4.19.262-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 4.19.262-rc1 review
This is the start of the stable review cycle for the 4.19.262 release. There are 229 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Oct 2022 11:29:24 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.262-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.262-rc1
Martin Liska <[email protected]>
gcov: support GCC 12.1 and newer compilers
Rafael J. Wysocki <[email protected]>
thermal: intel_powerclamp: Use first online CPU as control_cpu
Eric Dumazet <[email protected]>
inet: fully convert sk->sk_rx_dst to RCU rules
Ard Biesheuvel <[email protected]>
efi: libstub: drop pointless get_memory_map() call
Saurabh Sengar <[email protected]>
md: Replace snprintf with scnprintf
Jerry Lee 李修賢 <[email protected]>
ext4: continue to expand file system when the target size doesn't reach
Tetsuo Handa <[email protected]>
net/ieee802154: don't warn zero-sized raw_sendmsg()
Alexander Aring <[email protected]>
net: ieee802154: return -EINVAL for unknown addr type
Adrian Hunter <[email protected]>
perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
Maxime Ripard <[email protected]>
clk: bcm2835: Make peripheral PLLC critical
Dongliang Mu <[email protected]>
usb: idmouse: fix an uninit-value in idmouse_open
Keith Busch <[email protected]>
nvme: copy firmware_rev on each init
sunghwan jung <[email protected]>
Revert "usb: storage: Add quirk for Samsung Fit flash"
Robin Guo <[email protected]>
usb: musb: Fix musb_gadget.c rxstate overflow bug
Jianglei Nie <[email protected]>
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
Logan Gunthorpe <[email protected]>
md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
Hyunwoo Kim <[email protected]>
HID: roccat: Fix use-after-free in roccat_read()
Serge Semin <[email protected]>
ata: libahci_platform: Sanity check the DT child nodes number
Nam Cao <[email protected]>
staging: vt6655: fix potential memory leak
Wei Yongjun <[email protected]>
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
Shigeru Yoshida <[email protected]>
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
Letu Ren <[email protected]>
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
Zheyu Ma <[email protected]>
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
Alexander Stein <[email protected]>
ARM: dts: imx6sx: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6sll: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6sl: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6qp: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6dl: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6q: add missing properties for sram
Haibo Chen <[email protected]>
ARM: dts: imx7d-sdb: config the max pressure for tsc2046
hongao <[email protected]>
drm/amdgpu: fix initial connector audio value
Hans de Goede <[email protected]>
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
Maya Matuszczyk <[email protected]>
drm: panel-orientation-quirks: Add quirk for Anbernic Win600
Mateusz Kwiatkowski <[email protected]>
drm/vc4: vec: Fix timings for VEC modes
David Gow <[email protected]>
drm/amd/display: fix overflow on MIN_I64 definition
Javier Martinez Canillas <[email protected]>
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
Javier Martinez Canillas <[email protected]>
drm: Use size_t type for len variable in drm_copy_field()
Andrew Gaul <[email protected]>
r8152: Rate limit overflow messages
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix user-after-free
Liu Jian <[email protected]>
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
Daniel Golle <[email protected]>
wifi: rt2x00: correctly set BBP register 86 for MT7620
Daniel Golle <[email protected]>
wifi: rt2x00: set SoC wmac clock register
Daniel Golle <[email protected]>
wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
Daniel Golle <[email protected]>
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
Ziyang Xuan <[email protected]>
can: bcm: check the result of can_send() in bcm_can_tx()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
Tetsuo Handa <[email protected]>
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
Alexander Coffin <[email protected]>
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
Khalid Masum <[email protected]>
xfrm: Update ipcomp_scratches with NULL when freed
Tetsuo Handa <[email protected]>
wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
Eric Dumazet <[email protected]>
tcp: annotate data-race around tcp_md5sig_pool_populated
Mike Pattrick <[email protected]>
openvswitch: Fix overreporting of drops in dropwatch
Mike Pattrick <[email protected]>
openvswitch: Fix double reporting of drops in dropwatch
Wright Feng <[email protected]>
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
Anna Schumaker <[email protected]>
NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
Kees Cook <[email protected]>
x86/entry: Work around Clang __bdos() bug
Srinivas Pandruvada <[email protected]>
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
Chao Qin <[email protected]>
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
Kees Cook <[email protected]>
MIPS: BCM47XX: Cast memcmp() of function to (void *)
Arvid Norlander <[email protected]>
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
Zhang Qilong <[email protected]>
f2fs: fix race condition on setting FI_NO_EXTENT flag
Dan Carpenter <[email protected]>
crypto: cavium - prevent integer overflow loading firmware
Robin Murphy <[email protected]>
iommu/iova: Fix module config properly
Dan Carpenter <[email protected]>
iommu/omap: Fix buffer overflow in debugfs
Pali Rohár <[email protected]>
powerpc: Fix SPE Power ISA properties for e500v1 platforms
Nicholas Piggin <[email protected]>
powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
Vitaly Kuznetsov <[email protected]>
x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
Zheng Yongjun <[email protected]>
powerpc/powernv: add missing of_node_put() in opal_export_attrs()
Liang He <[email protected]>
powerpc/pci_dn: Add missing of_node_put()
Liang He <[email protected]>
powerpc/sysdev/fsl_msi: Add missing of_node_put()
Nathan Chancellor <[email protected]>
powerpc/math_emu/efp: Include module.h
Jack Wang <[email protected]>
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
Miaoqian Lin <[email protected]>
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
Stefan Wahren <[email protected]>
clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
David Collins <[email protected]>
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
Dave Jiang <[email protected]>
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
Jiasheng Jiang <[email protected]>
mfd: sm501: Add check for platform_driver_register()
Christophe JAILLET <[email protected]>
mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
Christophe JAILLET <[email protected]>
mfd: lp8788: Fix an error handling path in lp8788_probe()
Christophe JAILLET <[email protected]>
mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
Christophe JAILLET <[email protected]>
mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
Jiasheng Jiang <[email protected]>
fsi: core: Check error number after calling ida_simple_get
Pali Rohár <[email protected]>
serial: 8250: Fix restoring termios speed after suspend
Guilherme G. Piccoli <[email protected]>
firmware: google: Test spinlock on panic path to avoid lockups
Nam Cao <[email protected]>
staging: vt6655: fix some erroneous memory clean-up loops
Dongliang Mu <[email protected]>
phy: qualcomm: call clk_disable_unprepare in the error handling
Dan Carpenter <[email protected]>
drivers: serial: jsm: fix some leaks in probe
Albert Briscoe <[email protected]>
usb: gadget: function: fix dangling pnp_string in f_printer.c
Mario Limonciello <[email protected]>
xhci: Don't show warning for reinit on known broken suspend
Logan Gunthorpe <[email protected]>
md/raid5: Ensure stripe_fill happens on non-read IO with journal
Niklas Cassel <[email protected]>
ata: fix ata_id_has_dipm()
Niklas Cassel <[email protected]>
ata: fix ata_id_has_ncq_autosense()
Niklas Cassel <[email protected]>
ata: fix ata_id_has_devslp()
Niklas Cassel <[email protected]>
ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
William Dean <[email protected]>
mtd: devices: docg3: check the return value of devm_ioremap() in the probe
Jim Cromie <[email protected]>
dyndbg: let query-modname override actual module name
Jim Cromie <[email protected]>
dyndbg: fix module.dyndbg handling
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix the error caused by qp->sk
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix "kernel NULL pointer dereference" error
Miaoqian Lin <[email protected]>
media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
Shubhrajyoti Datta <[email protected]>
tty: xilinx_uartps: Fix the ignore_status
Liang He <[email protected]>
media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
Jack Wang <[email protected]>
HSI: omap_ssi_port: Fix dma_map_sg error check
Miaoqian Lin <[email protected]>
HSI: omap_ssi: Fix refcount leak in ssi_probe
Miaoqian Lin <[email protected]>
clk: tegra20: Fix refcount leak in tegra20_clock_init
Miaoqian Lin <[email protected]>
clk: tegra: Fix refcount leak in tegra114_clock_init
Miaoqian Lin <[email protected]>
clk: tegra: Fix refcount leak in tegra210_clock_init
Liang He <[email protected]>
clk: berlin: Add of_node_put() for of_get_parent()
Liang He <[email protected]>
clk: oxnas: Hold reference returned by of_get_parent()
Jonathan Cameron <[email protected]>
iio: ABI: Fix wrong format of differential capacitance channel ABI.
Nuno Sá <[email protected]>
iio: inkern: only release the device node when done with it
Claudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: check return status for pressure and touch
Claudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
Dmitry Torokhov <[email protected]>
ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
Geert Uytterhoeven <[email protected]>
ARM: Drop CMDLINE_* dependency on ATAGS
Dmitry Torokhov <[email protected]>
ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
Michael Walle <[email protected]>
ARM: dts: kirkwood: lsxl: remove first ethernet port
Michael Walle <[email protected]>
ARM: dts: kirkwood: lsxl: fix serial line
Marek Behún <[email protected]>
ARM: dts: turris-omnia: Fix mpp26 pin name and comment
Liang He <[email protected]>
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
Liang He <[email protected]>
soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
Liang He <[email protected]>
memory: of: Fix refcount leak bug in of_get_ddr_timings()
Zhang Qilong <[email protected]>
ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
Zhang Qilong <[email protected]>
ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
Zhang Qilong <[email protected]>
ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
Christophe JAILLET <[email protected]>
mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
Andreas Pape <[email protected]>
ALSA: dmaengine: increment buffer pointer atomically
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
Liang He <[email protected]>
ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
Christophe JAILLET <[email protected]>
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
Zheyu Ma <[email protected]>
drm/bridge: megachips: Fix a null pointer dereference bug
Hans de Goede <[email protected]>
platform/x86: msi-laptop: Fix resource cleanup
Hans de Goede <[email protected]>
platform/x86: msi-laptop: Fix old-ec check for backlight registering
Rustam Subkhankulov <[email protected]>
platform/chrome: fix double-free in chromeos_laptop_prepare()
Maxime Ripard <[email protected]>
drm/mipi-dsi: Detach devices when removing the host
Alvin Šipraga <[email protected]>
drm: bridge: adv7511: fix CEC power down control register offset
Russell King (Oracle) <[email protected]>
net: mvpp2: fix mvpp2 debugfs leak
Eric Dumazet <[email protected]>
once: add DO_ONCE_SLOW() for sleepable contexts
Jianglei Nie <[email protected]>
bnx2x: fix potential memory leak in bnx2x_tpa_stop()
Tetsuo Handa <[email protected]>
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
Neal Cardwell <[email protected]>
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
Xin Long <[email protected]>
sctp: handle the error returned from sctp_auth_asoc_init_active_key
Duoming Zhou <[email protected]>
mISDN: fix use-after-free bugs in l1oip timer handlers
Junichi Uekawa <[email protected]>
vhost/vsock: Use kvmalloc/kvfree for larger packets.
Vincent Whitchurch <[email protected]>
spi: s3c64xx: Fix large transfers with DMA
Phil Sutter <[email protected]>
netfilter: nft_fib: Fix for rpath check with VRF devices
Zhang Qilong <[email protected]>
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
Lee Jones <[email protected]>
bpf: Ensure correct locking around vulnerable function find_vpid()
Zheng Yongjun <[email protected]>
net: fs_enet: Fix wrong check in do_pd_setup
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
Lorenz Bauer <[email protected]>
bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Fix skb misuse in TX queue selection
Xu Qiang <[email protected]>
spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
Xu Qiang <[email protected]>
spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
Dan Carpenter <[email protected]>
wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
Christophe JAILLET <[email protected]>
spi: mt7621: Fix an error message in mt7621_spi_probe()
Lam Thai <[email protected]>
bpftool: Fix a wrong type cast in btf_dumper_int
Hari Chandrakanthan <[email protected]>
wifi: mac80211: allow bw change during channel switch in mesh
Wen Gong <[email protected]>
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
Kees Cook <[email protected]>
sh: machvec: Use char[] for section boundaries
Greg Kroah-Hartman <[email protected]>
selinux: use "grep -E" instead of "egrep"
Sean Christopherson <[email protected]>
KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
Michal Luczaj <[email protected]>
KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
Steven Rostedt (Google) <[email protected]>
ring-buffer: Fix race between reset page and reading page
Steven Rostedt (Google) <[email protected]>
ring-buffer: Check pending waiters when doing wake ups as well
Steven Rostedt (Google) <[email protected]>
ring-buffer: Allow splice to read previous partially read pages
Zheng Yejian <[email protected]>
ftrace: Properly unset FTRACE_HASH_FL_MOD
Rik van Riel <[email protected]>
livepatch: fix race between fork and KLP transition
Jinke Han <[email protected]>
ext4: place buffer head allocation before handle start
Lalith Rajendran <[email protected]>
ext4: make ext4_lazyinit_thread freezable
Baokun Li <[email protected]>
ext4: fix null-ptr-deref in ext4_write_info
Jan Kara <[email protected]>
ext4: avoid crash when inline data creation follows DIO write
Ryusuke Konishi <[email protected]>
nilfs2: fix use-after-free bug of struct nilfs_root
Aurelien Jarno <[email protected]>
riscv: fix build with binutils 2.38
Filipe Manana <[email protected]>
btrfs: fix race between quota enable and quota rescan ioctl
Hyunwoo Kim <[email protected]>
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
Maciej W. Rozycki <[email protected]>
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
Huacai Chen <[email protected]>
UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
Andrew Bresticker <[email protected]>
riscv: Allow PROT_WRITE-only mmap()
Helge Deller <[email protected]>
parisc: fbdev/stifb: Align graphics memory size to 4MB
Sasha Levin <[email protected]>
Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
Linus Walleij <[email protected]>
regulator: qcom_rpm: Fix circular deferral regression
Zhihao Cheng <[email protected]>
quota: Check next/prev free block number after reading from quota file
Andri Yngvason <[email protected]>
HID: multitouch: Add memory barriers
Alexander Aring <[email protected]>
fs: dlm: handle -EBUSY first in lock arg validation
Alexander Aring <[email protected]>
fs: dlm: fix race between test_bit() and queue_work()
Anssi Hannula <[email protected]>
can: kvaser_usb_leaf: Fix CAN state after restart
Anssi Hannula <[email protected]>
can: kvaser_usb_leaf: Fix TX queue out of sync after restart
Anssi Hannula <[email protected]>
can: kvaser_usb_leaf: Fix overread with an invalid command
Anssi Hannula <[email protected]>
can: kvaser_usb: Fix use of uninitialized completion
Jean-Francois Le Fillatre <[email protected]>
usb: add quirks for Lenovo OneLink+ Dock
Michael Hennerich <[email protected]>
iio: dac: ad5593r: Fix i2c read protocol requirements
Tudor Ambarus <[email protected]>
mtd: rawnand: atmel: Unmap streaming DMA mappings
Callum Osmotherly <[email protected]>
ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix NULL dererence at error path
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential memory leaks
Takashi Iwai <[email protected]>
ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
Takashi Iwai <[email protected]>
ALSA: oss: Fix potential deadlock at unregistration
Cameron Gutman <[email protected]>
Input: xpad - fix wireless 360 controller breaking after suspend
Pavel Rojtberg <[email protected]>
Input: xpad - add supported devices as contributed on github
Johannes Berg <[email protected]>
wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
Jason A. Donenfeld <[email protected]>
random: use expired timer rather than wq for mixing fast pool
Jason A. Donenfeld <[email protected]>
random: avoid reading two cache lines on irq randomness
Jason A. Donenfeld <[email protected]>
random: restore O_NONBLOCK support
Frank Wunderlich <[email protected]>
USB: serial: qcserial: add new usb-id for Dell branded EM7455
Linus Torvalds <[email protected]>
scsi: stex: Properly zero out the passthrough command structure
Takashi Iwai <[email protected]>
ALSA: hda: Fix position reporting on Poulsbo
Jason A. Donenfeld <[email protected]>
random: clamp credited irq bits to maximum mixed
Hu Weiwen <[email protected]>
ceph: don't truncate file in atomic_open
Ryusuke Konishi <[email protected]>
nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
Ryusuke Konishi <[email protected]>
nilfs2: fix leak of nilfs_root in case of writer thread creation failure
Ryusuke Konishi <[email protected]>
nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
Krzysztof Kozlowski <[email protected]>
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
Brian Norris <[email protected]>
mmc: core: Terminate infinite loop in SD-UHS voltage switch
ChanWoo Lee <[email protected]>
mmc: core: Replace with already defined values for readability
Johan Hovold <[email protected]>
USB: serial: ftdi_sio: fix 300 bps rate for SIO
Tadeusz Struk <[email protected]>
usb: mon: make mmapped memory read only
Lukas Straub <[email protected]>
um: Cleanup compiler warning in arch/x86/um/tls_32.c
Lukas Straub <[email protected]>
um: Cleanup syscall_handler_t cast in syscalls_32.h
Haimin Zhang <[email protected]>
net/ieee802154: fix uninit value bug in dgram_sendmsg
Letu Ren <[email protected]>
scsi: qedf: Fix a UAF bug in __qedf_probe()
Sergei Antonov <[email protected]>
ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
Swati Agarwal <[email protected]>
dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
Swati Agarwal <[email protected]>
dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
Cristian Marussi <[email protected]>
firmware: arm_scmi: Add SCMI PM driver remove routine
Dongliang Mu <[email protected]>
fs: fix UAF/GPF bug in nilfs_mdt_destroy
Russell King <[email protected]>
ARM: fix function graph tracer and unwinder dependencies
Shuah Khan <[email protected]>
docs: update mediator information in CoC docs
Sami Tolvanen <[email protected]>
Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-iio | 2 +- .../devicetree/bindings/dma/moxa,moxart-dma.txt | 4 +- .../process/code-of-conduct-interpretation.rst | 2 +- Makefile | 4 +- arch/arm/Kconfig | 3 +- arch/arm/Kconfig.debug | 6 +- arch/arm/boot/dts/armada-385-turris-omnia.dts | 4 +- arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- arch/arm/boot/dts/exynos4412-origen.dts | 2 +- arch/arm/boot/dts/imx6dl.dtsi | 3 + arch/arm/boot/dts/imx6q.dtsi | 3 + arch/arm/boot/dts/imx6qp.dtsi | 6 ++ arch/arm/boot/dts/imx6sl.dtsi | 3 + arch/arm/boot/dts/imx6sll.dtsi | 3 + arch/arm/boot/dts/imx6sx.dtsi | 6 ++ arch/arm/boot/dts/imx7d-sdb.dts | 7 +- arch/arm/boot/dts/kirkwood-lsxl.dtsi | 16 ++--- arch/arm/boot/dts/moxart-uc7112lx.dts | 2 +- arch/arm/boot/dts/moxart.dtsi | 4 +- arch/mips/bcm47xx/prom.c | 4 +- arch/powerpc/Makefile | 2 +- arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi | 51 ++++++++++++++ arch/powerpc/boot/dts/fsl/mpc8540ads.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8541cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8555cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8560ads.dts | 2 +- arch/powerpc/kernel/pci_dn.c | 1 + arch/powerpc/math-emu/math_efp.c | 1 + arch/powerpc/platforms/powernv/opal.c | 1 + arch/powerpc/sysdev/fsl_msi.c | 2 + arch/riscv/Makefile | 11 ++- arch/riscv/kernel/sys_riscv.c | 3 - arch/sh/include/asm/sections.h | 2 +- arch/sh/kernel/machvec.c | 10 +-- arch/um/kernel/um_arch.c | 2 +- arch/x86/include/asm/hyperv-tlfs.h | 4 +- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/vmx.c | 19 +++--- arch/x86/um/shared/sysdep/syscalls_32.h | 5 +- arch/x86/um/tls_32.c | 6 -- arch/x86/xen/enlighten_pv.c | 3 +- drivers/acpi/acpi_video.c | 16 +++++ drivers/ata/libahci_platform.c | 14 +++- drivers/block/nbd.c | 6 +- drivers/char/mem.c | 4 +- drivers/char/random.c | 25 ++++--- drivers/clk/bcm/clk-bcm2835.c | 8 +-- drivers/clk/berlin/bg2.c | 5 +- drivers/clk/berlin/bg2q.c | 6 +- drivers/clk/clk-oxnas.c | 6 +- drivers/clk/tegra/clk-tegra114.c | 1 + drivers/clk/tegra/clk-tegra20.c | 1 + drivers/clk/tegra/clk-tegra210.c | 1 + drivers/clk/ti/clk-dra7-atl.c | 9 ++- drivers/crypto/cavium/cpt/cptpf_main.c | 6 +- drivers/dma/ioat/dma.c | 6 +- drivers/dma/xilinx/xilinx_dma.c | 8 ++- drivers/firmware/arm_scmi/scmi_pm_domain.c | 20 ++++++ drivers/firmware/efi/libstub/fdt.c | 8 --- drivers/firmware/google/gsmi.c | 9 +++ drivers/fsi/fsi-core.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 7 +- drivers/gpu/drm/amd/display/dc/calcs/bw_fixed.c | 6 +- drivers/gpu/drm/bridge/adv7511/adv7511.h | 5 +- drivers/gpu/drm/bridge/adv7511/adv7511_cec.c | 4 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 4 +- drivers/gpu/drm/drm_ioctl.c | 8 ++- drivers/gpu/drm/drm_mipi_dsi.c | 1 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++ drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 12 ++-- drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c | 29 ++++---- drivers/gpu/drm/vc4/vc4_vec.c | 4 +- drivers/hid/hid-multitouch.c | 8 +-- drivers/hid/hid-roccat.c | 4 ++ drivers/hsi/controllers/omap_ssi_core.c | 1 + drivers/hsi/controllers/omap_ssi_port.c | 8 +-- drivers/iio/adc/at91-sama5d2_adc.c | 10 ++- drivers/iio/dac/ad5593r.c | 46 +++++++------ drivers/iio/inkern.c | 6 +- drivers/infiniband/sw/rxe/rxe_qp.c | 10 ++- drivers/input/joystick/xpad.c | 20 +++++- drivers/iommu/omap-iommu-debug.c | 6 +- drivers/isdn/mISDN/l1oip.h | 1 + drivers/isdn/mISDN/l1oip_core.c | 13 ++-- drivers/mailbox/bcm-flexrm-mailbox.c | 8 +-- drivers/md/raid0.c | 4 +- drivers/md/raid5.c | 14 +++- drivers/media/pci/cx88/cx88-vbi.c | 9 ++- drivers/media/pci/cx88/cx88-video.c | 43 ++++++------ drivers/media/platform/exynos4-is/fimc-is.c | 1 + drivers/media/platform/xilinx/xilinx-vipp.c | 9 +-- drivers/memory/of_memory.c | 1 + drivers/mfd/fsl-imx25-tsadc.c | 32 ++++++--- drivers/mfd/intel_soc_pmic_core.c | 1 + drivers/mfd/lp8788-irq.c | 3 + drivers/mfd/lp8788.c | 12 +++- drivers/mfd/sm501.c | 7 +- drivers/mmc/core/sd.c | 3 +- drivers/mmc/host/au1xmmc.c | 3 +- drivers/mmc/host/wmt-sdmmc.c | 5 +- drivers/mtd/devices/docg3.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 3 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 79 ++++++++++++++++++++++ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + drivers/net/ethernet/freescale/fs_enet/mac-fec.c | 2 +- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 ++- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 +++- drivers/net/usb/r8152.c | 4 +- drivers/net/wireless/ath/ath10k/mac.c | 54 ++++++++------- drivers/net/wireless/ath/ath9k/htc_hst.c | 43 ++++++++---- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 3 +- .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 12 ++-- drivers/net/wireless/mac80211_hwsim.c | 2 + drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 31 ++++++++- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 21 +++--- drivers/nvme/host/core.c | 3 +- drivers/pci/setup-res.c | 11 +++ drivers/phy/qualcomm/phy-qcom-usb-hsic.c | 6 +- drivers/platform/chrome/chromeos_laptop.c | 24 ++++--- drivers/platform/x86/msi-laptop.c | 14 ++-- drivers/power/supply/adp5061.c | 6 +- drivers/powercap/intel_rapl.c | 3 + drivers/regulator/qcom_rpm-regulator.c | 24 +++---- drivers/rpmsg/qcom_glink_native.c | 2 +- drivers/rpmsg/qcom_smd.c | 4 +- drivers/scsi/3w-9xxx.c | 2 +- drivers/scsi/qedf/qedf_main.c | 5 -- drivers/scsi/stex.c | 17 ++--- drivers/soc/qcom/smem_state.c | 3 +- drivers/soc/qcom/smsm.c | 20 ++++-- drivers/spi/spi-omap-100k.c | 1 + drivers/spi/spi-qup.c | 21 ++++-- drivers/spi/spi-s3c64xx.c | 9 +++ drivers/spmi/spmi-pmic-arb.c | 13 ++-- drivers/staging/mt7621-spi/spi-mt7621.c | 8 +-- drivers/staging/vt6655/device_main.c | 8 +-- drivers/thermal/intel_powerclamp.c | 4 +- drivers/tty/serial/8250/8250_port.c | 7 +- drivers/tty/serial/jsm/jsm_driver.c | 3 +- drivers/tty/serial/xilinx_uartps.c | 2 + drivers/usb/core/quirks.c | 4 ++ drivers/usb/gadget/function/f_printer.c | 12 ++-- drivers/usb/host/xhci-mem.c | 7 +- drivers/usb/host/xhci.c | 3 +- drivers/usb/misc/idmouse.c | 8 +-- drivers/usb/mon/mon_bin.c | 5 ++ drivers/usb/musb/musb_gadget.c | 3 + drivers/usb/serial/ftdi_sio.c | 3 +- drivers/usb/serial/qcserial.c | 1 + drivers/usb/storage/unusual_devs.h | 6 -- drivers/vhost/vsock.c | 2 +- drivers/video/fbdev/smscufx.c | 14 +++- drivers/video/fbdev/stifb.c | 2 +- fs/btrfs/qgroup.c | 15 ++++ fs/ceph/file.c | 10 ++- fs/dlm/ast.c | 6 +- fs/dlm/lock.c | 16 ++--- fs/ext4/file.c | 6 ++ fs/ext4/inode.c | 7 ++ fs/ext4/resize.c | 2 +- fs/ext4/super.c | 3 +- fs/f2fs/extent_cache.c | 3 +- fs/inode.c | 7 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nilfs2/inode.c | 20 +++++- fs/nilfs2/segment.c | 21 +++--- fs/quota/quota_tree.c | 38 +++++++++++ fs/splice.c | 10 +-- include/linux/ata.h | 39 ++++++----- include/linux/dynamic_debug.h | 2 +- include/linux/iova.h | 2 +- include/linux/once.h | 28 ++++++++ include/linux/tcp.h | 2 +- include/net/ieee802154_netdev.h | 43 ++++++++++++ include/net/sock.h | 2 +- include/net/tcp.h | 5 +- include/scsi/scsi_cmnd.h | 2 +- kernel/bpf/btf.c | 2 +- kernel/bpf/syscall.c | 2 + kernel/gcov/gcc_4_7.c | 18 ++++- kernel/livepatch/transition.c | 18 ++++- kernel/trace/ftrace.c | 8 ++- kernel/trace/ring_buffer.c | 46 ++++++++++++- lib/dynamic_debug.c | 11 +-- lib/once.c | 30 ++++++++ net/bluetooth/hci_sysfs.c | 3 + net/bluetooth/l2cap_core.c | 17 +++-- net/can/bcm.c | 7 +- net/core/stream.c | 3 +- net/ieee802154/socket.c | 46 +++++++------ net/ipv4/af_inet.c | 2 +- net/ipv4/inet_hashtables.c | 4 +- net/ipv4/netfilter/nft_fib_ipv4.c | 3 + net/ipv4/tcp.c | 19 ++++-- net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 11 +-- net/ipv4/tcp_output.c | 19 ++++-- net/ipv4/udp.c | 6 +- net/ipv6/netfilter/nft_fib_ipv6.c | 6 +- net/ipv6/tcp_ipv6.c | 11 +-- net/ipv6/udp.c | 4 +- net/mac80211/cfg.c | 3 - net/openvswitch/datapath.c | 18 +++-- net/rds/tcp.c | 2 +- net/sctp/auth.c | 18 +++-- net/vmw_vsock/virtio_transport_common.c | 2 +- net/xfrm/xfrm_ipcomp.c | 1 + scripts/Makefile.extrawarn | 1 + scripts/selinux/install_policy.sh | 2 +- sound/core/pcm_dmaengine.c | 8 ++- sound/core/rawmidi.c | 2 - sound/core/sound_oss.c | 13 ++-- sound/pci/hda/hda_intel.c | 3 +- sound/pci/hda/patch_realtek.c | 1 - sound/soc/codecs/wm5102.c | 6 +- sound/soc/codecs/wm5110.c | 6 +- sound/soc/codecs/wm8997.c | 6 +- sound/soc/fsl/eukrea-tlv320.c | 8 ++- sound/usb/endpoint.c | 6 +- tools/bpf/bpftool/btf_dumper.c | 2 +- tools/perf/util/intel-pt.c | 9 ++- 225 files changed, 1444 insertions(+), 598 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/229 Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
From: Sami Tolvanen <[email protected]>
commit 2120635108b35ecad9c59c8b44f6cbdf4f98214e upstream.
We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed.
--- scripts/Makefile.extrawarn | 1 + 1 file changed, 1 insertion(+)
scripts/Makefile.extrawarn +1 -0
@@ -74,5 +74,6 @@ KBUILD_CFLAGS += $(call cc-disable-warni KBUILD_CFLAGS += $(call cc-disable-warning, uninitialized) KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access) +KBUILD_CFLAGS += $(call cc-disable-warning, cast-function-type-strict) endif endif
Greg Kroah-Hartman
maintainerPATCH 2/229 docs: update mediator information in CoC docs
In reply to Greg Kroah-HartmanFrom: Shuah Khan <[email protected]>
commit 8bfdfa0d6b929ede7b6189e0e546ceb6a124d05d upstream.
Update mediator information in the CoC interpretation document.
--- Documentation/process/code-of-conduct-interpretation.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/process/code-of-conduct-interpretation.rst +1 -1
@@ -51,7 +51,7 @@ the Technical Advisory Board (TAB) or ot uncertain how to handle situations that come up. It will not be considered a violation report unless you want it to be. If you are uncertain about approaching the TAB or any other maintainers, please -reach out to our conflict mediator, Mishi Choudhary <[email protected]>. +reach out to our conflict mediator, Joanna Lee <[email protected]>. In the end, "be kind to each other" is really what the end goal is for everybody. We know everyone is human and we all fail at times, but the
Greg Kroah-Hartman
maintainerPATCH 3/229 ARM: fix function graph tracer and unwinder dependencies
In reply to Greg Kroah-HartmanFrom: Russell King <[email protected]>
commit 503621628b32782a07b2318e4112bd4372aa3401 upstream.
Naresh Kamboju recently reported that the function-graph tracer crashes on ARM. The function-graph tracer assumes that the kernel is built with frame pointers.
We explicitly disabled the function-graph tracer when building Thumb2, since the Thumb2 ABI doesn't have frame pointers.
We recently changed the way the unwinder method was selected, which seems to have made it more likely that we can end up with the function- graph tracer enabled but without the kernel built with frame pointers.
Fix up the function graph tracer dependencies so the option is not available when we have no possibility of having frame pointers, and adjust the dependencies on the unwinder option to hide the non-frame pointer unwinder options if the function-graph tracer is enabled.
--- arch/arm/Kconfig | 2 +- arch/arm/Kconfig.debug | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm/Kconfig +1 -1
@@ -68,7 +68,7 @@ config ARM select HAVE_EFFICIENT_UNALIGNED_ACCESS if (CPU_V6 || CPU_V6K || CPU_V7) && MMU select HAVE_EXIT_THREAD select HAVE_FTRACE_MCOUNT_RECORD if (!XIP_KERNEL) - select HAVE_FUNCTION_GRAPH_TRACER if (!THUMB2_KERNEL) + select HAVE_FUNCTION_GRAPH_TRACER if (!THUMB2_KERNEL && !CC_IS_CLANG) select HAVE_FUNCTION_TRACER if (!XIP_KERNEL) select HAVE_FUTEX_CMPXCHG if FUTEX select HAVE_GCC_PLUGINS
arch/arm/Kconfig.debug +3 -3
@@ -47,8 +47,8 @@ config DEBUG_WX choice prompt "Choose kernel unwinder" - default UNWINDER_ARM if AEABI && !FUNCTION_GRAPH_TRACER - default UNWINDER_FRAME_POINTER if !AEABI || FUNCTION_GRAPH_TRACER + default UNWINDER_ARM if AEABI + default UNWINDER_FRAME_POINTER if !AEABI help This determines which method will be used for unwinding kernel stack traces for panics, oopses, bugs, warnings, perf, /proc/<pid>/stack,
@@ -65,7 +65,7 @@ config UNWINDER_FRAME_POINTER config UNWINDER_ARM bool "ARM EABI stack unwinder" - depends on AEABI + depends on AEABI && !FUNCTION_GRAPH_TRACER select ARM_UNWIND help This option enables stack unwinding support in the kernel
Greg Kroah-Hartman
maintainerPATCH 4/229 fs: fix UAF/GPF bug in nilfs_mdt_destroy
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
commit 2e488f13755ffbb60f307e991b27024716a33b29 upstream.
In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private
and leads to crashes(e.g., UAF/GPF).
Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)
--- fs/inode.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
fs/inode.c +3 -4
@@ -166,8 +166,6 @@ int inode_init_always(struct super_block inode->i_wb_frn_history =0 ;#endif -if (security_inode_alloc (inode)) - goto out;spin_lock_init (&inode->i_lock);lockdep_set_class (&inode->i_lock, &sb->s_type->i_lock_key);
@@ -195,11 +193,12 @@ int inode_init_always(struct super_block inode->i_fsnotify_mask =0 ;#endif inode->i_flctx =NULL ; + +if (unlikely (security_inode_alloc (inode))) +return -ENOMEM ;this_cpu_inc (nr_inodes);return 0 ; -out: -return -ENOMEM ; }EXPORT_SYMBOL (inode_init_always);
Greg Kroah-Hartman
maintainerPATCH 5/229 firmware: arm_scmi: Add SCMI PM driver remove routine
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit dea796fcab0a219830831c070b8dc367d7e0f708 ]
Currently, when removing the SCMI PM driver not all the resources registered with genpd subsystem are properly de-registered.
As a side effect of this after a driver unload/load cycle you get a splat with a few warnings like this:
| debugfs: Directory 'BIG_CPU0' with parent 'pm_genpd' already present! | debugfs: Directory 'BIG_CPU1' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU0' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU1' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU2' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU3' with parent 'pm_genpd' already present! | debugfs: Directory 'BIG_SSTOP' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_SSTOP' with parent 'pm_genpd' already present! | debugfs: Directory 'DBGSYS' with parent 'pm_genpd' already present! | debugfs: Directory 'GPUTOP' with parent 'pm_genpd' already present!
Add a proper scmi_pm_domain_remove callback to the driver in order to take care of all the needed cleanups not handled by devres framework.
--- drivers/firmware/arm_scmi/scmi_pm_domain.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/firmware/arm_scmi/scmi_pm_domain.c +20 -0
@@ -106,9 +106,28 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) scmi_pd_data->domains = domains; scmi_pd_data->num_domains = num_domains; +dev_set_drvdata (dev, scmi_pd_data); +return of_genpd_add_provider_onecell (np, scmi_pd_data); } +static void scmi_pm_domain_remove (struct scmi_device *sdev) +{ +int i; +struct genpd_onecell_data *scmi_pd_data; +struct device *dev = &sdev->dev; +struct device_node *np = dev->of_node; + +of_genpd_del_provider (np); + + scmi_pd_data =dev_get_drvdata (dev); +for (i =0 ; i < scmi_pd_data->num_domains; i++) { +if (!scmi_pd_data->domains[i]) +continue ; +pm_genpd_remove (scmi_pd_data->domains[i]); + } +} +static const struct scmi_device_id scmi_id_table[] = { {SCMI_PROTOCOL_POWER }, { },
@@ -118,6 +137,7 @@ MODULE_DEVICE_TABLE(scmi, scmi_id_table);static struct scmi_driver scmi_power_domain_driver = { .name ="scmi-power-domain" , .probe = scmi_pm_domain_probe, + .remove = scmi_pm_domain_remove, .id_table = scmi_id_table, };module_scmi_driver (scmi_power_domain_driver);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 6/229 dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
In reply to Greg Kroah-HartmanFrom: Swati Agarwal <[email protected]>
[ Upstream commit 462bce790e6a7e68620a4ce260cc38f7ed0255d5 ]
Free the allocated resources for missing xlnx,num-fstores property.
--- drivers/dma/xilinx/xilinx_dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/xilinx/xilinx_dma.c +1 -1
@@ -2654,7 +2654,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)if (err <0 ) {dev_err (xdev->dev,"missing xlnx,num-fstores property\n" ); -return err; + goto disable_clks; } err = of_property_read_u32(node, "xlnx,flush-fsync",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 7/229 dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
In reply to Greg Kroah-HartmanFrom: Swati Agarwal <[email protected]>
[ Upstream commit 8f2b6bc79c32f0fa60df000ae387a790ec80eae9 ]
The driver does not handle the failure case while calling dma_set_mask_and_coherent API.
In case of failure, capture the return value of API and then report an error.
Addresses-coverity: Unchecked return value (CHECKED_RETURN)
--- drivers/dma/xilinx/xilinx_dma.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/dma/xilinx/xilinx_dma.c +5 -1
@@ -2674,7 +2674,11 @@ static int xilinx_dma_probe(struct platform_device *pdev) xdev->ext_addr = false;/* Set the dma mask bits */ -dma_set_mask_and_coherent (xdev->dev,DMA_BIT_MASK (addr_width)); + err =dma_set_mask_and_coherent (xdev->dev,DMA_BIT_MASK (addr_width)); +if (err <0 ) { +dev_err (xdev->dev,"DMA mask error %d\n" , err); + goto disable_clks; + }/* Initialize the DMA engine */ xdev->common.dev = &pdev->dev;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 8/229 ARM: dts: fix Moxa SDIO compatible, remove sdhci misnomer
In reply to Greg Kroah-HartmanFrom: Sergei Antonov <[email protected]>
[ Upstream commit 02181e68275d28cab3c3f755852770367f1bc229 ]
Driver moxart-mmc.c has .compatible = "moxa,moxart-mmc".
But moxart .dts/.dtsi and the documentation file moxa,moxart-dma.txt contain compatible = "moxa,moxart-sdhci".
Change moxart .dts/.dtsi files and moxa,moxart-dma.txt to match the driver.
Replace 'sdhci' with 'mmc' in names too, since SDHCI is a different controller from FTSDC010.
--- Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt | 4 ++-- arch/arm/boot/dts/moxart-uc7112lx.dts | 2 +- arch/arm/boot/dts/moxart.dtsi | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt +2 -2
@@ -34,8 +34,8 @@ Example: Use specific request line passing from dma For example, MMC request line is 5 - sdhci: sdhci@98e00000 { - compatible = "moxa,moxart-sdhci"; + mmc: mmc@98e00000 { + compatible = "moxa,moxart-mmc"; reg = <0x98e00000 0x5C>; interrupts = <5 0>; clocks = <&clk_apb>;
arch/arm/boot/dts/moxart-uc7112lx.dts +1 -1
@@ -80,7 +80,7 @@ &clk_pll { clocks = <&ref12>; }; -&sdhci { +&mmc { status = "okay"; };
arch/arm/boot/dts/moxart.dtsi +2 -2
@@ -93,8 +93,8 @@ watchdog: watchdog@98500000 { clock-names = "PCLK"; }; - sdhci: sdhci@98e00000 { - compatible = "moxa,moxart-sdhci"; + mmc: mmc@98e00000 { + compatible = "moxa,moxart-mmc"; reg = <0x98e00000 0x5C>; interrupts = <5 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clk_apb>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 9/229 scsi: qedf: Fix a UAF bug in __qedf_probe()
In reply to Greg Kroah-HartmanFrom: Letu Ren <[email protected]>
[ Upstream commit fbfe96869b782364caebae0445763969ddb6ea67 ]
In __qedf_probe(), if qedf->cdev is NULL which means qed_ops->common->probe() failed, then the program will goto label err1, and scsi_host_put() will free lport->host pointer. Because the memory qedf points to is allocated by libfc_host_alloc(), it will be freed by scsi_host_put(). However, the if statement below label err0 only checks whether qedf is NULL but doesn't check whether the memory has been freed. So a UAF bug can occur.
