4.19.276-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 4.19.276-rc1 review
This is the start of the stable review cycle for the 4.19.276 release. There are 252 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 12 Mar 2023 13:36:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.276-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.276-rc1
Srinivas Pandruvada <[email protected]>
thermal: intel: powerclamp: Fix cur_state for multi package system
Eric Biggers <[email protected]>
f2fs: fix cgroup writeback accounting with fs-layer encryption
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix race condition with usb_kill_urb
Ricardo Ribalda <[email protected]>
media: uvcvideo: Provide sync and async uvc_ctrl_status_event
Kuniyuki Iwashima <[email protected]>
tcp: Fix listen() regression in 4.19.270
Vasily Gorbik <[email protected]>
s390/setup: init jump labels before command line parsing
Vasily Gorbik <[email protected]>
s390/maccess: add no DAT mode to kernel_write
Nguyen Dinh Phi <[email protected]>
Bluetooth: hci_sock: purge socket queues in the destruct() callback
Jiapeng Chong <[email protected]>
phy: rockchip-typec: Fix unsigned comparison with less than zero
Daniel Scally <[email protected]>
usb: uvc: Enumerate valid values for color matching
Kees Cook <[email protected]>
USB: ene_usb6250: Allocate enough memory for full object
Kees Cook <[email protected]>
usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
Harshit Mogalapalli <[email protected]>
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
Harshit Mogalapalli <[email protected]>
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
Yulong Zhang <[email protected]>
tools/iio/iio_utils:fix memory leak
Alexander Usyskin <[email protected]>
mei: bus-fixup:upon error print return values of send and receive
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: disable the CTS when send break signal
Sven Schnelle <[email protected]>
tty: fix out-of-bounds access in tty_driver_lookup_tty()
Kees Cook <[email protected]>
media: uvcvideo: Silence memcpy() run-time false positive warnings
Guenter Roeck <[email protected]>
media: uvcvideo: Handle errors from calls to usb_string
Ricardo Ribalda <[email protected]>
media: uvcvideo: Handle cameras with invalid descriptors
Darrell Kavanagh <[email protected]>
firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
Jia-Ju Bai <[email protected]>
tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
Dan Carpenter <[email protected]>
thermal: intel: quark_dts: fix error pointer dereference
Arnd Bergmann <[email protected]>
scsi: ipr: Work around fortify-string warning
George Kennedy <[email protected]>
vc_screen: modify vcs_size() handling in vcs_read()
Eric Dumazet <[email protected]>
tcp: tcp_check_req() can be called from process context
Krzysztof Kozlowski <[email protected]>
ARM: dts: spear320-hmi: correct STMPE GPIO compatible
Fedor Pchelkin <[email protected]>
nfc: fix memory leak of se_io context in nfc_genl_se_io
Zhengchao Shao <[email protected]>
9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
Juergen Gross <[email protected]>
9p/xen: fix connection sequence
Juergen Gross <[email protected]>
9p/xen: fix version parsing
Eric Dumazet <[email protected]>
net: fix __dev_kfree_skb_any() vs drop monitor
Hangyu Hua <[email protected]>
netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
Li Hua <[email protected]>
watchdog: pcwd_usb: Fix attempting to access uninitialized memory
Chen Jun <[email protected]>
watchdog: Fix kmemleak in watchdog_cdev_register
ruanjinjie <[email protected]>
watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
Ammar Faizi <[email protected]>
x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
Zhihao Cheng <[email protected]>
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
Zhihao Cheng <[email protected]>
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Zhihao Cheng <[email protected]>
ubifs: ubifs_writepage: Mark page dirty after writing inode failed
Zhihao Cheng <[email protected]>
ubifs: dirty_cow_znode: Fix memleak in error handling path
Zhihao Cheng <[email protected]>
ubifs: Re-statistic cleaned znode count if commit failed
Yang Yingliang <[email protected]>
ubi: Fix possible null-ptr-deref in ubi_free_volume()
Li Zetao <[email protected]>
ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
Li Zetao <[email protected]>
ubi: Fix use-after-free when volume resizing failed
Zhihao Cheng <[email protected]>
ubifs: Reserve one leb for each journal head while doing budget
Zhihao Cheng <[email protected]>
ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
Zhihao Cheng <[email protected]>
ubifs: Fix wrong dirty space budget for dirty inode
Zhihao Cheng <[email protected]>
ubifs: Rectify space budget for ubifs_xrename()
Zhihao Cheng <[email protected]>
ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
George Kennedy <[email protected]>
ubi: ensure that VID header offset + VID header size <= alloc, size
Xiang Yang <[email protected]>
um: vector: Fix memory leak in vector_config
Fabrice Gasnier <[email protected]>
pwm: stm32-lp: fix the check on arr and cmp registers update
Liu Shixin via Jfs-discussion <[email protected]>
fs/jfs: fix shift exponent db_agl2size negative
Jamal Hadi Salim <[email protected]>
net/sched: Retire tcindex classifier
Dmitry Goncharov <[email protected]>
kbuild: Port silent mode detection to future gnu make.
Arnd Bergmann <[email protected]>
wifi: ath9k: use proper statements in conditionals
Mark Hawrylak <[email protected]>
drm/radeon: Fix eDP for single-display iMac11,2
Damien Le Moal <[email protected]>
PCI: Avoid FLR for AMD FCH AHCI adapters
Tomas Henzl <[email protected]>
scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
Tomas Henzl <[email protected]>
scsi: ses: Fix possible desc_ptr out-of-bounds accesses
Tomas Henzl <[email protected]>
scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
Tomas Henzl <[email protected]>
scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
James Bottomley <[email protected]>
scsi: ses: Don't attach if enclosure has no components
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix erroneous link down
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix link failure in NPIV environment
Steven Rostedt <[email protected]>
ktest.pl: Add RUN_TIMEOUT option with default unlimited
Steven Rostedt <[email protected]>
ktest.pl: Fix missing "end_monitor" when machine check fails
Steven Rostedt <[email protected]>
ktest.pl: Give back console on Ctrt^C on monitor
Sakari Ailus <[email protected]>
media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
Elvira Khabirova <[email protected]>
mips: fix syscall_get_nr
Al Viro <[email protected]>
alpha: fix FEN fault handling
Ilya Dryomov <[email protected]>
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct TMU phandle in Odroid XU
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct TMU phandle in Exynos4
Mikulas Patocka <[email protected]>
dm flakey: don't corrupt the zero page
Mikulas Patocka <[email protected]>
dm flakey: fix logic when corrupting a bio
Alexander Wetzel <[email protected]>
wifi: cfg80211: Fix use after free for wext
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Use a longer retry limit of 48
Jun Nie <[email protected]>
ext4: refuse to create ea block when umounted
Jun Nie <[email protected]>
ext4: optimize ea_inode block expansion
Dmitry Fomin <[email protected]>
ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
Johan Hovold <[email protected]>
irqdomain: Drop bogus fwspec-mapping error handling
Johan Hovold <[email protected]>
irqdomain: Fix disassociation race
Johan Hovold <[email protected]>
irqdomain: Fix association race
Roberto Sassu <[email protected]>
ima: Align ima_file_mmap() parameters with mmap_file LSM hook
KP Singh <[email protected]>
Documentation/hw-vuln: Document the interaction between IBRS and STIBP
KP Singh <[email protected]>
x86/speculation: Allow enabling STIBP with legacy IBRS
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Fix mixed steppings support
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Add a @cpu parameter to the reloading functions
Borislav Petkov (AMD) <[email protected]>
x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
Yang Jihong <[email protected]>
x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
Yang Jihong <[email protected]>
x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
Sean Christopherson <[email protected]>
x86/reboot: Disable SVM, not just VMX, when stopping CPUs
Sean Christopherson <[email protected]>
x86/reboot: Disable virtualization in an emergency if SVM is supported
Sean Christopherson <[email protected]>
x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
Sean Christopherson <[email protected]>
x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
Jan Kara <[email protected]>
udf: Fix file corruption when appending just after end of preallocated extent
Jan Kara <[email protected]>
udf: Do not update file length for failed writes to inline files
Jan Kara <[email protected]>
udf: Do not bother merging very long extents
Jan Kara <[email protected]>
udf: Truncate added extents on failed expansion
Heming Zhao via Ocfs2-devel <[email protected]>
ocfs2: fix non-auto defrag path not working issue
Heming Zhao via Ocfs2-devel <[email protected]>
ocfs2: fix defrag path triggering jbd2 ASSERT
Eric Biggers <[email protected]>
f2fs: fix information leak in f2fs_move_inline_dirents()
Dongliang Mu <[email protected]>
fs: hfsplus: fix UAF issue in hfsplus_put_super
Liu Shixin <[email protected]>
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct HDMI phy compatible in Exynos4
Vasily Gorbik <[email protected]>
s390/kprobes: fix current_kprobe never cleared after kprobes reenter
Vasily Gorbik <[email protected]>
s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
Ilya Leoshkevich <[email protected]>
s390: discard .interp section
Johan Hovold <[email protected]>
rtc: pm8xxx: fix set-alarm race
Alper Nebi Yasak <[email protected]>
firmware: coreboot: framebuffer: Ignore reserved pixel color bits
Jun ASAKA <[email protected]>
wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
Mike Snitzer <[email protected]>
dm cache: add cond_resched() to various workqueue loops
Mike Snitzer <[email protected]>
dm thin: add cond_resched() to various workqueue loops
Claudiu Beznea <[email protected]>
pinctrl: at91: use devm_kasprintf() to avoid potential leaks
Kees Cook <[email protected]>
regulator: s5m8767: Bounds check id indexing into arrays
Kees Cook <[email protected]>
regulator: max77802: Bounds check regulator id against opmode
Kees Cook <[email protected]>
ASoC: kirkwood: Iterate over array indexes instead of using pointer math
Jakob Koschel <[email protected]>
docs/scripts/gdb: add necessary make scripts_gdb step
Jiasheng Jiang <[email protected]>
drm/msm/dsi: Add missing check for alloc_ordered_workqueue
Liwei Song <[email protected]>
drm/radeon: free iio for atombios when driver shutdown
Roman Li <[email protected]>
drm/amd/display: Fix potential null-deref in dm_resume
Shay Drory <[email protected]>
net/mlx5: fw_tracer: Fix debug print
Hans de Goede <[email protected]>
ACPI: video: Fix Lenovo Ideapad Z570 DMI match
Michael Schmitz <[email protected]>
m68k: Check syscall_trace_enter() return code
Florian Fainelli <[email protected]>
net: bcmgenet: Add a check for oversized packets
Mark Rutland <[email protected]>
ACPI: Don't build ACPICA with '-Os'
Pietro Borrello <[email protected]>
inet: fix fast path in __inet_hash_connect()
Jisoo Jang <[email protected]>
wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
Breno Leitao <[email protected]>
x86/bugs: Reset speculation control settings on init
Jann Horn <[email protected]>
timers: Prevent union confusion from unexpected restart_syscall()
Yang Li <[email protected]>
thermal: intel: Fix unsigned comparison with less than zero
Paul E. McKenney <[email protected]>
rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
Jisoo Jang <[email protected]>
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
Markuss Broks <[email protected]>
ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
Jan Kara <[email protected]>
udf: Define EFSCORRUPTED error code
Bjorn Andersson <[email protected]>
rpmsg: glink: Avoid infinite loop on intent for missing channel
Duoming Zhou <[email protected]>
media: usb: siano: Fix use after free bugs caused by do_submit_urb
Hans Verkuil <[email protected]>
media: i2c: ov7670: 0 instead of -EINVAL was returned
Duoming Zhou <[email protected]>
media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
Yuan Can <[email protected]>
media: i2c: ov772x: Fix memleak in ov772x_probe()
Nathan Chancellor <[email protected]>
powerpc: Remove linker flag from KBUILD_AFLAGS
Jiasheng Jiang <[email protected]>
media: platform: ti: Add missing check for devm_regulator_get
Randy Dunlap <[email protected]>
MIPS: vpe-mt: drop physical_memsize
Nathan Lynch <[email protected]>
powerpc/rtas: ensure 4KB alignment for rtas_data_buf
Nathan Lynch <[email protected]>
powerpc/rtas: make all exports GPL
Nathan Lynch <[email protected]>
powerpc/pseries/lparcfg: add missing RTAS retry status handling
Chen-Yu Tsai <[email protected]>
clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
Frederic Barrat <[email protected]>
powerpc/powernv/ioda: Skip unallocated resources when mapping to PE
Luca Ellero <[email protected]>
Input: ads7846 - don't check penirq immediately for 7845
Luca Ellero <[email protected]>
Input: ads7846 - don't report pressure for ads7845
Samuel Holland <[email protected]>
mtd: rawnand: sunxi: Fix the size of the last OOB region
Qiheng Lin <[email protected]>
mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Fix bash specific "==" operator
Randy Dunlap <[email protected]>
sparc: allow PM configs for sparc32 COMPILE_TEST
Yicong Yang <[email protected]>
perf tools: Fix auto-complete on aarch64
Ian Rogers <[email protected]>
perf llvm: Fix inadvertent file creation
Andreas Gruenbacher <[email protected]>
gfs2: jdata writepage fix
Zhang Xiaoxu <[email protected]>
cifs: Fix warning and UAF when destroy the MR list
Zhang Xiaoxu <[email protected]>
cifs: Fix lost destroy smbd connection when MR allocate failed
Benjamin Coddington <[email protected]>
nfsd: fix race to check ls_layouts
Mike Snitzer <[email protected]>
dm: remove flush_scheduled_work() during local_exit()
Vadim Pasternak <[email protected]>
hwmon: (mlxreg-fan) Return zero speed for broken fan
William Zhang <[email protected]>
spi: bcm63xx-hsspi: Fix multi-bit mode setting
Álvaro Fernández Rojas <[email protected]>
spi: bcm63xx-hsspi: fix pm_runtime
Jiasheng Jiang <[email protected]>
scsi: aic94xx: Add missing check for dma_map_single()
Jonathan Cormier <[email protected]>
hwmon: (ltc2945) Handle error case in ltc2945_value_store
Haibo Chen <[email protected]>
gpio: vf610: connect GPIO label to dev name
Kuninori Morimoto <[email protected]>
ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
Nícolas F. R. A. Prado <[email protected]>
drm/mediatek: Clean dangling pointer on bind error path
Rob Clark <[email protected]>
drm/mediatek: Drop unbalanced obj unref
Mikko Perttunen <[email protected]>
gpu: host1x: Don't skip assigning syncpoints to channels
Jiasheng Jiang <[email protected]>
drm/msm/dpu: Add check for pstates
Dmitry Baryshkov <[email protected]>
drm/msm: use strscpy instead of strncpy
Daniel Mentz <[email protected]>
drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
Alexey V. Vissarionov <[email protected]>
ALSA: hda/ca0132: minor fix for allocation size
Miaoqian Lin <[email protected]>
pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
Lee Jones <[email protected]>
pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours
Jiasheng Jiang <[email protected]>
drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
Liang He <[email protected]>
gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
Dave Stevenson <[email protected]>
drm/vc4: dpi: Fix format mapping for RGB565
Dave Stevenson <[email protected]>
drm/vc4: dpi: Add option for inverting pixel clock and output enable
Laurent Pinchart <[email protected]>
drm: Clarify definition of the DRM_BUS_FLAG_(PIXDATA|SYNC)_* macros
Yuan Can <[email protected]>
drm/bridge: megachips: Fix error handling in i2c_register_driver()
Geert Uytterhoeven <[email protected]>
drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
Roxana Nicolescu <[email protected]>
selftest: fib_tests: Always cleanup before exit
Florian Fainelli <[email protected]>
irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
Florian Fainelli <[email protected]>
irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
Frank Jungclaus <[email protected]>
can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
Shayne Chen <[email protected]>
wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
Herbert Xu <[email protected]>
crypto: crypto4xx - Call dma_unmap_page when done
Dan Carpenter <[email protected]>
wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
Jiasheng Jiang <[email protected]>
wifi: iwl4965: Add missing check for create_singlethread_workqueue()
Jiasheng Jiang <[email protected]>
wifi: iwl3945: Add missing check for create_singlethread_workqueue
Conor Dooley <[email protected]>
RISC-V: time: initialize hrtimer based broadcast clock event device
Randy Dunlap <[email protected]>
m68k: /proc/hardware should depend on PROC_FS
Herbert Xu <[email protected]>
crypto: rsa-pkcs1pad - Use akcipher_request_complete
Pietro Borrello <[email protected]>
rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
Ilya Leoshkevich <[email protected]>
libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix potential user-after-free
Miaoqian Lin <[email protected]>
irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
Miaoqian Lin <[email protected]>
irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
Jack Morgenstein <[email protected]>
net/mlx5: Enhance debug print in page allocation failure
Yang Yingliang <[email protected]>
powercap: fix possible name leak in powercap_register_zone()
Herbert Xu <[email protected]>
crypto: seqiv - Handle EBUSY correctly
Armin Wolf <[email protected]>
ACPI: battery: Fix missing NUL-termination with large strings
Minsuk Kang <[email protected]>
wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
Fedor Pchelkin <[email protected]>
wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
Pavel Skripkin <[email protected]>
ath9k: htc: clean up statistics macros
Wan Jiabing <[email protected]>
ath9k: hif_usb: simplify if-if to if-else
Fedor Pchelkin <[email protected]>
wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
Alexey Kodanev <[email protected]>
wifi: orinoco: check return value of hermes_write_wordrec()
Daniil Tatianin <[email protected]>
ACPICA: nsrepair: handle cases without a return value correctly
Herbert Xu <[email protected]>
lib/mpi: Fix buffer overrun when SG is too long
Zhen Lei <[email protected]>
genirq: Fix the return type of kstat_cpu_irqs_sum()
Mario Limonciello <[email protected]>
ACPICA: Drop port I/O validation for some regions
Yang Yingliang <[email protected]>
wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
Zhengchao Shao <[email protected]>
wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
Zhang Changzhong <[email protected]>
wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
Zhengchao Shao <[email protected]>
wifi: ipw2200: fix memory leak in ipw_wdev_init()
Yang Yingliang <[email protected]>
wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
Christophe JAILLET <[email protected]>
ipw2x00: switch from 'pci_' to 'dma_' API
Li Zetao <[email protected]>
wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
Arnd Bergmann <[email protected]>
rtlwifi: fix -Wpointer-sign warning
Yang Yingliang <[email protected]>
wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
Zhengchao Shao <[email protected]>
wifi: libertas: fix memory leak in lbs_init_adapter()
Yuan Can <[email protected]>
wifi: rsi: Fix memory leak in rsi_coex_attach()
Martin K. Petersen <[email protected]>
block: bio-integrity: Copy flags when bio_integrity_payload is cloned
Kemeng Shi <[email protected]>
blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
Jerome Brunet <[email protected]>
arm64: dts: meson-axg: enable SCPI
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
Angus Chen <[email protected]>
ARM: imx: Call ida_simple_remove() for ida_simple_get
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
Yang Yingliang <[email protected]>
ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
Martin Blumenstingl <[email protected]>
arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
Martin Blumenstingl <[email protected]>
arm64: dts: meson-gx: Fix Ethernet MAC address unit name
Qiheng Lin <[email protected]>
ARM: zynq: Fix refcount leak in zynq_early_slcr_init
Chen Hui <[email protected]>
ARM: OMAP2+: Fix memory leak in realtime_counter_init()
Pietro Borrello <[email protected]>
HID: asus: use spinlock to safely schedule workers
Pietro Borrello <[email protected]>
HID: asus: use spinlock to protect concurrent accesses
Luke D. Jones <[email protected]>
HID: asus: Remove check for same LED brightness on set
-------------
Diffstat:
Documentation/admin-guide/hw-vuln/spectre.rst | 21 +- Documentation/dev-tools/gdb-kernel-debugging.rst | 4 + Makefile | 17 +- arch/alpha/kernel/traps.c | 30 +- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- arch/arm/boot/dts/exynos4-cpu-thermal.dtsi | 2 +- arch/arm/boot/dts/exynos4.dtsi | 2 +- arch/arm/boot/dts/exynos5410-odroidxu.dts | 1 - arch/arm/boot/dts/exynos5420.dtsi | 2 +- arch/arm/boot/dts/spear320-hmi.dts | 2 +- arch/arm/mach-imx/mmdc.c | 24 +- arch/arm/mach-omap1/timer.c | 2 +- arch/arm/mach-omap2/timer.c | 1 + arch/arm/mach-zynq/slcr.c | 1 + arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 26 + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + arch/m68k/68000/entry.S | 2 + arch/m68k/Kconfig.devices | 1 + arch/m68k/coldfire/entry.S | 2 + arch/m68k/kernel/entry.S | 3 + arch/mips/include/asm/syscall.h | 2 +- arch/mips/include/asm/vpe.h | 1 - arch/mips/kernel/vpe-mt.c | 7 +- arch/mips/lantiq/prom.c | 6 - arch/powerpc/Makefile | 2 +- arch/powerpc/kernel/rtas.c | 24 +- arch/powerpc/platforms/powernv/pci-ioda.c | 3 +- arch/powerpc/platforms/pseries/lparcfg.c | 20 +- arch/riscv/kernel/time.c | 3 + arch/s390/kernel/kprobes.c | 4 +- arch/s390/kernel/setup.c | 1 + arch/s390/kernel/vmlinux.lds.S | 1 + arch/s390/mm/maccess.c | 16 +- arch/sparc/Kconfig | 2 +- arch/um/drivers/vector_kern.c | 1 + arch/x86/include/asm/microcode.h | 4 +- arch/x86/include/asm/microcode_amd.h | 4 +- arch/x86/include/asm/msr-index.h | 4 + arch/x86/include/asm/reboot.h | 2 + arch/x86/include/asm/virtext.h | 16 +- arch/x86/kernel/cpu/bugs.c | 35 +- arch/x86/kernel/cpu/microcode/amd.c | 53 +- arch/x86/kernel/cpu/microcode/core.c | 6 +- arch/x86/kernel/crash.c | 17 +- arch/x86/kernel/kprobes/opt.c | 6 +- arch/x86/kernel/reboot.c | 88 ++- arch/x86/kernel/smp.c | 6 +- arch/x86/kernel/sysfb_efi.c | 8 + arch/x86/um/vdso/um_vdso.c | 12 +- block/bio-integrity.c | 1 + block/blk-mq-sched.c | 3 +- crypto/rsa-pkcs1pad.c | 34 +- crypto/seqiv.c | 2 +- drivers/acpi/acpica/Makefile | 2 +- drivers/acpi/acpica/hwvalid.c | 7 +- drivers/acpi/acpica/nsrepair.c | 12 +- drivers/acpi/battery.c | 2 +- drivers/acpi/video_detect.c | 2 +- drivers/block/rbd.c | 20 +- drivers/clk/clk.c | 11 + drivers/crypto/amcc/crypto4xx_core.c | 10 +- drivers/firmware/google/framebuffer-coreboot.c | 4 +- drivers/gpio/gpio-vf610.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +- drivers/gpu/drm/drm_mipi_dsi.c | 52 ++ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 - drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 + drivers/gpu/drm/msm/dsi/dsi_host.c | 3 + drivers/gpu/drm/msm/hdmi/hdmi.c | 4 + drivers/gpu/drm/msm/msm_fence.c | 2 +- drivers/gpu/drm/mxsfb/Kconfig | 1 + drivers/gpu/drm/radeon/atombios_encoders.c | 5 +- drivers/gpu/drm/radeon/radeon_device.c | 1 + drivers/gpu/drm/vc4/vc4_dpi.c | 66 +- drivers/gpu/host1x/hw/syncpt_hw.c | 3 - drivers/gpu/ipu-v3/ipu-common.c | 1 + drivers/hid/hid-asus.c | 38 +- drivers/hwmon/ltc2945.c | 2 + drivers/hwmon/mlxreg-fan.c | 6 + drivers/iio/accel/mma9551_core.c | 10 +- drivers/input/touchscreen/ads7846.c | 13 +- drivers/irqchip/irq-alpine-msi.c | 1 + drivers/irqchip/irq-bcm7120-l2.c | 3 +- drivers/irqchip/irq-brcmstb-l2.c | 6 +- drivers/irqchip/irq-mvebu-gicp.c | 1 + drivers/md/dm-cache-target.c | 4 + drivers/md/dm-flakey.c | 30 +- drivers/md/dm-thin.c | 2 + drivers/md/dm.c | 1 - drivers/media/i2c/ov7670.c | 2 +- drivers/media/i2c/ov772x.c | 3 +- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 3 + drivers/media/platform/omap3isp/isp.c | 9 + drivers/media/rc/ene_ir.c | 3 +- drivers/media/usb/siano/smsusb.c | 1 + drivers/media/usb/uvc/uvc_ctrl.c | 30 +- drivers/media/usb/uvc/uvc_driver.c | 48 +- drivers/media/usb/uvc/uvc_entity.c | 2 +- drivers/media/usb/uvc/uvc_status.c | 40 +- drivers/media/usb/uvc/uvc_video.c | 4 +- drivers/media/usb/uvc/uvcvideo.h | 5 +- drivers/mfd/pcf50633-adc.c | 7 +- drivers/misc/mei/bus-fixup.c | 8 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- drivers/mtd/ubi/build.c | 7 + drivers/mtd/ubi/vmt.c | 18 +- drivers/mtd/ubi/wl.c | 25 +- drivers/net/can/usb/esd_usb2.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 + .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 60 +- drivers/net/wireless/ath/ath9k/htc.h | 32 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +- drivers/net/wireless/ath/ath9k/wmi.c | 1 + .../wireless/broadcom/brcm80211/brcmfmac/common.c | 7 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 121 ++-- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 67 +- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 +- drivers/net/wireless/intersil/orinoco/hw.c | 2 + drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- drivers/net/wireless/marvell/libertas/main.c | 3 +- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- drivers/net/wireless/marvell/mwifiex/11n.c | 6 +- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 11 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 91 ++- .../net/wireless/realtek/rtlwifi/rtl8821ae/table.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/table.h | 4 +- drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + drivers/net/wireless/wl3501_cs.c | 2 +- drivers/nfc/st-nci/se.c | 6 + drivers/nfc/st21nfca/se.c | 6 + drivers/pci/quirks.c | 1 + drivers/phy/rockchip/phy-rockchip-typec.c | 3 +- drivers/pinctrl/pinctrl-at91-pio4.c | 4 +- drivers/pinctrl/pinctrl-at91.c | 2 +- drivers/pinctrl/pinctrl-rockchip.c | 23 +- drivers/powercap/powercap_sys.c | 14 +- drivers/pwm/pwm-stm32-lp.c | 2 +- drivers/regulator/max77802-regulator.c | 34 +- drivers/regulator/s5m8767.c | 6 +- drivers/rpmsg/qcom_glink_native.c | 1 + drivers/rtc/rtc-pm8xxx.c | 24 +- drivers/scsi/aic94xx/aic94xx_task.c | 3 + drivers/scsi/ipr.c | 41 +- drivers/scsi/qla2xxx/qla_os.c | 9 +- drivers/scsi/ses.c | 64 +- drivers/spi/spi-bcm63xx-hsspi.c | 20 +- drivers/thermal/intel_powerclamp.c | 20 +- drivers/thermal/intel_quark_dts_thermal.c | 12 +- drivers/thermal/intel_soc_dts_iosf.c | 2 +- drivers/tty/serial/fsl_lpuart.c | 24 +- drivers/tty/tty_io.c | 8 +- drivers/tty/vt/vc_screen.c | 4 +- drivers/usb/host/xhci-mvebu.c | 2 +- drivers/usb/storage/ene_ub6250.c | 2 +- drivers/watchdog/at91sam9_wdt.c | 7 +- drivers/watchdog/pcwd_usb.c | 6 +- drivers/watchdog/watchdog_dev.c | 2 +- fs/cifs/smbdirect.c | 4 +- fs/ext4/xattr.c | 35 +- fs/f2fs/data.c | 4 +- fs/f2fs/inline.c | 13 +- fs/gfs2/aops.c | 3 +- fs/hfs/bnode.c | 1 + fs/hfsplus/super.c | 4 +- fs/jfs/jfs_dmap.c | 3 +- fs/nfsd/nfs4layouts.c | 4 +- fs/ocfs2/move_extents.c | 34 +- fs/ubifs/budget.c | 9 +- fs/ubifs/dir.c | 13 +- fs/ubifs/file.c | 12 +- fs/ubifs/tnc.c | 24 +- fs/udf/file.c | 26 +- fs/udf/inode.c | 58 +- fs/udf/udf_sb.h | 2 + include/drm/drm_connector.h | 36 +- include/drm/drm_mipi_dsi.h | 4 + include/linux/ima.h | 6 +- include/linux/kernel_stat.h | 2 +- include/linux/kprobes.h | 2 + include/uapi/linux/usb/video.h | 30 + include/uapi/linux/uvcvideo.h | 2 +- kernel/irq/irqdomain.c | 31 +- kernel/kprobes.c | 6 +- kernel/rcu/tree_exp.h | 2 + kernel/time/hrtimer.c | 2 + kernel/time/posix-stubs.c | 2 + kernel/time/posix-timers.c | 2 + kernel/trace/ring_buffer.c | 7 +- lib/mpi/mpicoder.c | 3 +- net/9p/trans_rdma.c | 15 +- net/9p/trans_xen.c | 48 +- net/bluetooth/hci_sock.c | 11 +- net/bluetooth/l2cap_core.c | 24 - net/bluetooth/l2cap_sock.c | 8 + net/core/dev.c | 4 +- net/ipv4/inet_connection_sock.c | 1 + net/ipv4/inet_hashtables.c | 12 +- net/ipv4/tcp_minisocks.c | 7 +- net/mac80211/sta_info.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 5 +- net/nfc/netlink.c | 4 + net/rds/message.c | 2 +- net/sched/Kconfig | 11 - net/sched/Makefile | 1 - net/sched/cls_tcindex.c | 698 --------------------- net/wireless/sme.c | 31 +- security/integrity/ima/ima_main.c | 7 +- security/security.c | 7 +- sound/pci/hda/patch_ca0132.c | 2 +- sound/pci/ice1712/aureon.c | 2 +- sound/soc/kirkwood/kirkwood-dma.c | 2 +- sound/soc/soc-compress.c | 2 +- tools/iio/iio_utils.c | 23 +- tools/lib/bpf/nlattr.c | 2 +- tools/perf/perf-completion.sh | 11 +- tools/perf/util/llvm-utils.c | 25 +- tools/testing/ktest/ktest.pl | 26 +- tools/testing/ktest/sample.conf | 5 + .../ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- tools/testing/selftests/net/fib_tests.sh | 2 + 232 files changed, 1671 insertions(+), 1666 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/252 HID: asus: Remove check for same LED brightness on set
From: Luke D. Jones <[email protected]>
commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream.
Remove the early return on LED brightness set so that any controller application, daemon, or desktop may set the same brightness at any stage.
This is required because many ASUS ROG keyboards will default to max brightness on laptop resume if the LEDs were set to off before sleep.
--- drivers/hid/hid-asus.c | 3 --- 1 file changed, 3 deletions(-)
drivers/hid/hid-asus.c +0 -3
@@ -318,9 +318,6 @@ static void asus_kbd_backlight_set(struc { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); -if (led->brightness == brightness) -return ; - led->brightness = brightness;schedule_work (&led->work); }
Greg Kroah-Hartman
maintainerPATCH 2/252 HID: asus: use spinlock to protect concurrent accesses
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
commit 315c537068a13f0b5681d33dd045a912f4bece6f upstream.
asus driver has a worker that may access data concurrently. Proct the accesses using a spinlock.
--- drivers/hid/hid-asus.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
drivers/hid/hid-asus.c +21 -1
@@ -84,6 +84,7 @@ struct asus_kbd_leds {struct hid_device *hdev;struct work_struct work;unsigned int brightness; +spinlock_t lock;bool removed; };
@@ -318,7 +319,12 @@ static void asus_kbd_backlight_set(struc { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); +unsigned long flags; + +spin_lock_irqsave (&led->lock, flags); led->brightness = brightness; +spin_unlock_irqrestore (&led->lock, flags); +schedule_work (&led->work); }
@@ -326,8 +332,14 @@ static enum led_brightness asus_kbd_back { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); +enum led_brightness brightness; +unsigned long flags; -return led->brightness; +spin_lock_irqsave (&led->lock, flags); + brightness = led->brightness; +spin_unlock_irqrestore (&led->lock, flags); + +return brightness; }static void asus_kbd_backlight_work (struct work_struct *work)
@@ -335,11 +347,14 @@ static void asus_kbd_backlight_work(stru struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work);u8 buf[] = {FEATURE_KBD_REPORT_ID ,0xba ,0xc5 ,0xc4 ,0x00 };int ret; +unsigned long flags;if (led->removed)return ; +spin_lock_irqsave (&led->lock, flags); buf[4 ] = led->brightness; +spin_unlock_irqrestore (&led->lock, flags); ret =asus_kbd_set_report (led->hdev, buf,sizeof (buf));if (ret <0 )
@@ -380,6 +395,7 @@ static int asus_kbd_register_leds(struct drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set; drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get;INIT_WORK (&drvdata->kbd_backlight->work, asus_kbd_backlight_work); +spin_lock_init (&drvdata->kbd_backlight->lock); ret =devm_led_classdev_register (&hdev->dev, &drvdata->kbd_backlight->cdev);if (ret <0 ) {
@@ -689,9 +705,13 @@ err_stop_hw:static void asus_remove (struct hid_device *hdev) {struct asus_drvdata *drvdata =hid_get_drvdata (hdev); +unsigned long flags;if (drvdata->kbd_backlight) { +spin_lock_irqsave (&drvdata->kbd_backlight->lock, flags); drvdata->kbd_backlight->removed = true; +spin_unlock_irqrestore (&drvdata->kbd_backlight->lock, flags); +cancel_work_sync (&drvdata->kbd_backlight->work); }
Greg Kroah-Hartman
maintainerPATCH 3/252 HID: asus: use spinlock to safely schedule workers
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream.
Use spinlocks to deal with workers introducing a wrapper asus_schedule_work(), and several spinlock checks. Otherwise, asus_kbd_backlight_set() may schedule led->work after the structure has been freed, causing a use-after-free.
--- drivers/hid/hid-asus.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/hid/hid-asus.c +11 -4
@@ -314,6 +314,16 @@ static int asus_kbd_get_functions(structreturn ret; } +static void asus_schedule_work (struct asus_kbd_leds *led) +{ +unsigned long flags; + +spin_lock_irqsave (&led->lock, flags); +if (!led->removed) +schedule_work (&led->work); +spin_unlock_irqrestore (&led->lock, flags); +} +static void asus_kbd_backlight_set (struct led_classdev *led_cdev,enum led_brightness brightness) {
@@ -325,7 +335,7 @@ static void asus_kbd_backlight_set(struc led->brightness = brightness;spin_unlock_irqrestore (&led->lock, flags); -schedule_work (&led->work); +asus_schedule_work (led); }static enum led_brightness asus_kbd_backlight_get (struct led_classdev *led_cdev)
@@ -349,9 +359,6 @@ static void asus_kbd_backlight_work(struint ret;unsigned long flags; -if (led->removed) -return ; -spin_lock_irqsave (&led->lock, flags); buf[4 ] = led->brightness;spin_unlock_irqrestore (&led->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 4/252 ARM: OMAP2+: Fix memory leak in realtime_counter_init()
In reply to Greg Kroah-HartmanFrom: Chen Hui <[email protected]>
[ Upstream commit ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac ]
The "sys_clk" resource is malloced by clk_get(),
it is not released when the function return.
Message-Id: <[email protected]>
--- arch/arm/mach-omap2/timer.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-omap2/timer.c +1 -0
@@ -701,6 +701,7 @@ static void __init realtime_counter_init(void) } rate =clk_get_rate (sys_clk); +clk_put (sys_clk);if (soc_is_dra7xx ()) {/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/252 ARM: zynq: Fix refcount leak in zynq_early_slcr_init
In reply to Greg Kroah-HartmanFrom: Qiheng Lin <[email protected]>
[ Upstream commit 9eedb910a3be0005b88c696a8552c0d4c9937cd4 ]
of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on error path.
Add missing of_node_put() to avoid refcount leak.
--- arch/arm/mach-zynq/slcr.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-zynq/slcr.c +1 -0
@@ -222,6 +222,7 @@ int __init zynq_early_slcr_init(void) zynq_slcr_regmap =syscon_regmap_lookup_by_compatible ("xlnx,zynq-slcr" );if (IS_ERR (zynq_slcr_regmap)) {pr_err ("%s: failed to find zynq-slcr\n" , __func__); +of_node_put (np);return -ENODEV ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/252 arm64: dts: meson-gx: Fix Ethernet MAC address unit name
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 ]
Unit names should use hyphens instead of underscores to not cause warnings.
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -150,7 +150,7 @@ sn: sn@14 { reg = <0x14 0x10>; }; - eth_mac: eth_mac@34 { + eth_mac: eth-mac@34 { reg = <0x34 0x10>; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/252 arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit f189c869ad92787ddd753558bcbae89d75825bb6 ]
Node names should be generic and use hyphens instead of underscores to not cause warnings. Also nodes without a reg property should not have a unit-address. Change the scpi_dvfs node to use clock-controller as node name without a unit address (since it does not have a reg property).
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -167,7 +167,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks"; - scpi_dvfs: scpi_clocks@0 { + scpi_dvfs: clock-controller { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/252 ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 0414a100d6ab32721efa70ab55524540fdfe0ede ]
If platform_device_add() is not called or failed, it should call platform_device_put() in error case.
Message-Id: <[email protected]>
--- arch/arm/mach-omap1/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-omap1/timer.c +1 -1
@@ -165,7 +165,7 @@ static int __init omap1_dm_timer_init(void)kfree (pdata); err_free_pdev: -platform_device_unregister (pdev); +platform_device_put (pdev);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/252 ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit d15d2a617499882971ddb773a583015bf36fa492 ]
The property is wr-active:
exynos3250-rinato.dtb: fimd@11c00000: i80-if-timings: 'wr-act' does not match any of the regexes: 'pinctrl-[0-9]+'
--- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos3250-rinato.dts +1 -1
@@ -237,7 +237,7 @@ &fimd { i80-if-timings { cs-setup = <0>; wr-setup = <0>; - wr-act = <1>; + wr-active = <1>; wr-hold = <0>; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/252 ARM: imx: Call ida_simple_remove() for ida_simple_get
In reply to Greg Kroah-HartmanFrom: Angus Chen <[email protected]>
[ Upstream commit ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 ]
The function call ida_simple_get maybe fail,we should deal with it. And if ida_simple_get success ,it need to call ida_simple_remove also. BTW,devm_kasprintf can handle id is zero for consistency.
