffer to return a human-readable representation of control request. -* This buffer should have about 200 bytes. -* @size: size of str buffer. -* @bRequestType: matches the USB bmRequestType field -* @bRequest: matches the USB bRequest field -* @wValue: matches the USB wValue field (CPU byte order) -* @wIndex: matches the USB wIndex field (CPU byte order) -* @wLength: matches the USB wLength field (CPU byte order) -* -* Function returns decoded, formatted and human-readable description of -* control request packet. -* -* The usage scenario for this is for tracepoints, so function as a return -* use the same value as in parameters. This approach allows to use this -* function in TP_printk -* -* Important: wValue, wIndex, wLength parameters before invoking this function -* should be processed by le16_to_cpu macro. -*/ -const char *usb_decode_ctrl (char *str,size_t size,__u8 bRequestType, -__u8 bRequest,__u16 wValue,__u16 wIndex, -__u16 wLength) +static void usb_decode_ctrl_generic (char *str,size_t size,__u8 bRequestType, +__u8 bRequest,__u16 wValue,__u16 wIndex, +__u16 wLength) +{ +u8 recip = bRequestType &USB_RECIP_MASK ; +u8 type = bRequestType &USB_TYPE_MASK ; + +snprintf (str, size, +"Type=%s Recipient=%s Dir=%s bRequest=%u wValue=%u wIndex=%u wLength=%u" , + (type ==USB_TYPE_STANDARD ) ?"Standard" : + (type ==USB_TYPE_VENDOR ) ?"Vendor" : + (type ==USB_TYPE_CLASS ) ?"Class" :"Unknown" , + (recip ==USB_RECIP_DEVICE ) ?"Device" : + (recip ==USB_RECIP_INTERFACE ) ?"Interface" : + (recip ==USB_RECIP_ENDPOINT ) ?"Endpoint" :"Unknown" , + (bRequestType &USB_DIR_IN ) ?"IN" :"OUT" , + bRequest, wValue, wIndex, wLength); +} + +static void usb_decode_ctrl_standard (char *str,size_t size,__u8 bRequestType, +__u8 bRequest,__u16 wValue,__u16 wIndex, +__u16 wLength) {switch (bRequest) {case USB_REQ_GET_STATUS :
@@ -272,14 +270,48 @@ const char *usb_decode_ctrl(char *str, size_t size, __u8 bRequestType,usb_decode_set_isoch_delay (wValue, str, size);break ;default : -snprintf (str, size,"%02x %02x %02x %02x %02x %02x %02x %02x" , - bRequestType, bRequest, - (u8)(cpu_to_le16 (wValue) &0xff ), - (u8)(cpu_to_le16 (wValue) >>8 ), - (u8)(cpu_to_le16 (wIndex) &0xff ), - (u8)(cpu_to_le16 (wIndex) >>8 ), - (u8)(cpu_to_le16 (wLength) &0xff ), - (u8)(cpu_to_le16 (wLength) >>8 )); +usb_decode_ctrl_generic (str, size, bRequestType, bRequest, + wValue, wIndex, wLength); +break ; + } +} + +/** +* usb_decode_ctrl - Returns human readable representation of control request. +* @str: buffer to return a human-readable representation of control request. +* This buffer should have about 200 bytes. +* @size: size of str buffer. +* @bRequestType: matches the USB bmRequestType field +* @bRequest: matches the USB bRequest field +* @wValue: matches the USB wValue field (CPU byte order) +* @wIndex: matches the USB wIndex field (CPU byte order) +* @wLength: matches the USB wLength field (CPU byte order) +* +* Function returns decoded, formatted and human-readable description of +* control request packet. +* +* The usage scenario for this is for tracepoints, so function as a return +* use the same value as in parameters. This approach allows to use this +* function in TP_printk +* +* Important: wValue, wIndex, wLength parameters before invoking this function +* should be processed by le16_to_cpu macro. +*/ +const char *usb_decode_ctrl (char *str,size_t size,__u8 bRequestType, +__u8 bRequest,__u16 wValue,__u16 wIndex, +__u16 wLength) +{ +switch (bRequestType &USB_TYPE_MASK ) { +case USB_TYPE_STANDARD : +usb_decode_ctrl_standard (str, size, bRequestType, bRequest, + wValue, wIndex, wLength); +break ; +case USB_TYPE_VENDOR : +case USB_TYPE_CLASS : +default : +usb_decode_ctrl_generic (str, size, bRequestType, bRequest, + wValue, wIndex, wLength); +break ; }return str;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 381/717 clk: meson: Hold reference returned by of_get_parent()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 89ab396d712f7c91fe94f55cff23460426f5fc81 ]
We should hold the reference returned by of_get_parent() and use it to call of_node_put() for refcount balance.
--- drivers/clk/meson/meson-aoclk.c | 5 ++++- drivers/clk/meson/meson-eeclk.c | 5 ++++- drivers/clk/meson/meson8b.c | 5 ++++- 3 files changed, 12 insertions(+), 3 deletions(-)
drivers/clk/meson/meson-aoclk.c +4 -1
@@ -38,6 +38,7 @@ int meson_aoclkc_probe(struct platform_device *pdev)struct meson_aoclk_reset_controller *rstc;struct meson_aoclk_data *data;struct device *dev = &pdev->dev; +struct device_node *np;struct regmap *regmap;int ret, clkid;
@@ -49,7 +50,9 @@ int meson_aoclkc_probe(struct platform_device *pdev)if (!rstc)return -ENOMEM ; - regmap =syscon_node_to_regmap (of_get_parent (dev->of_node)); + np =of_get_parent (dev->of_node); + regmap =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (regmap)) {dev_err (dev,"failed to get regmap\n" );return PTR_ERR (regmap);
drivers/clk/meson/meson-eeclk.c +4 -1
@@ -18,6 +18,7 @@ int meson_eeclkc_probe(struct platform_device *pdev) {const struct meson_eeclkc_data *data;struct device *dev = &pdev->dev; +struct device_node *np;struct regmap *map;int ret, i;
@@ -26,7 +27,9 @@ int meson_eeclkc_probe(struct platform_device *pdev)return -EINVAL ;/* Get the hhi system controller node */ - map =syscon_node_to_regmap (of_get_parent (dev->of_node)); + np =of_get_parent (dev->of_node); + map =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (map)) {dev_err (dev,"failed to get HHI regmap\n" );
drivers/clk/meson/meson8b.c +4 -1
@@ -3792,12 +3792,15 @@ static void __init meson8b_clkc_init_common(struct device_node *np, struct clk_hw_onecell_data *clk_hw_onecell_data) {struct meson8b_clk_reset *rstc; +struct device_node *parent_np;const char *notifier_clk_name;struct clk *notifier_clk;struct regmap *map;int i, ret; - map =syscon_node_to_regmap (of_get_parent (np)); + parent_np =of_get_parent (np); + map =syscon_node_to_regmap (parent_np); +of_node_put (parent_np);if (IS_ERR (map)) {pr_err ("failed to get HHI regmap - Trying obsolete regs\n" );return ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 382/717 clk: st: Hold reference returned by of_get_parent()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 429973306f860470cbbb8402c8c53143b450faba ]
We should hold the reference returned by of_get_parent() and use it to call of_node_put() for refcount balance.
--- drivers/clk/st/clkgen-fsyn.c | 5 ++++- drivers/clk/st/clkgen-mux.c | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-)
drivers/clk/st/clkgen-fsyn.c +4 -1
@@ -987,6 +987,7 @@ static void __init st_of_quadfs_setup(struct device_node *np,const char *pll_name, *clk_parent_name;void __iomem *reg;spinlock_t *lock; +struct device_node *parent_np;/* * First check for reg property within the node to keep backward
@@ -994,7 +995,9 @@ static void __init st_of_quadfs_setup(struct device_node *np,*/ reg =of_iomap (np,0 );if (!reg) { - reg =of_iomap (of_get_parent (np),0 ); + parent_np =of_get_parent (np); + reg =of_iomap (parent_np,0 ); +of_node_put (parent_np);if (!reg) {pr_err ("%s: Failed to get base address\n" , __func__);return ;
drivers/clk/st/clkgen-mux.c +4 -1
@@ -56,6 +56,7 @@ static void __init st_of_clkgen_mux_setup(struct device_node *np,void __iomem *reg;const char **parents;int num_parents =0 ; +struct device_node *parent_np;/* * First check for reg property within the node to keep backward
@@ -63,7 +64,9 @@ static void __init st_of_clkgen_mux_setup(struct device_node *np,*/ reg =of_iomap (np,0 );if (!reg) { - reg =of_iomap (of_get_parent (np),0 ); + parent_np =of_get_parent (np); + reg =of_iomap (parent_np,0 ); +of_node_put (parent_np);if (!reg) {pr_err ("%s: Failed to get base address\n" , __func__);return ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 383/717 clk: oxnas: Hold reference returned by of_get_parent()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 1d6aa08c54cd0e005210ab8e3b1e92ede70f8a4f ]
In oxnas_stdclk_probe(), we need to hold the reference returned by of_get_parent() and use it to call of_node_put() for refcount balance.
--- drivers/clk/clk-oxnas.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/clk/clk-oxnas.c +4 -2
@@ -207,7 +207,7 @@ static const struct of_device_id oxnas_stdclk_dt_ids[] = {static int oxnas_stdclk_probe (struct platform_device *pdev) { -struct device_node *np = pdev->dev.of_node; +struct device_node *np = pdev->dev.of_node, *parent_np;const struct oxnas_stdclk_data *data;struct regmap *regmap;int ret;
@@ -215,7 +215,9 @@ static int oxnas_stdclk_probe(struct platform_device *pdev) data =of_device_get_match_data (&pdev->dev); - regmap =syscon_node_to_regmap (of_get_parent (np)); + parent_np =of_get_parent (np); + regmap =syscon_node_to_regmap (parent_np); +of_node_put (parent_np);if (IS_ERR (regmap)) {dev_err (&pdev->dev,"failed to have parent regmap\n" );return PTR_ERR (regmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 384/717 clk: qoriq: Hold reference returned by of_get_parent()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit a8ea4273bc26256ce3cce83164f0f51c5bf6e127 ]
In legacy_init_clockgen(), we need to hold the reference returned by of_get_parent() and use it to call of_node_put() for refcount balance.
Beside, in create_sysclk(), we need to call of_node_put() on 'sysclk' also for refcount balance.
--- drivers/clk/clk-qoriq.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/clk/clk-qoriq.c +8 -2
@@ -1063,8 +1063,13 @@ static void __init _clockgen_init(struct device_node *np, bool legacy);*/ static void __init legacy_init_clockgen (struct device_node *np) { -if (!clockgen.node) -_clockgen_init (of_get_parent (np), true); +if (!clockgen.node) { +struct device_node *parent_np; + + parent_np =of_get_parent (np); +_clockgen_init (parent_np, true); +of_node_put (parent_np); + } }/* Legacy node */
@@ -1159,6 +1164,7 @@ static struct clk * __init create_sysclk(const char *name) sysclk =of_get_child_by_name (clockgen.node,"sysclk" );if (sysclk) { clk =sysclk_from_fixed (sysclk, name); +of_node_put (sysclk);if (!IS_ERR (clk))return clk; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 385/717 clk: berlin: Add of_node_put() for of_get_parent()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 37c381b812dcbfde9c3f1f3d3e75fdfc1b40d5bc ]
In berlin2_clock_setup() and berlin2q_clock_setup(), we need to call of_node_put() for the reference returned by of_get_parent() which has increased the refcount. We should call *_put() in fail path or when it is not used anymore.
--- drivers/clk/berlin/bg2.c | 5 ++++- drivers/clk/berlin/bg2q.c | 6 +++++- 2 files changed, 9 insertions(+), 2 deletions(-)
drivers/clk/berlin/bg2.c +4 -1
@@ -500,12 +500,15 @@ static void __init berlin2_clock_setup(struct device_node *np)int n, ret; clk_data =kzalloc (struct_size (clk_data, hws,MAX_CLKS ),GFP_KERNEL ); -if (!clk_data) +if (!clk_data) { +of_node_put (parent_np);return ; + } clk_data->num =MAX_CLKS ; hws = clk_data->hws; gbase =of_iomap (parent_np,0 ); +of_node_put (parent_np);if (!gbase)return ;
drivers/clk/berlin/bg2q.c +5 -1
@@ -286,19 +286,23 @@ static void __init berlin2q_clock_setup(struct device_node *np)int n, ret; clk_data =kzalloc (struct_size (clk_data, hws,MAX_CLKS ),GFP_KERNEL ); -if (!clk_data) +if (!clk_data) { +of_node_put (parent_np);return ; + } clk_data->num =MAX_CLKS ; hws = clk_data->hws; gbase =of_iomap (parent_np,0 );if (!gbase) { +of_node_put (parent_np);pr_err ("%pOF: Unable to map global base\n" , np);return ; }/* BG2Q CPU PLL is not part of global registers */ cpupll_base =of_iomap (parent_np,1 ); +of_node_put (parent_np);if (!cpupll_base) {pr_err ("%pOF: Unable to map cpupll base\n" , np);iounmap (gbase);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 386/717 clk: sprd: Hold reference returned by of_get_parent()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 91e6455bf715fb1558a0bf8f645ec1c131254a3c ]
We should hold the reference returned by of_get_parent() and use it to call of_node_put() for refcount balance.
--- drivers/clk/sprd/common.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/clk/sprd/common.c +5 -4
@@ -41,7 +41,7 @@ int sprd_clk_regmap_init(struct platform_device *pdev, {void __iomem *base;struct device *dev = &pdev->dev; -struct device_node *node = dev->of_node; +struct device_node *node = dev->of_node, *np;struct regmap *regmap;if (of_find_property (node,"sprd,syscon" ,NULL )) {
@@ -50,9 +50,10 @@ int sprd_clk_regmap_init(struct platform_device *pdev,pr_err ("%s: failed to get syscon regmap\n" , __func__);return PTR_ERR (regmap); } - }else if (of_device_is_compatible (of_get_parent (dev->of_node), -"syscon" )) { - regmap =device_node_to_regmap (of_get_parent (dev->of_node)); + }else if (of_device_is_compatible (np =of_get_parent (node),"syscon" ) || + (of_node_put (np),0 )) { + regmap =device_node_to_regmap (np); +of_node_put (np);if (IS_ERR (regmap)) {dev_err (dev,"failed to get regmap from its parent.\n" );return PTR_ERR (regmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 387/717 clk: tegra: Fix refcount leak in tegra210_clock_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 56c78cb1f00a9dde8cd762131ce8f4c5eb046fbb ]
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/clk/tegra/clk-tegra210.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/tegra/clk-tegra210.c +1 -0
@@ -3748,6 +3748,7 @@ static void __init tegra210_clock_init(struct device_node *np) } pmc_base =of_iomap (node,0 ); +of_node_put (node);if (!pmc_base) {pr_err ("Can't map pmc registers\n" );WARN_ON (1 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 388/717 clk: tegra: Fix refcount leak in tegra114_clock_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit db16a80c76ea395766913082b1e3f939dde29b2c ]
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/clk/tegra/clk-tegra114.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/tegra/clk-tegra114.c +1 -0
@@ -1317,6 +1317,7 @@ static void __init tegra114_clock_init(struct device_node *np) } pmc_base =of_iomap (node,0 ); +of_node_put (node);if (!pmc_base) {pr_err ("Can't map pmc registers\n" );WARN_ON (1 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 389/717 clk: tegra20: Fix refcount leak in tegra20_clock_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 4e343bafe03ff68a62f48f8235cf98f2c685468b ]
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/clk/tegra/clk-tegra20.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/tegra/clk-tegra20.c +1 -0
@@ -1131,6 +1131,7 @@ static void __init tegra20_clock_init(struct device_node *np) } pmc_base =of_iomap (node,0 ); +of_node_put (node);if (!pmc_base) {pr_err ("Can't map pmc registers\n" );BUG ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 390/717 clk: samsung: exynosautov9: correct register offsets of peric0/c1
In reply to Greg Kroah-HartmanFrom: Chanho Park <[email protected]>
[ Upstream commit 67d98943408bce835185688cb75ebbb45b91e572 ]
Some register offsets of peric0 and peric1 cmu blocks need to be corrected and re-ordered by numerical order.