There are two ways to reach the statements below err0. The first one is described as before, "qedf" should be set to NULL. The second one is goto "err0" directly. In the latter scenario qedf hasn't been changed and it has the initial value NULL. As a result the if statement is not reachable in any situation.
The KASAN logs are as follows:
[ 2.312969] BUG: KASAN: use-after-free in __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] [ 2.312969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 2.312969] Call Trace: [ 2.312969] dump_stack_lvl+0x59/0x7b [ 2.312969] print_address_description+0x7c/0x3b0 [ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] __kasan_report+0x160/0x1c0 [ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] kasan_report+0x4b/0x70 [ 2.312969] ? kobject_put+0x25d/0x290 [ 2.312969] kasan_check_range+0x2ca/0x310 [ 2.312969] __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] ? selinux_kernfs_init_security+0xdc/0x5f0 [ 2.312969] ? trace_rpm_return_int_rcuidle+0x18/0x120 [ 2.312969] ? rpm_resume+0xa5c/0x16e0 [ 2.312969] ? qedf_get_generic_tlv_data+0x160/0x160 [ 2.312969] local_pci_probe+0x13c/0x1f0 [ 2.312969] pci_device_probe+0x37e/0x6c0
--- drivers/scsi/qedf/qedf_main.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/scsi/qedf/qedf_main.c +0 -5
@@ -3345,11 +3345,6 @@ static int __qedf_probe(struct pci_dev *pdev, int mode) err1:scsi_host_put (lport->host); err0: -if (qedf) { -QEDF_INFO (&qedf->dbg_ctx,QEDF_LOG_DISC ,"Probe done.\n" ); - -clear_bit (QEDF_PROBING , &qedf->flags); - }return rc; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 10/229 net/ieee802154: fix uninit value bug in dgram_sendmsg
In reply to Greg Kroah-HartmanFrom: Haimin Zhang <[email protected]>
[ Upstream commit 94160108a70c8af17fa1484a37e05181c0e094af ]
There is uninit value bug in dgram_sendmsg function in net/ieee802154/socket.c when the length of valid data pointed by the msg->msg_name isn't verified.
We introducing a helper function ieee802154_sockaddr_check_size to check namelen. First we check there is addr_type in ieee802154_addr_sa. Then, we check namelen according to addr_type.
Also fixed in raw_bind, dgram_bind, dgram_connect.
--- include/net/ieee802154_netdev.h | 37 +++++++++++++++++++++++++++++ net/ieee802154/socket.c | 42 ++++++++++++++++++--------------- 2 files changed, 60 insertions(+), 19 deletions(-)
include/net/ieee802154_netdev.h +37 -0
@@ -23,6 +23,22 @@#ifndef IEEE802154_NETDEVICE_H #define IEEE802154_NETDEVICE_H +#define IEEE802154_REQUIRED_SIZE (struct_type, member) \ + (offsetof(typeof(struct_type), member) + \ + sizeof(((typeof(struct_type) *)(NULL))->member)) + +#define IEEE802154_ADDR_OFFSET \ + offsetof(typeof(struct sockaddr_ieee802154), addr) + +#define IEEE802154_MIN_NAMELEN (IEEE802154_ADDR_OFFSET + \ + IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, addr_type)) + +#define IEEE802154_NAMELEN_SHORT (IEEE802154_ADDR_OFFSET + \ + IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, short_addr)) + +#define IEEE802154_NAMELEN_LONG (IEEE802154_ADDR_OFFSET + \ + IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, hwaddr)) +#include <net/af_ieee802154.h> #include <linux/netdevice.h> #include <linux/skbuff.h>
@@ -173,6 +189,27 @@ static inline void ieee802154_devaddr_to_raw(void *raw, __le64 addr)memcpy (raw, &temp,IEEE802154_ADDR_LEN ); } +static inline int +ieee802154_sockaddr_check_size (struct sockaddr_ieee802154 *daddr,int len) +{ +struct ieee802154_addr_sa *sa; + + sa = &daddr->addr; +if (len <IEEE802154_MIN_NAMELEN ) +return -EINVAL ; +switch (sa->addr_type) { +case IEEE802154_ADDR_SHORT : +if (len <IEEE802154_NAMELEN_SHORT ) +return -EINVAL ; +break ; +case IEEE802154_ADDR_LONG : +if (len <IEEE802154_NAMELEN_LONG ) +return -EINVAL ; +break ; + } +return 0 ; +} +static inline void ieee802154_addr_from_sa (struct ieee802154_addr *a,const struct ieee802154_addr_sa *sa) {
net/ieee802154/socket.c +23 -19
78 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 11/229 um: Cleanup syscall_handler_t cast in syscalls_32.h
In reply to Greg Kroah-HartmanFrom: Lukas Straub <[email protected]>
[ Upstream commit 61670b4d270c71219def1fbc9441debc2ac2e6e9 ]
Like in f4f03f299a56ce4d73c5431e0327b3b6cb55ebb9 "um: Cleanup syscall_handler_t definition/cast, fix warning", remove the cast to to fix the compiler warning.
--- arch/x86/um/shared/sysdep/syscalls_32.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/um/shared/sysdep/syscalls_32.h +2 -3
@@ -6,10 +6,9 @@#include <asm/unistd.h> #include <sysdep/ptrace.h> -typedef long syscall_handler_t (struct pt_regs ); +typedef long syscall_handler_t (struct syscall_args );extern syscall_handler_t *sys_call_table[];#define EXECUTE_SYSCALL (syscall, regs) \ - ((long (*)(struct syscall_args)) \ - (*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs)) + ((*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 12/229 um: Cleanup compiler warning in arch/x86/um/tls_32.c
In reply to Greg Kroah-HartmanFrom: Lukas Straub <[email protected]>
[ Upstream commit d27fff3499671dc23a08efd01cdb8b3764a391c4 ]
arch.tls_array is statically allocated so checking for NULL doesn't make sense. This causes the compiler warning below.
Remove the checks to silence these warnings.
../arch/x86/um/tls_32.c: In function 'get_free_idx':../arch/x86/um/tls_32.c:68:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress]
68 | if (!t->arch.tls_array)
| ^
In file included from ../arch/x86/um/asm/processor.h:10,
from ../include/linux/rcupdate.h:30,
from ../include/linux/rculist.h:11,
from ../include/linux/pid.h:5,
from ../include/linux/sched.h:14,
from ../arch/x86/um/tls_32.c:7:../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here
22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES];
| ^~~~~~~~~../arch/x86/um/tls_32.c: In function 'get_tls_entry':../arch/x86/um/tls_32.c:243:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress]
243 | if (!t->arch.tls_array)
| ^../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here
22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES];
| ^~~~~~~~~
--- arch/x86/um/tls_32.c | 6 ------ 1 file changed, 6 deletions(-)
arch/x86/um/tls_32.c +0 -6
@@ -65,9 +65,6 @@ static int get_free_idx(struct task_struct* task)struct thread_struct *t = &task->thread;int idx; -if (!t->arch.tls_array) -return GDT_ENTRY_TLS_MIN ; -for (idx =0 ; idx <GDT_ENTRY_TLS_ENTRIES ; idx++)if (!t->arch.tls_array[idx].present)return idx +GDT_ENTRY_TLS_MIN ;
@@ -242,9 +239,6 @@ static int get_tls_entry(struct task_struct *task, struct user_desc *info, {struct thread_struct *t = &task->thread; -if (!t->arch.tls_array) - goto clear; -if (idx <GDT_ENTRY_TLS_MIN || idx >GDT_ENTRY_TLS_MAX )return -EINVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 13/229 usb: mon: make mmapped memory read only
In reply to Greg Kroah-HartmanFrom: Tadeusz Struk <[email protected]>
commit a659daf63d16aa883be42f3f34ff84235c302198 upstream.
Syzbot found an issue in usbmon module, where the user space client can corrupt the monitor's internal memory, causing the usbmon module to crash the kernel with segfault, UAF, etc.
The reproducer mmaps the /dev/usbmon memory to user space, and overwrites it with arbitrary data, which causes all kinds of issues.
Return an -EPERM error from mon_bin_mmap() if the flag VM_WRTIE is set. Also clear VM_MAYWRITE to make it impossible to change it to writable later.
--- drivers/usb/mon/mon_bin.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/mon/mon_bin.c +5 -0
@@ -1268,6 +1268,11 @@ static int mon_bin_mmap(struct file *fil {/* don't do anything here: "fault" will set up page table entries */ vma->vm_ops = &mon_bin_vm_ops; + +if (vma->vm_flags &VM_WRITE ) +return -EPERM ; + + vma->vm_flags &= ~VM_MAYWRITE ; vma->vm_flags |=VM_DONTEXPAND |VM_DONTDUMP ; vma->vm_private_data = filp->private_data;mon_bin_vma_open (vma);
Greg Kroah-Hartman
maintainerPATCH 14/229 USB: serial: ftdi_sio: fix 300 bps rate for SIO
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 7bd7ad3c310cd6766f170927381eea0aa6f46c69 upstream.
The 300 bps rate of SIO devices has been mapped to 9600 bps since 2003... Let's fix the regression.
--- drivers/usb/serial/ftdi_sio.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/serial/ftdi_sio.c +1 -2
@@ -1304,8 +1304,7 @@ static u32 get_ftdi_divisor(struct tty_scase 38400 : div_value = ftdi_sio_b38400;break ;case 57600 : div_value = ftdi_sio_b57600;break ;case 115200 : div_value = ftdi_sio_b115200;break ; - }/* baud */ -if (div_value ==0 ) { +default :dev_dbg (dev,"%s - Baudrate (%d) requested is not supported\n" , __func__, baud); div_value = ftdi_sio_b9600;
Greg Kroah-Hartman
maintainerPATCH 15/229 mmc: core: Replace with already defined values for readability
In reply to Greg Kroah-HartmanFrom: ChanWoo Lee <[email protected]>
commit e427266460826bea21b70f9b2bb29decfb2c2620 upstream.
SD_ROCR_S18A is already defined and is used to check the rocr value, so let's replace with already defined values for readability.
--- drivers/mmc/core/sd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/core/sd.c +1 -1
@@ -787,7 +787,7 @@ try_again:* the CCS bit is set as well. We deliberately deviate from the spec in * regards to this, which allows UHS-I to be supported for SDSC cards. */ -if (!mmc_host_is_spi (host) && rocr && (*rocr &0x01000000 )) { +if (!mmc_host_is_spi (host) && rocr && (*rocr &SD_ROCR_S18A )) { err =mmc_set_uhs_voltage (host, pocr);if (err == -EAGAIN ) { retries--;
Greg Kroah-Hartman
maintainerPATCH 16/229 mmc: core: Terminate infinite loop in SD-UHS voltage switch
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
commit e9233917a7e53980664efbc565888163c0a33c3f upstream.
This loop intends to retry a max of 10 times, with some implicit termination based on the SD_{R,}OCR_S18A bit. Unfortunately, the termination condition depends on the value reported by the SD card (*rocr), which may or may not correctly reflect what we asked it to do.
Needless to say, it's not wise to rely on the card doing what we expect; we should at least terminate the loop regardless. So, check both the input and output values, so we ensure we will terminate regardless of the SD card behavior.
Note that SDIO learned a similar retry loop in commit 0797e5f1453b ("mmc: core: Fixup signal voltage switch"), but that used the 'ocr' result, and so the current pre-terminating condition looks like:
rocr & ocr & R4_18V_PRESENT
(i.e., it doesn't have the same bug.)
This addresses a number of crash reports seen on ChromeOS that look like the following:
... // lots of repeated: ...
<4>[13142.846061] mmc1: Skipping voltage switch
<4>[13143.406087] mmc1: Skipping voltage switch
<4>[13143.964724] mmc1: Skipping voltage switch
<4>[13144.526089] mmc1: Skipping voltage switch
<4>[13145.086088] mmc1: Skipping voltage switch
<4>[13145.645941] mmc1: Skipping voltage switch
<3>[13146.153969] INFO: task halt:30352 blocked for more than 122 seconds.
...--- drivers/mmc/core/sd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/core/sd.c +2 -1
@@ -787,7 +787,8 @@ try_again:* the CCS bit is set as well. We deliberately deviate from the spec in * regards to this, which allows UHS-I to be supported for SDSC cards. */ -if (!mmc_host_is_spi (host) && rocr && (*rocr &SD_ROCR_S18A )) { +if (!mmc_host_is_spi (host) && (ocr &SD_OCR_S18R ) && + rocr && (*rocr &SD_ROCR_S18A )) { err =mmc_set_uhs_voltage (host, pocr);if (err == -EAGAIN ) { retries--;
Greg Kroah-Hartman
maintainerPATCH 17/229 rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 766279a8f85df32345dbda03b102ca1ee3d5ddea upstream.
The use of strncpy() is considered deprecated for NUL-terminated strings[1]. Replace strncpy() with strscpy_pad(), to keep existing pad-behavior of strncpy, similarly to commit 08de420a8014 ("rpmsg:
glink: Replace strncpy() with strscpy_pad()"). This fixes W=1 warning:
In function ‘qcom_glink_rx_close’,
inlined from ‘qcom_glink_work’ at ../drivers/rpmsg/qcom_glink_native.c:1638:4:
drivers/rpmsg/qcom_glink_native.c:1549:17: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation]
1549 | strncpy(chinfo.name, channel->name, sizeof(chinfo.name));
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings
--- drivers/rpmsg/qcom_glink_native.c | 2 +- drivers/rpmsg/qcom_smd.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/rpmsg/qcom_glink_native.c +1 -1
@@ -1472,7 +1472,7 @@ static void qcom_glink_rx_close(struct qcancel_work_sync (&channel->intent_work);if (channel->rpdev) { -strncpy (chinfo.name, channel->name,sizeof (chinfo.name)); +strscpy_pad (chinfo.name, channel->name,sizeof (chinfo.name)); chinfo.src =RPMSG_ADDR_ANY ; chinfo.dst =RPMSG_ADDR_ANY ;
drivers/rpmsg/qcom_smd.c +2 -2
@@ -1073,7 +1073,7 @@ static int qcom_smd_create_device(struct/* Assign public information to the rpmsg_device */ rpdev = &qsdev->rpdev; -strncpy (rpdev->id.name, channel->name,RPMSG_NAME_SIZE ); +strscpy_pad (rpdev->id.name, channel->name,RPMSG_NAME_SIZE ); rpdev->src =RPMSG_ADDR_ANY ; rpdev->dst =RPMSG_ADDR_ANY ;
@@ -1304,7 +1304,7 @@ static void qcom_channel_state_worker(stspin_unlock_irqrestore (&edge->channels_lock, flags); -strncpy (chinfo.name, channel->name,sizeof (chinfo.name)); +strscpy_pad (chinfo.name, channel->name,sizeof (chinfo.name)); chinfo.src =RPMSG_ADDR_ANY ; chinfo.dst =RPMSG_ADDR_ANY ;rpmsg_unregister_device (&edge->dev, &chinfo);
Greg Kroah-Hartman
maintainerPATCH 18/229 nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit 21a87d88c2253350e115029f14fe2a10a7e6c856 upstream.
If the i_mode field in inode of metadata files is corrupted on disk, it can cause the initialization of bmap structure, which should have been called from nilfs_read_inode_common(), not to be called. This causes a lockdep warning followed by a NULL pointer dereference at nilfs_bmap_lookup_at_level().
This patch fixes these issues by adding a missing sanitiy check for the i_mode field of metadata file's inode.
--- fs/nilfs2/inode.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nilfs2/inode.c +2 -0
@@ -451,6 +451,8 @@ int nilfs_read_inode_common(struct inode inode->i_atime.tv_nsec =le32_to_cpu (raw_inode->i_mtime_nsec); inode->i_ctime.tv_nsec =le32_to_cpu (raw_inode->i_ctime_nsec); inode->i_mtime.tv_nsec =le32_to_cpu (raw_inode->i_mtime_nsec); +if (nilfs_is_metadata_file_inode (inode) && !S_ISREG (inode->i_mode)) +return -EIO ;/* this inode is for metadata and corrupted */ if (inode->i_nlink ==0 )return -ESTALE ;/* this inode is deleted */
Greg Kroah-Hartman
maintainerPATCH 19/229 nilfs2: fix leak of nilfs_root in case of writer thread creation failure
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit d0d51a97063db4704a5ef6bc978dddab1636a306 upstream.
If nilfs_attach_log_writer() failed to create a log writer thread, it frees a data structure of the log writer without any cleanup. After commit e912a5b66837 ("nilfs2: use root object to get ifile"), this causes a leak of struct nilfs_root, which started to leak an ifile metadata inode and a kobject on that struct.
In addition, if the kernel is booted with panic_on_warn, the above ifile metadata inode leak will cause the following panic when the nilfs2 kernel module is removed:
kmem_cache_destroy nilfs2_inode_cache: Slab cache still has objects when called from nilfs_destroy_cachep+0x16/0x3a [nilfs2]
WARNING: CPU: 8 PID: 1464 at mm/slab_common.c:494 kmem_cache_destroy+0x138/0x140
...
RIP: 0010:kmem_cache_destroy+0x138/0x140
Code: 00 20 00 00 e8 a9 55 d8 ff e9 76 ff ff ff 48 8b 53 60 48 c7 c6 20 70 65 86 48 c7 c7 d8 69 9c 86 48 8b 4c 24 28 e8 ef 71 c7 00 <0f> 0b e9 53 ff ff ff c3 48 81 ff ff 0f 00 00 77 03 31 c0 c3 53 48
...
Call Trace:
<TASK>
? nilfs_palloc_freev.cold.24+0x58/0x58 [nilfs2]
nilfs_destroy_cachep+0x16/0x3a [nilfs2]
exit_nilfs_fs+0xa/0x1b [nilfs2]
__x64_sys_delete_module+0x1d9/0x3a0
? __sanitizer_cov_trace_pc+0x1a/0x50
? syscall_trace_enter.isra.19+0x119/0x190
do_syscall_64+0x34/0x80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
...
</TASK>
Kernel panic - not syncing: panic_on_warn set ...This patch fixes these issues by calling nilfs_detach_log_writer() cleanup function if spawning the log writer thread fails.
--- fs/nilfs2/segment.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
fs/nilfs2/segment.c +3 -4
@@ -2786,10 +2786,9 @@ int nilfs_attach_log_writer(struct superinode_attach_wb (nilfs->ns_bdev->bd_inode,NULL ); err =nilfs_segctor_start_thread (nilfs->ns_writer); -if (err) { -kfree (nilfs->ns_writer); - nilfs->ns_writer =NULL ; - } +if (unlikely (err)) +nilfs_detach_log_writer (sb); +return err; }
Greg Kroah-Hartman
maintainerPATCH 20/229 nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit 723ac751208f6d6540191689cfbf6c77135a7a1b upstream.
If creation or finalization of a checkpoint fails due to anomalies in the checkpoint metadata on disk, a kernel warning is generated.
This patch replaces the WARN_ONs by nilfs_error, so that a kernel, booted with panic_on_warn, does not panic. A nilfs_error is appropriate here to handle the abnormal filesystem condition.
This also replaces the detected error codes with an I/O error so that neither of the internal error codes is returned to callers.
--- fs/nilfs2/segment.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
fs/nilfs2/segment.c +10 -4
@@ -880,9 +880,11 @@ static int nilfs_segctor_create_checkpoinilfs_mdt_mark_dirty (nilfs->ns_cpfile);nilfs_cpfile_put_checkpoint ( nilfs->ns_cpfile, nilfs->ns_cno, bh_cp); - }else -WARN_ON (err == -EINVAL || err == -ENOENT ); - + }else if (err == -EINVAL || err == -ENOENT ) { +nilfs_error (sci->sc_super, +"checkpoint creation failed due to metadata corruption." ); + err = -EIO ; + }return err; }
@@ -896,7 +898,11 @@ static int nilfs_segctor_fill_in_checkpo err =nilfs_cpfile_get_checkpoint (nilfs->ns_cpfile, nilfs->ns_cno,0 , &raw_cp, &bh_cp);if (unlikely (err)) { -WARN_ON (err == -EINVAL || err == -ENOENT ); +if (err == -EINVAL || err == -ENOENT ) { +nilfs_error (sci->sc_super, +"checkpoint finalization failed due to metadata corruption." ); + err = -EIO ; + } goto failed_ibh; } raw_cp->cp_snapshot_list.ssl_next =0 ;
Greg Kroah-Hartman
maintainerPATCH 21/229 ceph: dont truncate file in atomic_open
In reply to Greg Kroah-HartmanFrom: Hu Weiwen <[email protected]>
commit 7cb9994754f8a36ae9e5ec4597c5c4c2d6c03832 upstream.
Clear O_TRUNC from the flags sent in the MDS create request.
`atomic_open' is called before permission check. We should not do any modification to the file here. The caller will do the truncation afterward.
--- fs/ceph/file.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/ceph/file.c +7 -3
@@ -446,6 +446,12 @@ int ceph_atomic_open(struct inode *dir,if (dentry->d_name.len >NAME_MAX )return -ENAMETOOLONG ; +/* +* Do not truncate the file, since atomic_open is called before the +* permission check. The caller will do the truncation afterward. +*/ + flags &= ~O_TRUNC ; +if (flags &O_CREAT ) {if (ceph_quota_is_max_files_exceeded (dir))return -EDQUOT ;
@@ -478,9 +484,7 @@ int ceph_atomic_open(struct inode *dir, req->r_parent = dir;set_bit (CEPH_MDS_R_PARENT_LOCKED , &req->r_req_flags); - err =ceph_mdsc_do_request (mdsc, - (flags & (O_CREAT |O_TRUNC )) ? dir :NULL , - req); + err =ceph_mdsc_do_request (mdsc, (flags &O_CREAT ) ? dir :NULL , req); err =ceph_handle_snapdir (req, dentry, err);if (err) goto out_req;
Greg Kroah-Hartman
maintainerPATCH 22/229 random: clamp credited irq bits to maximum mixed
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit e78a802a7b4febf53f2a92842f494b01062d85a8 upstream.
Since the most that's mixed into the pool is sizeof(long)*2, don't credit more than that many bytes of entropy.
--- drivers/char/random.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/random.c +1 -1
@@ -976,7 +976,7 @@ static void mix_interrupt_randomness(strlocal_irq_enable ();mix_pool_bytes (pool,sizeof (pool)); -credit_init_bits (max (1u , (count &U16_MAX ) /64 )); + credit_init_bits(clamp_t(unsigned int, (count & U16_MAX) / 64, 1, sizeof(pool) * 8));memzero_explicit (pool,sizeof (pool)); }
Greg Kroah-Hartman
maintainerPATCH 23/229 ALSA: hda: Fix position reporting on Poulsbo
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 56e696c0f0c71b77fff921fc94b58a02f0445b2c upstream.
Hans reported that his Sony VAIO VPX11S1E showed the broken sound behavior at the start of the stream for a couple of seconds, and it turned out that the position_fix=1 option fixes the issue. It implies that the position reporting is inaccurate, and very likely hitting on all Poulsbo devices.
The patch applies the workaround for Poulsbo generically to switch to LPIB mode instead of the default position buffer.
--- sound/pci/hda/hda_intel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/hda/hda_intel.c +2 -1
@@ -2638,7 +2638,8 @@ static const struct pci_device_id azx_id .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },/* Poulsbo */ { PCI_DEVICE(0x8086, 0x811b), - .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE }, + .driver_data =AZX_DRIVER_SCH |AZX_DCAPS_INTEL_PCH_BASE | + AZX_DCAPS_POSFIX_LPIB }, /* Oaktrail */ { PCI_DEVICE(0x8086, 0x080a), .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE },
Greg Kroah-Hartman
maintainerPATCH 24/229 scsi: stex: Properly zero out the passthrough command structure
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 6022f210461fef67e6e676fd8544ca02d1bcfa7a upstream.
The passthrough structure is declared off of the stack, so it needs to be set to zero before copied back to userspace to prevent any unintentional data leakage. Switch things to be statically allocated which will fill the unused fields with 0 automatically.
--- drivers/scsi/stex.c | 17 +++++++++-------- include/scsi/scsi_cmnd.h | 2 +- 2 files changed, 10 insertions(+), 9 deletions(-)
drivers/scsi/stex.c +9 -8
@@ -673,16 +673,17 @@ stex_queuecommand_lck(struct scsi_cmnd *return 0 ;case PASSTHRU_CMD :if (cmd->cmnd[1 ] ==PASSTHRU_GET_DRVVER ) { -struct st_drvver ver; +const struct st_drvver ver = { + .major =ST_VER_MAJOR , + .minor =ST_VER_MINOR , + .oem =ST_OEM , + .build =ST_BUILD_VER , + .signature[0 ] =PASSTHRU_SIGNATURE , + .console_id = host->max_id -1 , + .host_no = hba->host->host_no, + };size_t cp_len =sizeof (ver); - ver.major =ST_VER_MAJOR ; - ver.minor =ST_VER_MINOR ; - ver.oem =ST_OEM ; - ver.build =ST_BUILD_VER ; - ver.signature[0 ] =PASSTHRU_SIGNATURE ; - ver.console_id = host->max_id -1 ; - ver.host_no = hba->host->host_no; cp_len =scsi_sg_copy_from_buffer (cmd, &ver, cp_len); cmd->result =sizeof (ver) == cp_len ? DID_OK << 16 | COMMAND_COMPLETE << 8 :
include/scsi/scsi_cmnd.h +1 -1
@@ -227,7 +227,7 @@ static inline struct scsi_data_buffer *s }static inline int scsi_sg_copy_from_buffer (struct scsi_cmnd *cmd, -void *buf,int buflen) +const void *buf,int buflen) {return sg_copy_from_buffer (scsi_sglist (cmd),scsi_sg_count (cmd), buf, buflen);
Greg Kroah-Hartman
maintainerPATCH 25/229 USB: serial: qcserial: add new usb-id for Dell branded EM7455
In reply to Greg Kroah-HartmanFrom: Frank Wunderlich <[email protected]>
commit eee48781ea199e32c1d0c4732641c494833788ca upstream.
Add support for Dell 5811e (EM7455) with USB-id 0x413c:0x81c2.
--- drivers/usb/serial/qcserial.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/qcserial.c +1 -0
@@ -177,6 +177,7 @@ static const struct usb_device_id id_tab {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */ {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */ + {DEVICE_SWI(0x413c, 0x81c2)}, /* Dell Wireless 5811e */ {DEVICE_SWI(0x413c, 0x81cb)}, /* Dell Wireless 5816e QDL */ {DEVICE_SWI(0x413c, 0x81cc)}, /* Dell Wireless 5816e */ {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */
Greg Kroah-Hartman
maintainerPATCH 26/229 random: restore O_NONBLOCK support
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit cd4f24ae9404fd31fc461066e57889be3b68641b upstream.
Prior to 5.6, when /dev/random was opened with O_NONBLOCK, it would return -EAGAIN if there was no entropy. When the pools were unified in 5.6, this was lost. The post 5.6 behavior of blocking until the pool is initialized, and ignoring O_NONBLOCK in the process, went unnoticed, with no reports about the regression received for two and a half years. However, eventually this indeed did break somebody's userspace.
So we restore the old behavior, by returning -EAGAIN if the pool is not initialized. Unlike the old /dev/random, this can only occur during early boot, after which it never blocks again.
In order to make this O_NONBLOCK behavior consistent with other expectations, also respect users reading with preadv2(RWF_NOWAIT) and similar.
--- drivers/char/mem.c | 4 ++-- drivers/char/random.c | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-)
drivers/char/mem.c +2 -2
@@ -893,8 +893,8 @@ static const struct memdev { #endif [5] = { "zero", 0666, &zero_fops, 0 }, [7] = { "full", 0666, &full_fops, 0 }, - [8] = { "random", 0666, &random_fops, 0 }, - [9 ] = {"urandom" ,0666 , &urandom_fops,0 }, + [8] = { "random", 0666, &random_fops, FMODE_NOWAIT }, + [9 ] = {"urandom" ,0666 , &urandom_fops,FMODE_NOWAIT }, #ifdef CONFIG_PRINTK [11] = { "kmsg", 0644, &kmsg_fops, 0 }, #endif
drivers/char/random.c +5 -0
@@ -1294,6 +1294,11 @@ static ssize_t random_read_iter(struct k {int ret; +if (!crng_ready () && + ((kiocb->ki_flags &IOCB_NOWAIT ) || + (kiocb->ki_filp->f_flags &O_NONBLOCK ))) +return -EAGAIN ; + ret =wait_for_random_bytes ();if (ret !=0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 27/229 random: avoid reading two cache lines on irq randomness
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 9ee0507e896b45af6d65408c77815800bce30008 upstream.
In order to avoid reading and dirtying two cache lines on every IRQ, move the work_struct to the bottom of the fast_pool struct. add_ interrupt_randomness() always touches .pool and .count, which are currently split, because .mix pushes everything down. Instead, move .mix to the bottom, so that .pool and .count are always in the first cache line, since .mix is only accessed when the pool is full.
--- drivers/char/random.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/random.c +1 -1
@@ -890,10 +890,10 @@ void __init add_bootloader_randomness(co }struct fast_pool { -struct work_struct mix;unsigned long pool[4 ];unsigned long last;unsigned int count; +struct work_struct mix; }; static DEFINE_PER_CPU(struct fast_pool, irq_randomness) = {
Greg Kroah-Hartman
maintainerPATCH 28/229 random: use expired timer rather than wq for mixing fast pool
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 748bc4dd9e663f23448d8ad7e58c011a67ea1eca upstream.
Previously, the fast pool was dumped into the main pool periodically in the fast pool's hard IRQ handler. This worked fine and there weren't problems with it, until RT came around. Since RT converts spinlocks into sleeping locks, problems cropped up. Rather than switching to raw spinlocks, the RT developers preferred we make the transformation from originally doing:
do_some_stuff()
spin_lock()
do_some_other_stuff()
spin_unlock()to doing:
do_some_stuff()
queue_work_on(some_other_stuff_worker)This is an ordinary pattern done all over the kernel. However, Sherry noticed a 10% performance regression in qperf TCP over a 40gbps InfiniBand card. Quoting her message:
Quoted 15 lines
MT27500 Family [ConnectX-3] cards:
Infiniband device 'mlx4_0' port 1 status:
default gid: fe80:0000:0000:0000:0010:e000:0178:9eb1 base lid:0x6
sm lid:0x1
state: 4: ACTIVE
phys state: 5: LinkUp
rate: 40 Gb/sec (4X QDR)link_layer: InfiniBandCards are configured with IP addresses on private subnet for IPoIB performance testing.
Regression identified in this bug is in TCP latency in this stack as reported by qperftcp_latmetric:
Quoted 6 lines
We have one system listen as a qperf server:
[root@yourQperfServer ~]# qperfHave the other system connect to qperf server as a client (in this
case, it’s X7 server with Mellanox card):
[root@yourQperfClient ~]# numactl -m0 -N0 qperf 20.20.20.101 -v -uu -ub --time 60 --wait_server 20 -oo msg_size:4K:1024K:*2tcp_lat
Rather than incur the scheduling latency from queue_work_on, we can instead switch to running on the next timer tick, on the same core. This also batches things a bit more -- once per jiffy -- which is okay now that mix_interrupt_randomness() can credit multiple bits at once.
--- drivers/char/random.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/char/random.c +11 -7
@@ -893,17 +893,20 @@ struct fast_pool {unsigned long pool[4 ];unsigned long last;unsigned int count; -struct work_struct mix; +struct timer_list mix; }; +static void mix_interrupt_randomness (struct timer_list *work); + static DEFINE_PER_CPU(struct fast_pool, irq_randomness) = { #ifdef CONFIG_64BIT #define FASTMIX_PERM SIPHASH_PERMUTATION - .pool = { SIPHASH_CONST_0, SIPHASH_CONST_1, SIPHASH_CONST_2, SIPHASH_CONST_3 } + .pool = { SIPHASH_CONST_0, SIPHASH_CONST_1, SIPHASH_CONST_2, SIPHASH_CONST_3 }, #else #define FASTMIX_PERM HSIPHASH_PERMUTATION - .pool = { HSIPHASH_CONST_0, HSIPHASH_CONST_1, HSIPHASH_CONST_2, HSIPHASH_CONST_3 } + .pool = { HSIPHASH_CONST_0, HSIPHASH_CONST_1, HSIPHASH_CONST_2, HSIPHASH_CONST_3 }, #endif + .mix = __TIMER_INITIALIZER(mix_interrupt_randomness, 0) }; /*
@@ -945,7 +948,7 @@ int __cold random_online_cpu(unsigned in }#endif -static void mix_interrupt_randomness (struct work_struct *work) +static void mix_interrupt_randomness (struct timer_list *work) { struct fast_pool *fast_pool = container_of(work, struct fast_pool, mix);/*
@@ -999,10 +1002,11 @@ void add_interrupt_randomness(int irq)if (new_count <1024 && !time_is_before_jiffies (fast_pool->last +HZ ))return ; -if (unlikely (!fast_pool->mix.func)) -INIT_WORK (&fast_pool->mix, mix_interrupt_randomness); fast_pool->count |=MIX_INFLIGHT ; -queue_work_on (raw_smp_processor_id (), system_highpri_wq, &fast_pool->mix); +if (!timer_pending (&fast_pool->mix)) { + fast_pool->mix.expires = jiffies; +add_timer_on (&fast_pool->mix,raw_smp_processor_id ()); + } }EXPORT_SYMBOL_GPL (add_interrupt_randomness);
Greg Kroah-Hartman
maintainerPATCH 29/229 wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 1833b6f46d7e2830251a063935ab464256defe22 upstream.
If the tool on the other side (e.g. wmediumd) gets confused about the rate, we hit a warning in mac80211. Silence that by effectively duplicating the check here and dropping the frame silently (in mac80211 it's dropped with the warning).
--- drivers/net/wireless/mac80211_hwsim.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/mac80211_hwsim.c +2 -0
@@ -3270,6 +3270,8 @@ static int hwsim_cloned_frame_received_n rx_status.band = data2->channel->band; rx_status.rate_idx =nla_get_u32 (info->attrs[HWSIM_ATTR_RX_RATE ]); +if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates) + goto out; rx_status.signal =nla_get_u32 (info->attrs[HWSIM_ATTR_SIGNAL ]);memcpy (IEEE80211_SKB_RXCB (skb), &rx_status,sizeof (rx_status));
Greg Kroah-Hartman
maintainerPATCH 30/229 Input: xpad - add supported devices as contributed on github
In reply to Greg Kroah-HartmanFrom: Pavel Rojtberg <[email protected]>
commit b382c5e37344883dc97525d05f1f6b788f549985 upstream.
This is based on multiple commits at https://github.com/paroj/xpad
--- drivers/input/joystick/xpad.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/input/joystick/xpad.c +19 -0
@@ -126,6 +126,8 @@ static const struct xpad_device {u8 xtype; } xpad_device[] = { { 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 }, + { 0x03eb, 0xff01, "Wooting One (Legacy)", 0, XTYPE_XBOX360 }, + { 0x03eb, 0xff02, "Wooting Two (Legacy)", 0, XTYPE_XBOX360 }, { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX }, { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX }, { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
@@ -256,6 +258,7 @@ static const struct xpad_device { { 0x0f0d, 0x0063, "Hori Real Arcade Pro Hayabusa (USA) Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, { 0x0f0d, 0x0067, "HORIPAD ONE", 0, XTYPE_XBOXONE }, { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x0f0d, 0x00c5, "Hori Fighting Commander ONE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, { 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX }, { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX }, { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
@@ -272,6 +275,7 @@ static const struct xpad_device { { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, { 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 }, { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 }, + { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
@@ -336,6 +340,7 @@ static const struct xpad_device { { 0x24c6, 0x5502, "Hori Fighting Stick VX Alt", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x24c6, 0x5503, "Hori Fighting Edge", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x24c6, 0x5506, "Hori SOULCALIBUR V Stick", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x24c6, 0x550d, "Hori GEM Xbox controller", 0, XTYPE_XBOX360 }, { 0x24c6, 0x550e, "Hori Real Arcade Pro V Kai 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE },
@@ -345,6 +350,14 @@ static const struct xpad_device { { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, + { 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 }, + { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, + { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1220, "Wooting Two HE", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 }, { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 }, { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
@@ -430,6 +443,7 @@ static const signed short xpad_abs_triggstatic const struct usb_device_id xpad_table[] = { {USB_INTERFACE_INFO ('X' ,'B' ,0 ) },/* X-Box USB-IF not approved class */ XPAD_XBOX360_VENDOR (0x0079 ),/* GPD Win 2 Controller */ +XPAD_XBOX360_VENDOR (0x03eb ),/* Wooting Keyboards (Legacy) */ XPAD_XBOX360_VENDOR (0x044f ),/* Thrustmaster X-Box 360 controllers */ XPAD_XBOX360_VENDOR (0x045e ),/* Microsoft X-Box 360 controllers */ XPAD_XBOXONE_VENDOR (0x045e ),/* Microsoft X-Box One controllers */
@@ -440,6 +454,7 @@ static const struct usb_device_id xpad_t { USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */XPAD_XBOXONE_VENDOR (0x0738 ),/* Mad Catz FightStick TE 2 */ XPAD_XBOX360_VENDOR (0x07ff ),/* Mad Catz GamePad */ +XPAD_XBOX360_VENDOR (0x0c12 ),/* Zeroplus X-Box 360 controllers */ XPAD_XBOX360_VENDOR (0x0e6f ),/* 0x0e6f X-Box 360 controllers */ XPAD_XBOXONE_VENDOR (0x0e6f ),/* 0x0e6f X-Box One controllers */ XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */
@@ -460,8 +475,12 @@ static const struct usb_device_id xpad_tXPAD_XBOXONE_VENDOR (0x20d6 ),/* PowerA Controllers */ XPAD_XBOX360_VENDOR (0x24c6 ),/* PowerA Controllers */ XPAD_XBOXONE_VENDOR (0x24c6 ),/* PowerA Controllers */ +XPAD_XBOX360_VENDOR (0x2563 ),/* OneXPlayer Gamepad */ +XPAD_XBOX360_VENDOR (0x260d ),/* Dareu H101 */ +XPAD_XBOXONE_VENDOR (0x2dc8 ),/* 8BitDo Pro 2 Wired Controller for Xbox */ XPAD_XBOXONE_VENDOR (0x2e24 ),/* Hyperkin Duke X-Box One pad */ XPAD_XBOX360_VENDOR (0x2f24 ),/* GameSir Controllers */ +XPAD_XBOX360_VENDOR (0x31e3 ),/* Wooting Keyboards */ XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */ { } };
Greg Kroah-Hartman
maintainerPATCH 31/229 Input: xpad - fix wireless 360 controller breaking after suspend
In reply to Greg Kroah-HartmanFrom: Cameron Gutman <[email protected]>
commit a17b9841152e7f4621619902b347e2cc39c32996 upstream.
Suspending and resuming the system can sometimes cause the out URB to get hung after a reset_resume. This causes LED setting and force feedback to break on resume. To avoid this, just drop the reset_resume callback so the USB core rebinds xpad to the wireless pads on resume if a reset happened.
A nice side effect of this change is the LED ring on wireless controllers is now set correctly on system resume.
--- drivers/input/joystick/xpad.c | 1 - 1 file changed, 1 deletion(-)
drivers/input/joystick/xpad.c +0 -1
@@ -1997,7 +1997,6 @@ static struct usb_driver xpad_driver = { .disconnect = xpad_disconnect, .suspend = xpad_suspend, .resume = xpad_resume, - .reset_resume = xpad_resume, .id_table = xpad_table, };
Greg Kroah-Hartman
maintainerPATCH 32/229 ALSA: oss: Fix potential deadlock at unregistration
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 97d917879d7f92df09c3f21fd54609a8bcd654b2 upstream.
We took sound_oss_mutex around the calls of unregister_sound_special() at unregistering OSS devices. This may, however, lead to a deadlock, because we manage the card release via the card's device object, and the release may happen at unregister_sound_special() call -- which will take sound_oss_mutex again in turn.
Although the deadlock might be fixed by relaxing the rawmidi mutex in the previous commit, it's safer to move unregister_sound_special() calls themselves out of the sound_oss_mutex, too. The call is race-safe as the function has a spinlock protection by itself.