--- arch/arm/mach-imx/mmdc.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
arch/arm/mach-imx/mmdc.c +12 -12
@@ -105,6 +105,7 @@ struct mmdc_pmu {cpumask_t cpu;struct hrtimer hrtimer;unsigned int active_events; +int id;struct device *dev;struct perf_event *mmdc_events[MMDC_NUM_COUNTERS ];struct hlist_node node;
@@ -445,8 +446,6 @@ static enum hrtimer_restart mmdc_pmu_timer_handler(struct hrtimer *hrtimer)static int mmdc_pmu_init (struct mmdc_pmu *pmu_mmdc,void __iomem *mmdc_base,struct device *dev) { -int mmdc_num; - *pmu_mmdc = (struct mmdc_pmu ) { .pmu = (struct pmu ) { .task_ctx_nr = perf_invalid_context,
@@ -463,15 +462,16 @@ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, .active_events = 0, }; - mmdc_num =ida_simple_get (&mmdc_ida,0 ,0 ,GFP_KERNEL ); + pmu_mmdc->id =ida_simple_get (&mmdc_ida,0 ,0 ,GFP_KERNEL ); -return mmdc_num; +return pmu_mmdc->id; }static int imx_mmdc_remove (struct platform_device *pdev) {struct mmdc_pmu *pmu_mmdc =platform_get_drvdata (pdev); +ida_simple_remove (&mmdc_ida, pmu_mmdc->id);cpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);perf_pmu_unregister (&pmu_mmdc->pmu);iounmap (pmu_mmdc->mmdc_base);
@@ -485,7 +485,6 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b {struct mmdc_pmu *pmu_mmdc;char *name; -int mmdc_num;int ret;const struct of_device_id *of_id =of_match_device (imx_mmdc_dt_ids, &pdev->dev);
@@ -508,14 +507,14 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b cpuhp_mmdc_state = ret; } - mmdc_num =mmdc_pmu_init (pmu_mmdc, mmdc_base, &pdev->dev); - pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; -if (mmdc_num ==0 ) - name ="mmdc" ; -else - name =devm_kasprintf (&pdev->dev, -GFP_KERNEL ,"mmdc%d" , mmdc_num); + ret =mmdc_pmu_init (pmu_mmdc, mmdc_base, &pdev->dev); +if (ret <0 ) + goto pmu_free; + name =devm_kasprintf (&pdev->dev, +GFP_KERNEL ,"mmdc%d" , ret); + + pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data; hrtimer_init(&pmu_mmdc->hrtimer, CLOCK_MONOTONIC,
@@ -536,6 +535,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b pmu_register_err:pr_warn ("MMDC Perf PMU failed (%d), disabled\n" , ret); +ida_simple_remove (&mmdc_ida, pmu_mmdc->id);cpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);hrtimer_cancel (&pmu_mmdc->hrtimer); pmu_free:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/252 arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 127f79212b07c5d9a6657a87e3eafdd889335814 ]
Fixes:
scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -167,7 +167,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks"; - scpi_dvfs: clock-controller { + scpi_dvfs: clocks-0 { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/252 arm64: dts: meson-axg: enable SCPI
In reply to Greg Kroah-HartmanFrom: Jerome Brunet <[email protected]>
[ Upstream commit 2c130695ad5265ce2eb38f55ee0cce26238f7891 ]
Enable SCPI on the axg platform, with cpu clock and hwmon (core temperature) support
Stable-dep-of: 5b7069d72f03 ("arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name")
--- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 26 ++++++++++++++++++++++ 1 file changed, 26 insertions(+)
arch/arm64/boot/dts/amlogic/meson-axg.dtsi +26 -0
@@ -47,6 +47,7 @@ cpu0: cpu@0 { reg = <0x0 0x0>; enable-method = "psci"; next-level-cache = <&l2>; + clocks = <&scpi_dvfs 0>; }; cpu1: cpu@1 {
@@ -55,6 +56,7 @@ cpu1: cpu@1 { reg = <0x0 0x1>; enable-method = "psci"; next-level-cache = <&l2>; + clocks = <&scpi_dvfs 0>; }; cpu2: cpu@2 {
@@ -63,6 +65,7 @@ cpu2: cpu@2 { reg = <0x0 0x2>; enable-method = "psci"; next-level-cache = <&l2>; + clocks = <&scpi_dvfs 0>; }; cpu3: cpu@3 {
@@ -71,6 +74,7 @@ cpu3: cpu@3 { reg = <0x0 0x3>; enable-method = "psci"; next-level-cache = <&l2>; + clocks = <&scpi_dvfs 0>; }; l2: l2-cache0 {
@@ -151,6 +155,28 @@ ao_alt_xtal: ao_alt_xtal-clk { #clock-cells = <0>; }; + scpi { + compatible = "arm,scpi-pre-1.0"; + mboxes = <&mailbox 1 &mailbox 2>; + shmem = <&cpu_scp_lpri &cpu_scp_hpri>; + + scpi_clocks: clocks { + compatible = "arm,scpi-clocks"; + + scpi_dvfs: clock-controller { + compatible = "arm,scpi-dvfs-clocks"; + #clock-cells = <1>; + clock-indices = <0>; + clock-output-names = "vcpu"; + }; + }; + + scpi_sensors: sensors { + compatible = "amlogic,meson-gxbb-scpi-sensors"; + #thermal-sensor-cells = <1>; + }; + }; + soc { compatible = "simple-bus"; #address-cells = <2>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/252 arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 5b7069d72f03c92a0ab919725017394ebce03a81 ]
Fixes:
scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-axg.dtsi +1 -1
@@ -163,7 +163,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks"; - scpi_dvfs: clock-controller { + scpi_dvfs: clocks-0 { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/252 arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 2ff650051493d5bdb6dd09d4c2850bb37db6be31 ]
Fixes:
scpi: sensors:compatible: 'oneOf' conditional failed, one must be fixed:
['amlogic,meson-gxbb-scpi-sensors'] is too short 'arm,scpi-sensors' was expected
--- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-axg.dtsi +1 -1
@@ -172,7 +172,7 @@ scpi_dvfs: clocks-0 { }; scpi_sensors: sensors { - compatible = "amlogic,meson-gxbb-scpi-sensors"; + compatible = "amlogic,meson-gxbb-scpi-sensors", "arm,scpi-sensors"; #thermal-sensor-cells = <1>; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/252 arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 61ff70708b98a85516eccb3755084ac97b42cf48 ]
Fixes:
bus@c8834000: rng: {...} should not be valid under {'type': 'object'}
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -423,7 +423,7 @@ periphs: periphs@c8834000 { #size-cells = <2>; ranges = <0x0 0x0 0x0 0xc8834000 0x0 0x2000>; - hwrng: rng { + hwrng: rng@0 { compatible = "amlogic,meson-rng"; reg = <0x0 0x0 0x0 0x4>; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/252 arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit d19189f70ba596798ea49166d2d1ef36a8df5289 ]
Fixes:
bus@c8834000: eth-phy-mux: {...} should not be valid under {'type': 'object'}
--- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +1 -1
@@ -636,7 +636,7 @@ mux { }; }; - eth-phy-mux { + eth-phy-mux@55c { compatible = "mdio-mux-mmioreg", "mdio-mux"; #address-cells = <1>; #size-cells = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/252 arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 22925af785fa3470efdf566339616d801119d348 ]
Specify #pwm-cells on pwm@11006000 to make it actually usable.
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +1 -0
@@ -380,6 +380,7 @@ uart3: serial@11005000 { pwm: pwm@11006000 { compatible = "mediatek,mt7622-pwm"; reg = <0 0x11006000 0 0x1000>; + #pwm-cells = <2>; interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_LOW>; clocks = <&topckgen CLK_TOP_PWM_SEL>, <&pericfg CLK_PERI_PWM_PD>,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/252 blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
In reply to Greg Kroah-HartmanFrom: Kemeng Shi <[email protected]>
[ Upstream commit c31e76bcc379182fe67a82c618493b7b8868c672 ]
Commit 97889f9ac24f8 ("blk-mq: remove synchronize_rcu() from blk_mq_del_queue_tag_set()") remove handle of TAG_SHARED in restart, then shared_hctx_restart counted for how many hardware queues are marked for restart is removed too.
Remove the stale comment that we still count hardware queues need restart.
--- block/blk-mq-sched.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
block/blk-mq-sched.c +1 -2
@@ -51,8 +51,7 @@ void blk_mq_sched_assign_ioc(struct request *rq, struct bio *bio) }/* -* Mark a hardware queue as needing a restart. For shared queues, maintain -* a count of how many hardware queues are marked for restart. +* Mark a hardware queue as needing a restart. */ void blk_mq_sched_mark_restart_hctx (struct blk_mq_hw_ctx *hctx) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/252 block: bio-integrity: Copy flags when bio_integrity_payload is cloned
In reply to Greg Kroah-HartmanFrom: Martin K. Petersen <[email protected]>
[ Upstream commit b6a4bdcda430e3ca43bbb9cb1d4d4d34ebe15c40 ]
Make sure to copy the flags when a bio_integrity_payload is cloned. Otherwise per-I/O properties such as IP checksum flag will not be passed down to the HBA driver. Since the integrity buffer is owned by the original bio, the BIP_BLOCK_INTEGRITY flag needs to be masked off to avoid a double free in the completion path.
--- block/bio-integrity.c | 1 + 1 file changed, 1 insertion(+)
block/bio-integrity.c +1 -0
@@ -444,6 +444,7 @@ int bio_integrity_clone(struct bio *bio, struct bio *bio_src, bip->bip_vcnt = bip_src->bip_vcnt; bip->bip_iter = bip_src->bip_iter; + bip->bip_flags = bip_src->bip_flags & ~BIP_BLOCK_INTEGRITY ;return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/252 wifi: rsi: Fix memory leak in rsi_coex_attach()
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f ]
The coex_cb needs to be freed when rsi_create_kthread() failed in rsi_coex_attach().
--- drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rsi/rsi_91x_coex.c +1 -0
@@ -160,6 +160,7 @@ int rsi_coex_attach(struct rsi_common *common) rsi_coex_scheduler_thread, "Coex-Tx-Thread")) {rsi_dbg (ERR_ZONE ,"%s: Unable to init tx thrd\n" , __func__); +kfree (coex_cb);return -EINVAL ; }return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/252 wifi: libertas: fix memory leak in lbs_init_adapter()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 16a03958618fb91bb1bc7077cf3211055162cc2f ]
When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not released. Add free memory to processing error path.
--- drivers/net/wireless/marvell/libertas/main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/libertas/main.c +1 -0
@@ -869,6 +869,7 @@ static int lbs_init_adapter(struct lbs_private *priv) ret =kfifo_alloc (&priv->event_fifo,sizeof (u32) *16 ,GFP_KERNEL );if (ret) {pr_err ("Out of memory allocating event FIFO buffer\n" ); +lbs_free_cmd_buffer (priv); goto out; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/252 wifi: rtl8xxxu: dont call dev_kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 4c2005ac87685907b3719b4f40215b578efd27c4 ]
It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled.
It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal.
In this case, dev_kfree_skb() is called to free and drop the SKB when it's shutdown, so replace it with dev_kfree_skb_irq(). Compile tested only.
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +1 -1
@@ -5101,7 +5101,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv, pending = priv->rx_urb_pending_count; }else { skb = (struct sk_buff *)rx_urb->urb.context; -dev_kfree_skb (skb); +dev_kfree_skb_irq (skb);usb_free_urb (&rx_urb->urb); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/252 rtlwifi: fix -Wpointer-sign warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit ef41937631bfee855e2b406e1d536efdaa9ce512 ]
There are thousands of warnings in a W=2 build from just one file:
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c:3788:15: warning: pointer targets in initialization of 'u8 *' {aka 'unsigned char *'} from 'char *' differ in signedness [-Wpointer-sign]
Change the types to consistently use 'const char *' for the strings.
Stable-dep-of: 117dbeda22ec ("wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()")
--- .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 81 ++++++++++--------- .../realtek/rtlwifi/rtl8821ae/table.c | 4 +- .../realtek/rtlwifi/rtl8821ae/table.h | 4 +- 3 files changed, 45 insertions(+), 44 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +41 -40
@@ -1608,7 +1608,7 @@ static void _rtl8821ae_phy_txpower_by_rate_configuration(struct ieee80211_hw *hw }/* string is in decimal */ -static bool _rtl8812ae_get_integer_from_string (char *str,u8 *pint) +static bool _rtl8812ae_get_integer_from_string (const char *str,u8 *pint) {u16 i =0 ; *pint =0 ;
@@ -1626,7 +1626,7 @@ static bool _rtl8812ae_get_integer_from_string(char *str, u8 *pint)return true; } -static bool _rtl8812ae_eq_n_byte (u8 *str1,u8 *str2,u32 num) +static bool _rtl8812ae_eq_n_byte (const char *str1,const char *str2,u32 num) {if (num ==0 )return false;
@@ -1664,10 +1664,11 @@ static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw,return channel_index; } -static void _rtl8812ae_phy_set_txpower_limit (struct ieee80211_hw *hw,u8 *pregulation, -u8 *pband,u8 *pbandwidth, -u8 *prate_section,u8 *prf_path, -u8 *pchannel,u8 *ppower_limit) +static void _rtl8812ae_phy_set_txpower_limit (struct ieee80211_hw *hw, +const char *pregulation, +const char *pband,const char *pbandwidth, +const char *prate_section,const char *prf_path, +const char *pchannel,const char *ppower_limit) {struct rtl_priv *rtlpriv =rtl_priv (hw);struct rtl_phy *rtlphy = &rtlpriv->phy;
@@ -1675,8 +1676,8 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregulu8 channel_index;s8 power_limit =0 , prev_power_limit, ret; -if (!_rtl8812ae_get_integer_from_string ((char *)pchannel, &channel) || - !_rtl8812ae_get_integer_from_string ((char *)ppower_limit, +if (!_rtl8812ae_get_integer_from_string (pchannel, &channel) || + !_rtl8812ae_get_integer_from_string (ppower_limit, &power_limit)) { RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "Illegal index of pwr_lmt table [chnl %d][val %d]\n",
@@ -1686,42 +1687,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul power_limit = power_limit >MAX_POWER_INDEX ?MAX_POWER_INDEX : power_limit; -if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("FCC" ),3 )) +if (_rtl8812ae_eq_n_byte (pregulation,"FCC" ,3 )) regulation =0 ; -else if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("MKK" ),3 )) +else if (_rtl8812ae_eq_n_byte (pregulation,"MKK" ,3 )) regulation =1 ; -else if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("ETSI" ),4 )) +else if (_rtl8812ae_eq_n_byte (pregulation,"ETSI" ,4 )) regulation =2 ; -else if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("WW13" ),4 )) +else if (_rtl8812ae_eq_n_byte (pregulation,"WW13" ,4 )) regulation =3 ; -if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("CCK" ),3 )) +if (_rtl8812ae_eq_n_byte (prate_section,"CCK" ,3 )) rate_section =0 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("OFDM" ),4 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"OFDM" ,4 )) rate_section =1 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("HT" ),2 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("1T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && +_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) rate_section =2 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("HT" ),2 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("2T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && +_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) rate_section =3 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("VHT" ),3 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("1T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && +_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) rate_section =4 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("VHT" ),3 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("2T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && +_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) rate_section =5 ; -if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("20M" ),3 )) +if (_rtl8812ae_eq_n_byte (pbandwidth,"20M" ,3 )) bandwidth =0 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("40M" ),3 )) +else if (_rtl8812ae_eq_n_byte (pbandwidth,"40M" ,3 )) bandwidth =1 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("80M" ),3 )) +else if (_rtl8812ae_eq_n_byte (pbandwidth,"80M" ,3 )) bandwidth =2 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("160M" ),4 )) +else if (_rtl8812ae_eq_n_byte (pbandwidth,"160M" ,4 )) bandwidth =3 ; -if (_rtl8812ae_eq_n_byte (pband, (u8 *)("2.4G" ),4 )) { +if (_rtl8812ae_eq_n_byte (pband,"2.4G" ,4 )) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_2_4G , channel);
@@ -1745,7 +1746,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul regulation, bandwidth, rate_section, channel_index, rtlphy->txpwr_limit_2_4g[regulation][bandwidth] [rate_section][channel_index][RF90_PATH_A]); - }else if (_rtl8812ae_eq_n_byte (pband, (u8 *)("5G" ),2 )) { + }else if (_rtl8812ae_eq_n_byte (pband,"5G" ,2 )) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_5G , channel);
@@ -1776,10 +1777,10 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul }static void _rtl8812ae_phy_config_bb_txpwr_lmt (struct ieee80211_hw *hw, -u8 *regulation,u8 *band, -u8 *bandwidth,u8 *rate_section, -u8 *rf_path,u8 *channel, -u8 *power_limit) +const char *regulation,const char *band, +const char *bandwidth,const char *rate_section, +const char *rf_path,const char *channel, +const char *power_limit) { _rtl8812ae_phy_set_txpower_limit(hw, regulation, band, bandwidth, rate_section, rf_path, channel,
@@ -1792,7 +1793,7 @@ static void _rtl8821ae_phy_read_and_config_txpwr_lmt(struct ieee80211_hw *hw)struct rtl_hal *rtlhal =rtl_hal (rtlpriv);u32 i =0 ;u32 array_len; -u8 **array; +const char **array;if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) { array_len =RTL8812AE_TXPWR_LMT_ARRAY_LEN ;
@@ -1806,13 +1807,13 @@ static void _rtl8821ae_phy_read_and_config_txpwr_lmt(struct ieee80211_hw *hw) "\n");for (i =0 ; i < array_len; i +=7 ) { -u8 *regulation = array[i]; -u8 *band = array[i+1 ]; -u8 *bandwidth = array[i+2 ]; -u8 *rate = array[i+3 ]; -u8 *rf_path = array[i+4 ]; -u8 *chnl = array[i+5 ]; -u8 *val = array[i+6 ]; +const char *regulation = array[i]; +const char *band = array[i+1 ]; +const char *bandwidth = array[i+2 ]; +const char *rate = array[i+3 ]; +const char *rf_path = array[i+4 ]; +const char *chnl = array[i+5 ]; +const char *val = array[i+6 ]; _rtl8812ae_phy_config_bb_txpwr_lmt(hw, regulation, band, bandwidth, rate, rf_path,
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c +2 -2
@@ -2917,7 +2917,7 @@ u32 RTL8821AE_AGC_TAB_1TARRAYLEN = ARRAY_SIZE(RTL8821AE_AGC_TAB_ARRAY);* TXPWR_LMT.TXT ******************************************************************************/ -u8 *RTL8812AE_TXPWR_LMT [] = { +const char *RTL8812AE_TXPWR_LMT [] = {"FCC" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"36" ,"ETSI" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,"MKK" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,
@@ -3486,7 +3486,7 @@ u8 *RTL8812AE_TXPWR_LMT[] = {u32 RTL8812AE_TXPWR_LMT_ARRAY_LEN =ARRAY_SIZE (RTL8812AE_TXPWR_LMT ); -u8 *RTL8821AE_TXPWR_LMT [] = { +const char *RTL8821AE_TXPWR_LMT [] = {"FCC" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,"ETSI" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,"MKK" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.h +2 -2
@@ -52,7 +52,7 @@ extern u32 RTL8821AE_AGC_TAB_ARRAY[];extern u32 RTL8812AE_AGC_TAB_1TARRAYLEN ;extern u32 RTL8812AE_AGC_TAB_ARRAY [];extern u32 RTL8812AE_TXPWR_LMT_ARRAY_LEN ; -extern u8 *RTL8812AE_TXPWR_LMT []; +extern const char *RTL8812AE_TXPWR_LMT [];extern u32 RTL8821AE_TXPWR_LMT_ARRAY_LEN ; -extern u8 *RTL8821AE_TXPWR_LMT []; +extern const char *RTL8821AE_TXPWR_LMT [];#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/252 wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
In reply to Greg Kroah-HartmanFrom: Li Zetao <[email protected]>
[ Upstream commit 117dbeda22ec5ea0918254d03b540ef8b8a64d53 ]
There is a global-out-of-bounds reported by KASAN:
BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ... </TASK>
The root cause of the problem is that the comparison order of "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two strings from tail to head, which causes the problem. In the _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully designing the comparison order. For example, "pregulation" and "pbandwidth" are compared in order of length from small to large, first is 3 and last is 4. However, the comparison order of "prate_section" dose not obey such order requirement, therefore when "prate_section" is "HT", when comparing from tail to head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough.
Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order of "prate_section", this may cause the value of "rate_section" to not be from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver from staging to regular tree, but also added setting txpower limit function during the driver config phase, so the problem was introduced by this commit.
--- .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------ 1 file changed, 20 insertions(+), 32 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +20 -32
@@ -1626,18 +1626,6 @@ static bool _rtl8812ae_get_integer_from_string(const char *str, u8 *pint)return true; } -static bool _rtl8812ae_eq_n_byte (const char *str1,const char *str2,u32 num) -{ -if (num ==0 ) -return false; -while (num >0 ) { - num--; -if (str1[num] != str2[num]) -return false; - } -return true; -} -static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (struct ieee80211_hw *hw,u8 band,u8 channel) {
@@ -1687,42 +1675,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, power_limit = power_limit >MAX_POWER_INDEX ?MAX_POWER_INDEX : power_limit; -if (_rtl8812ae_eq_n_byte (pregulation,"FCC" ,3 )) +if (strcmp (pregulation,"FCC" ) ==0 ) regulation =0 ; -else if (_rtl8812ae_eq_n_byte (pregulation,"MKK" ,3 )) +else if (strcmp (pregulation,"MKK" ) ==0 ) regulation =1 ; -else if (_rtl8812ae_eq_n_byte (pregulation,"ETSI" ,4 )) +else if (strcmp (pregulation,"ETSI" ) ==0 ) regulation =2 ; -else if (_rtl8812ae_eq_n_byte (pregulation,"WW13" ,4 )) +else if (strcmp (pregulation,"WW13" ) ==0 ) regulation =3 ; -if (_rtl8812ae_eq_n_byte (prate_section,"CCK" ,3 )) +if (strcmp (prate_section,"CCK" ) ==0 ) rate_section =0 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"OFDM" ,4 )) +else if (strcmp (prate_section,"OFDM" ) ==0 ) rate_section =1 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && -_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) +else if (strcmp (prate_section,"HT" ) ==0 && +strcmp (prf_path,"1T" ) ==0 ) rate_section =2 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && -_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) +else if (strcmp (prate_section,"HT" ) ==0 && +strcmp (prf_path,"2T" ) ==0 ) rate_section =3 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && -_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) +else if (strcmp (prate_section,"VHT" ) ==0 && +strcmp (prf_path,"1T" ) ==0 ) rate_section =4 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && -_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) +else if (strcmp (prate_section,"VHT" ) ==0 && +strcmp (prf_path,"2T" ) ==0 ) rate_section =5 ; -if (_rtl8812ae_eq_n_byte (pbandwidth,"20M" ,3 )) +if (strcmp (pbandwidth,"20M" ) ==0 ) bandwidth =0 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth,"40M" ,3 )) +else if (strcmp (pbandwidth,"40M" ) ==0 ) bandwidth =1 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth,"80M" ,3 )) +else if (strcmp (pbandwidth,"80M" ) ==0 ) bandwidth =2 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth,"160M" ,4 )) +else if (strcmp (pbandwidth,"160M" ) ==0 ) bandwidth =3 ; -if (_rtl8812ae_eq_n_byte (pband,"2.4G" ,4 )) { +if (strcmp (pband,"2.4G" ) ==0 ) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_2_4G , channel);
@@ -1746,7 +1734,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, regulation, bandwidth, rate_section, channel_index, rtlphy->txpwr_limit_2_4g[regulation][bandwidth] [rate_section][channel_index][RF90_PATH_A]); - }else if (_rtl8812ae_eq_n_byte (pband,"5G" ,2 )) { + }else if (strcmp (pband,"5G" ) ==0 ) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_5G , channel);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/252 ipw2x00: switch from pci_ to dma_ API
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit e52525c0c320076deab35409a6b2cff6388959b8 ]
The wrappers in include/linux/pci-dma-compat.h should go away.
The patch has been generated with the coccinelle script below and has been hand modified to replace GFP_ with a correct flag.
It has been compile tested.
When memory is allocated in 'ipw2100_msg_allocate()' (ipw2100.c), GFP_KERNEL can be used because it is called from the probe function. The call chain is:
ipw2100_pci_init_one (the probe function)
--> ipw2100_queues_allocate
--> ipw2100_msg_allocateMoreover, 'ipw2100_msg_allocate()' already uses GFP_KERNEL for some other memory allocations.
When memory is allocated in 'status_queue_allocate()' (ipw2100.c), GFP_KERNEL can be used because it is called from the probe function. The call chain is:
ipw2100_pci_init_one (the probe function)
--> ipw2100_queues_allocate
--> ipw2100_rx_allocate
--> status_queue_allocateMoreover, 'ipw2100_rx_allocate()' already uses GFP_KERNEL for some other memory allocations.
When memory is allocated in 'bd_queue_allocate()' (ipw2100.c), GFP_KERNEL can be used because it is called from the probe function. The call chain is:
ipw2100_pci_init_one (the probe function)
--> ipw2100_queues_allocate
--> ipw2100_rx_allocate
--> bd_queue_allocateMoreover, 'ipw2100_rx_allocate()' already uses GFP_KERNEL for some other memory allocations.
When memory is allocated in 'ipw2100_tx_allocate()' (ipw2100.c), GFP_KERNEL can be used because it is called from the probe function. The call chain is:
ipw2100_pci_init_one (the probe function)
--> ipw2100_queues_allocate
--> ipw2100_tx_allocateMoreover, 'ipw2100_tx_allocate()' already uses GFP_KERNEL for some other memory allocations.
When memory is allocated in 'ipw_queue_tx_init()' (ipw2200.c), GFP_KERNEL can be used because it is called from a call chain that already uses GFP_KERNEL and no spin_lock is taken in the between.
The call chain is:
ipw_up
--> ipw_load
--> ipw_queue_reset
--> ipw_queue_tx_init'ipw_up()' already uses GFP_KERNEL for some other memory allocations.
@@
@@
- PCI_DMA_BIDIRECTIONAL
+ DMA_BIDIRECTIONAL
@@
@@
- PCI_DMA_TODEVICE
+ DMA_TO_DEVICE
@@
@@
- PCI_DMA_FROMDEVICE
+ DMA_FROM_DEVICE
@@
@@
- PCI_DMA_NONE
+ DMA_NONE
@@
expression e1, e2, e3;
@@
- pci_alloc_consistent(e1, e2, e3)
+ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
@@
expression e1, e2, e3;
@@
- pci_zalloc_consistent(e1, e2, e3)
+ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
@@
expression e1, e2, e3, e4;
@@
- pci_free_consistent(e1, e2, e3, e4)
+ dma_free_coherent(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_map_single(e1, e2, e3, e4)
+ dma_map_single(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_single(e1, e2, e3, e4)
+ dma_unmap_single(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4, e5;
@@
- pci_map_page(e1, e2, e3, e4, e5)
+ dma_map_page(&e1->dev, e2, e3, e4, e5)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_page(e1, e2, e3, e4)
+ dma_unmap_page(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_map_sg(e1, e2, e3, e4)
+ dma_map_sg(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_sg(e1, e2, e3, e4)
+ dma_unmap_sg(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_single_for_cpu(e1, e2, e3, e4)
+ dma_sync_single_for_cpu(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_single_for_device(e1, e2, e3, e4)
+ dma_sync_single_for_device(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_sg_for_cpu(e1, e2, e3, e4)
+ dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_sg_for_device(e1, e2, e3, e4)
+ dma_sync_sg_for_device(&e1->dev, e2, e3, e4)
@@
expression e1, e2;
@@
- pci_dma_mapping_error(e1, e2)
+ dma_mapping_error(&e1->dev, e2)
@@
expression e1, e2;
@@
- pci_set_dma_mask(e1, e2)
+ dma_set_mask(&e1->dev, e2)
@@
expression e1, e2;
@@
- pci_set_consistent_dma_mask(e1, e2)
+ dma_set_coherent_mask(&e1->dev, e2)
Stable-dep-of: 45fc6d7461f1 ("wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()")
--- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 121 +++++++++---------- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 56 ++++----- 2 files changed, 88 insertions(+), 89 deletions(-)
drivers/net/wireless/intel/ipw2x00/ipw2100.c +59 -62
@@ -2308,10 +2308,11 @@ static int ipw2100_alloc_skb(struct ipw2100_priv *priv,return -ENOMEM ; packet->rxp = (struct ipw2100_rx *)packet->skb->data; - packet->dma_addr =pci_map_single (priv->pci_dev, packet->skb->data, + packet->dma_addr =dma_map_single (&priv->pci_dev->dev, + packet->skb->data,sizeof (struct ipw2100_rx ), -PCI_DMA_FROMDEVICE ); -if (pci_dma_mapping_error (priv->pci_dev, packet->dma_addr)) { +DMA_FROM_DEVICE ); +if (dma_mapping_error (&priv->pci_dev->dev, packet->dma_addr)) {dev_kfree_skb (packet->skb);return -ENOMEM ; }
@@ -2492,9 +2493,8 @@ static void isr_rx(struct ipw2100_priv *priv, int i,return ; } -pci_unmap_single (priv->pci_dev, - packet->dma_addr, -sizeof (struct ipw2100_rx ),PCI_DMA_FROMDEVICE ); +dma_unmap_single (&priv->pci_dev->dev, packet->dma_addr, +sizeof (struct ipw2100_rx ),DMA_FROM_DEVICE );skb_put (packet->skb, status->frame_size);
@@ -2576,8 +2576,8 @@ static void isr_rx_monitor(struct ipw2100_priv *priv, int i,return ; } -pci_unmap_single (priv->pci_dev, packet->dma_addr, -sizeof (struct ipw2100_rx ),PCI_DMA_FROMDEVICE ); +dma_unmap_single (&priv->pci_dev->dev, packet->dma_addr, +sizeof (struct ipw2100_rx ),DMA_FROM_DEVICE );memmove (packet->skb->data +sizeof (struct ipw_rt_hdr ), packet->skb->data, status->frame_size);
@@ -2702,9 +2702,9 @@ static void __ipw2100_rx_process(struct ipw2100_priv *priv)/* Sync the DMA for the RX buffer so CPU is sure to get * the correct values */ -pci_dma_sync_single_for_cpu (priv->pci_dev, packet->dma_addr, -sizeof (struct ipw2100_rx ), -PCI_DMA_FROMDEVICE ); +dma_sync_single_for_cpu (&priv->pci_dev->dev, packet->dma_addr, +sizeof (struct ipw2100_rx ), +DMA_FROM_DEVICE );if (unlikely (ipw2100_corruption_check (priv, i))) {ipw2100_corruption_detected (priv, i);
@@ -2936,9 +2936,8 @@ static int __ipw2100_tx_process(struct ipw2100_priv *priv) (packet->index +1 + i) % txq->entries, tbd->host_addr, tbd->buf_length); -pci_unmap_single (priv->pci_dev, - tbd->host_addr, - tbd->buf_length,PCI_DMA_TODEVICE ); +dma_unmap_single (&priv->pci_dev->dev, tbd->host_addr, + tbd->buf_length,DMA_TO_DEVICE ); }libipw_txb_free (packet->info.d_struct.txb);
@@ -3178,15 +3177,13 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv) tbd->buf_length = packet->info.d_struct.txb-> fragments[i]->len -LIBIPW_3ADDR_LEN ; - tbd->host_addr =pci_map_single (priv->pci_dev, + tbd->host_addr =dma_map_single (&priv->pci_dev->dev, packet->info.d_struct. - txb->fragments[i]-> - data + + txb->fragments[i]->data +LIBIPW_3ADDR_LEN , tbd->buf_length, -PCI_DMA_TODEVICE ); -if (pci_dma_mapping_error (priv->pci_dev, - tbd->host_addr)) { +DMA_TO_DEVICE ); +if (dma_mapping_error (&priv->pci_dev->dev, tbd->host_addr)) {IPW_DEBUG_TX ("dma mapping error\n" );break ; }
@@ -3195,10 +3192,10 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv) txq->next, tbd->host_addr, tbd->buf_length); -pci_dma_sync_single_for_device (priv->pci_dev, - tbd->host_addr, - tbd->buf_length, -PCI_DMA_TODEVICE ); +dma_sync_single_for_device (&priv->pci_dev->dev, + tbd->host_addr, + tbd->buf_length, +DMA_TO_DEVICE ); txq->next++; txq->next %= txq->entries;
@@ -3453,9 +3450,9 @@ static int ipw2100_msg_allocate(struct ipw2100_priv *priv)return -ENOMEM ;for (i =0 ; i <IPW_COMMAND_POOL_SIZE ; i++) { - v =pci_zalloc_consistent (priv->pci_dev, -sizeof (struct ipw2100_cmd_header ), - &p); + v =dma_alloc_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_cmd_header ), &p, +GFP_KERNEL );if (!v) { printk(KERN_ERR DRV_NAME ": ""%s: PCI alloc failed for msg "
@@ -3474,11 +3471,10 @@ static int ipw2100_msg_allocate(struct ipw2100_priv *priv)return 0 ;for (j =0 ; j < i; j++) { -pci_free_consistent (priv->pci_dev, -sizeof (struct ipw2100_cmd_header ), - priv->msg_buffers[j].info.c_struct.cmd, - priv->msg_buffers[j].info.c_struct. - cmd_phys); +dma_free_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_cmd_header ), + priv->msg_buffers[j].info.c_struct.cmd, + priv->msg_buffers[j].info.c_struct.cmd_phys); }kfree (priv->msg_buffers);
@@ -3509,11 +3505,10 @@ static void ipw2100_msg_free(struct ipw2100_priv *priv)return ;for (i =0 ; i <IPW_COMMAND_POOL_SIZE ; i++) { -pci_free_consistent (priv->pci_dev, -sizeof (struct ipw2100_cmd_header ), - priv->msg_buffers[i].info.c_struct.cmd, - priv->msg_buffers[i].info.c_struct. - cmd_phys); +dma_free_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_cmd_header ), + priv->msg_buffers[i].info.c_struct.cmd, + priv->msg_buffers[i].info.c_struct.cmd_phys); }kfree (priv->msg_buffers);
@@ -4336,7 +4331,8 @@ static int status_queue_allocate(struct ipw2100_priv *priv, int entries)IPW_DEBUG_INFO ("enter\n" ); q->size = entries *sizeof (struct ipw2100_status ); - q->drv =pci_zalloc_consistent (priv->pci_dev, q->size, &q->nic); + q->drv =dma_alloc_coherent (&priv->pci_dev->dev, q->size, &q->nic, +GFP_KERNEL );if (!q->drv) {IPW_DEBUG_WARNING ("Can not allocate status queue.\n" );return -ENOMEM ;
@@ -4352,9 +4348,10 @@ static void status_queue_free(struct ipw2100_priv *priv)IPW_DEBUG_INFO ("enter\n" );if (priv->status_queue.drv) { -pci_free_consistent (priv->pci_dev, priv->status_queue.size, - priv->status_queue.drv, - priv->status_queue.nic); +dma_free_coherent (&priv->pci_dev->dev, + priv->status_queue.size, + priv->status_queue.drv, + priv->status_queue.nic); priv->status_queue.drv =NULL ; }
@@ -4370,7 +4367,8 @@ static int bd_queue_allocate(struct ipw2100_priv *priv, q->entries = entries; q->size = entries *sizeof (struct ipw2100_bd ); - q->drv =pci_zalloc_consistent (priv->pci_dev, q->size, &q->nic); + q->drv =dma_alloc_coherent (&priv->pci_dev->dev, q->size, &q->nic, +GFP_KERNEL );if (!q->drv) {IPW_DEBUG_INFO ("can't allocate shared memory for buffer descriptors\n" );
@@ -4390,7 +4388,8 @@ static void bd_queue_free(struct ipw2100_priv *priv, struct ipw2100_bd_queue *q)return ;if (q->drv) { -pci_free_consistent (priv->pci_dev, q->size, q->drv, q->nic); +dma_free_coherent (&priv->pci_dev->dev, q->size, q->drv, + q->nic); q->drv =NULL ; }
@@ -4450,9 +4449,9 @@ static int ipw2100_tx_allocate(struct ipw2100_priv *priv) }for (i =0 ; i <TX_PENDED_QUEUE_LENGTH ; i++) { - v =pci_alloc_consistent (priv->pci_dev, -sizeof (struct ipw2100_data_header ), - &p); + v =dma_alloc_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_data_header ), &p, +GFP_KERNEL );if (!v) { printk(KERN_ERR DRV_NAME ": %s: PCI alloc failed for tx " "buffers.\n",
@@ -4472,11 +4471,10 @@ static int ipw2100_tx_allocate(struct ipw2100_priv *priv)return 0 ;for (j =0 ; j < i; j++) { -pci_free_consistent (priv->pci_dev, -sizeof (struct ipw2100_data_header ), - priv->tx_buffers[j].info.d_struct.data, - priv->tx_buffers[j].info.d_struct. - data_phys); +dma_free_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_data_header ), + priv->tx_buffers[j].info.d_struct.data, + priv->tx_buffers[j].info.d_struct.data_phys); }kfree (priv->tx_buffers);
@@ -4553,12 +4551,10 @@ static void ipw2100_tx_free(struct ipw2100_priv *priv) priv->tx_buffers[i].info.d_struct.txb =NULL ; }if (priv->tx_buffers[i].info.d_struct.data) -pci_free_consistent (priv->pci_dev, -sizeof (struct ipw2100_data_header ), - priv->tx_buffers[i].info.d_struct. - data, - priv->tx_buffers[i].info.d_struct. - data_phys); +dma_free_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_data_header ), + priv->tx_buffers[i].info.d_struct.data, + priv->tx_buffers[i].info.d_struct.data_phys); }kfree (priv->tx_buffers);
@@ -4621,9 +4617,10 @@ static int ipw2100_rx_allocate(struct ipw2100_priv *priv)return 0 ;for (j =0 ; j < i; j++) { -pci_unmap_single (priv->pci_dev, priv->rx_buffers[j].dma_addr, +dma_unmap_single (&priv->pci_dev->dev, + priv->rx_buffers[j].dma_addr,sizeof (struct ipw2100_rx_packet ), -PCI_DMA_FROMDEVICE ); +DMA_FROM_DEVICE );dev_kfree_skb (priv->rx_buffers[j].skb); }
@@ -4675,10 +4672,10 @@ static void ipw2100_rx_free(struct ipw2100_priv *priv)for (i =0 ; i <RX_QUEUE_LENGTH ; i++) {if (priv->rx_buffers[i].rxp) { -pci_unmap_single (priv->pci_dev, +dma_unmap_single (&priv->pci_dev->dev, priv->rx_buffers[i].dma_addr,sizeof (struct ipw2100_rx ), -PCI_DMA_FROMDEVICE ); +DMA_FROM_DEVICE );dev_kfree_skb (priv->rx_buffers[i].skb); } }
@@ -6214,7 +6211,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,pci_set_master (pci_dev);pci_set_drvdata (pci_dev, priv); - err =pci_set_dma_mask (pci_dev,DMA_BIT_MASK (32 )); + err =dma_set_mask (&pci_dev->dev,DMA_BIT_MASK (32 ));if (err) { printk(KERN_WARNING DRV_NAME "Error calling pci_set_dma_mask.\n");
drivers/net/wireless/intel/ipw2x00/ipw2200.c +29 -27
124 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/252 wifi: ipw2x00: dont call dev_kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 45fc6d7461f18df2f238caf0cbc5acc4163203d1 ]
It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled.
It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal.
In this case, dev_kfree_skb() is called to free and drop the SKB when it's reset, so replace it with dev_kfree_skb_irq(). Compile tested only.
--- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/ipw2x00/ipw2200.c +1 -1
@@ -3459,7 +3459,7 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv,dma_unmap_single (&priv->pci_dev->dev, rxq->pool[i].dma_addr,IPW_RX_BUF_SIZE ,DMA_FROM_DEVICE ); -dev_kfree_skb (rxq->pool[i].skb); +dev_kfree_skb_irq (rxq->pool[i].skb); rxq->pool[i].skb =NULL ; }list_add_tail (&rxq->pool[i].list, &rxq->rx_used);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/252 wifi: ipw2200: fix memory leak in ipw_wdev_init()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 9fe21dc626117fb44a8eb393713a86a620128ce3 ]
In the error path of ipw_wdev_init(), exception value is returned, and the memory applied for in the function is not released. Also the memory is not released in ipw_pci_probe(). As a result, memory leakage occurs. So memory release needs to be added to the error path of ipw_wdev_init().
--- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/ipw2x00/ipw2200.c +7 -2
@@ -11431,9 +11431,14 @@ static int ipw_wdev_init(struct net_device *dev)set_wiphy_dev (wdev->wiphy, &priv->pci_dev->dev);/* With that information in place, we can now register the wiphy... */ -if (wiphy_register (wdev->wiphy)) - rc = -EIO ; + rc =wiphy_register (wdev->wiphy); +if (rc) + goto out; + +return 0 ; out: +kfree (priv->ieee->a_band.channels); +kfree (priv->ieee->bg_band.channels);return rc; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/252 wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit 212fde3fe76e962598ce1d47b97cc78afdfc71b3 ]
The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Compile tested only.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +1 -0
@@ -313,6 +313,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,brcmf_err ("%s: failed to expand headroom\n" ,brcmf_ifname (ifp));atomic_inc (&drvr->bus_if->stats.pktcow_failed); +dev_kfree_skb (skb); goto done; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/252 wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit b9f420032f2ba1e634b22ca7b433e5c40ea663af ]
After the DMA buffer is mapped to a physical address, address is stored in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr and later unmap the DMA buffer. But when count is always equal to pktids->array_size, physaddr isn't stored in pktids and the DMA buffer will not be unmapped anyway.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +4 -1
@@ -339,8 +339,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev, count++; }while (count < pktids->array_size); -if (count == pktids->array_size) +if (count == pktids->array_size) { +dma_unmap_single (dev, *physaddr, skb->len - data_offset, + pktids->direction);return -ENOMEM ; + } array[*idx].data_offset = data_offset; array[*idx].physaddr = *physaddr;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/252 wifi: libertas_tf: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 9388ce97b98216833c969191ee6df61a7201d797 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas_tf/if_usb.c +1 -1
@@ -616,7 +616,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,spin_lock_irqsave (&priv->driver_lock, flags);memcpy (priv->cmd_resp_buff, recvbuff +MESSAGE_HEADER_LEN , recvlength -MESSAGE_HEADER_LEN ); -kfree_skb (skb); +dev_kfree_skb_irq (skb);lbtf_cmd_response_rx (priv);spin_unlock_irqrestore (&priv->driver_lock, flags); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/252 wifi: libertas: if_usb: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 3968e81ba644f10a7d45bae2539560db9edac501 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas/if_usb.c +1 -1
@@ -633,7 +633,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, priv->resp_len[i] = (recvlength -MESSAGE_HEADER_LEN );memcpy (priv->resp_buf[i], recvbuff +MESSAGE_HEADER_LEN , priv->resp_len[i]); -kfree_skb (skb); +dev_kfree_skb_irq (skb);lbs_notify_command_response (priv, i);spin_unlock_irqrestore (&priv->driver_lock, flags);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/252 wifi: libertas: main: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit f393df151540bf858effbd29ff572ab94e76a4c4 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas/main.c +1 -1
@@ -216,7 +216,7 @@ int lbs_stop_iface(struct lbs_private *priv)spin_lock_irqsave (&priv->driver_lock, flags); priv->iface_running = false; -kfree_skb (priv->currenttxskb); +dev_kfree_skb_irq (priv->currenttxskb); priv->currenttxskb =NULL ; priv->tx_pending_len =0 ;spin_unlock_irqrestore (&priv->driver_lock, flags);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/252 wifi: libertas: cmdresp: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 708a49a64237f19bd404852f297aaadbc9e7fee0 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas/cmdresp.c +1 -1
@@ -48,7 +48,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv,/* Free Tx and Rx packets */ spin_lock_irqsave (&priv->driver_lock, flags); -kfree_skb (priv->currenttxskb); +dev_kfree_skb_irq (priv->currenttxskb); priv->currenttxskb =NULL ; priv->tx_pending_len =0 ;spin_unlock_irqrestore (&priv->driver_lock, flags);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/252 wifi: wl3501_cs: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 44bacbdf9066c590423259dbd6d520baac99c1a8 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/wl3501_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/wl3501_cs.c +1 -1
@@ -1329,7 +1329,7 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb, }else { ++dev->stats.tx_packets; dev->stats.tx_bytes += skb->len; -kfree_skb (skb); +dev_kfree_skb_irq (skb);if (this->tx_buffer_cnt <2 )netif_stop_queue (dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/252 ACPICA: Drop port I/O validation for some regions
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 ]
Microsoft introduced support in Windows XP for blocking port I/O to various regions. For Windows compatibility ACPICA has adopted the same protections and will disallow writes to those (presumably) the same regions.