--- drivers/clk/samsung/clk-exynosautov9.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/clk/samsung/clk-exynosautov9.c +10 -10
@@ -1170,9 +1170,9 @@ static const struct samsung_cmu_info fsys2_cmu_info __initconst = {#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_2 0x2058#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_3 0x205c#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_4 0x2060 -#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_7 0x206c#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_5 0x2064#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_6 0x2068 +#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_7 0x206c#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_8 0x2070#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_9 0x2074#define CLK_CON_GAT_GOUT_BLK_PERIC0_UID_PERIC0_TOP0_IPCLKPORT_PCLK_10 0x204c
@@ -1418,14 +1418,14 @@ static const struct samsung_cmu_info peric0_cmu_info __initconst = {#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_IPCLK_11 0x2020#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_0 0x2044#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_1 0x2048 -#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_2 0x2058 -#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_3 0x205c -#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_4 0x2060 -#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_7 0x206c -#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_5 0x2064 -#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_6 0x2068 -#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_8 0x2070 -#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_9 0x2074 +#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_2 0x2054 +#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_3 0x2058 +#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_4 0x205c +#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_5 0x2060 +#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_6 0x2064 +#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_7 0x2068 +#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_8 0x206c +#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_9 0x2070#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_10 0x204c#define CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_11 0x2050
@@ -1463,9 +1463,9 @@ static const unsigned long peric1_clk_regs[] __initconst = {CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_2 ,CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_3 ,CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_4 , -CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_7 ,CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_5 ,CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_6 , +CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_7 ,CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_8 ,CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_9 , CLK_CON_GAT_GOUT_BLK_PERIC1_UID_PERIC1_TOP0_IPCLKPORT_PCLK_10,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 391/717 HSI: omap_ssi: Fix refcount leak in ssi_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9a2ea132df860177b33c9fd421b26c4e9a0a9396 ]
When returning or breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the child node to possibly release the node.
--- drivers/hsi/controllers/omap_ssi_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/hsi/controllers/omap_ssi_core.c +1 -0
@@ -524,6 +524,7 @@ static int ssi_probe(struct platform_device *pd)if (!childpdev) { err = -ENODEV ;dev_err (&pd->dev,"failed to create ssi controller port\n" ); +of_node_put (child); goto out3; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 392/717 HSI: omap_ssi_port: Fix dma_map_sg error check
In reply to Greg Kroah-HartmanFrom: Jack Wang <[email protected]>
[ Upstream commit 551e325bbd3fb8b5a686ac1e6cf76e5641461cf2 ]
dma_map_sg return 0 on error, in case of error return -EIO to caller.
--- drivers/hsi/controllers/omap_ssi_port.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/hsi/controllers/omap_ssi_port.c +4 -4
@@ -230,10 +230,10 @@ static int ssi_start_dma(struct hsi_msg *msg, int lch)if (msg->ttype ==HSI_MSG_READ ) { err =dma_map_sg (&ssi->device, msg->sgt.sgl, msg->sgt.nents,DMA_FROM_DEVICE ); -if (err <0 ) { +if (!err) {dev_dbg (&ssi->device,"DMA map SG failed !\n" );pm_runtime_put_autosuspend (omap_port->pdev); -return err; +return -EIO ; } csdp = SSI_DST_BURST_4x32_BIT |SSI_DST_MEMORY_PORT | SSI_SRC_SINGLE_ACCESS0 | SSI_SRC_PERIPHERAL_PORT |
@@ -247,10 +247,10 @@ static int ssi_start_dma(struct hsi_msg *msg, int lch) }else { err =dma_map_sg (&ssi->device, msg->sgt.sgl, msg->sgt.nents,DMA_TO_DEVICE ); -if (err <0 ) { +if (!err) {dev_dbg (&ssi->device,"DMA map SG failed !\n" );pm_runtime_put_autosuspend (omap_port->pdev); -return err; +return -EIO ; } csdp = SSI_SRC_BURST_4x32_BIT |SSI_SRC_MEMORY_PORT | SSI_DST_SINGLE_ACCESS0 | SSI_DST_PERIPHERAL_PORT |
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 393/717 clk: qcom: gcc-sdm660: Use floor ops for SDCC1 clock
In reply to Greg Kroah-HartmanFrom: Marijn Suijten <[email protected]>
[ Upstream commit 6956c18f4ad9200aa945f7ea37d65a05afc49d51 ]
In commit 3f905469c8ce ("clk: qcom: gcc: Use floor ops for SDCC clocks") floor ops were applied to SDCC2 only, but flooring is also required on the SDCC1 apps clock which is used by the eMMC card on Sony's Nile platform, and otherwise result in the typicial "Card appears overclocked" warnings observed on many other platforms before:
mmc0: Card appears overclocked; req 52000000 Hz, actual 100000000 Hz
mmc0: Card appears overclocked; req 52000000 Hz, actual 100000000 Hz
mmc0: Card appears overclocked; req 104000000 Hz, actual 192000000 Hz--- drivers/clk/qcom/gcc-sdm660.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/qcom/gcc-sdm660.c +1 -1
@@ -757,7 +757,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { .name = "sdcc1_apps_clk_src", .parent_data = gcc_parent_data_xo_gpll0_gpll4_gpll0_early_div, .num_parents = ARRAY_SIZE(gcc_parent_data_xo_gpll0_gpll4_gpll0_early_div), - .ops = &clk_rcg2_ops, + .ops = &clk_rcg2_floor_ops, }, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 394/717 media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 211f8304fa21aaedc2c247f0c9d6c7f1aaa61ad7 ]
In fimc_is_register_subdevs(), we need to call of_node_put() for the reference 'i2c_bus' when breaking out of the for_each_compatible_node() which has increased the refcount.
--- drivers/media/platform/samsung/exynos4-is/fimc-is.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/samsung/exynos4-is/fimc-is.c +1 -0
@@ -213,6 +213,7 @@ static int fimc_is_register_subdevs(struct fimc_is *is)if (ret <0 || index >=FIMC_IS_SENSORS_NUM ) {of_node_put (child); +of_node_put (i2c_bus);return ret; } index++;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 395/717 tty: xilinx_uartps: Fix the ignore_status
In reply to Greg Kroah-HartmanFrom: Shubhrajyoti Datta <[email protected]>
[ Upstream commit b8a6c3b3d4654fba19881cc77da61eac29f57cae ]
Currently the ignore_status is not considered in the isr. Add a check to add the ignore_status.
--- drivers/tty/serial/xilinx_uartps.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/xilinx_uartps.c +2 -0
@@ -361,6 +361,8 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id) isrstatus &= ~CDNS_UART_IXR_TXEMPTY ; } + isrstatus &= port->read_status_mask; + isrstatus &= ~port->ignore_status_mask;/* * Skip RX processing if RX is disabled as RXEMPTY will never be set * as read bytes will not be removed from the FIFO.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 396/717 media: amphion: insert picture startcode after seek for vc1g format
In reply to Greg Kroah-HartmanFrom: Ming Qian <[email protected]>
[ Upstream commit f7fd6c318c8a5d06bf3fe611f30763d62eaaf7f0 ]
For format vc1, the amphion vpu requires driver to help insert some custom startcode before sequence and frame. the startcode is different for vc1l and vc1g format.
But the sequence startcode is only needed at the beginning, and it's not expected after seek.
driver need to treat the codec header and the first frame after seek as a normal frame, and insert picture startcode for it.
In previous patch, I just fix it for vc1l format,
and should fix the similar issue for vc1g too.
--- drivers/media/platform/amphion/vpu_malone.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/amphion/vpu_malone.c +1 -1
@@ -1277,7 +1277,7 @@ static int vpu_malone_insert_scode_vc1_g_pic(struct malone_scode_t *scode) vbuf =to_vb2_v4l2_buffer (scode->vb); data =vb2_plane_vaddr (scode->vb,0 ); -if (vbuf->sequence ==0 ||vpu_vb_is_codecconfig (vbuf)) +if (scode->inst->total_input_count ==0 ||vpu_vb_is_codecconfig (vbuf))return 0 ;if (MALONE_VC1_CONTAIN_NAL (*data))return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 397/717 media: amphion: adjust the encoders value range of gop size
In reply to Greg Kroah-HartmanFrom: Ming Qian <[email protected]>
[ Upstream commit 996f4e89fabe44ab9ac0aabb0697aeecbe717eca ]
adjust the value range of gop size from [0, 65535] to [1, 8000]. when the gop size is set to a too large value,
it may affect the encoded picture quality.
so constrain it to a reasonable range.
--- drivers/media/platform/amphion/venc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/amphion/venc.c +1 -1
@@ -644,7 +644,7 @@ static int venc_ctrl_init(struct vpu_inst *inst) BITRATE_DEFAULT_PEAK);v4l2_ctrl_new_std (&inst->ctrl_handler, &venc_ctrl_ops, -V4L2_CID_MPEG_VIDEO_GOP_SIZE ,0 , (1 <<16 ) -1 ,1 ,30 ); +V4L2_CID_MPEG_VIDEO_GOP_SIZE ,1 ,8000 ,1 ,30 );v4l2_ctrl_new_std (&inst->ctrl_handler, &venc_ctrl_ops,V4L2_CID_MPEG_VIDEO_B_FRAMES ,0 ,4 ,1 ,0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 398/717 media: amphion: dont change the colorspace reported by decoder.
In reply to Greg Kroah-HartmanFrom: Ming Qian <[email protected]>
[ Upstream commit 61c2698ee60630c6a7d2e99850fa81ff6450270a ]
decoder will report the colorspace information
which is parsed from the sequence header,
if they are unspecified, just let application to determine it, don't change it in driver.
--- drivers/media/platform/amphion/vdec.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/media/platform/amphion/vdec.c +8 -8
@@ -808,14 +808,6 @@ static void vdec_init_fmt(struct vpu_inst *inst) inst->cap_format.field =V4L2_FIELD_NONE ; else inst->cap_format.field = V4L2_FIELD_SEQ_TB; -if (vdec->codec_info.color_primaries ==V4L2_COLORSPACE_DEFAULT ) - vdec->codec_info.color_primaries =V4L2_COLORSPACE_REC709 ; -if (vdec->codec_info.transfer_chars ==V4L2_XFER_FUNC_DEFAULT ) - vdec->codec_info.transfer_chars =V4L2_XFER_FUNC_709 ; -if (vdec->codec_info.matrix_coeffs ==V4L2_YCBCR_ENC_DEFAULT ) - vdec->codec_info.matrix_coeffs =V4L2_YCBCR_ENC_709 ; -if (vdec->codec_info.full_range ==V4L2_QUANTIZATION_DEFAULT ) - vdec->codec_info.full_range =V4L2_QUANTIZATION_LIM_RANGE ; }static void vdec_init_crop (struct vpu_inst *inst)
@@ -1556,6 +1548,14 @@ static int vdec_get_debug_info(struct vpu_inst *inst, char *str, u32 size, u32 i vdec->codec_info.frame_rate.numerator, vdec->codec_info.frame_rate.denominator);break ; +case 9 : + num =scnprintf (str, size,"colorspace: %d, %d, %d, %d (%d)\n" , + vdec->codec_info.color_primaries, + vdec->codec_info.transfer_chars, + vdec->codec_info.matrix_coeffs, + vdec->codec_info.full_range, + vdec->codec_info.vui_present); +break ;default :break ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 399/717 media: amphion: fix a bug that vpu core may not resume after suspend
In reply to Greg Kroah-HartmanFrom: Ming Qian <[email protected]>
[ Upstream commit 0202a665bf17fbe98fed954944aabbcb4f14a4cc ]
driver will enable the vpu core when request the first instance on the core.
one vpu core can only support 8 streaming instances in the same time, the instance won't be added to core's list before streamon.
so the actual instance count may be greater then the number in the core's list.
in pm resume callback, driver will resume the core immediately if core's list is not empty.
but this check is not accurate,
if suspend during one instance is requested, but not streamon, then after suspend, the core won't be resume, and led to instance failure.
use the request_count instead of the core's list to check whether is the core needed to resume immediately after suspend.
And it can make the pm suspend and resume callback more clear.
--- drivers/media/platform/amphion/vpu.h | 1 - drivers/media/platform/amphion/vpu_core.c | 84 ++++++++++++----------- drivers/media/platform/amphion/vpu_core.h | 1 + drivers/media/platform/amphion/vpu_dbg.c | 9 ++- 4 files changed, 51 insertions(+), 44 deletions(-)
drivers/media/platform/amphion/vpu.h +0 -1
@@ -119,7 +119,6 @@ struct vpu_mbox {enum vpu_core_state {VPU_CORE_DEINIT =0 ,VPU_CORE_ACTIVE , -VPU_CORE_SNAPSHOT ,VPU_CORE_HANG };
drivers/media/platform/amphion/vpu_core.c +43 -41
149 lines not on this page · raw message
drivers/media/platform/amphion/vpu_core.h +1 -0
@@ -11,5 +11,6 @@ u32 csr_readl(struct vpu_core *core, u32 reg);int vpu_alloc_dma (struct vpu_core *core,struct vpu_buffer *buf);void vpu_free_dma (struct vpu_buffer *buf);struct vpu_inst *vpu_core_find_instance (struct vpu_core *core,u32 index); +void vpu_core_set_state (struct vpu_core *core,enum vpu_core_state state);#endif
drivers/media/platform/amphion/vpu_dbg.c +7 -2
@@ -15,6 +15,7 @@#include <linux/debugfs.h> #include "vpu.h" #include "vpu_defs.h" +#include "vpu_core.h" #include "vpu_helpers.h" #include "vpu_cmds.h" #include "vpu_rpc.h"
@@ -233,6 +234,10 @@ static int vpu_dbg_core(struct seq_file *s, void *data)if (seq_write (s, str, num))return 0 ; + num =scnprintf (str,sizeof (str),"power %s\n" , +vpu_iface_get_power_state (core) ?"on" :"off" ); +if (seq_write (s, str, num)) +return 0 ; num =scnprintf (str,sizeof (str),"state = %d\n" , core->state);if (seq_write (s, str, num))return 0 ;
@@ -346,10 +351,10 @@ static ssize_t vpu_dbg_core_write(struct file *file,pm_runtime_resume_and_get (core->dev);mutex_lock (&core->lock); -if (core->state !=VPU_CORE_DEINIT && !core->instance_mask) { +if (vpu_iface_get_power_state (core) && !core->request_count) {dev_info (core->dev,"reset\n" );if (!vpu_core_sw_reset (core)) { - core->state =VPU_CORE_ACTIVE ; +vpu_core_set_state (core,VPU_CORE_ACTIVE ); core->hang_mask =0 ; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 400/717 media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
In reply to Greg Kroah-HartmanFrom: Xu Qiang <[email protected]>
[ Upstream commit 4029372233e13e281f8c387f279f9f064ced3810 ]
Add the missing clk_disable_unprepare() before return from vdec_hevc_start() in the error handling case.