--- sound/core/sound_oss.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
sound/core/sound_oss.c +9 -4
@@ -177,7 +177,6 @@ int snd_unregister_oss_device(int type,mutex_unlock (&sound_oss_mutex);return -ENOENT ; } -unregister_sound_special (minor);switch (SNDRV_MINOR_OSS_DEVICE (minor)) {case SNDRV_MINOR_OSS_PCM : track2 =SNDRV_MINOR_OSS (cidx,SNDRV_MINOR_OSS_AUDIO );
@@ -189,12 +188,18 @@ int snd_unregister_oss_device(int type, track2 =SNDRV_MINOR_OSS (cidx,SNDRV_MINOR_OSS_DMMIDI1 );break ; } -if (track2 >=0 ) { -unregister_sound_special (track2); +if (track2 >=0 ) snd_oss_minors[track2] =NULL ; - } snd_oss_minors[minor] =NULL ;mutex_unlock (&sound_oss_mutex); + +/* call unregister_sound_special() outside sound_oss_mutex; +* otherwise may deadlock, as it can trigger the release of a card +*/ +unregister_sound_special (minor); +if (track2 >=0 ) +unregister_sound_special (track2); +kfree (mptr);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 33/229 ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit a70aef7982b012e86dfd39fbb235e76a21ae778a upstream.
The register_mutex taken around the dev_unregister callback call in snd_rawmidi_free() may potentially lead to a mutex deadlock, when OSS emulation and a hot unplug are involved.
Since the mutex doesn't protect the actual race (as the registration itself is already protected by another means), let's drop it.
--- sound/core/rawmidi.c | 2 -- 1 file changed, 2 deletions(-)
sound/core/rawmidi.c +0 -2
@@ -1655,10 +1655,8 @@ static int snd_rawmidi_free(struct snd_rsnd_info_free_entry (rmidi->proc_entry); rmidi->proc_entry =NULL ; -mutex_lock (®ister_mutex);if (rmidi->ops && rmidi->ops->dev_unregister) rmidi->ops->dev_unregister (rmidi); -mutex_unlock (®ister_mutex);snd_rawmidi_free_substreams (&rmidi->streams[SNDRV_RAWMIDI_STREAM_INPUT ]);snd_rawmidi_free_substreams (&rmidi->streams[SNDRV_RAWMIDI_STREAM_OUTPUT ]);
Greg Kroah-Hartman
maintainerPATCH 34/229 ALSA: usb-audio: Fix potential memory leaks
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 6382da0828995af87aa8b8bef28cc61aceb4aff3 upstream.
When the driver hits -ENOMEM at allocating a URB or a buffer, it aborts and goes to the error path that releases the all previously allocated resources. However, when -ENOMEM hits at the middle of the sync EP URB allocation loop, the partially allocated URBs might be left without released, because ep->nurbs is still zero at that point.
Fix it by setting ep->nurbs at first, so that the error handler loops over the full URB list.
--- sound/usb/endpoint.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/usb/endpoint.c +1 -2
@@ -816,6 +816,7 @@ static int sync_ep_set_params(struct sndif (!ep->syncbuf)return -ENOMEM ; + ep->nurbs =SYNC_URBS ;for (i =0 ; i <SYNC_URBS ; i++) {struct snd_urb_ctx *u = &ep->urb[i]; u->index = i;
@@ -835,8 +836,6 @@ static int sync_ep_set_params(struct snd u->urb->complete = snd_complete_urb; } - ep->nurbs =SYNC_URBS ; -return 0 ; out_of_memory:
Greg Kroah-Hartman
maintainerPATCH 35/229 ALSA: usb-audio: Fix NULL dererence at error path
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 568be8aaf8a535f79c4db76cabe17b035aa2584d upstream.
At an error path to release URB buffers and contexts, the driver might hit a NULL dererence for u->urb pointer, when u->buffer_size has been already set but the actual URB allocation failed.
Fix it by adding the NULL check of urb. Also, make sure that buffer_size is cleared after the error path or the close.
--- sound/usb/endpoint.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/usb/endpoint.c +2 -1
@@ -86,12 +86,13 @@ static inline unsigned get_usb_high_spee*/ static void release_urb_ctx (struct snd_urb_ctx *u) { -if (u->buffer_size) +if (u->urb && u->buffer_size)usb_free_coherent (u->ep->chip->dev, u->buffer_size, u->urb->transfer_buffer, u->urb->transfer_dma);usb_free_urb (u->urb); u->urb =NULL ; + u->buffer_size =0 ; }static const char *usb_error_string (int err)
Greg Kroah-Hartman
maintainerPATCH 36/229 ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
In reply to Greg Kroah-HartmanFrom: Callum Osmotherly <[email protected]>
commit 417b9c51f59734d852e47252476fadc293ad994a upstream.
After some feedback from users with Dell Precision 5530 machines, this patch reverts the previous change to add ALC289_FIXUP_DUAL_SPK. While it improved the speaker output quality, it caused the headphone jack to have an audible "pop" sound when power saving was toggled.
--- sound/pci/hda/patch_realtek.c | 1 - 1 file changed, 1 deletion(-)
sound/pci/hda/patch_realtek.c +0 -1
@@ -7081,7 +7081,6 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1028 ,0x0871 ,"Dell Precision 3630" ,ALC255_FIXUP_DELL_HEADSET_MIC ),SND_PCI_QUIRK (0x1028 ,0x0872 ,"Dell Precision 3630" ,ALC255_FIXUP_DELL_HEADSET_MIC ),SND_PCI_QUIRK (0x1028 ,0x0873 ,"Dell Precision 3930" ,ALC255_FIXUP_DUMMY_LINEOUT_VERB ), -SND_PCI_QUIRK (0x1028 ,0x087d ,"Dell Precision 5530" ,ALC289_FIXUP_DUAL_SPK ),SND_PCI_QUIRK (0x1028 ,0x08ad ,"Dell WYSE AIO" ,ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x08ae ,"Dell WYSE NB" ,ALC225_FIXUP_DELL1_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
Greg Kroah-Hartman
maintainerPATCH 37/229 mtd: rawnand: atmel: Unmap streaming DMA mappings
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
commit 1161703c9bd664da5e3b2eb1a3bb40c210e026ea upstream.
Every dma_map_single() call should have its dma_unmap_single() counterpart, because the DMA address space is a shared resource and one could render the machine unusable by consuming all DMA addresses.
--- drivers/mtd/nand/raw/atmel/nand-controller.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/nand/raw/atmel/nand-controller.c +1 -0
@@ -398,6 +398,7 @@ static int atmel_nand_dma_transfer(strucdma_async_issue_pending (nc->dmac);wait_for_completion (&finished); +dma_unmap_single (nc->dev, buf_dma, len, dir);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 38/229 iio: dac: ad5593r: Fix i2c read protocol requirements
In reply to Greg Kroah-HartmanFrom: Michael Hennerich <[email protected]>
commit 558a25f903b4af6361b7fbeea08a6446a0745653 upstream.
For reliable operation across the full range of supported interface rates, the AD5593R needs a STOP condition between address write, and data read (like show in the datasheet Figure 40) so in turn i2c_smbus_read_word_swapped cannot be used.
While at it, a simple helper was added to make the code simpler.
--- drivers/iio/dac/ad5593r.c | 46 +++++++++++++++++++++++++++------------------- 1 file changed, 27 insertions(+), 19 deletions(-)
drivers/iio/dac/ad5593r.c +27 -19
@@ -15,6 +15,8 @@#include <linux/of.h> #include <linux/acpi.h> +#include <asm/unaligned.h> +#define AD5593R_MODE_CONF (0 << 4)#define AD5593R_MODE_DAC_WRITE (1 << 4)#define AD5593R_MODE_ADC_READBACK (4 << 4)
@@ -22,6 +24,24 @@#define AD5593R_MODE_GPIO_READBACK (6 << 4)#define AD5593R_MODE_REG_READBACK (7 << 4) +static int ad5593r_read_word (struct i2c_client *i2c,u8 reg,u16 *value) +{ +int ret; +u8 buf[2 ]; + + ret =i2c_smbus_write_byte (i2c, reg); +if (ret <0 ) +return ret; + + ret =i2c_master_recv (i2c, buf,sizeof (buf)); +if (ret <0 ) +return ret; + + *value =get_unaligned_be16 (buf); + +return 0 ; +} +static int ad5593r_write_dac (struct ad5592r_state *st,unsigned chan,u16 value) {struct i2c_client *i2c =to_i2c_client (st->dev);
@@ -40,13 +60,7 @@ static int ad5593r_read_adc(struct ad559if (val <0 )return (int ) val; - val =i2c_smbus_read_word_swapped (i2c,AD5593R_MODE_ADC_READBACK ); -if (val <0 ) -return (int ) val; - - *value = (u16 ) val; - -return 0 ; +return ad5593r_read_word (i2c,AD5593R_MODE_ADC_READBACK , value); }static int ad5593r_reg_write (struct ad5592r_state *st,u8 reg,u16 value)
@@ -60,25 +74,19 @@ static int ad5593r_reg_write(struct ad55static int ad5593r_reg_read (struct ad5592r_state *st,u8 reg,u16 *value) {struct i2c_client *i2c =to_i2c_client (st->dev); -s32 val; - - val =i2c_smbus_read_word_swapped (i2c,AD5593R_MODE_REG_READBACK | reg); -if (val <0 ) -return (int ) val; - *value = (u16 ) val; - -return 0 ; +return ad5593r_read_word (i2c,AD5593R_MODE_REG_READBACK | reg, value); }static int ad5593r_gpio_read (struct ad5592r_state *st,u8 *value) {struct i2c_client *i2c =to_i2c_client (st->dev); -s32 val; +u16 val; +int ret; - val =i2c_smbus_read_word_swapped (i2c,AD5593R_MODE_GPIO_READBACK ); -if (val <0 ) -return (int ) val; + ret =ad5593r_read_word (i2c,AD5593R_MODE_GPIO_READBACK , &val); +if (ret) +return ret; *value = (u8 ) val;
Greg Kroah-Hartman
maintainerPATCH 39/229 usb: add quirks for Lenovo OneLink+ Dock
In reply to Greg Kroah-HartmanFrom: Jean-Francois Le Fillatre <[email protected]>
commit 37d49519b41405b08748392c6a7f193d9f77ecd2 upstream.
The Lenovo OneLink+ Dock contains two VL812 USB3.0 controllers:
17ef:1018 upstream
17ef:1019 downstream
These hubs suffer from two separate problems:
1) After the host system was suspended and woken up, the hubs appear to be in a random state. Some downstream ports (both internal to the built-in audio and network controllers, and external to USB sockets) may no longer be functional. The exact list of disabled ports (if any) changes from wakeup to wakeup. Ports remain in that state until the dock is power-cycled, or until the laptop is rebooted.
Wakeup sources connected to the hubs (keyboard, WoL on the integrated gigabit controller) will wake the system up from suspend, but they may no longer work after wakeup (and in that case will no longer work as wakeup source in a subsequent suspend-wakeup cycle).
This issue appears in the logs with messages such as:
usb 1-6.1-port4: cannot disable (err = -71)
usb 1-6-port2: cannot disable (err = -71)
usb 1-6.1: clear tt 1 (80c0) error -71
usb 1-6-port4: cannot disable (err = -71)
usb 1-6.4: PM: dpm_run_callback(): usb_dev_resume+0x0/0x10 [usbcore] returns -71
usb 1-6.4: PM: failed to resume async: error -71
usb 1-7: reset full-speed USB device number 5 using xhci_hcd
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: Cannot enable. Maybe the USB cable is bad?
usb 1-6.1-port1: cannot disable (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: Cannot enable. Maybe the USB cable is bad?
usb 1-6.1-port1: cannot disable (err = -71)2) Some USB devices cannot be enumerated properly. So far I have only seen the issue with USB 3.0 devices. The same devices work without problem directly connected to the host system, to other systems or to other hubs (even when those hubs are connected to the OneLink+ dock).
One very reliable reproducer is this USB 3.0 HDD enclosure:
152d:9561 JMicron Technology Corp. / JMicron USA Technology Corp. Mobius
I have seen it happen sporadically with other USB 3.0 enclosures, with controllers from different manufacturers, all self-powered.
Typical messages in the logs:
xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command usb 2-1.4: device not accepting address 6, error -62 xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command usb 2-1.4: device not accepting address 7, error -62
usb 2-1-port4: attempt power cycle
xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command usb 2-1.4: device not accepting address 8, error -62 xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command usb 2-1.4: device not accepting address 9, error -62
usb 2-1-port4: unable to enumerate USB device
Through trial and error, I found that the USB_QUIRK_RESET_RESUME solved the second issue. Further testing then uncovered the first issue. Test results are summarized in this table:
=======================================================================================
Settings USB2 hotplug USB3 hotplug State after waking up
---------------------------------------------------------------------------------------
power/control=auto works fails broken
usbcore.autosuspend=-1 works works broken
OR power/control=on
power/control=auto works (1) works (1) works
and USB_QUIRK_RESET_RESUME
power/control=on works works works
and USB_QUIRK_RESET_RESUME
HUB_QUIRK_DISABLE_AUTOSUSPEND works works works
and USB_QUIRK_RESET_RESUME
=======================================================================================
In those results, the power/control settings are applied to both hubs, both on the USB2 and USB3 side, before each test.
Quoted 1 line
From those results,
USB_QUIRK_RESET_RESUMEis required to reset the hubs
properly after a suspend-wakeup cycle, and the hubs must not autosuspend to work around the USB3 issue.
A secondary effect of USB_QUIRK_RESET_RESUME is to prevent the hubs' upstream links from suspending (the downstream ports can still suspend). This secondary effect is used in results (1). It is enough to solve the USB3 problem.
Setting USB_QUIRK_RESET_RESUME on those hubs is the smallest patch that solves both issues.
Prior to creating this patch, I have used the USB_QUIRK_RESET_RESUME via the kernel command line for over a year without noticing any side effect.
Thanks to Oliver Neukum @Suse for explanations of the operations of USB_QUIRK_RESET_RESUME, and requesting more testing.
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -438,6 +438,10 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x1532, 0x0116), .driver_info = USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */ + { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */ { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM },
Greg Kroah-Hartman
maintainerPATCH 40/229 can: kvaser_usb: Fix use of uninitialized completion
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
commit cd7f30e174d09a02ca2afa5ef093fb0f0352e0d8 upstream.
flush_comp is initialized when CMD_FLUSH_QUEUE is sent to the device and completed when the device sends CMD_FLUSH_QUEUE_RESP.
This causes completion of uninitialized completion if the device sends CMD_FLUSH_QUEUE_RESP before CMD_FLUSH_QUEUE is ever sent (e.g. as a response to a flush by a previously bound driver, or a misbehaving device).
Fix that by initializing flush_comp in kvaser_usb_init_one() like the other completions.
This issue is only triggerable after RX URBs have been set up, i.e. the interface has been opened at least once.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +1 -0
@@ -691,6 +691,7 @@ static int kvaser_usb_init_one(struct kvinit_usb_anchor (&priv->tx_submitted);init_completion (&priv->start_comp);init_completion (&priv->stop_comp); +init_completion (&priv->flush_comp); priv->can.ctrlmode_supported =0 ; priv->dev = dev;
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +1 -1
@@ -1886,7 +1886,7 @@ static int kvaser_usb_hydra_flush_queue( {int err; -init_completion (&priv->flush_comp); +reinit_completion (&priv->flush_comp); err =kvaser_usb_hydra_send_simple_cmd (priv->dev,CMD_FLUSH_QUEUE , priv->channel);
Greg Kroah-Hartman
maintainerPATCH 41/229 can: kvaser_usb_leaf: Fix overread with an invalid command
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
commit 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 upstream.
For command events read from the device, kvaser_usb_leaf_read_bulk_callback() verifies that cmd->len does not exceed the size of the received data, but the actual kvaser_cmd handlers will happily read any kvaser_cmd fields without checking for cmd->len.
This can cause an overread if the last cmd in the buffer is shorter than expected for the command type (with cmd->len showing the actual short size).
Maximum overread seems to be 22 bytes (CMD_LEAF_LOG_MESSAGE), some of which are delivered to userspace as-is.
Fix that by verifying the length of command before handling it.
This issue can only occur after RX URBs have been set up, i.e. the interface has been opened at least once.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 75 +++++++++++++++++++++++ 1 file changed, 75 insertions(+)
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +75 -0
@@ -309,6 +309,38 @@ struct kvaser_cmd { } u; } __packed; +#define CMD_SIZE_ANY 0xff +#define kvaser_fsize (field) sizeof_field(struct kvaser_cmd, field) + +static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { + [CMD_START_CHIP_REPLY ] =kvaser_fsize (u.simple), + [CMD_STOP_CHIP_REPLY ] =kvaser_fsize (u.simple), + [CMD_GET_CARD_INFO_REPLY ] =kvaser_fsize (u.cardinfo), + [CMD_TX_ACKNOWLEDGE ] =kvaser_fsize (u.tx_acknowledge_header), + [CMD_GET_SOFTWARE_INFO_REPLY ] =kvaser_fsize (u.leaf.softinfo), + [CMD_RX_STD_MESSAGE ] =kvaser_fsize (u.leaf.rx_can), + [CMD_RX_EXT_MESSAGE ] =kvaser_fsize (u.leaf.rx_can), + [CMD_LEAF_LOG_MESSAGE ] =kvaser_fsize (u.leaf.log_message), + [CMD_CHIP_STATE_EVENT ] =kvaser_fsize (u.leaf.chip_state_event), + [CMD_CAN_ERROR_EVENT ] =kvaser_fsize (u.leaf.error_event), +/* ignored events: */ + [CMD_FLUSH_QUEUE_REPLY ] =CMD_SIZE_ANY , +}; + +static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = { + [CMD_START_CHIP_REPLY ] =kvaser_fsize (u.simple), + [CMD_STOP_CHIP_REPLY ] =kvaser_fsize (u.simple), + [CMD_GET_CARD_INFO_REPLY ] =kvaser_fsize (u.cardinfo), + [CMD_TX_ACKNOWLEDGE ] =kvaser_fsize (u.tx_acknowledge_header), + [CMD_GET_SOFTWARE_INFO_REPLY ] =kvaser_fsize (u.usbcan.softinfo), + [CMD_RX_STD_MESSAGE ] =kvaser_fsize (u.usbcan.rx_can), + [CMD_RX_EXT_MESSAGE ] =kvaser_fsize (u.usbcan.rx_can), + [CMD_CHIP_STATE_EVENT ] =kvaser_fsize (u.usbcan.chip_state_event), + [CMD_CAN_ERROR_EVENT ] =kvaser_fsize (u.usbcan.error_event), +/* ignored events: */ + [CMD_USBCAN_CLOCK_OVERFLOW_EVENT ] =CMD_SIZE_ANY , +}; +/* Summary of a kvaser error event, for a unified Leaf/Usbcan error * handling. Some discrepancies between the two families exist: *
@@ -396,6 +428,43 @@ static const struct kvaser_usb_dev_cfg k .bittiming_const = &kvaser_usb_flexc_bittiming_const, }; +static int kvaser_usb_leaf_verify_size (const struct kvaser_usb *dev, +const struct kvaser_cmd *cmd) +{ +/* buffer size >= cmd->len ensured by caller */ +u8 min_size =0 ; + +switch (dev->driver_info->family) { +case KVASER_LEAF : +if (cmd->id <ARRAY_SIZE (kvaser_usb_leaf_cmd_sizes_leaf)) + min_size = kvaser_usb_leaf_cmd_sizes_leaf[cmd->id]; +break ; +case KVASER_USBCAN : +if (cmd->id <ARRAY_SIZE (kvaser_usb_leaf_cmd_sizes_usbcan)) + min_size = kvaser_usb_leaf_cmd_sizes_usbcan[cmd->id]; +break ; + } + +if (min_size ==CMD_SIZE_ANY ) +return 0 ; + +if (min_size) { + min_size +=CMD_HEADER_LEN ; +if (cmd->len >= min_size) +return 0 ; + +dev_err_ratelimited (&dev->intf->dev, +"Received command %u too short (size %u, needed %u)" , + cmd->id, cmd->len, min_size); +return -EIO ; + } + +dev_warn_ratelimited (&dev->intf->dev, +"Unhandled command (%d, size %d)\n" , + cmd->id, cmd->len); +return -EINVAL ; +} +static void * kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv, const struct sk_buff *skb, int *frame_len,
@@ -503,6 +572,9 @@ static int kvaser_usb_leaf_wait_cmd(cons end:kfree (buf); +if (err ==0 ) + err =kvaser_usb_leaf_verify_size (dev, cmd); +return err; }
@@ -1137,6 +1209,9 @@ static void kvaser_usb_leaf_stop_chip_restatic void kvaser_usb_leaf_handle_command (const struct kvaser_usb *dev,const struct kvaser_cmd *cmd) { +if (kvaser_usb_leaf_verify_size (dev, cmd) <0 ) +return ; +switch (cmd->id) {case CMD_START_CHIP_REPLY :kvaser_usb_leaf_start_chip_reply (dev, cmd);
Greg Kroah-Hartman
maintainerPATCH 42/229 can: kvaser_usb_leaf: Fix TX queue out of sync after restart
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
commit 455561fb618fde40558776b5b8435f9420f335db upstream.
The TX queue seems to be implicitly flushed by the hardware during bus-off or bus-off recovery, but the driver does not reset the TX bookkeeping.
Despite not resetting TX bookkeeping the driver still re-enables TX queue unconditionally, leading to "cannot find free context" / NETDEV_TX_BUSY errors if the TX queue was full at bus-off time.
Fix that by resetting TX bookkeeping on CAN restart.
Tested with 0bfd:0124 Kvaser Mini PCI Express 2xHS FW 4.18.778.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 ++ drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-)
drivers/net/can/usb/kvaser_usb/kvaser_usb.h +2 -0
@@ -178,6 +178,8 @@ struct kvaser_usb_dev_cfg {extern const struct kvaser_usb_dev_ops kvaser_usb_hydra_dev_ops;extern const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops; +void kvaser_usb_unlink_tx_urbs (struct kvaser_usb_net_priv *priv); +int kvaser_usb_recv_cmd (const struct kvaser_usb *dev,void *cmd,int len,int *actual_len);
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +1 -1
@@ -453,7 +453,7 @@ static void kvaser_usb_reset_tx_urb_cont/* This method might sleep. Do not call it in the atomic context * of URB completions. */ -static void kvaser_usb_unlink_tx_urbs (struct kvaser_usb_net_priv *priv) +void kvaser_usb_unlink_tx_urbs (struct kvaser_usb_net_priv *priv) {usb_kill_anchored_urbs (&priv->tx_submitted);kvaser_usb_reset_tx_urb_contexts (priv);
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +2 -0
@@ -1430,6 +1430,8 @@ static int kvaser_usb_leaf_set_mode(struswitch (mode) {case CAN_MODE_START : +kvaser_usb_unlink_tx_urbs (priv); + err =kvaser_usb_leaf_simple_cmd_async (priv,CMD_START_CHIP );if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 43/229 can: kvaser_usb_leaf: Fix CAN state after restart
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
commit 0be1a655fe68c8e6dcadbcbddb69cf2fb29881f5 upstream.
can_restart() expects CMD_START_CHIP to set the error state to ERROR_ACTIVE as it calls netif_carrier_on() immediately afterwards.
Otherwise the user may immediately trigger restart again and hit a BUG_ON() in can_restart().
Fix kvaser_usb_leaf set_mode(CMD_START_CHIP) to set the expected state.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +2 -0
@@ -1435,6 +1435,8 @@ static int kvaser_usb_leaf_set_mode(stru err =kvaser_usb_leaf_simple_cmd_async (priv,CMD_START_CHIP );if (err)return err; + + priv->can.state =CAN_STATE_ERROR_ACTIVE ;break ;default :return -EOPNOTSUPP ;
Greg Kroah-Hartman
maintainerPATCH 44/229 fs: dlm: fix race between test_bit() and queue_work()
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
commit eef6ec9bf390e836a6c4029f3620fe49528aa1fe upstream.
This patch fixes a race by using ls_cb_mutex around the bit operations and conditional code blocks for LSFL_CB_DELAY.
The function dlm_callback_stop() expects to stop all callbacks and flush all currently queued onces. The set_bit() is not enough because there can still be queue_work() after the workqueue was flushed. To avoid queue_work() after set_bit(), surround both by ls_cb_mutex.
--- fs/dlm/ast.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/dlm/ast.c +4 -2
@@ -200,13 +200,13 @@ void dlm_add_cb(struct dlm_lkb *lkb, uinif (!prev_seq) {kref_get (&lkb->lkb_ref); +mutex_lock (&ls->ls_cb_mutex);if (test_bit (LSFL_CB_DELAY , &ls->ls_flags)) { -mutex_lock (&ls->ls_cb_mutex);list_add (&lkb->lkb_cb_list, &ls->ls_cb_delay); -mutex_unlock (&ls->ls_cb_mutex); }else {queue_work (ls->ls_callback_wq, &lkb->lkb_cb_work); } +mutex_unlock (&ls->ls_cb_mutex); } out:mutex_unlock (&lkb->lkb_cb_mutex);
@@ -286,7 +286,9 @@ void dlm_callback_stop(struct dlm_ls *lsvoid dlm_callback_suspend (struct dlm_ls *ls) { +mutex_lock (&ls->ls_cb_mutex);set_bit (LSFL_CB_DELAY , &ls->ls_flags); +mutex_unlock (&ls->ls_cb_mutex);if (ls->ls_callback_wq)flush_workqueue (ls->ls_callback_wq);
Greg Kroah-Hartman
maintainerPATCH 45/229 fs: dlm: handle -EBUSY first in lock arg validation
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
commit 44637ca41d551d409a481117b07fa209b330fca9 upstream.
During lock arg validation, first check for -EBUSY cases, then for -EINVAL cases. The -EINVAL checks look at lkb state variables which are not stable when an lkb is busy and would cause an -EBUSY result, e.g. lkb->lkb_grmode.
--- fs/dlm/lock.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
fs/dlm/lock.c +8 -8
@@ -2890,24 +2890,24 @@ static int set_unlock_args(uint32_t flagstatic int validate_lock_args (struct dlm_ls *ls,struct dlm_lkb *lkb,struct dlm_args *args) { -int rv = -EINVAL ; +int rv = -EBUSY ;if (args->flags &DLM_LKF_CONVERT ) { -if (lkb->lkb_flags &DLM_IFL_MSTCPY ) +if (lkb->lkb_status !=DLM_LKSTS_GRANTED ) goto out; -if (args->flags &DLM_LKF_QUECVT && - !__quecvt_compat_matrix[lkb->lkb_grmode+1 ][args->mode+1 ]) +if (lkb->lkb_wait_type) goto out; - rv = -EBUSY ; -if (lkb->lkb_status !=DLM_LKSTS_GRANTED ) +if (is_overlap (lkb)) goto out; -if (lkb->lkb_wait_type) + rv = -EINVAL ; +if (lkb->lkb_flags &DLM_IFL_MSTCPY ) goto out; -if (is_overlap (lkb)) +if (args->flags &DLM_LKF_QUECVT && + !__quecvt_compat_matrix[lkb->lkb_grmode+1 ][args->mode+1 ]) goto out; }
Greg Kroah-Hartman
maintainerPATCH 46/229 HID: multitouch: Add memory barriers
In reply to Greg Kroah-HartmanFrom: Andri Yngvason <[email protected]>
commit be6e2b5734a425941fcdcdbd2a9337be498ce2cf upstream.
This fixes broken atomic checks which cause a race between the release-timer and processing of hid input.
I noticed that contacts were sometimes sticking, even with the "sticky fingers" quirk enabled. This fixes that problem.
--- drivers/hid/hid-multitouch.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/hid/hid-multitouch.c +4 -4
@@ -1154,7 +1154,7 @@ static void mt_touch_report(struct hid_dint contact_count =-1 ;/* sticky fingers release in progress, abort */ -if (test_and_set_bit (MT_IO_FLAGS_RUNNING , &td->mt_io_flags)) +if (test_and_set_bit_lock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags))return ; scantime = *app->scantime;
@@ -1235,7 +1235,7 @@ static void mt_touch_report(struct hid_ddel_timer (&td->release_timer); } -clear_bit (MT_IO_FLAGS_RUNNING , &td->mt_io_flags); +clear_bit_unlock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags); } static int mt_touch_input_configured(struct hid_device *hdev,
@@ -1672,11 +1672,11 @@ static void mt_expired_timeout(struct ti* An input report came in just before we release the sticky fingers, * it will take care of the sticky fingers. */ -if (test_and_set_bit (MT_IO_FLAGS_RUNNING , &td->mt_io_flags)) +if (test_and_set_bit_lock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags))return ;if (test_bit (MT_IO_FLAGS_PENDING_SLOTS , &td->mt_io_flags))mt_release_contacts (hdev); -clear_bit (MT_IO_FLAGS_RUNNING , &td->mt_io_flags); +clear_bit_unlock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags); }static int mt_probe (struct hid_device *hdev,const struct hid_device_id *id)
Greg Kroah-Hartman
maintainerPATCH 47/229 quota: Check next/prev free block number after reading from quota file
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
commit 6c8ea8b8cd4722efd419f91ca46a2dc81b7d89a3 upstream.
Following process:
Init: v2_read_file_info: <3> dqi_free_blk 0 dqi_free_entry 5 dqi_blks 6
Step 1. chown bin f_a -> dquot_acquire -> v2_write_dquot:
qtree_write_dquot
do_insert_tree
find_free_dqentry
get_free_dqblk
write_blk(info->dqi_blocks) // info->dqi_blocks = 6, failure. The
content in physical block (corresponding to blk 6) is random.
Step 2. chown root f_a -> dquot_transfer -> dqput_all -> dqput ->
ext4_release_dquot -> v2_release_dquot -> qtree_delete_dquot:
dquot_release
remove_tree
free_dqentry
put_free_dqblk(6)
info->dqi_free_blk = blk // info->dqi_free_blk = 6Step 3. drop cache (buffer head for block 6 is released)
Step 4. chown bin f_b -> dquot_acquire -> commit_dqblk -> v2_write_dquot:
qtree_write_dquot
do_insert_tree
find_free_dqentry
get_free_dqblk
dh = (struct qt_disk_dqdbheader *)buf
blk = info->dqi_free_blk // 6
ret = read_blk(info, blk, buf) // The content of buf is random info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free) // random blk
Step 5. chown bin f_c -> notify_change -> ext4_setattr -> dquot_transfer:
dquot = dqget -> acquire_dquot -> ext4_acquire_dquot -> dquot_acquire ->
commit_dqblk -> v2_write_dquot -> dq_insert_tree:
do_insert_tree
find_free_dqentry
get_free_dqblk
blk = info->dqi_free_blk // If blk < 0 and blk is not an error
code, it will be returned as dquot
transfer_to[USRQUOTA] = dquot // A random negative value __dquot_transfer(transfer_to)
dquot_add_inodes(transfer_to[cnt])
spin_lock(&dquot->dq_dqb_lock) // page fault
, which will lead to kernel page fault:
Quota error (device sda): qtree_write_dquot: Error -8000 occurred while creating quota
BUG: unable to handle page fault for address: ffffffffffffe120 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 5974 Comm: chown Not tainted 6.0.0-rc1-00004 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:_raw_spin_lock+0x3a/0x90 Call Trace: dquot_add_inodes+0x28/0x270 __dquot_transfer+0x377/0x840 dquot_transfer+0xde/0x540 ext4_setattr+0x405/0x14d0 notify_change+0x68e/0x9f0 chown_common+0x300/0x430 __x64_sys_fchownat+0x29/0x40
In order to avoid accessing invalid quota memory address, this patch adds block number checking of next/prev free block read from quota file.
Fetch a reproducer in [Link].
--- fs/quota/quota_tree.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+)
fs/quota/quota_tree.c +38 -0
@@ -79,6 +79,35 @@ static ssize_t write_blk(struct qtree_mereturn ret; } +static inline int do_check_range (struct super_block *sb,const char *val_name, +uint val,uint min_val,uint max_val) +{ +if (val < min_val || val > max_val) { +quota_error (sb,"Getting %s %u out of range %u-%u" , + val_name, val, min_val, max_val); +return -EUCLEAN ; + } + +return 0 ; +} + +static int check_dquot_block_header (struct qtree_mem_dqinfo *info, +struct qt_disk_dqdbheader *dh) +{ +int err =0 ; + + err =do_check_range (info->dqi_sb,"dqdh_next_free" , +le32_to_cpu (dh->dqdh_next_free),0 , + info->dqi_blocks -1 ); +if (err) +return err; + err =do_check_range (info->dqi_sb,"dqdh_prev_free" , +le32_to_cpu (dh->dqdh_prev_free),0 , + info->dqi_blocks -1 ); + +return err; +} +/* Remove empty block from list and return it */ static int get_free_dqblk (struct qtree_mem_dqinfo *info) {
@@ -93,6 +122,9 @@ static int get_free_dqblk(struct qtree_m ret =read_blk (info, blk, buf);if (ret <0 ) goto out_buf; + ret =check_dquot_block_header (info, dh); +if (ret) + goto out_buf; info->dqi_free_blk =le32_to_cpu (dh->dqdh_next_free); }else {
@@ -240,6 +272,9 @@ static uint find_free_dqentry(struct qtr *err =read_blk (info, blk, buf);if (*err <0 ) goto out_buf; + *err =check_dquot_block_header (info, dh); +if (*err) + goto out_buf; }else { blk =get_free_dqblk (info);if ((int )blk <0 ) {
@@ -432,6 +467,9 @@ static int free_dqentry(struct qtree_mem goto out_buf; } dh = (struct qt_disk_dqdbheader *)buf; + ret =check_dquot_block_header (info, dh); +if (ret) + goto out_buf;le16_add_cpu (&dh->dqdh_entries,-1 );if (!le16_to_cpu (dh->dqdh_entries)) {/* Block got free? */ ret =remove_free_dqentry (info, buf, blk);
Greg Kroah-Hartman
maintainerPATCH 48/229 regulator: qcom_rpm: Fix circular deferral regression
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit 8478ed5844588703a1a4c96a004b1525fbdbdd5e upstream.
On recent kernels, the PM8058 L16 (or any other PM8058 LDO-regulator) does not come up if they are supplied by an SMPS-regulator. This is not very strange since the regulators are registered in a long array and the L-regulators are registered before the S-regulators, and if an L-regulator defers, it will never get around to registering the S-regulator that it needs.
See arch/arm/boot/dts/qcom-apq8060-dragonboard.dts:
pm8058-regulators {
(...)
vdd_l13_l16-supply = <&pm8058_s4>;
(...)Ooops.
Fix this by moving the PM8058 S-regulators first in the array.
Do the same for the PM8901 S-regulators (though this is currently not causing any problems with out device trees) so that the pattern of registration order is the same on all PMnnnn chips.
--- drivers/regulator/qcom_rpm-regulator.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/regulator/qcom_rpm-regulator.c +12 -12
@@ -820,6 +820,12 @@ static const struct rpm_regulator_data r };static const struct rpm_regulator_data rpm_pm8058_regulators[] = { + {"s0" ,QCOM_RPM_PM8058_SMPS0 , &pm8058_smps,"vdd_s0" }, + {"s1" ,QCOM_RPM_PM8058_SMPS1 , &pm8058_smps,"vdd_s1" }, + {"s2" ,QCOM_RPM_PM8058_SMPS2 , &pm8058_smps,"vdd_s2" }, + {"s3" ,QCOM_RPM_PM8058_SMPS3 , &pm8058_smps,"vdd_s3" }, + {"s4" ,QCOM_RPM_PM8058_SMPS4 , &pm8058_smps,"vdd_s4" }, + {"l0" ,QCOM_RPM_PM8058_LDO0 , &pm8058_nldo,"vdd_l0_l1_lvs" }, {"l1" ,QCOM_RPM_PM8058_LDO1 , &pm8058_nldo,"vdd_l0_l1_lvs" }, {"l2" ,QCOM_RPM_PM8058_LDO2 , &pm8058_pldo,"vdd_l2_l11_l12" },
@@ -847,12 +853,6 @@ static const struct rpm_regulator_data r { "l24", QCOM_RPM_PM8058_LDO24, &pm8058_nldo, "vdd_l23_l24_l25" }, { "l25", QCOM_RPM_PM8058_LDO25, &pm8058_nldo, "vdd_l23_l24_l25" }, - { "s0", QCOM_RPM_PM8058_SMPS0, &pm8058_smps, "vdd_s0" }, - { "s1", QCOM_RPM_PM8058_SMPS1, &pm8058_smps, "vdd_s1" }, - { "s2", QCOM_RPM_PM8058_SMPS2, &pm8058_smps, "vdd_s2" }, - { "s3", QCOM_RPM_PM8058_SMPS3, &pm8058_smps, "vdd_s3" }, - { "s4", QCOM_RPM_PM8058_SMPS4, &pm8058_smps, "vdd_s4" }, - { "lvs0", QCOM_RPM_PM8058_LVS0, &pm8058_switch, "vdd_l0_l1_lvs" }, { "lvs1", QCOM_RPM_PM8058_LVS1, &pm8058_switch, "vdd_l0_l1_lvs" },
@@ -861,6 +861,12 @@ static const struct rpm_regulator_data r };static const struct rpm_regulator_data rpm_pm8901_regulators[] = { + {"s0" ,QCOM_RPM_PM8901_SMPS0 , &pm8901_ftsmps,"vdd_s0" }, + {"s1" ,QCOM_RPM_PM8901_SMPS1 , &pm8901_ftsmps,"vdd_s1" }, + {"s2" ,QCOM_RPM_PM8901_SMPS2 , &pm8901_ftsmps,"vdd_s2" }, + {"s3" ,QCOM_RPM_PM8901_SMPS3 , &pm8901_ftsmps,"vdd_s3" }, + {"s4" ,QCOM_RPM_PM8901_SMPS4 , &pm8901_ftsmps,"vdd_s4" }, + {"l0" ,QCOM_RPM_PM8901_LDO0 , &pm8901_nldo,"vdd_l0" }, {"l1" ,QCOM_RPM_PM8901_LDO1 , &pm8901_pldo,"vdd_l1" }, {"l2" ,QCOM_RPM_PM8901_LDO2 , &pm8901_pldo,"vdd_l2" },
@@ -869,12 +875,6 @@ static const struct rpm_regulator_data r { "l5", QCOM_RPM_PM8901_LDO5, &pm8901_pldo, "vdd_l5" }, { "l6", QCOM_RPM_PM8901_LDO6, &pm8901_pldo, "vdd_l6" }, - { "s0", QCOM_RPM_PM8901_SMPS0, &pm8901_ftsmps, "vdd_s0" }, - { "s1", QCOM_RPM_PM8901_SMPS1, &pm8901_ftsmps, "vdd_s1" }, - { "s2", QCOM_RPM_PM8901_SMPS2, &pm8901_ftsmps, "vdd_s2" }, - { "s3", QCOM_RPM_PM8901_SMPS3, &pm8901_ftsmps, "vdd_s3" }, - { "s4", QCOM_RPM_PM8901_SMPS4, &pm8901_ftsmps, "vdd_s4" }, - { "lvs0", QCOM_RPM_PM8901_LVS0, &pm8901_switch, "lvs0_in" }, { "lvs1", QCOM_RPM_PM8901_LVS1, &pm8901_switch, "lvs1_in" }, { "lvs2", QCOM_RPM_PM8901_LVS2, &pm8901_switch, "lvs2_in" },
Greg Kroah-Hartman
maintainerPATCH 49/229 Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
In reply to Greg Kroah-HartmanThis reverts commit fd0a6e99b61e6c08fa5cf585d54fd956f70c73a6.
Which was upstream commit 97ef77c52b789ec1411d360ed99dca1efe4b2c81.
The commit is missing dependencies and breaks NFS tests, remove it for now.
--- fs/splice.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/splice.c +6 -4
@@ -899,15 +899,17 @@ ssize_t splice_direct_to_actor(struct fi {struct pipe_inode_info *pipe;long ret, bytes; +umode_t i_mode;size_t len;int i, flags, more;/* -* We require the input to be seekable, as we don't want to randomly -* drop data for eg socket -> socket splicing. Use the piped splicing -* for that! +* We require the input being a regular file, as we don't want to +* randomly drop data for eg socket -> socket splicing. Use the +* piped splicing for that! */ -if (unlikely (!(in->f_mode &FMODE_LSEEK ))) + i_mode =file_inode (in)->i_mode; +if (unlikely (!S_ISREG (i_mode) && !S_ISBLK (i_mode)))return -EINVAL ;/*
Greg Kroah-Hartman
maintainerPATCH 50/229 parisc: fbdev/stifb: Align graphics memory size to 4MB
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit aca7c13d3bee81a968337a5515411409ae9d095d upstream.