On some systems the AML included with the firmware will issue 4 byte long writes to 0x80. These writes aren't making it over because of this blockage. The first 4 byte write attempt is rejected, and then subsequently 1 byte at a time each offset is tried. The first at 0x80 works, but then the next 3 bytes are rejected.
This manifests in bizarre failures for devices that expected the AML to write all 4 bytes. Trying the same AML on Windows 10 or 11 doesn't hit this failure and all 4 bytes are written.
Either some of these regions were wrong or some point after Windows XP some of these regions blocks have been lifted.
In the last 15 years there doesn't seem to be any reports popping up of this error in the Windows event viewer anymore. There is no documentation at Microsoft's developer site indicating that Windows ACPI interpreter blocks these regions. Between the lack of documentation and the fact that the writes actually do work in Windows 10 and 11, it's quite likely Windows doesn't actually enforce this anymore.
So to help the issue, only enforce Windows XP specific entries if the latest _OSI supported is Windows XP. Continue to enforce the ALWAYS_ILLEGAL entries.
--- drivers/acpi/acpica/hwvalid.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/acpi/acpica/hwvalid.c +4 -3
@@ -23,8 +23,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width);* * The table is used to implement the Microsoft port access rules that * first appeared in Windows XP. Some ports are always illegal, and some -* ports are only illegal if the BIOS calls _OSI with a win_XP string or -* later (meaning that the BIOS itelf is post-XP.) +* ports are only illegal if the BIOS calls _OSI with nothing newer than +* the specific _OSI strings. * * This provides ACPICA with the desired port protections and * Microsoft compatibility.
@@ -145,7 +145,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)/* Port illegality may depend on the _OSI calls made by the BIOS */ -if (acpi_gbl_osi_data >= port_info->osi_dependency) { +if (port_info->osi_dependency ==ACPI_ALWAYS_ILLEGAL || + acpi_gbl_osi_data == port_info->osi_dependency) { ACPI_DEBUG_PRINT((ACPI_DB_VALUES, "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)\n", ACPI_FORMAT_UINT64(address),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/252 genirq: Fix the return type of kstat_cpu_irqs_sum()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit 47904aed898a08f028572b9b5a5cc101ddfb2d82 ]
The type of member ->irqs_sum is unsigned long, but kstat_cpu_irqs_sum() returns int, which can result in truncation. Therefore, change the kstat_cpu_irqs_sum() function's return value to unsigned long to avoid truncation.
--- include/linux/kernel_stat.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/kernel_stat.h +1 -1
@@ -73,7 +73,7 @@ extern unsigned int kstat_irqs_usr(unsigned int irq);/* * Number of interrupts per cpu, since bootup */ -static inline unsigned int kstat_cpu_irqs_sum (unsigned int cpu) +static inline unsigned long kstat_cpu_irqs_sum (unsigned int cpu) {return kstat_cpu (cpu).irqs_sum; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 37/252 lib/mpi: Fix buffer overrun when SG is too long
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ]
The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes.
--- lib/mpi/mpicoder.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/mpi/mpicoder.c +2 -1
@@ -397,7 +397,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)while (sg_miter_next (&miter)) { buff = miter.addr; - len = miter.length; + len =min_t (unsigned, miter.length, nbytes); + nbytes -= len;for (x =0 ; x < len; x++) { a <<=8 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 38/252 ACPICA: nsrepair: handle cases without a return value correctly
In reply to Greg Kroah-HartmanFrom: Daniil Tatianin <[email protected]>
[ Upstream commit ca843a4c79486e99a19b859ef0b9887854afe146 ]
Previously acpi_ns_simple_repair() would crash if expected_btypes contained any combination of ACPI_RTYPE_NONE with a different type, e.g | ACPI_RTYPE_INTEGER because of slightly incorrect logic in the !return_object branch, which wouldn't return AE_AML_NO_RETURN_VALUE for such cases.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- drivers/acpi/acpica/nsrepair.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/acpi/acpica/nsrepair.c +7 -5
@@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,* Try to fix if there was no return object. Warning if failed to fix. */ if (!return_object) { -if (expected_btypes && (!(expected_btypes &ACPI_RTYPE_NONE ))) { -if (package_index !=ACPI_NOT_PACKAGE_ELEMENT ) { +if (expected_btypes) { +if (!(expected_btypes &ACPI_RTYPE_NONE ) && + package_index !=ACPI_NOT_PACKAGE_ELEMENT ) { ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname, ACPI_WARN_ALWAYS,
@@ -196,14 +197,15 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,if (ACPI_SUCCESS (status)) {return (AE_OK );/* Repair was successful */ } - }else { + } + +if (expected_btypes !=ACPI_RTYPE_NONE ) {ACPI_WARN_PREDEFINED ((AE_INFO , info->full_pathname,ACPI_WARN_ALWAYS ,"Missing expected return value" )); +return (AE_AML_NO_RETURN_VALUE ); } - -return (AE_AML_NO_RETURN_VALUE ); } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 39/252 wifi: orinoco: check return value of hermes_write_wordrec()
In reply to Greg Kroah-HartmanFrom: Alexey Kodanev <[email protected]>
[ Upstream commit 1e346cbb096a5351a637ec1992beffbf330547f0 ]
There is currently no return check for writing an authentication type (HERMES_AUTH_SHARED_KEY or HERMES_AUTH_OPEN). It looks like it was accidentally skipped.
This patch adds a return check similar to the other checks in __orinoco_hw_setup_enc() for hermes_write_wordrec().
Detected using the static analysis tool - Svace.
--- drivers/net/wireless/intersil/orinoco/hw.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intersil/orinoco/hw.c +2 -0
@@ -931,6 +931,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv) err =hermes_write_wordrec (hw,USER_BAP ,HERMES_RID_CNFAUTHENTICATION_AGERE , auth_flag); +if (err) +return err; } err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFWEPENABLED_AGERE,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 40/252 wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 ]
It is stated that ath9k_htc_rx_msg() either frees the provided skb or passes its management to another callback function. However, the skb is not freed in case there is no another callback function, and Syzkaller was able to cause a memory leak. Also minor comment fix.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/htc_hst.c +3 -1
@@ -394,7 +394,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,* HTC Messages are handled directly here and the obtained SKB * is freed. * -* Service messages (Data, WMI) passed to the corresponding +* Service messages (Data, WMI) are passed to the corresponding * endpoint RX handlers, which have to free the SKB. */ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
@@ -481,6 +481,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,if (endpoint->ep_callbacks.rx) endpoint->ep_callbacks.rx (endpoint->ep_callbacks.priv, skb, epid); +else + goto invalid; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 41/252 ath9k: hif_usb: simplify if-if to if-else
In reply to Greg Kroah-HartmanFrom: Wan Jiabing <[email protected]>
[ Upstream commit 2950833f10cfa601813262e1d9c8473f9415681b ]
Use if and else instead of if(A) and if (!A).
Stable-dep-of: 0af54343a762 ("wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails")
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +2 -3
@@ -368,10 +368,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)__skb_queue_head_init (&tx_buf->skb_queue);list_move_tail (&tx_buf->list, &hif_dev->tx.tx_buf); hif_dev->tx.tx_buf_cnt++; - } - -if (!ret) + }else {TX_STAT_INC (buf_queued); + }return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 42/252 ath9k: htc: clean up statistics macros
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit d7fc76039b74ad37b7056d5607b05d7cb31a5404 ]
I've changed *STAT_* macros a bit in previous patch and I seems like they become really unreadable. Align these macros definitions to make code cleaner and fix folllowing checkpatch warning
ERROR: Macros with complex values should be enclosed in parentheses
Also, statistics macros now accept an hif_dev as argument, since macros that depend on having a local variable with a magic name don't abide by the coding style.
No functional change
Stable-dep-of: 0af54343a762 ("wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails")
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 26 +++++++-------- drivers/net/wireless/ath/ath9k/htc.h | 32 +++++++++++-------- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +++--- 3 files changed, 36 insertions(+), 32 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +13 -13
@@ -244,11 +244,11 @@ static inline void ath9k_skb_queue_complete(struct hif_device_usb *hif_dev,ath9k_htc_txcompletion_cb (hif_dev->htc_handle, skb, txok);if (txok) { -TX_STAT_INC (skb_success); -TX_STAT_ADD (skb_success_bytes, ln); +TX_STAT_INC (hif_dev, skb_success); +TX_STAT_ADD (hif_dev, skb_success_bytes, ln); }else -TX_STAT_INC (skb_failed); +TX_STAT_INC (hif_dev, skb_failed); } }
@@ -302,7 +302,7 @@ static void hif_usb_tx_cb(struct urb *urb) hif_dev->tx.tx_buf_cnt++;if (!(hif_dev->tx.flags &HIF_USB_TX_STOP ))__hif_usb_tx (hif_dev);/* Check for pending SKBs */ -TX_STAT_INC (buf_completed); +TX_STAT_INC (hif_dev, buf_completed);spin_unlock (&hif_dev->tx.tx_lock); }
@@ -353,7 +353,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev) tx_buf->len += tx_buf->offset;__skb_queue_tail (&tx_buf->skb_queue, nskb); -TX_STAT_INC (skb_queued); +TX_STAT_INC (hif_dev, skb_queued); } usb_fill_bulk_urb(tx_buf->urb, hif_dev->udev,
@@ -369,7 +369,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)list_move_tail (&tx_buf->list, &hif_dev->tx.tx_buf); hif_dev->tx.tx_buf_cnt++; }else { -TX_STAT_INC (buf_queued); +TX_STAT_INC (hif_dev, buf_queued); }return ret;
@@ -514,7 +514,7 @@ static void hif_usb_sta_drain(void *hif_handle, u8 idx)ath9k_htc_txcompletion_cb (hif_dev->htc_handle, skb, false); hif_dev->tx.tx_skb_cnt--; -TX_STAT_INC (skb_failed); +TX_STAT_INC (hif_dev, skb_failed); } }
@@ -585,14 +585,14 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, pkt_tag =get_unaligned_le16 (ptr + index +2 );if (pkt_tag !=ATH_USB_RX_STREAM_MODE_TAG ) { -RX_STAT_INC (skb_dropped); +RX_STAT_INC (hif_dev, skb_dropped);return ; }if (pkt_len >2 *MAX_RX_BUF_SIZE ) {dev_err (&hif_dev->udev->dev,"ath9k_htc: invalid pkt_len (%x)\n" , pkt_len); -RX_STAT_INC (skb_dropped); +RX_STAT_INC (hif_dev, skb_dropped);return ; }
@@ -618,7 +618,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, goto err; }skb_reserve (nskb,32 ); -RX_STAT_INC (skb_allocated); +RX_STAT_INC (hif_dev, skb_allocated);memcpy (nskb->data, &(skb->data[chk_idx+4 ]), hif_dev->rx_transfer_len);
@@ -639,7 +639,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, goto err; }skb_reserve (nskb,32 ); -RX_STAT_INC (skb_allocated); +RX_STAT_INC (hif_dev, skb_allocated);memcpy (nskb->data, &(skb->data[chk_idx+4 ]), pkt_len);skb_put (nskb, pkt_len);
@@ -649,10 +649,10 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, err:for (i =0 ; i < pool_index; i++) { -RX_STAT_ADD (skb_completed_bytes, skb_pool[i]->len); +RX_STAT_ADD (hif_dev, skb_completed_bytes, skb_pool[i]->len);ath9k_htc_rx_msg (hif_dev->htc_handle, skb_pool[i], skb_pool[i]->len,USB_WLAN_RX_PIPE ); -RX_STAT_INC (skb_completed); +RX_STAT_INC (hif_dev, skb_completed); } }
drivers/net/wireless/ath/ath9k/htc.h +18 -14
@@ -325,14 +325,18 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb) }#ifdef CONFIG_ATH9K_HTC_DEBUGFS -#define __STAT_SAFE (expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) -#define TX_STAT_INC (c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) -#define TX_STAT_ADD (c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) -#define RX_STAT_INC (c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) -#define RX_STAT_ADD (c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) -#define CAB_STAT_INC priv->debug.tx_stats.cab_queued++ - -#define TX_QSTAT_INC (q) (priv->debug.tx_stats.queue_stats[q]++) +#define __STAT_SAFE (hif_dev, expr) ((hif_dev)->htc_handle->drv_priv ? (expr) : 0) +#define CAB_STAT_INC (priv) ((priv)->debug.tx_stats.cab_queued++) +#define TX_QSTAT_INC (priv, q) ((priv)->debug.tx_stats.queue_stats[q]++) + +#define TX_STAT_INC (hif_dev, c) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c++) +#define TX_STAT_ADD (hif_dev, c, a) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c += a) +#define RX_STAT_INC (hif_dev, c) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c++) +#define RX_STAT_ADD (hif_dev, c, a) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c += a)void ath9k_htc_err_stat_rx (struct ath9k_htc_priv *priv,struct ath_rx_status *rs);
@@ -372,13 +376,13 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw, struct ethtool_stats *stats, u64 *data);#else -#define TX_STAT_INC (c) do { } while (0) -#define TX_STAT_ADD (c, a) do { } while (0) -#define RX_STAT_INC (c) do { } while (0) -#define RX_STAT_ADD (c, a) do { } while (0) -#define CAB_STAT_INC do { } while (0) +#define TX_STAT_INC (hif_dev, c) +#define TX_STAT_ADD (hif_dev, c, a) +#define RX_STAT_INC (hif_dev, c) +#define RX_STAT_ADD (hif_dev, c, a) -#define TX_QSTAT_INC (c) do { } while (0) +#define CAB_STAT_INC (priv) +#define TX_QSTAT_INC (priv, c)static inline void ath9k_htc_err_stat_rx (struct ath9k_htc_priv *priv,struct ath_rx_status *rs)
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +5 -5
@@ -106,20 +106,20 @@ static inline enum htc_endpoint_id get_htc_epid(struct ath9k_htc_priv *priv,switch (qnum) {case 0 : -TX_QSTAT_INC (IEEE80211_AC_VO ); +TX_QSTAT_INC (priv,IEEE80211_AC_VO ); epid = priv->data_vo_ep;break ;case 1 : -TX_QSTAT_INC (IEEE80211_AC_VI ); +TX_QSTAT_INC (priv,IEEE80211_AC_VI ); epid = priv->data_vi_ep;break ;case 2 : -TX_QSTAT_INC (IEEE80211_AC_BE ); +TX_QSTAT_INC (priv,IEEE80211_AC_BE ); epid = priv->data_be_ep;break ;case 3 :default : -TX_QSTAT_INC (IEEE80211_AC_BK ); +TX_QSTAT_INC (priv,IEEE80211_AC_BK ); epid = priv->data_bk_ep;break ; }
@@ -323,7 +323,7 @@ static void ath9k_htc_tx_data(struct ath9k_htc_priv *priv,memcpy (tx_fhdr, (u8 *) &tx_hdr,sizeof (tx_hdr));if (is_cab) { -CAB_STAT_INC ; +CAB_STAT_INC (priv); tx_ctl->epid = priv->cab_ep;return ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 43/252 wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 0af54343a76263a12dbae7fafb64eb47c4a6ad38 ]
Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and freed. Added a comment describing this issue.
The patch also makes remain_skb NULL after being processed so that it cannot be referenced after potential free. The initialization of hif_dev fields which are associated with remain_skb (rx_remain_len, rx_transfer_len and rx_pad_len) is moved after a new remain_skb is allocated.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 31 +++++++++++++++++------- 1 file changed, 22 insertions(+), 9 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +22 -9
@@ -561,11 +561,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,memcpy (ptr, skb->data, rx_remain_len); rx_pkt_len += rx_remain_len; - hif_dev->rx_remain_len =0 ;skb_put (remain_skb, rx_pkt_len); skb_pool[pool_index++] = remain_skb; - + hif_dev->remain_skb =NULL ; + hif_dev->rx_remain_len =0 ; }else { index = rx_remain_len; }
@@ -584,16 +584,21 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, pkt_len =get_unaligned_le16 (ptr + index); pkt_tag =get_unaligned_le16 (ptr + index +2 ); +/* It is supposed that if we have an invalid pkt_tag or +* pkt_len then the whole input SKB is considered invalid +* and dropped; the associated packets already in skb_pool +* are dropped, too. +*/ if (pkt_tag !=ATH_USB_RX_STREAM_MODE_TAG ) {RX_STAT_INC (hif_dev, skb_dropped); -return ; + goto invalid_pkt; }if (pkt_len >2 *MAX_RX_BUF_SIZE ) {dev_err (&hif_dev->udev->dev,"ath9k_htc: invalid pkt_len (%x)\n" , pkt_len);RX_STAT_INC (hif_dev, skb_dropped); -return ; + goto invalid_pkt; } pad_len =4 - (pkt_len &0x3 );
@@ -605,11 +610,6 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,if (index >MAX_RX_BUF_SIZE ) {spin_lock (&hif_dev->rx_lock); - hif_dev->rx_remain_len = index -MAX_RX_BUF_SIZE ; - hif_dev->rx_transfer_len = -MAX_RX_BUF_SIZE - chk_idx -4 ; - hif_dev->rx_pad_len = pad_len; - nskb =__dev_alloc_skb (pkt_len +32 ,GFP_ATOMIC );if (!nskb) { dev_err(&hif_dev->udev->dev,
@@ -617,6 +617,12 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,spin_unlock (&hif_dev->rx_lock); goto err; } + + hif_dev->rx_remain_len = index -MAX_RX_BUF_SIZE ; + hif_dev->rx_transfer_len = +MAX_RX_BUF_SIZE - chk_idx -4 ; + hif_dev->rx_pad_len = pad_len; +skb_reserve (nskb,32 );RX_STAT_INC (hif_dev, skb_allocated);
@@ -654,6 +660,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, skb_pool[i]->len, USB_WLAN_RX_PIPE);RX_STAT_INC (hif_dev, skb_completed); } +return ; +invalid_pkt: +for (i =0 ; i < pool_index; i++) { +dev_kfree_skb_any (skb_pool[i]); +RX_STAT_INC (hif_dev, skb_dropped); + } +return ; }static void ath9k_hif_usb_rx_cb (struct urb *urb)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 44/252 wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
In reply to Greg Kroah-HartmanFrom: Minsuk Kang <[email protected]>
[ Upstream commit 8a2f35b9830692f7a616f2f627f943bc748af13a ]
Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9k_wmi_cmd(). The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that could no longer be valid when a timeout occurs. Set wmi->last_seq_id to 0 when a timeout occurred.
Found by a modified version of syzkaller.
BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx Write of size 4 Call Trace: memcpy ath9k_wmi_ctrl_rx ath9k_htc_rx_msg ath9k_hif_usb_reg_in_cb __usb_hcd_giveback_urb usb_hcd_giveback_urb dummy_timer call_timer_fn run_timer_softirq __do_softirq irq_exit_rcu sysvec_apic_timer_interrupt
--- drivers/net/wireless/ath/ath9k/wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath9k/wmi.c +1 -0
@@ -338,6 +338,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,if (!time_left) {ath_dbg (common,WMI ,"Timeout waiting for WMI command: %s\n" ,wmi_cmd_to_name (cmd_id)); + wmi->last_seq_id =0 ;mutex_unlock (&wmi->op_mutex);kfree_skb (skb);return -ETIMEDOUT ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 45/252 ACPI: battery: Fix missing NUL-termination with large strings
In reply to Greg Kroah-HartmanFrom: Armin Wolf <[email protected]>
[ Upstream commit f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc ]
When encountering a string bigger than the destination buffer (32 bytes), the string is not properly NUL-terminated, causing buffer overreads later.
This for example happens on the Inspiron 3505, where the battery model name is larger than 32 bytes, which leads to sysfs showing the model name together with the serial number string (which is NUL-terminated and thus prevents worse).
Fix this by using strscpy() which ensures that the result is always NUL-terminated.
--- drivers/acpi/battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/battery.c +1 -1
@@ -478,7 +478,7 @@ static int extract_package(struct acpi_battery *battery,u8 *ptr = (u8 *)battery + offsets[i].offset;if (element->type ==ACPI_TYPE_STRING || element->type ==ACPI_TYPE_BUFFER ) -strncpy (ptr, element->string.pointer,32 ); +strscpy (ptr, element->string.pointer,32 );else if (element->type ==ACPI_TYPE_INTEGER ) {strncpy (ptr, (u8 *)&element->integer.value,sizeof (u64));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 46/252 crypto: seqiv - Handle EBUSY correctly
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 32e62025e5e52fbe4812ef044759de7010b15dbc ]
As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request.
However, as the caller of seqiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.
--- crypto/seqiv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/seqiv.c +1 -1
@@ -30,7 +30,7 @@ static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err)struct aead_request *subreq =aead_request_ctx (req);struct crypto_aead *geniv; -if (err == -EINPROGRESS ) +if (err == -EINPROGRESS || err == -EBUSY )return ;if (err)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 47/252 powercap: fix possible name leak in powercap_register_zone()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 1b6599f741a4525ca761ecde46e5885ff1e6ba58 ]
In the error path after calling dev_set_name(), the device name is leaked. To fix this, calling dev_set_name() before device_register(), and call put_device() if it returns error.
All the resources is released in powercap_release(), so it can return from powercap_register_zone() directly.
--- drivers/powercap/powercap_sys.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/powercap/powercap_sys.c +9 -5
@@ -542,9 +542,6 @@ struct powercap_zone *powercap_register_zone( power_zone->name =kstrdup (name,GFP_KERNEL );if (!power_zone->name) goto err_name_alloc; -dev_set_name (&power_zone->dev,"%s:%x" , -dev_name (power_zone->dev.parent), - power_zone->id); power_zone->constraints =kcalloc (nr_constraints,sizeof (*power_zone->constraints),GFP_KERNEL );
@@ -567,9 +564,16 @@ struct powercap_zone *powercap_register_zone( power_zone->dev_attr_groups[0 ] = &power_zone->dev_zone_attr_group; power_zone->dev_attr_groups[1 ] =NULL ; power_zone->dev.groups = power_zone->dev_attr_groups; +dev_set_name (&power_zone->dev,"%s:%x" , +dev_name (power_zone->dev.parent), + power_zone->id); result =device_register (&power_zone->dev); -if (result) - goto err_dev_ret; +if (result) { +put_device (&power_zone->dev); +mutex_unlock (&control_type->lock); + +return ERR_PTR (result); + } control_type->nr_zones++;mutex_unlock (&control_type->lock);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 48/252 net/mlx5: Enhance debug print in page allocation failure
In reply to Greg Kroah-HartmanFrom: Jack Morgenstein <[email protected]>
[ Upstream commit 7eef93003e5d20e1a6a6e59e12d914b5431cbda2 ]
Provide more details to aid debugging.
--- drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +2 -1
@@ -164,7 +164,8 @@ static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr) fp = list_entry(dev->priv.free_list.next, struct fw_page, list); n =find_first_bit (&fp->bitmask,8 *sizeof (fp->bitmask));if (n >=MLX5_NUM_4K_IN_PAGE ) { -mlx5_core_warn (dev,"alloc 4k bug\n" ); +mlx5_core_warn (dev,"alloc 4k bug: fw page = 0x%llx, n = %u, bitmask: %lu, max num of 4K pages: %d\n" , + fp->addr, n, fp->bitmask,MLX5_NUM_4K_IN_PAGE );return -ENOENT ; }clear_bit (n, &fp->bitmask);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 49/252 irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 071d068b89e95d1b078aa6bbcb9d0961b77d6aa1 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/irqchip/irq-alpine-msi.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-alpine-msi.c +1 -0
@@ -199,6 +199,7 @@ static int alpine_msix_init_domains(struct alpine_msix_data *priv, } gic_domain =irq_find_host (gic_node); +of_node_put (gic_node);if (!gic_domain) {pr_err ("Failed to find the GIC domain\n" );return -ENXIO ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 50/252 irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9419e700021a393f67be36abd0c4f3acc6139041 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/irqchip/irq-mvebu-gicp.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-mvebu-gicp.c +1 -0
@@ -223,6 +223,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev) } parent_domain =irq_find_host (irq_parent_dn); +of_node_put (irq_parent_dn);if (!parent_domain) {dev_err (&pdev->dev,"failed to find parent IRQ domain\n" );return -ENODEV ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 51/252 Bluetooth: L2CAP: Fix potential user-after-free
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit df5703348813235874d851934e957c3723d71644 ]
This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which makes it possible that the chan is disconnected in the meantime.
--- net/bluetooth/l2cap_core.c | 24 ------------------------ net/bluetooth/l2cap_sock.c | 8 ++++++++ 2 files changed, 8 insertions(+), 24 deletions(-)
net/bluetooth/l2cap_core.c +0 -24
@@ -2517,14 +2517,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)if (IS_ERR (skb))return PTR_ERR (skb); -/* Channel lock is released before requesting new skb and then -* reacquired thus we need to recheck channel state. -*/ -if (chan->state !=BT_CONNECTED ) { -kfree_skb (skb); -return -ENOTCONN ; - } -l2cap_do_send (chan, skb);return len; }
@@ -2568,14 +2560,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)if (IS_ERR (skb))return PTR_ERR (skb); -/* Channel lock is released before requesting new skb and then -* reacquired thus we need to recheck channel state. -*/ -if (chan->state !=BT_CONNECTED ) { -kfree_skb (skb); -return -ENOTCONN ; - } -l2cap_do_send (chan, skb); err = len;break ;
@@ -2596,14 +2580,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)*/ err =l2cap_segment_sdu (chan, &seg_queue, msg, len); -/* The channel could have been closed while segmenting, -* check that it is still connected. -*/ -if (chan->state !=BT_CONNECTED ) { -__skb_queue_purge (&seg_queue); - err = -ENOTCONN ; - } -if (err)break ;
net/bluetooth/l2cap_sock.c +8 -0
@@ -1414,6 +1414,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,if (!skb)return ERR_PTR (err); +/* Channel lock is released before requesting new skb and then +* reacquired thus we need to recheck channel state. +*/ +if (chan->state !=BT_CONNECTED ) { +kfree_skb (skb); +return ERR_PTR (-ENOTCONN ); + } + skb->priority = sk->sk_priority;bt_cb (skb)->l2cap.chan = chan;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 52/252 libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
[ Upstream commit 17bcd27a08a21397698edf143084d7c87ce17946 ]
The code assumes that everything that comes after nlmsgerr are nlattrs. When calculating their size, it does not account for the initial nlmsghdr. This may lead to accessing uninitialized memory.
--- tools/lib/bpf/nlattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/nlattr.c +1 -1
@@ -170,7 +170,7 @@ int nla_dump_errormsg(struct nlmsghdr *nlh) hlen +=nlmsg_len (&err->msg); attr = (struct nlattr *) ((void *) err + hlen); - alen = nlh->nlmsg_len - hlen; + alen = (void *)nlh + nlh->nlmsg_len - (void *)attr;if (nla_parse (tb,NLMSGERR_ATTR_MAX , attr, alen, extack_policy) !=0 ) { fprintf(stderr,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 53/252 rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 68762148d1b011d47bc2ceed7321739b5aea1e63 ]
rds_rm_zerocopy_callback() uses list_add_tail() with swapped arguments. This links the list head with the new entry, losing the references to the remaining part of the list.
--- net/rds/message.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/message.c +1 -1
@@ -118,7 +118,7 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs, ck = &info->zcookies;memset (ck,0 ,sizeof (*ck));WARN_ON (!rds_zcookie_add (info, cookie)); -list_add_tail (&q->zcookie_head, &info->rs_zcookie_next); +list_add_tail (&info->rs_zcookie_next, &q->zcookie_head);spin_unlock_irqrestore (&q->lock, flags);/* caller invokes rds_wake_sk_sleep() */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 54/252 crypto: rsa-pkcs1pad - Use akcipher_request_complete
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 ]
Use the akcipher_request_complete helper instead of calling the completion function directly. In fact the previous code was buggy in that EINPROGRESS was never passed back to the original caller.
--- crypto/rsa-pkcs1pad.c | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-)
crypto/rsa-pkcs1pad.c +15 -19
@@ -216,16 +216,14 @@ static void pkcs1pad_encrypt_sign_complete_cb( struct crypto_async_request *child_async_req, int err) {struct akcipher_request *req = child_async_req->data; -struct crypto_async_request async_req;if (err == -EINPROGRESS ) -return ; + goto out; + + err =pkcs1pad_encrypt_sign_complete (req, err); - async_req.data = req->base.data; - async_req.tfm =crypto_akcipher_tfm (crypto_akcipher_reqtfm (req)); - async_req.flags = child_async_req->flags; - req->base.complete (&async_req, -pkcs1pad_encrypt_sign_complete (req, err)); +out: +akcipher_request_complete (req, err); }static int pkcs1pad_encrypt (struct akcipher_request *req)
@@ -334,15 +332,14 @@ static void pkcs1pad_decrypt_complete_cb( struct crypto_async_request *child_async_req, int err) {struct akcipher_request *req = child_async_req->data; -struct crypto_async_request async_req;if (err == -EINPROGRESS ) -return ; + goto out; + + err =pkcs1pad_decrypt_complete (req, err); - async_req.data = req->base.data; - async_req.tfm =crypto_akcipher_tfm (crypto_akcipher_reqtfm (req)); - async_req.flags = child_async_req->flags; - req->base.complete (&async_req,pkcs1pad_decrypt_complete (req, err)); +out: +akcipher_request_complete (req, err); }static int pkcs1pad_decrypt (struct akcipher_request *req)
@@ -500,15 +497,14 @@ static void pkcs1pad_verify_complete_cb( struct crypto_async_request *child_async_req, int err) {struct akcipher_request *req = child_async_req->data; -struct crypto_async_request async_req;if (err == -EINPROGRESS ) -return ; + goto out; - async_req.data = req->base.data; - async_req.tfm =crypto_akcipher_tfm (crypto_akcipher_reqtfm (req)); - async_req.flags = child_async_req->flags; - req->base.complete (&async_req,pkcs1pad_verify_complete (req, err)); + err =pkcs1pad_verify_complete (req, err); + +out: +akcipher_request_complete (req, err); }/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 55/252 m68k: /proc/hardware should depend on PROC_FS
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 1e5b5df65af99013b4d31607ddb3ca5731dbe44d ]
When CONFIG_PROC_FS is not set, there is a build error for an unused function. Make PROC_HARDWARE depend on PROC_FS to prevent this error.
In file included from ../arch/m68k/kernel/setup.c:3:../arch/m68k/kernel/setup_mm.c:477:12: error: 'hardware_proc_show' defined but not used [-Werror=unused-function]
477 | static int hardware_proc_show(struct seq_file *m, void *v)
| ^~~~~~~~~~~~~~~~~~
--- arch/m68k/Kconfig.devices | 1 + 1 file changed, 1 insertion(+)
arch/m68k/Kconfig.devices +1 -0
@@ -19,6 +19,7 @@ config HEARTBEAT # We have a dedicated heartbeat LED. :-) config PROC_HARDWARE bool "/proc/hardware support" + depends on PROC_FS help Say Y here to support the /proc/hardware file, which gives you access to information about the machine you're running on,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 56/252 RISC-V: time: initialize hrtimer based broadcast clock event device
In reply to Greg Kroah-HartmanFrom: Conor Dooley <[email protected]>
[ Upstream commit 8b3b8fbb4896984b5564789a42240e4b3caddb61 ]
Similarly to commit 022eb8ae8b5e ("ARM: 8938/1: kernel: initialize broadcast hrtimer based clock event device"), RISC-V needs to initiate hrtimer based broadcast clock event device before C3STOP can be used. Otherwise, the introduction of C3STOP for the RISC-V arch timer in commit 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend") leaves us without any broadcast timer registered. This prevents the kernel from entering oneshot mode, which breaks timer behaviour, for example clock_nanosleep().
A test app that sleeps each cpu for 6, 5, 4, 3 ms respectively, HZ=250 & C3STOP enabled, the sleep times are rounded up to the next jiffy:
== CPU: 1 == == CPU: 2 == == CPU: 3 == == CPU: 4 == Mean: 7.974992 Mean: 7.976534 Mean: 7.962591 Mean: 3.952179
Std Dev: 0.154374 Std Dev: 0.156082 Std Dev: 0.171018 Std Dev: 0.076193
Hi: 9.472000 Hi: 10.495000 Hi: 8.864000 Hi: 4.736000
Lo: 6.087000 Lo: 6.380000 Lo: 4.872000 Lo: 3.403000
Samples: 521 Samples: 521 Samples: 521 Samples: 521
--- arch/riscv/kernel/time.c | 3 +++ 1 file changed, 3 insertions(+)
arch/riscv/kernel/time.c +3 -0
@@ -13,6 +13,7 @@*/ #include <linux/of_clk.h> +#include <linux/clockchips.h> #include <linux/clocksource.h> #include <linux/delay.h> #include <asm/sbi.h>
@@ -33,4 +34,6 @@ void __init time_init(void)of_clk_init (NULL );timer_probe (); + +tick_setup_hrtimer_broadcast (); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 57/252 wifi: iwl3945: Add missing check for create_singlethread_workqueue
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb ]
Add the check for the return value of the create_singlethread_workqueue in order to avoid NULL pointer dereference.
--- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/iwlegacy/3945-mac.c +12 -4
@@ -3400,10 +3400,12 @@ static DEVICE_ATTR(dump_errors, 0200, NULL, il3945_dump_error_log);* *****************************************************************************/ -static void +static int il3945_setup_deferred_work (struct il_priv *il) { il->workqueue =create_singlethread_workqueue (DRV_NAME ); +if (!il->workqueue) +return -ENOMEM ;init_waitqueue_head (&il->wait_command_queue);
@@ -3422,6 +3424,8 @@ il3945_setup_deferred_work(struct il_priv *il)tasklet_init (&il->irq_tasklet, il3945_irq_tasklet, (unsigned long )il); + +return 0 ; } static void
@@ -3743,7 +3747,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) }il_set_rxon_channel (il, &il->bands[NL80211_BAND_2GHZ ].channels[5 ]); -il3945_setup_deferred_work (il); + err =il3945_setup_deferred_work (il); +if (err) + goto out_remove_sysfs; +il3945_setup_handlers (il);il_power_initialize (il);
@@ -3755,7 +3762,7 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err =il3945_setup_mac (il);if (err) - goto out_remove_sysfs; + goto out_destroy_workqueue; err =il_dbgfs_register (il,DRV_NAME );if (err)
@@ -3767,9 +3774,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)return 0 ; -out_remove_sysfs: +out_destroy_workqueue:destroy_workqueue (il->workqueue); il->workqueue =NULL ; +out_remove_sysfs:sysfs_remove_group (&pdev->dev.kobj, &il3945_attribute_group); out_release_irq:free_irq (il->pci_dev->irq, il);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 58/252 wifi: iwl4965: Add missing check for create_singlethread_workqueue()
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 ]
Add the check for the return value of the create_singlethread_workqueue() in order to avoid NULL pointer dereference.
--- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlegacy/4965-mac.c +10 -2
@@ -6236,10 +6236,12 @@ il4965_bg_txpower_work(struct work_struct *work)mutex_unlock (&il->mutex); } -static void +static int il4965_setup_deferred_work (struct il_priv *il) { il->workqueue =create_singlethread_workqueue (DRV_NAME ); +if (!il->workqueue) +return -ENOMEM ;init_waitqueue_head (&il->wait_command_queue);
@@ -6260,6 +6262,8 @@ il4965_setup_deferred_work(struct il_priv *il)tasklet_init (&il->irq_tasklet, il4965_irq_tasklet, (unsigned long )il); + +return 0 ; } static void
@@ -6649,7 +6653,10 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) goto out_disable_msi; } -il4965_setup_deferred_work (il); + err =il4965_setup_deferred_work (il); +if (err) + goto out_free_irq; +il4965_setup_handlers (il);/*********************************************
@@ -6687,6 +6694,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) out_destroy_workqueue:destroy_workqueue (il->workqueue); il->workqueue =NULL ; +out_free_irq:free_irq (il->pci_dev->irq, il); out_disable_msi:pci_disable_msi (il->pci_dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 59/252 wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 ]
This code re-uses "i" to be the iterator for both the inside and outside loops. It means the outside loop will exit earlier than intended.
--- drivers/net/wireless/marvell/mwifiex/11n.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/mwifiex/11n.c +3 -3
@@ -901,7 +901,7 @@ mwifiex_send_delba_txbastream_tbl(struct mwifiex_private *priv, u8 tid)*/ void mwifiex_update_ampdu_txwinsize (struct mwifiex_adapter *adapter) { -u8 i; +u8 i, j;u32 tx_win_size;struct mwifiex_private *priv;
@@ -932,8 +932,8 @@ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter)if (tx_win_size != priv->add_ba_param.tx_win_size) {if (!priv->media_connected)continue ; -for (i =0 ; i <MAX_NUM_TID ; i++) -mwifiex_send_delba_txbastream_tbl (priv, i); +for (j =0 ; j <MAX_NUM_TID ; j++) +mwifiex_send_delba_txbastream_tbl (priv, j); } } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 60/252 crypto: crypto4xx - Call dma_unmap_page when done
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit bcdda4301bdc4955d45f7e1ffefb6207967b067e ]
In crypto4xx_cipher_done, we should be unmapping the dst page, not mapping it.
This was flagged by a sparse warning about the unused addr variable. While we're at it, also fix a sparse warning regarding the unused ctx variable in crypto4xx_ahash_done (by actually using it).
--- drivers/crypto/amcc/crypto4xx_core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/crypto/amcc/crypto4xx_core.c +4 -6
@@ -529,7 +529,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, {struct skcipher_request *req;struct scatterlist *dst; -dma_addr_t addr; req =skcipher_request_cast (pd_uinfo->async_req);
@@ -538,8 +537,8 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, req->cryptlen, req->dst); }else { dst = pd_uinfo->dest_va; - addr =dma_map_page (dev->core_dev->device,sg_page (dst), - dst->offset, dst->length,DMA_FROM_DEVICE ); +dma_unmap_page (dev->core_dev->device, pd->dest, dst->length, +DMA_FROM_DEVICE ); }if (pd_uinfo->sa_va->sa_command_0.bf.save_iv ==SA_SAVE_IV ) {
@@ -564,10 +563,9 @@ static void crypto4xx_ahash_done(struct crypto4xx_device *dev,struct ahash_request *ahash_req; ahash_req =ahash_request_cast (pd_uinfo->async_req); - ctx =crypto_tfm_ctx (ahash_req->base.tfm); + ctx =crypto_ahash_ctx (crypto_ahash_reqtfm (ahash_req)); -crypto4xx_copy_digest_to_dst (ahash_req->result, pd_uinfo, -crypto_tfm_ctx (ahash_req->base.tfm)); +crypto4xx_copy_digest_to_dst (ahash_req->result, pd_uinfo, ctx);crypto4xx_ret_sg_desc (dev, pd_uinfo);if (pd_uinfo->state &PD_ENTRY_BUSY )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 61/252 wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
In reply to Greg Kroah-HartmanFrom: Shayne Chen <[email protected]>
[ Upstream commit 59336e07b287d91dc4ec265e07724e8f7e3d0209 ]
The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to u16 after being assigned to rate variable, which causes information loss in STA_STATS_FIELD_TYPE and later bitfields.
--- net/mac80211/sta_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/sta_info.c +1 -1
@@ -2047,7 +2047,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,static int sta_set_rate_info_rx (struct sta_info *sta,struct rate_info *rinfo) { -u16 rate =READ_ONCE (sta_get_last_rx_stats (sta)->last_rate); +u32 rate =READ_ONCE (sta_get_last_rx_stats (sta)->last_rate);if (rate ==STA_STATS_RATE_INVALID )return -EINVAL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 62/252 can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
In reply to Greg Kroah-HartmanFrom: Frank Jungclaus <[email protected]>
[ Upstream commit 118469f88180438ef43dee93d71f77c00e7b425d ]
Move the supply for cf->data[3] (bit stream position of CAN error), in case of a bus- or protocol-error, outside of the "switch (ecc & SJA1000_ECC_MASK){}"-statement, because this bit stream position is independent of the error type.
--- drivers/net/can/usb/esd_usb2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/can/usb/esd_usb2.c +3 -1
@@ -290,7 +290,6 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv, cf->data[2 ] |=CAN_ERR_PROT_STUFF ;break ;default : - cf->data[3 ] = ecc &SJA1000_ECC_SEG ;break ; }
@@ -298,6 +297,9 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,if (!(ecc &SJA1000_ECC_DIR )) cf->data[2 ] |=CAN_ERR_PROT_TX ; +/* Bit stream position in CAN frame as the error was detected */ + cf->data[3 ] = ecc &SJA1000_ECC_SEG ; +if (priv->can.state ==CAN_STATE_ERROR_WARNING || priv->can.state ==CAN_STATE_ERROR_PASSIVE ) { cf->data[1] = (txerr > rxerr) ?