--- drivers/staging/media/meson/vdec/vdec_hevc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/staging/media/meson/vdec/vdec_hevc.c +5 -1
@@ -167,8 +167,12 @@ static int vdec_hevc_start(struct amvdec_session *sess)clk_set_rate (core->vdec_hevc_clk,666666666 ); ret =clk_prepare_enable (core->vdec_hevc_clk); -if (ret) +if (ret) { +if (core->platform->revision ==VDEC_REVISION_G12A || + core->platform->revision ==VDEC_REVISION_SM1 ) +clk_disable_unprepare (core->vdec_hevcf_clk);return ret; + }if (core->platform->revision ==VDEC_REVISION_SM1 ) regmap_update_bits(core->regmap_ao, AO_RTI_GEN_PWR_SLEEP0,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 401/717 media: uvcvideo: Fix memory leak in uvc_gpio_parse
In reply to Greg Kroah-HartmanFrom: José Expósito <[email protected]>
[ Upstream commit f0f078457f18f10696888f8d0e6aba9deb9cde92 ]
Previously the unit buffer was allocated before checking the IRQ for privacy GPIO. In case of error, the unit buffer was leaked.
Allocate the unit buffer after the IRQ to avoid it.
Addresses-Coverity-ID: 1474639 ("Resource leak")
--- drivers/media/usb/uvc/uvc_driver.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +4 -4
@@ -1538,10 +1538,6 @@ static int uvc_gpio_parse(struct uvc_device *dev)if (IS_ERR_OR_NULL (gpio_privacy))return PTR_ERR_OR_ZERO (gpio_privacy); - unit =uvc_alloc_entity (UVC_EXT_GPIO_UNIT ,UVC_EXT_GPIO_UNIT_ID ,0 ,1 ); -if (!unit) -return -ENOMEM ; - irq =gpiod_to_irq (gpio_privacy);if (irq <0 ) {if (irq !=EPROBE_DEFER )
@@ -1550,6 +1546,10 @@ static int uvc_gpio_parse(struct uvc_device *dev)return irq; } + unit =uvc_alloc_entity (UVC_EXT_GPIO_UNIT ,UVC_EXT_GPIO_UNIT_ID ,0 ,1 ); +if (!unit) +return -ENOMEM ; + unit->gpio.gpio_privacy = gpio_privacy; unit->gpio.irq = irq; unit->gpio.bControlSize =1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 402/717 media: uvcvideo: Use entity get_cur in uvc_ctrl_set
In reply to Greg Kroah-HartmanFrom: Yunke Cao <[email protected]>
[ Upstream commit 5f36851c36b30f713f588ed2b60aa7b4512e2c76 ]
Entity controls should get_cur using an entity-defined function instead of via a query. Fix this in uvc_ctrl_set.
--- drivers/media/usb/uvc/uvc_ctrl.c | 83 ++++++++++++++++++-------------- 1 file changed, 46 insertions(+), 37 deletions(-)
drivers/media/usb/uvc/uvc_ctrl.c +46 -37
@@ -963,36 +963,56 @@ static s32 __uvc_ctrl_get_value(struct uvc_control_mapping *mapping,return value; } -static int __uvc_ctrl_get (struct uvc_video_chain *chain, -struct uvc_control *ctrl,struct uvc_control_mapping *mapping, -s32 *value) +static int __uvc_ctrl_load_cur (struct uvc_video_chain *chain, +struct uvc_control *ctrl) { +u8 *data;int ret; -if ((ctrl->info.flags &UVC_CTRL_FLAG_GET_CUR ) ==0 ) -return -EACCES ; +if (ctrl->loaded) +return 0 ; -if (!ctrl->loaded) { -if (ctrl->entity->get_cur) { - ret = ctrl->entity->get_cur (chain->dev, - ctrl->entity, - ctrl->info.selector, -uvc_ctrl_data (ctrl,UVC_CTRL_DATA_CURRENT ), - ctrl->info.size); - }else { - ret =uvc_query_ctrl (chain->dev,UVC_GET_CUR , - ctrl->entity->id, - chain->dev->intfnum, - ctrl->info.selector, -uvc_ctrl_data (ctrl,UVC_CTRL_DATA_CURRENT ), - ctrl->info.size); - } -if (ret <0 ) -return ret; + data =uvc_ctrl_data (ctrl,UVC_CTRL_DATA_CURRENT ); +if ((ctrl->info.flags &UVC_CTRL_FLAG_GET_CUR ) ==0 ) { +memset (data,0 , ctrl->info.size); ctrl->loaded =1 ; + +return 0 ; } +if (ctrl->entity->get_cur) + ret = ctrl->entity->get_cur (chain->dev, ctrl->entity, + ctrl->info.selector, data, + ctrl->info.size); +else + ret =uvc_query_ctrl (chain->dev,UVC_GET_CUR , + ctrl->entity->id, chain->dev->intfnum, + ctrl->info.selector, data, + ctrl->info.size); + +if (ret <0 ) +return ret; + + ctrl->loaded =1 ; + +return ret; +} + +static int __uvc_ctrl_get (struct uvc_video_chain *chain, +struct uvc_control *ctrl, +struct uvc_control_mapping *mapping, +s32 *value) +{ +int ret; + +if ((ctrl->info.flags &UVC_CTRL_FLAG_GET_CUR ) ==0 ) +return -EACCES ; + + ret =__uvc_ctrl_load_cur (chain, ctrl); +if (ret <0 ) +return ret; + *value =__uvc_ctrl_get_value (mapping,uvc_ctrl_data (ctrl,UVC_CTRL_DATA_CURRENT ));
@@ -1783,21 +1803,10 @@ int uvc_ctrl_set(struct uvc_fh *handle,* needs to be loaded from the device to perform the read-modify-write * operation. */ -if (!ctrl->loaded && (ctrl->info.size *8 ) != mapping->size) { -if ((ctrl->info.flags &UVC_CTRL_FLAG_GET_CUR ) ==0 ) { -memset (uvc_ctrl_data (ctrl,UVC_CTRL_DATA_CURRENT ), -0 , ctrl->info.size); - }else { - ret =uvc_query_ctrl (chain->dev,UVC_GET_CUR , - ctrl->entity->id, chain->dev->intfnum, - ctrl->info.selector, -uvc_ctrl_data (ctrl,UVC_CTRL_DATA_CURRENT ), - ctrl->info.size); -if (ret <0 ) -return ret; - } - - ctrl->loaded =1 ; +if ((ctrl->info.size *8 ) != mapping->size) { + ret =__uvc_ctrl_load_cur (chain, ctrl); +if (ret <0 ) +return ret; }/* Backup the current value in case we need to rollback later. */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 403/717 media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 1c78f19c3a0ea312a8178a6bfd8934eb93e9b10a ]
of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/media/platform/xilinx/xilinx-vipp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/platform/xilinx/xilinx-vipp.c +5 -4
@@ -471,7 +471,7 @@ static int xvip_graph_dma_init(struct xvip_composite_device *xdev) {struct device_node *ports;struct device_node *port; -int ret; +int ret =0 ; ports =of_get_child_by_name (xdev->dev->of_node,"ports" );if (ports ==NULL ) {
@@ -481,13 +481,14 @@ static int xvip_graph_dma_init(struct xvip_composite_device *xdev)for_each_child_of_node (ports, port) { ret =xvip_graph_dma_init_one (xdev, port); -if (ret <0 ) { +if (ret) {of_node_put (port); -return ret; +break ; } } -return 0 ; +of_node_put (ports); +return ret; }static void xvip_graph_cleanup (struct xvip_composite_device *xdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 404/717 RDMA/rxe: Fix "kernel NULL pointer dereference" error
In reply to Greg Kroah-HartmanFrom: Zhu Yanjun <[email protected]>
[ Upstream commit a625ca30eff806395175ebad3ac1399014bdb280 ]
When rxe_queue_init in the function rxe_qp_init_req fails, both qp->req.task.func and qp->req.task.arg are not initialized.
Because of creation of qp fails, the function rxe_create_qp will call rxe_qp_do_cleanup to handle allocated resource.
Before calling __rxe_do_task, both qp->req.task.func and qp->req.task.arg should be checked.
--- drivers/infiniband/sw/rxe/rxe_qp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_qp.c +3 -1
@@ -794,7 +794,9 @@ static void rxe_qp_do_cleanup(struct work_struct *work)rxe_cleanup_task (&qp->comp.task);/* flush out any receive wr's or pending requests */ -__rxe_do_task (&qp->req.task); +if (qp->req.task.func) +__rxe_do_task (&qp->req.task); +if (qp->sq.queue) {__rxe_do_task (&qp->comp.task);__rxe_do_task (&qp->req.task);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 405/717 RDMA/rxe: Fix the error caused by qp->sk
In reply to Greg Kroah-HartmanFrom: Zhu Yanjun <[email protected]>
[ Upstream commit 548ce2e66725dcba4e27d1e8ac468d5dd17fd509 ]
When sock_create_kern in the function rxe_qp_init_req fails, qp->sk is set to NULL.
Then the function rxe_create_qp will call rxe_qp_do_cleanup to handle allocated resource.
Before handling qp->sk, this variable should be checked.
--- drivers/infiniband/sw/rxe/rxe_qp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/sw/rxe/rxe_qp.c +4 -2
@@ -832,8 +832,10 @@ static void rxe_qp_do_cleanup(struct work_struct *work)free_rd_atomic_resources (qp); -kernel_sock_shutdown (qp->sk,SHUT_RDWR ); -sock_release (qp->sk); +if (qp->sk) { +kernel_sock_shutdown (qp->sk,SHUT_RDWR ); +sock_release (qp->sk); + } }/* called when the last reference to the qp is dropped */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 406/717 clk: mediatek: clk-mt8195-vdo0: Set rate on vdo0_dp_intf0_dp_intfs parent
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 3f0dadd230cc2630202a977fe52cd1dd7a7579a7 ]
Add the CLK_SET_RATE_PARENT flag to the CLK_VDO0_DP_INTF0_DP_INTF
clock: this is required to trigger clock source selection on CLK_TOP_EDP, while avoiding to manage the enablement of the former separately from the latter in the displayport driver.
--- drivers/clk/mediatek/clk-mt8195-vdo0.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/clk/mediatek/clk-mt8195-vdo0.c +6 -1
@@ -37,6 +37,10 @@ static const struct mtk_gate_regs vdo0_2_cg_regs = {#define GATE_VDO0_2 (_id, _name, _parent, _shift) \ GATE_MTK(_id, _name, _parent, &vdo0_2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) +#define GATE_VDO0_2_FLAGS (_id, _name, _parent, _shift, _flags) \ + GATE_MTK_FLAGS(_id, _name, _parent, &vdo0_2_cg_regs, _shift, \ + &mtk_clk_gate_ops_setclr, _flags) +static const struct mtk_gate vdo0_clks[] = {/* VDO0_0 */ GATE_VDO0_0 (CLK_VDO0_DISP_OVL0 ,"vdo0_disp_ovl0" ,"top_vpp" ,0 ),
@@ -85,7 +89,8 @@ static const struct mtk_gate vdo0_clks[] = {/* VDO0_2 */ GATE_VDO0_2 (CLK_VDO0_DSI0_DSI ,"vdo0_dsi0_dsi" ,"top_dsi_occ" ,0 ),GATE_VDO0_2 (CLK_VDO0_DSI1_DSI ,"vdo0_dsi1_dsi" ,"top_dsi_occ" ,8 ), - GATE_VDO0_2(CLK_VDO0_DP_INTF0_DP_INTF, "vdo0_dp_intf0_dp_intf", "top_edp", 16), +GATE_VDO0_2_FLAGS (CLK_VDO0_DP_INTF0_DP_INTF ,"vdo0_dp_intf0_dp_intf" , + "top_edp", 16, CLK_SET_RATE_PARENT), };static int clk_mt8195_vdo0_probe (struct platform_device *pdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 407/717 clk: mediatek: clk-mt8195-vdo1: Reparent and set rate on vdo1_dpintfs parent
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit f24d71feb206631116ff9adaa6d43650c5dd8849 ]
Like it was done for the vdo0_dp_intf0_dp_intf clock (used for eDP), add the CLK_SET_RATE_PARENT flag to CLK_VDO1_DPINTF (used for DP) and also fix its parent clock name as it has to be "top_dp" for two reasons:
- This is its real parent!
- Likewise to eDP/VDO0 counterpart, we need clock source selection on CLK_TOP_DP.
--- drivers/clk/mediatek/clk-mt8195-vdo1.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/clk/mediatek/clk-mt8195-vdo1.c +5 -1
@@ -43,6 +43,10 @@ static const struct mtk_gate_regs vdo1_3_cg_regs = {#define GATE_VDO1_2 (_id, _name, _parent, _shift) \ GATE_MTK(_id, _name, _parent, &vdo1_2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) +#define GATE_VDO1_2_FLAGS (_id, _name, _parent, _shift, _flags) \ + GATE_MTK_FLAGS(_id, _name, _parent, &vdo1_2_cg_regs, _shift, \ + &mtk_clk_gate_ops_setclr, _flags) +#define GATE_VDO1_3 (_id, _name, _parent, _shift) \ GATE_MTK(_id, _name, _parent, &vdo1_3_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
@@ -99,7 +103,7 @@ static const struct mtk_gate vdo1_clks[] = {GATE_VDO1_2 (CLK_VDO1_DISP_MONITOR_DPI0 ,"vdo1_disp_monitor_dpi0" ,"top_vpp" ,1 ),GATE_VDO1_2 (CLK_VDO1_DPI1 ,"vdo1_dpi1" ,"top_vpp" ,8 ),GATE_VDO1_2 (CLK_VDO1_DISP_MONITOR_DPI1 ,"vdo1_disp_monitor_dpi1" ,"top_vpp" ,9 ), -GATE_VDO1_2 (CLK_VDO1_DPINTF ,"vdo1_dpintf" ,"top_vpp" ,16 ), +GATE_VDO1_2_FLAGS (CLK_VDO1_DPINTF ,"vdo1_dpintf" ,"top_dp" ,16 ,CLK_SET_RATE_PARENT ),GATE_VDO1_2 (CLK_VDO1_DISP_MONITOR_DPINTF ,"vdo1_disp_monitor_dpintf" ,"top_vpp" ,17 ),/* VDO1_3 */ GATE_VDO1_3(CLK_VDO1_26M_SLOW, "vdo1_26m_slow", "clk26m", 8),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 408/717 clk: mediatek: mt8195-infra_ao: Set pwrmcu clocks as critical
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 3f10f49cd9f8ab6471639d4ca2c6db9451121779 ]
The pwrmcu is responsible for power management and idle states in SSPM:
on older SoCs this was managed in Linux drivers like sspm/mcupm/eemgpu but, at least on MT8195, this functionality was transferred to the ATF firmware.
For this reason, turning off the pwrmcu related clocks from the kernel will lead to unability to resume the platform after suspend and other currently unknown PM related side-effects.
Set the PWRMCU and PWRMCU_BUS_H clocks as critical to prevent the kernel from turning them off, fixing the aforementioned issue.