Independend of the current graphics resolution, adjust the reported graphics card memory size to the next 4MB boundary.
This fixes the fbtest program which expects a naturally aligned size.
--- drivers/video/fbdev/stifb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/stifb.c +1 -1
@@ -1257,7 +1257,7 @@ static int __init stifb_init_fb(struct s/* limit fbsize to max visible screen size */ if (fix->smem_len > yres*fix->line_length) - fix->smem_len = yres*fix->line_length; + fix->smem_len =ALIGN (yres*fix->line_length,4 *1024 *1024 ); fix->accel =FB_ACCEL_NONE ;
Greg Kroah-Hartman
maintainerPATCH 51/229 riscv: Allow PROT_WRITE-only mmap()
In reply to Greg Kroah-HartmanFrom: Andrew Bresticker <[email protected]>
commit 9e2e6042a7ec6504fe8e366717afa2f40cf16488 upstream.
Commit 2139619bcad7 ("riscv: mmap with PROT_WRITE but no PROT_READ is invalid") made mmap() return EINVAL if PROT_WRITE was set wihtout PROT_READ with the justification that a write-only PTE is considered a reserved PTE permission bit pattern in the privileged spec. This check is unnecessary since we let VM_WRITE imply VM_READ on RISC-V, and it is inconsistent with other architectures that don't support write-only PTEs, creating a potential software portability issue. Just remove the check altogether and let PROT_WRITE imply PROT_READ as is the case on other architectures.
Note that this also allows PROT_WRITE|PROT_EXEC mappings which were disallowed prior to the aforementioned commit; PROT_READ is implied in such mappings as well.
--- arch/riscv/kernel/sys_riscv.c | 3 --- 1 file changed, 3 deletions(-)
arch/riscv/kernel/sys_riscv.c +0 -3
@@ -26,9 +26,6 @@ static long riscv_sys_mmap(unsigned longif (unlikely (offset & (~PAGE_MASK >> page_shift_offset)))return -EINVAL ; -if (unlikely ((prot &PROT_WRITE ) && !(prot &PROT_READ ))) -return -EINVAL ; -return ksys_mmap_pgoff (addr, len, prot, flags, fd, offset >> (PAGE_SHIFT - page_shift_offset)); }
Greg Kroah-Hartman
maintainerPATCH 52/229 UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
commit 16c546e148fa6d14a019431436a6f7b4087dbccd upstream.
When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected, cpu_max_bits_warn() generates a runtime warning similar as below while we show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs.
[ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]---
--- arch/um/kernel/um_arch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/um/kernel/um_arch.c +1 -1
@@ -77,7 +77,7 @@ static int show_cpuinfo(struct seq_filestatic void *c_start (struct seq_file *m,loff_t *pos) { -return *pos <NR_CPUS ? cpu_data + *pos :NULL ; +return *pos < nr_cpu_ids ? cpu_data + *pos :NULL ; }static void *c_next (struct seq_file *m,void *v,loff_t *pos)
Greg Kroah-Hartman
maintainerPATCH 53/229 PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 0e32818397426a688f598f35d3bc762eca6d7592 upstream.
When pci_assign_resource() is unable to assign resources to a BAR, it uses pci_revert_fw_address() to fall back to a firmware assignment (if any). Previously pci_revert_fw_address() assumed all addresses could reach the device, but this is not true if the device is below a bridge that only forwards addresses within its windows.
This problem was observed on a Tyan Tomcat IV S1564D system where the BIOS did not assign valid addresses to several bridges and USB devices:
pci 0000:00:11.0: PCI-to-PCIe bridge to [bus 01-ff]
pci 0000:00:11.0: bridge window [io 0xe000-0xefff]
pci 0000:01:00.0: PCIe Upstream Port to [bus 02-ff]
pci 0000:01:00.0: bridge window [io 0x0000-0x0fff] # unreachable
pci 0000:02:02.0: PCIe Downstream Port to [bus 05-ff]
pci 0000:02:02.0: bridge window [io 0x0000-0x0fff] # unreachable
pci 0000:05:00.0: PCIe-to-PCI bridge to [bus 06-ff]
pci 0000:05:00.0: bridge window [io 0x0000-0x0fff] # unreachable
pci 0000:06:08.0: USB UHCI 1.1
pci 0000:06:08.0: BAR 4: [io 0xfce0-0xfcff] # unreachable
pci 0000:06:08.1: USB UHCI 1.1
pci 0000:06:08.1: BAR 4: [io 0xfce0-0xfcff] # unreachable
pci 0000:06:08.0: can't claim BAR 4 [io 0xfce0-0xfcff]: no compatible bridge window pci 0000:06:08.1: can't claim BAR 4 [io 0xfce0-0xfcff]: no compatible bridge window
During the first pass of assigning unassigned resources, there was not enough I/O space available, so we couldn't assign the 06:08.0 BAR and reverted to the firmware assignment (still unreachable). Reverting the 06:08.1 assignment failed because it conflicted with 06:08.0:
pci 0000:00:11.0: bridge window [io 0xe000-0xefff]
pci 0000:01:00.0: no space for bridge window [io size 0x2000] pci 0000:02:02.0: no space for bridge window [io size 0x1000] pci 0000:05:00.0: no space for bridge window [io size 0x1000]
pci 0000:06:08.0: BAR 4: no space for [io size 0x0020]
pci 0000:06:08.0: BAR 4: trying firmware assignment [io 0xfce0-0xfcff]
pci 0000:06:08.1: BAR 4: no space for [io size 0x0020]
pci 0000:06:08.1: BAR 4: trying firmware assignment [io 0xfce0-0xfcff]
pci 0000:06:08.1: BAR 4: [io 0xfce0-0xfcff] conflicts with 0000:06:08.0 [io 0xfce0-0xfcff]
A subsequent pass assigned valid bridge windows and a valid 06:08.1 BAR, but left the 06:08.0 BAR alone, so the UHCI device was still unusable:
pci 0000:00:11.0: bridge window [io 0xe000-0xefff] released pci 0000:00:11.0: bridge window [io 0x1000-0x2fff] # reassigned pci 0000:01:00.0: bridge window [io 0x1000-0x2fff] # reassigned pci 0000:02:02.0: bridge window [io 0x2000-0x2fff] # reassigned pci 0000:05:00.0: bridge window [io 0x2000-0x2fff] # reassigned pci 0000:06:08.0: BAR 4: assigned [io 0xfce0-0xfcff] # left alone pci 0000:06:08.1: BAR 4: assigned [io 0x2000-0x201f]
...
uhci_hcd 0000:06:08.0: host system error, PCI problems?
uhci_hcd 0000:06:08.0: host controller process error, something bad happened! uhci_hcd 0000:06:08.0: host controller halted, very bad! uhci_hcd 0000:06:08.0: HCRESET not completed yet!
uhci_hcd 0000:06:08.0: HC died; cleaning up
If the address assigned by firmware is not reachable because it's not within upstream bridge windows, fail instead of assigning the unusable address from firmware.
--- drivers/pci/setup-res.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/pci/setup-res.c +11 -0
@@ -209,6 +209,17 @@ static int pci_revert_fw_address(struct root =pci_find_parent_resource (dev, res);if (!root) { +/* +* If dev is behind a bridge, accesses will only reach it +* if res is inside the relevant bridge window. +*/ +if (pci_upstream_bridge (dev)) +return -ENXIO ; + +/* +* On the root bus, assume the host bridge will forward +* everything. +*/ if (res->flags &IORESOURCE_IO ) root = &ioport_resource;else
Greg Kroah-Hartman
maintainerPATCH 54/229 fbdev: smscufx: Fix use-after-free in ufx_ops_open()
In reply to Greg Kroah-HartmanFrom: Hyunwoo Kim <[email protected]>
commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c upstream.
A race condition may occur if the user physically removes the USB device while calling open() for this device node.
This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF.
So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions to avoid race contidion of krefs.
--- drivers/video/fbdev/smscufx.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/video/fbdev/smscufx.c +13 -1
@@ -140,6 +140,8 @@ static int ufx_submit_urb(struct ufx_datstatic int ufx_alloc_urb_list (struct ufx_data *dev,int count,size_t size);static void ufx_free_urb_list (struct ufx_data *dev); +static DEFINE_MUTEX (disconnect_mutex); +/* reads a control register */ static int ufx_reg_read (struct ufx_data *dev,u32 index,u32 *data) {
@@ -1073,9 +1075,13 @@ static int ufx_ops_open(struct fb_info *if (user ==0 && !console)return -EBUSY ; +mutex_lock (&disconnect_mutex); +/* If the USB device is gone, we don't accept new opens */ -if (dev->virtualized) +if (dev->virtualized) { +mutex_unlock (&disconnect_mutex);return -ENODEV ; + } dev->fb_count++;
@@ -1099,6 +1105,8 @@ static int ufx_ops_open(struct fb_info *pr_debug ("open /dev/fb%d user=%d fb_info=%p count=%d" , info->node, user, info, dev->fb_count); +mutex_unlock (&disconnect_mutex); +return 0 ; }
@@ -1746,6 +1754,8 @@ static void ufx_usb_disconnect(struct us {struct ufx_data *dev; +mutex_lock (&disconnect_mutex); + dev =usb_get_intfdata (interface);pr_debug ("USB disconnect starting\n" );
@@ -1766,6 +1776,8 @@ static void ufx_usb_disconnect(struct uskref_put (&dev->kref, ufx_free);/* consider ufx_data freed */ + +mutex_unlock (&disconnect_mutex); }static struct usb_driver ufx_driver = {
Greg Kroah-Hartman
maintainerPATCH 55/229 btrfs: fix race between quota enable and quota rescan ioctl
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 331cd9461412e103d07595a10289de90004ac890 upstream.
When enabling quotas, at btrfs_quota_enable(), after committing the transaction, we change fs_info->quota_root to point to the quota root we created and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try to start the qgroup rescan worker, first by initializing it with a call to qgroup_rescan_init() - however if that fails we end up freeing the quota root but we leave fs_info->quota_root still pointing to it, this can later result in a use-after-free somewhere else.
We have previously set the flags BTRFS_FS_QUOTA_ENABLED and BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at btrfs_quota_enable(), which is possible if someone already called the quota rescan ioctl, and therefore started the rescan worker.
So fix this by ignoring an -EINPROGRESS and asserting we can't get any other error.
--- fs/btrfs/qgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/btrfs/qgroup.c +15 -0
@@ -1035,6 +1035,21 @@ out_add_root: fs_info->qgroup_rescan_running = true;btrfs_queue_work (fs_info->qgroup_rescan_workers, &fs_info->qgroup_rescan_work); + }else { +/* +* We have set both BTRFS_FS_QUOTA_ENABLED and +* BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with +* -EINPROGRESS. That can happen because someone started the +* rescan worker by calling quota rescan ioctl before we +* attempted to initialize the rescan worker. Failure due to +* quotas disabled in the meanwhile is not possible, because +* we are holding a write lock on fs_info->subvol_sem, which +* is also acquired when disabling quotas. +* Ignore such error, and any other error would need to undo +* everything we did in the transaction we just committed. +*/ +ASSERT (ret == -EINPROGRESS ); + ret =0 ; } out_free_path:
Greg Kroah-Hartman
maintainerPATCH 56/229 riscv: fix build with binutils 2.38
In reply to Greg Kroah-HartmanFrom: Aurelien Jarno <[email protected]>
commit 6df2a016c0c8a3d0933ef33dd192ea6606b115e3 upstream.
Quoted 1 line
From version 2.38, binutils default to ISA spec version 20191213. This
means that the csr read/write (csrr*/csrw*) instructions and fence.i instruction has separated from the I extension, become two standalone
extensions: Zicsr and Zifencei. As the kernel uses those instruction, this causes the following build failure:
CC arch/riscv/kernel/vdso/vgettimeofday.o
<<BUILDDIR>>/arch/riscv/include/asm/vdso/gettimeofday.h: Assembler messages:
<<BUILDDIR>>/arch/riscv/include/asm/vdso/gettimeofday.h:71: Error: unrecognized opcode csrr a5,0xc01' <<BUILDDIR>>/arch/riscv/include/asm/vdso/gettimeofday.h:71: Error: unrecognized opcode csrr a5,0xc01' <<BUILDDIR>>/arch/riscv/include/asm/vdso/gettimeofday.h:71: Error: unrecognized opcode csrr a5,0xc01' <<BUILDDIR>>/arch/riscv/include/asm/vdso/gettimeofday.h:71: Error: unrecognized opcode csrr a5,0xc01'
The fix is to specify those extensions explicitely in -march. However as older binutils version do not support this, we first need to detect that.
--- arch/riscv/Makefile | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
arch/riscv/Makefile +9 -2
@@ -49,9 +49,16 @@ ifeq ($(CONFIG_RISCV_ISA_C),y) KBUILD_ARCH_C = c endif -KBUILD_AFLAGS += -march=$(KBUILD_MARCH)$(KBUILD_ARCH_A)fd$(KBUILD_ARCH_C) +# Newer binutils versions default to ISA spec version 20191213 which moves some +# instructions from the I extension to the Zicsr and Zifencei extensions. +toolchain-need-zicsr-zifencei := $(call cc-option-yn, -march=$(riscv-march-y)_zicsr_zifencei) +ifeq ($(toolchain-need-zicsr-zifencei),y) + KBUILD_ARCH_ZISCR_ZIFENCEI = _zicsr_zifencei +endif + +KBUILD_AFLAGS += -march=$(KBUILD_MARCH)$(KBUILD_ARCH_A)fd$(KBUILD_ARCH_C)$(KBUILD_ARCH_ZISCR_ZIFENCEI) -KBUILD_CFLAGS += -march=$(KBUILD_MARCH)$(KBUILD_ARCH_A)$(KBUILD_ARCH_C) +KBUILD_CFLAGS += -march=$(KBUILD_MARCH)$(KBUILD_ARCH_A)$(KBUILD_ARCH_C)$(KBUILD_ARCH_ZISCR_ZIFENCEI) KBUILD_CFLAGS += -mno-save-restore KBUILD_CFLAGS += -DCONFIG_PAGE_OFFSET=$(CONFIG_PAGE_OFFSET)
Greg Kroah-Hartman
maintainerPATCH 57/229 nilfs2: fix use-after-free bug of struct nilfs_root
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit d325dc6eb763c10f591c239550b8c7e5466a5d09 upstream.
If the beginning of the inode bitmap area is corrupted on disk, an inode with the same inode number as the root inode can be allocated and fail soon after. In this case, the subsequent call to nilfs_clear_inode() on that bogus root inode will wrongly decrement the reference counter of struct nilfs_root, and this will erroneously free struct nilfs_root, causing kernel oopses.
This fixes the problem by changing nilfs_new_inode() to skip reserved inode numbers while repairing the inode bitmap.
--- fs/nilfs2/inode.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
fs/nilfs2/inode.c +17 -1
@@ -340,6 +340,7 @@ struct inode *nilfs_new_inode(struct inostruct inode *inode;struct nilfs_inode_info *ii;struct nilfs_root *root; +struct buffer_head *bh;int err = -ENOMEM ;ino_t ino;
@@ -355,11 +356,26 @@ struct inode *nilfs_new_inode(struct ino ii->i_state =BIT (NILFS_I_NEW ); ii->i_root = root; - err =nilfs_ifile_create_inode (root->ifile, &ino, &ii->i_bh); + err =nilfs_ifile_create_inode (root->ifile, &ino, &bh);if (unlikely (err)) goto failed_ifile_create_inode;/* reference count of i_bh inherits from nilfs_mdt_read_block() */ +if (unlikely (ino <NILFS_USER_INO )) { +nilfs_msg (sb,KERN_WARNING , +"inode bitmap is inconsistent for reserved inodes" ); +do { +brelse (bh); + err =nilfs_ifile_create_inode (root->ifile, &ino, &bh); +if (unlikely (err)) + goto failed_ifile_create_inode; + }while (ino <NILFS_USER_INO ); + +nilfs_msg (sb,KERN_INFO , +"repaired inode bitmap for reserved inodes" ); + } + ii->i_bh = bh; +atomic64_inc (&root->inodes_count);inode_init_owner (inode, dir, mode); inode->i_ino = ino;
Greg Kroah-Hartman
maintainerPATCH 58/229 ext4: avoid crash when inline data creation follows DIO write
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 4bb26f2885ac6930984ee451b952c5a6042f2c0e upstream.
When inode is created and written to using direct IO, there is nothing to clear the EXT4_STATE_MAY_INLINE_DATA flag. Thus when inode gets truncated later to say 1 byte and written using normal write, we will try to store the data as inline data. This confuses the code later because the inode now has both normal block and inline data allocated and the confusion manifests for example as:
kernel BUG at fs/ext4/inode.c:2721!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 359 Comm: repro Not tainted 5.19.0-rc8-00001-g31ba1e3b8305-dirty #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 RIP: 0010:ext4_writepages+0x363d/0x3660 RSP: 0018:ffffc90000ccf260 EFLAGS: 00010293 RAX: ffffffff81e1abcd RBX: 0000008000000000 RCX: ffff88810842a180 RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000 RBP: ffffc90000ccf650 R08: ffffffff81e17d58 R09: ffffed10222c680b R10: dfffe910222c680c R11: 1ffff110222c680a R12: ffff888111634128 R13: ffffc90000ccf880 R14: 0000008410000000 R15: 0000000000000001 FS: 00007f72635d2640(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565243379180 CR3: 000000010aa74000 CR4: 0000000000150eb0 Call Trace: <TASK> do_writepages+0x397/0x640 filemap_fdatawrite_wbc+0x151/0x1b0 file_write_and_wait_range+0x1c9/0x2b0 ext4_sync_file+0x19e/0xa00 vfs_fsync_range+0x17b/0x190 ext4_buffered_write_iter+0x488/0x530 ext4_file_write_iter+0x449/0x1b90 vfs_write+0xbcd/0xf40 ksys_write+0x198/0x2c0 __x64_sys_write+0x7b/0x90 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>
Fix the problem by clearing EXT4_STATE_MAY_INLINE_DATA when we are doing direct IO write to a file.
--- fs/ext4/file.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/file.c +6 -0
@@ -501,6 +501,12 @@ loff_t ext4_llseek(struct file *file, loinode_unlock_shared (inode);break ; } +/* +* Make sure inline data cannot be created anymore since we are going +* to allocate blocks for DIO. We know the inode does not have any +* inline data now because ext4_dio_supported() checked for that. +*/ +ext4_clear_inode_state (inode,EXT4_STATE_MAY_INLINE_DATA );if (offset <0 )return offset;
Greg Kroah-Hartman
maintainerPATCH 59/229 ext4: fix null-ptr-deref in ext4_write_info
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
commit f9c1f248607d5546075d3f731e7607d5571f2b60 upstream.
I caught a null-ptr-deref bug as follows:
==================================================================
KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] CPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339 RIP: 0010:ext4_write_info+0x53/0x1b0 [...] Call Trace: dquot_writeback_dquots+0x341/0x9a0 ext4_sync_fs+0x19e/0x800 __sync_filesystem+0x83/0x100 sync_filesystem+0x89/0xf0 generic_shutdown_super+0x79/0x3e0 kill_block_super+0xa1/0x110 deactivate_locked_super+0xac/0x130 deactivate_super+0xb6/0xd0 cleanup_mnt+0x289/0x400 __cleanup_mnt+0x16/0x20 task_work_run+0x11c/0x1c0 exit_to_user_mode_prepare+0x203/0x210 syscall_exit_to_user_mode+0x5b/0x3a0 do_syscall_64+0x59/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ==================================================================
Above issue may happen as follows:
-------------------------------------exit_to_user_mode_prepare
task_work_run
__cleanup_mnt
cleanup_mnt
deactivate_super
deactivate_locked_super
kill_block_super
generic_shutdown_super
shrink_dcache_for_umount
dentry = sb->s_root
sb->s_root = NULL <--- Here set NULL
sync_filesystem
__sync_filesystem
sb->s_op->sync_fs > ext4_sync_fs
dquot_writeback_dquots
sb->dq_op->write_info > ext4_write_info
ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2)
d_inode(sb->s_root)
s_root->d_inode <--- Null pointer dereferenceTo solve this problem, we use ext4_journal_start_sb directly to avoid s_root being used.
--- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/super.c +1 -1
@@ -5721,7 +5721,7 @@ static int ext4_write_info(struct super_handle_t *handle;/* Data block + inode block */ - handle =ext4_journal_start (d_inode (sb->s_root),EXT4_HT_QUOTA ,2 ); + handle =ext4_journal_start_sb (sb,EXT4_HT_QUOTA ,2 );if (IS_ERR (handle))return PTR_ERR (handle); ret =dquot_commit_info (sb, type);
Greg Kroah-Hartman
maintainerPATCH 60/229 ext4: make ext4_lazyinit_thread freezable
In reply to Greg Kroah-HartmanFrom: Lalith Rajendran <[email protected]>
commit 3b575495ab8dbb4dbe85b4ac7f991693c3668ff5 upstream.
ext4_lazyinit_thread is not set freezable. Hence when the thread calls try_to_freeze it doesn't freeze during suspend and continues to send requests to the storage during suspend, resulting in suspend failures.
--- fs/ext4/super.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/super.c +1 -0
@@ -3112,6 +3112,7 @@ static int ext4_lazyinit_thread(void *arunsigned long next_wakeup, cur;BUG_ON (NULL == eli); +set_freezable (); cont_thread:while (true) {
Greg Kroah-Hartman
maintainerPATCH 61/229 ext4: place buffer head allocation before handle start
In reply to Greg Kroah-HartmanFrom: Jinke Han <[email protected]>
commit d1052d236eddf6aa851434db1897b942e8db9921 upstream.
In our product environment, we encounter some jbd hung waiting handles to stop while several writters were doing memory reclaim for buffer head allocation in delay alloc write path. Ext4 do buffer head allocation with holding transaction handle which may be blocked too long if the reclaim works not so smooth. According to our bcc trace, the reclaim time in buffer head allocation can reach 258s and the jbd transaction commit also take almost the same time meanwhile. Except for these extreme cases, we often see several seconds delays for cgroup memory reclaim on our servers. This is more likely to happen considering docker environment.
One thing to note, the allocation of buffer heads is as often as page allocation or more often when blocksize less than page size. Just like page cache allocation, we should also place the buffer head allocation before startting the handle.
--- fs/ext4/inode.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/ext4/inode.c +7 -0
@@ -1310,6 +1310,13 @@ retry_grab: page =grab_cache_page_write_begin (mapping, index, flags);if (!page)return -ENOMEM ; +/* +* The same as page allocation, we prealloc buffer heads before +* starting the handle. +*/ +if (!page_has_buffers (page)) +create_empty_buffers (page, inode->i_sb->s_blocksize,0 ); +unlock_page (page); retry_journal:
Greg Kroah-Hartman
maintainerPATCH 62/229 livepatch: fix race between fork and KLP transition
In reply to Greg Kroah-HartmanFrom: Rik van Riel <[email protected]>
commit 747f7a2901174c9afa805dddfb7b24db6f65e985 upstream.
The KLP transition code depends on the TIF_PATCH_PENDING and the task->patch_state to stay in sync. On a normal (forward) transition, TIF_PATCH_PENDING will be set on every task in the system, while on a reverse transition (after a failed forward one) first TIF_PATCH_PENDING will be cleared from every task, followed by it being set on tasks that need to be transitioned back to the original code.
However, the fork code copies over the TIF_PATCH_PENDING flag from the parent to the child early on, in dup_task_struct and setup_thread_stack. Much later, klp_copy_process will set child->patch_state to match that of the parent.
However, the parent's patch_state may have been changed by KLP loading or unloading since it was initially copied over into the child.
This results in the KLP code occasionally hitting this warning in klp_complete_transition:
for_each_process_thread(g, task) {
WARN_ON_ONCE(test_tsk_thread_flag(task, TIF_PATCH_PENDING));
task->patch_state = KLP_UNDEFINED;
}Set, or clear, the TIF_PATCH_PENDING flag in the child task depending on whether or not it is needed at the time klp_copy_process is called, at a point in copy_process where the tasklist_lock is held exclusively, preventing races with the KLP code.
The KLP code does have a few places where the state is changed without the tasklist_lock held, but those should not cause problems because klp_update_patch_state(current) cannot be called while the current task is in the middle of fork, klp_check_and_switch_task() which is called under the pi_lock, which prevents rescheduling, and manipulation of the patch state of idle tasks, which do not fork.
This should prevent this warning from triggering again in the future, and close the race for both normal and reverse transitions.
--- kernel/livepatch/transition.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
kernel/livepatch/transition.c +16 -2
@@ -563,9 +563,23 @@ void klp_reverse_transition(void)/* Called from copy_process() during fork */ void klp_copy_process (struct task_struct *child) { - child->patch_state = current->patch_state; -/* TIF_PATCH_PENDING gets copied in setup_thread_stack() */ +/* +* The parent process may have gone through a KLP transition since +* the thread flag was copied in setup_thread_stack earlier. Bring +* the task flag up to date with the parent here. +* +* The operation is serialized against all klp_*_transition() +* operations by the tasklist_lock. The only exception is +* klp_update_patch_state(current), but we cannot race with +* that because we are current. +*/ +if (test_tsk_thread_flag (current,TIF_PATCH_PENDING )) +set_tsk_thread_flag (child,TIF_PATCH_PENDING ); +else +clear_tsk_thread_flag (child,TIF_PATCH_PENDING ); + + child->patch_state = current->patch_state; }/*
Greg Kroah-Hartman
maintainerPATCH 63/229 ftrace: Properly unset FTRACE_HASH_FL_MOD
In reply to Greg Kroah-HartmanFrom: Zheng Yejian <[email protected]>
commit 0ce0638edf5ec83343302b884fa208179580700a upstream.
When executing following commands like what document said, but the log "#### all functions enabled ####" was not shown as expect:
1. Set a 'mod' filter:
$ echo 'write*:mod:ext3' > /sys/kernel/tracing/set_ftrace_filter
2. Invert above filter:
$ echo '!write*:mod:ext3' >> /sys/kernel/tracing/set_ftrace_filter
3. Read the file:
$ cat /sys/kernel/tracing/set_ftrace_filterBy some debugging, I found that flag FTRACE_HASH_FL_MOD was not unset after inversion like above step 2 and then result of ftrace_hash_empty() is incorrect.
--- kernel/trace/ftrace.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/trace/ftrace.c +6 -2
@@ -5054,8 +5054,12 @@ int ftrace_regex_release(struct inode *iif (filter_hash) { orig_hash = &iter->ops->func_hash->filter_hash; -if (iter->tr && !list_empty (&iter->tr->mod_trace)) - iter->hash->flags |=FTRACE_HASH_FL_MOD ; +if (iter->tr) { +if (list_empty (&iter->tr->mod_trace)) + iter->hash->flags &= ~FTRACE_HASH_FL_MOD ; +else + iter->hash->flags |=FTRACE_HASH_FL_MOD ; + } }else orig_hash = &iter->ops->func_hash->notrace_hash;
Greg Kroah-Hartman
maintainerPATCH 64/229 ring-buffer: Allow splice to read previous partially read pages
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit fa8f4a89736b654125fb254b0db753ac68a5fced upstream.
If a page is partially read, and then the splice system call is run against the ring buffer, it will always fail to read, no matter how much is in the ring buffer. That's because the code path for a partial read of the page does will fail if the "full" flag is set.
The splice system call wants full pages, so if the read of the ring buffer is not yet full, it should return zero, and the splice will block. But if a previous read was done, where the beginning has been consumed, it should still be given to the splice caller if the rest of the page has been written to.
This caused the splice command to never consume data in this scenario, and let the ring buffer just fill up and lose events.
--- kernel/trace/ring_buffer.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
kernel/trace/ring_buffer.c +9 -1
@@ -4770,7 +4770,15 @@ int ring_buffer_read_page(struct ring_buunsigned int pos =0 ;unsigned int size; -if (full) +/* +* If a full page is expected, this can still be returned +* if there's been a previous partial read and the +* rest of the page can be read and the commit page is off +* the reader page. +*/ +if (full && + (!read || (len < (commit - read)) || + cpu_buffer->reader_page == cpu_buffer->commit_page)) goto out_unlock;if (len > (commit - read))
Greg Kroah-Hartman
maintainerPATCH 65/229 ring-buffer: Check pending waiters when doing wake ups as well
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit ec0bbc5ec5664dcee344f79373852117dc672c86 upstream.
The wake up waiters only checks the "wakeup_full" variable and not the "full_waiters_pending". The full_waiters_pending is set when a waiter is added to the wait queue. The wakeup_full is only set when an event is triggered, and it clears the full_waiters_pending to avoid multiple calls to irq_work_queue().
The irq_work callback really needs to check both wakeup_full as well as full_waiters_pending such that this code can be used to wake up waiters when a file is closed that represents the ring buffer and the waiters need to be woken up.
--- kernel/trace/ring_buffer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/trace/ring_buffer.c +2 -1
@@ -542,8 +542,9 @@ static void rb_wake_up_waiters(struct ir struct rb_irq_work *rbwork = container_of(work, struct rb_irq_work, work);wake_up_all (&rbwork->waiters); -if (rbwork->wakeup_full) { +if (rbwork->full_waiters_pending || rbwork->wakeup_full) { rbwork->wakeup_full = false; + rbwork->full_waiters_pending = false;wake_up_all (&rbwork->full_waiters); } }
Greg Kroah-Hartman
maintainerPATCH 66/229 ring-buffer: Fix race between reset page and reading page
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit a0fcaaed0c46cf9399d3a2d6e0c87ddb3df0e044 upstream.
The ring buffer is broken up into sub buffers (currently of page size). Each sub buffer has a pointer to its "tail" (the last event written to the sub buffer). When a new event is requested, the tail is locally incremented to cover the size of the new event. This is done in a way that there is no need for locking.
If the tail goes past the end of the sub buffer, the process of moving to the next sub buffer takes place. After setting the current sub buffer to the next one, the previous one that had the tail go passed the end of the sub buffer needs to be reset back to the original tail location (before the new event was requested) and the rest of the sub buffer needs to be "padded".
The race happens when a reader takes control of the sub buffer. As readers do a "swap" of sub buffers from the ring buffer to get exclusive access to the sub buffer, it replaces the "head" sub buffer with an empty sub buffer that goes back into the writable portion of the ring buffer. This swap can happen as soon as the writer moves to the next sub buffer and before it updates the last sub buffer with padding.
Because the sub buffer can be released to the reader while the writer is still updating the padding, it is possible for the reader to see the event that goes past the end of the sub buffer. This can cause obvious issues.
To fix this, add a few memory barriers so that the reader definitely sees the updates to the sub buffer, and also waits until the writer has put back the "tail" of the sub buffer back to the last event that was written on it.
To be paranoid, it will only spin for 1 second, otherwise it will warn and shutdown the ring buffer code. 1 second should be enough as the writer does have preemption disabled. If the writer doesn't move within 1 second (with preemption disabled) something is horribly wrong. No interrupt should last 1 second!
--- kernel/trace/ring_buffer.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)
kernel/trace/ring_buffer.c +33 -0
@@ -2157,6 +2157,9 @@ rb_reset_tail(struct ring_buffer_per_cpu/* Mark the rest of the page with padding */ rb_event_set_padding (event); +/* Make sure the padding is visible before the write update */ +smp_wmb (); +/* Set the write back to the previous setting */ local_sub (length, &tail_page->write);return ;
@@ -2168,6 +2171,9 @@ rb_reset_tail(struct ring_buffer_per_cpu/* time delta must be non zero */ event->time_delta =1 ; +/* Make sure the padding is visible before the tail_page->write update */ +smp_wmb (); +/* Set write to end of buffer */ length = (tail + length) -BUF_PAGE_SIZE ;local_sub (length, &tail_page->write);
@@ -3813,6 +3819,33 @@ rb_get_reader_page(struct ring_buffer_pearch_spin_unlock (&cpu_buffer->lock);local_irq_restore (flags); +/* +* The writer has preempt disable, wait for it. But not forever +* Although, 1 second is pretty much "forever" +*/ +#define USECS_WAIT 1000000 +for (nr_loops =0 ; nr_loops <USECS_WAIT ; nr_loops++) { +/* If the write is past the end of page, a writer is still updating it */ +if (likely (!reader ||rb_page_write (reader) <=BUF_PAGE_SIZE )) +break ; + +udelay (1 ); + +/* Get the latest version of the reader write value */ +smp_rmb (); + } + +/* The writer is not moving forward? Something is wrong */ +if (RB_WARN_ON (cpu_buffer, nr_loops ==USECS_WAIT )) + reader =NULL ; + +/* +* Make sure we see any padding after the write update +* (see rb_reset_tail()) +*/ +smp_rmb (); + +return reader; }
Greg Kroah-Hartman
maintainerPATCH 67/229 KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
In reply to Greg Kroah-HartmanFrom: Michal Luczaj <[email protected]>
commit 6aa5c47c351b22c21205c87977c84809cd015fcf upstream.
The emulator checks the wrong variable while setting the CPU interruptibility state, the target segment is embedded in the instruction opcode, not the ModR/M register. Fix the condition.
--- arch/x86/kvm/emulate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/emulate.c +1 -1
@@ -1975,7 +1975,7 @@ static int em_pop_sreg(struct x86_emulatif (rc !=X86EMUL_CONTINUE )return rc; -if (ctxt->modrm_reg ==VCPU_SREG_SS ) +if (seg ==VCPU_SREG_SS ) ctxt->interruptibility =KVM_X86_SHADOW_INT_MOV_SS ;if (ctxt->op_bytes >2 )rsp_increment (ctxt, ctxt->op_bytes -2 );
Greg Kroah-Hartman
maintainerPATCH 68/229 KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit d953540430c5af57f5de97ea9e36253908204027 upstream.
Drop pending exceptions and events queued for re-injection when leaving nested guest mode, even if the "exit" is due to VM-Fail, SMI, or forced by host userspace. Failure to purge events could result in an event belonging to L2 being injected into L1.
This _should_ never happen for VM-Fail as all events should be blocked by nested_run_pending, but it's possible if KVM, not the L1 hypervisor, is the source of VM-Fail when running vmcs02.
SMI is a nop (barring unknown bugs) as recognition of SMI and thus entry to SMM is blocked by pending exceptions and re-injected events.
Forced exit is definitely buggy, but has likely gone unnoticed because userspace probably follows the forced exit with KVM_SET_VCPU_EVENTS (or some other ioctl() that purges the queue).
--- arch/x86/kvm/vmx.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
arch/x86/kvm/vmx.c +11 -8
@@ -13276,14 +13276,6 @@ static void prepare_vmcs12(struct kvm_vc*/ vmcs12_save_pending_event (vcpu, vmcs12); } - -/* -* Drop what we picked up for L2 via vmx_complete_interrupts. It is -* preserved above and would only end up incorrectly in L1. -*/ - vcpu->arch.nmi_injected = false; -kvm_clear_exception_queue (vcpu); -kvm_clear_interrupt_queue (vcpu); }/*
@@ -13617,6 +13609,17 @@ static void nested_vmx_vmexit(struct kvmnested_vmx_abort (vcpu,VMX_ABORT_SAVE_GUEST_MSR_FAIL ); } +/* +* Drop events/exceptions that were queued for re-injection to L2 +* (picked up via vmx_complete_interrupts()), as well as exceptions +* that were pending for L2. Note, this must NOT be hoisted above +* prepare_vmcs12(), events/exceptions queued for re-injection need to +* be captured in vmcs12 (see vmcs12_save_pending_event()). +*/ + vcpu->arch.nmi_injected = false; +kvm_clear_exception_queue (vcpu); +kvm_clear_interrupt_queue (vcpu); +vmx_switch_vmcs (vcpu, &vmx->vmcs01);vm_entry_controls_reset_shadow (vmx);vm_exit_controls_reset_shadow (vmx);
Greg Kroah-Hartman
maintainerPATCH 69/229 selinux: use "grep -E" instead of "egrep"
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit c969bb8dbaf2f3628927eae73e7c579a74cf1b6e upstream.
The latest version of grep claims that egrep is now obsolete so the build now contains warnings that look like:
egrep: warning: egrep is obsolescent; using grep -E
fix this by using "grep -E" instead.
--- scripts/selinux/install_policy.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/selinux/install_policy.sh +1 -1
@@ -57,7 +57,7 @@ fi cd /etc/selinux/dummy/contexts/files $SF file_contexts / -mounts=`cat /proc/$$/mounts | egrep "ext2|ext3|xfs|jfs|ext4|ext4dev|gfs2" | awk '{ print $2 '}` +mounts=`cat /proc/$$/mounts | grep -E "ext2|ext3|xfs|jfs|ext4|ext4dev|gfs2" | awk '{ print $2 '}` $SF file_contexts $mounts
Greg Kroah-Hartman
maintainerPATCH 70/229 sh: machvec: Use char[] for section boundaries
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit c5783af354688b24abd359f7086c282ec74de993 ]
As done for other sections, define the extern as a character array, which relaxes many of the compiler-time object size checks, which would otherwise assume it's a single long. Solves the following build error:
arch/sh/kernel/machvec.c: error: array subscript 'struct sh_machine_vector[0]' is partly outside array bounds of 'long int[1]' [-Werror=array-bounds]: => 105:33
--- arch/sh/include/asm/sections.h | 2 +- arch/sh/kernel/machvec.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-)
arch/sh/include/asm/sections.h +1 -1
@@ -4,7 +4,7 @@#include <asm-generic/sections.h> -extern long __machvec_start, __machvec_end; +extern char __machvec_start[], __machvec_end[];extern char __uncached_start, __uncached_end;extern char __start_eh_frame[], __stop_eh_frame[];
arch/sh/kernel/machvec.c +5 -5
@@ -22,8 +22,8 @@#define MV_NAME_SIZE 32#define for_each_mv (mv) \ - for ((mv) = (struct sh_machine_vector *)&__machvec_start; \ - (mv) && (unsigned long)(mv) < (unsigned long)&__machvec_end; \ + for ((mv) = (struct sh_machine_vector *)__machvec_start; \ + (mv) && (unsigned long)(mv) < (unsigned long)__machvec_end; \ (mv)++)static struct sh_machine_vector *__init get_mv_byname (const char *name)
@@ -89,8 +89,8 @@ void __init sh_mv_setup(void)if (!machvec_selected) {unsigned long machvec_size; - machvec_size = ((unsigned long )&__machvec_end - - (unsigned long )&__machvec_start); + machvec_size = ((unsigned long )__machvec_end - + (unsigned long )__machvec_start);/* * Sanity check for machvec section alignment. Ensure
@@ -104,7 +104,7 @@ void __init sh_mv_setup(void)* vector (usually the only one) from .machvec.init. */ if (machvec_size >=sizeof (struct sh_machine_vector )) - sh_mv = *(struct sh_machine_vector *)&__machvec_start; + sh_mv = *(struct sh_machine_vector *)__machvec_start; }printk (KERN_NOTICE "Booting machvec: %s\n" ,get_system_type ());
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 71/229 wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
In reply to Greg Kroah-HartmanFrom: Wen Gong <[email protected]>
[ Upstream commit f020d9570a04df0762a2ac5c50cf1d8c511c9164 ]
When peer delete failed in a disconnect operation, use-after-free detected by KFENCE in below log. It is because for each vdev_id and address, it has only one struct ath10k_peer, it is allocated in ath10k_peer_map_event(). When connected to an AP, it has more than one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the array peer_map of struct ath10k will be set muti-elements to the same ath10k_peer in ath10k_peer_map_event(). When peer delete failed in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer id in array peer_map of struct ath10k, and then use-after-free happened for the 2nd peer id because they map to the same ath10k_peer.