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 63/252 irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 94debe03e8afa1267f95a9001786a6aa506b9ff3 ]
When support for the level triggered interrupt controller flavor was added with c0ca7262088e, we forgot to update the flags to be set to contain IRQ_LEVEL. While the flow handler is correct, the output from /proc/interrupts does not show such interrupts as being level triggered when they are, correct that.
--- drivers/irqchip/irq-brcmstb-l2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/irqchip/irq-brcmstb-l2.c +5 -1
@@ -169,6 +169,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np, *init_params) {unsigned int clr =IRQ_NOREQUEST |IRQ_NOPROBE |IRQ_NOAUTOEN ; +unsigned int set =0 ;struct brcmstb_l2_intc_data *data;struct irq_chip_type *ct;int ret;
@@ -216,9 +217,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,if (IS_ENABLED (CONFIG_MIPS ) &&IS_ENABLED (CONFIG_CPU_BIG_ENDIAN )) flags |=IRQ_GC_BE_IO ; +if (init_params->handler == handle_level_irq) + set |=IRQ_LEVEL ; +/* Allocate a single Generic IRQ chip for this node */ ret =irq_alloc_domain_generic_chips (data->domain,32 ,1 , - np->full_name, init_params->handler, clr,0 , flags); + np->full_name, init_params->handler, clr, set, flags);if (ret) {pr_err ("failed to allocate generic irq chip\n" ); goto out_free_domain;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 64/252 irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 13a157b38ca5b4f9eed81442b8821db293755961 ]
When support for the interrupt controller was added with a5042de2688d, we forgot to update the flags to be set to contain IRQ_LEVEL. While the flow handler is correct, the output from /proc/interrupts does not show such interrupts as being level triggered when they are, correct that.
--- drivers/irqchip/irq-bcm7120-l2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/irqchip/irq-bcm7120-l2.c +2 -1
@@ -271,7 +271,8 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn, flags |=IRQ_GC_BE_IO ; ret =irq_alloc_domain_generic_chips (data->domain,IRQS_PER_WORD ,1 , - dn->full_name, handle_level_irq, clr,0 , flags); + dn->full_name, handle_level_irq, clr, +IRQ_LEVEL , flags);if (ret) {pr_err ("failed to allocate generic irq chip\n" ); goto out_free_domain;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 65/252 selftest: fib_tests: Always cleanup before exit
In reply to Greg Kroah-HartmanFrom: Roxana Nicolescu <[email protected]>
[ Upstream commit b60417a9f2b890a8094477b2204d4f73c535725e ]
Usage of set -e before executing a command causes immediate exit on failure, without cleanup up the resources allocated at setup. This can affect the next tests that use the same resources, leading to a chain of failures.
A simple fix is to always call cleanup function when the script exists. This approach is already used by other existing tests.
--- tools/testing/selftests/net/fib_tests.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/fib_tests.sh +2 -0
@@ -1379,6 +1379,8 @@ EOF ################################################################################ # main +trap cleanup EXIT + while getopts :t:pPhv o do case $o in
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 66/252 drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 7783cc67862f9166c901bfa0f80b717aa8d354dd ]
Freescale/NXP i.MX LCDIF and eLCDIF LCD controllers are only present on Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXS || ARCH_MXC, to prevent asking the user about this driver when configuring a kernel without Freescale/NXP i.MX support.
--- drivers/gpu/drm/mxsfb/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/mxsfb/Kconfig +1 -0
@@ -7,6 +7,7 @@ config DRM_MXSFB tristate "i.MX23/i.MX28/i.MX6SX MXSFB LCD controller" depends on DRM && OF depends on COMMON_CLK + depends on ARCH_MXS || ARCH_MXC || COMPILE_TEST select DRM_MXS select DRM_KMS_HELPER select DRM_KMS_CMA_HELPER
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 67/252 drm/bridge: megachips: Fix error handling in i2c_register_driver()
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit 4ecff954c370b82bce45bdca2846c5c5563e8a8a ]
A problem about insmod megachips-stdpxxxx-ge-b850v3-fw.ko failed is triggered with the following log given:
[ 4497.981497] Error: Driver 'stdp4028-ge-b850v3-fw' is already registered, aborting...
insmod: ERROR: could not insert module megachips-stdpxxxx-ge-b850v3-fw.ko: Device or resource busy
The reason is that stdpxxxx_ge_b850v3_init() returns i2c_add_driver() directly without checking its return value, if i2c_add_driver() failed, it returns without calling i2c_del_driver() on the previous i2c driver, resulting the megachips-stdpxxxx-ge-b850v3-fw can never be installed later.
A simple call graph is shown as below:
stdpxxxx_ge_b850v3_init()
i2c_add_driver(&stdp4028_ge_b850v3_fw_driver)
i2c_add_driver(&stdp2690_ge_b850v3_fw_driver)
i2c_register_driver()
driver_register()
bus_add_driver()
priv = kzalloc(...) # OOM happened
# return without delete stdp4028_ge_b850v3_fw_driver
Fix by calling i2c_del_driver() on stdp4028_ge_b850v3_fw_driver when i2c_add_driver() returns error.
--- drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +5 -1
@@ -437,7 +437,11 @@ static int __init stdpxxxx_ge_b850v3_init(void)if (ret)return ret; -return i2c_add_driver (&stdp2690_ge_b850v3_fw_driver); + ret =i2c_add_driver (&stdp2690_ge_b850v3_fw_driver); +if (ret) +i2c_del_driver (&stdp4028_ge_b850v3_fw_driver); + +return ret; }module_init (stdpxxxx_ge_b850v3_init);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 68/252 drm: Clarify definition of the DRM_BUS_FLAG_(PIXDATA|SYNC)_* macros
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
[ Upstream commit a792fa0e21876c9cbae7cc170083016299153051 ]
The DRM_BUS_FLAG_PIXDATA_POSEDGE and DRM_BUS_FLAG_PIXDATA_NEGEDGE macros and their DRM_BUS_FLAG_SYNC_* counterparts define on which pixel clock edge data and sync signals are driven. They are however used in some drivers to define on which pixel clock edge data and sync signals are sampled, which should usually (but not always) be the opposite edge of the driving edge. This creates confusion.
Create four new macros for both PIXDATA and SYNC that explicitly state the driving and sampling edge in their name to remove the confusion. The driving macros are defined as the opposite of the sampling macros to made code simpler based on the assumption that the driving and sampling edges are opposite.
Stable-dep-of: 0870d86eac8a ("drm/vc4: dpi: Fix format mapping for RGB565")
--- include/drm/drm_connector.h | 36 ++++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-)
include/drm/drm_connector.h +32 -4
@@ -329,19 +329,47 @@ struct drm_display_info {#define DRM_BUS_FLAG_DE_LOW (1<<0)#define DRM_BUS_FLAG_DE_HIGH (1<<1) -/* drive data on pos. edge */ + +/* +* Don't use those two flags directly, use the DRM_BUS_FLAG_PIXDATA_DRIVE_* +* and DRM_BUS_FLAG_PIXDATA_SAMPLE_* variants to qualify the flags explicitly. +* The DRM_BUS_FLAG_PIXDATA_SAMPLE_* flags are defined as the opposite of the +* DRM_BUS_FLAG_PIXDATA_DRIVE_* flags to make code simpler, as signals are +* usually to be sampled on the opposite edge of the driving edge. +*/ #define DRM_BUS_FLAG_PIXDATA_POSEDGE (1<<2) -/* drive data on neg. edge */ #define DRM_BUS_FLAG_PIXDATA_NEGEDGE (1<<3) + +/* Drive data on rising edge */ +#define DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE DRM_BUS_FLAG_PIXDATA_POSEDGE +/* Drive data on falling edge */ +#define DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE DRM_BUS_FLAG_PIXDATA_NEGEDGE +/* Sample data on rising edge */ +#define DRM_BUS_FLAG_PIXDATA_SAMPLE_POSEDGE DRM_BUS_FLAG_PIXDATA_NEGEDGE +/* Sample data on falling edge */ +#define DRM_BUS_FLAG_PIXDATA_SAMPLE_NEGEDGE DRM_BUS_FLAG_PIXDATA_POSEDGE +/* data is transmitted MSB to LSB on the bus */ #define DRM_BUS_FLAG_DATA_MSB_TO_LSB (1<<4)/* data is transmitted LSB to MSB on the bus */ #define DRM_BUS_FLAG_DATA_LSB_TO_MSB (1<<5) -/* drive sync on pos. edge */ + +/* +* Similarly to the DRM_BUS_FLAG_PIXDATA_* flags, don't use these two flags +* directly, use one of the DRM_BUS_FLAG_SYNC_(DRIVE|SAMPLE)_* instead. +*/ #define DRM_BUS_FLAG_SYNC_POSEDGE (1<<6) -/* drive sync on neg. edge */ #define DRM_BUS_FLAG_SYNC_NEGEDGE (1<<7) +/* Drive sync on rising edge */ +#define DRM_BUS_FLAG_SYNC_DRIVE_POSEDGE DRM_BUS_FLAG_SYNC_POSEDGE +/* Drive sync on falling edge */ +#define DRM_BUS_FLAG_SYNC_DRIVE_NEGEDGE DRM_BUS_FLAG_SYNC_NEGEDGE +/* Sample sync on rising edge */ +#define DRM_BUS_FLAG_SYNC_SAMPLE_POSEDGE DRM_BUS_FLAG_SYNC_NEGEDGE +/* Sample sync on falling edge */ +#define DRM_BUS_FLAG_SYNC_SAMPLE_NEGEDGE DRM_BUS_FLAG_SYNC_POSEDGE +/** * @bus_flags: Additional information (like pixel signal polarity) for * the pixel data on the bus, using DRM_BUS_FLAGS\_ defines.
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 69/252 drm/vc4: dpi: Add option for inverting pixel clock and output enable
In reply to Greg Kroah-HartmanFrom: Dave Stevenson <[email protected]>
[ Upstream commit 3c2707632146b22e97b0fbf6778bab8add2eaa1d ]
DRM provides flags for inverting pixel clock and output enable signals, but these were not mapped to the relevant registers.
Add those mappings.
Stable-dep-of: 0870d86eac8a ("drm/vc4: dpi: Fix format mapping for RGB565")
--- drivers/gpu/drm/vc4/vc4_dpi.c | 66 ++++++++++++++++++++--------------- 1 file changed, 38 insertions(+), 28 deletions(-)
drivers/gpu/drm/vc4/vc4_dpi.c +38 -28
@@ -186,35 +186,45 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder) }drm_connector_list_iter_end (&conn_iter); -if (connector && connector->display_info.num_bus_formats) { -u32 bus_format = connector->display_info.bus_formats[0 ]; - -switch (bus_format) { -case MEDIA_BUS_FMT_RGB888_1X24 : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_24BIT_888_RGB , -DPI_FORMAT ); -break ; -case MEDIA_BUS_FMT_BGR888_1X24 : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_24BIT_888_RGB , -DPI_FORMAT ); - dpi_c |=VC4_SET_FIELD (DPI_ORDER_BGR ,DPI_ORDER ); -break ; -case MEDIA_BUS_FMT_RGB666_1X24_CPADHI : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_18BIT_666_RGB_2 , -DPI_FORMAT ); -break ; -case MEDIA_BUS_FMT_RGB666_1X18 : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_18BIT_666_RGB_1 , -DPI_FORMAT ); -break ; -case MEDIA_BUS_FMT_RGB565_1X16 : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_16BIT_565_RGB_3 , -DPI_FORMAT ); -break ; -default : -DRM_ERROR ("Unknown media bus format %d\n" , bus_format); -break ; +if (connector) { +if (connector->display_info.num_bus_formats) { +u32 bus_format = connector->display_info.bus_formats[0 ]; + +switch (bus_format) { +case MEDIA_BUS_FMT_RGB888_1X24 : + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_24BIT_888_RGB , +DPI_FORMAT ); +break ; +case MEDIA_BUS_FMT_BGR888_1X24 : + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_24BIT_888_RGB , +DPI_FORMAT ); + dpi_c |=VC4_SET_FIELD (DPI_ORDER_BGR , +DPI_ORDER ); +break ; +case MEDIA_BUS_FMT_RGB666_1X24_CPADHI : + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_18BIT_666_RGB_2 , +DPI_FORMAT ); +break ; +case MEDIA_BUS_FMT_RGB666_1X18 : + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_18BIT_666_RGB_1 , +DPI_FORMAT ); +break ; +case MEDIA_BUS_FMT_RGB565_1X16 : + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_16BIT_565_RGB_3 , +DPI_FORMAT ); +break ; +default : +DRM_ERROR ("Unknown media bus format %d\n" , + bus_format); +break ; + } } + +if (connector->display_info.bus_flags &DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE ) + dpi_c |=DPI_PIXEL_CLK_INVERT ; + +if (connector->display_info.bus_flags &DRM_BUS_FLAG_DE_LOW ) + dpi_c |=DPI_OUTPUT_ENABLE_INVERT ; }else {/* Default to 24bit if no connector found. */ dpi_c |=VC4_SET_FIELD (DPI_FORMAT_24BIT_888_RGB ,DPI_FORMAT );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 70/252 drm/vc4: dpi: Fix format mapping for RGB565
In reply to Greg Kroah-HartmanFrom: Dave Stevenson <[email protected]>
[ Upstream commit 0870d86eac8a9abd89a0be1b719d5dc5bac936f0 ]
The mapping is incorrect for RGB565_1X16 as it should be DPI_FORMAT_18BIT_666_RGB_1 instead of DPI_FORMAT_18BIT_666_RGB_3.
--- drivers/gpu/drm/vc4/vc4_dpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_dpi.c +1 -1
@@ -210,7 +210,7 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder) DPI_FORMAT);break ;case MEDIA_BUS_FMT_RGB565_1X16 : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_16BIT_565_RGB_3 , + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_16BIT_565_RGB_1 ,DPI_FORMAT );break ;default :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 71/252 gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 9afdf98cfdfa2ba8ec068cf08c5fcdc1ed8daf3f ]
In ipu_add_client_devices(), we need to call of_node_put() for reference returned by of_graph_get_port_by_id() in fail path.
--- drivers/gpu/ipu-v3/ipu-common.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/ipu-v3/ipu-common.c +1 -0
@@ -1238,6 +1238,7 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) pdev =platform_device_alloc (reg->name, id++);if (!pdev) { ret = -ENOMEM ; +of_node_put (of_node); goto err_register; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 72/252 drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit afe4cb96153a0d8003e4e4ebd91b5c543e10df84 ]
Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference in hdmi_hdcp.c and hdmi_hpd.c.
Patchwork: https://patchwork.freedesktop.org/patch/517211/
--- drivers/gpu/drm/msm/hdmi/hdmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/msm/hdmi/hdmi.c +4 -0
@@ -254,6 +254,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)pm_runtime_enable (&pdev->dev); hdmi->workq =alloc_ordered_workqueue ("msm_hdmi" ,0 ); +if (!hdmi->workq) { + ret = -ENOMEM ; + goto fail; + } hdmi->i2c =msm_hdmi_i2c_init (hdmi);if (IS_ERR (hdmi->i2c)) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 73/252 pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours
In reply to Greg Kroah-HartmanFrom: Lee Jones <[email protected]>
[ Upstream commit e1524ea84af7172acc20827f8dca3fc8f72b8f37 ]
Demote headers which are clearly not kerneldoc, provide titles for struct definition blocks, fix API slip (bitrot) misspellings and provide some missing entries.
Fixes the following W=1 kernel build warning(s):
drivers/pinctrl/pinctrl-rockchip.c:82: warning: cannot understand function prototype: 'struct rockchip_iomux ' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_IO_DEFAULT' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_IO_1V8_OR_3V0' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_IO_1V8_ONLY' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_IO_1V8_3V0_AUTO' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_IO_3V3_ONLY' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:97: warning: Enum value 'DRV_TYPE_MAX' not described in enum 'rockchip_pin_drv_type' drivers/pinctrl/pinctrl-rockchip.c:106: warning: Enum value 'PULL_TYPE_IO_DEFAULT' not described in enum 'rockchip_pin_pull_type' drivers/pinctrl/pinctrl-rockchip.c:106: warning: Enum value 'PULL_TYPE_IO_1V8_ONLY' not described in enum 'rockchip_pin_pull_type' drivers/pinctrl/pinctrl-rockchip.c:106: warning: Enum value 'PULL_TYPE_MAX' not described in enum 'rockchip_pin_pull_type' drivers/pinctrl/pinctrl-rockchip.c:109: warning: Cannot understand * @drv_type: drive strength variant using rockchip_perpin_drv_type on line 109 - I thought it was a doc line
drivers/pinctrl/pinctrl-rockchip.c:122: warning: Cannot understand * @reg_base: register base of the gpio bank
on line 109 - I thought it was a doc line
drivers/pinctrl/pinctrl-rockchip.c:325: warning: Function parameter or member 'route_location' not described in 'rockchip_mux_route_data' drivers/pinctrl/pinctrl-rockchip.c:328: warning: Cannot understand */
on line 109 - I thought it was a doc line
drivers/pinctrl/pinctrl-rockchip.c:375: warning: Function parameter or member 'data' not described in 'rockchip_pin_group' drivers/pinctrl/pinctrl-rockchip.c:387: warning: Function parameter or member 'ngroups' not described in 'rockchip_pmx_func'
Stable-dep-of: c818ae563bf9 ("pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups")
--- drivers/pinctrl/pinctrl-rockchip.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
drivers/pinctrl/pinctrl-rockchip.c +12 -10
@@ -70,7 +70,7 @@ enum rockchip_pinctrl_type { RK3399, }; -/** +/* * Encode variants of iomux registers into a type variable */ #define IOMUX_GPIO_ONLY BIT(0)
@@ -80,6 +80,7 @@ enum rockchip_pinctrl_type {#define IOMUX_WIDTH_3BIT BIT(4)/** +* struct rockchip_iomux * @type: iomux variant using IOMUX_* constants * @offset: if initialized to -1 it will be autocalculated, by specifying * an initial offset value the relevant source offset can be reset
@@ -90,7 +91,7 @@ struct rockchip_iomux {int offset; }; -/** +/* * enum type index corresponding to rockchip_perpin_drv_list arrays index. */ enum rockchip_pin_drv_type {
@@ -102,7 +103,7 @@ enum rockchip_pin_drv_type {DRV_TYPE_MAX }; -/** +/* * enum type index corresponding to rockchip_pull_list arrays index. */ enum rockchip_pin_pull_type {
@@ -112,6 +113,7 @@ enum rockchip_pin_pull_type { };/** +* struct rockchip_drv * @drv_type: drive strength variant using rockchip_perpin_drv_type * @offset: if initialized to -1 it will be autocalculated, by specifying * an initial offset value the relevant source offset can be reset
@@ -125,8 +127,9 @@ struct rockchip_drv { };/** +* struct rockchip_pin_bank * @reg_base: register base of the gpio bank -* @reg_pull: optional separate register for additional pull settings +* @regmap_pull: optional separate register for additional pull settings * @clk: clock of the gpio bank * @irq: interrupt of the gpio bank * @saved_masks: Saved content of GPIO_INTEN at suspend time.
@@ -144,6 +147,8 @@ struct rockchip_drv {* @gpio_chip: gpiolib chip * @grange: gpio range * @slock: spinlock for the gpio bank +* @toggle_edge_mode: bit mask to toggle (falling/rising) edge mode +* @recalced_mask: bit mask to indicate a need to recalulate the mask * @route_mask: bits describing the routing pins of per bank */ struct rockchip_pin_bank {
@@ -312,6 +317,7 @@ struct rockchip_mux_recalced_data {* @bank_num: bank number. * @pin: index at register or used to calc index. * @func: the min pin. +* @route_location: the mux route location (same, pmu, grf). * @route_offset: the max pin. * @route_val: the register offset. */
@@ -323,8 +329,6 @@ struct rockchip_mux_route_data {u32 route_val; }; -/** -*/ struct rockchip_pin_ctrl {struct rockchip_pin_bank *pin_banks;u32 nr_banks;
@@ -362,9 +366,7 @@ struct rockchip_pin_config {* @name: name of the pin group, used to lookup the group. * @pins: the pins included in this group. * @npins: number of pins included in this group. -* @func: the mux function number to be programmed when selected. -* @configs: the config values to be set for each pin -* @nconfigs: number of configs for each pin +* @data: local pin configuration */ struct rockchip_pin_group {const char *name;
@@ -377,7 +379,7 @@ struct rockchip_pin_group {* struct rockchip_pmx_func: represent a pin function. * @name: name of the pin function, used to lookup the function. * @groups: one or more names of pin groups that provide this function. -* @num_groups: number of groups included in @groups. +* @ngroups: number of groups included in @groups. */ struct rockchip_pmx_func {const char *name;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 74/252 pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit c818ae563bf99457f02e8170aabd6b174f629f65 ]
of_find_node_by_phandle() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
--- drivers/pinctrl/pinctrl-rockchip.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/pinctrl-rockchip.c +1 -0
@@ -2504,6 +2504,7 @@ static int rockchip_pinctrl_parse_groups(struct device_node *np, np_config =of_find_node_by_phandle (be32_to_cpup (phandle)); ret =pinconf_generic_parse_dt_config (np_config,NULL , &grp->data[j].configs, &grp->data[j].nconfigs); +of_node_put (np_config);if (ret)return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 75/252 ALSA: hda/ca0132: minor fix for allocation size
In reply to Greg Kroah-HartmanFrom: Alexey V. Vissarionov <[email protected]>
[ Upstream commit 3ee0fe7fa39b14d1cea455b7041f2df933bd97d2 ]
Although the "dma_chan" pointer occupies more or equal space compared to "*dma_chan", the allocation size should use the size of variable itself.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/pci/hda/patch_ca0132.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_ca0132.c +1 -1
@@ -1917,7 +1917,7 @@ static int dspio_set_uint_param_no_source(struct hda_codec *codec, int mod_id,static int dspio_alloc_dma_chan (struct hda_codec *codec,unsigned int *dma_chan) {int status =0 ; -unsigned int size =sizeof (dma_chan); +unsigned int size =sizeof (*dma_chan);codec_dbg (codec," dspio_alloc_dma_chan() -- begin\n" ); status = dspio_scp(codec, MASTERCONTROL, 0x20,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 76/252 drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
In reply to Greg Kroah-HartmanFrom: Daniel Mentz <[email protected]>
[ Upstream commit c9d27c6be518b4ef2966d9564654ef99292ea1b3 ]
The MIPI DCS specification demands that brightness values are sent in big endian byte order. It also states that one parameter (i.e. one byte) shall be sent/received for 8 bit wide values, and two parameters shall be used for values that are between 9 and 16 bits wide.
Add new functions to properly handle 16-bit brightness in big endian, since the two 8- and 16-bit cases are distinct from each other.
[richard: use separate functions instead of switch/case] [richard: split into 16-bit component]
--- drivers/gpu/drm/drm_mipi_dsi.c | 52 ++++++++++++++++++++++++++++++++++ include/drm/drm_mipi_dsi.h | 4 +++ 2 files changed, 56 insertions(+)
drivers/gpu/drm/drm_mipi_dsi.c +52 -0
@@ -1096,6 +1096,58 @@ int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi, }EXPORT_SYMBOL (mipi_dsi_dcs_get_display_brightness); +/** +* mipi_dsi_dcs_set_display_brightness_large() - sets the 16-bit brightness value +* of the display +* @dsi: DSI peripheral device +* @brightness: brightness value +* +* Return: 0 on success or a negative error code on failure. +*/ +int mipi_dsi_dcs_set_display_brightness_large (struct mipi_dsi_device *dsi, +u16 brightness) +{ +u8 payload[2 ] = { brightness >>8 , brightness &0xff }; +ssize_t err; + + err =mipi_dsi_dcs_write (dsi,MIPI_DCS_SET_DISPLAY_BRIGHTNESS , + payload,sizeof (payload)); +if (err <0 ) +return err; + +return 0 ; +} +EXPORT_SYMBOL (mipi_dsi_dcs_set_display_brightness_large); + +/** +* mipi_dsi_dcs_get_display_brightness_large() - gets the current 16-bit +* brightness value of the display +* @dsi: DSI peripheral device +* @brightness: brightness value +* +* Return: 0 on success or a negative error code on failure. +*/ +int mipi_dsi_dcs_get_display_brightness_large (struct mipi_dsi_device *dsi, +u16 *brightness) +{ +u8 brightness_be[2 ]; +ssize_t err; + + err =mipi_dsi_dcs_read (dsi,MIPI_DCS_GET_DISPLAY_BRIGHTNESS , + brightness_be,sizeof (brightness_be)); +if (err <=0 ) { +if (err ==0 ) + err = -ENODATA ; + +return err; + } + + *brightness = (brightness_be[0 ] <<8 ) | brightness_be[1 ]; + +return 0 ; +} +EXPORT_SYMBOL (mipi_dsi_dcs_get_display_brightness_large); +static int mipi_dsi_drv_probe (struct device *dev) {struct mipi_dsi_driver *drv =to_mipi_dsi_driver (dev->driver);
include/drm/drm_mipi_dsi.h +4 -0
@@ -274,6 +274,10 @@ int mipi_dsi_dcs_set_display_brightness(struct mipi_dsi_device *dsi, u16 brightness);int mipi_dsi_dcs_get_display_brightness (struct mipi_dsi_device *dsi,u16 *brightness); +int mipi_dsi_dcs_set_display_brightness_large (struct mipi_dsi_device *dsi, +u16 brightness); +int mipi_dsi_dcs_get_display_brightness_large (struct mipi_dsi_device *dsi, +u16 *brightness);/** * struct mipi_dsi_driver - DSI driver
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 77/252 drm/msm: use strscpy instead of strncpy
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit d7fd8634f48d76aa799ed57beb7d87dab91bde80 ]
Using strncpy can result in non-NULL-terminated destination string. Use strscpy instead. This fixes following warning:
drivers/gpu/drm/msm/msm_fence.c: In function ‘msm_fence_context_alloc’:drivers/gpu/drm/msm/msm_fence.c:25:9: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation]
25 | strncpy(fctx->name, name, sizeof(fctx->name));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Patchwork: https://patchwork.freedesktop.org/patch/518787/
--- drivers/gpu/drm/msm/msm_fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_fence.c +1 -1
@@ -31,7 +31,7 @@ msm_fence_context_alloc(struct drm_device *dev, const char *name)return ERR_PTR (-ENOMEM ); fctx->dev = dev; -strncpy (fctx->name, name,sizeof (fctx->name)); +strscpy (fctx->name, name,sizeof (fctx->name)); fctx->context =dma_fence_context_alloc (1 );init_waitqueue_head (&fctx->event);spin_lock_init (&fctx->spinlock);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 78/252 drm/msm/dpu: Add check for pstates
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 93340e10b9c5fc86730d149636e0aa8b47bb5a34 ]
As kzalloc may fail and return NULL pointer,
it should be better to check pstates
in order to avoid the NULL pointer dereference.
Patchwork: https://patchwork.freedesktop.org/patch/514160/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +2 -0
@@ -1477,6 +1477,8 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, } pstates =kzalloc (sizeof (*pstates) *DPU_STAGE_MAX *4 ,GFP_KERNEL ); +if (!pstates) +return -ENOMEM ; dpu_crtc =to_dpu_crtc (crtc); cstate =to_dpu_crtc_state (state);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 79/252 gpu: host1x: Dont skip assigning syncpoints to channels
In reply to Greg Kroah-HartmanFrom: Mikko Perttunen <[email protected]>
[ Upstream commit eb258cc1fd458e584082be987dbc6ec42668c05e ]
The code to write the syncpoint channel assignment register incorrectly skips the write if hypervisor registers are not available.
The register, however, is within the guest aperture so remove the check and assign syncpoints properly even on virtualized systems.
--- drivers/gpu/host1x/hw/syncpt_hw.c | 3 --- 1 file changed, 3 deletions(-)
drivers/gpu/host1x/hw/syncpt_hw.c +0 -3
@@ -113,9 +113,6 @@ static void syncpt_assign_to_channel(struct host1x_syncpt *sp,#if HOST1X_HW >=6 struct host1x *host = sp->host; -if (!host->hv_regs) -return ; -host1x_sync_writel (host,HOST1X_SYNC_SYNCPT_CH_APP_CH (ch ? ch->id :0xff ),HOST1X_SYNC_SYNCPT_CH_APP (sp->id));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 80/252 drm/mediatek: Drop unbalanced obj unref
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
[ Upstream commit 4deef811828e87e26a978d5d6433b261d4713849 ]
In the error path, mtk_drm_gem_object_mmap() is dropping an obj reference that it doesn't own.
--- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_drm_gem.c +0 -2
@@ -148,8 +148,6 @@ static int mtk_drm_gem_object_mmap(struct drm_gem_object *obj, ret =dma_mmap_attrs (priv->dma_dev, vma, mtk_gem->cookie, mtk_gem->dma_addr, obj->size, mtk_gem->dma_attrs); -if (ret) -drm_gem_vm_close (vma);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 81/252 drm/mediatek: Clean dangling pointer on bind error path
In reply to Greg Kroah-HartmanFrom: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit 36aa8c61af55675ed967900fbe5deb32d776f051 ]
mtk_drm_bind() can fail, in which case drm_dev_put() is called, destroying the drm_device object. However a pointer to it was still being held in the private object, and that pointer would be passed along to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that point, resulting in a panic. Clean the pointer when destroying the object in the error path to prevent this from happening.
--- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +1 -0
@@ -425,6 +425,7 @@ static int mtk_drm_bind(struct device *dev) err_deinit:mtk_drm_kms_deinit (drm); err_free: + private->drm =NULL ;drm_dev_put (drm);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 82/252 ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
[ Upstream commit ffe4c0f0bfaa571a676a0e946d4a6a0607f94294 ]
commit d3268a40d4b19f ("ASoC: soc-compress.c: fix NULL dereference") enables DPCM capture, but it should independent from playback. This patch fixup it.
--- sound/soc/soc-compress.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-compress.c +1 -1
@@ -944,7 +944,7 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) rtd->fe_compr =1 ;if (rtd->dai_link->dpcm_playback) be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK ].substream->private_data = rtd; -else if (rtd->dai_link->dpcm_capture) +if (rtd->dai_link->dpcm_capture) be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE ].substream->private_data = rtd;memcpy (compr->ops, &soc_compr_dyn_ops,sizeof (soc_compr_dyn_ops)); }else {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 83/252 gpio: vf610: connect GPIO label to dev name
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
[ Upstream commit 6f8ecb7f85f441eb7d78ba2a4df45ee8a821934e ]
Current GPIO label is fixed, so can't distinguish different GPIO controllers through labels. Use dev name instead.
--- drivers/gpio/gpio-vf610.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-vf610.c +1 -1
@@ -279,7 +279,7 @@ static int vf610_gpio_probe(struct platform_device *pdev) gc = &port->gc; gc->of_node = np; gc->parent = dev; - gc->label ="vf610-gpio" ; + gc->label =dev_name (dev); gc->ngpio =VF610_GPIO_PER_PORT ; gc->base =of_alias_get_id (np,"gpio" ) *VF610_GPIO_PER_PORT ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 84/252 hwmon: (ltc2945) Handle error case in ltc2945_value_store
In reply to Greg Kroah-HartmanFrom: Jonathan Cormier <[email protected]>
[ Upstream commit 178b01eccfb0b8149682f61388400bd3d903dddc ]
ltc2945_val_to_reg errors were not being handled which would have resulted in register being set to 0 (clamped) instead of being left alone.
--- drivers/hwmon/ltc2945.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hwmon/ltc2945.c +2 -0
@@ -257,6 +257,8 @@ static ssize_t ltc2945_set_value(struct device *dev,/* convert to register value, then clamp and write result */ regval =ltc2945_val_to_reg (dev, reg, val); +if (regval <0 ) +return regval;if (is_power_reg (reg)) { regval =clamp_val (regval,0 ,0xffffff ); regbuf[0 ] = regval >>16 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 85/252 scsi: aic94xx: Add missing check for dma_map_single()
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 32fe45274edb5926abc0fac7263d9f889d02d9cf ]
Add check for dma_map_single() and return error if it fails in order to avoid invalid DMA address.
--- drivers/scsi/aic94xx/aic94xx_task.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/aic94xx/aic94xx_task.c +3 -0
@@ -68,6 +68,9 @@ static int asd_map_scatterlist(struct sas_task *task,dma_addr_t dma =pci_map_single (asd_ha->pcidev, p, task->total_xfer_len, task->data_dir); +if (dma_mapping_error (&asd_ha->pcidev->dev, dma)) +return -ENOMEM ; + sg_arr[0 ].bus_addr =cpu_to_le64 ((u64 )dma); sg_arr[0 ].size =cpu_to_le32 (task->total_xfer_len); sg_arr[0 ].flags |=ASD_SG_EL_LIST_EOL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 86/252 spi: bcm63xx-hsspi: fix pm_runtime
In reply to Greg Kroah-HartmanFrom: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit 216e8e80057a9f0b6366327881acf88eaf9f1fd4 ]
The driver sets auto_runtime_pm to true, but it doesn't call pm_runtime_enable(), which results in "Failed to power device" when PM support is enabled.
Stable-dep-of: 811ff802aaf8 ("spi: bcm63xx-hsspi: Fix multi-bit mode setting")
--- drivers/spi/spi-bcm63xx-hsspi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/spi/spi-bcm63xx-hsspi.c +7 -1
@@ -20,6 +20,8 @@#include <linux/spi/spi.h> #include <linux/mutex.h> #include <linux/of.h> +#include <linux/reset.h> +#include <linux/pm_runtime.h> #define HSSPI_GLOBAL_CTRL_REG 0x0#define GLOBAL_CTRL_CS_POLARITY_SHIFT 0
@@ -432,13 +434,17 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)if (ret) goto out_put_master; +pm_runtime_enable (&pdev->dev); +/* register and we are done */ ret =devm_spi_register_master (dev, master);if (ret) - goto out_put_master; + goto out_pm_disable;return 0 ; +out_pm_disable: +pm_runtime_disable (&pdev->dev); out_put_master:spi_master_put (master); out_disable_pll_clk:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 87/252 spi: bcm63xx-hsspi: Fix multi-bit mode setting
In reply to Greg Kroah-HartmanFrom: William Zhang <[email protected]>
[ Upstream commit 811ff802aaf878ebbbaeac0307a0164fa21e7d40 ]
Currently the driver always sets the controller to dual data bit mode for both tx and rx data in the profile mode control register even for single data bit transfer. Luckily the opcode is set correctly according to SPI transfer data bit width so it does not actually cause issues.
This change fixes the problem by setting tx and rx data bit mode field correctly according to the actual SPI transfer tx and rx data bit width.
--- drivers/spi/spi-bcm63xx-hsspi.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/spi/spi-bcm63xx-hsspi.c +9 -3
@@ -163,6 +163,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)int step_size =HSSPI_BUFFER_LEN ;const u8 *tx = t->tx_buf;u8 *rx = t->rx_buf; +u32 val =0 ;bcm63xx_hsspi_set_clk (bs, spi, t->speed_hz);bcm63xx_hsspi_set_cs (bs, spi->chip_select, true);
@@ -178,11 +179,16 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) step_size -=HSSPI_OPCODE_LEN ;if ((opcode ==HSSPI_OP_READ && t->rx_nbits ==SPI_NBITS_DUAL ) || - (opcode ==HSSPI_OP_WRITE && t->tx_nbits ==SPI_NBITS_DUAL )) + (opcode ==HSSPI_OP_WRITE && t->tx_nbits ==SPI_NBITS_DUAL )) { opcode |=HSSPI_OP_MULTIBIT ; -__raw_writel (1 <<MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT | -1 <<MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT |0xff , +if (t->rx_nbits ==SPI_NBITS_DUAL ) + val |=1 <<MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT ; +if (t->tx_nbits ==SPI_NBITS_DUAL ) + val |=1 <<MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT ; + } + +__raw_writel (val |0xff , bs->regs +HSSPI_PROFILE_MODE_CTRL_REG (chip_select));while (pending >0 ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 88/252 hwmon: (mlxreg-fan) Return zero speed for broken fan
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit a1ffd3c46267ee5c807acd780e15df9bb692223f ]
Currently for broken fan driver returns value calculated based on error code (0xFF) in related fan speed register.
Thus, for such fan user gets fan{n}_fault to 1 and fan{n}_input with misleading value.
Add check for fan fault prior return speed value and return zero if fault is detected.
--- drivers/hwmon/mlxreg-fan.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hwmon/mlxreg-fan.c +6 -0
@@ -125,6 +125,12 @@ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,if (err)return err; +if (MLXREG_FAN_GET_FAULT (regval, tacho->mask)) { +/* FAN is broken - return zero for FAN speed. */ + *val =0 ; +return 0 ; + } + *val =MLXREG_FAN_GET_RPM (regval, fan->divider, fan->samples);break ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 89/252 dm: remove flush_scheduled_work() during local_exit()
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
[ Upstream commit 0b22ff5360f5c4e11050b89206370fdf7dc0a226 ]
Commit acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred device removal") switched from using system workqueue to a single workqueue local to DM. But it didn't eliminate the call to flush_scheduled_work() that was introduced purely for the benefit of deferred device removal with commit 2c140a246dc ("dm: allow remove to be deferred").
Since DM core uses its own workqueue (and queue_work) there is no need to call flush_scheduled_work() from local_exit(). local_exit()'s destroy_workqueue(deferred_remove_workqueue) handles flushing work started with queue_work().
--- drivers/md/dm.c | 1 - 1 file changed, 1 deletion(-)
drivers/md/dm.c +0 -1
@@ -279,7 +279,6 @@ static int __init local_init(void)static void local_exit (void ) { -flush_scheduled_work ();destroy_workqueue (deferred_remove_workqueue);kmem_cache_destroy (_rq_cache);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 90/252 nfsd: fix race to check ls_layouts
In reply to Greg Kroah-HartmanFrom: Benjamin Coddington <[email protected]>
[ Upstream commit fb610c4dbc996415d57d7090957ecddd4fd64fb6 ]
Its possible for __break_lease to find the layout's lease before we've added the layout to the owner's ls_layouts list. In that case, setting ls_recalled = true without actually recalling the layout will cause the server to never send a recall callback.
Move the check for ls_layouts before setting ls_recalled.
--- fs/nfsd/nfs4layouts.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfsd/nfs4layouts.c +2 -2
@@ -322,11 +322,11 @@ nfsd4_recall_file_layout(struct nfs4_layout_stateid *ls)if (ls->ls_recalled) goto out_unlock; - ls->ls_recalled = true; -atomic_inc (&ls->ls_stid.sc_file->fi_lo_recalls);if (list_empty (&ls->ls_layouts)) goto out_unlock; + ls->ls_recalled = true; +atomic_inc (&ls->ls_stid.sc_file->fi_lo_recalls);trace_nfsd_layout_recall (&ls->ls_stid.sc_stateid);refcount_inc (&ls->ls_stid.sc_count);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 91/252 cifs: Fix lost destroy smbd connection when MR allocate failed
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
[ Upstream commit e9d3401d95d62a9531082cd2453ed42f2740e3fd ]
If the MR allocate failed, the smb direct connection info is NULL, then smbd_destroy() will directly return, then the connection info will be leaked.
Let's set the smb direct connection info to the server before call smbd_destroy().
--- fs/cifs/smbdirect.c | 1 + 1 file changed, 1 insertion(+)
fs/cifs/smbdirect.c +1 -0
@@ -1887,6 +1887,7 @@ static struct smbd_connection *_smbd_get_connection( allocate_mr_failed:/* At this point, need to a full transport shutdown */ + server->smbd_conn = info;smbd_destroy (server);return NULL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 92/252 cifs: Fix warning and UAF when destroy the MR list
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
[ Upstream commit 3e161c2791f8e661eed24a2c624087084d910215 ]
If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR:
WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 RIP: 0010:__flush_work.isra.0+0xf7/0x110 Call Trace: <TASK> __cancel_work_timer+0x2ba/0x2e0 smbd_destroy+0x4e1/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 Call Trace: dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 smbd_destroy+0x4fc/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Allocated by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7a/0x90 _smbd_get_connection+0x1b6f/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 __kmem_cache_free+0xc8/0x330 _smbd_get_connection+0x1c6a/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Let's initialize the MR recovery work before MR allocate to prevent the warning, remove the MRs from the list to prevent the UAF.
--- fs/cifs/smbdirect.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/cifs/smbdirect.c +2 -1
@@ -2454,6 +2454,7 @@ static int allocate_mr_list(struct smbd_connection *info)atomic_set (&info->mr_ready_count,0 );atomic_set (&info->mr_used_count,0 );init_waitqueue_head (&info->wait_for_mr_cleanup); +INIT_WORK (&info->mr_recovery_work, smbd_mr_recovery_work);/* Allocate more MRs (2x) than hardware responder_resources */ for (i =0 ; i < info->responder_resources *2 ; i++) { smbdirect_mr =kzalloc (sizeof (*smbdirect_mr),GFP_KERNEL );
@@ -2482,13 +2483,13 @@ static int allocate_mr_list(struct smbd_connection *info)list_add_tail (&smbdirect_mr->list, &info->mr_list);atomic_inc (&info->mr_ready_count); } -INIT_WORK (&info->mr_recovery_work, smbd_mr_recovery_work);return 0 ; out:kfree (smbdirect_mr);list_for_each_entry_safe (smbdirect_mr, tmp, &info->mr_list, list) { +list_del (&smbdirect_mr->list);ib_dereg_mr (smbdirect_mr->mr);kfree (smbdirect_mr->sgl);kfree (smbdirect_mr);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 93/252 gfs2: jdata writepage fix
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit cbb60951ce18c9b6e91d2eb97deb41d8ff616622 ]
The ->writepage() and ->writepages() operations are supposed to write entire pages. However, on filesystems with a block size smaller than PAGE_SIZE, __gfs2_jdata_writepage() only adds the first block to the current transaction instead of adding the entire page. Fix that.