--- drivers/clk/mediatek/clk-mt8195-infra_ao.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/clk/mediatek/clk-mt8195-infra_ao.c +10 -3
@@ -54,8 +54,12 @@ static const struct mtk_gate_regs infra_ao4_cg_regs = {#define GATE_INFRA_AO1 (_id, _name, _parent, _shift) \ GATE_INFRA_AO1_FLAGS(_id, _name, _parent, _shift, 0) +#define GATE_INFRA_AO2_FLAGS (_id, _name, _parent, _shift, _flag) \ + GATE_MTK_FLAGS(_id, _name, _parent, &infra_ao2_cg_regs, _shift, \ + &mtk_clk_gate_ops_setclr, _flag) +#define GATE_INFRA_AO2 (_id, _name, _parent, _shift) \ - GATE_MTK(_id, _name, _parent, &infra_ao2_cg_regs, _shift, &mtk_clk_gate_ops_setclr) + GATE_INFRA_AO2_FLAGS(_id, _name, _parent, _shift, 0)#define GATE_INFRA_AO3_FLAGS (_id, _name, _parent, _shift, _flag) \ GATE_MTK_FLAGS(_id, _name, _parent, &infra_ao3_cg_regs, _shift, \
@@ -135,8 +139,11 @@ static const struct mtk_gate infra_ao_clks[] = {GATE_INFRA_AO2 (CLK_INFRA_AO_UNIPRO_SYS ,"infra_ao_unipro_sys" ,"top_ufs" ,11 ),GATE_INFRA_AO2 (CLK_INFRA_AO_UNIPRO_TICK ,"infra_ao_unipro_tick" ,"top_ufs_tick1us" ,12 ),GATE_INFRA_AO2 (CLK_INFRA_AO_UFS_MP_SAP_B ,"infra_ao_ufs_mp_sap_b" ,"top_ufs_mp_sap_cfg" ,13 ), -GATE_INFRA_AO2 (CLK_INFRA_AO_PWRMCU ,"infra_ao_pwrmcu" ,"top_pwrmcu" ,15 ), -GATE_INFRA_AO2 (CLK_INFRA_AO_PWRMCU_BUS_H ,"infra_ao_pwrmcu_bus_h" ,"top_axi" ,17 ), +/* pwrmcu is used by ATF for platform PM: clocks must never be disabled by the kernel */ +GATE_INFRA_AO2_FLAGS (CLK_INFRA_AO_PWRMCU ,"infra_ao_pwrmcu" ,"top_pwrmcu" ,15 , +CLK_IS_CRITICAL ), +GATE_INFRA_AO2_FLAGS (CLK_INFRA_AO_PWRMCU_BUS_H ,"infra_ao_pwrmcu_bus_h" ,"top_axi" ,17 , +CLK_IS_CRITICAL ),GATE_INFRA_AO2 (CLK_INFRA_AO_APDMA_B ,"infra_ao_apdma_b" ,"top_axi" ,18 ),GATE_INFRA_AO2 (CLK_INFRA_AO_SPI4 ,"infra_ao_spi4" ,"top_spi" ,25 ), GATE_INFRA_AO2(CLK_INFRA_AO_SPI5, "infra_ao_spi5", "top_spi", 26),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 409/717 misc: ocxl: fix possible refcount leak in afu_ioctl()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit c3b69ba5114c860d730870c03ab4ee45276e5e35 ]
eventfd_ctx_put need to be called to put the refcount that gotten by eventfd_ctx_fdget when ocxl_irq_set_handler fails.
--- drivers/misc/ocxl/file.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/misc/ocxl/file.c +2 -0
@@ -257,6 +257,8 @@ static long afu_ioctl(struct file *file, unsigned int cmd,if (IS_ERR (ev_ctx))return PTR_ERR (ev_ctx); rc =ocxl_irq_set_handler (ctx, irq_id, irq_handler, irq_free, ev_ctx); +if (rc) +eventfd_ctx_put (ev_ctx);break ;case OCXL_IOCTL_GET_METADATA :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 410/717 fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 939bc5453b8cbdde9f1e5110ce8309aedb1b501a ]
The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix that.
--- drivers/fpga/dfl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/fpga/dfl.c +1 -1
@@ -1866,7 +1866,7 @@ long dfl_feature_ioctl_set_irq(struct platform_device *pdev,return -EINVAL ; fds =memdup_user ((void __user *)(arg +sizeof (hdr)), - hdr.count *sizeof (s32)); +array_size (hdr.count,sizeof (s32)));if (IS_ERR (fds))return PTR_ERR (fds);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 411/717 phy: rockchip-inno-usb2: Return zero after otg sync
In reply to Greg Kroah-HartmanFrom: Peter Geis <[email protected]>
[ Upstream commit f340ed8664a55a467850ec1689996e63d9ee971a ]
The otg sync state patch reuses the ret variable, but fails to set it to zero after use. This leads to a situation when the otg port is in peripheral mode where the otg phy aborts halfway through setup. It also fails to account for a failure to register the extcon notifier. Fix this by using our own variable and skipping otg sync in case of failure.
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +6 -4
@@ -1124,7 +1124,7 @@ static int rockchip_usb2phy_otg_port_init(struct rockchip_usb2phy *rphy,struct rockchip_usb2phy_port *rport, struct device_node *child_np) { - int ret; + int ret, id; rport->port_id =USB2PHY_PORT_OTG ; rport->port_cfg = &rphy->phy_cfg->port_cfgs[USB2PHY_PORT_OTG ];
@@ -1162,13 +1162,15 @@ static int rockchip_usb2phy_otg_port_init(struct rockchip_usb2phy *rphy, ret =devm_extcon_register_notifier (rphy->dev, rphy->edev,EXTCON_USB_HOST , &rport->event_nb); -if (ret) +if (ret) {dev_err (rphy->dev,"register USB HOST notifier failed\n" ); + goto out; + }if (!of_property_read_bool (rphy->dev->of_node,"extcon" )) {/* do initial sync of usb state */ - ret =property_enabled (rphy->grf, &rport->port_cfg->utmi_id); -extcon_set_state_sync (rphy->edev,EXTCON_USB_HOST , !ret); + id =property_enabled (rphy->grf, &rport->port_cfg->utmi_id); +extcon_set_state_sync (rphy->edev,EXTCON_USB_HOST , !id); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 412/717 dmaengine: idxd: avoid deadlock in process_misc_interrupts()
In reply to Greg Kroah-HartmanFrom: Jerry Snitselaar <[email protected]>
[ Upstream commit 407171717a4f4d2d80825584643374a2dfdb0540 ]
idxd_device_clear_state() now grabs the idxd->dev_lock itself, so don't grab the lock prior to calling it.
This was seen in testing after dmar fault occurred on system, resulting in lockup stack traces.
--- drivers/dma/idxd/irq.c | 2 -- 1 file changed, 2 deletions(-)
drivers/dma/idxd/irq.c +0 -2
@@ -324,13 +324,11 @@ static int process_misc_interrupts(struct idxd_device *idxd, u32 cause) idxd->state =IDXD_DEV_HALTED ;idxd_wqs_quiesce (idxd);idxd_wqs_unmap_portal (idxd); -spin_lock (&idxd->dev_lock);idxd_device_clear_state (idxd);dev_err (&idxd->pdev->dev,"idxd halted, need %s.\n" , gensts.reset_type ==IDXD_DEVICE_RESET_FLR ?"FLR" :"system reset" ); -spin_unlock (&idxd->dev_lock);return -ENXIO ; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 413/717 dmaengine: hisilicon: Disable channels when unregister hisi_dma
In reply to Greg Kroah-HartmanFrom: Jie Hai <[email protected]>
[ Upstream commit e3bdaa04ada31f46d0586df83a2789b8913053c5 ]
When hisi_dma is unloaded or unbinded, all of channels should be disabled. This patch disables DMA channels when driver is unloaded or unbinded.
--- drivers/dma/hisi_dma.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/dma/hisi_dma.c +9 -5
@@ -180,7 +180,8 @@ static void hisi_dma_reset_qp_point(struct hisi_dma_dev *hdma_dev, u32 index)hisi_dma_chan_write (hdma_dev->base,HISI_DMA_CQ_HEAD_PTR , index,0 ); } -static void hisi_dma_reset_hw_chan (struct hisi_dma_chan *chan) +static void hisi_dma_reset_or_disable_hw_chan (struct hisi_dma_chan *chan, +bool disable) {struct hisi_dma_dev *hdma_dev = chan->hdma_dev;u32 index = chan->qp_num, tmp;
@@ -201,8 +202,11 @@ static void hisi_dma_reset_hw_chan(struct hisi_dma_chan *chan)hisi_dma_do_reset (hdma_dev, index);hisi_dma_reset_qp_point (hdma_dev, index);hisi_dma_pause_dma (hdma_dev, index, false); -hisi_dma_enable_dma (hdma_dev, index, true); -hisi_dma_unmask_irq (hdma_dev, index); + +if (!disable) { +hisi_dma_enable_dma (hdma_dev, index, true); +hisi_dma_unmask_irq (hdma_dev, index); + } ret = readl_relaxed_poll_timeout(hdma_dev->base + HISI_DMA_Q_FSM_STS + index * HISI_DMA_OFFSET, tmp,
@@ -218,7 +222,7 @@ static void hisi_dma_free_chan_resources(struct dma_chan *c)struct hisi_dma_chan *chan =to_hisi_dma_chan (c);struct hisi_dma_dev *hdma_dev = chan->hdma_dev; -hisi_dma_reset_hw_chan (chan); +hisi_dma_reset_or_disable_hw_chan (chan, false);vchan_free_chan_resources (&chan->vc);memset (chan->sq,0 ,sizeof (struct hisi_dma_sqe ) * hdma_dev->chan_depth);
@@ -394,7 +398,7 @@ static void hisi_dma_enable_qp(struct hisi_dma_dev *hdma_dev, u32 qp_index)static void hisi_dma_disable_qp (struct hisi_dma_dev *hdma_dev,u32 qp_index) { -hisi_dma_reset_hw_chan (&hdma_dev->chan[qp_index]); +hisi_dma_reset_or_disable_hw_chan (&hdma_dev->chan[qp_index], true); }static void hisi_dma_enable_qps (struct hisi_dma_dev *hdma_dev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 414/717 dmaengine: hisilicon: Fix CQ head update
In reply to Greg Kroah-HartmanFrom: Jie Hai <[email protected]>
[ Upstream commit 94477a79cf80e8ab55b68f14bc579a12ddea1e0b ]
After completion of data transfer of one or multiple descriptors, the completion status and the current head pointer to submission queue are written into the CQ and interrupt can be generated to inform the software. In interrupt process CQ is read and cq_head is updated.
hisi_dma_irq updates cq_head only when the completion status is success. When an abnormal interrupt reports, cq_head will not update which will cause subsequent interrupt processes read the error CQ and never report the correct status.
This patch updates cq_head whenever CQ is accessed.
--- drivers/dma/hisi_dma.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/dma/hisi_dma.c +3 -5
@@ -436,12 +436,10 @@ static irqreturn_t hisi_dma_irq(int irq, void *data) desc = chan->desc; cqe = chan->cq + chan->cq_head;if (desc) { + chan->cq_head = (chan->cq_head +1 ) % hdma_dev->chan_depth; +hisi_dma_chan_write (hdma_dev->base,HISI_DMA_CQ_HEAD_PTR , + chan->qp_num, chan->cq_head);if (FIELD_GET (STATUS_MASK , cqe->w0) ==STATUS_SUCC ) { - chan->cq_head = (chan->cq_head +1 ) % - hdma_dev->chan_depth; -hisi_dma_chan_write (hdma_dev->base, -HISI_DMA_CQ_HEAD_PTR , chan->qp_num, - chan->cq_head);vchan_cookie_complete (&desc->vd); }else {dev_err (&hdma_dev->pdev->dev,"task error!\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 415/717 dmaengine: hisilicon: Add multi-thread support for a DMA channel
In reply to Greg Kroah-HartmanFrom: Jie Hai <[email protected]>
[ Upstream commit 2cbb95883c990d0002a77e13d3278913ab26ad79 ]
When we get a DMA channel and try to use it in multiple threads it will cause oops and hanging the system.
% echo 100 > /sys/module/dmatest/parameters/threads_per_chan % echo 100 > /sys/module/dmatest/parameters/iterations % echo 1 > /sys/module/dmatest/parameters/run
[383493.327077] Unable to handle kernel paging request at virtual address dead000000000108 [383493.335103] Mem abort info: [383493.335103] ESR = 0x96000044 [383493.335105] EC = 0x25: DABT (current EL), IL = 32 bits [383493.335107] SET = 0, FnV = 0 [383493.335108] EA = 0, S1PTW = 0 [383493.335109] FSC = 0x04: level 0 translation fault [383493.335110] Data abort info: [383493.335111] ISV = 0, ISS = 0x00000044 [383493.364739] CM = 0, WnR = 1 [383493.367793] [dead000000000108] address between user and kernel address ranges [383493.375021] Internal error: Oops: 96000044 [#1] PREEMPT SMP [383493.437574] CPU: 63 PID: 27895 Comm: dma0chan0-copy2 Kdump: loaded Tainted: GO 5.17.0-rc4+ #2 [383493.457851] pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [383493.465331] pc : vchan_tx_submit+0x64/0xa0 [383493.469957] lr : vchan_tx_submit+0x34/0xa0
This occurs because the transmission timed out, and that's due to data race. Each thread rewrite channels's descriptor as soon as device_issue_pending is called. It leads to the situation that the driver thinks that it uses the right descriptor in interrupt handler while channels's descriptor has been changed by other thread. The descriptor which in fact reported interrupt will not be handled any more, as well as its tx->callback. That's why timeout reports.
With current fixes channels' descriptor changes it's value only when it has been used. A new descriptor is acquired from vc->desc_issued queue that is already filled with descriptors that are ready to be sent. Threads have no direct access to DMA channel descriptor. In case of channel's descriptor is busy, try to submit to HW again when a descriptor is completed. In this case, vc->desc_issued may be empty when hisi_dma_start_transfer is called, so delete error reporting on this. Now it is just possible to queue a descriptor for further processing.
--- drivers/dma/hisi_dma.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/dma/hisi_dma.c +2 -4
@@ -271,7 +271,6 @@ static void hisi_dma_start_transfer(struct hisi_dma_chan *chan) vd =vchan_next_desc (&chan->vc);if (!vd) { -dev_err (&hdma_dev->pdev->dev,"no issued task!\n" ); chan->desc =NULL ;return ; }
@@ -303,7 +302,7 @@ static void hisi_dma_issue_pending(struct dma_chan *c)spin_lock_irqsave (&chan->vc.lock, flags); -if (vchan_issue_pending (&chan->vc)) +if (vchan_issue_pending (&chan->vc) && !chan->desc)hisi_dma_start_transfer (chan);spin_unlock_irqrestore (&chan->vc.lock, flags);
@@ -441,11 +440,10 @@ static irqreturn_t hisi_dma_irq(int irq, void *data) chan->qp_num, chan->cq_head);if (FIELD_GET (STATUS_MASK , cqe->w0) ==STATUS_SUCC ) {vchan_cookie_complete (&desc->vd); +hisi_dma_start_transfer (chan); }else {dev_err (&hdma_dev->pdev->dev,"task error!\n" ); } - - chan->desc =NULL ; }spin_unlock (&chan->vc.lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 416/717 usb: gadget: f_fs: stricter integer overflow checks
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit f57004b9d96755cd6a243b51c267be4016b4563c ]
This from static analysis. The vla_item() takes a size and adds it to the total. It has a built in integer overflow check so if it encounters an integer overflow anywhere then it records the total as SIZE_MAX.
However there is an issue here because the "lang_count*(needed_count+1)" multiplication can overflow. Technically the "lang_count + 1" addition could overflow too, but that would be detected and is harmless. Fix both using the new size_add() and size_mul() functions.