And clean up all peers in array peer_map for the ath10k_peer, then user-after-free disappeared
peer map event log:
[ 306.911021] wlan0: authenticate with b0:2a:43:e6:75:0e [ 306.957187] ath10k_pci 0000:01:00.0: mac vdev 0 peer create b0:2a:43:e6:75:0e (new sta) sta 1 / 32 peer 1 / 33 [ 306.957395] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 246 [ 306.957404] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 198 [ 306.986924] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 166
peer unmap event log:
[ 435.715691] wlan0: deauthenticating from b0:2a:43:e6:75:0e by local choice (Reason: 3=DEAUTH_LEAVING) [ 435.716802] ath10k_pci 0000:01:00.0: mac vdev 0 peer delete b0:2a:43:e6:75:0e sta ffff990e0e9c2b50 (sta gone) [ 435.717177] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 246 [ 435.717186] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 198 [ 435.717193] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 166
use-after-free log:
[21705.888627] wlan0: deauthenticating from d0:76:8f:82:be:75 by local choice (Reason: 3=DEAUTH_LEAVING) [21713.799910] ath10k_pci 0000:01:00.0: failed to delete peer d0:76:8f:82:be:75 for vdev 0: -110 [21713.799925] ath10k_pci 0000:01:00.0: found sta peer d0:76:8f:82:be:75 (ptr 0000000000000000 id 102) entry on vdev 0 after it was supposedly removed [21713.799968] ================================================================== [21713.799991] BUG: KFENCE: use-after-free read in ath10k_sta_state+0x265/0xb8a [ath10k_core] [21713.799991] [21713.799997] Use-after-free read at 0x00000000abe1c75e (in kfence-#69): [21713.800010] ath10k_sta_state+0x265/0xb8a [ath10k_core] [21713.800041] drv_sta_state+0x115/0x677 [mac80211] [21713.800059] __sta_info_destroy_part2+0xb1/0x133 [mac80211] [21713.800076] __sta_info_flush+0x11d/0x162 [mac80211] [21713.800093] ieee80211_set_disassoc+0x12d/0x2f4 [mac80211] [21713.800110] ieee80211_mgd_deauth+0x26c/0x29b [mac80211] [21713.800137] cfg80211_mlme_deauth+0x13f/0x1bb [cfg80211] [21713.800153] nl80211_deauthenticate+0xf8/0x121 [cfg80211] [21713.800161] genl_rcv_msg+0x38e/0x3be [21713.800166] netlink_rcv_skb+0x89/0xf7 [21713.800171] genl_rcv+0x28/0x36 [21713.800176] netlink_unicast+0x179/0x24b [21713.800181] netlink_sendmsg+0x3a0/0x40e [21713.800187] sock_sendmsg+0x72/0x76 [21713.800192] ____sys_sendmsg+0x16d/0x1e3 [21713.800196] ___sys_sendmsg+0x95/0xd1 [21713.800200] __sys_sendmsg+0x85/0xbf [21713.800205] do_syscall_64+0x43/0x55 [21713.800210] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [21713.800213] [21713.800219] kfence-#69: 0x000000009149b0d5-0x000000004c0697fb, size=1064, cache=kmalloc-2k [21713.800219] [21713.800224] allocated by task 13 on cpu 0 at 21705.501373s: [21713.800241] ath10k_peer_map_event+0x7e/0x154 [ath10k_core] [21713.800254] ath10k_htt_t2h_msg_handler+0x586/0x1039 [ath10k_core] [21713.800265] ath10k_htt_htc_t2h_msg_handler+0x12/0x28 [ath10k_core] [21713.800277] ath10k_htc_rx_completion_handler+0x14c/0x1b5 [ath10k_core] [21713.800283] ath10k_pci_process_rx_cb+0x195/0x1df [ath10k_pci] [21713.800294] ath10k_ce_per_engine_service+0x55/0x74 [ath10k_core] [21713.800305] ath10k_ce_per_engine_service_any+0x76/0x84 [ath10k_core] [21713.800310] ath10k_pci_napi_poll+0x49/0x144 [ath10k_pci] [21713.800316] net_rx_action+0xdc/0x361 [21713.800320] __do_softirq+0x163/0x29a [21713.800325] asm_call_irq_on_stack+0x12/0x20 [21713.800331] do_softirq_own_stack+0x3c/0x48 [21713.800337] __irq_exit_rcu+0x9b/0x9d [21713.800342] common_interrupt+0xc9/0x14d [21713.800346] asm_common_interrupt+0x1e/0x40 [21713.800351] ksoftirqd_should_run+0x5/0x16 [21713.800357] smpboot_thread_fn+0x148/0x211 [21713.800362] kthread+0x150/0x15f [21713.800367] ret_from_fork+0x22/0x30 [21713.800370] [21713.800374] freed by task 708 on cpu 1 at 21713.799953s: [21713.800498] ath10k_sta_state+0x2c6/0xb8a [ath10k_core] [21713.800515] drv_sta_state+0x115/0x677 [mac80211] [21713.800532] __sta_info_destroy_part2+0xb1/0x133 [mac80211] [21713.800548] __sta_info_flush+0x11d/0x162 [mac80211] [21713.800565] ieee80211_set_disassoc+0x12d/0x2f4 [mac80211] [21713.800581] ieee80211_mgd_deauth+0x26c/0x29b [mac80211] [21713.800598] cfg80211_mlme_deauth+0x13f/0x1bb [cfg80211] [21713.800614] nl80211_deauthenticate+0xf8/0x121 [cfg80211] [21713.800619] genl_rcv_msg+0x38e/0x3be [21713.800623] netlink_rcv_skb+0x89/0xf7 [21713.800628] genl_rcv+0x28/0x36 [21713.800632] netlink_unicast+0x179/0x24b [21713.800637] netlink_sendmsg+0x3a0/0x40e [21713.800642] sock_sendmsg+0x72/0x76 [21713.800646] ____sys_sendmsg+0x16d/0x1e3 [21713.800651] ___sys_sendmsg+0x95/0xd1 [21713.800655] __sys_sendmsg+0x85/0xbf [21713.800659] do_syscall_64+0x43/0x55 [21713.800663] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1
--- drivers/net/wireless/ath/ath10k/mac.c | 54 ++++++++++++++------------- 1 file changed, 29 insertions(+), 25 deletions(-)
drivers/net/wireless/ath/ath10k/mac.c +29 -25
@@ -819,11 +819,36 @@ static int ath10k_peer_delete(struct ath10k *ar, u32 vdev_id, const u8 *addr)return 0 ; } +static void ath10k_peer_map_cleanup (struct ath10k *ar,struct ath10k_peer *peer) +{ +int peer_id, i; + +lockdep_assert_held (&ar->conf_mutex); + +for_each_set_bit (peer_id, peer->peer_ids, +ATH10K_MAX_NUM_PEER_IDS ) { + ar->peer_map[peer_id] =NULL ; + } + +/* Double check that peer is properly un-referenced from +* the peer_map +*/ +for (i =0 ; i <ARRAY_SIZE (ar->peer_map); i++) { +if (ar->peer_map[i] == peer) { +ath10k_warn (ar,"removing stale peer_map entry for %pM (ptr %pK idx %d)\n" , + peer->addr, peer, i); + ar->peer_map[i] =NULL ; + } + } + +list_del (&peer->list); +kfree (peer); + ar->num_peers--; +} +static void ath10k_peer_cleanup (struct ath10k *ar,u32 vdev_id) {struct ath10k_peer *peer, *tmp; -int peer_id; -int i;lockdep_assert_held (&ar->conf_mutex);
@@ -835,25 +860,7 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)ath10k_warn (ar,"removing stale peer %pM from vdev_id %d\n" , peer->addr, vdev_id); -for_each_set_bit (peer_id, peer->peer_ids, -ATH10K_MAX_NUM_PEER_IDS ) { - ar->peer_map[peer_id] =NULL ; - } - -/* Double check that peer is properly un-referenced from -* the peer_map -*/ -for (i =0 ; i <ARRAY_SIZE (ar->peer_map); i++) { -if (ar->peer_map[i] == peer) { -ath10k_warn (ar,"removing stale peer_map entry for %pM (ptr %pK idx %d)\n" , - peer->addr, peer, i); - ar->peer_map[i] =NULL ; - } - } - -list_del (&peer->list); -kfree (peer); - ar->num_peers--; +ath10k_peer_map_cleanup (ar, peer); }spin_unlock_bh (&ar->data_lock); }
@@ -6371,10 +6378,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,/* Clean up the peer object as well since we * must have failed to do this above. */ -list_del (&peer->list); - ar->peer_map[i] =NULL ; -kfree (peer); - ar->num_peers--; +ath10k_peer_map_cleanup (ar, peer); } }spin_unlock_bh (&ar->data_lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 72/229 wifi: mac80211: allow bw change during channel switch in mesh
In reply to Greg Kroah-HartmanFrom: Hari Chandrakanthan <[email protected]>
[ Upstream commit 6b75f133fe05c36c52d691ff21545d5757fff721 ]
Quoted 1 line
From 'IEEE Std 802.11-2020 section 11.8.8.4.1':
The mesh channel switch may be triggered by the need to avoid interference to a detected radar signal, or to reassign mesh STA channels to ensure the MBSS connectivity.
A 20/40 MHz MBSS may be changed to a 20 MHz MBSS and a 20 MHz MBSS may be changed to a 20/40 MHz MBSS.
Since the standard allows the change of bandwidth during the channel switch in mesh, remove the bandwidth check present in ieee80211_set_csa_beacon.
--- net/mac80211/cfg.c | 3 --- 1 file changed, 3 deletions(-)
net/mac80211/cfg.c +0 -3
@@ -3136,9 +3136,6 @@ static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata,case NL80211_IFTYPE_MESH_POINT : {struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; -if (params->chandef.width != sdata->vif.bss_conf.chandef.width) -return -EINVAL ; -/* changes into another band are not supported */ if (sdata->vif.bss_conf.chandef.chan->band != params->chandef.chan->band)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 73/229 bpftool: Fix a wrong type cast in btf_dumper_int
In reply to Greg Kroah-HartmanFrom: Lam Thai <[email protected]>
[ Upstream commit 7184aef9c0f7a81db8fd18d183ee42481d89bf35 ]
When data points to a boolean value, casting it to int * is problematic and could lead to a wrong value being passed to jsonw_bool. Change the cast to bool * instead.
--- tools/bpf/bpftool/btf_dumper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/bpf/bpftool/btf_dumper.c +1 -1
@@ -164,7 +164,7 @@ static int btf_dumper_int(const struct btf_type *t, __u8 bit_offset, *(char *)data);break ;case BTF_INT_BOOL : -jsonw_bool (jw, *(int *)data); +jsonw_bool (jw, *(bool *)data);break ;default :/* shouldn't happen */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 74/229 spi: mt7621: Fix an error message in mt7621_spi_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 2b2bf6b7faa9010fae10dc7de76627a3fdb525b3 ]
'status' is known to be 0 at this point. The expected error code is PTR_ERR(clk).
Switch to dev_err_probe() in order to display the expected error code (in a human readable way).
This also filters -EPROBE_DEFER cases, should it happen.
--- drivers/staging/mt7621-spi/spi-mt7621.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/staging/mt7621-spi/spi-mt7621.c +3 -5
@@ -442,11 +442,9 @@ static int mt7621_spi_probe(struct platform_device *pdev)return PTR_ERR (base); clk =devm_clk_get (&pdev->dev,NULL ); -if (IS_ERR (clk)) { -dev_err (&pdev->dev,"unable to get SYS clock, err=%d\n" , - status); -return PTR_ERR (clk); - } +if (IS_ERR (clk)) +return dev_err_probe (&pdev->dev,PTR_ERR (clk), +"unable to get SYS clock\n" ); status =clk_prepare_enable (clk);if (status)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 75/229 wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 620d5eaeb9059636864bda83ca1c68c20ede34a5 ]
There some bounds checking to ensure that "map_addr" is not out of bounds before the start of the loop. But the checking needs to be done as we iterate through the loop because "map_addr" gets larger as we iterate.
--- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +7 -7
@@ -1879,13 +1879,6 @@ static int rtl8xxxu_read_efuse(struct rtl8xxxu_priv *priv)/* We have 8 bits to indicate validity */ map_addr = offset *8 ; -if (map_addr >=EFUSE_MAP_LEN ) { -dev_warn (dev,"%s: Illegal map_addr (%04x), " -"efuse corrupt!\n" , - __func__, map_addr); - ret = -EINVAL ; - goto exit; - }for (i =0 ; i <EFUSE_MAX_WORD_UNIT ; i++) {/* Check word enable condition in the section */ if (word_mask &BIT (i)) {
@@ -1896,6 +1889,13 @@ static int rtl8xxxu_read_efuse(struct rtl8xxxu_priv *priv) ret =rtl8xxxu_read_efuse8 (priv, efuse_addr++, &val8);if (ret) goto exit; +if (map_addr >=EFUSE_MAP_LEN -1 ) { +dev_warn (dev,"%s: Illegal map_addr (%04x), " +"efuse corrupt!\n" , + __func__, map_addr); + ret = -EINVAL ; + goto exit; + } priv->efuse_wifi.raw[map_addr++] = val8; ret =rtl8xxxu_read_efuse8 (priv, efuse_addr++, &val8);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 76/229 spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
In reply to Greg Kroah-HartmanFrom: Xu Qiang <[email protected]>
[ Upstream commit 70034320fdc597b8f58b4a43bb547f17c4c5557a ]
Add the missing clk_disable_unprepare() before return from spi_qup_resume() in the error handling case.
--- drivers/spi/spi-qup.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
drivers/spi/spi-qup.c +14 -3
@@ -1219,14 +1219,25 @@ static int spi_qup_resume(struct device *device)return ret; ret =clk_prepare_enable (controller->cclk); -if (ret) +if (ret) { +clk_disable_unprepare (controller->iclk);return ret; + } ret =spi_qup_set_state (controller,QUP_STATE_RESET );if (ret) -return ret; + goto disable_clk; + + ret =spi_master_resume (master); +if (ret) + goto disable_clk; - return spi_master_resume(master); +return 0 ; + +disable_clk: +clk_disable_unprepare (controller->cclk); +clk_disable_unprepare (controller->iclk); + return ret; }#endif /* CONFIG_PM_SLEEP */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 77/229 spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
In reply to Greg Kroah-HartmanFrom: Xu Qiang <[email protected]>
[ Upstream commit 494a22765ce479c9f8ad181c5d24cffda9f534bb ]
Add the missing clk_disable_unprepare() before return from spi_qup_pm_resume_runtime() in the error handling case.
--- drivers/spi/spi-qup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/spi/spi-qup.c +3 -1
@@ -1172,8 +1172,10 @@ static int spi_qup_pm_resume_runtime(struct device *device)return ret; ret =clk_prepare_enable (controller->cclk); -if (ret) +if (ret) { +clk_disable_unprepare (controller->iclk);return ret; + }/* Disable clocks auto gaiting */ config =readl_relaxed (controller->base +QUP_CONFIG );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 78/229 wifi: rtl8xxxu: Fix skb misuse in TX queue selection
In reply to Greg Kroah-HartmanFrom: Bitterblue Smith <[email protected]>
[ Upstream commit edd5747aa12ed61a5ecbfa58d3908623fddbf1e8 ]
rtl8xxxu_queue_select() selects the wrong TX queues because it's reading memory from the wrong address. It expects to find ieee80211_hdr at skb->data, but that's not the case after skb_push(). Move the call to rtl8xxxu_queue_select() before the call to skb_push().
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +2 -1
@@ -4955,6 +4955,8 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw,if (control && control->sta) sta = control->sta; + queue =rtl8xxxu_queue_select (hw, skb); + tx_desc =skb_push (skb, tx_desc_size);memset (tx_desc,0 , tx_desc_size);
@@ -4967,7 +4969,6 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw, is_broadcast_ether_addr(ieee80211_get_DA(hdr))) tx_desc->txdw0 |= TXDESC_BROADMULTICAST; - queue =rtl8xxxu_queue_select (hw, skb); tx_desc->txdw1 =cpu_to_le32 (queue <<TXDESC_QUEUE_SHIFT );if (tx_info->control.hw_key) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 79/229 bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
In reply to Greg Kroah-HartmanFrom: Lorenz Bauer <[email protected]>
[ Upstream commit a37a32583e282d8d815e22add29bc1e91e19951a ]
When trying to finish resolving a struct member, btf_struct_resolve saves the member type id in a u16 temporary variable. This truncates the 32 bit type id value if it exceeds UINT16_MAX.
As a result, structs that have members with type ids > UINT16_MAX and which need resolution will fail with a message like this:
[67414] STRUCT ff_device size=120 vlen=12
effect_owners type_id=67434 bits_offset=960 Member exceeds struct_size
Fix this by changing the type of last_member_type_id to u32.
--- kernel/bpf/btf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/btf.c +1 -1
@@ -1660,7 +1660,7 @@ static int btf_struct_resolve(struct btf_verifier_env *env,if (v->next_member) {const struct btf_type *last_member_type;const struct btf_member *last_member; -u16 last_member_type_id; +u32 last_member_type_id; last_member =btf_type_member (v->t) + v->next_member -1 ; last_member_type_id = last_member->type;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 80/229 wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
In reply to Greg Kroah-HartmanFrom: Bitterblue Smith <[email protected]>
[ Upstream commit e963a19c64ac0d2f8785d36a27391abd91ac77aa ]
Found by comparing with the vendor driver. Currently this affects only the RTL8192EU, which is the only gen2 chip with 2 TX paths supported by this driver. It's unclear what kind of effect the mistake had in practice, since I don't have any RTL8192EU devices to test it.
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +2 -2
@@ -2930,12 +2930,12 @@ bool rtl8xxxu_gen2_simularity_compare(struct rtl8xxxu_priv *priv, }if (!(simubitmap &0x30 ) && priv->tx_paths >1 ) { -/* path B RX OK */ +/* path B TX OK */ for (i =4 ; i <6 ; i++) result[3 ][i] = result[c1][i]; } -if (!(simubitmap &0x30 ) && priv->tx_paths >1 ) { +if (!(simubitmap &0xc0 ) && priv->tx_paths >1 ) {/* path B RX OK */ for (i =6 ; i <8 ; i++) result[3 ][i] = result[c1][i];
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 81/229 net: fs_enet: Fix wrong check in do_pd_setup
In reply to Greg Kroah-HartmanFrom: Zheng Yongjun <[email protected]>
[ Upstream commit ec3f06b542a960806a81345042e4eee3f8c5dec4 ]
Should check of_iomap return value 'fep->fec.fecp' instead of 'fep->fcc.fccp'
--- drivers/net/ethernet/freescale/fs_enet/mac-fec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/fs_enet/mac-fec.c +1 -1
@@ -98,7 +98,7 @@ static int do_pd_setup(struct fs_enet_private *fep)return -EINVAL ; fep->fec.fecp =of_iomap (ofdev->dev.of_node,0 ); -if (!fep->fcc.fccp) +if (!fep->fec.fecp)return -EINVAL ;return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 82/229 bpf: Ensure correct locking around vulnerable function find_vpid()
In reply to Greg Kroah-HartmanFrom: Lee Jones <[email protected]>
[ Upstream commit 83c10cc362d91c0d8d25e60779ee52fdbbf3894d ]
The documentation for find_vpid() clearly states:
"Must be called with the tasklist_lock or rcu_read_lock() held."
Presently we do neither for find_vpid() instance in bpf_task_fd_query(). Add proper rcu_read_lock/unlock() to fix the issue.
--- kernel/bpf/syscall.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/bpf/syscall.c +2 -0
@@ -2325,7 +2325,9 @@ static int bpf_task_fd_query(const union bpf_attr *attr,if (attr->task_fd_query.flags !=0 )return -EINVAL ; +rcu_read_lock (); task =get_pid_task (find_vpid (pid),PIDTYPE_PID ); +rcu_read_unlock ();if (!task)return -ENOENT ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 83/229 spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 29f65f2171c85a9633daa380df14009a365f42f2 ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context.
--- drivers/spi/spi-omap-100k.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-omap-100k.c +1 -0
@@ -425,6 +425,7 @@ static int omap1_spi100k_probe(struct platform_device *pdev)return status; err_fck: +pm_runtime_disable (&pdev->dev);clk_disable_unprepare (spi100k->fck); err_ick:clk_disable_unprepare (spi100k->ick);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 84/229 netfilter: nft_fib: Fix for rpath check with VRF devices
In reply to Greg Kroah-HartmanFrom: Phil Sutter <[email protected]>
[ Upstream commit 2a8a7c0eaa8747c16aa4a48d573aa920d5c00a5c ]
Analogous to commit b575b24b8eee3 ("netfilter: Fix rpfilter dropping vrf packets by mistake") but for nftables fib expression:
Add special treatment of VRF devices so that typical reverse path filtering via 'fib saddr . iif oif' expression works as expected.
--- net/ipv4/netfilter/nft_fib_ipv4.c | 3 +++ net/ipv6/netfilter/nft_fib_ipv6.c | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-)
net/ipv4/netfilter/nft_fib_ipv4.c +3 -0
@@ -95,6 +95,9 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,else oif =NULL ; +if (priv->flags &NFTA_FIB_F_IIF ) + fl4.flowi4_oif =l3mdev_master_ifindex_rcu (oif); +if (nft_hook (pkt) ==NF_INET_PRE_ROUTING &&nft_fib_is_loopback (pkt->skb,nft_in (pkt))) { nft_fib_store_result(dest, priv, pkt,
net/ipv6/netfilter/nft_fib_ipv6.c +5 -1
@@ -41,6 +41,9 @@ static int nft_fib6_flowi_init(struct flowi6 *fl6, const struct nft_fib *priv,if (ipv6_addr_type (&fl6->daddr) &IPV6_ADDR_LINKLOCAL ) { lookup_flags |=RT6_LOOKUP_F_IFACE ; fl6->flowi6_oif =get_ifindex (dev ? dev : pkt->skb->dev); + }else if ((priv->flags &NFTA_FIB_F_IIF ) && + (netif_is_l3_master (dev) ||netif_is_l3_slave (dev))) { + fl6->flowi6_oif = dev->ifindex; }if (ipv6_addr_type (&fl6->saddr) &IPV6_ADDR_UNICAST )
@@ -189,7 +192,8 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,if (rt->rt6i_flags & (RTF_REJECT |RTF_ANYCAST |RTF_LOCAL )) goto put_rt_err; -if (oif && oif != rt->rt6i_idev->dev) +if (oif && oif != rt->rt6i_idev->dev && +l3mdev_master_ifindex_rcu (rt->rt6i_idev->dev) != oif->ifindex) goto put_rt_err;switch (priv->result) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 85/229 spi: s3c64xx: Fix large transfers with DMA
In reply to Greg Kroah-HartmanFrom: Vincent Whitchurch <[email protected]>
[ Upstream commit 1224e29572f655facfcd850cf0f0a4784f36a903 ]
The COUNT_VALUE in the PACKET_CNT register is 16-bit so the maximum value is 65535. Asking the driver to transfer a larger size currently leads to the DMA transfer timing out. Implement ->max_transfer_size() and have the core split the transfer as needed.
--- drivers/spi/spi-s3c64xx.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/spi/spi-s3c64xx.c +9 -0
@@ -84,6 +84,7 @@#define S3C64XX_SPI_ST_TX_FIFORDY (1<<0)#define S3C64XX_SPI_PACKET_CNT_EN (1<<16) +#define S3C64XX_SPI_PACKET_CNT_MASK GENMASK(15, 0)#define S3C64XX_SPI_PND_TX_UNDERRUN_CLR (1<<4)#define S3C64XX_SPI_PND_TX_OVERRUN_CLR (1<<3)
@@ -654,6 +655,13 @@ static int s3c64xx_spi_prepare_message(struct spi_master *master,return 0 ; } +static size_t s3c64xx_spi_max_transfer_size (struct spi_device *spi) +{ +struct spi_controller *ctlr = spi->controller; + +return ctlr->can_dma ?S3C64XX_SPI_PACKET_CNT_MASK :SIZE_MAX ; +} +static int s3c64xx_spi_transfer_one (struct spi_master *master,struct spi_device *spi,struct spi_transfer *xfer)
@@ -1118,6 +1126,7 @@ static int s3c64xx_spi_probe(struct platform_device *pdev) master->prepare_transfer_hardware = s3c64xx_spi_prepare_transfer; master->prepare_message = s3c64xx_spi_prepare_message; master->transfer_one = s3c64xx_spi_transfer_one; + master->max_transfer_size = s3c64xx_spi_max_transfer_size; master->num_chipselect = sci->num_cs; master->dma_alignment =8 ; master->bits_per_word_mask = SPI_BPW_MASK(32) | SPI_BPW_MASK(16) |
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 86/229 vhost/vsock: Use kvmalloc/kvfree for larger packets.
In reply to Greg Kroah-HartmanFrom: Junichi Uekawa <[email protected]>
[ Upstream commit 0e3f72931fc47bb81686020cc643cde5d9cd0bb8 ]
When copying a large file over sftp over vsock, data size is usually 32kB, and kmalloc seems to fail to try to allocate 32 32kB regions.
vhost-5837: page allocation failure: order:4, mode:0x24040c0
Call Trace: [<ffffffffb6a0df64>] dump_stack+0x97/0xdb [<ffffffffb68d6aed>] warn_alloc_failed+0x10f/0x138 [<ffffffffb68d868a>] ? __alloc_pages_direct_compact+0x38/0xc8 [<ffffffffb664619f>] __alloc_pages_nodemask+0x84c/0x90d [<ffffffffb6646e56>] alloc_kmem_pages+0x17/0x19 [<ffffffffb6653a26>] kmalloc_order_trace+0x2b/0xdb [<ffffffffb66682f3>] __kmalloc+0x177/0x1f7 [<ffffffffb66e0d94>] ? copy_from_iter+0x8d/0x31d [<ffffffffc0689ab7>] vhost_vsock_handle_tx_kick+0x1fa/0x301 [vhost_vsock] [<ffffffffc06828d9>] vhost_worker+0xf7/0x157 [vhost] [<ffffffffb683ddce>] kthread+0xfd/0x105 [<ffffffffc06827e2>] ? vhost_dev_set_owner+0x22e/0x22e [vhost] [<ffffffffb683dcd1>] ? flush_kthread_worker+0xf3/0xf3 [<ffffffffb6eb332e>] ret_from_fork+0x4e/0x80 [<ffffffffb683dcd1>] ? flush_kthread_worker+0xf3/0xf3
Work around by doing kvmalloc instead.
--- drivers/vhost/vsock.c | 2 +- net/vmw_vsock/virtio_transport_common.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/vhost/vsock.c +1 -1
@@ -354,7 +354,7 @@ vhost_vsock_alloc_pkt(struct vhost_virtqueue *vq,return NULL ; } - pkt->buf =kmalloc (pkt->len,GFP_KERNEL ); + pkt->buf =kvmalloc (pkt->len,GFP_KERNEL );if (!pkt->buf) {kfree (pkt);return NULL ;
net/vmw_vsock/virtio_transport_common.c +1 -1
@@ -1079,7 +1079,7 @@ EXPORT_SYMBOL_GPL(virtio_transport_recv_pkt);void virtio_transport_free_pkt (struct virtio_vsock_pkt *pkt) { -kfree (pkt->buf); +kvfree (pkt->buf);kfree (pkt); }EXPORT_SYMBOL_GPL (virtio_transport_free_pkt);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 87/229 mISDN: fix use-after-free bugs in l1oip timer handlers
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit 2568a7e0832ee30b0a351016d03062ab4e0e0a3f ]
The l1oip_cleanup() traverses the l1oip_ilist and calls release_card() to cleanup module and stack. However, release_card() calls del_timer() to delete the timers such as keep_tl and timeout_tl. If the timer handler is running, the del_timer() will not stop it and result in UAF bugs. One of the processes is shown below:
(cleanup routine) | (timer handler)
release_card() | l1oip_timeout()
... |
del_timer() | ...
... |
kfree(hc) //FREE |
| hc->timeout_on = 0 //USEFix by calling del_timer_sync() in release_card(), which makes sure the timer handlers have finished before the resources, such as l1oip and so on, have been deallocated.
What's more, the hc->workq and hc->socket_thread can kick those timers right back in. We add a bool flag to show if card is released. Then, check this flag in hc->workq and hc->socket_thread.
--- drivers/isdn/mISDN/l1oip.h | 1 + drivers/isdn/mISDN/l1oip_core.c | 13 +++++++------ 2 files changed, 8 insertions(+), 6 deletions(-)
drivers/isdn/mISDN/l1oip.h +1 -0
@@ -59,6 +59,7 @@ struct l1oip {int bundle;/* bundle channels in one frm */ int codec;/* codec to use for transmis. */ int limit;/* limit number of bchannels */ +bool shutdown;/* if card is released */ /* timer */ struct timer_list keep_tl;
drivers/isdn/mISDN/l1oip_core.c +7 -6
@@ -289,7 +289,7 @@ l1oip_socket_send(struct l1oip *hc, u8 localcodec, u8 channel, u32 chanmask, p = frame;/* restart timer */ -if (time_before (hc->keep_tl.expires, jiffies +5 *HZ )) +if (time_before (hc->keep_tl.expires, jiffies +5 *HZ ) && !hc->shutdown)mod_timer (&hc->keep_tl, jiffies +L1OIP_KEEPALIVE *HZ );else hc->keep_tl.expires = jiffies +L1OIP_KEEPALIVE *HZ ;
@@ -615,7 +615,9 @@ l1oip_socket_parse(struct l1oip *hc, struct sockaddr_in *sin, u8 *buf, int len) goto multiframe;/* restart timer */ -if (time_before (hc->timeout_tl.expires, jiffies +5 *HZ ) || !hc->timeout_on) { +if ((time_before (hc->timeout_tl.expires, jiffies +5 *HZ ) || + !hc->timeout_on) && + !hc->shutdown) { hc->timeout_on =1 ;mod_timer (&hc->timeout_tl, jiffies +L1OIP_TIMEOUT *HZ ); }else /* only adjust timer */
@@ -1247,11 +1249,10 @@ release_card(struct l1oip *hc) {int ch; -if (timer_pending (&hc->keep_tl)) -del_timer (&hc->keep_tl); + hc->shutdown = true; -if (timer_pending (&hc->timeout_tl)) -del_timer (&hc->timeout_tl); +del_timer_sync (&hc->keep_tl); +del_timer_sync (&hc->timeout_tl);cancel_work_sync (&hc->workq);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 88/229 sctp: handle the error returned from sctp_auth_asoc_init_active_key
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 022152aaebe116a25c39818a07e175a8cd3c1e11 ]
When it returns an error from sctp_auth_asoc_init_active_key(), the active_key is actually not updated. The old sh_key will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot:
sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 sctp_set_owner_w net/sctp/socket.c:132 [inline] sctp_sendmsg_to_asoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctp_sendmsg+0x1053/0x1d50 net/sctp/socket.c:2025 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734
This patch is to fix it by not replacing the sh_key when it returns errors from sctp_auth_asoc_init_active_key() in sctp_auth_set_key(). For sctp_auth_set_active_key(), old active_key_id will be set back to asoc->active_key_id when the same thing happens.
--- net/sctp/auth.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
net/sctp/auth.c +14 -4
@@ -886,12 +886,17 @@ int sctp_auth_set_key(struct sctp_endpoint *ep, }list_del_init (&shkey->key_list); -sctp_auth_shkey_release (shkey);list_add (&cur_key->key_list, sh_keys); -if (asoc && asoc->active_key_id == auth_key->sca_keynumber) -sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL ); +if (asoc && asoc->active_key_id == auth_key->sca_keynumber && +sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL )) { +list_del_init (&cur_key->key_list); +sctp_auth_shkey_release (cur_key); +list_add (&shkey->key_list, sh_keys); +return -ENOMEM ; + } +sctp_auth_shkey_release (shkey);return 0 ; }
@@ -920,8 +925,13 @@ int sctp_auth_set_active_key(struct sctp_endpoint *ep,return -EINVAL ;if (asoc) { +__u16 active_key_id = asoc->active_key_id; + asoc->active_key_id = key_id; -sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL ); +if (sctp_auth_asoc_init_active_key (asoc,GFP_KERNEL )) { + asoc->active_key_id = active_key_id; +return -ENOMEM ; + } }else ep->active_key_id = key_id;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 89/229 tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
In reply to Greg Kroah-HartmanFrom: Neal Cardwell <[email protected]>
[ Upstream commit f4ce91ce12a7c6ead19b128ffa8cff6e3ded2a14 ]
This commit fixes a bug in the tracking of max_packets_out and is_cwnd_limited. This bug can cause the connection to fail to remember that is_cwnd_limited is true, causing the connection to fail to grow cwnd when it should, causing throughput to be lower than it should be.
The following event sequence is an example that triggers the bug:
(a) The connection is cwnd_limited, but packets_out is not at its peak due to TSO deferral deciding not to send another skb yet. In such cases the connection can advance max_packets_seq and set tp->is_cwnd_limited to true and max_packets_out to a small number.
(b) Then later in the round trip the connection is pacing-limited (not cwnd-limited), and packets_out is larger. In such cases the connection would raise max_packets_out to a bigger number but (unexpectedly) flip tp->is_cwnd_limited from true to false.
This commit fixes that bug.
One straightforward fix would be to separately track (a) the next window after max_packets_out reaches a maximum, and (b) the next window after tp->is_cwnd_limited is set to true. But this would require consuming an extra u32 sequence number.
Instead, to save space we track only the most important information. Specifically, we track the strongest available signal of the degree to which the cwnd is fully utilized:
(1) If the connection is cwnd-limited then we remember that fact for the current window.
(2) If the connection not cwnd-limited then we track the maximum number of outstanding packets in the current window.
In particular, note that the new logic cannot trigger the buggy (a)/(b) sequence above because with the new logic a condition where tp->packets_out > tp->max_packets_out can only trigger an update of tp->is_cwnd_limited if tp->is_cwnd_limited is false.
This first showed up in a testing of a BBRv2 dev branch, but this buggy behavior highlighted a general issue with the tcp_cwnd_validate() logic that can cause cwnd to fail to increase at the proper rate for any TCP congestion control, including Reno or CUBIC.
--- include/linux/tcp.h | 2 +- include/net/tcp.h | 5 ++++- net/ipv4/tcp.c | 2 ++ net/ipv4/tcp_output.c | 19 ++++++++++++------- 4 files changed, 19 insertions(+), 9 deletions(-)
include/linux/tcp.h +1 -1
@@ -263,7 +263,7 @@ struct tcp_sock {u32 packets_out;/* Packets which are "in flight" */ u32 retrans_out;/* Retransmitted packets out */ u32 max_packets_out;/* max packets_out in last window */ -u32 max_packets_seq;/* right edge of max_packets_out flight */ +u32 cwnd_usage_seq;/* right edge of cwnd usage tracking flight */ u16 urg_data;/* Saved octet of OOB data and control flags */ u8 ecn_flags;/* ECN status bits. */
include/net/tcp.h +4 -1
@@ -1231,11 +1231,14 @@ static inline bool tcp_is_cwnd_limited(const struct sock *sk) {const struct tcp_sock *tp =tcp_sk (sk); +if (tp->is_cwnd_limited) +return true; +/* If in slow start, ensure cwnd grows to twice what was ACKed. */ if (tcp_in_slow_start (tp))return tp->snd_cwnd <2 * tp->max_packets_out; -return tp->is_cwnd_limited; +return false; }/* BBR congestion control needs pacing.
net/ipv4/tcp.c +2 -0
@@ -2607,6 +2607,8 @@ int tcp_disconnect(struct sock *sk, int flags) icsk->icsk_probes_out =0 ; tp->snd_ssthresh =TCP_INFINITE_SSTHRESH ; tp->snd_cwnd_cnt =0 ; + tp->is_cwnd_limited =0 ; + tp->max_packets_out =0 ; tp->window_clamp =0 ; tp->delivered =0 ; tp->delivered_ce =0 ;
net/ipv4/tcp_output.c +12 -7
@@ -1638,15 +1638,20 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited)const struct tcp_congestion_ops *ca_ops =inet_csk (sk)->icsk_ca_ops;struct tcp_sock *tp =tcp_sk (sk); -/* Track the maximum number of outstanding packets in each -* window, and remember whether we were cwnd-limited then. +/* Track the strongest available signal of the degree to which the cwnd +* is fully utilized. If cwnd-limited then remember that fact for the +* current window. If not cwnd-limited then track the maximum number of +* outstanding packets in the current window. (If cwnd-limited then we +* chose to not update tp->max_packets_out to avoid an extra else +* clause with no functional impact.) */ -if (!before (tp->snd_una, tp->max_packets_seq) || - tp->packets_out > tp->max_packets_out || - is_cwnd_limited) { - tp->max_packets_out = tp->packets_out; - tp->max_packets_seq = tp->snd_nxt; +if (!before (tp->snd_una, tp->cwnd_usage_seq) || + is_cwnd_limited || + (!tp->is_cwnd_limited && + tp->packets_out > tp->max_packets_out)) { tp->is_cwnd_limited = is_cwnd_limited; + tp->max_packets_out = tp->packets_out; + tp->cwnd_usage_seq = tp->snd_nxt; }if (tcp_is_cwnd_limited (sk)) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 90/229 net: rds: dont hold sock lock when cancelling work from rds_tcp_reset_callbacks()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit a91b750fd6629354460282bbf5146c01b05c4859 ]
syzbot is reporting lockdep warning at rds_tcp_reset_callbacks() [1], for commit ac3615e7f3cffe2a ("RDS: TCP: Reduce code duplication in rds_tcp_reset_callbacks()") added cancel_delayed_work_sync() into a section protected by lock_sock() without realizing that rds_send_xmit() might call lock_sock().
We don't need to protect cancel_delayed_work_sync() using lock_sock(), for even if rds_{send,recv}_worker() re-queued this work while __flush_work()
from cancel_delayed_work_sync() was waiting for this work to complete,
retried rds_{send,recv}_worker() is no-op due to the absence of RDS_CONN_UP bit.
--- net/rds/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/tcp.c +1 -1
@@ -176,10 +176,10 @@ void rds_tcp_reset_callbacks(struct socket *sock,*/ atomic_set (&cp->cp_state,RDS_CONN_RESETTING );wait_event (cp->cp_waitq, !test_bit (RDS_IN_XMIT , &cp->cp_flags)); -lock_sock (osock->sk);/* reset receive side state for rds_tcp_data_recv() for osock */ cancel_delayed_work_sync (&cp->cp_send_w);cancel_delayed_work_sync (&cp->cp_recv_w); +lock_sock (osock->sk);if (tc->t_tinc) {rds_inc_put (&tc->t_tinc->ti_inc); tc->t_tinc =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 91/229 bnx2x: fix potential memory leak in bnx2x_tpa_stop()
In reply to Greg Kroah-HartmanFrom: Jianglei Nie <[email protected]>
[ Upstream commit b43f9acbb8942b05252be83ac25a81cec70cc192 ]
bnx2x_tpa_stop() allocates a memory chunk from new_data with bnx2x_frag_alloc(). The new_data should be freed when gets some error. But when "pad + len > fp->rx_buf_size" is true, bnx2x_tpa_stop() returns without releasing the new_data, which will lead to a memory leak.
We should free the new_data with bnx2x_frag_free() when "pad + len > fp->rx_buf_size" is true.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +1 -0
@@ -788,6 +788,7 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,BNX2X_ERR ("skb_put is about to fail... pad %d len %d rx_buf_size %d\n" , pad, len, fp->rx_buf_size);bnx2x_panic (); +bnx2x_frag_free (fp, new_data); return; }#endif
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 92/229 once: add DO_ONCE_SLOW() for sleepable contexts
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 62c07983bef9d3e78e71189441e1a470f0d1e653 ]
Christophe Leroy reported a ~80ms latency spike
happening at first TCP connect() time.
This is because __inet_hash_connect() uses get_random_once()
to populate a perturbation table which became quite big
after commit 4c2c8f03a5ab ("tcp: increase source port perturb table to 2^16")
get_random_once() uses DO_ONCE(), which block hard irqs for the duration of the operation.
This patch adds DO_ONCE_SLOW() which uses a mutex instead of a spinlock for operations where we prefer to stay in process context.
Then __inet_hash_connect() can use get_random_slow_once() to populate its perturbation table.