--- fs/gfs2/aops.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/gfs2/aops.c +1 -2
@@ -179,7 +179,6 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w {struct inode *inode = page->mapping->host;struct gfs2_inode *ip =GFS2_I (inode); -struct gfs2_sbd *sdp =GFS2_SB (inode);if (PageChecked (page)) {ClearPageChecked (page);
@@ -187,7 +186,7 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *wcreate_empty_buffers (page, inode->i_sb->s_blocksize,BIT (BH_Dirty)|BIT (BH_Uptodate)); } -gfs2_page_add_databufs (ip, page,0 , sdp->sd_vfs->s_blocksize); +gfs2_page_add_databufs (ip, page,0 ,PAGE_SIZE ); }return gfs2_write_full_page (page, gfs2_get_block_noalloc, wbc); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 94/252 perf llvm: Fix inadvertent file creation
In reply to Greg Kroah-HartmanFrom: Ian Rogers <[email protected]>
[ Upstream commit 9f19aab47ced012eddef1e2bc96007efc7713b61 ]
The LLVM template is first echo-ed into command_out and then command_out executed. The echo surrounds the template with double quotes, however, the template itself may contain quotes. This is generally innocuous but in tools/perf/tests/bpf-script-test-prologue.c we see:
...SEC("func=null_lseek file->f_mode offset orig")
...
where the first double quote ends the double quote of the echo, then the > redirects output into a file called f_mode.
To avoid this inadvertent behavior substitute redirects and similar characters to be ASCII control codes, then substitute the output in the echo back again.
--- tools/perf/util/llvm-utils.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
tools/perf/util/llvm-utils.c +24 -1
@@ -521,14 +521,37 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,pr_debug ("llvm compiling command template: %s\n" , template); +/* +* Below, substitute control characters for values that can cause the +* echo to misbehave, then substitute the values back. +*/ err = -ENOMEM ; -if (asprintf (&command_echo,"echo -n \"%s\"" , template) <0 ) +if (asprintf (&command_echo,"echo -n \a%s\a" , template) <0 ) goto errout; +#define SWAP_CHAR (a, b) do { if (*p == a) *p = b; } while (0) +for (char *p = command_echo; *p; p++) { +SWAP_CHAR ('<' ,'\001' ); +SWAP_CHAR ('>' ,'\002' ); +SWAP_CHAR ('"' ,'\003' ); +SWAP_CHAR ('\'' ,'\004' ); +SWAP_CHAR ('|' ,'\005' ); +SWAP_CHAR ('&' ,'\006' ); +SWAP_CHAR ('\a' ,'"' ); + } err =read_from_pipe (command_echo, (void **) &command_out,NULL );if (err) goto errout; +for (char *p = command_out; *p; p++) { +SWAP_CHAR ('\001' ,'<' ); +SWAP_CHAR ('\002' ,'>' ); +SWAP_CHAR ('\003' ,'"' ); +SWAP_CHAR ('\004' ,'\'' ); +SWAP_CHAR ('\005' ,'|' ); +SWAP_CHAR ('\006' ,'&' ); + } +#undef SWAP_CHARpr_debug ("llvm compiling command : %s\n" , command_out); err =read_from_pipe (template, &obj_buf, &obj_buf_sz);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 95/252 perf tools: Fix auto-complete on aarch64
In reply to Greg Kroah-HartmanFrom: Yicong Yang <[email protected]>
[ Upstream commit ffd1240e8f0814262ceb957dbe961f6e0aef1e7a ]
On aarch64 CPU related events are not under event_source/devices/cpu/events, they're under event_source/devices/armv8_pmuv3_0/events on my machine. Using current auto-complete script will generate below error:
[root@localhost bin]# perf stat -e
ls: cannot access '/sys/bus/event_source/devices/cpu/events': No such file or directory
Fix this by not testing /sys/bus/event_source/devices/cpu/events on aarch64 machine.
--- tools/perf/perf-completion.sh | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
tools/perf/perf-completion.sh +8 -3
@@ -165,7 +165,12 @@ __perf_main () local cur1=${COMP_WORDS[COMP_CWORD]} local raw_evts=$($cmd list --raw-dump) - local arr s tmp result + local arr s tmp result cpu_evts + + # aarch64 doesn't have /sys/bus/event_source/devices/cpu/events + if [[ `uname -m` != aarch64 ]]; then + cpu_evts=$(ls /sys/bus/event_source/devices/cpu/events) + fi if [[ "$cur1" == */* && ${cur1#*/} =~ ^[A-Z] ]]; then OLD_IFS="$IFS"
@@ -183,9 +188,9 @@ __perf_main () fi done - evts=${result}" "$(ls /sys/bus/event_source/devices/cpu/events) + evts=${result}" "${cpu_evts} else - evts=${raw_evts}" "$(ls /sys/bus/event_source/devices/cpu/events) + evts=${raw_evts}" "${cpu_evts} fi if [[ "$cur1" == , ]]; then
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 96/252 sparc: allow PM configs for sparc32 COMPILE_TEST
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 7be6a87c2473957090995b7eb541e31d57a2c801 ]
When doing randconfig builds for sparc32 with COMPILE_TEST, some (non-Sparc) drivers cause kconfig warnings with the Kconfig symbols PM, PM_GENERIC_DOMAINS, or PM_GENERIC_DOMAINS_OF.
This is due to arch/sparc/Kconfig not using the PM Kconfig for Sparc32:
if SPARC64
source "kernel/power/Kconfig"
endif
Arnd suggested adding "|| COMPILE_TEST" to the conditional, instead of trying to track down every driver that selects any of these PM symbols.
Fixes the following kconfig warnings:
WARNING: unmet direct dependencies detected for PM
Depends on [n]: SPARC64 [=n]
Selected by [y]:
- SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
WARNING: unmet direct dependencies detected for PM
Depends on [n]: SPARC64 [=n]
Selected by [y]:
- SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS
Depends on [n]: SPARC64 [=n] && PM [=y]
Selected by [y]:
- QCOM_GDSC [=y] && COMMON_CLK [=y] && PM [=y]
- SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
- MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
- BCM2835_POWER [=y] && (ARCH_BCM2835 || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
- BCM_PMB [=y] && (ARCH_BCMBCA || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
- ROCKCHIP_PM_DOMAINS [=y] && (ARCH_ROCKCHIP || COMPILE_TEST [=y]) && PM [=y] Selected by [m]:
- ARM_SCPI_POWER_DOMAIN [=m] && (ARM_SCPI_PROTOCOL [=m] || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
- MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
- QCOM_AOSS_QMP [=m] && (ARCH_QCOM || COMPILE_TEST [=y]) && MAILBOX [=y] && COMMON_CLK [=y] && PM [=y]
WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS_OF
Depends on [n]: SPARC64 [=n] && PM_GENERIC_DOMAINS [=y] && OF [=y] Selected by [y]:
- MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] Selected by [m]:
- MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
--- arch/sparc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/Kconfig +1 -1
@@ -329,7 +329,7 @@ config FORCE_MAX_ZONEORDER This config option is actually maximum order plus one. For example, a value of 13 means that the largest free memory block is 2^12 pages. -if SPARC64 +if SPARC64 || COMPILE_TEST source "kernel/power/Kconfig" endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 97/252 selftests/ftrace: Fix bash specific "==" operator
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit 1e6b485c922fbedf41d5a9f4e6449c5aeb923a32 ]
Since commit a1d6cd88c897 ("selftests/ftrace: event_triggers: wait longer for test_event_enable") introduced bash specific "==" comparation operator, that test will fail when we run it on a posix-shell. checkbashisms warned it as below.
possible bashism in ftrace/func_event_triggers.tc line 45 (should be 'b = a'):
if [ "$e" == $val ]; then
This replaces it with "=".
--- .../selftests/ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc +1 -1
@@ -49,7 +49,7 @@ test_event_enabled() { while [ $check_times -ne 0 ]; do e=`cat $EVENT_ENABLE` - if [ "$e" == $val ]; then + if [ "$e" = $val ]; then return 0 fi sleep $SLEEP_TIME
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 98/252 mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
In reply to Greg Kroah-HartmanFrom: Qiheng Lin <[email protected]>
[ Upstream commit 8b450dcff23aa254844492831a8e2b508a9d522d ]
req is allocated in pcf50633_adc_async_read(), but adc_enqueue_request() could fail to insert the req into queue. We need to check the return value and free it in the case of failure.
--- drivers/mfd/pcf50633-adc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/mfd/pcf50633-adc.c +6 -1
@@ -140,6 +140,7 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, void *callback_param) {struct pcf50633_adc_request *req; +int ret;/* req is freed when the result is ready, in interrupt handler */ req =kmalloc (sizeof (*req),GFP_KERNEL );
@@ -151,7 +152,11 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, req->callback = callback; req->callback_param = callback_param; -return adc_enqueue_request (pcf, req); + ret =adc_enqueue_request (pcf, req); +if (ret) +kfree (req); + +return ret; }EXPORT_SYMBOL_GPL (pcf50633_adc_async_read);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 99/252 mtd: rawnand: sunxi: Fix the size of the last OOB region
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 34569d869532b54d6e360d224a0254dcdd6a1785 ]
The previous code assigned to the wrong structure member.
--- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/sunxi_nand.c +1 -1
@@ -1670,7 +1670,7 @@ static int sunxi_nand_ooblayout_free(struct mtd_info *mtd, int section,if (section < ecc->steps) oobregion->length =4 ;else - oobregion->offset = mtd->oobsize - oobregion->offset; + oobregion->length = mtd->oobsize - oobregion->offset;return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 100/252 Input: ads7846 - dont report pressure for ads7845
In reply to Greg Kroah-HartmanFrom: Luca Ellero <[email protected]>
[ Upstream commit d50584d783313c8b05b84d0b07a2142f1bde46dd ]
ADS7845 doesn't support pressure.
Avoid the following error reported by libinput-list-devices:
"ADS7845 Touchscreen: kernel bug: device has min == max on ABS_PRESSURE".
--- drivers/input/touchscreen/ads7846.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/input/touchscreen/ads7846.c +3 -2
@@ -1374,8 +1374,9 @@ static int ads7846_probe(struct spi_device *spi) pdata->y_min ? :0 , pdata->y_max ? :MAX_12BIT , 0, 0); -input_set_abs_params (input_dev,ABS_PRESSURE , - pdata->pressure_min, pdata->pressure_max,0 ,0 ); +if (ts->model !=7845 ) +input_set_abs_params (input_dev,ABS_PRESSURE , + pdata->pressure_min, pdata->pressure_max,0 ,0 );ads7846_setup_spi_msg (ts, pdata);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 101/252 Input: ads7846 - dont check penirq immediately for 7845
In reply to Greg Kroah-HartmanFrom: Luca Ellero <[email protected]>
[ Upstream commit fa9f4275b20ec7b2a8fb05c66362d10b36f9efec ]
To discard false readings, one should use "ti,penirq-recheck-delay-usecs". Checking get_pendown_state() at the beginning, most of the time fails causing malfunctioning.
--- drivers/input/touchscreen/ads7846.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/input/touchscreen/ads7846.c +1 -7
@@ -790,14 +790,8 @@ static void ads7846_report_state(struct ads7846 *ts)if (x ==MAX_12BIT ) x =0 ; -if (ts->model ==7843 ) { +if (ts->model ==7843 || ts->model ==7845 ) { Rt = ts->pressure_max /2 ; - }else if (ts->model ==7845 ) { -if (get_pendown_state (ts)) - Rt = ts->pressure_max /2 ; -else - Rt =0 ; -dev_vdbg (&ts->spi->dev,"x/y: %d/%d, PD %d\n" , x, y, Rt); }else if (likely (x && z1)) {/* compute touch pressure resistance using equation #2 */ Rt = z2;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 102/252 powerpc/powernv/ioda: Skip unallocated resources when mapping to PE
In reply to Greg Kroah-HartmanFrom: Frederic Barrat <[email protected]>
[ Upstream commit e64e71056f323a1e178dccf04d4c0f032d84436c ]
pnv_ioda_setup_pe_res() calls opal to map a resource with a PE. However, the code assumes the resource is allocated and it uses the resource address to find out the segment(s) which need to be mapped to the PE. In the unlikely case where the resource hasn't been allocated, the computation for the segment number is garbage, which can lead to invalid memory access and potentially a kernel crash, such as:
[ ] pci_bus 0002:02: Configuring PE for bus
[ ] pci 0002:02 : [PE# fc] Secondary bus 0x0000000000000002..0x0000000000000002 associated with PE#fc
[ ] BUG: Kernel NULL pointer dereference on write at 0x00000000
[ ] Faulting instruction address: 0xc00000000005eac4
[ ] Oops: Kernel access of bad area, sig: 7 [#1]
[ ] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
[ ] Modules linked in:
[ ] CPU: 12 PID: 1 Comm: swapper/20 Not tainted 5.10.50-openpower1 #2
[ ] NIP: c00000000005eac4 LR: c00000000005ea44 CTR: 0000000030061b9c
[ ] REGS: c000200007383650 TRAP: 0300 Not tainted (5.10.50-openpower1)
[ ] MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 44000224 XER: 20040000 [ ] CFAR: c00000000005eaa0 DAR: 0000000000000000 DSISR: 02080000 IRQMASK: 0 [ ] GPR00: c00000000005dd98 c0002000073838e0 c00000000185de00 c000200fff018960 [ ] GPR04: 00000000000000fc 0000000000000003 0000000000000000 0000000000000000 [ ] GPR08: 0000000000000000 0000000000000000 0000000000000000 9000000000001033 [ ] GPR12: 0000000031cb0000 c000000ffffe6a80 c000000000010a58 0000000000000000 [ ] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ ] GPR20: 0000000000000000 0000000000000000 0000000000000000 c00000000711e200 [ ] GPR24: 0000000000000100 c000200009501120 c00020000cee2800 00000000000003ff [ ] GPR28: c000200fff018960 0000000000000000 c000200ffcb7fd00 0000000000000000 [ ] NIP [c00000000005eac4] pnv_ioda_setup_pe_res+0x94/0x1a0
[ ] LR [c00000000005ea44] pnv_ioda_setup_pe_res+0x14/0x1a0
[ ] Call Trace:
[ ] [c0002000073838e0] [c00000000005eb98] pnv_ioda_setup_pe_res+0x168/0x1a0 (unreliable) [ ] [c000200007383970] [c00000000005dd98] pnv_pci_ioda_dma_dev_setup+0x43c/0x970 [ ] [c000200007383a60] [c000000000032cdc] pcibios_bus_add_device+0x78/0x18c [ ] [c000200007383aa0] [c00000000028f2bc] pci_bus_add_device+0x28/0xbc
[ ] [c000200007383b10] [c00000000028f3a0] pci_bus_add_devices+0x50/0x7c
[ ] [c000200007383b50] [c00000000028f3c4] pci_bus_add_devices+0x74/0x7c
[ ] [c000200007383b90] [c00000000028f3c4] pci_bus_add_devices+0x74/0x7c
[ ] [c000200007383bd0] [c00000000069ad0c] pcibios_init+0xf0/0x104
[ ] [c000200007383c50] [c0000000000106d8] do_one_initcall+0x84/0x1c4
[ ] [c000200007383d20] [c0000000006910b8] kernel_init_freeable+0x264/0x268 [ ] [c000200007383dc0] [c000000000010a68] kernel_init+0x18/0x138
[ ] [c000200007383e20] [c00000000000cbfc] ret_from_kernel_thread+0x5c/0x80 [ ] Instruction dump:
[ ] 7f89e840 409d000c 7fbbf840 409c000c 38210090 4848f448 809c002c e95e0120 [ ] 7ba91764 38a00003 57a7043e 38c00000 <7c8a492e> 5484043e e87e0018 4bff23bd
Hitting the problem is not that easy. It was seen with a (semi-bogus) PCI device with a class code of 0. The generic PCI framework doesn't allocate resources in such a case.
The patch is simply skipping resources which are still flagged with IORESOURCE_UNSET.
We don't have the problem with 64-bit mem resources, as the address of the resource is checked to be within the range of the 64-bit mmio window. See pnv_ioda_reserve_dev_m64_pe() and pnv_pci_is_m64().
--- arch/powerpc/platforms/powernv/pci-ioda.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/powerpc/platforms/powernv/pci-ioda.c +2 -1
@@ -3123,7 +3123,8 @@ static void pnv_ioda_setup_pe_res(struct pnv_ioda_pe *pe,int index;int64_t rc; -if (!res || !res->flags || res->start > res->end) +if (!res || !res->flags || res->start > res->end || + res->flags &IORESOURCE_UNSET )return ;if (res->flags &IORESOURCE_IO ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 103/252 clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit 79200d5851c8e7179f68a4a6f162d8f1bde4986f ]
In the previous commits that added CLK_OPS_PARENT_ENABLE, support for this flag was only added to rate change operations (rate setting and reparent) and disabling unused subtree. It was not added to the clock gate related operations. Any hardware driver that needs it for these operations will either see bogus results, or worse, hang.
This has been seen on MT8192 and MT8195, where the imp_ii2_* clk drivers set this, but dumping debugfs clk_summary would cause it to hang.
Prepare parent on prepare and enable parent on enable dependencies are already handled automatically by the core as part of its sequencing. Whether the case for "enable parent on prepare" should be supported by this flag or not is not clear, and thus ignored for now.
This change solely fixes the handling of clk_core_is_enabled, i.e. enabling the parent clock when reading the hardware state. Unfortunately clk_core_is_enabled is called in a variety of places, sometimes with the enable clock already held. To avoid deadlocking, the core will ignore readouts and just return false if CLK_OPS_PARENT_ENABLE is set but the parent isn't currently enabled.
--- drivers/clk/clk.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/clk/clk.c +11 -0
@@ -244,6 +244,17 @@ static bool clk_core_is_enabled(struct clk_core *core) } } +/* +* This could be called with the enable lock held, or from atomic +* context. If the parent isn't enabled already, we can't do +* anything here. We can also assume this clock isn't enabled. +*/ +if ((core->flags &CLK_OPS_PARENT_ENABLE ) && core->parent) +if (!clk_core_is_enabled (core->parent)) { + ret = false; + goto done; + } + ret = core->ops->is_enabled (core->hw); done:if (core->dev)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 104/252 powerpc/pseries/lparcfg: add missing RTAS retry status handling
In reply to Greg Kroah-HartmanFrom: Nathan Lynch <[email protected]>
[ Upstream commit 5d08633e5f6564b60f1cbe09af3af40a74d66431 ]
The ibm,get-system-parameter RTAS function may return -2 or 990x, which indicate that the caller should try again.
lparcfg's parse_system_parameter_string() ignores this, making it possible to intermittently report incorrect SPLPAR characteristics.
Move the RTAS call into a coventional rtas_busy_delay()-based loop.
--- arch/powerpc/platforms/pseries/lparcfg.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
arch/powerpc/platforms/pseries/lparcfg.c +10 -10
@@ -291,6 +291,7 @@ static void parse_mpp_x_data(struct seq_file *m)*/ static void parse_system_parameter_string (struct seq_file *m) { +const s32 token =rtas_token ("ibm,get-system-parameter" );int call_status;unsigned char *local_buffer =kmalloc (SPLPAR_MAXLENGTH ,GFP_KERNEL );
@@ -300,16 +301,15 @@ static void parse_system_parameter_string(struct seq_file *m)return ; } -spin_lock (&rtas_data_buf_lock); -memset (rtas_data_buf,0 ,SPLPAR_MAXLENGTH ); - call_status =rtas_call (rtas_token ("ibm,get-system-parameter" ),3 ,1 , -NULL , -SPLPAR_CHARACTERISTICS_TOKEN , -__pa (rtas_data_buf), -RTAS_DATA_BUF_SIZE ); -memcpy (local_buffer, rtas_data_buf,SPLPAR_MAXLENGTH ); - local_buffer[SPLPAR_MAXLENGTH -1 ] ='\0' ; -spin_unlock (&rtas_data_buf_lock); +do { +spin_lock (&rtas_data_buf_lock); +memset (rtas_data_buf,0 ,SPLPAR_MAXLENGTH ); + call_status =rtas_call (token,3 ,1 ,NULL ,SPLPAR_CHARACTERISTICS_TOKEN , +__pa (rtas_data_buf),RTAS_DATA_BUF_SIZE ); +memcpy (local_buffer, rtas_data_buf,SPLPAR_MAXLENGTH ); + local_buffer[SPLPAR_MAXLENGTH -1 ] ='\0' ; +spin_unlock (&rtas_data_buf_lock); + }while (rtas_busy_delay (call_status));if (call_status !=0 ) { printk(KERN_INFO
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 105/252 powerpc/rtas: make all exports GPL
In reply to Greg Kroah-HartmanFrom: Nathan Lynch <[email protected]>
[ Upstream commit 9bce6243848dfd0ff7c2be6e8d82ab9b1e6c7858 ]
The first symbol exports of RTAS functions and data came with the (now removed) scanlog driver in 2003:
At the time this was applied, EXPORT_SYMBOL_GPL() was very new, and the exports of rtas_call() etc have remained non-GPL. As new APIs have been added to the RTAS subsystem, their symbol exports have followed the convention set by existing code.
However, the historical evidence is that RTAS function exports have been added over time only to satisfy the needs of in-kernel users, and these clients must have fairly intimate knowledge of how the APIs work to use them safely. No out of tree users are known, and future ones seem unlikely.
Arguably the default for RTAS symbols should have become EXPORT_SYMBOL_GPL once it was available. Let's make it so now, and exceptions can be evaluated as needed.
Stable-dep-of: 836b5b9fcc8e ("powerpc/rtas: ensure 4KB alignment for rtas_data_buf")
--- arch/powerpc/kernel/rtas.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
arch/powerpc/kernel/rtas.c +11 -11
@@ -54,10 +54,10 @@ struct rtas_t rtas = {EXPORT_SYMBOL (rtas);DEFINE_SPINLOCK (rtas_data_buf_lock); -EXPORT_SYMBOL (rtas_data_buf_lock); +EXPORT_SYMBOL_GPL (rtas_data_buf_lock); char rtas_data_buf[RTAS_DATA_BUF_SIZE] __cacheline_aligned; -EXPORT_SYMBOL (rtas_data_buf); +EXPORT_SYMBOL_GPL (rtas_data_buf);unsigned long rtas_rmo_buf;
@@ -66,7 +66,7 @@ unsigned long rtas_rmo_buf;* This is done like this so rtas_flash can be a module. */ void (*rtas_flash_term_hook)(int ); -EXPORT_SYMBOL (rtas_flash_term_hook); +EXPORT_SYMBOL_GPL (rtas_flash_term_hook);/* RTAS use home made raw locking instead of spin_lock_irqsave * because those can be called from within really nasty contexts
@@ -314,7 +314,7 @@ void rtas_progress(char *s, unsigned short hex)spin_unlock (&progress_lock); } -EXPORT_SYMBOL (rtas_progress);/* needed by rtas_flash module */ +EXPORT_SYMBOL_GPL (rtas_progress);/* needed by rtas_flash module */ int rtas_token (const char *service) {
@@ -324,7 +324,7 @@ int rtas_token(const char *service) tokp =of_get_property (rtas.dev, service,NULL );return tokp ?be32_to_cpu (*tokp) :RTAS_UNKNOWN_SERVICE ; } -EXPORT_SYMBOL (rtas_token); +EXPORT_SYMBOL_GPL (rtas_token);int rtas_service_present (const char *service) {
@@ -484,7 +484,7 @@ int rtas_call(int token, int nargs, int nret, int *outputs, ...) }return ret; } -EXPORT_SYMBOL (rtas_call); +EXPORT_SYMBOL_GPL (rtas_call);/* For RTAS_BUSY (-2), delay for 1 millisecond. For an extended busy status * code of 990n, perform the hinted delay of 10^n (last digit) milliseconds.
@@ -519,7 +519,7 @@ unsigned int rtas_busy_delay(int status)return ms; } -EXPORT_SYMBOL (rtas_busy_delay); +EXPORT_SYMBOL_GPL (rtas_busy_delay);static int rtas_error_rc (int rtas_rc) {
@@ -565,7 +565,7 @@ int rtas_get_power_level(int powerdomain, int *level)return rtas_error_rc (rc);return rc; } -EXPORT_SYMBOL (rtas_get_power_level); +EXPORT_SYMBOL_GPL (rtas_get_power_level);int rtas_set_power_level (int powerdomain,int level,int *setlevel) {
@@ -583,7 +583,7 @@ int rtas_set_power_level(int powerdomain, int level, int *setlevel)return rtas_error_rc (rc);return rc; } -EXPORT_SYMBOL (rtas_set_power_level); +EXPORT_SYMBOL_GPL (rtas_set_power_level);int rtas_get_sensor (int sensor,int index,int *state) {
@@ -601,7 +601,7 @@ int rtas_get_sensor(int sensor, int index, int *state)return rtas_error_rc (rc);return rc; } -EXPORT_SYMBOL (rtas_get_sensor); +EXPORT_SYMBOL_GPL (rtas_get_sensor);int rtas_get_sensor_fast (int sensor,int index,int *state) {
@@ -662,7 +662,7 @@ int rtas_set_indicator(int indicator, int index, int new_value)return rtas_error_rc (rc);return rc; } -EXPORT_SYMBOL (rtas_set_indicator); +EXPORT_SYMBOL_GPL (rtas_set_indicator);/* * Ignoring RTAS extended delay
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 106/252 powerpc/rtas: ensure 4KB alignment for rtas_data_buf
In reply to Greg Kroah-HartmanFrom: Nathan Lynch <[email protected]>
[ Upstream commit 836b5b9fcc8e09cea7e8a59a070349a00e818308 ]
Some RTAS functions that have work area parameters impose alignment requirements on the work area passed to them by the OS. Examples include:
- ibm,configure-connector
- ibm,update-nodes
- ibm,update-properties
4KB is the greatest alignment required by PAPR for such buffers. rtas_data_buf used to have a __page_aligned attribute in the arch/ppc64 days, but that was changed to __cacheline_aligned for unknown reasons by commit 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"). That works out to 128-byte alignment on ppc64, which isn't right.
This was found by inspection and I'm not aware of any real problems caused by this. Either current RTAS implementations don't enforce the alignment constraints, or rtas_data_buf is always being placed at a 4KB boundary by accident (or both, perhaps).
Use __aligned(SZ_4K) to ensure the rtas_data_buf has alignment appropriate for all users.
--- arch/powerpc/kernel/rtas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/rtas.c +1 -1
@@ -56,7 +56,7 @@ EXPORT_SYMBOL(rtas);DEFINE_SPINLOCK (rtas_data_buf_lock);EXPORT_SYMBOL_GPL (rtas_data_buf_lock); -char rtas_data_buf[RTAS_DATA_BUF_SIZE] __cacheline_aligned; +char rtas_data_buf[RTAS_DATA_BUF_SIZE ]__aligned(SZ_4K) ;EXPORT_SYMBOL_GPL (rtas_data_buf);unsigned long rtas_rmo_buf;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 107/252 MIPS: vpe-mt: drop physical_memsize
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 91dc288f4edf0d768e46c2c6d33e0ab703403459 ]
When neither LANTIQ nor MIPS_MALTA is set, 'physical_memsize' is not declared. This causes the build to fail with:
mips-linux-ld: arch/mips/kernel/vpe-mt.o: in function `vpe_run':
arch/mips/kernel/vpe-mt.c:(.text.vpe_run+0x280): undefined reference to `physical_memsize'
LANTIQ is not using 'physical_memsize' and MIPS_MALTA's use of it is self-contained in mti-malta/malta-dtshim.c.
Use of physical_memsize in vpe-mt.c appears to be unused, so eliminate this loader mode completely and require VPE programs to be compiled with DFLT_STACK_SIZE and DFLT_HEAP_SIZE defined.
--- arch/mips/include/asm/vpe.h | 1 - arch/mips/kernel/vpe-mt.c | 7 +++---- arch/mips/lantiq/prom.c | 6 ------ 3 files changed, 3 insertions(+), 11 deletions(-)
arch/mips/include/asm/vpe.h +0 -1
@@ -104,7 +104,6 @@ struct vpe_control {struct list_head tc_list;/* Thread contexts */ }; -extern unsigned long physical_memsize;extern struct vpe_control vpecontrol;extern const struct file_operations vpe_fops;
arch/mips/kernel/vpe-mt.c +3 -4
@@ -92,12 +92,11 @@ int vpe_run(struct vpe *v)write_tc_c0_tchalt (read_tc_c0_tchalt () & ~TCHALT_H );/* -* The sde-kit passes 'memsize' to __start in $a3, so set something -* here... Or set $a3 to zero and define DFLT_STACK_SIZE and -* DFLT_HEAP_SIZE when you compile your program +* We don't pass the memsize here, so VPE programs need to be +* compiled with DFLT_STACK_SIZE and DFLT_HEAP_SIZE defined. */ +mttgpr (7 ,0 );mttgpr (6 , v->ntcs); -mttgpr (7 , physical_memsize);/* set up VPE1 */ /*
arch/mips/lantiq/prom.c +0 -6
@@ -24,12 +24,6 @@DEFINE_SPINLOCK (ebu_lock);EXPORT_SYMBOL_GPL (ebu_lock); -/* -* This is needed by the VPE loader code, just set it to 0 and assume -* that the firmware hardcodes this value to something useful. -*/ -unsigned long physical_memsize =0L ; -/* * this struct is filled by the soc specific detection code and holds * information about the specific soc type, revision and name
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 108/252 media: platform: ti: Add missing check for devm_regulator_get
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit da8e05f84a11c3cc3b0ba0a3c62d20e358002d99 ]
Add check for the return value of devm_regulator_get since it may return error pointer.
--- drivers/media/platform/omap3isp/isp.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/media/platform/omap3isp/isp.c +9 -0
@@ -2247,7 +2247,16 @@ static int isp_probe(struct platform_device *pdev)/* Regulators */ isp->isp_csiphy1.vdd =devm_regulator_get (&pdev->dev,"vdd-csiphy1" ); +if (IS_ERR (isp->isp_csiphy1.vdd)) { + ret =PTR_ERR (isp->isp_csiphy1.vdd); + goto error; + } + isp->isp_csiphy2.vdd =devm_regulator_get (&pdev->dev,"vdd-csiphy2" ); +if (IS_ERR (isp->isp_csiphy2.vdd)) { + ret =PTR_ERR (isp->isp_csiphy2.vdd); + goto error; + }/* Clocks *
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 109/252 powerpc: Remove linker flag from KBUILD_AFLAGS
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 31f48f16264bc70962fb3e7ec62da64d0a2ba04a ]
When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it points out that KBUILD_AFLAGS contains a linker flag, which will be unused:
clang: error: -Wl,-a32: 'linker' input unused [-Werror,-Wunused-command-line-argument]
This was likely supposed to be '-Wa,-a$(BITS)'. However, this change is unnecessary, as all supported versions of clang and gcc will pass '-a64' or '-a32' to GNU as based on the value of '-m'; the behavior of the latest stable release of the oldest supported major version of each compiler is shown below and each compiler's latest release exhibits the same behavior (GCC 12.2.0 and Clang 15.0.6).
$ powerpc64-linux-gcc --version | head -1 powerpc64-linux-gcc (GCC) 5.5.0
$ powerpc64-linux-gcc -m64 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as ' .../as -a64 -mppc64 -many -mbig -o /dev/null /tmp/cctwuBzZ.s
$ powerpc64-linux-gcc -m32 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as ' .../as -a32 -mppc -many -mbig -o /dev/null /tmp/ccaZP4mF.sg
$ clang --version | head -1 Ubuntu clang version 11.1.0-++20211011094159+1fdec59bffc1-1~exp1~20211011214622.5
$ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \
-x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as
"/usr/bin/powerpc64-linux-gnu-as" "-a64" "-mppc64" "-many" "-o" "/dev/null" "/tmp/null-80267c.s" $ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \
-x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as
"/usr/bin/powerpc64-linux-gnu-as" "-a32" "-mppc" "-many" "-o" "/dev/null" "/tmp/null-ab8f8d.s"Remove this flag altogether to avoid future issues.
--- arch/powerpc/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/Makefile +1 -1
@@ -109,7 +109,7 @@ aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mlittle-endian ifeq ($(HAS_BIARCH),y) KBUILD_CFLAGS += -m$(BITS) -KBUILD_AFLAGS += -m$(BITS) -Wl,-a$(BITS) +KBUILD_AFLAGS += -m$(BITS) KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION) KBUILD_ARFLAGS += --target=elf$(BITS)-$(GNUTARGET) endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 110/252 media: i2c: ov772x: Fix memleak in ov772x_probe()
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit 7485edb2b6ca5960205c0a49bedfd09bba30e521 ]
A memory leak was reported when testing ov772x with bpf mock device:
AssertionError: unreferenced object 0xffff888109afa7a8 (size 8):
comm "python3", pid 279, jiffies 4294805921 (age 20.681s) hex dump (first 8 bytes):
80 22 88 15 81 88 ff ff ."......
backtrace:
[<000000009990b438>] __kmalloc_node+0x44/0x1b0
[<000000009e32f7d7>] kvmalloc_node+0x34/0x180
[<00000000faf48134>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev]
[<00000000da376937>] ov772x_probe+0x1c3/0x68c [ov772x]
[<000000003f0d225e>] i2c_device_probe+0x28d/0x680
[<00000000e0b6db89>] really_probe+0x17c/0x3f0
[<000000001b19fcee>] __driver_probe_device+0xe3/0x170
[<0000000048370519>] driver_probe_device+0x49/0x120
[<000000005ead07a0>] __device_attach_driver+0xf7/0x150
[<0000000043f452b8>] bus_for_each_drv+0x114/0x180
[<00000000358e5596>] __device_attach+0x1e5/0x2d0
[<0000000043f83c5d>] bus_probe_device+0x126/0x140
[<00000000ee0f3046>] device_add+0x810/0x1130
[<00000000e0278184>] i2c_new_client_device+0x359/0x4f0
[<0000000070baf34f>] of_i2c_register_device+0xf1/0x110
[<00000000a9f2159d>] of_i2c_notify+0x100/0x160
unreferenced object 0xffff888119825c00 (size 256):
comm "python3", pid 279, jiffies 4294805921 (age 20.681s)
hex dump (first 32 bytes):
00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff .........^......
10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff .\.......\......
backtrace:
[<000000009990b438>] __kmalloc_node+0x44/0x1b0
[<000000009e32f7d7>] kvmalloc_node+0x34/0x180
[<0000000073d88e0b>] v4l2_ctrl_new.cold+0x19b/0x86f [videodev]
[<00000000b1f576fb>] v4l2_ctrl_new_std+0x16f/0x210 [videodev]
[<00000000caf7ac99>] ov772x_probe+0x1fa/0x68c [ov772x]
[<000000003f0d225e>] i2c_device_probe+0x28d/0x680
[<00000000e0b6db89>] really_probe+0x17c/0x3f0
[<000000001b19fcee>] __driver_probe_device+0xe3/0x170
[<0000000048370519>] driver_probe_device+0x49/0x120
[<000000005ead07a0>] __device_attach_driver+0xf7/0x150
[<0000000043f452b8>] bus_for_each_drv+0x114/0x180
[<00000000358e5596>] __device_attach+0x1e5/0x2d0
[<0000000043f83c5d>] bus_probe_device+0x126/0x140
[<00000000ee0f3046>] device_add+0x810/0x1130
[<00000000e0278184>] i2c_new_client_device+0x359/0x4f0
[<0000000070baf34f>] of_i2c_register_device+0xf1/0x110The reason is that if priv->hdl.error is set, ov772x_probe() jumps to the error_mutex_destroy without doing v4l2_ctrl_handler_free(), and all resources allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() are leaked.
--- drivers/media/i2c/ov772x.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/i2c/ov772x.c +1 -2
@@ -1424,7 +1424,7 @@ static int ov772x_probe(struct i2c_client *client, priv->subdev.ctrl_handler = &priv->hdl;if (priv->hdl.error) { ret = priv->hdl.error; - goto error_mutex_destroy; + goto error_ctrl_free; } priv->clk =clk_get (&client->dev,NULL );
@@ -1473,7 +1473,6 @@ static int ov772x_probe(struct i2c_client *client,clk_put (priv->clk); error_ctrl_free:v4l2_ctrl_handler_free (&priv->hdl); -error_mutex_destroy:mutex_destroy (&priv->lock);return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 111/252 media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit 29b0589a865b6f66d141d79b2dd1373e4e50fe17 ]
When the ene device is detaching, function ene_remove() will be called. But there is no function to cancel tx_sim_timer in ene_remove(), the timer handler ene_tx_irqsim() could race with ene_remove(). As a result, the UAF bugs could happen, the process is shown below.
(cleanup routine) | (timer routine)
| mod_timer(&dev->tx_sim_timer, ..)
ene_remove() | (wait a time)
| ene_tx_irqsim()
| dev->hw_lock //USE
| ene_tx_sample(dev) //USEFix by adding del_timer_sync(&dev->tx_sim_timer) in ene_remove(), The tx_sim_timer could stop before ene device is deallocated.
What's more, The rc_unregister_device() and del_timer_sync() should be called first in ene_remove() and the deallocated functions such as free_irq(), release_region() and so on should be called behind them. Because the rc_unregister_device() is well synchronized. Otherwise, race conditions may happen. The situations that may lead to race conditions are shown below.
Firstly, the rx receiver is disabled with ene_rx_disable() before rc_unregister_device() in ene_remove(), which means it can be enabled again if a process opens /dev/lirc0 between ene_rx_disable() and rc_unregister_device().
Secondly, the irqaction descriptor is freed by free_irq() before the rc device is unregistered, which means irqaction descriptor may be accessed again after it is deallocated.
Thirdly, the timer can call ene_tx_sample() that can write to the io ports, which means the io ports could be accessed again after they are deallocated by release_region().
Therefore, the rc_unregister_device() and del_timer_sync() should be called first in ene_remove().
Suggested by: Sean Young <[email protected]>
--- drivers/media/rc/ene_ir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/rc/ene_ir.c +2 -1
@@ -1116,6 +1116,8 @@ static void ene_remove(struct pnp_dev *pnp_dev)struct ene_device *dev =pnp_get_drvdata (pnp_dev);unsigned long flags; +rc_unregister_device (dev->rdev); +del_timer_sync (&dev->tx_sim_timer);spin_lock_irqsave (&dev->hw_lock, flags);ene_rx_disable (dev);ene_rx_restore_hw_buffer (dev);
@@ -1123,7 +1125,6 @@ static void ene_remove(struct pnp_dev *pnp_dev)free_irq (dev->irq, dev);release_region (dev->hw_io,ENE_IO_SIZE ); -rc_unregister_device (dev->rdev);kfree (dev); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 112/252 media: i2c: ov7670: 0 instead of -EINVAL was returned
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 6a4c664539e6de9b32b65ddcf767ec1bcc1d7f8a ]
If the media bus is unsupported, then return -EINVAL. Instead it returned 'ret' which happened to be 0.