--- drivers/usb/gadget/function/f_fs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_fs.c +2 -2
@@ -2645,10 +2645,10 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,unsigned i =0 ;vla_group (d); vla_item(d, struct usb_gadget_strings *, stringtabs, - lang_count +1 ); +size_add (lang_count,1 )); vla_item(d, struct usb_gadget_strings, stringtab, lang_count); vla_item(d, struct usb_string, strings, - lang_count*(needed_count+1 )); +size_mul (lang_count, (needed_count +1 )));char *vlabuf =kmalloc (vla_group_size (d),GFP_KERNEL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 417/717 dyndbg: fix static_branch manipulation
In reply to Greg Kroah-HartmanFrom: Jim Cromie <[email protected]>
[ Upstream commit ee879be38bc87f8cedc79ae2742958db6533ca59 ]
In https://lore.kernel.org/lkml/[email protected]/
Vincent's patch commented on, and worked around, a bug toggling static_branch's, when a 2nd PRINTK-ish flag was added. The bug results in a premature static_branch_disable when the 1st of 2 flags was disabled.
The cited commit computed newflags, but then in the JUMP_LABEL block, failed to use that result, instead using just one of the terms in it. Using newflags instead made the code work properly.
This is Vincents test-case, reduced. It needs the 2nd flag to demonstrate the bug, but it's explanatory here.
pt_test() {
echo 5 > /sys/module/dynamic_debug/verbose
site="module tcp" # just one callsite
echo " $site =_ " > /proc/dynamic_debug/control # clear it
# A B ~A ~B
for flg in +T +p "-T #broke here" -p; do
echo " $site $flg " > /proc/dynamic_debug/control
done;
# A B ~B ~A
for flg in +T +p "-p #broke here" -T; do
echo " $site $flg " > /proc/dynamic_debug/control
done
}pt_test
--- lib/dynamic_debug.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
lib/dynamic_debug.c +3 -2
@@ -211,10 +211,11 @@ static int ddebug_change(const struct ddebug_query *query,continue ;#ifdef CONFIG_JUMP_LABEL if (dp->flags & _DPRINTK_FLAGS_PRINT) { -if (!(modifiers->flags & _DPRINTK_FLAGS_PRINT)) +if (!(newflags & _DPRINTK_FLAGS_PRINT))static_branch_disable (&dp->key.dd_key_true); - }else if (modifiers->flags & _DPRINTK_FLAGS_PRINT) + }else if (newflags & _DPRINTK_FLAGS_PRINT) {static_branch_enable (&dp->key.dd_key_true); + }#endif dp->flags = newflags; v4pr_info("changed %s:%d [%s]%s =%s\n",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 418/717 dyndbg: fix module.dyndbg handling
In reply to Greg Kroah-HartmanFrom: Jim Cromie <[email protected]>
[ Upstream commit 85d6b66d31c35158364058ee98fb69ab5bb6a6b1 ]
For CONFIG_DYNAMIC_DEBUG=N, the ddebug_dyndbg_module_param_cb() stub-fn is too permissive:
bash-5.1# modprobe drm JUNKdyndbg
bash-5.1# modprobe drm dyndbgJUNK
[ 42.933220] dyndbg param is supported only in CONFIG_DYNAMIC_DEBUG builds [ 42.937484] ACPI: bus type drm_connector registered
This caused no ill effects, because unknown parameters are either ignored by default with an "unknown parameter" warning, or ignored because dyndbg allows its no-effect use on non-dyndbg builds.
But since the code has an explicit feedback message, it should be issued accurately. Fix with strcmp for exact param-name match.
--- include/linux/dynamic_debug.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/dynamic_debug.h +1 -1
@@ -201,7 +201,7 @@ static inline int ddebug_remove_module(const char *mod)static inline int ddebug_dyndbg_module_param_cb (char *param,char *val,const char *modname) { -if (strstr (param,"dyndbg" )) { +if (!strcmp (param,"dyndbg" )) {/* avoid pr_warn(), which wants pr_fmt() fully defined */ printk (KERN_WARNING "dyndbg param is supported only in " "CONFIG_DYNAMIC_DEBUG builds\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 419/717 dyndbg: let query-modname override actual module name
In reply to Greg Kroah-HartmanFrom: Jim Cromie <[email protected]>
[ Upstream commit e75ef56f74965f426dd819a41336b640ffdd8fbc ]
dyndbg's control-parser: ddebug_parse_query(), requires that search
terms: module, func, file, lineno, are used only once in a query; a thing cannot be named both foo and bar.
The cited commit added an overriding module modname, taken from the module loader, which is authoritative. So it set query.module 1st, which disallowed its use in the query-string.
But now, its useful to allow a module-load to enable classes across a whole (or part of) a subsystem at once.
# enable (dynamic-debug in) drm only modprobe drm dyndbg="class DRM_UT_CORE +p"
# get drm_helper too modprobe drm dyndbg="class DRM_UT_CORE module drm* +p"
# get everything that knows DRM_UT_CORE modprobe drm dyndbg="class DRM_UT_CORE module * +p"
# also for boot-args: drm.dyndbg="class DRM_UT_CORE module * +p"
So convert the override into a default, by filling it only when/after the query-string omitted the module.
NB: the query class FOO handling is forthcoming.
--- lib/dynamic_debug.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
lib/dynamic_debug.c +7 -4
@@ -384,10 +384,6 @@ static int ddebug_parse_query(char *words[], int nwords,return -EINVAL ; } -if (modname) -/* support $modname.dyndbg=<multiple queries> */ - query->module = modname; -for (i =0 ; i < nwords; i +=2 ) {char *keyword = words[i];char *arg = words[i+1 ];
@@ -428,6 +424,13 @@ static int ddebug_parse_query(char *words[], int nwords,if (rc)return rc; } +if (!query->module && modname) +/* +* support $modname.dyndbg=<multiple queries>, when +* not given in the query itself +*/ + query->module = modname; +vpr_info_dq (query,"parsed" );return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 420/717 dyndbg: drop EXPORTed dynamic_debug_exec_queries
In reply to Greg Kroah-HartmanFrom: Jim Cromie <[email protected]>
[ Upstream commit e26ef3af964acfea311403126acee8c56c89e26b ]
This exported fn is unused, and will not be needed. Lets dump it.
The export was added to let drm control pr_debugs, as part of using them to avoid drm_debug_enabled overheads. But its better to just implement the drm.debug bitmap interface, then its available for everyone.
--- include/linux/dynamic_debug.h | 9 --------- lib/dynamic_debug.c | 29 ----------------------------- 2 files changed, 38 deletions(-)
include/linux/dynamic_debug.h +0 -9
@@ -55,9 +55,6 @@ struct _ddebug {#if defined(CONFIG_DYNAMIC_DEBUG_CORE ) -/* exported for module authors to exercise >control */ -int dynamic_debug_exec_queries (const char *query,const char *modname); -int ddebug_add_module (struct _ddebug *tab,unsigned int n,const char *modname);extern int ddebug_remove_module (const char *mod_name);
@@ -221,12 +218,6 @@ static inline int ddebug_dyndbg_module_param_cb(char *param, char *val, rowsize, groupsize, buf, len, ascii); \ } while (0) -static inline int dynamic_debug_exec_queries(const char *query, const char *modname) -{ -pr_warn ("kernel not built with CONFIG_DYNAMIC_DEBUG_CORE\n" ); -return 0 ; -} -#endif /* !CONFIG_DYNAMIC_DEBUG_CORE */ #endif
lib/dynamic_debug.c +0 -29
@@ -557,35 +557,6 @@ static int ddebug_exec_queries(char *query, const char *modname)return nfound; } -/** -* dynamic_debug_exec_queries - select and change dynamic-debug prints -* @query: query-string described in admin-guide/dynamic-debug-howto -* @modname: string containing module name, usually &module.mod_name -* -* This uses the >/proc/dynamic_debug/control reader, allowing module -* authors to modify their dynamic-debug callsites. The modname is -* canonically struct module.mod_name, but can also be null or a -* module-wildcard, for example: "drm*". -*/ -int dynamic_debug_exec_queries (const char *query,const char *modname) -{ -int rc; -char *qry;/* writable copy of query */ - -if (!query) { -pr_err ("non-null query/command string expected\n" ); -return -EINVAL ; - } - qry =kstrndup (query,PAGE_SIZE ,GFP_KERNEL ); -if (!qry) -return -ENOMEM ; - - rc =ddebug_exec_queries (qry, modname); -kfree (qry); -return rc; -} -EXPORT_SYMBOL_GPL (dynamic_debug_exec_queries); -#define PREFIX_SIZE 64static int remaining (int wrote)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 421/717 clk: qcom: sm6115: Select QCOM_GDSC
In reply to Greg Kroah-HartmanFrom: Dang Huynh <[email protected]>
[ Upstream commit 50ee65dc512b9b5c4de354cf3b4dded34f46c571 ]
While working on the Fxtec Pro1X device, this error shows up with my own minimal configuration:
gcc-sm6115: probe of 1400000.clock-controller failed with error -38
The clock driver depends on CONFIG_QCOM_GDSC and after enabling that, the driver probes successfully.
--- drivers/clk/qcom/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/clk/qcom/Kconfig +1 -0
@@ -637,6 +637,7 @@ config SM_DISPCC_6350 config SM_GCC_6115 tristate "SM6115 and SM4250 Global Clock Controller" + select QCOM_GDSC help Support for the global clock controller on SM6115 and SM4250 devices. Say Y if you want to use peripheral devices such as UART, SPI,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 422/717 mtd: devices: docg3: check the return value of devm_ioremap() in the probe
In reply to Greg Kroah-HartmanFrom: William Dean <[email protected]>
[ Upstream commit 26e784433e6c65735cd6d93a8db52531970d9a60 ]
The function devm_ioremap() in docg3_probe() can fail, so its return value should be checked.
--- drivers/mtd/devices/docg3.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/mtd/devices/docg3.c +6 -1
@@ -1974,9 +1974,14 @@ static int __init docg3_probe(struct platform_device *pdev)dev_err (dev,"No I/O memory resource defined\n" );return ret; } - base =devm_ioremap (dev, ress->start,DOC_IOSPACE_SIZE ); ret = -ENOMEM ; + base =devm_ioremap (dev, ress->start,DOC_IOSPACE_SIZE ); +if (!base) { +dev_err (dev,"devm_ioremap dev failed\n" ); +return ret; + } + cascade =devm_kcalloc (dev,DOC_MAX_NBFLOORS ,sizeof (*cascade),GFP_KERNEL );if (!cascade)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 423/717 remoteproc: Harden rproc_handle_vdev() against integer overflow
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 7d7f8fe4e399519cc9ac68a475fec6d3a996341b ]
The struct_size() macro protects against integer overflows but adding "+ rsc->config_len" introduces the risk of integer overflows again. Use size_add() to be safe.
--- drivers/remoteproc/remoteproc_core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/remoteproc/remoteproc_core.c +3 -2
@@ -518,12 +518,13 @@ static int rproc_handle_vdev(struct rproc *rproc, void *ptr,struct fw_rsc_vdev *rsc = ptr;struct device *dev = &rproc->dev;struct rproc_vdev *rvdev; +size_t rsc_size;int i, ret;char name[16 ];/* make sure resource isn't truncated */ -if (struct_size (rsc, vring, rsc->num_of_vrings) + rsc->config_len > - avail) { + rsc_size =struct_size (rsc, vring, rsc->num_of_vrings); +if (size_add (rsc_size, rsc->config_len) > avail) {dev_err (dev,"vdev rsc is truncated\n" );return -EINVAL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 424/717 phy: amlogic: phy-meson-axg-mipi-pcie-analog: Hold reference returned by of_get_parent()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit c4c349be07aeec5f397a349046dc5fc0f2657691 ]
As the of_get_parent() will increase the refcount of the node->parent and the reference will be discarded, so we should hold the reference with which we can decrease the refcount when done.
--- drivers/phy/amlogic/phy-meson-axg-mipi-pcie-analog.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/phy/amlogic/phy-meson-axg-mipi-pcie-analog.c +4 -2
@@ -197,7 +197,7 @@ static int phy_axg_mipi_pcie_analog_probe(struct platform_device *pdev)struct phy_provider *phy;struct device *dev = &pdev->dev;struct phy_axg_mipi_pcie_analog_priv *priv; -struct device_node *np = dev->of_node; +struct device_node *np = dev->of_node, *parent_np;struct regmap *map;int ret;
@@ -206,7 +206,9 @@ static int phy_axg_mipi_pcie_analog_probe(struct platform_device *pdev)return -ENOMEM ;/* Get the hhi system controller node */ - map =syscon_node_to_regmap (of_get_parent (dev->of_node)); + parent_np =of_get_parent (dev->of_node); + map =syscon_node_to_regmap (parent_np); +of_node_put (parent_np);if (IS_ERR (map)) {dev_err (dev,"failed to get HHI regmap\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 425/717 phy: phy-mtk-tphy: fix the phy type setting issue
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
[ Upstream commit 931c05a8cb1be029ef2fbc1e4af313d4cb297c47 ]
The PHY type is not set if the index is non zero, prepare type value according to the index, like as mask value.
--- drivers/phy/mediatek/phy-mtk-tphy.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/phy/mediatek/phy-mtk-tphy.c +4 -3
@@ -906,7 +906,7 @@ static int phy_type_syscon_get(struct mtk_phy_instance *instance,static int phy_type_set (struct mtk_phy_instance *instance) {int type; -u32 mask; +u32 offset;if (!instance->type_sw)return 0 ;
@@ -929,8 +929,9 @@ static int phy_type_set(struct mtk_phy_instance *instance)return 0 ; } - mask =RG_PHY_SW_TYPE << (instance->type_sw_index *BITS_PER_BYTE ); -regmap_update_bits (instance->type_sw, instance->type_sw_reg, mask, type); + offset = instance->type_sw_index *BITS_PER_BYTE ; +regmap_update_bits (instance->type_sw, instance->type_sw_reg, +RG_PHY_SW_TYPE << offset, type << offset);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 426/717 mtd: rawnand: intel: Read the chip-select line from the correct OF node
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit bfc618fcc3f167ad082053e81e9d664e724c6288 ]
The chip select has to be read from the flash node which is a child node of the NAND controller.
--- drivers/mtd/nand/raw/intel-nand-controller.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/mtd/nand/raw/intel-nand-controller.c +9 -2
@@ -16,6 +16,7 @@#include <linux/mtd/rawnand.h> #include <linux/mtd/nand.h> +#include <linux/of.h> #include <linux/platform_device.h> #include <linux/sched.h> #include <linux/slab.h>
@@ -580,6 +581,7 @@ static int ebu_nand_probe(struct platform_device *pdev) {struct device *dev = &pdev->dev;struct ebu_nand_controller *ebu_host; +struct device_node *chip_np;struct nand_chip *nand;struct mtd_info *mtd;struct resource *res;
@@ -604,7 +606,12 @@ static int ebu_nand_probe(struct platform_device *pdev)if (IS_ERR (ebu_host->hsnand))return PTR_ERR (ebu_host->hsnand); - ret =device_property_read_u32 (dev,"reg" , &cs); + chip_np =of_get_next_child (dev->of_node,NULL ); +if (!chip_np) +return dev_err_probe (dev, -EINVAL , +"Could not find child node for the NAND chip\n" ); + + ret =of_property_read_u32 (chip_np,"reg" , &cs);if (ret) {dev_err (dev,"failed to get chip select: %d\n" , ret);return ret;
@@ -660,7 +667,7 @@ static int ebu_nand_probe(struct platform_device *pdev)writel (ebu_host->cs[cs].addr_sel |EBU_ADDR_MASK (5 ) |EBU_ADDR_SEL_REGEN , ebu_host->ebu +EBU_ADDR_SEL (cs)); -nand_set_flash_node (&ebu_host->chip, dev->of_node); +nand_set_flash_node (&ebu_host->chip, chip_np); mtd =nand_to_mtd (&ebu_host->chip);if (!mtd->name) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 427/717 mtd: rawnand: intel: Remove undocumented compatible string
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit 68c02ebaa34d41063ccbbc789a352537ddc3cd8a ]
The "intel,nand-controller" compatible string is not part of the dt-bindings. Remove it from the driver as it's not supposed to be used without any documentation for it.