--- include/linux/once.h | 28 ++++++++++++++++++++++++++++ lib/once.c | 30 ++++++++++++++++++++++++++++++ net/ipv4/inet_hashtables.c | 4 ++-- 3 files changed, 60 insertions(+), 2 deletions(-)
include/linux/once.h +28 -0
@@ -5,10 +5,18 @@#include <linux/types.h> #include <linux/jump_label.h> +/* Helpers used from arbitrary contexts. +* Hard irqs are blocked, be cautious. +*/ bool __do_once_start (bool *done,unsigned long *flags);void __do_once_done (bool *done,struct static_key_true *once_key,unsigned long *flags,struct module *mod); +/* Variant for process contexts only. */ +bool __do_once_slow_start (bool *done); +void __do_once_slow_done (bool *done,struct static_key_true *once_key, +struct module *mod); +/* Call a function exactly once. The idea of DO_ONCE() is to perform * a function call such as initialization of random seeds, etc, only * once, where DO_ONCE() can live in the fast-path. After @func has
@@ -52,9 +60,29 @@ void __do_once_done(bool *done, struct static_key_true *once_key, ___ret; \ }) +/* Variant of DO_ONCE() for process/sleepable contexts. */ +#define DO_ONCE_SLOW (func, ...) \ + ({ \ + bool ___ret = false; \ + static bool __section(".data.once") ___done = false; \ + static DEFINE_STATIC_KEY_TRUE(___once_key); \ + if (static_branch_unlikely(&___once_key)) { \ + ___ret = __do_once_slow_start(&___done); \ + if (unlikely(___ret)) { \ + func(__VA_ARGS__); \ + __do_once_slow_done(&___done, &___once_key, \ + THIS_MODULE); \ + } \ + } \ + ___ret; \ + }) +#define get_random_once (buf, nbytes) \ DO_ONCE(get_random_bytes, (buf), (nbytes))#define get_random_once_wait (buf, nbytes) \ DO_ONCE(get_random_bytes_wait, (buf), (nbytes)) \ +#define get_random_slow_once (buf, nbytes) \ + DO_ONCE_SLOW(get_random_bytes, (buf), (nbytes)) +#endif /* _LINUX_ONCE_H */
lib/once.c +30 -0
@@ -66,3 +66,33 @@ void __do_once_done(bool *done, struct static_key_true *once_key,once_disable_jump (once_key, mod); }EXPORT_SYMBOL (__do_once_done); + +static DEFINE_MUTEX (once_mutex); + +bool __do_once_slow_start (bool *done) +__acquires (once_mutex) +{ +mutex_lock (&once_mutex); +if (*done) { +mutex_unlock (&once_mutex); +/* Keep sparse happy by restoring an even lock count on +* this mutex. In case we return here, we don't call into +* __do_once_done but return early in the DO_ONCE_SLOW() macro. +*/ +__acquire (once_mutex); +return false; + } + +return true; +} +EXPORT_SYMBOL (__do_once_slow_start); + +void __do_once_slow_done (bool *done,struct static_key_true *once_key, +struct module *mod) +__releases (once_mutex) +{ + *done = true; +mutex_unlock (&once_mutex); +once_disable_jump (once_key, mod); +} +EXPORT_SYMBOL (__do_once_slow_done);
net/ipv4/inet_hashtables.c +2 -2
@@ -765,8 +765,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,if (likely (remaining >1 )) remaining &= ~1U ; -net_get_random_once (table_perturb, -INET_TABLE_PERTURB_SIZE *sizeof (*table_perturb)); +get_random_slow_once (table_perturb, +INET_TABLE_PERTURB_SIZE *sizeof (*table_perturb)); index = port_offset & (INET_TABLE_PERTURB_SIZE -1 ); offset =READ_ONCE (table_perturb[index]) + (port_offset >>32 );
Signature · 1 line
2.35.1
Re: [PATCH 4.19 092/229] once: add DO_ONCE_SLOW() for sleepable contexts
Hello,
As mentioned in the thread for the 5.4 version here[1], it causes a crash for the 4.19 kernel too.
Just paste the log here for reference:
[ 1375.219830] wlan0: authenticate with 98:da:c4:4f:77:11 [ 1375.230257] wlan0: send auth to 98:da:c4:4f:77:11 (try 1/3) [ 1375.262598] wlan0: authenticated [ 1375.267766] wlan0: associate with 98:da:c4:4f:77:11 (try 1/3) [ 1375.285716] wlan0: RX AssocResp from 98:da:c4:4f:77:11 (capab=0x1411 status=0 aid=1) [ 1375.310066] wlan0: associated [ 1375.332056] wlcore: Association completed. [ 1376.105149] Unable to handle kernel write to read-only memory at virtual address ffffff80092a6f18 [ 1376.114129] Mem abort info: [ 1376.117072] ESR = 0x9600004f [ 1376.120138] Exception class = DABT (current EL), IL = 32 bits [ 1376.126091] SET = 0, FnV = 0 [ 1376.129147] EA = 0, S1PTW = 0 [ 1376.132301] Data abort info: [ 1376.135176] ISV = 0, ISS = 0x0000004f [ 1376.139012] CM = 0, WnR = 1 [ 1376.141997] swapper pgtable: 4k pages, 39-bit VAs, pgdp = 00000000a9880db2 [ 1376.148923] [ffffff80092a6f18] pgd=000000021fffe003, pud=000000021fffe003, pmd=000000021fffb003, pte=00600000012a6793 [ 1376.159550] Internal error: Oops: 9600004f [#1] PREEMPT SMP [ 1376.165119] Modules linked in: [ 1376.168168] Process TlsVerify_100 (pid: 5454, stack limit = 0x0000000025f9c863) [ 1376.175472] CPU: 5 PID: 5454 Comm: TlsVerify_100 Not tainted 4.19.262-g8479d939a3b0 #1 [ 1376.183381] Hardware name: HiKey960 (DT) [ 1376.187295] pstate: 60400005 (nZCv daif +PAN -UAO) [ 1376.192085] pc : __do_once_slow_done+0x14/0x98 [ 1376.196535] lr : __inet_hash_connect+0x480/0x484 [ 1376.201146] sp : ffffff800e203b80 [ 1376.204460] x29: ffffff800e203b80 x28: 0000000000000000 [ 1376.209768] x27: 0000000000006e48 x26: 0000000000000000 [ 1376.215071] x25: ffffff80098e6000 x24: 9b29771fbf0b881c [ 1376.220375] x23: ffffff8009766600 x22: ffffff8009766bc0 [ 1376.225678] x21: ffffff8008c34198 x20: ffffff80098e65c0 [ 1376.230982] x19: ffffffc04cabd1c0 x18: 0000000005c65eec [ 1376.236285] x17: 00000000175fece9 x16: 0000000071679066 [ 1376.241588] x15: 00000000467bf177 x14: 000000005f331e5c [ 1376.246891] x13: 0000000000000014 x12: 00000000b82286ab [ 1376.252194] x11: 0000000084c874ea x10: 00000000fdb36642 [ 1376.257497] x9 : 68962c3381a87000 x8 : 0000000000000001 [ 1376.262800] x7 : 0000000000000000 x6 : ffffffc2197c0000 [ 1376.268103] x5 : 000000008113af5d x4 : 0000000000000008 [ 1376.273406] x3 : 0000000000000030 x2 : 0000000000000000 [ 1376.278709] x1 : ffffff800976e568 x0 : ffffff80092a6f18 [ 1376.284012] Call trace: [ 1376.286456] __do_once_slow_done+0x14/0x98 [ 1376.290544] __inet_hash_connect+0x480/0x484 [ 1376.294805] inet_hash_connect+0x48/0x54 [ 1376.298720] tcp_v4_connect+0x26c/0x3e4 [ 1376.302549] __inet_stream_connect+0x2ac/0x308 [ 1376.306984] inet_stream_connect+0x44/0x68 [ 1376.311072] __sys_connect+0xb4/0x100 [ 1376.314725] __arm64_sys_connect+0x1c/0x28 [ 1376.318816] el0_svc_common+0xa4/0x188 [ 1376.322556] el0_svc_handler+0x60/0x68 [ 1376.326298] el0_svc+0x8/0x300 [ 1376.329345] Code: f9000bf5 a9024ff4 910003fd 52800028 (39000008) [ 1376.335431] ---[ end trace 28410d3ffccfb491 ]--- [ 1376.351416] Kernel panic - not syncing: Fatal exception [ 1376.356640] SMP: stopping secondary CPUs [ 1376.360775] Kernel Offset: disabled [ 1376.364257] CPU features: 0x10,20082004 [ 1376.368083] Memory Limit: none [ 1376.382434] Rebooting in 5 seconds..
[1]: https://lore.kernel.org/lkml/[email protected]/
Thanks,
Yongqin Liu
Greg Kroah-Hartman
maintainerRe: [PATCH 4.19 092/229] once: add DO_ONCE_SLOW() for sleepable contexts
Quoted 5 lines · Yongqin Liu
Hello,
As mentioned in the thread for the 5.4 version here[1], it causes a crash for the 4.19 kernel too.
Just paste the log here for reference:
Can you try this patch please:
include/linux/once.h +1 -1
@@ -64,7 +64,7 @@ void __do_once_slow_done(bool *done, struct static_key_true *once_key,#define DO_ONCE_SLOW (func, ...) \ ({ \ bool ___ret = false; \ - static bool __section(".data.once") ___done = false; \ + static bool __section(.data.once) ___done = false; \ static DEFINE_STATIC_KEY_TRUE(___once_key); \ if (static_branch_unlikely(&___once_key)) { \ ___ret = __do_once_slow_start(&___done); \
Re: [PATCH 4.19 092/229] once: add DO_ONCE_SLOW() for sleepable contexts
Hi, Greg
Quoted 16 lines · Greg Kroah-Hartman
Quoted 5 lines · Yongqin Liu
Hello,
As mentioned in the thread for the 5.4 version here[1], it causes a crash for the 4.19 kernel too.
Just paste the log here for reference:Can you try this patch please:
include/linux/once.h +0
-0
include/linux/once.h void __do_once_slow_done(bool *done, struct static_key_true *once_key, · line 70
Quoted 8 lines
include/linux/once.h +1
-1@@ -64,7 +64,7 @@ void __do_once_slow_done(bool *done, struct static_key_true *once_key,#define DO_ONCE_SLOW (func, ...) \ ({ \ bool ___ret = false; \ - static bool __section(".data.once") ___done = false; \ + static bool __section(.data.once) ___done = false; \ static DEFINE_STATIC_KEY_TRUE(___once_key); \ if (static_branch_unlikely(&___once_key)) { \ ___ret = __do_once_slow_start(&___done); \
This change works, it does not cause kernel panic again after this change is applied.
Signature · 6 lines
Best Regards, Yongqin Liu --------------------------------------------------------------- #mailing list [email protected] http://lists.linaro.org/mailman/listinfo/linaro-android
Greg Kroah-Hartman
maintainerRe: [PATCH 4.19 092/229] once: add DO_ONCE_SLOW() for sleepable contexts
Quoted 24 lines · Yongqin Liu
Hi, Greg
Quoted 20 lines · Greg Kroah-Hartman
Quoted 5 lines · Yongqin Liu
Hello,
As mentioned in the thread for the 5.4 version here[1], it causes a crash for the 4.19 kernel too.
Just paste the log here for reference:Can you try this patch please:
include/linux/once.h +0
-1@@ -64,7 +64,7 @@ void __do_once_slow_done(bool *done, struct static_key_true *once_key,#define DO_ONCE_SLOW (func, ...) \ ({ \ bool ___ret = false; \ - static bool __section(".data.once") ___done = false; \
Quoted 8 lines
include/linux/once.h void __do_once_slow_done(bool *done, struct static_key_true *once_key, · line 70
Quoted 4 lines
include/linux/once.h +1
-0+ static bool __section(.data.once) ___done = false; \static DEFINE_STATIC_KEY_TRUE (___once_key); \if (static_branch_unlikely (&___once_key)) { \ ___ret =__do_once_slow_start (&___done); \This change works, it does not cause kernel panic again after this change is applied.
Great, thanks! Can I get a Tested-by: line for the changelog?
I'll queue this up in a bit and get it fixed in the next release.
thanks,
greg k-h
Re: [PATCH 4.19 092/229] once: add DO_ONCE_SLOW() for sleepable contexts
Quoted 35 lines · Greg Kroah-Hartman
Quoted 24 lines · Yongqin Liu
Hi, Greg
Quoted 20 lines · Greg Kroah-Hartman
Quoted 5 lines · Yongqin Liu
Hello,
As mentioned in the thread for the 5.4 version here[1], it causes a crash for the 4.19 kernel too.
Just paste the log here for reference:Can you try this patch please:
include/linux/once.h +0
-1@@ -64,7 +64,7 @@ void __do_once_slow_done(bool *done, struct static_key_true *once_key,#define DO_ONCE_SLOW (func, ...) \ ({ \ bool ___ret = false; \ - static bool __section(".data.once") ___done = false; \Quoted 8 lines
include/linux/once.h void __do_once_slow_done(bool *done, struct static_key_true *once_key, · line 70
Quoted 4 lines
include/linux/once.h +1
-0+ static bool __section(.data.once) ___done = false; \static DEFINE_STATIC_KEY_TRUE (___once_key); \if (static_branch_unlikely (&___once_key)) { \ ___ret =__do_once_slow_start (&___done); \This change works, it does not cause kernel panic again after this change is applied.
Quoted 1 line
Great, thanks! Can I get a Tested-by: line for the changelog?
Sure, Yongqin Liu <[email protected]>
Quoted 1 line
I'll queue this up in a bit and get it fixed in the next release.
BTW, to be clear, I tested it with one 4.19-q tree based on the latest ACK android-4.19-q branch[1],
If there is something else I could help test, please let me know.
[1]: https://android.googlesource.com/kernel/common/+/refs/heads/android-4.19-q
Signature · 6 lines
Best Regards, Yongqin Liu --------------------------------------------------------------- #mailing list [email protected] http://lists.linaro.org/mailman/listinfo/linaro-android
Greg Kroah-Hartman
maintainerPATCH 93/229 net: mvpp2: fix mvpp2 debugfs leak
In reply to Greg Kroah-HartmanFrom: Russell King (Oracle) <[email protected]>
[ Upstream commit 0152dfee235e87660f52a117fc9f70dc55956bb4 ]
When mvpp2 is unloaded, the driver specific debugfs directory is not removed, which technically leads to a memory leak. However, this directory is only created when the first device is probed, so the hardware is present. Removing the module is only something a developer would to when e.g. testing out changes, so the module would be reloaded. So this memory leak is minor.
The original attempt in commit fe2c9c61f668 ("net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()") that was labelled as a memory leak fix was not, it fixed a refcount leak, but in doing so created a problem when the module is reloaded - the directory already exists, but mvpp2_root is NULL, so we lose all debugfs entries. This fix has been reverted.
This is the alternative fix, where we remove the offending directory whenever the driver is unloaded.
--- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 ++++++++-- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 ++++++++++++- 3 files changed, 21 insertions(+), 3 deletions(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2.h +1 -0
@@ -1107,5 +1107,6 @@ void mvpp2_percpu_write_relaxed(struct mvpp2 *priv, int cpu, u32 offset,void mvpp2_dbgfs_init (struct mvpp2 *priv,const char *name);void mvpp2_dbgfs_cleanup (struct mvpp2 *priv); +void mvpp2_dbgfs_exit (void );#endif
drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +8 -2
@@ -648,6 +648,13 @@ static int mvpp2_dbgfs_port_init(struct dentry *parent,return 0 ; } +static struct dentry *mvpp2_root; + +void mvpp2_dbgfs_exit (void ) +{ +debugfs_remove (mvpp2_root); +} +void mvpp2_dbgfs_cleanup (struct mvpp2 *priv) {debugfs_remove_recursive (priv->dbgfs_dir);
@@ -655,10 +662,9 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv)void mvpp2_dbgfs_init (struct mvpp2 *priv,const char *name) { -struct dentry *mvpp2_dir, *mvpp2_root; +struct dentry *mvpp2_dir;int ret, i; - mvpp2_root =debugfs_lookup (MVPP2_DRIVER_NAME ,NULL );if (!mvpp2_root) mvpp2_root =debugfs_create_dir (MVPP2_DRIVER_NAME ,NULL );
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +12 -1
@@ -5417,7 +5417,18 @@ static struct platform_driver mvpp2_driver = { }, }; -module_platform_driver (mvpp2_driver); +static int __init mvpp2_driver_init (void ) +{ +return platform_driver_register (&mvpp2_driver); +} +module_init (mvpp2_driver_init); + +static void __exit mvpp2_driver_exit(void) +{ +platform_driver_unregister (&mvpp2_driver); +mvpp2_dbgfs_exit (); +} +module_exit (mvpp2_driver_exit);MODULE_DESCRIPTION ("Marvell PPv2 Ethernet Driver - www.marvell.com" );MODULE_AUTHOR ("Marcin Wojtas <[email protected]>" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 94/229 drm: bridge: adv7511: fix CEC power down control register offset
In reply to Greg Kroah-HartmanFrom: Alvin Šipraga <[email protected]>
[ Upstream commit 1d22b6033ea113a4c3850dfa2c0770885c81aec8 ]
The ADV7511_REG_CEC_CTRL = 0xE2 register is part of the main register map - not the CEC register map. As such, we shouldn't apply an offset to the register address. Doing so will cause us to address a bogus register for chips with a CEC register map offset (e.g. ADV7533).
--- drivers/gpu/drm/bridge/adv7511/adv7511.h | 5 +---- drivers/gpu/drm/bridge/adv7511/adv7511_cec.c | 4 ++-- 2 files changed, 3 insertions(+), 6 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511.h +1 -4
@@ -383,10 +383,7 @@ void adv7511_cec_irq_process(struct adv7511 *adv7511, unsigned int irq1);#else static inline int adv7511_cec_init (struct device *dev,struct adv7511 *adv7511) { -unsigned int offset = adv7511->type ==ADV7533 ? -ADV7533_REG_CEC_OFFSET :0 ; - -regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL + offset, +regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL ,ADV7511_CEC_CTRL_POWER_DOWN );return 0 ; }
drivers/gpu/drm/bridge/adv7511/adv7511_cec.c +2 -2
@@ -316,7 +316,7 @@ int adv7511_cec_init(struct device *dev, struct adv7511 *adv7511) goto err_cec_alloc; } -regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL + offset,0 ); +regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL ,0 );/* cec soft reset */ regmap_write (adv7511->regmap_cec,ADV7511_REG_CEC_SOFT_RESET + offset,0x01 );
@@ -343,7 +343,7 @@ int adv7511_cec_init(struct device *dev, struct adv7511 *adv7511)dev_info (dev,"Initializing CEC failed with error %d, disabling CEC\n" , ret); err_cec_parse_dt: -regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL + offset, +regmap_write (adv7511->regmap,ADV7511_REG_CEC_CTRL ,ADV7511_CEC_CTRL_POWER_DOWN );return ret == -EPROBE_DEFER ? ret :0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 95/229 drm/mipi-dsi: Detach devices when removing the host
In reply to Greg Kroah-HartmanFrom: Maxime Ripard <[email protected]>
[ Upstream commit 668a8f17b5290d04ef7343636a5588a0692731a1 ]
Whenever the MIPI-DSI host is unregistered, the code of mipi_dsi_host_unregister() loops over every device currently found on that bus and will unregister it.
However, it doesn't detach it from the bus first, which leads to all kind of resource leaks if the host wants to perform some clean up whenever a device is detached.
--- drivers/gpu/drm/drm_mipi_dsi.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_mipi_dsi.c +1 -0
@@ -305,6 +305,7 @@ static int mipi_dsi_remove_device_fn(struct device *dev, void *priv) {struct mipi_dsi_device *dsi =to_mipi_dsi_device (dev); +mipi_dsi_detach (dsi);mipi_dsi_device_unregister (dsi);return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 96/229 platform/chrome: fix double-free in chromeos_laptop_prepare()
In reply to Greg Kroah-HartmanFrom: Rustam Subkhankulov <[email protected]>
[ Upstream commit 6ad4194d6a1e1d11b285989cd648ef695b4a93c0 ]
If chromeos_laptop_prepare_i2c_peripherals() fails after allocating memory for 'cros_laptop->i2c_peripherals', this memory is freed at 'err_out' label and nonzero value is returned. Then chromeos_laptop_destroy() is called, resulting in double-free error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/platform/chrome/chromeos_laptop.c | 24 ++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
drivers/platform/chrome/chromeos_laptop.c +13 -11
@@ -716,6 +716,7 @@ static int __init chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop, const struct chromeos_laptop *src) { + struct i2c_peripheral *i2c_peripherals;struct i2c_peripheral *i2c_dev;struct i2c_board_info *info;int i;
@@ -724,17 +725,15 @@ chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop,if (!src->num_i2c_peripherals)return 0 ; - cros_laptop->i2c_peripherals =kmemdup (src->i2c_peripherals, - src->num_i2c_peripherals * -sizeof (*src->i2c_peripherals), -GFP_KERNEL ); -if (!cros_laptop->i2c_peripherals) + i2c_peripherals =kmemdup (src->i2c_peripherals, + src->num_i2c_peripherals * +sizeof (*src->i2c_peripherals), +GFP_KERNEL ); +if (!i2c_peripherals)return -ENOMEM ; - cros_laptop->num_i2c_peripherals = src->num_i2c_peripherals; - -for (i =0 ; i < cros_laptop->num_i2c_peripherals; i++) { - i2c_dev = &cros_laptop->i2c_peripherals[i]; +for (i =0 ; i < src->num_i2c_peripherals; i++) { + i2c_dev = &i2c_peripherals[i]; info = &i2c_dev->board_info; error =chromeos_laptop_setup_irq (i2c_dev);
@@ -752,16 +751,19 @@ chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop, } } + cros_laptop->i2c_peripherals = i2c_peripherals; + cros_laptop->num_i2c_peripherals = src->num_i2c_peripherals; +return 0 ; err_out:while (--i >=0 ) { - i2c_dev = &cros_laptop->i2c_peripherals[i]; + i2c_dev = &i2c_peripherals[i]; info = &i2c_dev->board_info;if (info->properties)property_entries_free (info->properties); } -kfree (cros_laptop->i2c_peripherals); +kfree (i2c_peripherals);return error; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 97/229 platform/x86: msi-laptop: Fix old-ec check for backlight registering
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 83ac7a1c2ed5f17caa07cbbc84bad3c05dc3bf22 ]
Commit 2cc6c717799f ("msi-laptop: Port to new backlight interface selection API") replaced this check:
if (!quirks->old_ec_model || acpi_video_backlight_support())
pr_info("Brightness ignored, ...");
else
do_register();With:
if (quirks->old_ec_model || acpi_video_get_backlight_type() == acpi_backlight_vendor) do_register();
But since the do_register() part was part of the else branch, the entire condition should be inverted. So not only the 2 statements on either side of the || should be inverted, but the || itself should be replaced with a &&.
In practice this has likely not been an issue because the new-ec models (old_ec_model==false) likely all support ACPI video backlight control, making acpi_video_get_backlight_type() return acpi_backlight_video turning the second part of the || also false when old_ec_model == false.
--- drivers/platform/x86/msi-laptop.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/platform/x86/msi-laptop.c +1 -2
@@ -1061,8 +1061,7 @@ static int __init msi_init(void)return -EINVAL ;/* Register backlight stuff */ - -if (quirks->old_ec_model || +if (quirks->old_ec_model &&acpi_video_get_backlight_type () == acpi_backlight_vendor) {struct backlight_properties props;memset (&props,0 ,sizeof (struct backlight_properties ));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 98/229 platform/x86: msi-laptop: Fix resource cleanup
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 5523632aa10f906dfe2eb714ee748590dc7fc6b1 ]
Fix the input-device not getting free-ed on probe-errors and fix the msi_touchpad_dwork not getting cancelled on neither probe-errors nor on remove.
--- drivers/platform/x86/msi-laptop.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/x86/msi-laptop.c +3 -0
@@ -1129,6 +1129,8 @@ static int __init msi_init(void) fail_create_group:if (quirks->load_scm_model) {i8042_remove_filter (msi_laptop_i8042_filter); +cancel_delayed_work_sync (&msi_touchpad_dwork); +input_unregister_device (msi_laptop_input_dev);cancel_delayed_work_sync (&msi_rfkill_dwork);cancel_work_sync (&msi_rfkill_work);rfkill_cleanup ();
@@ -1149,6 +1151,7 @@ static void __exit msi_cleanup(void) {if (quirks->load_scm_model) {i8042_remove_filter (msi_laptop_i8042_filter); +cancel_delayed_work_sync (&msi_touchpad_dwork);input_unregister_device (msi_laptop_input_dev);cancel_delayed_work_sync (&msi_rfkill_dwork);cancel_work_sync (&msi_rfkill_work);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 99/229 drm/bridge: megachips: Fix a null pointer dereference bug
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 1ff673333d46d2c1b053ebd0c1c7c7c79e36943e ]
When removing the module we will get the following warning:
[ 31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered [ 31.912484] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI [ 31.913338] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130 [ 31.921825] Call Trace: [ 31.922533] stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw] [ 31.923139] i2c_device_remove+0x181/0x1f0
The two bridges (stdp2690, stdp4028) do not probe at the same time, so the driver does not call ge_b850v3_resgiter() when probing, causing the driver to try to remove the object that has not been initialized.
Fix this by checking whether both the bridges are probed.
--- drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +3 -1
@@ -290,7 +290,9 @@ static void ge_b850v3_lvds_remove(void)* This check is to avoid both the drivers * removing the bridge in their remove() function */ -if (!ge_b850v3_lvds_ptr) +if (!ge_b850v3_lvds_ptr || + !ge_b850v3_lvds_ptr->stdp2690_i2c || + !ge_b850v3_lvds_ptr->stdp4028_i2c) goto out;drm_bridge_remove (&ge_b850v3_lvds_ptr->bridge);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 100/229 mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 5cbedf52608cc3cbc1c2a9a861fb671620427a20 ]
If clk_prepare_enable() fails, there is no point in calling clk_disable_unprepare() in the error handling path.
Move the out_clk label at the right place.
--- drivers/mmc/host/au1xmmc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/host/au1xmmc.c +2 -1
@@ -1118,8 +1118,9 @@ static int au1xmmc_probe(struct platform_device *pdev)if (host->platdata && host->platdata->cd_setup && !(mmc->caps &MMC_CAP_NEEDS_POLL )) host->platdata->cd_setup (mmc,0 ); -out_clk: +clk_disable_unprepare (host->clk); +out_clk:clk_put (host->clk); out_irq:free_irq (host->irq, host);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 101/229 ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit bfb735a3ceff0bab6473bac275da96f9b2a06dec ]
In eukrea_tlv320_probe(), we need to hold the reference returned from of_find_compatible_node() which has increased the refcount and then call of_node_put() with it when done.
--- sound/soc/fsl/eukrea-tlv320.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/soc/fsl/eukrea-tlv320.c +5 -3
@@ -87,7 +87,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)int ret;int int_port =0 , ext_port;struct device_node *np = pdev->dev.of_node; -struct device_node *ssi_np =NULL , *codec_np =NULL ; +struct device_node *ssi_np =NULL , *codec_np =NULL , *tmp_np =NULL ; eukrea_tlv320.dev = &pdev->dev;if (np) {
@@ -144,7 +144,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev) }if (machine_is_eukrea_cpuimx27 () || -of_find_compatible_node (NULL ,NULL ,"fsl,imx21-audmux" )) { + (tmp_np =of_find_compatible_node (NULL ,NULL ,"fsl,imx21-audmux" ))) { imx_audmux_v1_configure_port(MX27_AUDMUX_HPCR1_SSI0, IMX_AUDMUX_V1_PCR_SYN | IMX_AUDMUX_V1_PCR_TFSDIR |
@@ -159,10 +159,11 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)IMX_AUDMUX_V1_PCR_SYN |IMX_AUDMUX_V1_PCR_RXDSEL (MX27_AUDMUX_HPCR1_SSI0 ) ); +of_node_put (tmp_np); }else if (machine_is_eukrea_cpuimx25sd () ||machine_is_eukrea_cpuimx35sd () ||machine_is_eukrea_cpuimx51sd () || -of_find_compatible_node (NULL ,NULL ,"fsl,imx31-audmux" )) { + (tmp_np =of_find_compatible_node (NULL ,NULL ,"fsl,imx31-audmux" ))) {if (!np) ext_port =machine_is_eukrea_cpuimx25sd () ?4 :3 ;
@@ -179,6 +180,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)IMX_AUDMUX_V2_PTCR_SYN ,IMX_AUDMUX_V2_PDCR_RXDSEL (int_port) ); +of_node_put (tmp_np); }else {if (np) {/* The eukrea,asoc-tlv320 driver was explicitly
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 102/229 drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 7538f80ae0d98bf51eb89eee5344aec219902d42 ]
Remove loops over hw_vbif. Instead always VBIF's idx as an index in the array. This fixes an error in dpu_kms_hw_init(), where we fill dpu_kms->hw_vbif[i], but check for an error pointer at dpu_kms->hw_vbif[vbif_idx].
Patchwork: https://patchwork.freedesktop.org/patch/489569/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 12 ++++------ drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c | 29 +++++++++++------------- 2 files changed, 18 insertions(+), 23 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +5 -7
@@ -654,12 +654,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)_dpu_kms_mmu_destroy (dpu_kms);if (dpu_kms->catalog) { -for (i =0 ; i < dpu_kms->catalog->vbif_count; i++) { -u32 vbif_idx = dpu_kms->catalog->vbif[i].id; - -if ((vbif_idx <VBIF_MAX ) && dpu_kms->hw_vbif[vbif_idx]) { -dpu_hw_vbif_destroy (dpu_kms->hw_vbif[vbif_idx]); - dpu_kms->hw_vbif[vbif_idx] =NULL ; +for (i =0 ; i <ARRAY_SIZE (dpu_kms->hw_vbif); i++) { +if (dpu_kms->hw_vbif[i]) { +dpu_hw_vbif_destroy (dpu_kms->hw_vbif[i]); + dpu_kms->hw_vbif[i] =NULL ; } } }
@@ -1094,7 +1092,7 @@ static int dpu_kms_hw_init(struct msm_kms *kms)for (i =0 ; i < dpu_kms->catalog->vbif_count; i++) {u32 vbif_idx = dpu_kms->catalog->vbif[i].id; - dpu_kms->hw_vbif[i] =dpu_hw_vbif_init (vbif_idx, + dpu_kms->hw_vbif[vbif_idx] =dpu_hw_vbif_init (vbif_idx, dpu_kms->vbif[vbif_idx], dpu_kms->catalog);if (IS_ERR_OR_NULL (dpu_kms->hw_vbif[vbif_idx])) { rc =PTR_ERR (dpu_kms->hw_vbif[vbif_idx]);
drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c +13 -16
@@ -18,6 +18,14 @@#include "dpu_hw_vbif.h" #include "dpu_trace.h" +static struct dpu_hw_vbif *dpu_get_vbif (struct dpu_kms *dpu_kms,enum dpu_vbif vbif_idx) +{ +if (vbif_idx <ARRAY_SIZE (dpu_kms->hw_vbif)) +return dpu_kms->hw_vbif[vbif_idx]; + +return NULL ; +} +/** * _dpu_vbif_wait_for_xin_halt - wait for the xin to halt * @vbif: Pointer to hardware vbif driver
@@ -155,11 +163,11 @@ static u32 _dpu_vbif_get_ot_limit(struct dpu_hw_vbif *vbif,void dpu_vbif_set_ot_limit (struct dpu_kms *dpu_kms,struct dpu_vbif_set_ot_params *params) { -struct dpu_hw_vbif *vbif =NULL ; +struct dpu_hw_vbif *vbif;struct dpu_hw_mdp *mdp;bool forced_on = false;u32 ot_lim; -int ret, i; +int ret;if (!dpu_kms) {DPU_ERROR ("invalid arguments\n" );
@@ -167,12 +175,7 @@ void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms, } mdp = dpu_kms->hw_mdp; -for (i =0 ; i <ARRAY_SIZE (dpu_kms->hw_vbif); i++) { -if (dpu_kms->hw_vbif[i] && - dpu_kms->hw_vbif[i]->idx == params->vbif_idx) - vbif = dpu_kms->hw_vbif[i]; - } - + vbif =dpu_get_vbif (dpu_kms, params->vbif_idx);if (!vbif || !mdp) {DPU_DEBUG ("invalid arguments vbif %d mdp %d\n" , vbif !=0 , mdp !=0 );
@@ -217,7 +220,7 @@ void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms,void dpu_vbif_set_qos_remap (struct dpu_kms *dpu_kms,struct dpu_vbif_set_qos_params *params) { -struct dpu_hw_vbif *vbif =NULL ; +struct dpu_hw_vbif *vbif;struct dpu_hw_mdp *mdp;bool forced_on = false;const struct dpu_vbif_qos_tbl *qos_tbl;
@@ -229,13 +232,7 @@ void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms, } mdp = dpu_kms->hw_mdp; -for (i =0 ; i <ARRAY_SIZE (dpu_kms->hw_vbif); i++) { -if (dpu_kms->hw_vbif[i] && - dpu_kms->hw_vbif[i]->idx == params->vbif_idx) { - vbif = dpu_kms->hw_vbif[i]; -break ; - } - } + vbif =dpu_get_vbif (dpu_kms, params->vbif_idx);if (!vbif || !vbif->cap) {DPU_ERROR ("invalid vbif %d\n" , params->vbif_idx);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 103/229 ALSA: dmaengine: increment buffer pointer atomically
In reply to Greg Kroah-HartmanFrom: Andreas Pape <[email protected]>
[ Upstream commit d1c442019594692c64a70a86ad88eb5b6db92216 ]
Setting pointer and afterwards checking for wraparound leads to the possibility of returning the inconsistent pointer position.
This patch increments buffer pointer atomically to avoid this issue.
--- sound/core/pcm_dmaengine.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/core/pcm_dmaengine.c +5 -3
@@ -139,12 +139,14 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_set_config_from_dai_data);static void dmaengine_pcm_dma_complete (void *arg) { +unsigned int new_pos;struct snd_pcm_substream *substream = arg;struct dmaengine_pcm_runtime_data *prtd =substream_to_prtd (substream); - prtd->pos +=snd_pcm_lib_period_bytes (substream); -if (prtd->pos >=snd_pcm_lib_buffer_bytes (substream)) - prtd->pos =0 ; + new_pos = prtd->pos +snd_pcm_lib_period_bytes (substream); +if (new_pos >=snd_pcm_lib_buffer_bytes (substream)) + new_pos =0 ; + prtd->pos = new_pos;snd_pcm_period_elapsed (substream); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 104/229 mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit cb58188ad90a61784a56a64f5107faaf2ad323e7 ]
A dma_free_coherent() call is missing in the error handling path of the probe, as already done in the remove function.
--- drivers/mmc/host/wmt-sdmmc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/mmc/host/wmt-sdmmc.c +4 -1
@@ -853,7 +853,7 @@ static int wmt_mci_probe(struct platform_device *pdev)if (IS_ERR (priv->clk_sdmmc)) {dev_err (&pdev->dev,"Error getting clock\n" ); ret =PTR_ERR (priv->clk_sdmmc); - goto fail5; + goto fail5_and_a_half; } ret =clk_prepare_enable (priv->clk_sdmmc);
@@ -870,6 +870,9 @@ static int wmt_mci_probe(struct platform_device *pdev)return 0 ; fail6:clk_put (priv->clk_sdmmc); +fail5_and_a_half: +dma_free_coherent (&pdev->dev, mmc->max_blk_count *16 , + priv->dma_desc_buffer, priv->dma_desc_device_addr); fail5:free_irq (dma_irq, priv); fail4:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 105/229 ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 41a736ac20602f64773e80f0f5b32cde1830a44a ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of wm8997_probe
--- sound/soc/codecs/wm8997.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm8997.c +3 -3
@@ -1159,9 +1159,6 @@ static int wm8997_probe(struct platform_device *pdev)regmap_update_bits (arizona->regmap, wm8997_digital_vu[i],WM8997_DIG_VU ,WM8997_DIG_VU ); -pm_runtime_enable (&pdev->dev); -pm_runtime_idle (&pdev->dev); -arizona_init_common (arizona); ret =arizona_init_vol_limit (arizona);
@@ -1180,6 +1177,9 @@ static int wm8997_probe(struct platform_device *pdev) goto err_spk_irqs; } +pm_runtime_enable (&pdev->dev); +pm_runtime_idle (&pdev->dev); +return ret; err_spk_irqs:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 106/229 ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 86b46bf1feb83898d89a2b4a8d08d21e9ea277a7 ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of wm5110_probe.
--- sound/soc/codecs/wm5110.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm5110.c +3 -3
@@ -2453,9 +2453,6 @@ static int wm5110_probe(struct platform_device *pdev)regmap_update_bits (arizona->regmap, wm5110_digital_vu[i],WM5110_DIG_VU ,WM5110_DIG_VU ); -pm_runtime_enable (&pdev->dev); -pm_runtime_idle (&pdev->dev); - ret =arizona_request_irq (arizona,ARIZONA_IRQ_DSP_IRQ1 ,"ADSP2 Compressed IRQ" , wm5110_adsp2_irq, wm5110);
@@ -2488,6 +2485,9 @@ static int wm5110_probe(struct platform_device *pdev) goto err_spk_irqs; } +pm_runtime_enable (&pdev->dev); +pm_runtime_idle (&pdev->dev); +return ret; err_spk_irqs:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 107/229 ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit fcbb60820cd3008bb44334a0395e5e57ccb77329 ]
The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of wm5102_probe.
--- sound/soc/codecs/wm5102.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm5102.c +3 -3
@@ -2085,9 +2085,6 @@ static int wm5102_probe(struct platform_device *pdev)regmap_update_bits (arizona->regmap, wm5102_digital_vu[i],WM5102_DIG_VU ,WM5102_DIG_VU ); -pm_runtime_enable (&pdev->dev); -pm_runtime_idle (&pdev->dev); - ret =arizona_request_irq (arizona,ARIZONA_IRQ_DSP_IRQ1 ,"ADSP2 Compressed IRQ" , wm5102_adsp2_irq, wm5102);
@@ -2120,6 +2117,9 @@ static int wm5102_probe(struct platform_device *pdev) goto err_spk_irqs; } +pm_runtime_enable (&pdev->dev); +pm_runtime_idle (&pdev->dev); +return ret; err_spk_irqs:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 108/229 memory: of: Fix refcount leak bug in of_get_ddr_timings()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 05215fb32010d4afb68fbdbb4d237df6e2d4567b ]
We should add the of_node_put() when breaking out of for_each_child_of_node() as it will automatically increase and decrease the refcount.
--- drivers/memory/of_memory.c | 1 + 1 file changed, 1 insertion(+)
drivers/memory/of_memory.c +1 -0
@@ -135,6 +135,7 @@ const struct lpddr2_timings *of_get_ddr_timings(struct device_node *np_ddr,for_each_child_of_node (np_ddr, np_tim) {if (of_device_is_compatible (np_tim, tim_compat)) {if (of_do_get_timings (np_tim, &timings[i])) { +of_node_put (np_tim);devm_kfree (dev, timings); goto default_timings; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 109/229 soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit af8f6f39b8afd772fda4f8e61823ef8c021bf382 ]
There are two refcount leak bugs in qcom_smsm_probe():
(1) The 'local_node' is escaped out from for_each_child_of_node() as the break of iteration, we should call of_node_put() for it in error path or when it is not used anymore.
(2) The 'node' is escaped out from for_each_available_child_of_node() as the 'goto', we should call of_node_put() for it in goto target.