This fixes a smatch warning:
ov7670.c:1843 ov7670_parse_dt() warn: missing error code? 'ret'
--- drivers/media/i2c/ov7670.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/ov7670.c +1 -1
@@ -1750,7 +1750,7 @@ static int ov7670_parse_dt(struct device *dev,if (bus_cfg.bus_type !=V4L2_MBUS_PARALLEL ) {dev_err (dev,"Unsupported media bus type\n" ); -return ret; +return -EINVAL ; } info->mbus_config = bus_cfg.bus.parallel.flags;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 113/252 media: usb: siano: Fix use after free bugs caused by do_submit_urb
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit ebad8e731c1c06adf04621d6fd327b860c0861b5 ]
There are UAF bugs caused by do_submit_urb(). One of the KASan reports is shown below:
[ 36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890 [ 36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49 [ 36.408316] [ 36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8 [ 36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 [ 36.416157] Workqueue: 0x0 (events) [ 36.417654] Call Trace: [ 36.418546] <TASK> [ 36.419320] dump_stack_lvl+0x96/0xd0 [ 36.420522] print_address_description+0x75/0x350 [ 36.421992] print_report+0x11b/0x250 [ 36.423174] ? _raw_spin_lock_irqsave+0x87/0xd0 [ 36.424806] ? __virt_addr_valid+0xcf/0x170 [ 36.426069] ? worker_thread+0x4a2/0x890 [ 36.427355] kasan_report+0x131/0x160 [ 36.428556] ? worker_thread+0x4a2/0x890 [ 36.430053] worker_thread+0x4a2/0x890 [ 36.431297] ? worker_clr_flags+0x90/0x90 [ 36.432479] kthread+0x166/0x190 [ 36.433493] ? kthread_blkcg+0x50/0x50 [ 36.434669] ret_from_fork+0x22/0x30 [ 36.435923] </TASK> [ 36.436684] [ 36.437215] Allocated by task 24: [ 36.438289] kasan_set_track+0x50/0x80 [ 36.439436] __kasan_kmalloc+0x89/0xa0 [ 36.440566] smsusb_probe+0x374/0xc90 [ 36.441920] usb_probe_interface+0x2d1/0x4c0 [ 36.443253] really_probe+0x1d5/0x580 [ 36.444539] __driver_probe_device+0xe3/0x130 [ 36.446085] driver_probe_device+0x49/0x220 [ 36.447423] __device_attach_driver+0x19e/0x1b0 [ 36.448931] bus_for_each_drv+0xcb/0x110 [ 36.450217] __device_attach+0x132/0x1f0 [ 36.451470] bus_probe_device+0x59/0xf0 [ 36.452563] device_add+0x4ec/0x7b0 [ 36.453830] usb_set_configuration+0xc63/0xe10 [ 36.455230] usb_generic_driver_probe+0x3b/0x80 [ 36.456166] printk: console [ttyGS0] disabled [ 36.456569] usb_probe_device+0x90/0x110 [ 36.459523] really_probe+0x1d5/0x580 [ 36.461027] __driver_probe_device+0xe3/0x130 [ 36.462465] driver_probe_device+0x49/0x220 [ 36.463847] __device_attach_driver+0x19e/0x1b0 [ 36.465229] bus_for_each_drv+0xcb/0x110 [ 36.466466] __device_attach+0x132/0x1f0 [ 36.467799] bus_probe_device+0x59/0xf0 [ 36.469010] device_add+0x4ec/0x7b0 [ 36.470125] usb_new_device+0x863/0xa00 [ 36.471374] hub_event+0x18c7/0x2220 [ 36.472746] process_one_work+0x34c/0x5b0 [ 36.474041] worker_thread+0x4b7/0x890 [ 36.475216] kthread+0x166/0x190 [ 36.476267] ret_from_fork+0x22/0x30 [ 36.477447] [ 36.478160] Freed by task 24: [ 36.479239] kasan_set_track+0x50/0x80 [ 36.480512] kasan_save_free_info+0x2b/0x40 [ 36.481808] ____kasan_slab_free+0x122/0x1a0 [ 36.483173] __kmem_cache_free+0xc4/0x200 [ 36.484563] smsusb_term_device+0xcd/0xf0 [ 36.485896] smsusb_probe+0xc85/0xc90 [ 36.486976] usb_probe_interface+0x2d1/0x4c0 [ 36.488303] really_probe+0x1d5/0x580 [ 36.489498] __driver_probe_device+0xe3/0x130 [ 36.491140] driver_probe_device+0x49/0x220 [ 36.492475] __device_attach_driver+0x19e/0x1b0 [ 36.493988] bus_for_each_drv+0xcb/0x110 [ 36.495171] __device_attach+0x132/0x1f0 [ 36.496617] bus_probe_device+0x59/0xf0 [ 36.497875] device_add+0x4ec/0x7b0 [ 36.498972] usb_set_configuration+0xc63/0xe10 [ 36.500264] usb_generic_driver_probe+0x3b/0x80 [ 36.501740] usb_probe_device+0x90/0x110 [ 36.503084] really_probe+0x1d5/0x580 [ 36.504241] __driver_probe_device+0xe3/0x130 [ 36.505548] driver_probe_device+0x49/0x220 [ 36.506766] __device_attach_driver+0x19e/0x1b0 [ 36.508368] bus_for_each_drv+0xcb/0x110 [ 36.509646] __device_attach+0x132/0x1f0 [ 36.510911] bus_probe_device+0x59/0xf0 [ 36.512103] device_add+0x4ec/0x7b0 [ 36.513215] usb_new_device+0x863/0xa00 [ 36.514736] hub_event+0x18c7/0x2220 [ 36.516130] process_one_work+0x34c/0x5b0 [ 36.517396] worker_thread+0x4b7/0x890 [ 36.518591] kthread+0x166/0x190 [ 36.519599] ret_from_fork+0x22/0x30 [ 36.520851] [ 36.521405] Last potentially related work creation: [ 36.523143] kasan_save_stack+0x3f/0x60 [ 36.524275] kasan_record_aux_stack_noalloc+0x9d/0xb0 [ 36.525831] insert_work+0x25/0x130 [ 36.527039] __queue_work+0x4d4/0x620 [ 36.528236] queue_work_on+0x72/0xb0 [ 36.529344] __usb_hcd_giveback_urb+0x13f/0x1b0 [ 36.530819] dummy_timer+0x350/0x1a40 [ 36.532149] call_timer_fn+0x2c/0x190 [ 36.533567] expire_timers+0x69/0x1f0 [ 36.534736] __run_timers+0x289/0x2d0 [ 36.535841] run_timer_softirq+0x2d/0x60 [ 36.537110] __do_softirq+0x116/0x380 [ 36.538377] [ 36.538950] Second to last potentially related work creation: [ 36.540855] kasan_save_stack+0x3f/0x60 [ 36.542084] kasan_record_aux_stack_noalloc+0x9d/0xb0 [ 36.543592] insert_work+0x25/0x130 [ 36.544891] __queue_work+0x4d4/0x620 [ 36.546168] queue_work_on+0x72/0xb0 [ 36.547328] __usb_hcd_giveback_urb+0x13f/0x1b0 [ 36.548805] dummy_timer+0x350/0x1a40 [ 36.550116] call_timer_fn+0x2c/0x190 [ 36.551570] expire_timers+0x69/0x1f0 [ 36.552762] __run_timers+0x289/0x2d0 [ 36.553916] run_timer_softirq+0x2d/0x60 [ 36.555118] __do_softirq+0x116/0x380 [ 36.556239] [ 36.556807] The buggy address belongs to the object at ffff888005960000 [ 36.556807] which belongs to the cache kmalloc-4k of size 4096 [ 36.560652] The buggy address is located 232 bytes inside of [ 36.560652] 4096-byte region [ffff888005960000, ffff888005961000) [ 36.564791] [ 36.565355] The buggy address belongs to the physical page: [ 36.567212] page:000000004f0a0731 refcount:1 mapcount:0 mapping:0000000000000000 index:0x00 [ 36.570534] head:000000004f0a0731 order:3 compound_mapcount:0 subpages_mapcount:0 compound0 [ 36.573717] flags: 0x100000000010200(slab|head|node=0|zone=1) [ 36.575481] raw: 0100000000010200 ffff888001042140 dead000000000122 0000000000000000 [ 36.577842] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 36.580175] page dumped because: kasan: bad access detected [ 36.581994] [ 36.582548] Memory state around the buggy address: [ 36.583983] ffff88800595ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.586240] ffff888005960000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.588884] >ffff888005960080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.591071] ^ [ 36.593295] ffff888005960100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.595705] ffff888005960180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.598026] ================================================================== [ 36.600224] Disabling lock debugging due to kernel taint [ 36.602681] general protection fault, probably for non-canonical address 0x43600a000000060I [ 36.607129] CPU: 0 PID: 49 Comm: kworker/0:2 Tainted: G B 6.2.0-rc3-15798-8 [ 36.611115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 [ 36.615026] Workqueue: events do_submit_urb [ 36.616290] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 [ 36.618107] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 [ 36.623522] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 [ 36.625072] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 [ 36.627206] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 [ 36.629813] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f [ 36.631974] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 [ 36.634285] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 [ 36.636438] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 [ 36.639092] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.640951] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 [ 36.643411] Call Trace: [ 36.644215] <TASK> [ 36.644902] smscore_getbuffer+0x3e/0x1e0 [ 36.646147] do_submit_urb+0x4f/0x190 [ 36.647449] process_one_work+0x34c/0x5b0 [ 36.648777] worker_thread+0x4b7/0x890 [ 36.649984] ? worker_clr_flags+0x90/0x90 [ 36.651166] kthread+0x166/0x190 [ 36.652151] ? kthread_blkcg+0x50/0x50 [ 36.653547] ret_from_fork+0x22/0x30 [ 36.655051] </TASK> [ 36.655733] Modules linked in: [ 36.656787] ---[ end trace 0000000000000000 ]--- [ 36.658328] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 [ 36.660045] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 [ 36.665730] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 [ 36.667448] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 [ 36.669675] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 [ 36.672645] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f [ 36.674921] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 [ 36.677034] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 [ 36.679184] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 [ 36.681655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.683383] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 [ 36.685733] Kernel panic - not syncing: Fatal exception [ 36.688585] Kernel Offset: 0x1d400000 from 0xffffffff81000000 (relocation range: 0xfffffff) [ 36.692199] ---[ end Kernel panic - not syncing: Fatal exception ]---
When the siano device is plugged in, it may call the following functions to initialize the device.
smsusb_probe()-->smsusb_init_device()-->smscore_start_device().
When smscore_start_device() gets failed, the function smsusb_term_device() will be called and smsusb_device_t will be deallocated. Although we use usb_kill_urb() in smsusb_stop_streaming() to cancel transfer requests and wait for them to finish, the worker threads that are scheduled by smsusb_onresponse() may be still running. As a result, the UAF bugs could happen.
We add cancel_work_sync() in smsusb_stop_streaming() in order that the worker threads could finish before the smsusb_device_t is deallocated.
--- drivers/media/usb/siano/smsusb.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/usb/siano/smsusb.c +1 -0
@@ -190,6 +190,7 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)for (i =0 ; i <MAX_URBS ; i++) {usb_kill_urb (&dev->surbs[i].urb); +cancel_work_sync (&dev->surbs[i].wq);if (dev->surbs[i].cb) {smscore_putbuffer (dev->coredev, dev->surbs[i].cb);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 114/252 rpmsg: glink: Avoid infinite loop on intent for missing channel
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit 3e74ec2f39362bffbd42854acbb67c7f4cb808f9 ]
In the event that an intent advertisement arrives on an unknown channel the fifo is not advanced, resulting in the same message being handled over and over.
--- drivers/rpmsg/qcom_glink_native.c | 1 + 1 file changed, 1 insertion(+)
drivers/rpmsg/qcom_glink_native.c +1 -0
@@ -929,6 +929,7 @@ static void qcom_glink_handle_intent(struct qcom_glink *glink,spin_unlock_irqrestore (&glink->idr_lock, flags);if (!channel) {dev_err (glink->dev,"intents for non-existing channel\n" ); +qcom_glink_rx_advance (glink,ALIGN (msglen,8 ));return ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 115/252 udf: Define EFSCORRUPTED error code
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 3d2d7e61553dbcc8ba45201d8ae4f383742c8202 ]
Similarly to other filesystems define EFSCORRUPTED error code for reporting internal filesystem corruption.
--- fs/udf/udf_sb.h | 2 ++ 1 file changed, 2 insertions(+)
fs/udf/udf_sb.h +2 -0
@@ -57,6 +57,8 @@#define MF_DUPLICATE_MD 0x01#define MF_MIRROR_FE_LOADED 0x02 +#define EFSCORRUPTED EUCLEAN +struct udf_meta_data {__u32 s_meta_file_loc;__u32 s_mirror_file_loc;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 116/252 ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
In reply to Greg Kroah-HartmanFrom: Markuss Broks <[email protected]>
[ Upstream commit 5d5aa219a790d61cad2c38e1aa32058f16ad2f0b ]
For some reason, the driver adding support for Exynos5420 MIPI phy back in 2016 wasn't used on Exynos5420, which caused a kernel panic. Add the proper compatible for it.
--- arch/arm/boot/dts/exynos5420.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos5420.dtsi +1 -1
@@ -530,7 +530,7 @@ dp_phy: dp-video-phy { }; mipi_phy: mipi-video-phy { - compatible = "samsung,s5pv210-mipi-video-phy"; + compatible = "samsung,exynos5420-mipi-video-phy"; syscon = <&pmu_system_controller>; #phy-cells = <1>; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 117/252 wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
In reply to Greg Kroah-HartmanFrom: Jisoo Jang <[email protected]>
[ Upstream commit 0a06cadcc2a0044e4a117cc0e61436fc3a0dad69 ]
This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware version string by memcpy() in brcmf_fil_iovar_data_get().
The patch ensures buf is null-terminated.
Found by a modified version of syzkaller.
[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3 [ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 47.601565][ T1897] ================================================================== [ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0 [ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897 [ 47.604336][ T1897] [ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131 [ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event [ 47.607453][ T1897] Call Trace: [ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1 [ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334 [ 47.609009][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609434][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609863][ T1897] kasan_report.cold+0x83/0xdf [ 47.610366][ T1897] ? strsep+0x1b2/0x1f0 [ 47.610882][ T1897] strsep+0x1b2/0x1f0 [ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0 [ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40 [ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100 [ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0 [ 47.614704][ T1897] ? find_held_lock+0x2d/0x110 [ 47.615236][ T1897] ? brcmf_usb_deq+0x1a7/0x260 [ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0 [ 47.616288][ T1897] brcmf_attach+0x246/0xd40 [ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0 [ 47.617280][ T1897] ? kmemdup+0x43/0x50 [ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690 [ 47.618244][ T1897] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 [ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760 [ 47.619429][ T1897] ? usb_probe_device+0x250/0x250 [ 47.619950][ T1897] really_probe+0x205/0xb70 [ 47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.621048][ T1897] __driver_probe_device+0x311/0x4b0 [ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.622209][ T1897] driver_probe_device+0x4e/0x150 [ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0 [ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0 [ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30 [ 47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.624907][ T1897] ? trace_hardirqs_on+0x46/0x160 [ 47.625437][ T1897] __device_attach+0x23f/0x3a0 [ 47.625924][ T1897] ? device_bind_driver+0xd0/0xd0 [ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0 [ 47.627057][ T1897] bus_probe_device+0x1da/0x290 [ 47.627557][ T1897] device_add+0xb7b/0x1eb0 [ 47.628027][ T1897] ? wait_for_completion+0x290/0x290 [ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 [ 47.629249][ T1897] usb_set_configuration+0xf59/0x16f0 [ 47.629829][ T1897] usb_generic_driver_probe+0x82/0xa0 [ 47.630385][ T1897] usb_probe_device+0xbb/0x250 [ 47.630927][ T1897] ? usb_suspend+0x590/0x590 [ 47.631397][ T1897] really_probe+0x205/0xb70 [ 47.631855][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0 [ 47.633002][ T1897] ? usb_generic_driver_match+0x75/0x90 [ 47.633573][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.634170][ T1897] driver_probe_device+0x4e/0x150 [ 47.634703][ T1897] __device_attach_driver+0x1cc/0x2a0 [ 47.635248][ T1897] bus_for_each_drv+0x156/0x1d0 [ 47.635748][ T1897] ? bus_rescan_devices+0x30/0x30 [ 47.636271][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.636881][ T1897] ? trace_hardirqs_on+0x46/0x160 [ 47.637396][ T1897] __device_attach+0x23f/0x3a0 [ 47.637904][ T1897] ? device_bind_driver+0xd0/0xd0 [ 47.638426][ T1897] ? kobject_uevent_env+0x287/0x14b0 [ 47.638985][ T1897] bus_probe_device+0x1da/0x290 [ 47.639512][ T1897] device_add+0xb7b/0x1eb0 [ 47.639977][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 [ 47.640612][ T1897] ? kfree+0x14a/0x6b0 [ 47.641055][ T1897] ? __usb_get_extra_descriptor+0x116/0x160 [ 47.641679][ T1897] usb_new_device.cold+0x49c/0x1029 [ 47.642245][ T1897] ? hub_disconnect+0x450/0x450 [ 47.642756][ T1897] ? rwlock_bug.part.0+0x90/0x90 [ 47.643273][ T1897] ? _raw_spin_unlock_irq+0x24/0x30 [ 47.643822][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.644445][ T1897] hub_event+0x1c98/0x3950 [ 47.644939][ T1897] ? hub_port_debounce+0x2e0/0x2e0 [ 47.645467][ T1897] ? check_irq_usage+0x861/0xf20 [ 47.645975][ T1897] ? drain_workqueue+0x280/0x360 [ 47.646506][ T1897] ? lock_release+0x640/0x640 [ 47.646994][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 47.647572][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 47.648111][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.648735][ T1897] process_one_work+0x92b/0x1460 [ 47.649262][ T1897] ? pwq_dec_nr_in_flight+0x330/0x330 [ 47.649816][ T1897] ? rwlock_bug.part.0+0x90/0x90 [ 47.650336][ T1897] worker_thread+0x95/0xe00 [ 47.650830][ T1897] ? __kthread_parkme+0x115/0x1e0 [ 47.651361][ T1897] ? process_one_work+0x1460/0x1460 [ 47.651904][ T1897] kthread+0x3a1/0x480 [ 47.652329][ T1897] ? set_kthread_struct+0x120/0x120 [ 47.652878][ T1897] ret_from_fork+0x1f/0x30 [ 47.653370][ T1897] [ 47.653608][ T1897] [ 47.653848][ T1897] addr ffffc90001f6f000 is located in stack of task kworker/0:2/1897 at offset 512 in frame: [ 47.654891][ T1897] brcmf_c_preinit_dcmds+0x0/0xc40 [ 47.655442][ T1897] [ 47.655690][ T1897] this frame has 4 objects: [ 47.656151][ T1897] [48, 56) 'ptr' [ 47.656159][ T1897] [80, 148) 'revinfo' [ 47.656534][ T1897] [192, 210) 'eventmask' [ 47.656953][ T1897] [256, 512) 'buf' [ 47.657410][ T1897] [ 47.658035][ T1897] Memory state around the buggy address: [ 47.658743][ T1897] ffffc90001f6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.659577][ T1897] ffffc90001f6ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.660394][ T1897] >ffffc90001f6f000: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 [ 47.661199][ T1897] ^ [ 47.661625][ T1897] ffffc90001f6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.662455][ T1897] ffffc90001f6f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 [ 47.663318][ T1897] ================================================================== [ 47.664147][ T1897] Disabling lock debugging due to kernel taint
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +1 -0
@@ -273,6 +273,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp) err); goto done; } + buf[sizeof (buf) -1 ] ='\0' ; ptr = (char *)buf;strsep (&ptr,"\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 118/252 rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
In reply to Greg Kroah-HartmanFrom: Paul E. McKenney <[email protected]>
[ Upstream commit 2d7f00b2f01301d6e41fd4a28030dab0442265be ]
The normal grace period's RCU CPU stall warnings are invoked from the scheduling-clock interrupt handler, and can thus invoke smp_processor_id() with impunity, which allows them to directly invoke dump_cpu_task(). In contrast, the expedited grace period's RCU CPU stall warnings are invoked from process context, which causes the dump_cpu_task() function's calls to smp_processor_id() to complain bitterly in debug kernels.
This commit therefore causes synchronize_rcu_expedited_wait() to disable preemption around its call to dump_cpu_task().
--- kernel/rcu/tree_exp.h | 2 ++ 1 file changed, 2 insertions(+)
kernel/rcu/tree_exp.h +2 -0
@@ -577,7 +577,9 @@ static void synchronize_sched_expedited_wait(struct rcu_state *rsp) mask =leaf_node_cpu_bit (rnp, cpu);if (!(rnp->expmask & mask))continue ; +preempt_disable ();// For smp_processor_id() in dump_cpu_task(). dump_cpu_task (cpu); +preempt_enable (); } } jiffies_stall =3 *rcu_jiffies_till_stall_check () +3 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 119/252 thermal: intel: Fix unsigned comparison with less than zero
In reply to Greg Kroah-HartmanFrom: Yang Li <[email protected]>
[ Upstream commit e7fcfe67f9f410736b758969477b17ea285e8e6c ]
The return value from the call to intel_tcc_get_tjmax() is int, which can be a negative error code. However, the return value is being assigned to an u32 variable 'tj_max', so making 'tj_max' an int.
Eliminate the following warning:
./drivers/thermal/intel/intel_soc_dts_iosf.c:394:5-11: WARNING: Unsigned expression compared with zero: tj_max < 0
--- drivers/thermal/intel_soc_dts_iosf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thermal/intel_soc_dts_iosf.c +1 -1
@@ -405,7 +405,7 @@ struct intel_soc_dts_sensors *intel_soc_dts_iosf_init( {struct intel_soc_dts_sensors *sensors;bool notification; -u32 tj_max; +int tj_max;int ret;int i;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 120/252 timers: Prevent union confusion from unexpected restart_syscall()
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
[ Upstream commit 9f76d59173d9d146e96c66886b671c1915a5c5e5 ]
The nanosleep syscalls use the restart_block mechanism, with a quirk:
The type and rmtp/compat_rmtp fields are set up unconditionally on syscall entry, while the rest of the restart_block is only set up in the unlikely case that the syscall is actually interrupted by a signal (or pseudo-signal) that doesn't have a signal handler.
If the restart_block was set up by a previous syscall (futex(..., FUTEX_WAIT, ...) or poll()) and hasn't been invalidated somehow since then, this will clobber some of the union fields used by futex_wait_restart() and do_restart_poll().
If userspace afterwards wrongly calls the restart_syscall syscall, futex_wait_restart()/do_restart_poll() will read struct fields that have been clobbered.
This doesn't actually lead to anything particularly interesting because none of the union fields contain trusted kernel data, and futex(..., FUTEX_WAIT, ...) and poll() aren't syscalls where it makes much sense to apply seccomp filters to their arguments.
So the current consequences are just of the "if userspace does bad stuff, it can damage itself, and that's not a problem" flavor.
But still, it seems like a hazard for future developers, so invalidate the restart_block when partly setting it up in the nanosleep syscalls.
--- kernel/time/hrtimer.c | 2 ++ kernel/time/posix-stubs.c | 2 ++ kernel/time/posix-timers.c | 2 ++ 3 files changed, 6 insertions(+)
kernel/time/hrtimer.c +2 -0
@@ -1838,6 +1838,7 @@ SYSCALL_DEFINE2(nanosleep, struct __kernel_timespec __user *, rqtp,if (!timespec64_valid (&tu))return -EINVAL ; + current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ?TT_NATIVE :TT_NONE ; current->restart_block.nanosleep.rmtp = rmtp;return hrtimer_nanosleep (&tu,HRTIMER_MODE_REL ,CLOCK_MONOTONIC );
@@ -1858,6 +1859,7 @@ COMPAT_SYSCALL_DEFINE2(nanosleep, struct compat_timespec __user *, rqtp,if (!timespec64_valid (&tu))return -EINVAL ; + current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ?TT_COMPAT :TT_NONE ; current->restart_block.nanosleep.compat_rmtp = rmtp;return hrtimer_nanosleep (&tu,HRTIMER_MODE_REL ,CLOCK_MONOTONIC );
kernel/time/posix-stubs.c +2 -0
@@ -144,6 +144,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,return -EINVAL ;if (flags &TIMER_ABSTIME ) rmtp =NULL ; + current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ?TT_NATIVE :TT_NONE ; current->restart_block.nanosleep.rmtp = rmtp; return hrtimer_nanosleep(&t, flags & TIMER_ABSTIME ?
@@ -230,6 +231,7 @@ COMPAT_SYSCALL_DEFINE4(clock_nanosleep, clockid_t, which_clock, int, flags,return -EINVAL ;if (flags &TIMER_ABSTIME ) rmtp =NULL ; + current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ?TT_COMPAT :TT_NONE ; current->restart_block.nanosleep.compat_rmtp = rmtp; return hrtimer_nanosleep(&t, flags & TIMER_ABSTIME ?
kernel/time/posix-timers.c +2 -0
@@ -1225,6 +1225,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,return -EINVAL ;if (flags &TIMER_ABSTIME ) rmtp =NULL ; + current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ?TT_NATIVE :TT_NONE ; current->restart_block.nanosleep.rmtp = rmtp;
@@ -1252,6 +1253,7 @@ COMPAT_SYSCALL_DEFINE4(clock_nanosleep, clockid_t, which_clock, int, flags,return -EINVAL ;if (flags &TIMER_ABSTIME ) rmtp =NULL ; + current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ?TT_COMPAT :TT_NONE ; current->restart_block.nanosleep.compat_rmtp = rmtp;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 121/252 x86/bugs: Reset speculation control settings on init
In reply to Greg Kroah-HartmanFrom: Breno Leitao <[email protected]>
[ Upstream commit 0125acda7d76b943ca55811df40ed6ec0ecf670f ]
Currently, x86_spec_ctrl_base is read at boot time and speculative bits are set if Kconfig items are enabled. For example, IBRS is enabled if CONFIG_CPU_IBRS_ENTRY is configured, etc. These MSR bits are not cleared if the mitigations are disabled.
This is a problem when kexec-ing a kernel that has the mitigation disabled from a kernel that has the mitigation enabled. In this case, the MSR bits are not cleared during the new kernel boot. As a result, this might have some performance degradation that is hard to pinpoint.
This problem does not happen if the machine is (hard) rebooted because the bit will be cleared by default.
[ bp: Massage. ]
--- arch/x86/include/asm/msr-index.h | 4 ++++ arch/x86/kernel/cpu/bugs.c | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletion(-)
arch/x86/include/asm/msr-index.h +4 -0
@@ -50,6 +50,10 @@#define SPEC_CTRL_RRSBA_DIS_S_SHIFT 6/* Disable RRSBA behavior */ #define SPEC_CTRL_RRSBA_DIS_S BIT(SPEC_CTRL_RRSBA_DIS_S_SHIFT) +/* A mask for bits which the kernel toggles when controlling mitigations */ +#define SPEC_CTRL_MITIGATIONS_MASK (SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD \ + | SPEC_CTRL_RRSBA_DIS_S) +#define MSR_IA32_PRED_CMD 0x00000049/* Prediction Command */ #define PRED_CMD_IBPB BIT(0)/* Indirect Branch Prediction Barrier */
arch/x86/kernel/cpu/bugs.c +9 -1
@@ -135,9 +135,17 @@ void __init check_bugs(void)* have unknown values. AMD64_LS_CFG MSR is cached in the early AMD * init code as it is not enumerated and depends on the family. */ -if (boot_cpu_has (X86_FEATURE_MSR_SPEC_CTRL )) +if (cpu_feature_enabled (X86_FEATURE_MSR_SPEC_CTRL )) {rdmsrl (MSR_IA32_SPEC_CTRL , x86_spec_ctrl_base); +/* +* Previously running kernel (kexec), may have some controls +* turned ON. Clear them and let the mitigations setup below +* rediscover them based on configuration. +*/ + x86_spec_ctrl_base &= ~SPEC_CTRL_MITIGATIONS_MASK ; + } +/* Select the proper CPU mitigations before patching alternatives: */ spectre_v1_select_mitigation ();spectre_v2_select_mitigation ();
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 122/252 wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
In reply to Greg Kroah-HartmanFrom: Jisoo Jang <[email protected]>
[ Upstream commit 660145d708be52f946a82e5b633c020f58f996de ]
Fix a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with a CLM version string by memcpy() in brcmf_fil_iovar_data_get(). Ensure buf is null-terminated.
Found by a modified version of syzkaller.
[ 33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42 version 5.90.188.22 [ 33.021554][ T1896] ================================================================== [ 33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110 [ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896 [ 33.023852][ T1896] [ 33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132 [ 33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 33.026065][ T1896] Workqueue: usb_hub_wq hub_event [ 33.026581][ T1896] Call Trace: [ 33.026896][ T1896] dump_stack_lvl+0x57/0x7d [ 33.027372][ T1896] print_address_description.constprop.0.cold+0xf/0x334 [ 33.028037][ T1896] ? strreplace+0xf2/0x110 [ 33.028403][ T1896] ? strreplace+0xf2/0x110 [ 33.028807][ T1896] kasan_report.cold+0x83/0xdf [ 33.029283][ T1896] ? strreplace+0xf2/0x110 [ 33.029666][ T1896] strreplace+0xf2/0x110 [ 33.029966][ T1896] brcmf_c_preinit_dcmds+0xab1/0xc40 [ 33.030351][ T1896] ? brcmf_c_set_joinpref_default+0x100/0x100 [ 33.030787][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 33.031223][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 33.031661][ T1896] ? lock_acquire+0x19d/0x4e0 [ 33.032091][ T1896] ? find_held_lock+0x2d/0x110 [ 33.032605][ T1896] ? brcmf_usb_deq+0x1a7/0x260 [ 33.033087][ T1896] ? brcmf_usb_rx_fill_all+0x5a/0xf0 [ 33.033582][ T1896] brcmf_attach+0x246/0xd40 [ 33.034022][ T1896] ? wiphy_new_nm+0x1476/0x1d50 [ 33.034383][ T1896] ? kmemdup+0x30/0x40 [ 33.034722][ T1896] brcmf_usb_probe+0x12de/0x1690 [ 33.035223][ T1896] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 [ 33.035833][ T1896] usb_probe_interface+0x25f/0x710 [ 33.036315][ T1896] really_probe+0x1be/0xa90 [ 33.036656][ T1896] __driver_probe_device+0x2ab/0x460 [ 33.037026][ T1896] ? usb_match_id.part.0+0x88/0xc0 [ 33.037383][ T1896] driver_probe_device+0x49/0x120 [ 33.037790][ T1896] __device_attach_driver+0x18a/0x250 [ 33.038300][ T1896] ? driver_allows_async_probing+0x120/0x120 [ 33.038986][ T1896] bus_for_each_drv+0x123/0x1a0 [ 33.039906][ T1896] ? bus_rescan_devices+0x20/0x20 [ 33.041412][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 33.041861][ T1896] ? trace_hardirqs_on+0x1c/0x120 [ 33.042330][ T1896] __device_attach+0x207/0x330 [ 33.042664][ T1896] ? device_bind_driver+0xb0/0xb0 [ 33.043026][ T1896] ? kobject_uevent_env+0x230/0x12c0 [ 33.043515][ T1896] bus_probe_device+0x1a2/0x260 [ 33.043914][ T1896] device_add+0xa61/0x1ce0 [ 33.044227][ T1896] ? __mutex_unlock_slowpath+0xe7/0x660 [ 33.044891][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550 [ 33.045531][ T1896] usb_set_configuration+0x984/0x1770 [ 33.046051][ T1896] ? kernfs_create_link+0x175/0x230 [ 33.046548][ T1896] usb_generic_driver_probe+0x69/0x90 [ 33.046931][ T1896] usb_probe_device+0x9c/0x220 [ 33.047434][ T1896] really_probe+0x1be/0xa90 [ 33.047760][ T1896] __driver_probe_device+0x2ab/0x460 [ 33.048134][ T1896] driver_probe_device+0x49/0x120 [ 33.048516][ T1896] __device_attach_driver+0x18a/0x250 [ 33.048910][ T1896] ? driver_allows_async_probing+0x120/0x120 [ 33.049437][ T1896] bus_for_each_drv+0x123/0x1a0 [ 33.049814][ T1896] ? bus_rescan_devices+0x20/0x20 [ 33.050164][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 33.050579][ T1896] ? trace_hardirqs_on+0x1c/0x120 [ 33.050936][ T1896] __device_attach+0x207/0x330 [ 33.051399][ T1896] ? device_bind_driver+0xb0/0xb0 [ 33.051888][ T1896] ? kobject_uevent_env+0x230/0x12c0 [ 33.052314][ T1896] bus_probe_device+0x1a2/0x260 [ 33.052688][ T1896] device_add+0xa61/0x1ce0 [ 33.053121][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550 [ 33.053568][ T1896] usb_new_device.cold+0x463/0xf66 [ 33.053953][ T1896] ? hub_disconnect+0x400/0x400 [ 33.054313][ T1896] ? rwlock_bug.part.0+0x90/0x90 [ 33.054661][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 33.055094][ T1896] hub_event+0x10d5/0x3330 [ 33.055530][ T1896] ? hub_port_debounce+0x280/0x280 [ 33.055934][ T1896] ? __lock_acquire+0x1671/0x5790 [ 33.056387][ T1896] ? wq_calc_node_cpumask+0x170/0x2a0 [ 33.056924][ T1896] ? lock_release+0x640/0x640 [ 33.057383][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 33.057916][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 33.058402][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 33.059019][ T1896] process_one_work+0x873/0x13e0 [ 33.059488][ T1896] ? lock_release+0x640/0x640 [ 33.059932][ T1896] ? pwq_dec_nr_in_flight+0x320/0x320 [ 33.060446][ T1896] ? rwlock_bug.part.0+0x90/0x90 [ 33.060898][ T1896] worker_thread+0x8b/0xd10 [ 33.061348][ T1896] ? __kthread_parkme+0xd9/0x1d0 [ 33.061810][ T1896] ? process_one_work+0x13e0/0x13e0 [ 33.062288][ T1896] kthread+0x379/0x450 [ 33.062660][ T1896] ? _raw_spin_unlock_irq+0x24/0x30 [ 33.063148][ T1896] ? set_kthread_struct+0x100/0x100 [ 33.063606][ T1896] ret_from_fork+0x1f/0x30 [ 33.064070][ T1896] [ 33.064313][ T1896] [ 33.064545][ T1896] addr ffffc90001d6efc8 is located in stack of task kworker/0:2/1896 at offset 512 in frame: [ 33.065478][ T1896] brcmf_c_preinit_dcmds+0x0/0xc40 [ 33.065973][ T1896] [ 33.066191][ T1896] this frame has 4 objects: [ 33.066614][ T1896] [48, 56) 'ptr' [ 33.066618][ T1896] [80, 148) 'revinfo' [ 33.066957][ T1896] [192, 210) 'eventmask' [ 33.067338][ T1896] [256, 512) 'buf' [ 33.067742][ T1896] [ 33.068304][ T1896] Memory state around the buggy address: [ 33.068838][ T1896] ffffc90001d6ee80: f2 00 00 02 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 [ 33.069545][ T1896] ffffc90001d6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.070626][ T1896] >ffffc90001d6ef80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 [ 33.072052][ T1896] ^ [ 33.073043][ T1896] ffffc90001d6f000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.074230][ T1896] ffffc90001d6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.074914][ T1896] ================================================================== [ 33.075713][ T1896] Disabling lock debugging due to kernel taint
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +4 -2
@@ -290,15 +290,17 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)if (err) {brcmf_dbg (TRACE ,"retrieving clmver failed, %d\n" , err); }else { + buf[sizeof (buf) -1 ] ='\0' ; clmver = (char *)buf; -/* store CLM version for adding it to revinfo debugfs file */ -memcpy (ifp->drvr->clmver, clmver,sizeof (ifp->drvr->clmver));/* Replace all newline/linefeed characters with space * character */ strreplace (clmver,'\n' ,' ' ); +/* store CLM version for adding it to revinfo debugfs file */ +memcpy (ifp->drvr->clmver, clmver,sizeof (ifp->drvr->clmver)); +brcmf_dbg (INFO ,"CLM version = %s\n" , clmver); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 123/252 inet: fix fast path in __inet_hash_connect()
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 21cbd90a6fab7123905386985e3e4a80236b8714 ]
__inet_hash_connect() has a fast path taken if sk_head(&tb->owners) is equal to the sk parameter.sk_head() returns the hlist_entry() with respect to the sk_node field. However entries in the tb->owners list are inserted with respect to the sk_bind_node field with sk_add_bind_node().
Thus the check would never pass and the fast path never execute.
This fast path has never been executed or tested as this bug seems to be present since commit 1da177e4c3f4 ("Linux-2.6.12-rc2"), thus remove it to reduce code complexity.
--- net/ipv4/inet_hashtables.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
net/ipv4/inet_hashtables.c +1 -11
@@ -756,17 +756,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,u32 index;if (port) { - head = &hinfo->bhash[inet_bhashfn (net, port, - hinfo->bhash_size)]; - tb =inet_csk (sk)->icsk_bind_hash; -spin_lock_bh (&head->lock); -if (sk_head (&tb->owners) == sk && !sk->sk_bind_node.next) { -inet_ehash_nolisten (sk,NULL ,NULL ); -spin_unlock_bh (&head->lock); -return 0 ; - } -spin_unlock (&head->lock); -/* No definite answer... Walk to established hash table */ +local_bh_disable (); ret =check_established (death_row, sk, port,NULL );local_bh_enable ();return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 124/252 ACPI: Dont build ACPICA with -Os
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit 8f9e0a52810dd83406c768972d022c37e7a18f1f ]
The ACPICA code has been built with '-Os' since the beginning of git history, though there's no explanatory comment as to why.
This is unfortunate as GCC drops the alignment specificed by '-falign-functions=N' when '-Os' is used, as reported in GCC bug 88345:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345
This prevents CONFIG_FUNCTION_ALIGNMENT and CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B from having their expected effect on the ACPICA code. This is doubly unfortunate as in subsequent patches arm64 will depend upon CONFIG_FUNCTION_ALIGNMENT for its ftrace implementation.
Drop the '-Os' flag when building the ACPICA code. With this removed, the code builds cleanly and works correctly in testing so far.
I've tested this by selecting CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y, building and booting a kernel using ACPI, and looking for misaligned text symbols:
* arm64:
Before, v6.2-rc3:
# uname -rm
6.2.0-rc3 aarch64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
5009 Before, v6.2-rc3 + fixed __cold:
# uname -rm
6.2.0-rc3-00001-g2a2bedf8bfa9 aarch64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
919After:
# uname -rm
6.2.0-rc3-00002-g267bddc38572 aarch64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
323
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l
0* x86_64:
Before, v6.2-rc3:
# uname -rm
6.2.0-rc3 x86_64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
11537 Before, v6.2-rc3 + fixed __cold:
# uname -rm
6.2.0-rc3-00001-g2a2bedf8bfa9 x86_64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
2805After:
# uname -rm
6.2.0-rc3-00002-g267bddc38572 x86_64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
1357
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l
0With the patch applied, the remaining unaligned text labels are a combination of static call trampolines and labels in assembly, which can be dealt with in subsequent patches.
--- drivers/acpi/acpica/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpica/Makefile +1 -1
@@ -3,7 +3,7 @@ # Makefile for ACPICA Core interpreter # -ccflags-y := -Os -D_LINUX -DBUILDING_ACPICA +ccflags-y := -D_LINUX -DBUILDING_ACPICA ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT # use acpi.o to put all files here into acpi.o modparam namespace
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 125/252 net: bcmgenet: Add a check for oversized packets
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 5c0862c2c962052ed5055220a00ac1cefb92fbcd ]
Occasionnaly we may get oversized packets from the hardware which exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early check which drops the packet to avoid invoking skb_over_panic() and move on to processing the next packet.
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +8 -0
@@ -1825,6 +1825,14 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring, __func__, p_index, ring->c_index, ring->read_ptr, dma_length_status); +if (unlikely (len >RX_BUF_LENGTH )) { +netif_err (priv, rx_status, dev,"oversized packet\n" ); + dev->stats.rx_length_errors++; + dev->stats.rx_errors++; +dev_kfree_skb_any (skb); + goto next; + } +if (unlikely (!(dma_flag &DMA_EOP ) || !(dma_flag &DMA_SOP ))) {netif_err (priv, rx_status, dev,"dropping fragmented packet!\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 126/252 m68k: Check syscall_trace_enter() return code
In reply to Greg Kroah-HartmanFrom: Michael Schmitz <[email protected]>
[ Upstream commit 2ca8a1de4437f21562e57f9ac123914747a8e7a1 ]
Check return code of syscall_trace_enter(), and skip syscall if -1. Return code will be left at what had been set by ptrace or seccomp (in regs->d0).
No regression seen in testing with strace on ARAnyM.
--- arch/m68k/68000/entry.S | 2 ++ arch/m68k/coldfire/entry.S | 2 ++ arch/m68k/kernel/entry.S | 3 +++ 3 files changed, 7 insertions(+)
arch/m68k/68000/entry.S +2 -0
@@ -47,6 +47,8 @@ do_trace: jbsr syscall_trace_enter RESTORE_SWITCH_STACK addql #4,%sp + addql #1,%d0 + jeq ret_from_exception movel %sp@(PT_OFF_ORIG_D0),%d1 movel #-ENOSYS,%d0 cmpl #NR_syscalls,%d1
arch/m68k/coldfire/entry.S +2 -0
@@ -92,6 +92,8 @@ ENTRY(system_call) jbsr syscall_trace_enter RESTORE_SWITCH_STACK addql #4,%sp + addql #1,%d0 + jeq ret_from_exception movel %d3,%a0 jbsr %a0@ movel %d0,%sp@(PT_OFF_D0) /* save the return value */
arch/m68k/kernel/entry.S +3 -0
@@ -160,9 +160,12 @@ do_trace_entry: jbsr syscall_trace RESTORE_SWITCH_STACK addql #4,%sp + addql #1,%d0 | optimization for cmpil #-1,%d0 + jeq ret_from_syscall movel %sp@(PT_OFF_ORIG_D0),%d0 cmpl #NR_syscalls,%d0 jcs syscall + jra ret_from_syscall badsys: movel #-ENOSYS,%sp@(PT_OFF_D0) jra ret_from_syscall
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 127/252 ACPI: video: Fix Lenovo Ideapad Z570 DMI match
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 2d11eae42d52a131f06061015e49dc0f085c5bfc ]
Multiple Ideapad Z570 variants need acpi_backlight=native to force native use on these pre Windows 8 machines since acpi_video backlight control does not work here.
The original DMI quirk matches on a product_name of "102434U" but other variants may have different product_name-s such as e.g. "1024D9U".
Move to checking product_version instead as is more or less standard for Lenovo DMI quirks for similar reasons.
--- drivers/acpi/video_detect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/video_detect.c +1 -1
@@ -300,7 +300,7 @@ static const struct dmi_system_id video_detect_dmi_table[] = { .ident = "Lenovo Ideapad Z570", .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), - DMI_MATCH(DMI_PRODUCT_NAME, "102434U"), + DMI_MATCH(DMI_PRODUCT_VERSION, "Ideapad Z570"), }, }, {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 128/252 net/mlx5: fw_tracer: Fix debug print
In reply to Greg Kroah-HartmanFrom: Shay Drory <[email protected]>
[ Upstream commit 988c2352273997a242f15c4fc3711773515006a2 ]
The debug message specify tdsn, but takes as an argument the tmsn. The correct argument is tmsn, hence, fix the print.
--- drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +1 -1
@@ -564,7 +564,7 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer, }else { cur_string =mlx5_tracer_message_get (tracer, tracer_event);if (!cur_string) { -pr_debug ("%s Got string event for unknown string tdsm: %d\n" , +pr_debug ("%s Got string event for unknown string tmsn: %d\n" , __func__, tracer_event->string_event.tmsn);return -1 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 129/252 drm/amd/display: Fix potential null-deref in dm_resume
In reply to Greg Kroah-HartmanFrom: Roman Li <[email protected]>
[ Upstream commit 7a7175a2cd84b7874bebbf8e59f134557a34161b ]
[Why]
Fixing smatch error:dm_resume() error: we previously assumed 'aconnector->dc_link' could be null
[How]
Check if dc_link null at the beginning of the loop, so further checks can be dropped.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +4 -2
@@ -773,12 +773,14 @@ static int dm_resume(void *handle)list_for_each_entry (connector, &ddev->mode_config.connector_list, head) { aconnector =to_amdgpu_dm_connector (connector); +if (!aconnector->dc_link) +continue ; +/* * this is the case when traversing through already created * MST connectors, should be skipped */ -if (aconnector->dc_link && - aconnector->dc_link->type == dc_connection_mst_branch) +if (aconnector->dc_link->type == dc_connection_mst_branch)continue ;mutex_lock (&aconnector->hpd_lock);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 130/252 drm/radeon: free iio for atombios when driver shutdown
In reply to Greg Kroah-HartmanFrom: Liwei Song <[email protected]>
[ Upstream commit 4773fadedca918faec443daaca5e4ea1c0ced144 ]
Fix below kmemleak when unload radeon driver:
unreferenced object 0xffff9f8608ede200 (size 512):
comm "systemd-udevd", pid 326, jiffies 4294682822 (age 716.338s) hex dump (first 32 bytes):
00 00 00 00 c4 aa ec aa 14 ab 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000062fadebe>] kmem_cache_alloc_trace+0x2f1/0x500
[<00000000b6883cea>] atom_parse+0x117/0x230 [radeon]
[<00000000158c23fd>] radeon_atombios_init+0xab/0x170 [radeon]
[<00000000683f672e>] si_init+0x57/0x750 [radeon]
[<00000000566cc31f>] radeon_device_init+0x559/0x9c0 [radeon]
[<0000000046efabb3>] radeon_driver_load_kms+0xc1/0x1a0 [radeon]
[<00000000b5155064>] drm_dev_register+0xdd/0x1d0
[<0000000045fec835>] radeon_pci_probe+0xbd/0x100 [radeon]
[<00000000e69ecca3>] pci_device_probe+0xe1/0x160
[<0000000019484b76>] really_probe.part.0+0xc1/0x2c0
[<000000003f2649da>] __driver_probe_device+0x96/0x130
[<00000000231c5bb1>] driver_probe_device+0x24/0xf0
[<0000000000a42377>] __driver_attach+0x77/0x190
[<00000000d7574da6>] bus_for_each_dev+0x7f/0xd0
[<00000000633166d2>] driver_attach+0x1e/0x30
[<00000000313b05b8>] bus_add_driver+0x12c/0x1e0iio was allocated in atom_index_iio() called by atom_parse(), but it doesn't got released when the dirver is shutdown. Fix this kmemleak by free it in radeon_atombios_fini().
--- drivers/gpu/drm/radeon/radeon_device.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/radeon_device.c +1 -0
@@ -1015,6 +1015,7 @@ void radeon_atombios_fini(struct radeon_device *rdev) {if (rdev->mode_info.atom_context) {kfree (rdev->mode_info.atom_context->scratch); +kfree (rdev->mode_info.atom_context->iio); }kfree (rdev->mode_info.atom_context); rdev->mode_info.atom_context =NULL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 131/252 drm/msm/dsi: Add missing check for alloc_ordered_workqueue
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 115906ca7b535afb1fe7b5406c566ccd3873f82b ]
Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference.
Patchwork: https://patchwork.freedesktop.org/patch/517646/
--- drivers/gpu/drm/msm/dsi/dsi_host.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/msm/dsi/dsi_host.c +3 -0
@@ -1883,6 +1883,9 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi)/* setup workqueue */ msm_host->workqueue =alloc_ordered_workqueue ("dsi_drm_work" ,0 ); +if (!msm_host->workqueue) +return -ENOMEM ; +INIT_WORK (&msm_host->err_work, dsi_err_worker);INIT_WORK (&msm_host->hpd_work, dsi_hpd_worker);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 132/252 docs/scripts/gdb: add necessary make scripts_gdb step
In reply to Greg Kroah-HartmanFrom: Jakob Koschel <[email protected]>
[ Upstream commit 6b219431037bf98c9efd49716aea9b68440477a3 ]
In order to debug the kernel successfully with gdb you need to run 'make scripts_gdb' nowadays.
This was changed with the following commit:
Commit 67274c083438340ad16c ("scripts/gdb: delay generation of gdb constants.py")
In order to have a complete guide for beginners this remark should be added to the offial documentation.
--- Documentation/dev-tools/gdb-kernel-debugging.rst | 4 ++++ 1 file changed, 4 insertions(+)
Documentation/dev-tools/gdb-kernel-debugging.rst +4 -0
@@ -39,6 +39,10 @@ Setup this mode. In this case, you should build the kernel with CONFIG_RANDOMIZE_BASE disabled if the architecture supports KASLR. +- Build the gdb scripts (required on kernels v5.1 and above):: + + make scripts_gdb + - Enable the gdb stub of QEMU/KVM, either - at VM startup time by appending "-s" to the QEMU command line
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 133/252 ASoC: kirkwood: Iterate over array indexes instead of using pointer math
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit b3bcedc0402fcdc5c8624c433562d9d1882749d8 ]
Walking the dram->cs array was seen as accesses beyond the first array item by the compiler. Instead, use the array index directly. This allows for run-time bounds checking under CONFIG_UBSAN_BOUNDS as well. Seen with GCC 13 with -fstrict-flex-arrays:
../sound/soc/kirkwood/kirkwood-dma.c: In function
'kirkwood_dma_conf_mbus_windows.constprop':../sound/soc/kirkwood/kirkwood-dma.c:90:24: warning: array subscript 0 is outside array bounds of 'const struct mbus_dram_window[0]' [-Warray-bounds=]
90 | if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) {
| ~~^~~~~~--- sound/soc/kirkwood/kirkwood-dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/kirkwood/kirkwood-dma.c +1 -1
@@ -90,7 +90,7 @@ kirkwood_dma_conf_mbus_windows(void __iomem *base, int win,/* try to find matching cs for current dma address */ for (i =0 ; i < dram->num_cs; i++) { -const struct mbus_dram_window *cs = dram->cs + i; +const struct mbus_dram_window *cs = &dram->cs[i];if ((cs->base &0xffff0000 ) < (dma &0xffff0000 )) {writel (cs->base &0xffff0000 , base +KIRKWOOD_AUDIO_WIN_BASE_REG (win));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 134/252 regulator: max77802: Bounds check regulator id against opmode
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 4fd8bcec5fd7c0d586206fa2f42bd67b06cdaa7e ]
Explicitly bounds-check the id before accessing the opmode array. Seen with GCC 13:
../drivers/regulator/max77802-regulator.c: In function 'max77802_enable':../drivers/regulator/max77802-regulator.c:217:29: warning: array subscript [0, 41] is outside array bounds of 'unsigned int[42]' [-Warray-bounds=]
217 | if (max77802->opmode[id] == MAX77802_OFF_PWRREQ)
| ~~~~~~~~~~~~~~~~^~~~
../drivers/regulator/max77802-regulator.c:62:22: note: while referencing 'opmode'
62 | unsigned int opmode[MAX77802_REG_MAX];
| ^~~~~~
--- drivers/regulator/max77802-regulator.c | 34 ++++++++++++++++++-------- 1 file changed, 24 insertions(+), 10 deletions(-)
drivers/regulator/max77802-regulator.c +24 -10
@@ -97,9 +97,11 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev) {unsigned int val =MAX77802_OFF_PWRREQ ;struct max77802_regulator_prv *max77802 =rdev_get_drvdata (rdev); -int id =rdev_get_id (rdev); +unsigned int id =rdev_get_id (rdev);int shift =max77802_get_opmode_shift (id); +if (WARN_ON_ONCE (id >=ARRAY_SIZE (max77802->opmode))) +return -EINVAL ; max77802->opmode[id] = val;return regmap_update_bits (rdev->regmap, rdev->desc->enable_reg, rdev->desc->enable_mask, val << shift);
@@ -113,7 +115,7 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev)static int max77802_set_mode (struct regulator_dev *rdev,unsigned int mode) {struct max77802_regulator_prv *max77802 =rdev_get_drvdata (rdev); -int id =rdev_get_id (rdev); +unsigned int id =rdev_get_id (rdev);unsigned int val;int shift =max77802_get_opmode_shift (id);
@@ -130,6 +132,9 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)return -EINVAL ; } +if (WARN_ON_ONCE (id >=ARRAY_SIZE (max77802->opmode))) +return -EINVAL ; + max77802->opmode[id] = val;return regmap_update_bits (rdev->regmap, rdev->desc->enable_reg, rdev->desc->enable_mask, val << shift);
@@ -138,8 +143,10 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)static unsigned max77802_get_mode (struct regulator_dev *rdev) {struct max77802_regulator_prv *max77802 =rdev_get_drvdata (rdev); -int id =rdev_get_id (rdev); +unsigned int id =rdev_get_id (rdev); +if (WARN_ON_ONCE (id >=ARRAY_SIZE (max77802->opmode))) +return -EINVAL ;return max77802_map_mode (max77802->opmode[id]); }
@@ -163,10 +170,13 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev, unsigned int mode) {struct max77802_regulator_prv *max77802 =rdev_get_drvdata (rdev); -int id =rdev_get_id (rdev); +unsigned int id =rdev_get_id (rdev);unsigned int val;int shift =max77802_get_opmode_shift (id); +if (WARN_ON_ONCE (id >=ARRAY_SIZE (max77802->opmode))) +return -EINVAL ; +/* * If the regulator has been disabled for suspend * then is invalid to try setting a suspend mode.
@@ -212,9 +222,11 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev,static int max77802_enable (struct regulator_dev *rdev) {struct max77802_regulator_prv *max77802 =rdev_get_drvdata (rdev); -int id =rdev_get_id (rdev); +unsigned int id =rdev_get_id (rdev);int shift =max77802_get_opmode_shift (id); +if (WARN_ON_ONCE (id >=ARRAY_SIZE (max77802->opmode))) +return -EINVAL ;if (max77802->opmode[id] ==MAX77802_OFF_PWRREQ ) max77802->opmode[id] =MAX77802_OPMODE_NORMAL ;
@@ -543,7 +555,7 @@ static int max77802_pmic_probe(struct platform_device *pdev)for (i =0 ; i <MAX77802_REG_MAX ; i++) {struct regulator_dev *rdev; -int id = regulators[i].id; +unsigned int id = regulators[i].id;int shift =max77802_get_opmode_shift (id);int ret;
@@ -561,10 +573,12 @@ static int max77802_pmic_probe(struct platform_device *pdev)* the hardware reports OFF as the regulator operating mode. * Default to operating mode NORMAL in that case. */ -if (val ==MAX77802_STATUS_OFF ) - max77802->opmode[id] =MAX77802_OPMODE_NORMAL ; -else - max77802->opmode[id] = val; +if (id <ARRAY_SIZE (max77802->opmode)) { +if (val ==MAX77802_STATUS_OFF ) + max77802->opmode[id] =MAX77802_OPMODE_NORMAL ; +else + max77802->opmode[id] = val; + } rdev =devm_regulator_register (&pdev->dev, ®ulators[i], &config);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 135/252 regulator: s5m8767: Bounds check id indexing into arrays
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit e314e15a0b58f9d051c00b25951073bcdae61953 ]
The compiler has no way to know if "id" is within the array bounds of the regulators array. Add a check for this and a build-time check that the regulators and reg_voltage_map arrays are sized the same. Seen with GCC 13:
../drivers/regulator/s5m8767.c: In function 's5m8767_pmic_probe':../drivers/regulator/s5m8767.c:936:35: warning: array subscript [0, 36] is outside array bounds of 'struct regulator_desc[37]' [-Warray-bounds=]
936 | regulators[id].vsel_reg =
| ~~~~~~~~~~^~~~--- drivers/regulator/s5m8767.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/regulator/s5m8767.c +5 -1
@@ -922,10 +922,14 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)for (i =0 ; i < pdata->num_regulators; i++) {const struct sec_voltage_desc *desc; -int id = pdata->regulators[i].id; +unsigned int id = pdata->regulators[i].id;int enable_reg, enable_val;struct regulator_dev *rdev; +BUILD_BUG_ON (ARRAY_SIZE (regulators) !=ARRAY_SIZE (reg_voltage_map)); +if (WARN_ON_ONCE (id >=ARRAY_SIZE (regulators))) +continue ; + desc = reg_voltage_map[id];if (desc) { regulators[id].n_voltages =
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 136/252 pinctrl: at91: use devm_kasprintf() to avoid potential leaks
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 1c4e5c470a56f7f7c649c0c70e603abc1eab15c4 ]
Use devm_kasprintf() instead of kasprintf() to avoid any potential leaks. At the moment drivers have no remove functionality thus there is no need for fixes tag.
--- drivers/pinctrl/pinctrl-at91-pio4.c | 4 ++-- drivers/pinctrl/pinctrl-at91.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/pinctrl/pinctrl-at91-pio4.c +2 -2
@@ -1022,8 +1022,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev) pin_desc[i].number = i;/* Pin naming convention: P(bank_name)(bank_pin_number). */ - pin_desc[i].name =kasprintf (GFP_KERNEL ,"P%c%d" , - bank +'A' , line); + pin_desc[i].name =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"P%c%d" , + bank +'A' , line); group->name = group_names[i] = pin_desc[i].name; group->pin = pin_desc[i].number;
drivers/pinctrl/pinctrl-at91.c +1 -1
@@ -1782,7 +1782,7 @@ static int at91_gpio_probe(struct platform_device *pdev) }for (i =0 ; i < chip->ngpio; i++) - names[i] =kasprintf (GFP_KERNEL ,"pio%c%d" , alias_idx +'A' , i); + names[i] =devm_kasprintf (&pdev->dev,GFP_KERNEL ,"pio%c%d" , alias_idx +'A' , i); chip->names = (const char *const *)names;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 137/252 dm thin: add cond_resched() to various workqueue loops
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
[ Upstream commit e4f80303c2353952e6e980b23914e4214487f2a6 ]
Otherwise on resource constrained systems these workqueues may be too greedy.
--- drivers/md/dm-thin.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/dm-thin.c +2 -0
@@ -2222,6 +2222,7 @@ static void process_thin_deferred_bios(struct thin_c *tc)throttle_work_update (&pool->throttle);dm_pool_issue_prefetches (pool->pmd); } +cond_resched (); }blk_finish_plug (&plug); }
@@ -2305,6 +2306,7 @@ static void process_thin_deferred_cells(struct thin_c *tc)else pool->process_cell (tc, cell); } +cond_resched (); }while (!list_empty (&cells)); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 138/252 dm cache: add cond_resched() to various workqueue loops
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
[ Upstream commit 76227f6dc805e9e960128bcc6276647361e0827c ]
Otherwise on resource constrained systems these workqueues may be too greedy.
--- drivers/md/dm-cache-target.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/md/dm-cache-target.c +4 -0
@@ -1905,6 +1905,7 @@ static void process_deferred_bios(struct work_struct *ws)else commit_needed =process_bio (cache, bio) || commit_needed; +cond_resched (); }if (commit_needed)
@@ -1927,6 +1928,7 @@ static void requeue_deferred_bios(struct cache *cache)while ((bio =bio_list_pop (&bios))) { bio->bi_status =BLK_STS_DM_REQUEUE ;bio_endio (bio); +cond_resched (); } }
@@ -1967,6 +1969,8 @@ static void check_migrations(struct work_struct *ws) r =mg_start (cache, op,NULL );if (r)break ; + +cond_resched (); } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 139/252 wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
In reply to Greg Kroah-HartmanFrom: Jun ASAKA <[email protected]>
commit c6015bf3ff1ffb3caa27eb913797438a0fc634a0 upstream.
Fixing transmission failure which results in "authentication with ... timed out". This can be fixed by disable the REG_TXPAUSE.
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c +5 -0
@@ -1679,6 +1679,11 @@ static void rtl8192e_enable_rf(struct rt val8 =rtl8xxxu_read8 (priv,REG_PAD_CTRL1 ); val8 &= ~BIT (0 );rtl8xxxu_write8 (priv,REG_PAD_CTRL1 , val8); + +/* +* Fix transmission failure of rtl8192e. +*/ +rtl8xxxu_write8 (priv,REG_TXPAUSE ,0x00 ); }struct rtl8xxxu_fileops rtl8192eu_fops = {
Greg Kroah-Hartman
maintainerPATCH 140/252 firmware: coreboot: framebuffer: Ignore reserved pixel color bits
In reply to Greg Kroah-HartmanFrom: Alper Nebi Yasak <[email protected]>
commit e6acaf25cba14661211bb72181c35dd13b24f5b3 upstream.
The coreboot framebuffer doesn't support transparency, its 'reserved' bit field is merely padding for byte/word alignment of pixel colors [1]. When trying to match the framebuffer to a simplefb format, the kernel driver unnecessarily requires the format's transparency bit field to exactly match this padding, even if the former is zero-width.
Due to a coreboot bug [2] (fixed upstream), some boards misreport the reserved field's size as equal to its position (0x18 for both on a 'Lick' Chromebook), and the driver fails to probe where it would have otherwise worked fine with e.g. the a8r8g8b8 or x8r8g8b8 formats.
Remove the transparency comparison with reserved bits. When the bits-per-pixel and other color components match, transparency will already be in a subset of the reserved field. Not forcing it to match reserved bits allows the driver to work on the boards which misreport the reserved field. It also enables using simplefb formats that don't have transparency bits, although this doesn't currently happen due to format support and ordering in linux/platform_data/simplefb.h.
[1] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.19/src/commonlib/include/commonlib/coreboot_tables.h#255
[2] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.13/src/drivers/intel/fsp2_0/graphics.c#82
--- drivers/firmware/google/framebuffer-coreboot.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/firmware/google/framebuffer-coreboot.c +1 -3
@@ -51,9 +51,7 @@ static int framebuffer_probe(struct core fb->green_mask_pos == formats[i].green.offset && fb->green_mask_size == formats[i].green.length && fb->blue_mask_pos == formats[i].blue.offset && - fb->blue_mask_size == formats[i].blue.length && - fb->reserved_mask_pos == formats[i].transp.offset && - fb->reserved_mask_size == formats[i].transp.length) + fb->blue_mask_size == formats[i].blue.length) pdata.format = formats[i].name; }if (!pdata.format)
Greg Kroah-Hartman
maintainerPATCH 141/252 rtc: pm8xxx: fix set-alarm race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit c88db0eff9722fc2b6c4d172a50471d20e08ecc6 upstream.
Make sure to disable the alarm before updating the four alarm time registers to avoid spurious alarms during the update.
Note that the disable needs to be done outside of the ctrl_reg_lock section to prevent a racing alarm interrupt from disabling the newly set alarm when the lock is released.
--- drivers/rtc/rtc-pm8xxx.c | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-)
drivers/rtc/rtc-pm8xxx.c +10 -14
@@ -229,7 +229,6 @@ static int pm8xxx_rtc_set_alarm(struct d {int rc, i;u8 value[NUM_8_BIT_RTC_REGS ]; -unsigned int ctrl_reg;unsigned long secs, irq_flags;struct pm8xxx_rtc *rtc_dd =dev_get_drvdata (dev);const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
@@ -241,6 +240,11 @@ static int pm8xxx_rtc_set_alarm(struct d secs >>=8 ; } + rc =regmap_update_bits (rtc_dd->regmap, regs->alarm_ctrl, + regs->alarm_en,0 ); +if (rc) +return rc; +spin_lock_irqsave (&rtc_dd->ctrl_reg_lock, irq_flags); rc = regmap_bulk_write(rtc_dd->regmap, regs->alarm_rw, value,
@@ -250,19 +254,11 @@ static int pm8xxx_rtc_set_alarm(struct d goto rtc_rw_fail; } - rc =regmap_read (rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg); -if (rc) - goto rtc_rw_fail; - -if (alarm->enabled) - ctrl_reg |= regs->alarm_en; -else - ctrl_reg &= ~regs->alarm_en; - - rc =regmap_write (rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg); -if (rc) { -dev_err (dev,"Write to RTC alarm control register failed\n" ); - goto rtc_rw_fail; +if (alarm->enabled) { + rc =regmap_update_bits (rtc_dd->regmap, regs->alarm_ctrl, + regs->alarm_en, regs->alarm_en); +if (rc) + goto rtc_rw_fail; } dev_dbg(dev, "Alarm Set for h:r:s=%d:%d:%d, d/m/y=%d/%d/%d\n",
Greg Kroah-Hartman
maintainerPATCH 142/252 s390: discard .interp section
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
commit e9c9cb90e76ffaabcc7ca8f275d9e82195fd6367 upstream.
When debugging vmlinux with QEMU + GDB, the following GDB error may occur:
(gdb) c
Continuing.
Warning:
Cannot insert breakpoint -1.
Cannot access memory at address 0xffffffffffff95c0
Command aborted.
(gdb)The reason is that, when .interp section is present, GDB tries to locate the file specified in it in memory and put a number of breakpoints there (see enable_break() function in gdb/solib-svr4.c). Sometimes GDB finds a bogus location that matches its heuristics, fails to set a breakpoint and stops. This makes further debugging impossible.
The .interp section contains misleading information anyway (vmlinux does not need ld.so), so fix by discarding it.
--- arch/s390/kernel/vmlinux.lds.S | 1 + 1 file changed, 1 insertion(+)
arch/s390/kernel/vmlinux.lds.S +1 -0
@@ -153,5 +153,6 @@ SECTIONS DISCARDS /DISCARD/ : { *(.eh_frame) + *(.interp) } }
Greg Kroah-Hartman
maintainerPATCH 143/252 s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
commit 42e19e6f04984088b6f9f0507c4c89a8152d9730 upstream.
Recent test_kprobe_missed kprobes kunit test uncovers the following error (reported when CONFIG_DEBUG_ATOMIC_SLEEP is enabled):
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 662, name: kunit_try_catchpreempt_count: 0, expected: 0
RCU nest depth: 0, expected: 0
no locks held by kunit_try_catch/662.
irq event stamp: 280 hardirqs last enabled at (279): [<00000003e60a3d42>] __do_pgm_check+0x17a/0x1c0 hardirqs last disabled at (280): [<00000003e3bd774a>] kprobe_exceptions_notify+0x27a/0x318 softirqs last enabled at (0): [<00000003e3c5c890>] copy_process+0x14a8/0x4c80 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 46 PID: 662 Comm: kunit_try_catch Tainted: G N 6.2.0-173644-g44c18d77f0c0 #2 Hardware name: IBM 3931 A01 704 (LPAR) Call Trace: [<00000003e60a3a00>] dump_stack_lvl+0x120/0x198 [<00000003e3d02e82>] __might_resched+0x60a/0x668 [<00000003e60b9908>] __mutex_lock+0xc0/0x14e0 [<00000003e60bad5a>] mutex_lock_nested+0x32/0x40 [<00000003e3f7b460>] unregister_kprobe+0x30/0xd8 [<00000003e51b2602>] test_kprobe_missed+0xf2/0x268 [<00000003e51b5406>] kunit_try_run_case+0x10e/0x290 [<00000003e51b7dfa>] kunit_generic_run_threadfn_adapter+0x62/0xb8 [<00000003e3ce30f8>] kthread+0x2d0/0x398 [<00000003e3b96afa>] __ret_from_fork+0x8a/0xe8 [<00000003e60ccada>] ret_from_fork+0xa/0x40
The reason for this error report is that kprobes handling code failed to restore irqs.
The problem is that when kprobe is triggered from another kprobe post_handler current sequence of enable_singlestep / disable_singlestep is the following:enable_singlestep <- original kprobe (saves kprobe_saved_imask) enable_singlestep <- kprobe triggered from post_handler (clobbers kprobe_saved_imask) disable_singlestep <- kprobe triggered from post_handler (restores kprobe_saved_imask) disable_singlestep <- original kprobe (restores wrong clobbered kprobe_saved_imask)
There is just one kprobe_ctlblk per cpu and both calls saves and loads irq mask to kprobe_saved_imask. To fix the problem simply move resume_execution (which calls disable_singlestep) before calling post_handler. This also fixes the problem that post_handler is called with pt_regs which were not yet adjusted after single-stepping.
--- arch/s390/kernel/kprobes.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/s390/kernel/kprobes.c +1 -2
@@ -508,12 +508,11 @@ static int post_kprobe_handler(struct ptif (!p)return 0 ; +resume_execution (p, regs);if (kcb->kprobe_status !=KPROBE_REENTER && p->post_handler) { kcb->kprobe_status =KPROBE_HIT_SSDONE ; p->post_handler (p, regs,0 ); } - -resume_execution (p, regs);pop_kprobe (kcb);preempt_enable_no_resched ();
Greg Kroah-Hartman
maintainerPATCH 144/252 s390/kprobes: fix current_kprobe never cleared after kprobes reenter
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
commit cd57953936f2213dfaccce10d20f396956222c7d upstream.
Recent test_kprobe_missed kprobes kunit test uncovers the following problem. Once kprobe is triggered from another kprobe (kprobe reenter), all future kprobes on this cpu are considered as kprobe reenter, thus pre_handler and post_handler are not being called and kprobes are counted as "missed".
Commit b9599798f953 ("[S390] kprobes: activation and deactivation") introduced a simpler scheme for kprobes (de)activation and status tracking by using push_kprobe/pop_kprobe, which supposed to work for both initial kprobe entry as well as kprobe reentry and helps to avoid handling those two cases differently. The problem is that a sequence of calls in case of kprobes reenter:push_kprobe() <- NULL (current_kprobe)push_kprobe() <- kprobe1 (current_kprobe)pop_kprobe() -> kprobe1 (current_kprobe)pop_kprobe() -> kprobe1 (current_kprobe)
leaves "kprobe1" as "current_kprobe" on this cpu, instead of setting it to NULL. In fact push_kprobe/pop_kprobe can only store a single state (there is just one prev_kprobe in kprobe_ctlblk). Which is a hack but sufficient, there is no need to have another prev_kprobe just to store NULL. To make a simple and backportable fix simply reset "prev_kprobe" when kprobe is poped from this "stack". No need to worry about "kprobe_status" in this case, because its value is only checked when current_kprobe != NULL.
--- arch/s390/kernel/kprobes.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kernel/kprobes.c +1 -0
@@ -254,6 +254,7 @@ static void pop_kprobe(struct kprobe_ctl {__this_cpu_write (current_kprobe, kcb->prev_kprobe.kp); kcb->kprobe_status = kcb->prev_kprobe.status; + kcb->prev_kprobe.kp =NULL ; }NOKPROBE_SYMBOL (pop_kprobe);
Greg Kroah-Hartman
maintainerPATCH 145/252 ARM: dts: exynos: correct HDMI phy compatible in Exynos4
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit af1c89ddb74f170eccd5a57001d7317560b638ea upstream.
The HDMI phy compatible was missing vendor prefix.
--- arch/arm/boot/dts/exynos4.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos4.dtsi +1 -1
@@ -611,7 +611,7 @@ status = "disabled"; hdmi_i2c_phy: hdmiphy@38 { - compatible = "exynos4210-hdmiphy"; + compatible = "samsung,exynos4210-hdmiphy"; reg = <0x38>; }; };
Greg Kroah-Hartman
maintainerPATCH 146/252 hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
In reply to Greg Kroah-HartmanFrom: Liu Shixin <[email protected]>
commit a9dc087fd3c484fd1ed18c5efb290efaaf44ce03 upstream.
Syzbot found a kernel BUG in hfs_bnode_put():
kernel BUG at fs/hfs/bnode.c:466!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 3634 Comm: kworker/u4:5 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: writeback wb_workfn (flush-7:0) RIP: 0010:hfs_bnode_put+0x46f/0x480 fs/hfs/bnode.c:466 Code: 8a 80 ff e9 73 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a0 fe ff ff 48 89 df e8 db 8a 80 ff e9 93 fe ff ff e8 a1 68 2c ff <0f> 0b e8 9a 68 2c ff 0f 0b 0f 1f 84 00 00 00 00 00 55 41 57 41 56 RSP: 0018:ffffc90003b4f258 EFLAGS: 00010293 RAX: ffffffff825e318f RBX: 0000000000000000 RCX: ffff8880739dd7c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003b4f430 R08: ffffffff825e2d9b R09: ffffed10045157d1 R10: ffffed10045157d1 R11: 1ffff110045157d0 R12: ffff8880228abe80 R13: ffff88807016c000 R14: dffffc0000000000 R15: ffff8880228abe00 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa6ebe88718 CR3: 000000001e93d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> hfs_write_inode+0x1bc/0xb40 write_inode fs/fs-writeback.c:1440 [inline] __writeback_single_inode+0x4d6/0x670 fs/fs-writeback.c:1652 writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1878 __writeback_inodes_wb+0x125/0x420 fs/fs-writeback.c:1949 wb_writeback+0x440/0x7b0 fs/fs-writeback.c:2054 wb_check_start_all fs/fs-writeback.c:2176 [inline] wb_do_writeback fs/fs-writeback.c:2202 [inline] wb_workfn+0x827/0xef0 fs/fs-writeback.c:2235 process_one_work+0x877/0xdb0 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK>
The BUG_ON() is triggered at here:
/* Dispose of resources used by a node */
void hfs_bnode_put(struct hfs_bnode *node)
{
if (node) { <skipped>
BUG_ON(!atomic_read(&node->refcnt)); <- we have issue here!!!! <skipped>
}
}
By tracing the refcnt, I found the node is created by hfs_bmap_alloc() with refcnt 1. Then the node is used by hfs_btree_write(). There is a missing of hfs_bnode_get() after find the node. The issue happened in following path:
<alloc>
hfs_bmap_alloc
hfs_bnode_find
__hfs_bnode_create <- allocate a new node with refcnt 1.
hfs_bnode_put <- decrease the refcnt
<write>
hfs_btree_write
hfs_bnode_find
__hfs_bnode_create
hfs_bnode_findhash <- find the node without refcnt increased.
hfs_bnode_put <- trigger the BUG_ON() since refcnt is 0.
--- fs/hfs/bnode.c | 1 + 1 file changed, 1 insertion(+)
fs/hfs/bnode.c +1 -0
@@ -281,6 +281,7 @@ static struct hfs_bnode *__hfs_bnode_cre tree->node_hash[hash] = node; tree->node_hash_cnt++; }else { +hfs_bnode_get (node2);spin_unlock (&tree->hash_lock);kfree (node);wait_event (node2->lock_wq, !test_bit (HFS_BNODE_NEW , &node2->flags));
Greg Kroah-Hartman
maintainerPATCH 147/252 fs: hfsplus: fix UAF issue in hfsplus_put_super
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 upstream.
The current hfsplus_put_super first calls hfs_btree_close on sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an use-after-free issue in hfsplus_release_folio.
As shown in hfsplus_fill_super, the error handling code also calls iput before hfs_btree_close.
To fix this error, we move all iput calls before hfsplus_btree_close.
Note that this patch is tested on Syzbot.
--- fs/hfsplus/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/hfsplus/super.c +2 -2
@@ -294,11 +294,11 @@ static void hfsplus_put_super(struct suphfsplus_sync_fs (sb,1 ); } +iput (sbi->alloc_file); +iput (sbi->hidden_dir);hfs_btree_close (sbi->attr_tree);hfs_btree_close (sbi->cat_tree);hfs_btree_close (sbi->ext_tree); -iput (sbi->alloc_file); -iput (sbi->hidden_dir);kfree (sbi->s_vhdr_buf);kfree (sbi->s_backup_vhdr_buf);unload_nls (sbi->nls);
Greg Kroah-Hartman
maintainerPATCH 148/252 f2fs: fix information leak in f2fs_move_inline_dirents()
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 9a5571cff4ffcfc24847df9fd545cc5799ac0ee5 upstream.
When converting an inline directory to a regular one, f2fs is leaking uninitialized memory to disk because it doesn't initialize the entire directory block. Fix this by zero-initializing the block.
This bug was introduced by commit 4ec17d688d74 ("f2fs: avoid unneeded initializing when converting inline dentry"), which didn't consider the security implications of leaking uninitialized memory to disk.
This was found by running xfstest generic/435 on a KMSAN-enabled kernel.
--- fs/f2fs/inline.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
fs/f2fs/inline.c +6 -7
@@ -408,18 +408,17 @@ static int f2fs_move_inline_dirents(stru dentry_blk =page_address (page); +/* +* Start by zeroing the full block, to ensure that all unused space is +* zeroed and no uninitialized memory is leaked to disk. +*/ +memset (dentry_blk,0 ,F2FS_BLKSIZE ); +make_dentry_ptr_inline (dir, &src, inline_dentry);make_dentry_ptr_block (dir, &dst, dentry_blk);/* copy data from inline dentry block to new dentry block */ memcpy (dst.bitmap, src.bitmap, src.nr_bitmap); -memset (dst.bitmap + src.nr_bitmap,0 , dst.nr_bitmap - src.nr_bitmap); -/* -* we do not need to zero out remainder part of dentry and filename -* field, since we have used bitmap for marking the usage status of -* them, besides, we can also ignore copying/zeroing reserved space -* of dentry block, because them haven't been used so far. -*/ memcpy (dst.dentry, src.dentry,SIZE_OF_DIR_ENTRY * src.max);memcpy (dst.filename, src.filename, src.max *F2FS_SLOT_LEN );
Greg Kroah-Hartman
maintainerPATCH 149/252 ocfs2: fix defrag path triggering jbd2 ASSERT
In reply to Greg Kroah-HartmanFrom: Heming Zhao via Ocfs2-devel <[email protected]>
commit 60eed1e3d45045623e46944ebc7c42c30a4350f0 upstream.
code path:
ocfs2_ioctl_move_extents
ocfs2_move_extents
ocfs2_defrag_extent
__ocfs2_move_extent
+ ocfs2_journal_access_di
+ ocfs2_split_extent //sub-paths call jbd2_journal_restart
+ ocfs2_journal_dirty //crash by jbs2 ASSERT
crash stacks:
PID: 11297 TASK: ffff974a676dcd00 CPU: 67 COMMAND: "defragfs.ocfs2"
#0 [ffffb25d8dad3900] machine_kexec at ffffffff8386fe01
#1 [ffffb25d8dad3958] __crash_kexec at ffffffff8395959d
#2 [ffffb25d8dad3a20] crash_kexec at ffffffff8395a45d
#3 [ffffb25d8dad3a38] oops_end at ffffffff83836d3f
#4 [ffffb25d8dad3a58] do_trap at ffffffff83833205
#5 [ffffb25d8dad3aa0] do_invalid_op at ffffffff83833aa6
#6 [ffffb25d8dad3ac0] invalid_op at ffffffff84200d18
[exception RIP: jbd2_journal_dirty_metadata+0x2ba]
RIP: ffffffffc09ca54a RSP: ffffb25d8dad3b70 RFLAGS: 00010207
RAX: 0000000000000000 RBX: ffff9706eedc5248 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffff97337029ea28 RDI: ffff9706eedc5250
RBP: ffff9703c3520200 R8: 000000000f46b0b2 R9: 0000000000000000
R10: 0000000000000001 R11: 00000001000000fe R12: ffff97337029ea28
R13: 0000000000000000 R14: ffff9703de59bf60 R15: ffff9706eedc5250
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffb25d8dad3ba8] ocfs2_journal_dirty at ffffffffc137fb95 [ocfs2] #8 [ffffb25d8dad3be8] __ocfs2_move_extent at ffffffffc139a950 [ocfs2] #9 [ffffb25d8dad3c80] ocfs2_defrag_extent at ffffffffc139b2d2 [ocfs2]
Analysis
This bug has the same root cause of 'commit 7f27ec978b0e ("ocfs2: call ocfs2_journal_access_di() before ocfs2_journal_dirty() in ocfs2_write_end_nolock()")'. For this bug, jbd2_journal_restart() is called by ocfs2_split_extent() during defragmenting.
How to fix
For ocfs2_split_extent() can handle journal operations totally by itself. Caller doesn't need to call journal access/dirty pair, and caller only needs to call journal start/stop pair. The fix method is to remove journal access/dirty from __ocfs2_move_extent().
The discussion for this patch:
https://oss.oracle.com/pipermail/ocfs2-devel/2023-February/000647.html
--- fs/ocfs2/move_extents.c | 10 ---------- 1 file changed, 10 deletions(-)
fs/ocfs2/move_extents.c +0 -10
@@ -115,14 +115,6 @@ static int __ocfs2_move_extent(handle_t*/ replace_rec.e_flags = ext_flags & ~OCFS2_EXT_REFCOUNTED ; - ret =ocfs2_journal_access_di (handle,INODE_CACHE (inode), - context->et.et_root_bh, -OCFS2_JOURNAL_ACCESS_WRITE ); -if (ret) { -mlog_errno (ret); - goto out; - } - ret =ocfs2_split_extent (handle, &context->et, path, index, &replace_rec, context->meta_ac, &context->dealloc);
@@ -131,8 +123,6 @@ static int __ocfs2_move_extent(handle_t goto out; } -ocfs2_journal_dirty (handle, context->et.et_root_bh); - context->new_phys_cpos = new_p_cpos;/*
Greg Kroah-Hartman
maintainerPATCH 150/252 ocfs2: fix non-auto defrag path not working issue
In reply to Greg Kroah-HartmanFrom: Heming Zhao via Ocfs2-devel <[email protected]>
commit 236b9254f8d1edc273ad88b420aa85fbd84f492d upstream.
This fixes three issues on move extents ioctl without auto defrag:
a) In ocfs2_find_victim_alloc_group(), we have to convert bits to block first in case of global bitmap.
b) In ocfs2_probe_alloc_group(), when finding enough bits in block group bitmap, we have to back off move_len to start pos as well, otherwise it may corrupt filesystem.
c) In ocfs2_ioctl_move_extents(), set me_threshold both for non-auto and auto defrag paths. Otherwise it will set move_max_hop to 0 and finally cause unexpectedly ENOSPC error.
Currently there are no tools triggering the above issues since defragfs.ocfs2 enables auto defrag by default. Tested with manually changing defragfs.ocfs2 to run non auto defrag path.
--- fs/ocfs2/move_extents.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
fs/ocfs2/move_extents.c +13 -11
@@ -444,7 +444,7 @@ static int ocfs2_find_victim_alloc_group bg = (struct ocfs2_group_desc *)gd_bh->b_data;if (vict_blkno < (le64_to_cpu (bg->bg_blkno) + -le16_to_cpu (bg->bg_bits))) { + (le16_to_cpu (bg->bg_bits) << bits_per_unit))) { *ret_bh = gd_bh; *vict_bit = (vict_blkno - blkno) >>
@@ -559,6 +559,7 @@ static void ocfs2_probe_alloc_group(stru last_free_bits++;if (last_free_bits == move_len) { + i -= move_len; *goal_bit = i; *phys_cpos = base_cpos + i;break ;
@@ -1030,18 +1031,19 @@ int ocfs2_ioctl_move_extents(struct file context->range = ⦥ +/* +* ok, the default theshold for the defragmentation +* is 1M, since our maximum clustersize was 1M also. +* any thought? +*/ +if (!range.me_threshold) + range.me_threshold =1024 *1024 ; + +if (range.me_threshold >i_size_read (inode)) + range.me_threshold =i_size_read (inode); +if (range.me_flags &OCFS2_MOVE_EXT_FL_AUTO_DEFRAG ) { context->auto_defrag =1 ; -/* -* ok, the default theshold for the defragmentation -* is 1M, since our maximum clustersize was 1M also. -* any thought? -*/ -if (!range.me_threshold) - range.me_threshold =1024 *1024 ; - -if (range.me_threshold >i_size_read (inode)) - range.me_threshold =i_size_read (inode);if (range.me_flags &OCFS2_MOVE_EXT_FL_PART_DEFRAG ) context->partial =1 ;
Greg Kroah-Hartman
maintainerPATCH 151/252 udf: Truncate added extents on failed expansion
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 70bfb3a8d661d4fdc742afc061b88a7f3fc9f500 upstream.
When a file expansion failed because we didn't have enough space for indirect extents make sure we truncate extents created so far so that we don't leave extents beyond EOF.
--- fs/udf/inode.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
fs/udf/inode.c +11 -4
@@ -521,8 +521,10 @@ static int udf_do_extend_file(struct ino }if (fake) { -udf_add_aext (inode, last_pos, &last_ext->extLocation, - last_ext->extLength,1 ); + err =udf_add_aext (inode, last_pos, &last_ext->extLocation, + last_ext->extLength,1 ); +if (err <0 ) + goto out_err; count++; }else {struct kernel_lb_addr tmploc;
@@ -556,7 +558,7 @@ static int udf_do_extend_file(struct ino err =udf_add_aext (inode, last_pos, &last_ext->extLocation, last_ext->extLength,1 );if (err) -return err; + goto out_err; count++; }if (new_block_bytes) {
@@ -565,7 +567,7 @@ static int udf_do_extend_file(struct ino err =udf_add_aext (inode, last_pos, &last_ext->extLocation, last_ext->extLength,1 );if (err) -return err; + goto out_err; count++; }
@@ -579,6 +581,11 @@ out:return -EIO ;return count; +out_err: +/* Remove extents we've created so far */ +udf_clear_extent_cache (inode); +udf_truncate_extents (inode); +return err; }/* Extend the final block of the file to final_block_len bytes */
Greg Kroah-Hartman
maintainerPATCH 152/252 udf: Do not bother merging very long extents
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 53cafe1d6d8ef9f93318e5bfccc0d24f27d41ced upstream.
When merging very long extents we try to push as much length as possible to the first extent. However this is unnecessarily complicated and not really worth the trouble. Furthermore there was a bug in the logic resulting in corrupting extents in the file as syzbot reproducer shows. So just don't bother with the merging of extents that are too long together.
--- fs/udf/inode.c | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-)
fs/udf/inode.c +2 -17
@@ -1089,23 +1089,8 @@ static void udf_merge_extents(struct ino blocksize - 1) >> blocksize_bits)))) {if (((li->extLength &UDF_EXTENT_LENGTH_MASK ) + - (lip1->extLength &UDF_EXTENT_LENGTH_MASK ) + - blocksize -1 ) & ~UDF_EXTENT_LENGTH_MASK ) { - lip1->extLength = (lip1->extLength - - (li->extLength & -UDF_EXTENT_LENGTH_MASK ) + -UDF_EXTENT_LENGTH_MASK ) & - ~(blocksize -1 ); - li->extLength = (li->extLength & -UDF_EXTENT_FLAG_MASK ) + - (UDF_EXTENT_LENGTH_MASK +1 ) - - blocksize; - lip1->extLocation.logicalBlockNum = - li->extLocation.logicalBlockNum + - ((li->extLength & -UDF_EXTENT_LENGTH_MASK ) >> - blocksize_bits); - }else { + (lip1->extLength &UDF_EXTENT_LENGTH_MASK ) + + blocksize -1 ) <=UDF_EXTENT_LENGTH_MASK ) { li->extLength = lip1->extLength + (((li->extLength & UDF_EXTENT_LENGTH_MASK) +
Greg Kroah-Hartman
maintainerPATCH 153/252 udf: Do not update file length for failed writes to inline files
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 256fe4162f8b5a1625b8603ca5f7ff79725bfb47 upstream.
When write to inline file fails (or happens only partly), we still updated length of inline data as if the whole write succeeded. Fix the update of length of inline data to happen only if the write succeeds.
--- fs/udf/file.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-)
fs/udf/file.c +12 -14
@@ -148,26 +148,24 @@ static ssize_t udf_file_write_iter(struc goto out;down_write (&iinfo->i_data_sem); -if (iinfo->i_alloc_type ==ICBTAG_FLAG_AD_IN_ICB ) { -loff_t end = iocb->ki_pos +iov_iter_count (from); - -if (inode->i_sb->s_blocksize < - (udf_file_entry_alloc_offset (inode) + end)) { - err =udf_expand_file_adinicb (inode); -if (err) { -inode_unlock (inode); -udf_debug ("udf_expand_adinicb: err=%d\n" , err); -return err; - } - }else { - iinfo->i_lenAlloc =max (end, inode->i_size); -up_write (&iinfo->i_data_sem); +if (iinfo->i_alloc_type ==ICBTAG_FLAG_AD_IN_ICB && + inode->i_sb->s_blocksize < (udf_file_entry_alloc_offset (inode) + + iocb->ki_pos +iov_iter_count (from))) { + err =udf_expand_file_adinicb (inode); +if (err) { +inode_unlock (inode); +udf_debug ("udf_expand_adinicb: err=%d\n" , err); +return err; } }else up_write (&iinfo->i_data_sem); retval =__generic_file_write_iter (iocb, from); out: +down_write (&iinfo->i_data_sem); +if (iinfo->i_alloc_type ==ICBTAG_FLAG_AD_IN_ICB && retval >0 ) + iinfo->i_lenAlloc = inode->i_size; +up_write (&iinfo->i_data_sem);inode_unlock (inode);if (retval >0 ) {
Greg Kroah-Hartman
maintainerPATCH 154/252 udf: Fix file corruption when appending just after end of preallocated extent
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 36ec52ea038b18a53e198116ef7d7e70c87db046 upstream.
When we append new block just after the end of preallocated extent, the code in inode_getblk() wrongly determined we're going to use the preallocated extent which resulted in adding block into a wrong logical offset in the file. Sequence like this manifests it:
xfs_io -f -c "pwrite 0x2cacf 0xd122" -c "truncate 0x2dd6f" \
-c "pwrite 0x27fd9 0x69a9" -c "pwrite 0x32981 0x7244" <file>
The code that determined the use of preallocated extent is actually stale because udf_do_extend_file() does not create preallocation anymore so after calling that function we are sure there's no usable preallocation. Just remove the faulty condition.
--- fs/udf/inode.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-)
fs/udf/inode.c +11 -13
@@ -800,19 +800,17 @@ static sector_t inode_getblk(struct inod c =0 ; offset =0 ; count += ret; -/* We are not covered by a preallocated extent? */ -if ((laarr[0 ].extLength &UDF_EXTENT_FLAG_MASK ) != -EXT_NOT_RECORDED_ALLOCATED ) { -/* Is there any real extent? - otherwise we overwrite -* the fake one... */ -if (count) - c = !c; - laarr[c].extLength =EXT_NOT_RECORDED_NOT_ALLOCATED | - inode->i_sb->s_blocksize; -memset (&laarr[c].extLocation,0x00 , -sizeof (struct kernel_lb_addr )); - count++; - } +/* +* Is there any real extent? - otherwise we overwrite the fake +* one... +*/ +if (count) + c = !c; + laarr[c].extLength =EXT_NOT_RECORDED_NOT_ALLOCATED | + inode->i_sb->s_blocksize; +memset (&laarr[c].extLocation,0x00 , +sizeof (struct kernel_lb_addr )); + count++; endnum = c +1 ; lastblock =1 ; }else {
Greg Kroah-Hartman
maintainerPATCH 155/252 x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 6a3236580b0b1accc3976345e723104f74f6f8e6 upstream.
Set GIF=1 prior to disabling SVM to ensure that INIT is recognized if the kernel is disabling SVM in an emergency, e.g. if the kernel is about to jump into a crash kernel or may reboot without doing a full CPU RESET. If GIF is left cleared, the new kernel (or firmware) will be unabled to awaken APs. Eat faults on STGI (due to EFER.SVME=0) as it's possible that SVM could be disabled via NMI shootdown between reading EFER.SVME and executing STGI.
--- arch/x86/include/asm/virtext.h | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
arch/x86/include/asm/virtext.h +15 -1
@@ -114,7 +114,21 @@ static inline void cpu_svm_disable(void)wrmsrl (MSR_VM_HSAVE_PA ,0 );rdmsrl (MSR_EFER , efer); -wrmsrl (MSR_EFER , efer & ~EFER_SVME ); +if (efer &EFER_SVME ) { +/* +* Force GIF=1 prior to disabling SVM to ensure INIT and NMI +* aren't blocked, e.g. if a fatal error occurred between CLGI +* and STGI. Note, STGI may #UD if SVM is disabled from NMI +* context between reading EFER and executing STGI. In that +* case, GIF must already be set, otherwise the NMI would have +* been blocked, so just eat the fault. +*/ + asm_volatile_goto("1: stgi\n\t" + _ASM_EXTABLE(1b, %l[fault]) + ::: "memory" : fault); +fault: + wrmsrl(MSR_EFER, efer & ~EFER_SVME); + } }/** Makes sure SVM is disabled, if it is supported on the CPU
Greg Kroah-Hartman
maintainerPATCH 156/252 x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 26044aff37a5455b19a91785086914fd33053ef4 upstream.
Disable virtualization in crash_nmi_callback() and rework the emergency_vmx_disable_all() path to do an NMI shootdown if and only if a
shootdown has not already occurred. NMI crash shootdown fundamentally
can't support multiple invocations as responding CPUs are deliberately put into halt state without unblocking NMIs. But, the emergency reboot path doesn't have any work of its own, it simply cares about disabling virtualization, i.e. so long as a shootdown occurred, emergency reboot doesn't care who initiated the shootdown, or when.
If "crash_kexec_post_notifiers" is specified on the kernel command line, panic() will invoke crash_smp_send_stop() and result in a second call to nmi_shootdown_cpus() during native_machine_emergency_restart().
Invoke the callback _before_ disabling virtualization, as the current VMCS needs to be cleared before doing VMXOFF. Note, this results in a subtle change in ordering between disabling virtualization and stopping Intel PT on the responding CPUs. While VMX and Intel PT do interact, VMXOFF and writes to MSR_IA32_RTIT_CTL do not induce faults between one another, which is all that matters when panicking.
Harden nmi_shootdown_cpus() against multiple invocations to try and capture any such kernel bugs via a WARN instead of hanging the system during a crash/dump, e.g. prior to the recent hardening of register_nmi_handler(), re-registering the NMI handler would trigger a double list_add() and hang the system if CONFIG_BUG_ON_DATA_CORRUPTION=y.
list_add double add: new=ffffffff82220800, prev=ffffffff8221cfe8, next=ffffffff82220800.
WARNING: CPU: 2 PID: 1319 at lib/list_debug.c:29 __list_add_valid+0x67/0x70 Call Trace: __register_nmi_handler+0xcf/0x130 nmi_shootdown_cpus+0x39/0x90 native_machine_emergency_restart+0x1c9/0x1d0 panic+0x237/0x29b
Extract the disabling logic to a common helper to deduplicate code, and to prepare for doing the shootdown in the emergency reboot path if SVM is supported.
Note, prior to commit ed72736183c4 ("x86/reboot: Force all cpus to exit VMX root if VMX is supported"), nmi_shootdown_cpus() was subtly protected against a second invocation by a cpu_vmx_enabled() check as the kdump handler would disable VMX if it ran first.
--- arch/x86/include/asm/reboot.h | 2 + arch/x86/kernel/crash.c | 17 ---------- arch/x86/kernel/reboot.c | 65 ++++++++++++++++++++++++++++++++++-------- 3 files changed, 56 insertions(+), 28 deletions(-)
arch/x86/include/asm/reboot.h +2 -0
@@ -25,6 +25,8 @@ void __noreturn machine_real_restart(uns#define MRR_BIOS 0#define MRR_APM 1 +void cpu_emergency_disable_virtualization (void ); +typedef void (*nmi_shootdown_cb )(int ,struct pt_regs *);void nmi_shootdown_cpus (nmi_shootdown_cb callback);void run_crash_ipi_callback (struct pt_regs *regs);
arch/x86/kernel/crash.c +1 -16
@@ -35,7 +35,6 @@#include <linux/kdebug.h> #include <asm/cpu.h> #include <asm/reboot.h> -#include <asm/virtext.h> #include <asm/intel_pt.h> /* Used while preparing memory map entries for second kernel */
@@ -86,15 +85,6 @@ static void kdump_nmi_callback(int cpu,*/ cpu_crash_vmclear_loaded_vmcss (); -/* Disable VMX or SVM if needed. -* -* We need to disable virtualization on all CPUs. -* Having VMX or SVM enabled on any CPU may break rebooting -* after the kdump kernel has finished its task. -*/ -cpu_emergency_vmxoff (); -cpu_emergency_svm_disable (); -/* * Disable Intel PT to stop its logging */
@@ -153,12 +143,7 @@ void native_machine_crash_shutdown(struc*/ cpu_crash_vmclear_loaded_vmcss (); -/* Booting kdump kernel with VMX or SVM enabled won't work, -* because (among other limitations) we can't disable paging -* with the virt flags. -*/ -cpu_emergency_vmxoff (); -cpu_emergency_svm_disable (); +cpu_emergency_disable_virtualization ();/* * Disable Intel PT to stop its logging
arch/x86/kernel/reboot.c +53 -12
114 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 157/252 x86/reboot: Disable virtualization in an emergency if SVM is supported
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit d81f952aa657b76cea381384bef1fea35c5fd266 upstream.
Disable SVM on all CPUs via NMI shootdown during an emergency reboot. Like VMX, SVM can block INIT, e.g. if the emergency reboot is triggered between CLGI and STGI, and thus can prevent bringing up other CPUs via INIT-SIPI-SIPI.
--- arch/x86/kernel/reboot.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
arch/x86/kernel/reboot.c +11 -12
@@ -538,27 +538,26 @@ static inline void kb_wait(void)static inline void nmi_shootdown_cpus_on_restart (void ); -/* Use NMIs as IPIs to tell all CPUs to disable virtualization */ -static void emergency_vmx_disable_all (void ) +static void emergency_reboot_disable_virtualization (void ) {/* Just make sure we won't change CPUs while doing this */ local_irq_disable ();/* -* Disable VMX on all CPUs before rebooting, otherwise we risk hanging -* the machine, because the CPU blocks INIT when it's in VMX root. +* Disable virtualization on all CPUs before rebooting to avoid hanging +* the system, as VMX and SVM block INIT when running in the host. * * We can't take any locks and we may be on an inconsistent state, so -* use NMIs as IPIs to tell the other CPUs to exit VMX root and halt. +* use NMIs as IPIs to tell the other CPUs to disable VMX/SVM and halt. * -* Do the NMI shootdown even if VMX if off on _this_ CPU, as that -* doesn't prevent a different CPU from being in VMX root operation. +* Do the NMI shootdown even if virtualization is off on _this_ CPU, as +* other CPUs may have virtualization enabled. */ -if (cpu_has_vmx ()) { -/* Safely force _this_ CPU out of VMX root operation. */ -__cpu_emergency_vmxoff (); +if (cpu_has_vmx () ||cpu_has_svm (NULL )) { +/* Safely force _this_ CPU out of VMX/SVM operation. */ +cpu_emergency_disable_virtualization (); -/* Halt and exit VMX root operation on the other CPUs. */ +/* Disable VMX/SVM and halt on other CPUs. */ nmi_shootdown_cpus_on_restart (); }
@@ -596,7 +595,7 @@ static void native_machine_emergency_resunsigned short mode;if (reboot_emergency) -emergency_vmx_disable_all (); +emergency_reboot_disable_virtualization ();tboot_shutdown (TB_SHUTDOWN_REBOOT );
Greg Kroah-Hartman
maintainerPATCH 158/252 x86/reboot: Disable SVM, not just VMX, when stopping CPUs
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit a2b07fa7b93321c059af0c6d492cc9a4f1e390aa upstream.
Disable SVM and more importantly force GIF=1 when halting a CPU or rebooting the machine. Similar to VMX, SVM allows software to block INITs via CLGI, and thus can be problematic for a crash/reboot. The window for failure is smaller with SVM as INIT is only blocked while GIF=0, i.e. between CLGI and STGI, but the window does exist.
--- arch/x86/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/kernel/smp.c +3 -3
@@ -33,7 +33,7 @@#include <asm/mce.h> #include <asm/trace/irq_vectors.h> #include <asm/kexec.h> -#include <asm/virtext.h> +#include <asm/reboot.h> /* * Some notes on x86 processor bugs affecting SMP operation:
@@ -163,7 +163,7 @@ static int smp_stop_nmi_callback(unsigneif (raw_smp_processor_id () ==atomic_read (&stopping_cpu))return NMI_HANDLED ; -cpu_emergency_vmxoff (); +cpu_emergency_disable_virtualization ();stop_this_cpu (NULL );return NMI_HANDLED ;
@@ -176,7 +176,7 @@ static int smp_stop_nmi_callback(unsigne asmlinkage __visible void smp_reboot_interrupt(void) {ipi_entering_ack_irq (); -cpu_emergency_vmxoff (); +cpu_emergency_disable_virtualization ();stop_this_cpu (NULL );irq_exit (); }
Greg Kroah-Hartman
maintainerPATCH 159/252 x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
In reply to Greg Kroah-HartmanFrom: Yang Jihong <[email protected]>
commit 868a6fc0ca2407622d2833adefe1c4d284766c4c upstream.
Since the following commit:
commit f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code")
modified the update timing of the KPROBE_FLAG_OPTIMIZED, a optimized_kprobe may be in the optimizing or unoptimizing state when op.kp->flags has KPROBE_FLAG_OPTIMIZED and op->list is not empty.
The __recover_optprobed_insn check logic is incorrect, a kprobe in the unoptimizing state may be incorrectly determined as unoptimizing. As a result, incorrect instructions are copied.
The optprobe_queued_unopt function needs to be exported for invoking in arch directory.
--- arch/x86/kernel/kprobes/opt.c | 4 ++-- include/linux/kprobes.h | 1 + kernel/kprobes.c | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-)
arch/x86/kernel/kprobes/opt.c +2 -2
@@ -56,8 +56,8 @@ unsigned long __recover_optprobed_insn(k/* This function only handles jump-optimized kprobe */ if (kp &&kprobe_optimized (kp)) { op = container_of(kp, struct optimized_kprobe, kp); -/* If op->list is not empty, op is under optimizing */ -if (list_empty (&op->list)) +/* If op is optimized or under unoptimizing */ +if (list_empty (&op->list) ||optprobe_queued_unopt (op)) goto found; } }
include/linux/kprobes.h +1 -0
@@ -331,6 +331,7 @@ extern int proc_kprobes_optimization_han size_t *length, loff_t *ppos);#endif extern void wait_for_kprobe_optimizer (void ); +bool optprobe_queued_unopt (struct optimized_kprobe *op);#else static inline void wait_for_kprobe_optimizer (void ) { }#endif /* CONFIG_OPTPROBES */
kernel/kprobes.c +1 -1
@@ -626,7 +626,7 @@ void wait_for_kprobe_optimizer(void)mutex_unlock (&kprobe_mutex); } -static bool optprobe_queued_unopt (struct optimized_kprobe *op) +bool optprobe_queued_unopt (struct optimized_kprobe *op) {struct optimized_kprobe *_op;
Greg Kroah-Hartman
maintainerPATCH 160/252 x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
In reply to Greg Kroah-HartmanFrom: Yang Jihong <[email protected]>
commit f1c97a1b4ef709e3f066f82e3ba3108c3b133ae6 upstream.
When arch_prepare_optimized_kprobe calculating jump destination address, it copies original instructions from jmp-optimized kprobe (see __recover_optprobed_insn), and calculated based on length of original instruction.
arch_check_optimized_kprobe does not check KPROBE_FLAG_OPTIMATED when checking whether jmp-optimized kprobe exists.
As a result, setup_detour_execution may jump to a range that has been overwritten by jump destination address, resulting in an inval opcode error.
For example, assume that register two kprobes whose addresses are <func+9> and <func+11> in "func" function.
The original code of "func" function is as follows:
0xffffffff816cb5e9 <+9>: push %r12 0xffffffff816cb5eb <+11>: xor %r12d,%r12d 0xffffffff816cb5ee <+14>: test %rdi,%rdi 0xffffffff816cb5f1 <+17>: setne %r12b 0xffffffff816cb5f5 <+21>: push %rbp
1.Register the kprobe for <func+11>, assume that is kp1, corresponding optimized_kprobe is op1.
After the optimization, "func" code changes to:
0xffffffff816cc079 <+9>: push %r12 0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000 0xffffffff816cc080 <+16>: incl 0xf(%rcx) 0xffffffff816cc083 <+19>: xchg %eax,%ebp 0xffffffff816cc084 <+20>: (bad) 0xffffffff816cc085 <+21>: push %rbp
Now op1->flags == KPROBE_FLAG_OPTIMATED;
2. Register the kprobe for <func+9>, assume that is kp2, corresponding optimized_kprobe is op2.
register_kprobe(kp2)
register_aggr_kprobe
alloc_aggr_kprobe
__prepare_optimized_kprobe
arch_prepare_optimized_kprobe
__recover_optprobed_insn // copy original bytes from kp1->optinsn.copied_insn,
// jump address = <func+14>3. disable kp1:
disable_kprobe(kp1)
__disable_kprobe
...
if (p == orig_p || aggr_kprobe_disabled(orig_p)) {
ret = disarm_kprobe(orig_p, true) // add op1 in unoptimizing_list, not unoptimized
orig_p->flags |= KPROBE_FLAG_DISABLED; // op1->flags == KPROBE_FLAG_OPTIMATED | KPROBE_FLAG_DISABLED
...4. unregister kp2__unregister_kprobe_top
...
if (!kprobe_disabled(ap) && !kprobes_all_disarmed) {
optimize_kprobe(op)
...
if (arch_check_optimized_kprobe(op) < 0) // because op1 has KPROBE_FLAG_DISABLED, here not return
return;
p->kp.flags |= KPROBE_FLAG_OPTIMIZED; // now op2 has KPROBE_FLAG_OPTIMIZED}
"func" code now is:
0xffffffff816cc079 <+9>: int3 0xffffffff816cc07a <+10>: push %rsp 0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000 0xffffffff816cc080 <+16>: incl 0xf(%rcx) 0xffffffff816cc083 <+19>: xchg %eax,%ebp 0xffffffff816cc084 <+20>: (bad) 0xffffffff816cc085 <+21>: push %rbp
5. if call "func", int3 handler call setup_detour_execution:
if (p->flags & KPROBE_FLAG_OPTIMIZED) {
...
regs->ip = (unsigned long)op->optinsn.insn + TMPL_END_IDX;
...
}The code for the destination address is
0xffffffffa021072c: push %r12 0xffffffffa021072e: xor %r12d,%r12d 0xffffffffa0210731: jmp 0xffffffff816cb5ee <func+14>
However, <func+14> is not a valid start instruction address. As a result, an error occurs.
--- arch/x86/kernel/kprobes/opt.c | 2 +- include/linux/kprobes.h | 1 + kernel/kprobes.c | 4 ++-- 3 files changed, 4 insertions(+), 3 deletions(-)
arch/x86/kernel/kprobes/opt.c +1 -1
@@ -328,7 +328,7 @@ int arch_check_optimized_kprobe(struct ofor (i =1 ; i < op->optinsn.size; i++) { p =get_kprobe (op->kp.addr + i); -if (p && !kprobe_disabled (p)) +if (p && !kprobe_disarmed (p))return -EEXIST ; }
include/linux/kprobes.h +1 -0
@@ -332,6 +332,7 @@ extern int proc_kprobes_optimization_han#endif extern void wait_for_kprobe_optimizer (void );bool optprobe_queued_unopt (struct optimized_kprobe *op); +bool kprobe_disarmed (struct kprobe *p);#else static inline void wait_for_kprobe_optimizer (void ) { }#endif /* CONFIG_OPTPROBES */
kernel/kprobes.c +2 -2
@@ -418,8 +418,8 @@ static inline int kprobe_optready(structreturn 0 ; } -/* Return true(!0) if the kprobe is disarmed. Note: p must be on hash list */ -static inline int kprobe_disarmed (struct kprobe *p) +/* Return true if the kprobe is disarmed. Note: p must be on hash list */ +bool kprobe_disarmed (struct kprobe *p) {struct optimized_kprobe *op;
Greg Kroah-Hartman
maintainerPATCH 161/252 x86/microcode/amd: Remove load_microcode_amd()s bsp parameter
In reply to Greg Kroah-HartmanFrom: Borislav Petkov (AMD) <[email protected]>
commit 2355370cd941cbb20882cc3f34460f9f2b8f9a18 upstream.
It is always the BSP.
No functional changes.
--- arch/x86/kernel/cpu/microcode/amd.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-)
arch/x86/kernel/cpu/microcode/amd.c +5 -12
@@ -329,8 +329,7 @@ void load_ucode_amd_ap(unsigned int cpuiapply_microcode_early_amd (cpuid_1_eax, cp.data, cp.size, false); } -static enum ucode_state -load_microcode_amd (bool save,u8 family,const u8 *data,size_t size); +static enum ucode_state load_microcode_amd (u8 family,const u8 *data,size_t size);int __init save_microcode_in_initrd_amd (unsigned int cpuid_1_eax) {
@@ -348,7 +347,7 @@ int __init save_microcode_in_initrd_amd(if (!desc.mc)return -EINVAL ; - ret =load_microcode_amd (true,x86_family (cpuid_1_eax), desc.data, desc.size); + ret =load_microcode_amd (x86_family (cpuid_1_eax), desc.data, desc.size);if (ret >UCODE_UPDATED )return -EINVAL ;
@@ -698,8 +697,7 @@ static enum ucode_state __load_microcodereturn UCODE_OK ; } -static enum ucode_state -load_microcode_amd (bool save,u8 family,const u8 *data,size_t size) +static enum ucode_state load_microcode_amd (u8 family,const u8 *data,size_t size) {struct ucode_patch *p;enum ucode_state ret;
@@ -723,10 +721,6 @@ load_microcode_amd(bool save, u8 family, ret =UCODE_NEW ; } -/* save BSP's matching patch for early load */ -if (!save) -return ret; -memset (amd_ucode_patch,0 ,PATCH_MAX_SIZE );memcpy (amd_ucode_patch, p->data,min_t (u32,ksize (p->data),PATCH_MAX_SIZE ));
@@ -754,12 +748,11 @@ static enum ucode_state request_microcod {char fw_name[36 ] ="amd-ucode/microcode_amd.bin" ;struct cpuinfo_x86 *c = &cpu_data (cpu); -bool bsp = c->cpu_index == boot_cpu_data.cpu_index;enum ucode_state ret =UCODE_NFOUND ;const struct firmware *fw;/* reload ucode container only on the boot cpu */ -if (!refresh_fw || !bsp) +if (!refresh_fw)return UCODE_OK ;if (c->x86 >=0x15 )
@@ -776,7 +769,7 @@ static enum ucode_state request_microcod goto fw_release; } - ret =load_microcode_amd (bsp, c->x86, fw->data, fw->size); + ret =load_microcode_amd (c->x86, fw->data, fw->size); fw_release:release_firmware (fw);
Re: [PATCH 4.19 161/252] x86/microcode/amd: Remove load_microcode_amd()s bsp parameter
Quoted 8 lines · Greg Kroah-Hartman
From: Borislav Petkov (AMD) <[email protected]>
commit
2355370cd941cbb20882cc3f34460f9f2b8f9a18upstream.It is always the BSP.
No functional changes.
Does this not depend on commit 2071c0aeda22 "x86/microcode: Simplify init path even more"? That hasn't been backported to any stable branches.
Ben.
Quoted 74 lines
Signed-off-by Borislav Petkov (AMD) <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- arch/x86/kernel/cpu/microcode/amd.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-)arch/x86/kernel/cpu/microcode/amd.c +5
-12@@ -329,8 +329,7 @@ void load_ucode_amd_ap(unsigned int cpuiapply_microcode_early_amd (cpuid_1_eax, cp.data, cp.size, false); } -static enum ucode_state -load_microcode_amd (bool save,u8 family,const u8 *data,size_t size); +static enum ucode_state load_microcode_amd (u8 family,const u8 *data,size_t size);int __init save_microcode_in_initrd_amd (unsigned int cpuid_1_eax) {@@ -348,7 +347,7 @@ int __init save_microcode_in_initrd_amd(if (!desc.mc)return -EINVAL ; - ret =load_microcode_amd (true,x86_family (cpuid_1_eax), desc.data, desc.size); + ret =load_microcode_amd (x86_family (cpuid_1_eax), desc.data, desc.size);if (ret >UCODE_UPDATED )return -EINVAL ;@@ -698,8 +697,7 @@ static enum ucode_state __load_microcodereturn UCODE_OK ; } -static enum ucode_state -load_microcode_amd (bool save,u8 family,const u8 *data,size_t size) +static enum ucode_state load_microcode_amd (u8 family,const u8 *data,size_t size) {struct ucode_patch *p;enum ucode_state ret;@@ -723,10 +721,6 @@ load_microcode_amd(bool save, u8 family, ret =UCODE_NEW ; } -/* save BSP's matching patch for early load */ -if (!save) -return ret; -memset (amd_ucode_patch,0 ,PATCH_MAX_SIZE );memcpy (amd_ucode_patch, p->data,min_t (u32,ksize (p->data),PATCH_MAX_SIZE ));@@ -754,12 +748,11 @@ static enum ucode_state request_microcod {char fw_name[36 ] ="amd-ucode/microcode_amd.bin" ;struct cpuinfo_x86 *c = &cpu_data (cpu); -bool bsp = c->cpu_index == boot_cpu_data.cpu_index;enum ucode_state ret =UCODE_NFOUND ;const struct firmware *fw;/* reload ucode container only on the boot cpu */ -if (!refresh_fw || !bsp) +if (!refresh_fw)return UCODE_OK ;if (c->x86 >=0x15 )@@ -776,7 +769,7 @@ static enum ucode_state request_microcod goto fw_release; } - ret =load_microcode_amd (bsp, c->x86, fw->data, fw->size); + ret =load_microcode_amd (c->x86, fw->data, fw->size); fw_release:release_firmware (fw);
Signature · 5 lines
Ben Hutchings
[W]e found...that it wasn't as easy to get programs right as we had
thought. I realized that a large part of my life from then on was going
to be spent in finding mistakes in my own programs.
- Maurice Wilkes, 1949Greg Kroah-Hartman
maintainerRe: [PATCH 4.19 161/252] x86/microcode/amd: Remove load_microcode_amd()s bsp parameter
Quoted 5 lines · Ben Hutchings
Quoted 4 lines · Greg Kroah-Hartman
From: Borislav Petkov (AMD) <[email protected]>
commit
2355370cd941cbb20882cc3f34460f9f2b8f9a18upstream.
Quoted 8 lines
Quoted 4 lines
It is always the BSP.
No functional changes.
Does this not depend on commit
2071c0aeda22"x86/microcode: Simplify init path even more"? That hasn't been backported to any stable branches.
It didn't seem to need it to at least build properly. And it doesn't apply to the stable branches, so are you sure it's needed?
thanks,
greg k-h
Re: [PATCH 4.19 161/252] x86/microcode/amd: Remove load_microcode_amd()s bsp parameter
Quoted 11 lines · Greg Kroah-Hartman
Quoted 10 lines · Ben Hutchings
Quoted 8 lines · Greg Kroah-Hartman
From: Borislav Petkov (AMD) <[email protected]>
commit
2355370cd941cbb20882cc3f34460f9f2b8f9a18upstream.It is always the BSP.
No functional changes.
Quoted 6 lines
Quoted 3 lines
Does this not depend on commit
2071c0aeda22"x86/microcode: Simplify init path even more"? That hasn't been backported to any stable branches.It didn't seem to need it to at least build properly. And it doesn't apply to the stable branches, so are you sure it's needed?
This commit message says that load_microcode_amd() is always called with bsp=true. That doesn't seem to have been true before commit 2071c0aeda22, though I haven't tested it.
Ben.
Signature · 3 lines
Ben Hutchings
Usenet is essentially a HUGE group of people passing notes in class.
- Rachel Kadel, `A Quick Guide to Newsgroup Etiquette'Greg Kroah-Hartman
maintainerPATCH 162/252 x86/microcode/AMD: Add a @cpu parameter to the reloading functions
In reply to Greg Kroah-HartmanFrom: Borislav Petkov (AMD) <[email protected]>
commit a5ad92134bd153a9ccdcddf09a95b088f36c3cce upstream.
Will be used in a subsequent change.
--- arch/x86/include/asm/microcode.h | 4 ++-- arch/x86/include/asm/microcode_amd.h | 4 ++-- arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/cpu/microcode/core.c | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-)
arch/x86/include/asm/microcode.h +2 -2
@@ -130,7 +130,7 @@ static inline unsigned int x86_cpuid_famint __init microcode_init (void );extern void __init load_ucode_bsp (void );extern void load_ucode_ap (void ); -void reload_early_microcode (void ); +void reload_early_microcode (unsigned int cpu);extern bool get_builtin_firmware (struct cpio_data *cd,const char *name);extern bool initrd_gone;void microcode_bsp_resume (void );
@@ -138,7 +138,7 @@ void microcode_bsp_resume(void);static inline int __init microcode_init (void ) {return 0 ; };static inline void __init load_ucode_bsp (void ) { }static inline void load_ucode_ap (void ) { } -static inline void reload_early_microcode (void ) { } +static inline void reload_early_microcode (unsigned int cpu) { }static inline void microcode_bsp_resume (void ) { }static inline bool get_builtin_firmware (struct cpio_data *cd,const char *name) {return false; }
arch/x86/include/asm/microcode_amd.h +2 -2
@@ -47,12 +47,12 @@ struct microcode_amd {extern void __init load_ucode_amd_bsp (unsigned int family);extern void load_ucode_amd_ap (unsigned int family);extern int __init save_microcode_in_initrd_amd (unsigned int family); -void reload_ucode_amd (void ); +void reload_ucode_amd (unsigned int cpu);#else static inline void __init load_ucode_amd_bsp (unsigned int family) {}static inline void load_ucode_amd_ap (unsigned int family) {}static inline int __init save_microcode_in_initrd_amd (unsigned int family) {return -EINVAL ; } -void reload_ucode_amd (void ) {} +static inline void reload_ucode_amd (unsigned int cpu) {}#endif #endif /* _ASM_X86_MICROCODE_AMD_H */
arch/x86/kernel/cpu/microcode/amd.c +1 -1
@@ -354,7 +354,7 @@ int __init save_microcode_in_initrd_amd(return 0 ; } -void reload_ucode_amd (void ) +void reload_ucode_amd (unsigned int cpu) {struct microcode_amd *mc;u32 rev, dummy;
arch/x86/kernel/cpu/microcode/core.c +3 -3
@@ -326,7 +326,7 @@ struct cpio_data find_microcode_in_initr#endif } -void reload_early_microcode (void ) +void reload_early_microcode (unsigned int cpu) {int vendor, family;
@@ -340,7 +340,7 @@ void reload_early_microcode(void)break ;case X86_VENDOR_AMD :if (family >=0x10 ) -reload_ucode_amd (); +reload_ucode_amd (cpu);break ;default :break ;
@@ -783,7 +783,7 @@ void microcode_bsp_resume(void)if (uci->valid && uci->mc) microcode_ops->apply_microcode (cpu);else if (!uci->mc) -reload_early_microcode (); +reload_early_microcode (cpu); }static struct syscore_ops mc_syscore_ops = {
Greg Kroah-Hartman
maintainerPATCH 163/252 x86/microcode/AMD: Fix mixed steppings support
In reply to Greg Kroah-HartmanFrom: Borislav Petkov (AMD) <[email protected]>
commit 7ff6edf4fef38ab404ee7861f257e28eaaeed35f upstream.
The AMD side of the loader has always claimed to support mixed steppings. But somewhere along the way, it broke that by assuming that the cached patch blob is a single one instead of it being one per *node*.
So turn it into a per-node one so that each node can stash the blob relevant for it.
[ NB: Fixes tag is not really the exactly correct one but it is good
enough. ]
--- arch/x86/kernel/cpu/microcode/amd.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-)
arch/x86/kernel/cpu/microcode/amd.c +21 -13
@@ -54,7 +54,9 @@ struct cont_desc { };static u32 ucode_new_rev; -static u8 amd_ucode_patch[PATCH_MAX_SIZE ]; + +/* One blob per node. */ +static u8 amd_ucode_patch[MAX_NUMNODES ][PATCH_MAX_SIZE ];/* * Microcode patch container file is prepended to the initrd in cpio
@@ -210,7 +212,7 @@ apply_microcode_early_amd(u32 cpuid_1_ea patch = (u8 (*)[PATCH_MAX_SIZE ])__pa_nodebug (&amd_ucode_patch);#else new_rev = &ucode_new_rev; - patch = &amd_ucode_patch; + patch = &amd_ucode_patch[0 ];#endif desc.cpuid_1_eax = cpuid_1_eax;
@@ -356,10 +358,10 @@ int __init save_microcode_in_initrd_amd(void reload_ucode_amd (unsigned int cpu) { -struct microcode_amd *mc;u32 rev, dummy; +struct microcode_amd *mc; - mc = (struct microcode_amd *)amd_ucode_patch; + mc = (struct microcode_amd *)amd_ucode_patch[cpu_to_node (cpu)];rdmsr (MSR_AMD64_PATCH_LEVEL , rev, dummy);
@@ -699,6 +701,8 @@ static enum ucode_state __load_microcodestatic enum ucode_state load_microcode_amd (u8 family,const u8 *data,size_t size) { +struct cpuinfo_x86 *c; +unsigned int nid, cpu;struct ucode_patch *p;enum ucode_state ret;
@@ -711,18 +715,22 @@ static enum ucode_state load_microcode_areturn ret; } - p =find_patch (0 ); -if (!p) { -return ret; - }else { -if (boot_cpu_data.microcode >= p->patch_id) -return ret; +for_each_node (nid) { + cpu =cpumask_first (cpumask_of_node (nid)); + c = &cpu_data (cpu); + + p =find_patch (cpu); +if (!p) +continue ; + +if (c->microcode >= p->patch_id) +continue ; ret =UCODE_NEW ; - } -memset (amd_ucode_patch,0 ,PATCH_MAX_SIZE ); -memcpy (amd_ucode_patch, p->data,min_t (u32,ksize (p->data),PATCH_MAX_SIZE )); +memset (&amd_ucode_patch[nid],0 ,PATCH_MAX_SIZE ); +memcpy (&amd_ucode_patch[nid], p->data,min_t (u32,ksize (p->data),PATCH_MAX_SIZE )); + }return ret; }
Greg Kroah-Hartman
maintainerPATCH 164/252 x86/speculation: Allow enabling STIBP with legacy IBRS
In reply to Greg Kroah-HartmanFrom: KP Singh <[email protected]>
commit 6921ed9049bc7457f66c1596c5b78aec0dae4a9d upstream.
When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation() determines that STIBP is not needed.
The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection against which STIBP protects.
Exclude IBRS from the spectre_v2_in_ibrs_mode() check to allow for enabling STIBP (through seccomp/prctl() by default or always-on, if selected by spectre_v2_user kernel cmdline parameter).
[ bp: Massage. ]
--- arch/x86/kernel/cpu/bugs.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
arch/x86/kernel/cpu/bugs.c +18 -7
@@ -983,14 +983,18 @@ spectre_v2_parse_user_cmdline(void)return SPECTRE_V2_USER_CMD_AUTO ; } -static inline bool spectre_v2_in_ibrs_mode (enum spectre_v2_mitigation mode) +static inline bool spectre_v2_in_eibrs_mode (enum spectre_v2_mitigation mode) { -return mode ==SPECTRE_V2_IBRS || - mode ==SPECTRE_V2_EIBRS || +return mode ==SPECTRE_V2_EIBRS || mode ==SPECTRE_V2_EIBRS_RETPOLINE || mode ==SPECTRE_V2_EIBRS_LFENCE ; } +static inline bool spectre_v2_in_ibrs_mode (enum spectre_v2_mitigation mode) +{ +return spectre_v2_in_eibrs_mode (mode) || mode ==SPECTRE_V2_IBRS ; +} +static void __init spectre_v2_user_select_mitigation (void ) {
@@ -1053,12 +1057,19 @@ spectre_v2_user_select_mitigation(void) }/* -* If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible, -* STIBP is not required. +* If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP +* is not required. +* +* Enhanced IBRS also protects against cross-thread branch target +* injection in user-mode as the IBRS bit remains always set which +* implicitly enables cross-thread protections. However, in legacy IBRS +* mode, the IBRS bit is set only on kernel entry and cleared on return +* to userspace. This disables the implicit cross-thread protection, +* so allow for STIBP to be selected in that case. */ if (!boot_cpu_has (X86_FEATURE_STIBP ) || !smt_possible || -spectre_v2_in_ibrs_mode (spectre_v2_enabled)) +spectre_v2_in_eibrs_mode (spectre_v2_enabled))return ;/*
@@ -2110,7 +2121,7 @@ static ssize_t mmio_stale_data_show_statstatic char *stibp_state (void ) { -if (spectre_v2_in_ibrs_mode (spectre_v2_enabled)) +if (spectre_v2_in_eibrs_mode (spectre_v2_enabled))return "" ;switch (spectre_v2_user_stibp) {
Greg Kroah-Hartman
maintainerPATCH 165/252 Documentation/hw-vuln: Document the interaction between IBRS and STIBP
In reply to Greg Kroah-HartmanFrom: KP Singh <[email protected]>
commit e02b50ca442e88122e1302d4dbc1b71a4808c13f upstream.
Explain why STIBP is needed with legacy IBRS as currently implemented (KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled.
--- Documentation/admin-guide/hw-vuln/spectre.rst | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
Documentation/admin-guide/hw-vuln/spectre.rst +16 -5
@@ -479,8 +479,16 @@ Spectre variant 2 On Intel Skylake-era systems the mitigation covers most, but not all, cases. See :ref:`[3] <spec_ref3>` for more details. - On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced - IBRS on x86), retpoline is automatically disabled at run time. + On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS + or enhanced IBRS on x86), retpoline is automatically disabled at run time. + + Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at + boot, by setting the IBRS bit, and they're automatically protected against + Spectre v2 variant attacks, including cross-thread branch target injections + on SMT systems (STIBP). In other words, eIBRS enables STIBP too. + + Legacy IBRS systems clear the IBRS bit on exit to userspace and + therefore explicitly enable STIBP for that The retpoline mitigation is turned on by default on vulnerable CPUs. It can be forced on or off by the administrator
@@ -504,9 +512,12 @@ Spectre variant 2 For Spectre variant 2 mitigation, individual user programs can be compiled with return trampolines for indirect branches. This protects them from consuming poisoned entries in the branch - target buffer left by malicious software. Alternatively, the - programs can disable their indirect branch speculation via prctl() - (See :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`). + target buffer left by malicious software. + + On legacy IBRS systems, at return to userspace, implicit STIBP is disabled + because the kernel clears the IBRS bit. In this case, the userspace programs + can disable indirect branch speculation via prctl() (See + :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`). On x86, this will turn on STIBP to guard against attacks from the sibling thread when the user program is running, and use IBPB to flush the branch target buffer when switching to/from the program.