--- drivers/mtd/nand/raw/intel-nand-controller.c | 1 - 1 file changed, 1 deletion(-)
drivers/mtd/nand/raw/intel-nand-controller.c +0 -1
@@ -723,7 +723,6 @@ static int ebu_nand_remove(struct platform_device *pdev) }static const struct of_device_id ebu_nand_match[] = { - { .compatible ="intel,nand-controller" }, { .compatible ="intel,lgm-ebunand" }, {} };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 428/717 mtd: rawnand: fsl_elbc: Fix none ECC mode
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 049e43b9fd8fd2966940485da163d67e96ee3fea ]
Commit f6424c22aa36 ("mtd: rawnand: fsl_elbc: Make SW ECC work") added support for specifying ECC mode via DTS and skipping autodetection.
But it broke explicit specification of HW ECC mode in DTS as correct settings for HW ECC mode are applied only when NONE mode or nothing was specified in DTS file.
Also it started aliasing NONE mode to be same as when ECC mode was not specified and disallowed usage of ON_DIE mode.
Fix all these issues. Use autodetection of ECC mode only in case when mode was really not specified in DTS file by checking that ecc value is invalid. Set HW ECC settings either when HW ECC was specified in DTS or it was autodetected. And do not fail when ON_DIE mode is set.
--- drivers/mtd/nand/raw/fsl_elbc_nand.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-)
drivers/mtd/nand/raw/fsl_elbc_nand.c +16 -12
@@ -726,36 +726,40 @@ static int fsl_elbc_attach_chip(struct nand_chip *chip)struct fsl_lbc_regs __iomem *lbc = ctrl->regs;unsigned int al; -switch (chip->ecc.engine_type) {/* * if ECC was not chosen in DT, decide whether to use HW or SW ECC from * CS Base Register */ -case NAND_ECC_ENGINE_TYPE_NONE : +if (chip->ecc.engine_type ==NAND_ECC_ENGINE_TYPE_INVALID ) {/* If CS Base Register selects full hardware ECC then use it */ if ((in_be32 (&lbc->bank[priv->bank].br) &BR_DECC ) ==BR_DECC_CHK_GEN ) { - chip->ecc.read_page = fsl_elbc_read_page; - chip->ecc.write_page = fsl_elbc_write_page; - chip->ecc.write_subpage = fsl_elbc_write_subpage; - chip->ecc.engine_type =NAND_ECC_ENGINE_TYPE_ON_HOST ; -mtd_set_ooblayout (mtd, &fsl_elbc_ooblayout_ops); - chip->ecc.size =512 ; - chip->ecc.bytes =3 ; - chip->ecc.strength =1 ; }else {/* otherwise fall back to default software ECC */ chip->ecc.engine_type =NAND_ECC_ENGINE_TYPE_SOFT ; chip->ecc.algo =NAND_ECC_ALGO_HAMMING ; } + } + +switch (chip->ecc.engine_type) { +/* if HW ECC was chosen, setup ecc and oob layout */ +case NAND_ECC_ENGINE_TYPE_ON_HOST : + chip->ecc.read_page = fsl_elbc_read_page; + chip->ecc.write_page = fsl_elbc_write_page; + chip->ecc.write_subpage = fsl_elbc_write_subpage; +mtd_set_ooblayout (mtd, &fsl_elbc_ooblayout_ops); + chip->ecc.size =512 ; + chip->ecc.bytes =3 ; + chip->ecc.strength =1 ;break ; -/* if SW ECC was chosen in DT, we do not need to set anything here */ +/* if none or SW ECC was chosen, we do not need to set anything here */ +case NAND_ECC_ENGINE_TYPE_NONE :case NAND_ECC_ENGINE_TYPE_SOFT : +case NAND_ECC_ENGINE_TYPE_ON_DIE :break ; -/* should we also implement *_ECC_ENGINE_CONTROLLER to do as above? */ default :return -EINVAL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 429/717 RDMA/irdma: Align AE id codes to correct flush code and event
In reply to Greg Kroah-HartmanFrom: Sindhu-Devale <[email protected]>
[ Upstream commit 7f51a961f8c6b84752a48e950074a8c4a0808d91 ]
A number of asynchronous event (AE) ids were not aligned to the correct flush_code and event_type. Fix these up so that the correct IBV error and event codes are returned to application.
Also, add handling for new AE ids like IRDMA_AE_INVALID_REQUEST to return the correct WC error code.
--- drivers/infiniband/hw/irdma/defs.h | 1 + drivers/infiniband/hw/irdma/hw.c | 51 +++++++++++++++++------------ drivers/infiniband/hw/irdma/type.h | 1 + drivers/infiniband/hw/irdma/user.h | 1 + drivers/infiniband/hw/irdma/utils.c | 3 ++ drivers/infiniband/hw/irdma/verbs.c | 2 ++ 6 files changed, 38 insertions(+), 21 deletions(-)
drivers/infiniband/hw/irdma/defs.h +1 -0
@@ -314,6 +314,7 @@ enum irdma_cqp_op_type {#define IRDMA_AE_IB_REMOTE_ACCESS_ERROR 0x020d#define IRDMA_AE_IB_REMOTE_OP_ERROR 0x020e#define IRDMA_AE_WQE_LSMM_TOO_LONG 0x0220 +#define IRDMA_AE_INVALID_REQUEST 0x0223#define IRDMA_AE_DDP_INVALID_MSN_GAP_IN_MSN 0x0301#define IRDMA_AE_DDP_UBE_DDP_MESSAGE_TOO_LONG_FOR_AVAILABLE_BUFFER 0x0303#define IRDMA_AE_DDP_UBE_INVALID_DDP_VERSION 0x0304
drivers/infiniband/hw/irdma/hw.c +30 -21
89 lines not on this page · raw message
drivers/infiniband/hw/irdma/type.h +1 -0
@@ -98,6 +98,7 @@ enum irdma_term_mpa_errors {enum irdma_qp_event_type {IRDMA_QP_EVENT_CATASTROPHIC ,IRDMA_QP_EVENT_ACCESS_ERR , +IRDMA_QP_EVENT_REQ_ERR , };enum irdma_hw_stats_index_32b {
drivers/infiniband/hw/irdma/user.h +1 -0
@@ -103,6 +103,7 @@ enum irdma_flush_opcode {FLUSH_FATAL_ERR ,FLUSH_RETRY_EXC_ERR ,FLUSH_MW_BIND_ERR , + FLUSH_REM_INV_REQ_ERR, }; enum irdma_cmpl_status {
drivers/infiniband/hw/irdma/utils.c +3 -0
@@ -2478,6 +2478,9 @@ void irdma_ib_qp_event(struct irdma_qp *iwqp, enum irdma_qp_event_type event)case IRDMA_QP_EVENT_ACCESS_ERR : ibevent.event =IB_EVENT_QP_ACCESS_ERR ;break ; +case IRDMA_QP_EVENT_REQ_ERR : + ibevent.event =IB_EVENT_QP_REQ_ERR ; +break ; } ibevent.device = iwqp->ibqp.device; ibevent.element.qp = &iwqp->ibqp;
drivers/infiniband/hw/irdma/verbs.c +2 -0
@@ -3307,6 +3307,8 @@ static enum ib_wc_status irdma_flush_err_to_ib_wc_status(enum irdma_flush_opcodereturn IB_WC_RETRY_EXC_ERR ;case FLUSH_MW_BIND_ERR :return IB_WC_MW_BIND_ERR ; +case FLUSH_REM_INV_REQ_ERR : +return IB_WC_REM_INV_REQ_ERR ;case FLUSH_FATAL_ERR :default :return IB_WC_FATAL_ERR ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 430/717 RDMA/irdma: Validate udata inlen and outlen
In reply to Greg Kroah-HartmanFrom: Shiraz Saleem <[email protected]>
[ Upstream commit 34acb833cc83bdea912a160ff99b537e62bb4cf3 ]
Currently ib_copy_from_udata and ib_copy_to_udata could underfill the request and response buffer if the user-space passes an undersized value for udata->inlen or udata->outlen respectively [1] This could lead to undesirable behavior.
Zero initing the buffer only goes as far as preventing using the buffer uninitialized.
Validate udata->inlen and udata->outlen passed from user-space to ensure they are at least the required minimum size.
--- drivers/infiniband/hw/irdma/verbs.c | 67 ++++++++++++++++++++++++++--- 1 file changed, 60 insertions(+), 7 deletions(-)
drivers/infiniband/hw/irdma/verbs.c +60 -7
@@ -299,13 +299,19 @@ static void irdma_alloc_push_page(struct irdma_qp *iwqp)static int irdma_alloc_ucontext (struct ib_ucontext *uctx,struct ib_udata *udata) { +#define IRDMA_ALLOC_UCTX_MIN_REQ_LEN offsetofend(struct irdma_alloc_ucontext_req, rsvd8) +#define IRDMA_ALLOC_UCTX_MIN_RESP_LEN offsetofend(struct irdma_alloc_ucontext_resp, rsvd)struct ib_device *ibdev = uctx->device;struct irdma_device *iwdev =to_iwdev (ibdev); -struct irdma_alloc_ucontext_req req; +struct irdma_alloc_ucontext_req req = {};struct irdma_alloc_ucontext_resp uresp = {};struct irdma_ucontext *ucontext =to_ucontext (uctx);struct irdma_uk_attrs *uk_attrs; +if (udata->inlen <IRDMA_ALLOC_UCTX_MIN_REQ_LEN || + udata->outlen <IRDMA_ALLOC_UCTX_MIN_RESP_LEN ) +return -EINVAL ; +if (ib_copy_from_udata (&req, udata,min (sizeof (req), udata->inlen)))return -EINVAL ;
@@ -317,7 +323,7 @@ static int irdma_alloc_ucontext(struct ib_ucontext *uctx, uk_attrs = &iwdev->rf->sc_dev.hw_attrs.uk_attrs;/* GEN_1 legacy support with libi40iw */ -if (udata->outlen <sizeof (uresp)) { +if (udata->outlen ==IRDMA_ALLOC_UCTX_MIN_RESP_LEN ) {if (uk_attrs->hw_rev !=IRDMA_GEN_1 )return -EOPNOTSUPP ;
@@ -389,6 +395,7 @@ static void irdma_dealloc_ucontext(struct ib_ucontext *context)*/ static int irdma_alloc_pd (struct ib_pd *pd,struct ib_udata *udata) { +#define IRDMA_ALLOC_PD_MIN_RESP_LEN offsetofend(struct irdma_alloc_pd_resp, rsvd)struct irdma_pd *iwpd =to_iwpd (pd);struct irdma_device *iwdev =to_iwdev (pd->device);struct irdma_sc_dev *dev = &iwdev->rf->sc_dev;
@@ -398,6 +405,9 @@ static int irdma_alloc_pd(struct ib_pd *pd, struct ib_udata *udata)u32 pd_id =0 ;int err; +if (udata && udata->outlen <IRDMA_ALLOC_PD_MIN_RESP_LEN ) +return -EINVAL ; + err =irdma_alloc_rsrc (rf, rf->allocated_pds, rf->max_pd, &pd_id, &rf->next_pd);if (err)
@@ -814,12 +824,14 @@ static int irdma_create_qp(struct ib_qp *ibqp,struct ib_qp_init_attr *init_attr, struct ib_udata *udata) { +#define IRDMA_CREATE_QP_MIN_REQ_LEN offsetofend(struct irdma_create_qp_req, user_compl_ctx) +#define IRDMA_CREATE_QP_MIN_RESP_LEN offsetofend(struct irdma_create_qp_resp, rsvd)struct ib_pd *ibpd = ibqp->pd;struct irdma_pd *iwpd =to_iwpd (ibpd);struct irdma_device *iwdev =to_iwdev (ibpd->device);struct irdma_pci_f *rf = iwdev->rf;struct irdma_qp *iwqp =to_iwqp (ibqp); -struct irdma_create_qp_req req; +struct irdma_create_qp_req req = {};struct irdma_create_qp_resp uresp = {};u32 qp_num =0 ;int err_code;
@@ -836,6 +848,10 @@ static int irdma_create_qp(struct ib_qp *ibqp,if (err_code)return err_code; +if (udata && (udata->inlen <IRDMA_CREATE_QP_MIN_REQ_LEN || + udata->outlen <IRDMA_CREATE_QP_MIN_RESP_LEN )) +return -EINVAL ; + sq_size = init_attr->cap.max_send_wr; rq_size = init_attr->cap.max_recv_wr;
@@ -1120,6 +1136,8 @@ static int irdma_query_pkey(struct ib_device *ibdev, u32 port, u16 index,int irdma_modify_qp_roce (struct ib_qp *ibqp,struct ib_qp_attr *attr,int attr_mask,struct ib_udata *udata) { +#define IRDMA_MODIFY_QP_MIN_REQ_LEN offsetofend(struct irdma_modify_qp_req, rq_flush) +#define IRDMA_MODIFY_QP_MIN_RESP_LEN offsetofend(struct irdma_modify_qp_resp, push_valid)struct irdma_pd *iwpd =to_iwpd (ibqp->pd);struct irdma_qp *iwqp =to_iwqp (ibqp);struct irdma_device *iwdev = iwqp->iwdev;
@@ -1138,6 +1156,13 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, roce_info = &iwqp->roce_info; udp_info = &iwqp->udp_info; +if (udata) { +/* udata inlen/outlen can be 0 when supporting legacy libi40iw */ +if ((udata->inlen && udata->inlen <IRDMA_MODIFY_QP_MIN_REQ_LEN ) || + (udata->outlen && udata->outlen <IRDMA_MODIFY_QP_MIN_RESP_LEN )) +return -EINVAL ; + } +if (attr_mask & ~IB_QP_ATTR_STANDARD_BITS )return -EOPNOTSUPP ;
@@ -1374,7 +1399,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr,if (iwqp->iwarp_state ==IRDMA_QP_STATE_ERROR ) {spin_unlock_irqrestore (&iwqp->lock, flags); -if (udata) { +if (udata && udata->inlen) {if (ib_copy_from_udata (&ureq, udata,min (sizeof (ureq), udata->inlen)))return -EINVAL ;
@@ -1426,7 +1451,7 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr, }else { iwqp->ibqp_state = attr->qp_state; } -if (udata && dev->hw_attrs.uk_attrs.hw_rev >=IRDMA_GEN_2 ) { +if (udata && udata->outlen && dev->hw_attrs.uk_attrs.hw_rev >=IRDMA_GEN_2 ) {struct irdma_ucontext *ucontext; ucontext = rdma_udata_to_drv_context(udata,
@@ -1466,6 +1491,8 @@ int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr,int irdma_modify_qp (struct ib_qp *ibqp,struct ib_qp_attr *attr,int attr_mask,struct ib_udata *udata) { +#define IRDMA_MODIFY_QP_MIN_REQ_LEN offsetofend(struct irdma_modify_qp_req, rq_flush) +#define IRDMA_MODIFY_QP_MIN_RESP_LEN offsetofend(struct irdma_modify_qp_resp, push_valid)struct irdma_qp *iwqp =to_iwqp (ibqp);struct irdma_device *iwdev = iwqp->iwdev;struct irdma_sc_dev *dev = &iwdev->rf->sc_dev;
@@ -1480,6 +1507,13 @@ int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,int err;unsigned long flags; +if (udata) { +/* udata inlen/outlen can be 0 when supporting legacy libi40iw */ +if ((udata->inlen && udata->inlen <IRDMA_MODIFY_QP_MIN_REQ_LEN ) || + (udata->outlen && udata->outlen <IRDMA_MODIFY_QP_MIN_RESP_LEN )) +return -EINVAL ; + } +if (attr_mask & ~IB_QP_ATTR_STANDARD_BITS )return -EOPNOTSUPP ;
@@ -1565,7 +1599,7 @@ int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,case IB_QPS_RESET :if (iwqp->iwarp_state ==IRDMA_QP_STATE_ERROR ) {spin_unlock_irqrestore (&iwqp->lock, flags); -if (udata) { +if (udata && udata->inlen) {if (ib_copy_from_udata (&ureq, udata,min (sizeof (ureq), udata->inlen)))return -EINVAL ;
@@ -1662,7 +1696,7 @@ int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask, } } } -if (attr_mask &IB_QP_STATE && udata && +if (attr_mask &IB_QP_STATE && udata && udata->outlen && dev->hw_attrs.uk_attrs.hw_rev >=IRDMA_GEN_2 ) {struct irdma_ucontext *ucontext;