--- drivers/soc/qcom/smsm.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/soc/qcom/smsm.c +13 -7
@@ -519,7 +519,7 @@ static int qcom_smsm_probe(struct platform_device *pdev)for (id =0 ; id < smsm->num_hosts; id++) { ret =smsm_parse_ipc (smsm, id);if (ret <0 ) -return ret; + goto out_put; }/* Acquire the main SMSM state vector */
@@ -527,13 +527,14 @@ static int qcom_smsm_probe(struct platform_device *pdev) smsm->num_entries * sizeof(u32));if (ret <0 && ret != -EEXIST ) {dev_err (&pdev->dev,"unable to allocate shared state entry\n" ); -return ret; + goto out_put; } states =qcom_smem_get (QCOM_SMEM_HOST_ANY ,SMEM_SMSM_SHARED_STATE ,NULL );if (IS_ERR (states)) {dev_err (&pdev->dev,"Unable to acquire shared state entry\n" ); -return PTR_ERR (states); + ret =PTR_ERR (states); + goto out_put; }/* Acquire the list of interrupt mask vectors */
@@ -541,13 +542,14 @@ static int qcom_smsm_probe(struct platform_device *pdev) ret =qcom_smem_alloc (QCOM_SMEM_HOST_ANY ,SMEM_SMSM_CPU_INTR_MASK , size);if (ret <0 && ret != -EEXIST ) {dev_err (&pdev->dev,"unable to allocate smsm interrupt mask\n" ); -return ret; + goto out_put; } intr_mask =qcom_smem_get (QCOM_SMEM_HOST_ANY ,SMEM_SMSM_CPU_INTR_MASK ,NULL );if (IS_ERR (intr_mask)) {dev_err (&pdev->dev,"unable to acquire shared memory interrupt mask\n" ); -return PTR_ERR (intr_mask); + ret =PTR_ERR (intr_mask); + goto out_put; }/* Setup the reference to the local state bits */
@@ -558,7 +560,8 @@ static int qcom_smsm_probe(struct platform_device *pdev) smsm->state =qcom_smem_state_register (local_node, &smsm_state_ops, smsm);if (IS_ERR (smsm->state)) {dev_err (smsm->dev,"failed to register qcom_smem_state\n" ); -return PTR_ERR (smsm->state); + ret =PTR_ERR (smsm->state); + goto out_put; }/* Register handlers for remote processor entries of interest. */
@@ -588,16 +591,19 @@ static int qcom_smsm_probe(struct platform_device *pdev) }platform_set_drvdata (pdev, smsm); +of_node_put (local_node);return 0 ; unwind_interfaces: +of_node_put (node);for (id =0 ; id < smsm->num_entries; id++)if (smsm->entries[id].domain)irq_domain_remove (smsm->entries[id].domain);qcom_smem_state_unregister (smsm->state); - +out_put: +of_node_put (local_node);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 110/229 soc: qcom: smem_state: Add refcounting for the state->of_node
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 90681f53b9381c23ff7762a3b13826d620c272de ]
In qcom_smem_state_register() and qcom_smem_state_release(), we should better use of_node_get() and of_node_put() for the reference creation and destruction of 'device_node'.
--- drivers/soc/qcom/smem_state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/soc/qcom/smem_state.c +2 -1
@@ -144,6 +144,7 @@ static void qcom_smem_state_release(struct kref *ref) struct qcom_smem_state *state = container_of(ref, struct qcom_smem_state, refcount);list_del (&state->list); +of_node_put (state->of_node);kfree (state); }
@@ -177,7 +178,7 @@ struct qcom_smem_state *qcom_smem_state_register(struct device_node *of_node,kref_init (&state->refcount); - state->of_node = of_node; + state->of_node =of_node_get (of_node); state->ops = *ops; state->priv = priv;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 111/229 ARM: dts: turris-omnia: Fix mpp26 pin name and comment
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
[ Upstream commit 49e93898f0dc177e645c22d0664813567fd9ec00 ]
There is a bug in Turris Omnia's schematics, whereupon the MPP[26] pin, which is routed to CN11 pin header, is documented as SPI CS1, but MPP[26] pin does not support this function. Instead it controls chip select 2 if in "spi0" mode.
Fix the name of the pin node in pinctrl node and fix the comment in SPI node.
--- arch/arm/boot/dts/armada-385-turris-omnia.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/armada-385-turris-omnia.dts +2 -2
@@ -307,7 +307,7 @@ marvell,function = "spi0"; }; - spi0cs1_pins: spi0cs1-pins { + spi0cs2_pins: spi0cs2-pins { marvell,pins = "mpp26"; marvell,function = "spi0"; };
@@ -342,7 +342,7 @@ }; }; - /* MISO, MOSI, SCLK and CS1 are routed to pin header CN11 */ + /* MISO, MOSI, SCLK and CS2 are routed to pin header CN11 */ }; &uart0 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 112/229 ARM: dts: kirkwood: lsxl: fix serial line
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit 04eabc6ac10fda9424606d9a7ab6ab9a5d95350a ]
Commit 327e15428977 ("ARM: dts: kirkwood: consolidate common pinctrl settings") unknowingly broke the serial output on this board. Before this commit, the pinmux was still configured by the bootloader and the kernel didn't reconfigured it again. This was an oversight by the initial board support where the pinmux for the serial line was never configured by the kernel. But with this commit, the serial line will be reconfigured to the wrong pins. This is especially confusing, because the output still works, but the input doesn't. Presumingly, the input is reconfigured to MPP10, but the output is connected to both MPP11 and MPP5.
Override the pinmux in the board device tree.
--- arch/arm/boot/dts/kirkwood-lsxl.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm/boot/dts/kirkwood-lsxl.dtsi +5 -0
@@ -10,6 +10,11 @@ ocp@f1000000 { pinctrl: pin-controller@10000 { + /* Non-default UART pins */ + pmx_uart0: pmx-uart0 { + marvell,pins = "mpp4", "mpp5"; + }; + pmx_power_hdd: pmx-power-hdd { marvell,pins = "mpp10"; marvell,function = "gpo";
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 113/229 ARM: dts: kirkwood: lsxl: remove first ethernet port
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit 2d528eda7c96ce5c70f895854ecd5684bd5d80b9 ]
Both the Linkstation LS-CHLv2 and the LS-XHL have only one ethernet port. This has always been wrong, i.e. the board code used to set up both ports, but the driver will play nice and return -ENODEV if the assiciated PHY is not found. Nevertheless, it is wrong. Remove it.
--- arch/arm/boot/dts/kirkwood-lsxl.dtsi | 11 ----------- 1 file changed, 11 deletions(-)
arch/arm/boot/dts/kirkwood-lsxl.dtsi +0 -11
@@ -218,22 +218,11 @@ &mdio { status = "okay"; - ethphy0: ethernet-phy@0 { - reg = <0>; - }; - ethphy1: ethernet-phy@8 { reg = <8>; }; }; -ð0 { - status = "okay"; - ethernet0-port@0 { - phy-handle = <ðphy0>; - }; -}; - ð1 { status = "okay"; ethernet1-port@0 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 114/229 ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit 3ba2d4bb9592bf7a6a3fe3dbe711ecfc3d004bab ]
According to s5k6a3 driver code, the reset line for the chip appears to be active low. This also matches the typical polarity of reset lines in general. Let's fix it up as having correct polarity in DTS is important when the driver will be switched over to gpiod API.
--- arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos4412-midas.dtsi +1 -1
@@ -525,7 +525,7 @@ clocks = <&camera 1>; clock-names = "extclk"; samsung,camclk-out = <1>; - gpios = <&gpm1 6 GPIO_ACTIVE_HIGH>; + gpios = <&gpm1 6 GPIO_ACTIVE_LOW>; port { is_s5k6a3_ep: endpoint {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 115/229 ARM: Drop CMDLINE_* dependency on ATAGS
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 136f4b1ec7c962ee37a787e095fd37b058d72bd3 ]
On arm32, the configuration options to specify the kernel command line type depend on ATAGS. However, the actual CMDLINE cofiguration option does not depend on ATAGS, and the code that handles this is not specific to ATAGS (see drivers/of/fdt.c:early_init_dt_scan_chosen()).
Hence users who desire to override the kernel command line on arm32 must enable support for ATAGS, even on a pure-DT system. Other architectures (arm64, loongarch, microblaze, nios2, powerpc, and riscv) do not impose such a restriction.
Hence drop the dependency on ATAGS.
--- arch/arm/Kconfig | 1 - 1 file changed, 1 deletion(-)
arch/arm/Kconfig +0 -1
@@ -1943,7 +1943,6 @@ config CMDLINE choice prompt "Kernel command line type" if CMDLINE != "" default CMDLINE_FROM_BOOTLOADER - depends on ATAGS config CMDLINE_FROM_BOOTLOADER bool "Use bootloader kernel arguments if available"
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 116/229 ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit a08137bd1e0a7ce951dce9ce4a83e39d379b6e1b ]
EHCI Oxynos (drivers/usb/host/ehci-exynos.c) drives VBUS GPIO high when trying to power up the bus, therefore the GPIO in DTS must be marked as "active high". This will be important when EHCI driver is converted to gpiod API that respects declared polarities.
--- arch/arm/boot/dts/exynos4412-origen.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos4412-origen.dts +1 -1
@@ -87,7 +87,7 @@ }; &ehci { - samsung,vbus-gpio = <&gpx3 5 1>; + samsung,vbus-gpio = <&gpx3 5 GPIO_ACTIVE_HIGH>; status = "okay"; port@1 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 117/229 iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit bb73d5d9164c57c4bb916739a98e5cd8e0a5ed8c ]
All ADC HW versions handled by this driver (SAMA5D2, SAM9X60, SAMA7G5) have MR.TRACKTIM on 4 bits. Fix AT91_SAMA5D2_MR_TRACKTIM_MAX to reflect this.
--- drivers/iio/adc/at91-sama5d2_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/at91-sama5d2_adc.c +1 -1
@@ -81,7 +81,7 @@#define AT91_SAMA5D2_MR_ANACH BIT(23)/* Tracking Time */ #define AT91_SAMA5D2_MR_TRACKTIM (v) ((v) << 24) -#define AT91_SAMA5D2_MR_TRACKTIM_MAX 0xff +#define AT91_SAMA5D2_MR_TRACKTIM_MAX 0xf/* Transfer Time */ #define AT91_SAMA5D2_MR_TRANSFER (v) ((v) << 28)#define AT91_SAMA5D2_MR_TRANSFER_MAX 0x3
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 118/229 iio: adc: at91-sama5d2_adc: check return status for pressure and touch
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit d84ace944a3b24529798dbae1340dea098473155 ]
Check return status of at91_adc_read_position() and at91_adc_read_pressure() in at91_adc_read_info_raw().
--- drivers/iio/adc/at91-sama5d2_adc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/iio/adc/at91-sama5d2_adc.c +6 -2
@@ -1329,8 +1329,10 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev, *val = tmp_val;mutex_unlock (&st->lock);iio_device_release_direct_mode (indio_dev); +if (ret >0 ) + ret =at91_adc_adjust_val_osr (st, val); -return at91_adc_adjust_val_osr (st, val); +return ret; }if (chan->type ==IIO_PRESSURE ) { ret =iio_device_claim_direct_mode (indio_dev);
@@ -1343,8 +1345,10 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev, *val = tmp_val;mutex_unlock (&st->lock);iio_device_release_direct_mode (indio_dev); +if (ret >0 ) + ret =at91_adc_adjust_val_osr (st, val); -return at91_adc_adjust_val_osr (st, val); +return ret; }/* in this case we have a voltage channel */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 119/229 iio: inkern: only release the device node when done with it
In reply to Greg Kroah-HartmanFrom: Nuno Sá <[email protected]>
[ Upstream commit 79c3e84874c7d14f04ad58313b64955a0d2e9437 ]
'of_node_put()' can potentially release the memory pointed to by 'iiospec.np' which would leave us with an invalid pointer (and we would still pass it in 'of_xlate()'). Note that it is not guaranteed for the of_node lifespan to be attached to the device (to which is attached) lifespan so that there is (even though very unlikely) the possibility for the node to be freed while the device is still around. Thus, as there are indeed some of_xlate users which do access the node, a race is indeed possible.
As such, we can only release the node after we are done with it.
--- drivers/iio/inkern.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/iio/inkern.c +4 -2
@@ -139,9 +139,10 @@ static int __of_iio_channel_get(struct iio_channel *channel, idev =bus_find_device (&iio_bus_type,NULL , iiospec.np, iio_dev_node_match); -of_node_put (iiospec.np); -if (idev ==NULL ) +if (idev ==NULL ) { +of_node_put (iiospec.np);return -EPROBE_DEFER ; + } indio_dev =dev_to_iio_dev (idev); channel->indio_dev = indio_dev;
@@ -149,6 +150,7 @@ static int __of_iio_channel_get(struct iio_channel *channel, index = indio_dev->info->of_xlate (indio_dev, &iiospec); else index =__of_iio_simple_xlate (indio_dev, &iiospec); +of_node_put (iiospec.np);if (index <0 ) goto err_put; channel->channel = &indio_dev->channels[index];
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 120/229 iio: ABI: Fix wrong format of differential capacitance channel ABI.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
[ Upstream commit 1efc41035f1841acf0af2bab153158e27ce94f10 ]
in_ only occurs once in these attributes.
--- Documentation/ABI/testing/sysfs-bus-iio | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/ABI/testing/sysfs-bus-iio +1 -1
@@ -135,7 +135,7 @@ Description: Raw capacitance measurement from channel Y. Units after application of scale and offset are nanofarads. -What: /sys/.../iio:deviceX/in_capacitanceY-in_capacitanceZ_raw +What: /sys/.../iio:deviceX/in_capacitanceY-capacitanceZ_raw KernelVersion: 3.2 Contact: [email protected] Description:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 121/229 clk: oxnas: Hold reference returned by of_get_parent()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 1d6aa08c54cd0e005210ab8e3b1e92ede70f8a4f ]
In oxnas_stdclk_probe(), we need to hold the reference returned by of_get_parent() and use it to call of_node_put() for refcount balance.
--- drivers/clk/clk-oxnas.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/clk/clk-oxnas.c +4 -2
@@ -218,7 +218,7 @@ static const struct of_device_id oxnas_stdclk_dt_ids[] = {static int oxnas_stdclk_probe (struct platform_device *pdev) { -struct device_node *np = pdev->dev.of_node; +struct device_node *np = pdev->dev.of_node, *parent_np;const struct oxnas_stdclk_data *data;const struct of_device_id *id;struct regmap *regmap;
@@ -230,7 +230,9 @@ static int oxnas_stdclk_probe(struct platform_device *pdev)return -ENODEV ; data = id->data; - regmap =syscon_node_to_regmap (of_get_parent (np)); + parent_np =of_get_parent (np); + regmap =syscon_node_to_regmap (parent_np); +of_node_put (parent_np);if (IS_ERR (regmap)) {dev_err (&pdev->dev,"failed to have parent regmap\n" );return PTR_ERR (regmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 122/229 clk: berlin: Add of_node_put() for of_get_parent()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 37c381b812dcbfde9c3f1f3d3e75fdfc1b40d5bc ]
In berlin2_clock_setup() and berlin2q_clock_setup(), we need to call of_node_put() for the reference returned by of_get_parent() which has increased the refcount. We should call *_put() in fail path or when it is not used anymore.
--- drivers/clk/berlin/bg2.c | 5 ++++- drivers/clk/berlin/bg2q.c | 6 +++++- 2 files changed, 9 insertions(+), 2 deletions(-)
drivers/clk/berlin/bg2.c +4 -1
@@ -499,12 +499,15 @@ static void __init berlin2_clock_setup(struct device_node *np)int n, ret; clk_data =kzalloc (struct_size (clk_data, hws,MAX_CLKS ),GFP_KERNEL ); -if (!clk_data) +if (!clk_data) { +of_node_put (parent_np);return ; + } clk_data->num =MAX_CLKS ; hws = clk_data->hws; gbase =of_iomap (parent_np,0 ); +of_node_put (parent_np);if (!gbase)return ;
drivers/clk/berlin/bg2q.c +5 -1
@@ -285,19 +285,23 @@ static void __init berlin2q_clock_setup(struct device_node *np)int n, ret; clk_data =kzalloc (struct_size (clk_data, hws,MAX_CLKS ),GFP_KERNEL ); -if (!clk_data) +if (!clk_data) { +of_node_put (parent_np);return ; + } clk_data->num =MAX_CLKS ; hws = clk_data->hws; gbase =of_iomap (parent_np,0 );if (!gbase) { +of_node_put (parent_np);pr_err ("%pOF: Unable to map global base\n" , np);return ; }/* BG2Q CPU PLL is not part of global registers */ cpupll_base =of_iomap (parent_np,1 ); +of_node_put (parent_np);if (!cpupll_base) {pr_err ("%pOF: Unable to map cpupll base\n" , np);iounmap (gbase);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 123/229 clk: tegra: Fix refcount leak in tegra210_clock_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 56c78cb1f00a9dde8cd762131ce8f4c5eb046fbb ]
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/clk/tegra/clk-tegra210.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/tegra/clk-tegra210.c +1 -0
@@ -3529,6 +3529,7 @@ static void __init tegra210_clock_init(struct device_node *np) } pmc_base =of_iomap (node,0 ); +of_node_put (node);if (!pmc_base) {pr_err ("Can't map pmc registers\n" );WARN_ON (1 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 124/229 clk: tegra: Fix refcount leak in tegra114_clock_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit db16a80c76ea395766913082b1e3f939dde29b2c ]
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/clk/tegra/clk-tegra114.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/tegra/clk-tegra114.c +1 -0
@@ -1348,6 +1348,7 @@ static void __init tegra114_clock_init(struct device_node *np) } pmc_base =of_iomap (node,0 ); +of_node_put (node);if (!pmc_base) {pr_err ("Can't map pmc registers\n" );WARN_ON (1 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 125/229 clk: tegra20: Fix refcount leak in tegra20_clock_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 4e343bafe03ff68a62f48f8235cf98f2c685468b ]
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/clk/tegra/clk-tegra20.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/tegra/clk-tegra20.c +1 -0
@@ -1152,6 +1152,7 @@ static void __init tegra20_clock_init(struct device_node *np) } pmc_base =of_iomap (node,0 ); +of_node_put (node);if (!pmc_base) {pr_err ("Can't map pmc registers\n" );BUG ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 126/229 HSI: omap_ssi: Fix refcount leak in ssi_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9a2ea132df860177b33c9fd421b26c4e9a0a9396 ]
When returning or breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the child node to possibly release the node.
--- drivers/hsi/controllers/omap_ssi_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/hsi/controllers/omap_ssi_core.c +1 -0
@@ -560,6 +560,7 @@ static int ssi_probe(struct platform_device *pd)if (!childpdev) { err = -ENODEV ;dev_err (&pd->dev,"failed to create ssi controller port\n" ); +of_node_put (child); goto out3; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 127/229 HSI: omap_ssi_port: Fix dma_map_sg error check
In reply to Greg Kroah-HartmanFrom: Jack Wang <[email protected]>
[ Upstream commit 551e325bbd3fb8b5a686ac1e6cf76e5641461cf2 ]
dma_map_sg return 0 on error, in case of error return -EIO to caller.
--- drivers/hsi/controllers/omap_ssi_port.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/hsi/controllers/omap_ssi_port.c +4 -4
@@ -253,10 +253,10 @@ static int ssi_start_dma(struct hsi_msg *msg, int lch)if (msg->ttype ==HSI_MSG_READ ) { err =dma_map_sg (&ssi->device, msg->sgt.sgl, msg->sgt.nents,DMA_FROM_DEVICE ); -if (err <0 ) { +if (!err) {dev_dbg (&ssi->device,"DMA map SG failed !\n" );pm_runtime_put_autosuspend (omap_port->pdev); -return err; +return -EIO ; } csdp = SSI_DST_BURST_4x32_BIT |SSI_DST_MEMORY_PORT | SSI_SRC_SINGLE_ACCESS0 | SSI_SRC_PERIPHERAL_PORT |
@@ -270,10 +270,10 @@ static int ssi_start_dma(struct hsi_msg *msg, int lch) }else { err =dma_map_sg (&ssi->device, msg->sgt.sgl, msg->sgt.nents,DMA_TO_DEVICE ); -if (err <0 ) { +if (!err) {dev_dbg (&ssi->device,"DMA map SG failed !\n" );pm_runtime_put_autosuspend (omap_port->pdev); -return err; +return -EIO ; } csdp = SSI_SRC_BURST_4x32_BIT |SSI_SRC_MEMORY_PORT | SSI_DST_SINGLE_ACCESS0 | SSI_DST_PERIPHERAL_PORT |
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 128/229 media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 211f8304fa21aaedc2c247f0c9d6c7f1aaa61ad7 ]
In fimc_is_register_subdevs(), we need to call of_node_put() for the reference 'i2c_bus' when breaking out of the for_each_compatible_node() which has increased the refcount.
--- drivers/media/platform/exynos4-is/fimc-is.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/exynos4-is/fimc-is.c +1 -0
@@ -217,6 +217,7 @@ static int fimc_is_register_subdevs(struct fimc_is *is)if (ret <0 || index >=FIMC_IS_SENSORS_NUM ) {of_node_put (child); +of_node_put (i2c_bus);return ret; } index++;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 129/229 tty: xilinx_uartps: Fix the ignore_status
In reply to Greg Kroah-HartmanFrom: Shubhrajyoti Datta <[email protected]>
[ Upstream commit b8a6c3b3d4654fba19881cc77da61eac29f57cae ]
Currently the ignore_status is not considered in the isr. Add a check to add the ignore_status.
--- drivers/tty/serial/xilinx_uartps.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/xilinx_uartps.c +2 -0
@@ -365,6 +365,8 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id) isrstatus &= ~CDNS_UART_IXR_TXEMPTY ; } + isrstatus &= port->read_status_mask; + isrstatus &= ~port->ignore_status_mask;/* * Skip RX processing if RX is disabled as RXEMPTY will never be set * as read bytes will not be removed from the FIFO.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 130/229 media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 1c78f19c3a0ea312a8178a6bfd8934eb93e9b10a ]
of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/media/platform/xilinx/xilinx-vipp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/platform/xilinx/xilinx-vipp.c +5 -4
@@ -464,7 +464,7 @@ static int xvip_graph_dma_init(struct xvip_composite_device *xdev) {struct device_node *ports;struct device_node *port; -int ret; +int ret =0 ; ports =of_get_child_by_name (xdev->dev->of_node,"ports" );if (ports ==NULL ) {
@@ -474,13 +474,14 @@ static int xvip_graph_dma_init(struct xvip_composite_device *xdev)for_each_child_of_node (ports, port) { ret =xvip_graph_dma_init_one (xdev, port); -if (ret <0 ) { +if (ret) {of_node_put (port); -return ret; +break ; } } -return 0 ; +of_node_put (ports); +return ret; }static void xvip_graph_cleanup (struct xvip_composite_device *xdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 131/229 RDMA/rxe: Fix "kernel NULL pointer dereference" error
In reply to Greg Kroah-HartmanFrom: Zhu Yanjun <[email protected]>
[ Upstream commit a625ca30eff806395175ebad3ac1399014bdb280 ]
When rxe_queue_init in the function rxe_qp_init_req fails, both qp->req.task.func and qp->req.task.arg are not initialized.
Because of creation of qp fails, the function rxe_create_qp will call rxe_qp_do_cleanup to handle allocated resource.
Before calling __rxe_do_task, both qp->req.task.func and qp->req.task.arg should be checked.
--- drivers/infiniband/sw/rxe/rxe_qp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_qp.c +3 -1
@@ -799,7 +799,9 @@ void rxe_qp_destroy(struct rxe_qp *qp)rxe_cleanup_task (&qp->comp.task);/* flush out any receive wr's or pending requests */ -__rxe_do_task (&qp->req.task); +if (qp->req.task.func) +__rxe_do_task (&qp->req.task); +if (qp->sq.queue) {__rxe_do_task (&qp->comp.task);__rxe_do_task (&qp->req.task);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 132/229 RDMA/rxe: Fix the error caused by qp->sk
In reply to Greg Kroah-HartmanFrom: Zhu Yanjun <[email protected]>
[ Upstream commit 548ce2e66725dcba4e27d1e8ac468d5dd17fd509 ]
When sock_create_kern in the function rxe_qp_init_req fails, qp->sk is set to NULL.
Then the function rxe_create_qp will call rxe_qp_do_cleanup to handle allocated resource.
Before handling qp->sk, this variable should be checked.
--- drivers/infiniband/sw/rxe/rxe_qp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/sw/rxe/rxe_qp.c +4 -2
@@ -841,8 +841,10 @@ static void rxe_qp_do_cleanup(struct work_struct *work)free_rd_atomic_resources (qp); -kernel_sock_shutdown (qp->sk,SHUT_RDWR ); -sock_release (qp->sk); +if (qp->sk) { +kernel_sock_shutdown (qp->sk,SHUT_RDWR ); +sock_release (qp->sk); + } }/* called when the last reference to the qp is dropped */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 133/229 dyndbg: fix module.dyndbg handling
In reply to Greg Kroah-HartmanFrom: Jim Cromie <[email protected]>
[ Upstream commit 85d6b66d31c35158364058ee98fb69ab5bb6a6b1 ]
For CONFIG_DYNAMIC_DEBUG=N, the ddebug_dyndbg_module_param_cb() stub-fn is too permissive:
bash-5.1# modprobe drm JUNKdyndbg
bash-5.1# modprobe drm dyndbgJUNK
[ 42.933220] dyndbg param is supported only in CONFIG_DYNAMIC_DEBUG builds [ 42.937484] ACPI: bus type drm_connector registered
This caused no ill effects, because unknown parameters are either ignored by default with an "unknown parameter" warning, or ignored because dyndbg allows its no-effect use on non-dyndbg builds.
But since the code has an explicit feedback message, it should be issued accurately. Fix with strcmp for exact param-name match.
--- include/linux/dynamic_debug.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/dynamic_debug.h +1 -1
@@ -168,7 +168,7 @@ static inline int ddebug_remove_module(const char *mod)static inline int ddebug_dyndbg_module_param_cb (char *param,char *val,const char *modname) { -if (strstr (param,"dyndbg" )) { +if (!strcmp (param,"dyndbg" )) {/* avoid pr_warn(), which wants pr_fmt() fully defined */ printk (KERN_WARNING "dyndbg param is supported only in " "CONFIG_DYNAMIC_DEBUG builds\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 134/229 dyndbg: let query-modname override actual module name
In reply to Greg Kroah-HartmanFrom: Jim Cromie <[email protected]>
[ Upstream commit e75ef56f74965f426dd819a41336b640ffdd8fbc ]
dyndbg's control-parser: ddebug_parse_query(), requires that search
terms: module, func, file, lineno, are used only once in a query; a thing cannot be named both foo and bar.
The cited commit added an overriding module modname, taken from the module loader, which is authoritative. So it set query.module 1st, which disallowed its use in the query-string.
But now, its useful to allow a module-load to enable classes across a whole (or part of) a subsystem at once.
# enable (dynamic-debug in) drm only modprobe drm dyndbg="class DRM_UT_CORE +p"
# get drm_helper too modprobe drm dyndbg="class DRM_UT_CORE module drm* +p"
# get everything that knows DRM_UT_CORE modprobe drm dyndbg="class DRM_UT_CORE module * +p"
# also for boot-args: drm.dyndbg="class DRM_UT_CORE module * +p"
So convert the override into a default, by filling it only when/after the query-string omitted the module.
NB: the query class FOO handling is forthcoming.
--- lib/dynamic_debug.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
lib/dynamic_debug.c +7 -4
@@ -327,10 +327,6 @@ static int ddebug_parse_query(char *words[], int nwords, }memset (query,0 ,sizeof (*query)); -if (modname) -/* support $modname.dyndbg=<multiple queries> */ - query->module = modname; -for (i =0 ; i < nwords; i +=2 ) {if (!strcmp (words[i],"func" )) { rc =check_set (&query->function, words[i+1 ],"func" );
@@ -379,6 +375,13 @@ static int ddebug_parse_query(char *words[], int nwords,if (rc)return rc; } +if (!query->module && modname) +/* +* support $modname.dyndbg=<multiple queries>, when +* not given in the query itself +*/ + query->module = modname; +vpr_info_dq (query,"parsed" );return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 135/229 mtd: devices: docg3: check the return value of devm_ioremap() in the probe
In reply to Greg Kroah-HartmanFrom: William Dean <[email protected]>
[ Upstream commit 26e784433e6c65735cd6d93a8db52531970d9a60 ]
The function devm_ioremap() in docg3_probe() can fail, so its return value should be checked.
--- drivers/mtd/devices/docg3.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/mtd/devices/docg3.c +6 -1
@@ -1990,9 +1990,14 @@ static int __init docg3_probe(struct platform_device *pdev)dev_err (dev,"No I/O memory resource defined\n" );return ret; } - base =devm_ioremap (dev, ress->start,DOC_IOSPACE_SIZE ); ret = -ENOMEM ; + base =devm_ioremap (dev, ress->start,DOC_IOSPACE_SIZE ); +if (!base) { +dev_err (dev,"devm_ioremap dev failed\n" ); +return ret; + } + cascade =devm_kcalloc (dev,DOC_MAX_NBFLOORS ,sizeof (*cascade),GFP_KERNEL );if (!cascade)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 136/229 ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
[ Upstream commit 690aa8c3ae308bc696ec8b1b357b995193927083 ]
ACS-5 section
7.13.6.41 Words 85..87, 120: Commands and feature sets supported or enabled states that:
If bit 15 of word 86 is set to one, bit 14 of word 119 is set to one, and bit 15 of word 119 is cleared to zero, then word 119 is valid.
If bit 15 of word 86 is set to one, bit 14 of word 120 is set to one, and bit 15 of word 120 is cleared to zero, then word 120 is valid.
(This text also exists in really old ACS standards, e.g. ACS-3.)
Currently, ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() both check bit 15 of word 86, but neither of them check that bit 14 of word 119 is set to one, or that bit 15 of word 119 is cleared to zero.
Additionally, make ata_id_sense_reporting_enabled() return false if !ata_id_has_sense_reporting(), similar to how e.g. ata_id_flush_ext_enabled() returns false if !ata_id_has_flush_ext().
--- include/linux/ata.h | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
include/linux/ata.h +9 -4
@@ -786,16 +786,21 @@ static inline bool ata_id_has_read_log_dma_ext(const u16 *id)static inline bool ata_id_has_sense_reporting (const u16 *id) { -if (!(id[ATA_ID_CFS_ENABLE_2 ] & (1 <<15 ))) +if (!(id[ATA_ID_CFS_ENABLE_2 ] &BIT (15 ))) +return false; +if ((id[ATA_ID_COMMAND_SET_3 ] & (BIT (15 ) |BIT (14 ))) !=BIT (14 ))return false; -return id[ATA_ID_COMMAND_SET_3 ] & (1 <<6 ); +return id[ATA_ID_COMMAND_SET_3 ] &BIT (6 ); }static inline bool ata_id_sense_reporting_enabled (const u16 *id) { -if (!(id[ATA_ID_CFS_ENABLE_2 ] & (1 <<15 ))) +if (!ata_id_has_sense_reporting (id)) +return false; +/* ata_id_has_sense_reporting() == true, word 86 must have bit 15 set */ +if ((id[ATA_ID_COMMAND_SET_4 ] & (BIT (15 ) |BIT (14 ))) !=BIT (14 ))return false; -return id[ATA_ID_COMMAND_SET_4 ] & (1 <<6 ); +return id[ATA_ID_COMMAND_SET_4 ] &BIT (6 ); }/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 137/229 ata: fix ata_id_has_devslp()
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
[ Upstream commit 9c6e09a434e1317e09b78b3b69cd384022ec9a03 ]
ACS-5 section
7.13.6.36 Word 78: Serial ATA features supported
states that:
If word 76 is not 0000h or FFFFh, word 78 reports the features supported by the device. If this word is not supported, the word shall be cleared to zero.
(This text also exists in really old ACS standards, e.g. ACS-3.)
Additionally, move the macro to the other ATA_ID_FEATURE_SUPP macros (which already have this check), thus making it more likely that the next ATA_ID_FEATURE_SUPP macro that is added will include this check.
--- include/linux/ata.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/linux/ata.h +4 -1
@@ -581,6 +581,10 @@ struct ata_bmdma_prd { ((((id)[ATA_ID_SATA_CAPABILITY ] !=0x0000 ) && \ ((id)[ATA_ID_SATA_CAPABILITY ] !=0xffff )) && \ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 2))) +#define ata_id_has_devslp (id) \ + ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ + ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ + ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8)))#define ata_id_iordy_disable (id) ((id)[ATA_ID_CAPABILITY] & (1 << 10))#define ata_id_has_iordy (id) ((id)[ATA_ID_CAPABILITY] & (1 << 11))#define ata_id_u32 (id,n) \
@@ -593,7 +597,6 @@ struct ata_bmdma_prd {#define ata_id_cdb_intr (id) (((id)[ATA_ID_CONFIG] & 0x60) == 0x20)#define ata_id_has_da (id) ((id)[ATA_ID_SATA_CAPABILITY_2] & (1 << 4)) -#define ata_id_has_devslp (id) ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8))#define ata_id_has_ncq_autosense (id) \ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 138/229 ata: fix ata_id_has_ncq_autosense()
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
[ Upstream commit a5fb6bf853148974dbde092ec1bde553bea5e49f ]
ACS-5 section
7.13.6.36 Word 78: Serial ATA features supported
states that:
If word 76 is not 0000h or FFFFh, word 78 reports the features supported by the device. If this word is not supported, the word shall be cleared to zero.
(This text also exists in really old ACS standards, e.g. ACS-3.)
Additionally, move the macro to the other ATA_ID_FEATURE_SUPP macros (which already have this check), thus making it more likely that the next ATA_ID_FEATURE_SUPP macro that is added will include this check.
--- include/linux/ata.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
include/linux/ata.h +4 -2
@@ -585,6 +585,10 @@ struct ata_bmdma_prd { ((((id)[ATA_ID_SATA_CAPABILITY ] !=0x0000 ) && \ ((id)[ATA_ID_SATA_CAPABILITY ] !=0xffff )) && \ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8))) +#define ata_id_has_ncq_autosense (id) \ + ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ + ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ + ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7)))#define ata_id_iordy_disable (id) ((id)[ATA_ID_CAPABILITY] & (1 << 10))#define ata_id_has_iordy (id) ((id)[ATA_ID_CAPABILITY] & (1 << 11))#define ata_id_u32 (id,n) \
@@ -597,8 +601,6 @@ struct ata_bmdma_prd {#define ata_id_cdb_intr (id) (((id)[ATA_ID_CONFIG] & 0x60) == 0x20)#define ata_id_has_da (id) ((id)[ATA_ID_SATA_CAPABILITY_2] & (1 << 4)) -#define ata_id_has_ncq_autosense (id) \ - ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7))static inline bool ata_id_has_hipm (const u16 *id) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 139/229 ata: fix ata_id_has_dipm()
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
[ Upstream commit 630624cb1b5826d753ac8e01a0e42de43d66dedf ]
ACS-5 section
7.13.6.36 Word 78: Serial ATA features supported
states that:
If word 76 is not 0000h or FFFFh, word 78 reports the features supported by the device. If this word is not supported, the word shall be cleared to zero.
(This text also exists in really old ACS standards, e.g. ACS-3.)
The problem with ata_id_has_dipm() is that the while it performs a check against 0 and 0xffff, it performs the check against ATA_ID_FEATURE_SUPP (word 78), the same word where the feature bit is stored.
Fix this by performing the check against ATA_ID_SATA_CAPABILITY (word 76), like required by the spec. The feature bit check itself is of course still performed against ATA_ID_FEATURE_SUPP (word 78).
Additionally, move the macro to the other ATA_ID_FEATURE_SUPP macros (which already have this check), thus making it more likely that the next ATA_ID_FEATURE_SUPP macro that is added will include this check.
--- include/linux/ata.h | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
include/linux/ata.h +4 -11
@@ -589,6 +589,10 @@ struct ata_bmdma_prd { ((((id)[ATA_ID_SATA_CAPABILITY ] !=0x0000 ) && \ ((id)[ATA_ID_SATA_CAPABILITY ] !=0xffff )) && \ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7))) +#define ata_id_has_dipm (id) \ + ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \ + ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \ + ((id)[ATA_ID_FEATURE_SUPP] & (1 << 3)))#define ata_id_iordy_disable (id) ((id)[ATA_ID_CAPABILITY] & (1 << 10))#define ata_id_has_iordy (id) ((id)[ATA_ID_CAPABILITY] & (1 << 11))#define ata_id_u32 (id,n) \
@@ -612,17 +616,6 @@ static inline bool ata_id_has_hipm(const u16 *id)return val & (1 <<9 ); } -static inline bool ata_id_has_dipm (const u16 *id) -{ -u16 val = id[ATA_ID_FEATURE_SUPP ]; - -if (val ==0 || val ==0xffff ) -return false; - -return val & (1 <<3 ); -} - -static inline bool ata_id_has_fua (const u16 *id) {if ((id[ATA_ID_CFSSE ] &0xC000 ) !=0x4000 )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 140/229 md/raid5: Ensure stripe_fill happens on non-read IO with journal
In reply to Greg Kroah-HartmanFrom: Logan Gunthorpe <[email protected]>
[ Upstream commit e2eed85bc75138a9eeb63863d20f8904ac42a577 ]
When doing degrade/recover tests using the journal a kernel BUG is hit at drivers/md/raid5.c:4381 in handle_parity_checks5():
BUG_ON(!test_bit(R5_UPTODATE, &dev->flags));
This was found to occur because handle_stripe_fill() was skipped for stripes in the journal due to a condition in that function. Thus blocks were not fetched and R5_UPTODATE was not set when the code reached handle_parity_checks5().
To fix this, don't skip handle_stripe_fill() unless the stripe is for read.
--- drivers/md/raid5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/raid5.c +1 -1
@@ -3723,7 +3723,7 @@ static void handle_stripe_fill(struct stripe_head *sh,* back cache (prexor with orig_page, and then xor with * page) in the read path */ -if (s->injournal && s->failed) { +if (s->to_read && s->injournal && s->failed) {if (test_bit (STRIPE_R5C_CACHING , &sh->state))r5c_make_stripe_write_out (sh); goto out;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 141/229 xhci: Dont show warning for reinit on known broken suspend
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit 484d6f7aa3283d082c87654b7fe7a7f725423dfb ]
commit 8b328f8002bc ("xhci: re-initialize the HC during resume if HCE was set") introduced a new warning message when the host controller error was set and re-initializing.
This is expected behavior on some designs which already set xhci->broken_suspend so the new warning is alarming to some users.
Modify the code to only show the warning if this was a surprising behavior to the XHCI driver.
--- drivers/usb/host/xhci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/xhci.c +2 -1
@@ -1155,7 +1155,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)/* re-initialize the HC on Restore Error, or Host Controller Error */ if (temp & (STS_SRE |STS_HCE )) { reinit_xhc = true; -xhci_warn (xhci,"xHC error in resume, USBSTS 0x%x, Reinit\n" , temp); +if (!xhci->broken_suspend) +xhci_warn (xhci,"xHC error in resume, USBSTS 0x%x, Reinit\n" , temp); }if (reinit_xhc) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 142/229 usb: gadget: function: fix dangling pnp_string in f_printer.c
In reply to Greg Kroah-HartmanFrom: Albert Briscoe <[email protected]>
[ Upstream commit 24b7ba2f88e04800b54d462f376512e8c41b8a3c ]
When opts->pnp_string is changed with configfs, new memory is allocated for the string. It does not, however, update dev->pnp_string, even though the memory is freed. When rquesting the string, the host then gets old or corrupted data rather than the new string. The ieee 1284 id string should be allowed to change while the device is connected.
The bug was introduced in commit fdc01cc286be ("usb: gadget: printer:
Remove pnp_string static buffer"), which changed opts->pnp_string from a char[] to a char*.
This patch changes dev->pnp_string from a char* to a char** pointing to opts->pnp_string.
--- drivers/usb/gadget/function/f_printer.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/usb/gadget/function/f_printer.c +6 -6
@@ -87,7 +87,7 @@ struct printer_dev {u8 printer_cdev_open;wait_queue_head_t wait;unsigned q_len; -char *pnp_string;/* We don't own memory! */ +char **pnp_string;/* We don't own memory! */ struct usb_function function; };
@@ -963,16 +963,16 @@ static int printer_func_setup(struct usb_function *f,if ((wIndex>>8 ) != dev->interface)break ; -if (!dev->pnp_string) { +if (!*dev->pnp_string) { value =0 ;break ; } - value =strlen (dev->pnp_string); + value =strlen (*dev->pnp_string); buf[0 ] = (value >>8 ) &0xFF ; buf[1 ] = value &0xFF ; -memcpy (buf +2 , dev->pnp_string, value); +memcpy (buf +2 , *dev->pnp_string, value);DBG (dev,"1284 PNP String: %x %s\n" , value, - dev->pnp_string); + *dev->pnp_string);break ;case GET_PORT_STATUS :/* Get Port Status */
@@ -1435,7 +1435,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)kref_init (&dev->kref); ++opts->refcnt; dev->minor = opts->minor; - dev->pnp_string = opts->pnp_string; + dev->pnp_string = &opts->pnp_string; dev->q_len = opts->q_len;mutex_unlock (&opts->lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 143/229 drivers: serial: jsm: fix some leaks in probe
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 1d5859ef229e381f4db38dce8ed58e4bf862006b ]
This error path needs to unwind instead of just returning directly.