@@ -1797,6 +1831,7 @@ static int irdma_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata)static int irdma_resize_cq (struct ib_cq *ibcq,int entries,struct ib_udata *udata) { +#define IRDMA_RESIZE_CQ_MIN_REQ_LEN offsetofend(struct irdma_resize_cq_req, user_cq_buffer)struct irdma_cq *iwcq =to_iwcq (ibcq);struct irdma_sc_dev *dev = iwcq->sc_cq.dev;struct irdma_cqp_request *cqp_request;
@@ -1819,6 +1854,9 @@ static int irdma_resize_cq(struct ib_cq *ibcq, int entries, IRDMA_FEATURE_CQ_RESIZE))return -EOPNOTSUPP ; +if (udata && udata->inlen <IRDMA_RESIZE_CQ_MIN_REQ_LEN ) +return -EINVAL ; +if (entries > rf->max_cqe)return -EINVAL ;
@@ -1951,6 +1989,8 @@ static int irdma_create_cq(struct ib_cq *ibcq,const struct ib_cq_init_attr *attr, struct ib_udata *udata) { +#define IRDMA_CREATE_CQ_MIN_REQ_LEN offsetofend(struct irdma_create_cq_req, user_cq_buf) +#define IRDMA_CREATE_CQ_MIN_RESP_LEN offsetofend(struct irdma_create_cq_resp, cq_size)struct ib_device *ibdev = ibcq->device;struct irdma_device *iwdev =to_iwdev (ibdev);struct irdma_pci_f *rf = iwdev->rf;
@@ -1969,6 +2009,11 @@ static int irdma_create_cq(struct ib_cq *ibcq, err_code =cq_validate_flags (attr->flags, dev->hw_attrs.uk_attrs.hw_rev);if (err_code)return err_code; + +if (udata && (udata->inlen <IRDMA_CREATE_CQ_MIN_REQ_LEN || + udata->outlen <IRDMA_CREATE_CQ_MIN_RESP_LEN )) +return -EINVAL ; + err_code =irdma_alloc_rsrc (rf, rf->allocated_cqs, rf->max_cq, &cq_num, &rf->next_cq);if (err_code)
@@ -2738,6 +2783,7 @@ static struct ib_mr *irdma_reg_user_mr(struct ib_pd *pd, u64 start, u64 len, u64 virt, int access, struct ib_udata *udata) { +#define IRDMA_MEM_REG_MIN_REQ_LEN offsetofend(struct irdma_mem_reg_req, sq_pages) struct irdma_device *iwdev = to_iwdev(pd->device);struct irdma_ucontext *ucontext;struct irdma_pble_alloc *palloc;
@@ -2755,6 +2801,9 @@ static struct ib_mr *irdma_reg_user_mr(struct ib_pd *pd, u64 start, u64 len,if (len > iwdev->rf->sc_dev.hw_attrs.max_mr_size)return ERR_PTR (-EINVAL ); +if (udata->inlen <IRDMA_MEM_REG_MIN_REQ_LEN ) +return ERR_PTR (-EINVAL ); + region =ib_umem_get (pd->device, start, len, access);if (IS_ERR (region)) {
@@ -4290,12 +4339,16 @@ static int irdma_create_user_ah(struct ib_ah *ibah,struct rdma_ah_init_attr *attr, struct ib_udata *udata) { +#define IRDMA_CREATE_AH_MIN_RESP_LEN offsetofend(struct irdma_create_ah_resp, rsvd) struct irdma_ah *ah = container_of(ibah, struct irdma_ah, ibah);struct irdma_device *iwdev =to_iwdev (ibah->pd->device);struct irdma_create_ah_resp uresp;struct irdma_ah *parent_ah;int err; +if (udata && udata->outlen <IRDMA_CREATE_AH_MIN_RESP_LEN ) +return -EINVAL ; + err =irdma_setup_ah (ibah, attr);if (err)return err;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 431/717 RDMA/srp: Fix srp_abort()
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 6dbe4a8dead84de474483910b02ec9e6a10fc1a9 ]
Fix the code for converting a SCSI command pointer into an SRP request pointer.
--- drivers/infiniband/ulp/srp/ib_srp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/infiniband/ulp/srp/ib_srp.c +1 -3
@@ -2790,7 +2790,7 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,static int srp_abort (struct scsi_cmnd *scmnd) {struct srp_target_port *target =host_to_target (scmnd->device->host); -struct srp_request *req = (struct srp_request *) scmnd->host_scribble; +struct srp_request *req =scsi_cmd_priv (scmnd);u32 tag;u16 ch_idx;struct srp_rdma_ch *ch;
@@ -2798,8 +2798,6 @@ static int srp_abort(struct scsi_cmnd *scmnd)shost_printk (KERN_ERR , target->scsi_host,"SRP abort called\n" ); -if (!req) -return SUCCESS ; tag =blk_mq_unique_tag (scsi_cmd_to_rq (scmnd)); ch_idx =blk_mq_unique_tag_to_hwq (tag);if (WARN_ON_ONCE (ch_idx >= target->ch_count))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 432/717 RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
In reply to Greg Kroah-HartmanFrom: Bernard Metzler <[email protected]>
[ Upstream commit 754209850df8367c954ac1de7671c7430b1f342c ]
For header and trailer/padding processing, siw did not consume new skb data until minimum amount present to fill current header or trailer structure, including potential payload padding. Not consuming any data during upcall may cause a receive stall, since tcp_read_sock() is not upcalling again if no new data arrive.
A NFSoRDMA client got stuck at RDMA Write reception of unaligned payload, if the current skb did contain only the expected 3 padding bytes, but not the 4 bytes CRC trailer. Expecting 4 more bytes already arrived in another skb, and not consuming those 3 bytes in the current upcall left the Write incomplete, waiting for the CRC forever.
--- drivers/infiniband/sw/siw/siw_qp_rx.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
drivers/infiniband/sw/siw/siw_qp_rx.c +15 -12
@@ -961,27 +961,28 @@ int siw_proc_terminate(struct siw_qp *qp)static int siw_get_trailer (struct siw_qp *qp,struct siw_rx_stream *srx) {struct sk_buff *skb = srx->skb; +int avail =min (srx->skb_new, srx->fpdu_part_rem);u8 *tbuf = (u8 *)&srx->trailer.crc - srx->pad;__wsum crc_in, crc_own =0 ;siw_dbg_qp (qp,"expected %d, available %d, pad %u\n" , srx->fpdu_part_rem, srx->skb_new, srx->pad); -if (srx->skb_new < srx->fpdu_part_rem) -return -EAGAIN ; - -skb_copy_bits (skb, srx->skb_offset, tbuf, srx->fpdu_part_rem); +skb_copy_bits (skb, srx->skb_offset, tbuf, avail); -if (srx->mpa_crc_hd && srx->pad) -crypto_shash_update (srx->mpa_crc_hd, tbuf, srx->pad); + srx->skb_new -= avail; + srx->skb_offset += avail; + srx->skb_copied += avail; + srx->fpdu_part_rem -= avail; - srx->skb_new -= srx->fpdu_part_rem; - srx->skb_offset += srx->fpdu_part_rem; - srx->skb_copied += srx->fpdu_part_rem; +if (srx->fpdu_part_rem) +return -EAGAIN ;if (!srx->mpa_crc_hd)return 0 ; +if (srx->pad) +crypto_shash_update (srx->mpa_crc_hd, tbuf, srx->pad);/* * CRC32 is computed, transmitted and received directly in NBO, * so there's never a reason to convert byte order.
@@ -1083,10 +1084,9 @@ static int siw_get_hdr(struct siw_rx_stream *srx)* completely received. */ if (iwarp_pktinfo[opcode].hdr_len >sizeof (struct iwarp_ctrl_tagged )) { - bytes = iwarp_pktinfo[opcode].hdr_len -MIN_DDP_HDR ; +int hdrlen = iwarp_pktinfo[opcode].hdr_len; -if (srx->skb_new < bytes) -return -EAGAIN ; + bytes =min_t (int, hdrlen -MIN_DDP_HDR , srx->skb_new);skb_copy_bits (skb, srx->skb_offset, (char *)c_hdr + srx->fpdu_part_rcvd, bytes);
@@ -1096,6 +1096,9 @@ static int siw_get_hdr(struct siw_rx_stream *srx) srx->skb_new -= bytes; srx->skb_offset += bytes; srx->skb_copied += bytes; + +if (srx->fpdu_part_rcvd < hdrlen) +return -EAGAIN ; }/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 433/717 RDMA/siw: Fix QP destroy to wait for all references dropped.
In reply to Greg Kroah-HartmanFrom: Bernard Metzler <[email protected]>
[ Upstream commit a3c278807a459e6f50afee6971cabe74cccfb490 ]
Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after-free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed.
--- drivers/infiniband/sw/siw/siw.h | 1 + drivers/infiniband/sw/siw/siw_qp.c | 2 +- drivers/infiniband/sw/siw/siw_verbs.c | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-)
drivers/infiniband/sw/siw/siw.h +1 -0
@@ -418,6 +418,7 @@ struct siw_qp {struct ib_qp base_qp;struct siw_device *sdev;struct kref ref; +struct completion qp_free;struct list_head devq;int tx_cpu;struct siw_qp_attrs attrs;
drivers/infiniband/sw/siw/siw_qp.c +1 -1
@@ -1342,6 +1342,6 @@ void siw_free_qp(struct kref *ref)vfree (qp->orq);siw_put_tx_cpu (qp->tx_cpu); - +complete (&qp->qp_free);atomic_dec (&sdev->num_qp); }
drivers/infiniband/sw/siw/siw_verbs.c +3 -0
@@ -480,6 +480,8 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,list_add_tail (&qp->devq, &sdev->qp_list);spin_unlock_irqrestore (&sdev->lock, flags); +init_completion (&qp->qp_free); +return 0 ; err_out_xa:
@@ -624,6 +626,7 @@ int siw_destroy_qp(struct ib_qp *base_qp, struct ib_udata *udata) qp->scq = qp->rcq =NULL ;siw_qp_put (qp); +wait_for_completion (&qp->qp_free);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 434/717 ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
[ Upstream commit 690aa8c3ae308bc696ec8b1b357b995193927083 ]
ACS-5 section
7.13.6.41 Words 85..87, 120: Commands and feature sets supported or enabled states that:
If bit 15 of word 86 is set to one, bit 14 of word 119 is set to one, and bit 15 of word 119 is cleared to zero, then word 119 is valid.
If bit 15 of word 86 is set to one, bit 14 of word 120 is set to one, and bit 15 of word 120 is cleared to zero, then word 120 is valid.
(This text also exists in really old ACS standards, e.g. ACS-3.)
Currently, ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() both check bit 15 of word 86, but neither of them check that bit 14 of word 119 is set to one, or that bit 15 of word 119 is cleared to zero.
Additionally, make ata_id_sense_reporting_enabled() return false if !ata_id_has_sense_reporting(), similar to how e.g. ata_id_flush_ext_enabled() returns false if !ata_id_has_flush_ext().
--- include/linux/ata.h | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
include/linux/ata.h +9 -4
@@ -771,16 +771,21 @@ static inline bool ata_id_has_read_log_dma_ext(const u16 *id)static inline bool ata_id_has_sense_reporting (const u16 *id) { -if (!(id[ATA_ID_CFS_ENABLE_2 ] & (1 <<15 ))) +if (!(id[ATA_ID_CFS_ENABLE_2 ] &BIT (15 ))) +return false; +if ((id[ATA_ID_COMMAND_SET_3 ] & (BIT (15 ) |BIT (14 ))) !=BIT (14 ))return false; -return id[ATA_ID_COMMAND_SET_3 ] & (1 <<6 ); +return id[ATA_ID_COMMAND_SET_3 ] &BIT (6 ); }static inline bool ata_id_sense_reporting_enabled (const u16 *id) { -if (!(id[ATA_ID_CFS_ENABLE_2 ] & (1 <<15 ))) +if (!ata_id_has_sense_reporting (id)) +return false; +/* ata_id_has_sense_reporting() == true, word 86 must have bit 15 set */ +if ((id[ATA_ID_COMMAND_SET_4 ] & (BIT (15 ) |BIT (14 ))) !=BIT (14 ))return false; -return id[ATA_ID_COMMAND_SET_4 ] & (1 <<6 ); +return id[ATA_ID_COMMAND_SET_4 ] &BIT (6 ); }/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 435/717 ata: fix ata_id_has_devslp()
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
[ Upstream commit 9c6e09a434e1317e09b78b3b69cd384022ec9a03 ]
ACS-5 section
7.13.6.36 Word 78: Serial ATA features supported
states that:
If word 76 is not 0000h or FFFFh, word 78 reports the features supported by the device. If this word is not supported, the word shall be cleared to zero.
(This text also exists in really old ACS standards, e.g. ACS-3.)
Additionally, move the macro to the other ATA_ID_FEATURE_SUPP macros (which already have this check), thus making it more likely that the next ATA_ID_FEATURE_SUPP macro that is added will include this check.
--- include/linux/ata.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/linux/ata.h +4 -1
@@ -566,6 +566,10 @@ struct ata_bmdma_prd { ((((id)[ATA_ID_SATA_CAPABILITY ] !=0x0000 ) && \ ((id)[ATA_ID_SATA_CAPABILITY ] !=0xffff )) && \ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 2))) +#define ata_id_has_devslp (id) \ + ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ + ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ + ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8)))#define ata_id_iordy_disable (id) ((id)[ATA_ID_CAPABILITY] & (1 << 10))#define ata_id_has_iordy (id) ((id)[ATA_ID_CAPABILITY] & (1 << 11))#define ata_id_u32 (id,n) \
@@ -578,7 +582,6 @@ struct ata_bmdma_prd {#define ata_id_cdb_intr (id) (((id)[ATA_ID_CONFIG] & 0x60) == 0x20)#define ata_id_has_da (id) ((id)[ATA_ID_SATA_CAPABILITY_2] & (1 << 4)) -#define ata_id_has_devslp (id) ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8))#define ata_id_has_ncq_autosense (id) \ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 436/717 ata: fix ata_id_has_ncq_autosense()
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
[ Upstream commit a5fb6bf853148974dbde092ec1bde553bea5e49f ]
ACS-5 section
7.13.6.36 Word 78: Serial ATA features supported
states that:
If word 76 is not 0000h or FFFFh, word 78 reports the features supported by the device. If this word is not supported, the word shall be cleared to zero.
(This text also exists in really old ACS standards, e.g. ACS-3.)
Additionally, move the macro to the other ATA_ID_FEATURE_SUPP macros (which already have this check), thus making it more likely that the next ATA_ID_FEATURE_SUPP macro that is added will include this check.
--- include/linux/ata.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
include/linux/ata.h +4 -2
@@ -570,6 +570,10 @@ struct ata_bmdma_prd { ((((id)[ATA_ID_SATA_CAPABILITY ] !=0x0000 ) && \ ((id)[ATA_ID_SATA_CAPABILITY ] !=0xffff )) && \ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8))) +#define ata_id_has_ncq_autosense (id) \ + ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ + ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ + ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7)))#define ata_id_iordy_disable (id) ((id)[ATA_ID_CAPABILITY] & (1 << 10))#define ata_id_has_iordy (id) ((id)[ATA_ID_CAPABILITY] & (1 << 11))#define ata_id_u32 (id,n) \
@@ -582,8 +586,6 @@ struct ata_bmdma_prd {#define ata_id_cdb_intr (id) (((id)[ATA_ID_CONFIG] & 0x60) == 0x20)#define ata_id_has_da (id) ((id)[ATA_ID_SATA_CAPABILITY_2] & (1 << 4)) -#define ata_id_has_ncq_autosense (id) \ - ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7))static inline bool ata_id_has_hipm (const u16 *id) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 437/717 ata: fix ata_id_has_dipm()
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
[ Upstream commit 630624cb1b5826d753ac8e01a0e42de43d66dedf ]
ACS-5 section
7.13.6.36 Word 78: Serial ATA features supported
states that:
If word 76 is not 0000h or FFFFh, word 78 reports the features supported by the device. If this word is not supported, the word shall be cleared to zero.
(This text also exists in really old ACS standards, e.g. ACS-3.)
The problem with ata_id_has_dipm() is that the while it performs a check against 0 and 0xffff, it performs the check against ATA_ID_FEATURE_SUPP (word 78), the same word where the feature bit is stored.
Fix this by performing the check against ATA_ID_SATA_CAPABILITY (word 76), like required by the spec. The feature bit check itself is of course still performed against ATA_ID_FEATURE_SUPP (word 78).
Additionally, move the macro to the other ATA_ID_FEATURE_SUPP macros (which already have this check), thus making it more likely that the next ATA_ID_FEATURE_SUPP macro that is added will include this check.
--- include/linux/ata.h | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
include/linux/ata.h +4 -11
@@ -574,6 +574,10 @@ struct ata_bmdma_prd { ((((id)[ATA_ID_SATA_CAPABILITY ] !=0x0000 ) && \ ((id)[ATA_ID_SATA_CAPABILITY ] !=0xffff )) && \ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7))) +#define ata_id_has_dipm (id) \ + ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ + ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ + ((id)[ATA_ID_FEATURE_SUPP] & (1 << 3)))#define ata_id_iordy_disable (id) ((id)[ATA_ID_CAPABILITY] & (1 << 10))#define ata_id_has_iordy (id) ((id)[ATA_ID_CAPABILITY] & (1 << 11))#define ata_id_u32 (id,n) \
@@ -597,17 +601,6 @@ static inline bool ata_id_has_hipm(const u16 *id)return val & (1 <<9 ); } -static inline bool ata_id_has_dipm (const u16 *id) -{ -u16 val = id[ATA_ID_FEATURE_SUPP ]; - -if (val ==0 || val ==0xffff ) -return false; - -return val & (1 <<3 ); -} - -static inline bool ata_id_has_fua (const u16 *id) {if ((id[ATA_ID_CFSSE ] &0xC000 ) !=0x4000 )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 438/717 mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 3e4ad3212cf22687410b1e8f4e68feec50646113 ]
The meson_nfc_ecc_correct() function accidentally does a right shift instead of a left shift so it only works for BIT(0). Also use BIT_ULL() because "correct_bitmap" is a u64 and we want to avoid shift wrapping bugs.
--- drivers/mtd/nand/raw/meson_nand.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mtd/nand/raw/meson_nand.c +2 -2
@@ -454,7 +454,7 @@ static int meson_nfc_ecc_correct(struct nand_chip *nand, u32 *bitflips,if (ECC_ERR_CNT (*info) !=ECC_UNCORRECTABLE ) { mtd->ecc_stats.corrected +=ECC_ERR_CNT (*info); *bitflips =max_t (u32, *bitflips,ECC_ERR_CNT (*info)); - *correct_bitmap |=1 >> i; + *correct_bitmap |=BIT_ULL (i);continue ; } if ((nand->options & NAND_NEED_SCRAMBLING) &&
@@ -800,7 +800,7 @@ static int meson_nfc_read_page_hwecc(struct nand_chip *nand, u8 *buf,u8 *data = buf + i * ecc->size;u8 *oob = nand->oob_poi + i * (ecc->bytes +2 ); -if (correct_bitmap & (1 << i)) +if (correct_bitmap &BIT_ULL (i))continue ; ret = nand_check_erased_ecc_chunk(data, ecc->size, oob, ecc->bytes + 2,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 439/717 md: Replace snprintf with scnprintf
In reply to Greg Kroah-HartmanFrom: Saurabh Sengar <[email protected]>
[ Upstream commit 1727fd5015d8f93474148f94e34cda5aa6ad4a43 ]
Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf() returns the number of characters generated from the given input, which could cause the expression “200 – len” to wrap around to a large positive number. Fix this by using scnprintf() instead, which returns the actual number of characters written into the buffer.
[ 1513.267938] ------------[ cut here ]------------ [ 1513.267943] WARNING: CPU: 15 PID: 37247 at <snip>/lib/vsprintf.c:2509 vsnprintf+0x2c8/0x510 [ 1513.267944] Modules linked in: <snip> [ 1513.267969] CPU: 15 PID: 37247 Comm: mdadm Not tainted 5.4.0-1085-azure #90~18.04.1-Ubuntu [ 1513.267969] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 1513.267971] RIP: 0010:vsnprintf+0x2c8/0x510 <-snip-> [ 1513.267982] Call Trace: [ 1513.267986] snprintf+0x45/0x70 [ 1513.267990] ? disk_name+0x71/0xa0 [ 1513.267993] dump_zones+0x114/0x240 [raid0] [ 1513.267996] ? _cond_resched+0x19/0x40 [ 1513.267998] raid0_run+0x19e/0x270 [raid0] [ 1513.268000] md_run+0x5e0/0xc50 [ 1513.268003] ? security_capable+0x3f/0x60 [ 1513.268005] do_md_run+0x19/0x110 [ 1513.268006] md_ioctl+0x195e/0x1f90 [ 1513.268007] blkdev_ioctl+0x91f/0x9f0 [ 1513.268010] block_ioctl+0x3d/0x50 [ 1513.268012] do_vfs_ioctl+0xa9/0x640 [ 1513.268014] ? __fput+0x162/0x260 [ 1513.268016] ksys_ioctl+0x75/0x80 [ 1513.268017] __x64_sys_ioctl+0x1a/0x20 [ 1513.268019] do_syscall_64+0x5e/0x200 [ 1513.268021] entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/md/raid0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/raid0.c +1 -1
@@ -47,7 +47,7 @@ static void dump_zones(struct mddev *mddev)int len =0 ;for (k =0 ; k < conf->strip_zone[j].nb_dev; k++) - len +=snprintf (line+len,200 -len,"%s%pg" , k?"/" :"" , + len +=scnprintf (line+len,200 -len,"%s%pg" , k?"/" :"" , conf->devlist[j * raid_disks + k]->bdev);pr_debug ("md: zone%d=[%s]\n" , j, line);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 440/717 md/raid5: Ensure stripe_fill happens on non-read IO with journal
In reply to Greg Kroah-HartmanFrom: Logan Gunthorpe <[email protected]>
[ Upstream commit e2eed85bc75138a9eeb63863d20f8904ac42a577 ]
When doing degrade/recover tests using the journal a kernel BUG is hit at drivers/md/raid5.c:4381 in handle_parity_checks5():
BUG_ON(!test_bit(R5_UPTODATE, &dev->flags));
This was found to occur because handle_stripe_fill() was skipped for stripes in the journal due to a condition in that function. Thus blocks were not fetched and R5_UPTODATE was not set when the code reached handle_parity_checks5().
To fix this, don't skip handle_stripe_fill() unless the stripe is for read.
--- drivers/md/raid5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/raid5.c +1 -1
@@ -3951,7 +3951,7 @@ static void handle_stripe_fill(struct stripe_head *sh,* back cache (prexor with orig_page, and then xor with * page) in the read path */ -if (s->injournal && s->failed) { +if (s->to_read && s->injournal && s->failed) {if (test_bit (STRIPE_R5C_CACHING , &sh->state))r5c_make_stripe_write_out (sh); goto out;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 441/717 md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
In reply to Greg Kroah-HartmanFrom: David Sloan <[email protected]>
[ Upstream commit c66a6f41e09ad386fd2cce22b9cded837bbbc704 ]
When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed:
=============================================================================
BUG bio-200 (Not tainted): Object already free
-----------------------------------------------------------------------------
Allocated in mempool_alloc_slab+0x17/0x20 age=3 cpu=2 pid=7504
__slab_alloc.constprop.0+0x5a/0xb0
kmem_cache_alloc+0x31e/0x330
mempool_alloc_slab+0x17/0x20
mempool_alloc+0x100/0x2b0
bio_alloc_bioset+0x181/0x460
do_mpage_readpage+0x776/0xd00
mpage_readahead+0x166/0x320
blkdev_readahead+0x15/0x20
read_pages+0x13f/0x5f0
page_cache_ra_unbounded+0x18d/0x220
force_page_cache_ra+0x181/0x1c0
page_cache_sync_ra+0x65/0xb0
filemap_get_pages+0x1df/0xaf0
filemap_read+0x1e1/0x700
blkdev_read_iter+0x1e5/0x330
vfs_read+0x42a/0x570
Freed in mempool_free_slab+0x17/0x20 age=3 cpu=2 pid=7504
kmem_cache_free+0x46d/0x490
mempool_free_slab+0x17/0x20
mempool_free+0x66/0x190
bio_free+0x78/0x90
bio_put+0x100/0x1a0
raid5_make_request+0x2259/0x2450
md_handle_request+0x402/0x600
md_submit_bio+0xd9/0x120
__submit_bio+0x11f/0x1b0
submit_bio_noacct_nocheck+0x204/0x480
submit_bio_noacct+0x32e/0xc70
submit_bio+0x98/0x1a0
mpage_readahead+0x250/0x320
blkdev_readahead+0x15/0x20
read_pages+0x13f/0x5f0
page_cache_ra_unbounded+0x18d/0x220
Slab 0xffffea000481b600 objects=21 used=0 fp=0xffff8881206d8940 flags=0x17ffffc0010201(locked|slab|head|node=0|zone=2|lastcpupid=0x1fffff)
CPU: 0 PID: 34525 Comm: kworker/u24:2 Not tainted 6.0.0-rc2-localyes-265166-gf11c5343fa3f #143
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: raid5wq raid5_do_work
Call Trace:
<TASK>
dump_stack_lvl+0x5a/0x78
dump_stack+0x10/0x16
print_trailer+0x158/0x165
object_err+0x35/0x50
free_debug_processing.cold+0xb7/0xbe
__slab_free+0x1ae/0x330
kmem_cache_free+0x46d/0x490
mempool_free_slab+0x17/0x20
mempool_free+0x66/0x190
bio_free+0x78/0x90
bio_put+0x100/0x1a0
mpage_end_io+0x36/0x150
bio_endio+0x2fd/0x360
md_end_io_acct+0x7e/0x90
bio_endio+0x2fd/0x360
handle_failed_stripe+0x960/0xb80
handle_stripe+0x1348/0x3760
handle_active_stripes.constprop.0+0x72a/0xaf0
raid5_do_work+0x177/0x330
process_one_work+0x616/0xb20
worker_thread+0x2bd/0x6f0
kthread+0x179/0x1b0
ret_from_fork+0x22/0x30
</TASK>The double free is caused by an unnecessary bio_put() in the if(is_badblock(...)) error path in raid5_read_one_chunk().
The error path was moved ahead of bio_alloc_clone() in c82aa1b76787c ("md/raid5: move checking badblock before clone bio in raid5_read_one_chunk"). The previous code checked and freed align_bio which required a bio_put. After the move that is no longer needed as raid_bio is returned to the control of the common io path which performs its own endio resulting in a double free on bad device blocks.
--- drivers/md/raid5.c | 1 - 1 file changed, 1 deletion(-)
drivers/md/raid5.c +0 -1
@@ -5446,7 +5446,6 @@ static int raid5_read_one_chunk(struct mddev *mddev, struct bio *raid_bio)if (is_badblock (rdev, sector,bio_sectors (raid_bio), &first_bad, &bad_sectors)) { -bio_put (raid_bio);rdev_dec_pending (rdev, mddev);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 442/717 RDMA/cm: Use SLID in the work completion as the DLID in responder side
In reply to Greg Kroah-HartmanFrom: Mark Zhang <[email protected]>
[ Upstream commit b7d95040c13f61a4a6a859c5355faf583eff9658 ]
The responder should always use WC's SLID as the dlid, to follow the IB SPEC section "13.5.4.2 COMMON RESPONSE ACTIONS":
A responder always takes the following actions in constructing a response packet:
- The SLID of the received packet is used as the DLID in the response packet.
--- drivers/infiniband/core/cm.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/infiniband/core/cm.c +7 -7
@@ -1632,14 +1632,13 @@ static void cm_path_set_rec_type(struct ib_device *ib_device, u32 port_num,static void cm_format_path_lid_from_req (struct cm_req_msg *req_msg,struct sa_path_rec *primary_path, -struct sa_path_rec *alt_path) +struct sa_path_rec *alt_path, +struct ib_wc *wc) {u32 lid;if (primary_path->rec_type !=SA_PATH_REC_TYPE_OPA ) { -sa_path_set_dlid (primary_path, -IBA_GET (CM_REQ_PRIMARY_LOCAL_PORT_LID , - req_msg)); +sa_path_set_dlid (primary_path, wc->slid);sa_path_set_slid (primary_path,IBA_GET (CM_REQ_PRIMARY_REMOTE_PORT_LID , req_msg));
@@ -1676,7 +1675,8 @@ static void cm_format_path_lid_from_req(struct cm_req_msg *req_msg,static void cm_format_paths_from_req (struct cm_req_msg *req_msg,struct sa_path_rec *primary_path, -struct sa_path_rec *alt_path) +struct sa_path_rec *alt_path, +struct ib_wc *wc) { primary_path->dgid = *IBA_GET_MEM_PTR (CM_REQ_PRIMARY_LOCAL_PORT_GID , req_msg);
@@ -1734,7 +1734,7 @@ static void cm_format_paths_from_req(struct cm_req_msg *req_msg,if (sa_path_is_roce (alt_path)) alt_path->roce.route_resolved = false; } -cm_format_path_lid_from_req (req_msg, primary_path, alt_path); +cm_format_path_lid_from_req (req_msg, primary_path, alt_path, wc); }static u16 cm_get_bth_pkey (struct cm_work *work)
@@ -2148,7 +2148,7 @@ static int cm_req_handler(struct cm_work *work)if (cm_req_has_alt_path (req_msg)) work->path[1 ].rec_type = work->path[0 ].rec_type;cm_format_paths_from_req (req_msg, &work->path[0 ], - &work->path[1 ]); + &work->path[1 ], work->mad_recv_wc->wc);if (cm_id_priv->av.ah_attr.type ==RDMA_AH_ATTR_TYPE_ROCE )sa_path_set_dmac (&work->path[0 ], cm_id_priv->av.ah_attr.roce.dmac);
Signature · 1 line
2.35.1