--- drivers/tty/serial/jsm/jsm_driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/tty/serial/jsm/jsm_driver.c +2 -1
@@ -212,7 +212,8 @@ static int jsm_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent)break ;default : -return -ENXIO ; + rc = -ENXIO ; + goto out_kfree_brd; } rc =request_irq (brd->irq, brd->bd_ops->intr,IRQF_SHARED ,"JSM" , brd);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 144/229 phy: qualcomm: call clk_disable_unprepare in the error handling
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit c3966ced8eb8dc53b6c8d7f97d32cc8a2107d83e ]
Smatch reports the following error:
drivers/phy/qualcomm/phy-qcom-usb-hsic.c:82 qcom_usb_hsic_phy_power_on()
warn: 'uphy->cal_clk' from clk_prepare_enable() not released on lines:
58.drivers/phy/qualcomm/phy-qcom-usb-hsic.c:82 qcom_usb_hsic_phy_power_on()
warn: 'uphy->cal_sleep_clk' from clk_prepare_enable() not released on
lines: 58.drivers/phy/qualcomm/phy-qcom-usb-hsic.c:82 qcom_usb_hsic_phy_power_on()
warn: 'uphy->phy_clk' from clk_prepare_enable() not released on lines:
58.
Fix this by calling proper clk_disable_unprepare calls.
--- drivers/phy/qualcomm/phy-qcom-usb-hsic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/phy/qualcomm/phy-qcom-usb-hsic.c +4 -2
@@ -57,8 +57,10 @@ static int qcom_usb_hsic_phy_power_on(struct phy *phy)/* Configure pins for HSIC functionality */ pins_default =pinctrl_lookup_state (uphy->pctl,PINCTRL_STATE_DEFAULT ); -if (IS_ERR (pins_default)) -return PTR_ERR (pins_default); +if (IS_ERR (pins_default)) { + ret =PTR_ERR (pins_default); + goto err_ulpi; + } ret =pinctrl_select_state (uphy->pctl, pins_default);if (ret)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 145/229 staging: vt6655: fix some erroneous memory clean-up loops
In reply to Greg Kroah-HartmanFrom: Nam Cao <[email protected]>
[ Upstream commit 2a2db520e3ca5aafba7c211abfd397666c9b5f9d ]
In some initialization functions of this driver, memory is allocated with 'i' acting as an index variable and increasing from 0. The commit in "Fixes" introduces some clean-up codes in case of allocation failure, which free memory in reverse order with 'i' decreasing to 0. However, there are some problems:
- The case i=0 is left out. Thus memory is leaked.
- In case memory allocation fails right from the start, the memory freeing loops will start with i=-1 and invalid memory locations will be accessed.
One of these loops has been fixed in commit c8ff91535880 ("staging:
vt6655: fix potential memory leak"). Fix the remaining erroneous loops.
--- drivers/staging/vt6655/device_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/vt6655/device_main.c +3 -3
@@ -567,7 +567,7 @@ static int device_init_rd0_ring(struct vnt_private *priv)kfree (desc->rd_info); err_free_desc: -while (--i) { +while (i--) { desc = &priv->aRD0Ring[i];device_free_rx_buf (priv, desc);kfree (desc->rd_info);
@@ -613,7 +613,7 @@ static int device_init_rd1_ring(struct vnt_private *priv)kfree (desc->rd_info); err_free_desc: -while (--i) { +while (i--) { desc = &priv->aRD1Ring[i];device_free_rx_buf (priv, desc);kfree (desc->rd_info);
@@ -717,7 +717,7 @@ static int device_init_td1_ring(struct vnt_private *priv)return 0 ; err_free_desc: -while (--i) { +while (i--) { desc = &priv->apTD1Rings[i];kfree (desc->td_info); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 146/229 firmware: google: Test spinlock on panic path to avoid lockups
In reply to Greg Kroah-HartmanFrom: Guilherme G. Piccoli <[email protected]>
[ Upstream commit 3e081438b8e639cc76ef1a5ce0c1bd8a154082c7 ]
Currently the gsmi driver registers a panic notifier as well as reboot and die notifiers. The callbacks registered are called in atomic and very limited context - for instance, panic disables preemption and local IRQs, also all secondary CPUs (not executing the panic path) are shutdown.
With that said, taking a spinlock in this scenario is a dangerous invitation for lockup scenarios. So, fix that by checking if the spinlock is free to acquire in the panic notifier callback - if not, bail-out and avoid a potential hang.
--- drivers/firmware/google/gsmi.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/firmware/google/gsmi.c +9 -0
@@ -661,6 +661,15 @@ static struct notifier_block gsmi_die_notifier = {static int gsmi_panic_callback (struct notifier_block *nb,unsigned long reason,void *arg) { + +/* +* Panic callbacks are executed with all other CPUs stopped, +* so we must not attempt to spin waiting for gsmi_dev.lock +* to be released. +*/ +if (spin_is_locked (&gsmi_dev.lock)) +return NOTIFY_DONE ; +gsmi_shutdown_reason (GSMI_SHUTDOWN_PANIC );return NOTIFY_DONE ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 147/229 serial: 8250: Fix restoring termios speed after suspend
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 379a33786d489ab81885ff0b3935cfeb36137fea ]
Since commit edc6afc54968 ("tty: switch to ktermios and new framework") termios speed is no longer stored only in c_cflag member but also in new additional c_ispeed and c_ospeed members. If BOTHER flag is set in c_cflag then termios speed is stored only in these new members.
Since commit 027b57170bf8 ("serial: core: Fix initializing and restoring termios speed") termios speed is available also in struct console.
So properly restore also c_ispeed and c_ospeed members after suspend to fix restoring termios speed which is not represented by Bnnn constant.
--- drivers/tty/serial/8250/8250_port.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_port.c +6 -1
@@ -3269,8 +3269,13 @@ static void serial8250_console_restore(struct uart_8250_port *up)unsigned int baud, quot, frac =0 ; termios.c_cflag = port->cons->cflag; -if (port->state->port.tty && termios.c_cflag ==0 ) + termios.c_ispeed = port->cons->ispeed; + termios.c_ospeed = port->cons->ospeed; +if (port->state->port.tty && termios.c_cflag ==0 ) { termios.c_cflag = port->state->port.tty->termios.c_cflag; + termios.c_ispeed = port->state->port.tty->termios.c_ispeed; + termios.c_ospeed = port->state->port.tty->termios.c_ospeed; + } baud =serial8250_get_baud_rate (port, &termios,NULL ); quot =serial8250_get_divisor (port, baud, &frac);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 148/229 fsi: core: Check error number after calling ida_simple_get
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 35af9fb49bc5c6d61ef70b501c3a56fe161cce3e ]
If allocation fails, the ida_simple_get() will return error number. So master->idx could be error number and be used in dev_set_name(). Therefore, it should be better to check it and return error if fails, like the ida_simple_get() in __fsi_get_new_minor().
--- drivers/fsi/fsi-core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/fsi/fsi-core.c +3 -0
@@ -1279,6 +1279,9 @@ int fsi_master_register(struct fsi_master *master)mutex_init (&master->scan_lock); master->idx =ida_simple_get (&master_ida,0 ,INT_MAX ,GFP_KERNEL ); +if (master->idx <0 ) +return master->idx; +dev_set_name (&master->dev,"fsi%d" , master->idx); rc =device_register (&master->dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 149/229 mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 48749cabba109397b4e7dd556e85718ec0ec114d ]
The commit in Fixes: has added a pwm_add_table() call in the probe() and a pwm_remove_table() call in the remove(), but forget to update the error handling path of the probe.
Add the missing pwm_remove_table() call.
--- drivers/mfd/intel_soc_pmic_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/mfd/intel_soc_pmic_core.c +1 -0
@@ -118,6 +118,7 @@ static int intel_soc_pmic_i2c_probe(struct i2c_client *i2c,return 0 ; err_del_irq_chip: +pwm_remove_table (crc_pwm_lookup,ARRAY_SIZE (crc_pwm_lookup));regmap_del_irq_chip (pmic->irq, pmic->irq_chip_data);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 150/229 mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 3fa9e4cfb55da512ebfd57336fde468830719298 ]
If devm_of_platform_populate() fails, some resources need to be released.
Introduce a mx25_tsadc_unset_irq() function that undoes mx25_tsadc_setup_irq() and call it both from the new error handling path of the probe and in the remove function.
--- drivers/mfd/fsl-imx25-tsadc.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-)
drivers/mfd/fsl-imx25-tsadc.c +24 -8
@@ -89,6 +89,19 @@ static int mx25_tsadc_setup_irq(struct platform_device *pdev,return 0 ; } +static int mx25_tsadc_unset_irq (struct platform_device *pdev) +{ +struct mx25_tsadc *tsadc =platform_get_drvdata (pdev); +int irq =platform_get_irq (pdev,0 ); + +if (irq) { +irq_set_chained_handler_and_data (irq,NULL ,NULL ); +irq_domain_remove (tsadc->domain); + } + +return 0 ; +} +static void mx25_tsadc_setup_clk (struct platform_device *pdev,struct mx25_tsadc *tsadc) {
@@ -176,18 +189,21 @@ static int mx25_tsadc_probe(struct platform_device *pdev)platform_set_drvdata (pdev, tsadc); -return devm_of_platform_populate (dev); + ret =devm_of_platform_populate (dev); +if (ret) + goto err_irq; + +return 0 ; + +err_irq: +mx25_tsadc_unset_irq (pdev); + +return ret; }static int mx25_tsadc_remove (struct platform_device *pdev) { -struct mx25_tsadc *tsadc =platform_get_drvdata (pdev); -int irq =platform_get_irq (pdev,0 ); - -if (irq) { -irq_set_chained_handler_and_data (irq,NULL ,NULL ); -irq_domain_remove (tsadc->domain); - } +mx25_tsadc_unset_irq (pdev);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 151/229 mfd: lp8788: Fix an error handling path in lp8788_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit becfdcd75126b20b8ec10066c5e85b34f8994ad5 ]
Should an error occurs in mfd_add_devices(), some resources need to be released, as already done in the .remove() function.
Add an error handling path and a lp8788_irq_exit() call to undo a previous lp8788_irq_init().
--- drivers/mfd/lp8788.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/mfd/lp8788.c +10 -2
@@ -199,8 +199,16 @@ static int lp8788_probe(struct i2c_client *cl, const struct i2c_device_id *id)if (ret)return ret; -return mfd_add_devices (lp->dev,-1 , lp8788_devs, -ARRAY_SIZE (lp8788_devs),NULL ,0 ,NULL ); + ret =mfd_add_devices (lp->dev,-1 , lp8788_devs, +ARRAY_SIZE (lp8788_devs),NULL ,0 ,NULL ); +if (ret) + goto err_exit_irq; + +return 0 ; + +err_exit_irq: +lp8788_irq_exit (lp); +return ret; }static int lp8788_remove (struct i2c_client *cl)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 152/229 mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 557244f6284f30613f2d61f14b579303165876c3 ]
In lp8788_irq_init(), if an error occurs after a successful irq_domain_add_linear() call, it must be undone by a corresponding irq_domain_remove() call.
irq_domain_remove() should also be called in lp8788_irq_exit() for the same reason.
--- drivers/mfd/lp8788-irq.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mfd/lp8788-irq.c +3 -0
@@ -179,6 +179,7 @@ int lp8788_irq_init(struct lp8788 *lp, int irq)IRQF_TRIGGER_FALLING |IRQF_ONESHOT , "lp8788-irq", irqd);if (ret) { +irq_domain_remove (lp->irqdm);dev_err (lp->dev,"failed to create a thread for IRQ_N\n" );return ret; }
@@ -192,4 +193,6 @@ void lp8788_irq_exit(struct lp8788 *lp) {if (lp->irq)free_irq (lp->irq, lp->irqdm); +if (lp->irqdm) +irq_domain_remove (lp->irqdm); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 153/229 mfd: sm501: Add check for platform_driver_register()
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 8325a6c24ad78b8c1acc3c42b098ee24105d68e5 ]
As platform_driver_register() can return error numbers, it should be better to check platform_driver_register() and deal with the exception.
--- drivers/mfd/sm501.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/mfd/sm501.c +6 -1
@@ -1738,7 +1738,12 @@ static struct platform_driver sm501_plat_driver = {static int __init sm501_base_init (void ) { -platform_driver_register (&sm501_plat_driver); +int ret; + + ret =platform_driver_register (&sm501_plat_driver); +if (ret <0 ) +return ret; +return pci_register_driver (&sm501_pci_driver); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 154/229 dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
In reply to Greg Kroah-HartmanFrom: Dave Jiang <[email protected]>
[ Upstream commit 898ec89dbb55b8294695ad71694a0684e62b2a73 ]
User reports observing timer event report channel halted but no error observed in CHANERR register. The driver finished self-test and released channel resources. Debug shows that __cleanup() can call mod_timer() after the timer has been deleted and thus resurrect the timer. While harmless, it causes suprious error message to be emitted. Use mod_timer_pending() call to prevent deleted timer from being resurrected.
--- drivers/dma/ioat/dma.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/dma/ioat/dma.c +3 -3
@@ -653,7 +653,7 @@ static void __cleanup(struct ioatdma_chan *ioat_chan, dma_addr_t phys_complete)if (active - i ==0 ) {dev_dbg (to_dev (ioat_chan),"%s: cancel completion timeout\n" , __func__); -mod_timer (&ioat_chan->timer, jiffies +IDLE_TIMEOUT ); +mod_timer_pending (&ioat_chan->timer, jiffies +IDLE_TIMEOUT ); }/* microsecond delay by sysfs variable per pending descriptor */
@@ -679,7 +679,7 @@ static void ioat_cleanup(struct ioatdma_chan *ioat_chan)if (chanerr & (IOAT_CHANERR_HANDLE_MASK |IOAT_CHANERR_RECOVER_MASK )) { -mod_timer (&ioat_chan->timer, jiffies +IDLE_TIMEOUT ); +mod_timer_pending (&ioat_chan->timer, jiffies +IDLE_TIMEOUT );ioat_eh (ioat_chan); } }
@@ -876,7 +876,7 @@ static void check_active(struct ioatdma_chan *ioat_chan) }if (test_and_clear_bit (IOAT_CHAN_ACTIVE , &ioat_chan->state)) -mod_timer (&ioat_chan->timer, jiffies +IDLE_TIMEOUT ); +mod_timer_pending (&ioat_chan->timer, jiffies +IDLE_TIMEOUT ); }void ioat_timer_event (struct timer_list *t)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 155/229 spmi: pmic-arb: correct duplicate APID to PPID mapping logic
In reply to Greg Kroah-HartmanFrom: David Collins <[email protected]>
[ Upstream commit 1f1693118c2476cb1666ad357edcf3cf48bf9b16 ]
Correct the way that duplicate PPID mappings are handled for PMIC arbiter v5. The final APID mapped to a given PPID should be the one which has write owner = APPS EE, if it exists, or if not that, then the first APID mapped to the PPID, if it exists.
--- drivers/spmi/spmi-pmic-arb.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/spmi/spmi-pmic-arb.c +7 -6
@@ -867,7 +867,8 @@ static int pmic_arb_read_apid_map_v5(struct spmi_pmic_arb *pmic_arb)* version 5, there is more than one APID mapped to each PPID. * The owner field for each of these mappings specifies the EE which is * allowed to write to the APID. The owner of the last (highest) APID -* for a given PPID will receive interrupts from the PPID. +* which has the IRQ owner bit set for a given PPID will receive +* interrupts from the PPID. */ for (i =0 ; ; i++, apidd++) { offset = pmic_arb->ver_ops->apid_map_offset (i);
@@ -890,16 +891,16 @@ static int pmic_arb_read_apid_map_v5(struct spmi_pmic_arb *pmic_arb) apid = pmic_arb->ppid_to_apid[ppid] & ~PMIC_ARB_APID_VALID ; prev_apidd = &pmic_arb->apid_data[apid]; -if (valid && is_irq_ee && - prev_apidd->write_ee == pmic_arb->ee) { +if (!valid || apidd->write_ee == pmic_arb->ee) { +/* First PPID mapping or one for this EE */ + pmic_arb->ppid_to_apid[ppid] = i |PMIC_ARB_APID_VALID ; + }else if (valid && is_irq_ee && + prev_apidd->write_ee == pmic_arb->ee) {/* * Duplicate PPID mapping after the one for this EE; * override the irq owner */ prev_apidd->irq_ee = apidd->irq_ee; - }else if (!valid || is_irq_ee) { -/* First PPID mapping or duplicate for another EE */ - pmic_arb->ppid_to_apid[ppid] = i |PMIC_ARB_APID_VALID ; } apidd->ppid = ppid;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 156/229 clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 0b919a3728691c172312dee99ba654055ccd8c84 ]
The return value of bcm2835_clock_rate_from_divisor is always unsigned and also all caller expect this. So fix the declaration accordingly.
--- drivers/clk/bcm/clk-bcm2835.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/clk/bcm/clk-bcm2835.c +3 -3
@@ -950,9 +950,9 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw,return div; } -static long bcm2835_clock_rate_from_divisor (struct bcm2835_clock *clock, -unsigned long parent_rate, -u32 div) +static unsigned long bcm2835_clock_rate_from_divisor (struct bcm2835_clock *clock, +unsigned long parent_rate, +u32 div) {const struct bcm2835_clock_data *data = clock->data;u64 temp;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 157/229 clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9c59a01caba26ec06fefd6ca1f22d5fd1de57d63 ]
pm_runtime_get_sync() will increment pm usage counter. Forgetting to putting operation will result in reference leak. Add missing pm_runtime_put_sync in some error paths.
--- drivers/clk/ti/clk-dra7-atl.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/clk/ti/clk-dra7-atl.c +6 -3
@@ -252,14 +252,16 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)if (rc) {pr_err ("%s: failed to lookup atl clock %d\n" , __func__, i); -return -EINVAL ; + ret = -EINVAL ; + goto pm_put; } clk =of_clk_get_from_provider (&clkspec);if (IS_ERR (clk)) {pr_err ("%s: failed to get atl clock %d from provider\n" , __func__, i); -return PTR_ERR (clk); + ret =PTR_ERR (clk); + goto pm_put; } cdesc =to_atl_desc (__clk_get_hw (clk));
@@ -292,8 +294,9 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)if (cdesc->enabled)atl_clk_enable (__clk_get_hw (clk)); } -pm_runtime_put_sync (cinfo->dev); +pm_put: +pm_runtime_put_sync (cinfo->dev);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 158/229 mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
In reply to Greg Kroah-HartmanFrom: Jack Wang <[email protected]>
[ Upstream commit 6b207ce8a96a71e966831e3a13c38143ba9a73c1 ]
dma_map_sg return 0 on error, fix the error check, and return -EIO to caller.
--- drivers/mailbox/bcm-flexrm-mailbox.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/mailbox/bcm-flexrm-mailbox.c +4 -4
@@ -634,15 +634,15 @@ static int flexrm_spu_dma_map(struct device *dev, struct brcm_message *msg) rc =dma_map_sg (dev, msg->spu.src,sg_nents (msg->spu.src),DMA_TO_DEVICE ); -if (rc <0 ) -return rc; +if (!rc) +return -EIO ; rc =dma_map_sg (dev, msg->spu.dst,sg_nents (msg->spu.dst),DMA_FROM_DEVICE ); -if (rc <0 ) { +if (!rc) {dma_unmap_sg (dev, msg->spu.src,sg_nents (msg->spu.src),DMA_TO_DEVICE ); -return rc; +return -EIO ; }return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 159/229 powerpc/math_emu/efp: Include module.h
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit cfe0d370e0788625ce0df3239aad07a2506c1796 ]
When building with a recent version of clang, there are a couple of errors around the call to module_init():
arch/powerpc/math-emu/math_efp.c:927:1: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int] module_init(spe_mathemu_init);
^
int
arch/powerpc/math-emu/math_efp.c:927:13: error: a parameter list without types is only allowed in a function definition
module_init(spe_mathemu_init);
^2 errors generated.
module_init() is a macro, which is not getting expanded because module.h is not included in this file. Add the include so that the macro can expand properly, clearing up the build failure.
--- arch/powerpc/math-emu/math_efp.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/math-emu/math_efp.c +1 -0
@@ -21,6 +21,7 @@#include <linux/types.h> #include <linux/prctl.h> +#include <linux/module.h> #include <linux/uaccess.h> #include <asm/reg.h>
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 160/229 powerpc/sysdev/fsl_msi: Add missing of_node_put()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit def435c04ee984a5f9ed2711b2bfe946936c6a21 ]
In fsl_setup_msi_irqs(), use of_node_put() to drop the reference returned by of_parse_phandle().
--- arch/powerpc/sysdev/fsl_msi.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/sysdev/fsl_msi.c +2 -0
@@ -216,8 +216,10 @@ static int fsl_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)dev_err (&pdev->dev,"node %pOF has an invalid fsl,msi phandle %u\n" , hose->dn, np->phandle); +of_node_put (np);return -EINVAL ; } +of_node_put (np); }for_each_pci_msi_entry (entry, pdev) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 161/229 powerpc/pci_dn: Add missing of_node_put()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 110a1fcb6c4d55144d8179983a475f17a1d6f832 ]
In pci_add_device_node_info(), use of_node_put() to drop the reference to 'parent' returned by of_get_parent() to keep refcount balance.
--- arch/powerpc/kernel/pci_dn.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/kernel/pci_dn.c +1 -0
@@ -338,6 +338,7 @@ struct pci_dn *pci_add_device_node_info(struct pci_controller *hose,INIT_LIST_HEAD (&pdn->list); parent =of_get_parent (dn); pdn->parent = parent ?PCI_DN (parent) :NULL ; +of_node_put (parent);if (pdn->parent)list_add_tail (&pdn->list, &pdn->parent->child_list);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 162/229 powerpc/powernv: add missing of_node_put() in opal_export_attrs()
In reply to Greg Kroah-HartmanFrom: Zheng Yongjun <[email protected]>
[ Upstream commit 71a92e99c47900cc164620948b3863382cec4f1a ]
After using 'np' returned by of_find_node_by_path(), of_node_put() need be called to decrease the refcount.
--- arch/powerpc/platforms/powernv/opal.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/powernv/opal.c +1 -0
@@ -740,6 +740,7 @@ static void opal_export_attrs(void) kobj =kobject_create_and_add ("exports" , opal_kobj);if (!kobj) {pr_warn ("kobject_create_and_add() of exports failed\n" ); +of_node_put (np);return ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 163/229 x86/hyperv: Fix struct hv_enlightened_vmcs definition
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
[ Upstream commit ea9da788a61e47e7ab9cbad397453e51cd82ac0d ]
Section 1.9 of TLFS v6.0b says:
"All structures are padded in such a way that fields are aligned naturally (that is, an 8-byte field is aligned to an offset of 8 bytes and so on)".
'struct enlightened_vmcs' has a glitch:
...
struct {
u32 nested_flush_hypercall:1; /* 836: 0 4 */
u32 msr_bitmap:1; /* 836: 1 4 */
u32 reserved:30; /* 836: 2 4 */
} hv_enlightenments_control; /* 836 4 */
u32 hv_vp_id; /* 840 4 */
u64 hv_vm_id; /* 844 8 */
u64 partition_assist_page; /* 852 8 */...
And the observed values in 'partition_assist_page' make no sense at all. Fix the layout by padding the structure properly.
--- arch/x86/include/asm/hyperv-tlfs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/include/asm/hyperv-tlfs.h +2 -2
@@ -682,7 +682,7 @@ struct hv_enlightened_vmcs {u64 guest_rip;u32 hv_clean_fields; -u32 hv_padding_32; +u32 padding32_1;u32 hv_synthetic_controls;struct {u32 nested_flush_hypercall:1 ;
@@ -690,7 +690,7 @@ struct hv_enlightened_vmcs { u32 reserved:30; } hv_enlightenments_control;u32 hv_vp_id; - +u32 padding32_2;u64 hv_vm_id;u64 partition_assist_page;u64 padding64_4[4 ];
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 164/229 powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit 58ec7f06b74e0d6e76c4110afce367c8b5f0837d ]
Big-endian GENERIC_CPU supports 970, but builds with -mcpu=power5. POWER5 is ISA v2.02 whereas 970 is v2.01 plus Altivec. 2.02 added the popcntb instruction which a compiler might use.
Use -mcpu=power4.
--- arch/powerpc/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/Makefile +1 -1
@@ -165,7 +165,7 @@ CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=power8 CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power9,-mtune=power8) else CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5)) -CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4) +CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=power4 endif else ifdef CONFIG_PPC_BOOK3E_64 CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 165/229 powerpc: Fix SPE Power ISA properties for e500v1 platforms
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 37b9345ce7f4ab17538ea62def6f6d430f091355 ]
Commit 2eb28006431c ("powerpc/e500v2: Add Power ISA properties to comply with ePAPR 1.1") introduced new include file e500v2_power_isa.dtsi and should have used it for all e500v2 platforms. But apparently it was used also for e500v1 platforms mpc8540, mpc8541, mpc8555 and mpc8560.
e500v1 cores compared to e500v2 do not support double precision floating point SPE instructions. Hence power-isa-sp.fd should not be set on e500v1 platforms, which is in e500v2_power_isa.dtsi include file.
Fix this issue by introducing a new e500v1_power_isa.dtsi include file and use it in all e500v1 device tree files.
--- .../boot/dts/fsl/e500v1_power_isa.dtsi | 51 +++++++++++++++++++ arch/powerpc/boot/dts/fsl/mpc8540ads.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8541cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8555cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8560ads.dts | 2 +- 5 files changed, 55 insertions(+), 4 deletions(-) create mode 100644 arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi
arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi new file +51 -0
@@ -0,0 +1,51 @@ +/* + * e500v1 Power ISA Device Tree Source (include) + * + * Copyright 2012 Freescale Semiconductor Inc. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * * Neither the name of Freescale Semiconductor nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * + * ALTERNATIVELY, this software may be distributed under the terms of the + * GNU General Public License ("GPL") as published by the Free Software + * Foundation, either version 2 of that License or (at your option) any + * later version. + * + * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor "AS IS" AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY + * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/ { + cpus { + power-isa-version = "2.03"; + power-isa-b; // Base + power-isa-e; // Embedded + power-isa-atb; // Alternate Time Base + power-isa-cs; // Cache Specification + power-isa-e.le; // Embedded.Little-Endian + power-isa-e.pm; // Embedded.Performance Monitor + power-isa-ecl; // Embedded Cache Locking + power-isa-mmc; // Memory Coherence + power-isa-sp; // Signal Processing Engine + power-isa-sp.fs; // SPE.Embedded Float Scalar Single + power-isa-sp.fv; // SPE.Embedded Float Vector + mmu-type = "power-embedded"; + }; +};
arch/powerpc/boot/dts/fsl/mpc8540ads.dts +1 -1
@@ -11,7 +11,7 @@ /dts-v1/; -/include/ "e500v2_power_isa.dtsi" +/include/ "e500v1_power_isa.dtsi" / { model = "MPC8540ADS";
arch/powerpc/boot/dts/fsl/mpc8541cds.dts +1 -1
@@ -11,7 +11,7 @@ /dts-v1/; -/include/ "e500v2_power_isa.dtsi" +/include/ "e500v1_power_isa.dtsi" / { model = "MPC8541CDS";
arch/powerpc/boot/dts/fsl/mpc8555cds.dts +1 -1
@@ -11,7 +11,7 @@ /dts-v1/; -/include/ "e500v2_power_isa.dtsi" +/include/ "e500v1_power_isa.dtsi" / { model = "MPC8555CDS";
arch/powerpc/boot/dts/fsl/mpc8560ads.dts +1 -1
@@ -11,7 +11,7 @@ /dts-v1/; -/include/ "e500v2_power_isa.dtsi" +/include/ "e500v1_power_isa.dtsi" / { model = "MPC8560ADS";
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 166/229 iommu/omap: Fix buffer overflow in debugfs
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 184233a5202786b20220acd2d04ddf909ef18f29 ]
There are two issues here:
1) The "len" variable needs to be checked before the very first write. Otherwise if omap2_iommu_dump_ctx() with "bytes" less than 32 it is a buffer overflow.
2) The snprintf() function returns the number of bytes that *would* have been copied if there were enough space. But we want to know the number of bytes which were *actually* copied so use scnprintf() instead.
--- drivers/iommu/omap-iommu-debug.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iommu/omap-iommu-debug.c +3 -3
@@ -35,12 +35,12 @@ static inline bool is_omap_iommu_detached(struct omap_iommu *obj)ssize_t bytes; \const char *str ="%20s: %08x\n" ; \const int maxcol =32 ; \ - bytes =snprintf (p, maxcol, str,__stringify (name), \ +if (len < maxcol) \ + goto out; \ + bytes =scnprintf (p, maxcol, str,__stringify (name), \ iommu_read_reg(obj, MMU_##name)); \ p += bytes; \ len -= bytes; \ -if (len < maxcol) \ - goto out; \ }while (0 ) static ssize_t
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 167/229 iommu/iova: Fix module config properly
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
[ Upstream commit 4f58330fcc8482aa90674e1f40f601e82f18ed4a ]
IOMMU_IOVA is intended to be an optional library for users to select as and when they desire. Since it can be a module now, this means that built-in code which has chosen not to select it should not fail to link if it happens to have selected as a module by someone else. Replace IS_ENABLED() with IS_REACHABLE() to do the right thing.
--- include/linux/iova.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/iova.h +1 -1
@@ -133,7 +133,7 @@ static inline unsigned long iova_pfn(struct iova_domain *iovad, dma_addr_t iova)return iova >>iova_shift (iovad); } -#if IS_ENABLED (CONFIG_IOMMU_IOVA ) +#if IS_REACHABLE (CONFIG_IOMMU_IOVA )int iova_cache_get (void );void iova_cache_put (void );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 168/229 crypto: cavium - prevent integer overflow loading firmware
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 2526d6bf27d15054bb0778b2f7bc6625fd934905 ]
The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly.
The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow.
--- drivers/crypto/cavium/cpt/cptpf_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/crypto/cavium/cpt/cptpf_main.c +4 -2
@@ -257,6 +257,7 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae)const struct firmware *fw_entry;struct device *dev = &cpt->pdev->dev;struct ucode_header *ucode; +unsigned int code_length;struct microcode *mcode;int j, ret =0 ;
@@ -267,11 +268,12 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae) ucode = (struct ucode_header *)fw_entry->data; mcode = &cpt->mcode[cpt->next_mc_idx];memcpy (mcode->version, (u8 *)fw_entry->data,CPT_UCODE_VERSION_SZ ); - mcode->code_size =ntohl (ucode->code_length) *2 ; -if (!mcode->code_size) { + code_length =ntohl (ucode->code_length); +if (code_length ==0 || code_length >=INT_MAX /2 ) { ret = -EINVAL ; goto fw_release; } + mcode->code_size = code_length *2 ; mcode->is_ae = is_ae; mcode->core_mask =0ULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 169/229 f2fs: fix race condition on setting FI_NO_EXTENT flag
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 07725adc55c0a414c10acb5c8c86cea34b95ddef ]
The following scenarios exist.
process A: process B:
->f2fs_drop_extent_tree ->f2fs_update_extent_cache_range
->f2fs_update_extent_tree_range
->write_lock
->set_inode_flag
->is_inode_flag_set
->__free_extent_tree // Shouldn't
// have been
// cleaned up
// here->write_lock
In this case, the "FI_NO_EXTENT" flag is set between f2fs_update_extent_tree_range and is_inode_flag_set by other process. it leads to clearing the whole exten tree which should not have happened. And we fix it by move the setting it to the range of write_lock.
--- fs/f2fs/extent_cache.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/f2fs/extent_cache.c +1 -2
@@ -717,9 +717,8 @@ void f2fs_drop_extent_tree(struct inode *inode)if (!f2fs_may_extent_tree (inode))return ; -set_inode_flag (inode,FI_NO_EXTENT ); -write_lock (&et->lock); +set_inode_flag (inode,FI_NO_EXTENT );__free_extent_tree (sbi, et);if (et->largest.len) { et->largest.len =0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 170/229 ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
In reply to Greg Kroah-HartmanFrom: Arvid Norlander <[email protected]>
[ Upstream commit 574160b8548deff8b80b174f03201e94ab8431e2 ]
Toshiba Satellite Z830 needs the quirk video_disable_backlight_sysfs_if for proper backlight control after suspend/resume cycles.
Toshiba Portege Z830 is simply the same laptop rebranded for certain markets (I looked through the manual to other language sections to confirm this) and thus also needs this quirk.
Thanks to Hans de Goede for suggesting this fix.
--- drivers/acpi/acpi_video.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/acpi/acpi_video.c +16 -0
@@ -511,6 +511,22 @@ static const struct dmi_system_id video_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE R830"), }, }, + { + .callback = video_disable_backlight_sysfs_if, + .ident = "Toshiba Satellite Z830", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), + DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE Z830"), + }, + }, + { + .callback = video_disable_backlight_sysfs_if, + .ident = "Toshiba Portege Z830", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), + DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE Z830"), + }, + }, /* * Some machine's _DOD IDs don't have bit 31(Device ID Scheme) set * but the IDs actually follow the Device ID Scheme.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 171/229 MIPS: BCM47XX: Cast memcmp() of function to (void *)
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 0dedcf6e3301836eb70cfa649052e7ce4fcd13ba ]
Clang is especially sensitive about argument type matching when using __overloaded functions (like memcmp(), etc). Help it see that function pointers are just "void *". Avoids this error:
arch/mips/bcm47xx/prom.c:89:8: error: no matching function for call to 'memcmp'
if (!memcmp(prom_init, prom_init + mem, 32))
^~~~~~include/linux/string.h:156:12: note: candidate function not viable: no known conversion from 'void (void)' to 'const void *' for 1st argument extern int memcmp(const void *,const void *,__kernel_size_t);
--- arch/mips/bcm47xx/prom.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/bcm47xx/prom.c +2 -2
@@ -85,7 +85,7 @@ static __init void prom_init_mem(void)pr_debug ("Assume 128MB RAM\n" );break ; } -if (!memcmp (prom_init, prom_init + mem,32 )) +if (!memcmp ((void *)prom_init, (void *)prom_init + mem,32 ))break ; } lowmem = mem;
@@ -162,7 +162,7 @@ void __init bcm47xx_prom_highmem_init(void) off =EXTVBASE +__pa (off);for (extmem =128 <<20 ; extmem <512 <<20 ; extmem <<=1 ) { -if (!memcmp (prom_init, (void *)(off + extmem),16 )) +if (!memcmp ((void *)prom_init, (void *)(off + extmem),16 ))break ; } extmem -= lowmem;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 172/229 powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
In reply to Greg Kroah-HartmanFrom: Chao Qin <[email protected]>
[ Upstream commit 2d93540014387d1c73b9ccc4d7895320df66d01b ]
When value < time_unit, the parameter of ilog2() will be zero and the return value is -1. u64(-1) is too large for shift exponent and then will trigger shift-out-of-bounds:
shift exponent 18446744073709551615 is too large for 32-bit type 'int'
Call Trace: rapl_compute_time_window_core rapl_write_data_raw set_time_window store_constraint_time_window_us
--- drivers/powercap/intel_rapl.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/powercap/intel_rapl.c +3 -0
@@ -1068,6 +1068,9 @@ static u64 rapl_compute_time_window_core(struct rapl_package *rp, u64 value, y = value &0x1f ; value = (1 << y) * (4 + f) * rp->time_unit /4 ; }else { +if (value < rp->time_unit) +return 0 ; +do_div (value, rp->time_unit); y =ilog2 (value); f =div64_u64 (4 * (value - (1 << y)),1 << y);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 173/229 thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
In reply to Greg Kroah-HartmanFrom: Srinivas Pandruvada <[email protected]>
[ Upstream commit 68b99e94a4a2db6ba9b31fe0485e057b9354a640 ]
When CPU 0 is offline and intel_powerclamp is used to inject idle, it generates kernel BUG:
BUG: using smp_processor_id() in preemptible [00000000] code: bash/15687 caller is debug_smp_processor_id+0x17/0x20 CPU: 4 PID: 15687 Comm: bash Not tainted 5.19.0-rc7+ #57 Call Trace: <TASK> dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 check_preemption_disabled+0xdd/0xe0 debug_smp_processor_id+0x17/0x20 powerclamp_set_cur_state+0x7f/0xf9 [intel_powerclamp]
...
...
Here CPU 0 is the control CPU by default and changed to the current CPU, if CPU 0 offlined. This check has to be performed under cpus_read_lock(), hence the above warning.
Use get_cpu() instead of smp_processor_id() to avoid this BUG.
--- drivers/thermal/intel_powerclamp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/thermal/intel_powerclamp.c +4 -2
@@ -550,8 +550,10 @@ static int start_power_clamp(void)/* prefer BSP */ control_cpu =0 ; -if (!cpu_online (control_cpu)) - control_cpu =smp_processor_id (); +if (!cpu_online (control_cpu)) { + control_cpu =get_cpu (); +put_cpu (); + } clamping = true;schedule_delayed_work (&poll_pkg_cstate_work,0 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 174/229 x86/entry: Work around Clang __bdos() bug
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 3e1730842f142add55dc658929221521a9ea62b6 ]
Clang produces a false positive when building with CONFIG_FORTIFY_SOURCE=y and CONFIG_UBSAN_BOUNDS=y when operating on an array with a dynamic offset. Work around this by using a direct assignment of an empty instance. Avoids this warning:
../include/linux/fortify-string.h:309:4: warning: call to __write_overflow_field declared with 'warn ing' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wat tribute-warning]
__write_overflow_field(p_size_field, size);
^which was isolated to the memset() call in xen_load_idt().
Note that this looks very much like another bug that was worked around:
https://github.com/ClangBuiltLinux/linux/issues/1592
--- arch/x86/xen/enlighten_pv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/xen/enlighten_pv.c +2 -1
@@ -752,6 +752,7 @@ static void xen_load_idt(const struct desc_ptr *desc) {static DEFINE_SPINLOCK (lock);static struct trap_info traps[257 ]; +static const struct trap_info zero = { };unsigned out;trace_xen_cpu_load_idt (desc);
@@ -761,7 +762,7 @@ static void xen_load_idt(const struct desc_ptr *desc)memcpy (this_cpu_ptr (&idt_desc), desc,sizeof (idt_desc)); out =xen_convert_trap_info (desc, traps, false); -memset (&traps[out],0 ,sizeof (traps[0 ])); + traps[out] = zero;xen_mc_flush ();if (HYPERVISOR_set_trap_table (traps))
Signature · 1 line
2.35.1
Re: [PATCH 4.19 174/229] x86/entry: Work around Clang __bdos() bug
Hi!
Quoted 12 lines
From: Kees Cook <[email protected]>
[ Upstream commit
3e1730842f142add55dc658929221521a9ea62b6]Clang produces a false positive when building with
CONFIG_FORTIFY_SOURCE=yandCONFIG_UBSAN_BOUNDS=ywhen operating on an array with a dynamic offset. Work around this by using a direct assignment of an empty instance. Avoids this warning:
../include/linux/fortify-string.h:309:4: warning: call to__write_overflow_fielddeclared with 'warn ing' attribute: detected write beyond size of field (1st parameter); maybe usestruct_group()? [-Wat tribute-warning]
Quoted 7 lines
__write_overflow_field(p_size_field, size); ^which was isolated to the
memset()call inxen_load_idt().Note that this looks very much like another bug that was worked around:
https://github.com/ClangBuiltLinux/linux/issues/1592
We don't have CONFIG_UBSAN_BOUNDS in 4.19, so maybe we don't need this one?
Best regards,
Pavel
Quoted 22 lines
+++
b/arch/x86/xen/enlighten_pv.carch/x86/xen/enlighten_pv.c +2
-1@@ -752,6 +752,7 @@ static void xen_load_idt(const struct desc_ptr *desc) {static DEFINE_SPINLOCK (lock);static struct trap_info traps[257 ]; +static const struct trap_info zero = { };unsigned out;trace_xen_cpu_load_idt (desc);@@ -761,7 +762,7 @@ static void xen_load_idt(const struct desc_ptr *desc)memcpy (this_cpu_ptr (&idt_desc), desc,sizeof (idt_desc)); out =xen_convert_trap_info (desc, traps, false); -memset (&traps[out],0 ,sizeof (traps[0 ])); + traps[out] = zero;xen_mc_flush ();if (HYPERVISOR_set_trap_table (traps))Signature · 1 line
2.35.1
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany