5.4.235-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 5.4.235-rc1 review
This is the start of the stable review cycle for the 5.4.235 release. There are 357 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 12 Mar 2023 13:36:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.235-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.235-rc1
Maxime Ripard <[email protected]>
dt-bindings: rtc: sun6i-a31-rtc: Loosen the requirements on the clocks
Stefan Haberland <[email protected]>
s390/dasd: add missing discipline function
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix race condition with usb_kill_urb
Ricardo Ribalda <[email protected]>
media: uvcvideo: Provide sync and async uvc_ctrl_status_event
Kuniyuki Iwashima <[email protected]>
tcp: Fix listen() regression in 5.4.229.
Nguyen Dinh Phi <[email protected]>
Bluetooth: hci_sock: purge socket queues in the destruct() callback
Linus Torvalds <[email protected]>
x86/resctl: fix scheduler confusion with 'current'
Valentin Schneider <[email protected]>
x86/resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid}Jakub Kicinski <[email protected]>
net: tls: avoid hanging tasks on the tx_lock
Jiapeng Chong <[email protected]>
phy: rockchip-typec: Fix unsigned comparison with less than zero
Mengyuan Lou <[email protected]>
PCI: Add ACS quirk for Wangxun NICs
Greg Kroah-Hartman <[email protected]>
kernel/fail_function: fix memory leak with using debugfs_lookup()
Daniel Scally <[email protected]>
usb: uvc: Enumerate valid values for color matching
Kees Cook <[email protected]>
USB: ene_usb6250: Allocate enough memory for full object
Kees Cook <[email protected]>
usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
Harshit Mogalapalli <[email protected]>
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
Harshit Mogalapalli <[email protected]>
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
Yulong Zhang <[email protected]>
tools/iio/iio_utils:fix memory leak
Alexander Usyskin <[email protected]>
mei: bus-fixup:upon error print return values of send and receive
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: disable the CTS when send break signal
Sven Schnelle <[email protected]>
tty: fix out-of-bounds access in tty_driver_lookup_tty()
Yuan Can <[email protected]>
staging: emxx_udc: Add checks for dma_alloc_coherent()
Kees Cook <[email protected]>
media: uvcvideo: Silence memcpy() run-time false positive warnings
Ricardo Ribalda <[email protected]>
media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
Guenter Roeck <[email protected]>
media: uvcvideo: Handle errors from calls to usb_string
Ricardo Ribalda <[email protected]>
media: uvcvideo: Handle cameras with invalid descriptors
Liang He <[email protected]>
mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
Darrell Kavanagh <[email protected]>
firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
Jia-Ju Bai <[email protected]>
tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
Randy Dunlap <[email protected]>
thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
Dan Carpenter <[email protected]>
thermal: intel: quark_dts: fix error pointer dereference
Arnd Bergmann <[email protected]>
scsi: ipr: Work around fortify-string warning
Samuel Holland <[email protected]>
rtc: sun6i: Always export the internal oscillator
Jernej Skrabec <[email protected]>
rtc: sun6i: Make external 32k oscillator optional
George Kennedy <[email protected]>
vc_screen: modify vcs_size() handling in vcs_read()
Eric Dumazet <[email protected]>
tcp: tcp_check_req() can be called from process context
Krzysztof Kozlowski <[email protected]>
ARM: dts: spear320-hmi: correct STMPE GPIO compatible
Pedro Tammela <[email protected]>
net/sched: act_sample: fix action bind logic
Fedor Pchelkin <[email protected]>
nfc: fix memory leak of se_io context in nfc_genl_se_io
Maor Dickman <[email protected]>
net/mlx5: Geneve, Fix handling of Geneve object id as error code
Zhengchao Shao <[email protected]>
9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
Juergen Gross <[email protected]>
9p/xen: fix connection sequence
Juergen Gross <[email protected]>
9p/xen: fix version parsing
Eric Dumazet <[email protected]>
net: fix __dev_kfree_skb_any() vs drop monitor
Xin Long <[email protected]>
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
Lu Wei <[email protected]>
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
Hangyu Hua <[email protected]>
netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
Li Hua <[email protected]>
watchdog: pcwd_usb: Fix attempting to access uninitialized memory
Chen Jun <[email protected]>
watchdog: Fix kmemleak in watchdog_cdev_register
ruanjinjie <[email protected]>
watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
Ammar Faizi <[email protected]>
x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
Zhihao Cheng <[email protected]>
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
Zhihao Cheng <[email protected]>
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Zhihao Cheng <[email protected]>
ubifs: ubifs_writepage: Mark page dirty after writing inode failed
Zhihao Cheng <[email protected]>
ubifs: dirty_cow_znode: Fix memleak in error handling path
Zhihao Cheng <[email protected]>
ubifs: Re-statistic cleaned znode count if commit failed
Yang Yingliang <[email protected]>
ubi: Fix possible null-ptr-deref in ubi_free_volume()
Li Zetao <[email protected]>
ubifs: Fix memory leak in alloc_wbufs()
Li Zetao <[email protected]>
ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
Li Zetao <[email protected]>
ubi: Fix use-after-free when volume resizing failed
Zhihao Cheng <[email protected]>
ubifs: Reserve one leb for each journal head while doing budget
Zhihao Cheng <[email protected]>
ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
Zhihao Cheng <[email protected]>
ubifs: Fix wrong dirty space budget for dirty inode
Zhihao Cheng <[email protected]>
ubifs: Rectify space budget for ubifs_xrename()
Zhihao Cheng <[email protected]>
ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
Li Hua <[email protected]>
ubifs: Fix build errors as symbol undefined
George Kennedy <[email protected]>
ubi: ensure that VID header offset + VID header size <= alloc, size
Xiang Yang <[email protected]>
um: vector: Fix memory leak in vector_config
Alexander Potapenko <[email protected]>
fs: f2fs: initialize fsdata in pagecache_write()
Eric Biggers <[email protected]>
f2fs: use memcpy_{to,from}_page() where possible
Fabrice Gasnier <[email protected]>
pwm: stm32-lp: fix the check on arr and cmp registers update
Emil Renner Berthing <[email protected]>
pwm: sifive: Always let the first pwm_apply_state succeed
Uwe Kleine-König <[email protected]>
pwm: sifive: Reduce time the controller lock is held
Liu Shixin via Jfs-discussion <[email protected]>
fs/jfs: fix shift exponent db_agl2size negative
Jamal Hadi Salim <[email protected]>
net/sched: Retire tcindex classifier
Dmitry Goncharov <[email protected]>
kbuild: Port silent mode detection to future gnu make.
Arnd Bergmann <[email protected]>
wifi: ath9k: use proper statements in conditionals
Mark Hawrylak <[email protected]>
drm/radeon: Fix eDP for single-display iMac11,2
Mavroudis Chatzilaridis <[email protected]>
drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
Damien Le Moal <[email protected]>
PCI: Avoid FLR for AMD FCH AHCI adapters
Lukas Wunner <[email protected]>
PCI: hotplug: Allow marking devices as disconnected during bind/unbind
Lukas Wunner <[email protected]>
PCI/PM: Observe reset delay irrespective of bridge_d3
Tomas Henzl <[email protected]>
scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
Tomas Henzl <[email protected]>
scsi: ses: Fix possible desc_ptr out-of-bounds accesses
Tomas Henzl <[email protected]>
scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
Tomas Henzl <[email protected]>
scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
James Bottomley <[email protected]>
scsi: ses: Don't attach if enclosure has no components
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix erroneous link down
Arun Easi <[email protected]>
scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix link failure in NPIV environment
Steven Rostedt <[email protected]>
ktest.pl: Add RUN_TIMEOUT option with default unlimited
Steven Rostedt <[email protected]>
ktest.pl: Fix missing "end_monitor" when machine check fails
Steven Rostedt <[email protected]>
ktest.pl: Give back console on Ctrt^C on monitor
Yin Fengwei <[email protected]>
mm/thp: check and bail out if page in deferred queue already
Johannes Weiner <[email protected]>
mm: memcontrol: deprecate charge moving
Sakari Ailus <[email protected]>
media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
Elvira Khabirova <[email protected]>
mips: fix syscall_get_nr
Al Viro <[email protected]>
alpha: fix FEN fault handling
Ilya Dryomov <[email protected]>
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct TMU phandle in Odroid XU
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct TMU phandle in Exynos4
Mikulas Patocka <[email protected]>
dm flakey: don't corrupt the zero page
Mikulas Patocka <[email protected]>
dm flakey: fix logic when corrupting a bio
Srinivas Pandruvada <[email protected]>
thermal: intel: powerclamp: Fix cur_state for multi package system
Alexander Wetzel <[email protected]>
wifi: cfg80211: Fix use after free for wext
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Use a longer retry limit of 48
Jun Nie <[email protected]>
ext4: refuse to create ea block when umounted
Jun Nie <[email protected]>
ext4: optimize ea_inode block expansion
Łukasz Stelmach <[email protected]>
ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
Dmitry Fomin <[email protected]>
ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
Johan Hovold <[email protected]>
irqdomain: Drop bogus fwspec-mapping error handling
Johan Hovold <[email protected]>
irqdomain: Fix disassociation race
Johan Hovold <[email protected]>
irqdomain: Fix association race
Roberto Sassu <[email protected]>
ima: Align ima_file_mmap() parameters with mmap_file LSM hook
KP Singh <[email protected]>
Documentation/hw-vuln: Document the interaction between IBRS and STIBP
KP Singh <[email protected]>
x86/speculation: Allow enabling STIBP with legacy IBRS
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Fix mixed steppings support
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Add a @cpu parameter to the reloading functions
Borislav Petkov (AMD) <[email protected]>
x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
Yang Jihong <[email protected]>
x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
Yang Jihong <[email protected]>
x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
Sean Christopherson <[email protected]>
x86/reboot: Disable SVM, not just VMX, when stopping CPUs
Sean Christopherson <[email protected]>
x86/reboot: Disable virtualization in an emergency if SVM is supported
Sean Christopherson <[email protected]>
x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
Sean Christopherson <[email protected]>
x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
Nico Boehr <[email protected]>
KVM: s390: disable migration mode when dirty tracking is disabled
Sean Christopherson <[email protected]>
KVM: Destroy target device if coalesced MMIO unregistration fails
Jan Kara <[email protected]>
udf: Fix file corruption when appending just after end of preallocated extent
Jan Kara <[email protected]>
udf: Detect system inodes linked into directory hierarchy
Jan Kara <[email protected]>
udf: Preserve link count of system files
Jan Kara <[email protected]>
udf: Do not update file length for failed writes to inline files
Jan Kara <[email protected]>
udf: Do not bother merging very long extents
Jan Kara <[email protected]>
udf: Truncate added extents on failed expansion
Heming Zhao via Ocfs2-devel <[email protected]>
ocfs2: fix non-auto defrag path not working issue
Heming Zhao via Ocfs2-devel <[email protected]>
ocfs2: fix defrag path triggering jbd2 ASSERT
Eric Biggers <[email protected]>
f2fs: fix cgroup writeback accounting with fs-layer encryption
Eric Biggers <[email protected]>
f2fs: fix information leak in f2fs_move_inline_dirents()
Dongliang Mu <[email protected]>
fs: hfsplus: fix UAF issue in hfsplus_put_super
Liu Shixin <[email protected]>
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct HDMI phy compatible in Exynos4
Vasily Gorbik <[email protected]>
s390/kprobes: fix current_kprobe never cleared after kprobes reenter
Vasily Gorbik <[email protected]>
s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
Ilya Leoshkevich <[email protected]>
s390: discard .interp section
Corey Minyard <[email protected]>
ipmi_ssif: Rename idle state and check
Johan Hovold <[email protected]>
rtc: pm8xxx: fix set-alarm race
Alper Nebi Yasak <[email protected]>
firmware: coreboot: framebuffer: Ignore reserved pixel color bits
Jun ASAKA <[email protected]>
wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
Jeff Layton <[email protected]>
nfsd: zero out pointers after putting nfsd_files on COPY setup error
Mike Snitzer <[email protected]>
dm cache: add cond_resched() to various workqueue loops
Mike Snitzer <[email protected]>
dm thin: add cond_resched() to various workqueue loops
Darrell Kavanagh <[email protected]>
drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
Claudiu Beznea <[email protected]>
pinctrl: at91: use devm_kasprintf() to avoid potential leaks
Robin Murphy <[email protected]>
hwmon: (coretemp) Simplify platform device handling
Kees Cook <[email protected]>
regulator: s5m8767: Bounds check id indexing into arrays
Kees Cook <[email protected]>
regulator: max77802: Bounds check regulator id against opmode
Kees Cook <[email protected]>
ASoC: kirkwood: Iterate over array indexes instead of using pointer math
Jakob Koschel <[email protected]>
docs/scripts/gdb: add necessary make scripts_gdb step
Jiasheng Jiang <[email protected]>
drm/msm/dsi: Add missing check for alloc_ordered_workqueue
Liwei Song <[email protected]>
drm/radeon: free iio for atombios when driver shutdown
Jingyuan Liang <[email protected]>
HID: Add Mapping for System Microphone Mute
Tomi Valkeinen <[email protected]>
drm/omap: dsi: Fix excessive stack usage
Roman Li <[email protected]>
drm/amd/display: Fix potential null-deref in dm_resume
Kees Cook <[email protected]>
uaccess: Add minimum bounds check on kernel buffer size
Kees Cook <[email protected]>
coda: Avoid partial allocation of sig_inputArgs
Shay Drory <[email protected]>
net/mlx5: fw_tracer: Fix debug print
Hans de Goede <[email protected]>
ACPI: video: Fix Lenovo Ideapad Z570 DMI match
Lorenzo Bianconi <[email protected]>
wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
Michael Schmitz <[email protected]>
m68k: Check syscall_trace_enter() return code
Florian Fainelli <[email protected]>
net: bcmgenet: Add a check for oversized packets
Mark Rutland <[email protected]>
ACPI: Don't build ACPICA with '-Os'
Jesse Brandeburg <[email protected]>
ice: add missing checks for PF vsi type
Pietro Borrello <[email protected]>
inet: fix fast path in __inet_hash_connect()
Jisoo Jang <[email protected]>
wifi: mt7601u: fix an integer underflow
Jisoo Jang <[email protected]>
wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
Breno Leitao <[email protected]>
x86/bugs: Reset speculation control settings on init
Jann Horn <[email protected]>
timers: Prevent union confusion from unexpected restart_syscall()
Yang Li <[email protected]>
thermal: intel: Fix unsigned comparison with less than zero
Paul E. McKenney <[email protected]>
rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
Jisoo Jang <[email protected]>
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
Li Nan <[email protected]>
blk-iocost: fix divide by 0 error in calc_lcoefs()
Markuss Broks <[email protected]>
ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
Jan Kara <[email protected]>
udf: Define EFSCORRUPTED error code
Bjorn Andersson <[email protected]>
rpmsg: glink: Avoid infinite loop on intent for missing channel
Duoming Zhou <[email protected]>
media: usb: siano: Fix use after free bugs caused by do_submit_urb
Hans Verkuil <[email protected]>
media: i2c: ov7670: 0 instead of -EINVAL was returned
Duoming Zhou <[email protected]>
media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
Yuan Can <[email protected]>
media: i2c: ov772x: Fix memleak in ov772x_probe()
Shang XiaoJing <[email protected]>
media: ov5675: Fix memleak in ov5675_init_controls()
Nathan Chancellor <[email protected]>
powerpc: Remove linker flag from KBUILD_AFLAGS
Jiasheng Jiang <[email protected]>
media: platform: ti: Add missing check for devm_regulator_get
Sibi Sankar <[email protected]>
remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
Randy Dunlap <[email protected]>
MIPS: vpe-mt: drop physical_memsize
Randy Dunlap <[email protected]>
MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set
Ganesh Goudar <[email protected]>
powerpc/eeh: Set channel state after notifying the drivers
Daniel Axtens <[email protected]>
powerpc/eeh: Small refactor of eeh_handle_normal_event()
Nathan Lynch <[email protected]>
powerpc/rtas: ensure 4KB alignment for rtas_data_buf
Nathan Lynch <[email protected]>
powerpc/rtas: make all exports GPL
Nathan Lynch <[email protected]>
powerpc/pseries/lparcfg: add missing RTAS retry status handling
Nathan Lynch <[email protected]>
powerpc/pseries/lpar: add missing RTAS retry status handling
Chen-Yu Tsai <[email protected]>
clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
Frederic Barrat <[email protected]>
powerpc/powernv/ioda: Skip unallocated resources when mapping to PE
Dmitry Baryshkov <[email protected]>
clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC
Luca Ellero <[email protected]>
Input: ads7846 - don't check penirq immediately for 7845
Luca Ellero <[email protected]>
Input: ads7846 - don't report pressure for ads7845
Geert Uytterhoeven <[email protected]>
clk: renesas: cpg-mssr: Remove superfluous check in resume code
Yoshihiro Shimoda <[email protected]>
clk: renesas: cpg-mssr: Use enum clk_reg_layout instead of a boolean flag
Alexey Khoroshilov <[email protected]>
clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed
Samuel Holland <[email protected]>
mtd: rawnand: sunxi: Fix the size of the last OOB region
Dmitry Baryshkov <[email protected]>
clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents
Dmitry Baryshkov <[email protected]>
clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
Qiheng Lin <[email protected]>
mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Fix bash specific "==" operator
Randy Dunlap <[email protected]>
sparc: allow PM configs for sparc32 COMPILE_TEST
Yicong Yang <[email protected]>
perf tools: Fix auto-complete on aarch64
Ian Rogers <[email protected]>
perf llvm: Fix inadvertent file creation
Andreas Gruenbacher <[email protected]>
gfs2: jdata writepage fix
Zhang Xiaoxu <[email protected]>
cifs: Fix warning and UAF when destroy the MR list
Zhang Xiaoxu <[email protected]>
cifs: Fix lost destroy smbd connection when MR allocate failed
Benjamin Coddington <[email protected]>
nfsd: fix race to check ls_layouts
Pietro Borrello <[email protected]>
hid: bigben_probe(): validate report count
Hans de Goede <[email protected]>
HID: asus: Fix mute and touchpad-toggle keys on Medion Akoya E1239T
Hans de Goede <[email protected]>
HID: asus: Add support for multi-touch touchpad on Medion Akoya E1239T
Hans de Goede <[email protected]>
HID: asus: Add report_size to struct asus_touchpad_info
Hans de Goede <[email protected]>
HID: asus: Only set EV_REP if we are adding a mapping
Pietro Borrello <[email protected]>
HID: bigben: use spinlock to safely schedule workers
Pietro Borrello <[email protected]>
HID: bigben_worker() remove unneeded check on report_field
Pietro Borrello <[email protected]>
HID: bigben: use spinlock to protect concurrent accesses
Lucas Tanure <[email protected]>
ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
Tzung-Bi Shih <[email protected]>
ASoC: dapm: declare missing structure prototypes
Christophe JAILLET <[email protected]>
spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
Mike Snitzer <[email protected]>
dm: remove flush_scheduled_work() during local_exit()
Vadim Pasternak <[email protected]>
hwmon: (mlxreg-fan) Return zero speed for broken fan
William Zhang <[email protected]>
spi: bcm63xx-hsspi: Fix multi-bit mode setting
Álvaro Fernández Rojas <[email protected]>
spi: bcm63xx-hsspi: fix pm_runtime
Jiasheng Jiang <[email protected]>
scsi: aic94xx: Add missing check for dma_map_single()
Jonathan Cormier <[email protected]>
hwmon: (ltc2945) Handle error case in ltc2945_value_store
Haibo Chen <[email protected]>
gpio: vf610: connect GPIO label to dev name
Kuninori Morimoto <[email protected]>
ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
Nícolas F. R. A. Prado <[email protected]>
drm/mediatek: Clean dangling pointer on bind error path
Rob Clark <[email protected]>
drm/mediatek: Drop unbalanced obj unref
Miles Chen <[email protected]>
drm/mediatek: Use NULL instead of 0 for NULL pointer
Wambui Karuga <[email protected]>
drm/mediatek: remove cast to pointers passed to kfree
Mikko Perttunen <[email protected]>
gpu: host1x: Don't skip assigning syncpoints to channels
Jiasheng Jiang <[email protected]>
drm/msm/mdp5: Add check for kzalloc
Thomas Zimmermann <[email protected]>
drm: Initialize struct drm_crtc_state.no_vblank from device settings
Boris Brezillon <[email protected]>
drm/bridge: Introduce drm_bridge_get_next_bridge()
Boris Brezillon <[email protected]>
drm/bridge: Rename bridge helpers targeting a bridge chain
Boris Brezillon <[email protected]>
drm/exynos: Don't reset bridge->next
Jiasheng Jiang <[email protected]>
drm/msm/dpu: Add check for pstates
Jiasheng Jiang <[email protected]>
drm/msm/dpu: Add check for cstate
Dmitry Baryshkov <[email protected]>
drm/msm: use strscpy instead of strncpy
Daniel Mentz <[email protected]>
drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
Alexey V. Vissarionov <[email protected]>
ALSA: hda/ca0132: minor fix for allocation size
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: initialize is_dsp_mode flag
Miaoqian Lin <[email protected]>
pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
Jiasheng Jiang <[email protected]>
drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
Liang He <[email protected]>
gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
Dave Stevenson <[email protected]>
drm/vc4: dpi: Fix format mapping for RGB565
Dave Stevenson <[email protected]>
drm/vc4: dpi: Add option for inverting pixel clock and output enable
Yuan Can <[email protected]>
drm/bridge: megachips: Fix error handling in i2c_register_driver()
Geert Uytterhoeven <[email protected]>
drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
Geert Uytterhoeven <[email protected]>
drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
Roxana Nicolescu <[email protected]>
selftest: fib_tests: Always cleanup before exit
Jakub Sitnicki <[email protected]>
selftests/net: Interpret UDP_GRO cmsg data as an int value
Florian Fainelli <[email protected]>
irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
Florian Fainelli <[email protected]>
irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
Frank Jungclaus <[email protected]>
can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
Yongqin Liu <[email protected]>
thermal/drivers/hisi: Drop second sensor hi3660
Shayne Chen <[email protected]>
wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
Herbert Xu <[email protected]>
crypto: crypto4xx - Call dma_unmap_page when done
Dan Carpenter <[email protected]>
wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
Jiasheng Jiang <[email protected]>
wifi: iwl4965: Add missing check for create_singlethread_workqueue()
Jiasheng Jiang <[email protected]>
wifi: iwl3945: Add missing check for create_singlethread_workqueue
Kees Cook <[email protected]>
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
Kees Cook <[email protected]>
usb: gadget: udc: Avoid tasklet passing a global
Conor Dooley <[email protected]>
RISC-V: time: initialize hrtimer based broadcast clock event device
Randy Dunlap <[email protected]>
m68k: /proc/hardware should depend on PROC_FS
Herbert Xu <[email protected]>
crypto: rsa-pkcs1pad - Use akcipher_request_complete
Pietro Borrello <[email protected]>
rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
Ilya Leoshkevich <[email protected]>
libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix potential user-after-free
Qi Zheng <[email protected]>
OPP: fix error checking in opp_migrate_dentry()
Pietro Borrello <[email protected]>
tap: tap_open(): correctly initialize socket uid
Pietro Borrello <[email protected]>
tun: tun_chr_open(): correctly initialize socket uid
Pietro Borrello <[email protected]>
net: add sock_init_data_uid()
Geliang Tang <[email protected]>
mptcp: add sk_stop_timer_sync helper
Miaoqian Lin <[email protected]>
irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
Miaoqian Lin <[email protected]>
irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
Miaoqian Lin <[email protected]>
irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
Jack Morgenstein <[email protected]>
net/mlx5: Enhance debug print in page allocation failure
Yang Yingliang <[email protected]>
powercap: fix possible name leak in powercap_register_zone()
Herbert Xu <[email protected]>
crypto: seqiv - Handle EBUSY correctly
Herbert Xu <[email protected]>
crypto: essiv - Handle EBUSY correctly
Chen Wandun <[email protected]>
crypto: essiv - remove redundant null pointer check before kfree
Koba Ko <[email protected]>
crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
Armin Wolf <[email protected]>
ACPI: battery: Fix missing NUL-termination with large strings
Minsuk Kang <[email protected]>
wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
Fedor Pchelkin <[email protected]>
wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
Pavel Skripkin <[email protected]>
ath9k: htc: clean up statistics macros
Wan Jiabing <[email protected]>
ath9k: hif_usb: simplify if-if to if-else
Fedor Pchelkin <[email protected]>
wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
Alexey Kodanev <[email protected]>
wifi: orinoco: check return value of hermes_write_wordrec()
Daniil Tatianin <[email protected]>
ACPICA: nsrepair: handle cases without a return value correctly
Herbert Xu <[email protected]>
lib/mpi: Fix buffer overrun when SG is too long
Zhen Lei <[email protected]>
genirq: Fix the return type of kstat_cpu_irqs_sum()
Mario Limonciello <[email protected]>
ACPICA: Drop port I/O validation for some regions
Eric Biggers <[email protected]>
crypto: x86/ghash - fix unaligned access in ghash_setkey()
Yang Yingliang <[email protected]>
wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
Zhengchao Shao <[email protected]>
wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
Zhang Changzhong <[email protected]>
wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
Zhang Changzhong <[email protected]>
wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
Luc Van Oostenryck <[email protected]>
wilc1000: let wilc_mac_xmit() return NETDEV_TX_OK
Zhengchao Shao <[email protected]>
wifi: ipw2200: fix memory leak in ipw_wdev_init()
Yang Yingliang <[email protected]>
wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
Christophe JAILLET <[email protected]>
ipw2x00: switch from 'pci_' to 'dma_' API
Li Zetao <[email protected]>
wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
Arnd Bergmann <[email protected]>
rtlwifi: fix -Wpointer-sign warning
Yang Yingliang <[email protected]>
wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
Zhengchao Shao <[email protected]>
wifi: libertas: fix memory leak in lbs_init_adapter()
Yang Yingliang <[email protected]>
wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
Markus Elfring <[email protected]>
net/wireless: Delete unnecessary checks before the macro call “dev_kfree_skb”
Yuan Can <[email protected]>
wifi: rsi: Fix memory leak in rsi_coex_attach()
Martin K. Petersen <[email protected]>
block: bio-integrity: Copy flags when bio_integrity_payload is cloned
Pietro Borrello <[email protected]>
sched/rt: pick_next_rt_entity(): check list_entry
Dietmar Eggemann <[email protected]>
sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
Qiheng Lin <[email protected]>
s390/dasd: Fix potential memleak in dasd_eckd_init()
Jan Höppner <[email protected]>
s390/dasd: Prepare for additional path event handling
Kemeng Shi <[email protected]>
blk-mq: correct stale comment of .get_budget
Kemeng Shi <[email protected]>
blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
Kemeng Shi <[email protected]>
blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
Salman Qazi <[email protected]>
block: Limit number of items taken from the I/O scheduler in one go
Douglas Anderson <[email protected]>
Revert "scsi: core: run queue if SCSI device queue isn't ready and queue is idle"
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
Peng Fan <[email protected]>
ARM: dts: imx7s: correct iomuxc gpr mux controller cells
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
Angus Chen <[email protected]>
ARM: imx: Call ida_simple_remove() for ida_simple_get
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
Yang Yingliang <[email protected]>
ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
Christian Hewitt <[email protected]>
arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
Martin Blumenstingl <[email protected]>
arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
Martin Blumenstingl <[email protected]>
arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
Martin Blumenstingl <[email protected]>
arm64: dts: meson-gx: Fix Ethernet MAC address unit name
Qiheng Lin <[email protected]>
ARM: zynq: Fix refcount leak in zynq_early_slcr_init
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: qcs404: use symbol names for PCIe resets
Chen Hui <[email protected]>
ARM: OMAP2+: Fix memory leak in realtime_counter_init()
Pietro Borrello <[email protected]>
HID: asus: use spinlock to safely schedule workers
Pietro Borrello <[email protected]>
HID: asus: use spinlock to protect concurrent accesses
Luke D. Jones <[email protected]>
HID: asus: Remove check for same LED brightness on set
-------------
Diffstat:
Documentation/admin-guide/cgroup-v1/memory.rst | 13 +- Documentation/admin-guide/hw-vuln/spectre.rst | 21 +- Documentation/dev-tools/gdb-kernel-debugging.rst | 4 + .../bindings/rtc/allwinner,sun6i-a31-rtc.yaml | 1 - Documentation/virt/kvm/api.txt | 18 +- Documentation/virt/kvm/devices/vm.txt | 4 + Makefile | 15 +- arch/alpha/kernel/traps.c | 30 +- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- arch/arm/boot/dts/exynos4-cpu-thermal.dtsi | 2 +- arch/arm/boot/dts/exynos4.dtsi | 2 +- arch/arm/boot/dts/exynos5410-odroidxu.dts | 1 - arch/arm/boot/dts/exynos5420.dtsi | 2 +- arch/arm/boot/dts/imx7s.dtsi | 2 +- arch/arm/boot/dts/spear320-hmi.dts | 2 +- arch/arm/mach-imx/mmdc.c | 24 +- arch/arm/mach-omap1/timer.c | 2 +- arch/arm/mach-omap2/timer.c | 1 + arch/arm/mach-zynq/slcr.c | 1 + arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 4 +- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 - arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +- .../dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 +- arch/m68k/68000/entry.S | 2 + arch/m68k/Kconfig.devices | 1 + arch/m68k/coldfire/entry.S | 2 + arch/m68k/kernel/entry.S | 3 + arch/mips/include/asm/syscall.h | 2 +- arch/mips/include/asm/vpe.h | 1 - arch/mips/kernel/smp-cps.c | 8 +- arch/mips/kernel/vpe-mt.c | 7 +- arch/mips/lantiq/prom.c | 6 - arch/powerpc/Makefile | 2 +- arch/powerpc/kernel/eeh_driver.c | 71 +- arch/powerpc/kernel/rtas.c | 24 +- arch/powerpc/platforms/powernv/pci-ioda.c | 3 +- arch/powerpc/platforms/pseries/lpar.c | 20 +- arch/powerpc/platforms/pseries/lparcfg.c | 20 +- arch/riscv/kernel/time.c | 3 + arch/s390/kernel/kprobes.c | 4 +- arch/s390/kernel/vmlinux.lds.S | 1 + arch/s390/kvm/kvm-s390.c | 16 + arch/sparc/Kconfig | 2 +- arch/um/drivers/vector_kern.c | 1 + arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +- arch/x86/include/asm/microcode.h | 4 +- arch/x86/include/asm/microcode_amd.h | 4 +- arch/x86/include/asm/msr-index.h | 4 + arch/x86/include/asm/reboot.h | 2 + arch/x86/include/asm/resctrl_sched.h | 19 +- arch/x86/include/asm/virtext.h | 16 +- arch/x86/kernel/cpu/bugs.c | 35 +- arch/x86/kernel/cpu/microcode/amd.c | 53 +- arch/x86/kernel/cpu/microcode/core.c | 6 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 14 +- arch/x86/kernel/crash.c | 17 +- arch/x86/kernel/kprobes/opt.c | 6 +- arch/x86/kernel/process_32.c | 2 +- arch/x86/kernel/process_64.c | 2 +- arch/x86/kernel/reboot.c | 88 ++- arch/x86/kernel/smp.c | 6 +- arch/x86/kernel/sysfb_efi.c | 8 + arch/x86/um/vdso/um_vdso.c | 12 +- block/bio-integrity.c | 1 + block/blk-iocost.c | 11 +- block/blk-mq-sched.c | 71 +- block/blk-mq.c | 6 +- crypto/essiv.c | 10 +- crypto/rsa-pkcs1pad.c | 34 +- crypto/seqiv.c | 2 +- drivers/acpi/acpica/Makefile | 2 +- drivers/acpi/acpica/hwvalid.c | 7 +- drivers/acpi/acpica/nsrepair.c | 12 +- drivers/acpi/battery.c | 2 +- drivers/acpi/video_detect.c | 2 +- drivers/block/rbd.c | 20 +- drivers/char/ipmi/ipmi_ssif.c | 46 +- drivers/clk/clk.c | 11 + drivers/clk/qcom/gcc-qcs404.c | 24 +- drivers/clk/qcom/gpucc-sdm845.c | 7 +- drivers/clk/renesas/r7s9210-cpg-mssr.c | 2 +- drivers/clk/renesas/renesas-cpg-mssr.c | 29 +- drivers/clk/renesas/renesas-cpg-mssr.h | 12 +- drivers/crypto/amcc/crypto4xx_core.c | 10 +- drivers/crypto/ccp/ccp-dmaengine.c | 21 +- drivers/firmware/google/framebuffer-coreboot.c | 4 +- drivers/gpio/gpio-vf610.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +- drivers/gpu/drm/drm_atomic_helper.c | 29 +- drivers/gpu/drm/drm_bridge.c | 125 ++-- drivers/gpu/drm/drm_encoder.c | 2 +- drivers/gpu/drm/drm_fourcc.c | 4 + drivers/gpu/drm/drm_mipi_dsi.c | 52 ++ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/drm_probe_helper.c | 2 +- drivers/gpu/drm/drm_vblank.c | 28 + drivers/gpu/drm/exynos/exynos_dp.c | 1 - drivers/gpu/drm/exynos/exynos_drm_dsi.c | 8 +- drivers/gpu/drm/i915/display/intel_quirks.c | 2 + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 8 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 +- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 7 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 3 + drivers/gpu/drm/msm/hdmi/hdmi.c | 4 + drivers/gpu/drm/msm/msm_fence.c | 2 +- drivers/gpu/drm/mxsfb/Kconfig | 1 + drivers/gpu/drm/omapdrm/dss/dsi.c | 26 +- drivers/gpu/drm/omapdrm/omap_drv.c | 4 +- drivers/gpu/drm/omapdrm/omap_encoder.c | 3 +- drivers/gpu/drm/radeon/atombios_encoders.c | 5 +- drivers/gpu/drm/radeon/radeon_device.c | 1 + drivers/gpu/drm/vc4/vc4_dpi.c | 66 +- drivers/gpu/drm/vc4/vc4_dsi.c | 8 +- drivers/gpu/host1x/hw/syncpt_hw.c | 3 - drivers/gpu/ipu-v3/ipu-common.c | 1 + drivers/hid/hid-asus.c | 136 +++- drivers/hid/hid-bigbenff.c | 75 ++- drivers/hid/hid-debug.c | 1 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 8 + drivers/hwmon/coretemp.c | 128 ++-- drivers/hwmon/ltc2945.c | 2 + drivers/hwmon/mlxreg-fan.c | 6 + drivers/iio/accel/mma9551_core.c | 10 +- drivers/input/keyboard/omap-keypad.c | 2 +- drivers/input/serio/hil_mlc.c | 2 +- drivers/input/touchscreen/ads7846.c | 13 +- drivers/irqchip/irq-alpine-msi.c | 1 + drivers/irqchip/irq-bcm7120-l2.c | 3 +- drivers/irqchip/irq-brcmstb-l2.c | 6 +- drivers/irqchip/irq-mvebu-gicp.c | 1 + drivers/irqchip/irq-ti-sci-intr.c | 1 + drivers/md/dm-cache-target.c | 4 + drivers/md/dm-flakey.c | 30 +- drivers/md/dm-thin.c | 2 + drivers/md/dm.c | 1 - drivers/media/i2c/ov5675.c | 4 +- drivers/media/i2c/ov7670.c | 2 +- drivers/media/i2c/ov772x.c | 3 +- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 3 + drivers/media/platform/omap3isp/isp.c | 9 + drivers/media/rc/ene_ir.c | 3 +- drivers/media/usb/siano/smsusb.c | 1 + drivers/media/usb/uvc/uvc_ctrl.c | 30 +- drivers/media/usb/uvc/uvc_driver.c | 66 +- drivers/media/usb/uvc/uvc_entity.c | 2 +- drivers/media/usb/uvc/uvc_status.c | 40 +- drivers/media/usb/uvc/uvc_video.c | 15 +- drivers/media/usb/uvc/uvcvideo.h | 6 +- drivers/mfd/arizona-core.c | 2 +- drivers/mfd/pcf50633-adc.c | 7 +- drivers/misc/mei/bus-fixup.c | 8 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- drivers/mtd/ubi/build.c | 7 + drivers/mtd/ubi/vmt.c | 18 +- drivers/mtd/ubi/wl.c | 25 +- drivers/net/can/usb/esd_usb2.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 + drivers/net/ethernet/intel/ice/ice_main.c | 17 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../net/ethernet/mellanox/mlx5/core/lib/geneve.c | 1 + .../net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 +- drivers/net/tap.c | 2 +- drivers/net/tun.c | 2 +- drivers/net/wan/farsync.c | 4 +- drivers/net/wireless/ath/ath10k/wmi.c | 4 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 60 +- drivers/net/wireless/ath/ath9k/htc.h | 32 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +- drivers/net/wireless/ath/ath9k/wmi.c | 1 + .../wireless/broadcom/brcm80211/brcmfmac/common.c | 7 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 121 ++-- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 67 +- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 24 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 +- drivers/net/wireless/intel/iwlegacy/common.c | 8 +- drivers/net/wireless/intersil/orinoco/hw.c | 2 + drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- drivers/net/wireless/marvell/libertas/main.c | 3 +- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- drivers/net/wireless/marvell/mwifiex/11n.c | 6 +- drivers/net/wireless/mediatek/mt76/dma.c | 13 +- .../net/wireless/mediatek/mt76/mt76x02_beacon.c | 5 +- drivers/net/wireless/mediatek/mt7601u/dma.c | 3 +- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 11 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 91 ++- .../net/wireless/realtek/rtlwifi/rtl8821ae/table.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/table.h | 4 +- drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + drivers/net/wireless/st/cw1200/scan.c | 3 +- drivers/net/wireless/wl3501_cs.c | 2 +- drivers/nfc/st-nci/se.c | 6 + drivers/nfc/st21nfca/se.c | 6 + drivers/opp/debugfs.c | 2 +- drivers/pci/pci.c | 2 +- drivers/pci/pci.h | 43 +- drivers/pci/quirks.c | 23 + drivers/phy/rockchip/phy-rockchip-typec.c | 3 +- drivers/pinctrl/pinctrl-at91-pio4.c | 4 +- drivers/pinctrl/pinctrl-at91.c | 2 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + drivers/powercap/powercap_sys.c | 14 +- drivers/pwm/pwm-sifive.c | 16 +- drivers/pwm/pwm-stm32-lp.c | 2 +- drivers/regulator/max77802-regulator.c | 34 +- drivers/regulator/s5m8767.c | 6 +- drivers/remoteproc/qcom_q6v5_mss.c | 59 +- drivers/rpmsg/qcom_glink_native.c | 1 + drivers/rtc/rtc-pm8xxx.c | 24 +- drivers/rtc/rtc-sun6i.c | 32 +- drivers/s390/block/dasd.c | 4 +- drivers/s390/block/dasd_diag.c | 8 +- drivers/s390/block/dasd_eckd.c | 82 ++- drivers/s390/block/dasd_fba.c | 8 +- drivers/s390/block/dasd_int.h | 2 +- drivers/s390/crypto/ap_bus.c | 2 +- drivers/scsi/aic94xx/aic94xx_task.c | 3 + drivers/scsi/ipr.c | 41 +- drivers/scsi/qla2xxx/qla_nvme.c | 19 +- drivers/scsi/qla2xxx/qla_os.c | 9 +- drivers/scsi/scsi_lib.c | 7 +- drivers/scsi/ses.c | 64 +- drivers/spi/spi-bcm63xx-hsspi.c | 20 +- drivers/spi/spi-synquacer.c | 7 +- drivers/staging/emxx_udc/emxx_udc.c | 7 +- drivers/staging/most/dim2/dim2.c | 2 +- drivers/staging/octeon/ethernet-tx.c | 2 +- drivers/staging/wilc1000/wilc_netdev.c | 7 +- drivers/thermal/hisi_thermal.c | 4 - drivers/thermal/intel/Kconfig | 3 +- drivers/thermal/intel/intel_powerclamp.c | 20 +- drivers/thermal/intel/intel_quark_dts_thermal.c | 12 +- drivers/thermal/intel/intel_soc_dts_iosf.c | 2 +- drivers/tty/serial/fsl_lpuart.c | 24 +- drivers/tty/tty_io.c | 8 +- drivers/tty/vt/keyboard.c | 2 +- drivers/tty/vt/vc_screen.c | 4 +- drivers/usb/gadget/udc/snps_udc_core.c | 6 +- drivers/usb/host/fhci-sched.c | 2 +- drivers/usb/host/xhci-mvebu.c | 2 +- drivers/usb/storage/ene_ub6250.c | 2 +- drivers/watchdog/at91sam9_wdt.c | 7 +- drivers/watchdog/pcwd_usb.c | 6 +- drivers/watchdog/watchdog_dev.c | 2 +- fs/cifs/smbdirect.c | 4 +- fs/coda/upcall.c | 2 +- fs/ext4/xattr.c | 35 +- fs/f2fs/data.c | 6 +- fs/f2fs/inline.c | 28 +- fs/f2fs/super.c | 11 +- fs/f2fs/verity.c | 12 +- fs/gfs2/aops.c | 3 +- fs/hfs/bnode.c | 1 + fs/hfsplus/super.c | 4 +- fs/jfs/jfs_dmap.c | 3 +- fs/nfsd/nfs4layouts.c | 4 +- fs/nfsd/nfs4proc.c | 2 + fs/ocfs2/move_extents.c | 34 +- fs/ubifs/budget.c | 9 +- fs/ubifs/dir.c | 9 +- fs/ubifs/file.c | 12 +- fs/ubifs/super.c | 17 +- fs/ubifs/tnc.c | 24 +- fs/ubifs/ubifs.h | 5 + fs/udf/file.c | 26 +- fs/udf/inode.c | 74 +-- fs/udf/super.c | 1 + fs/udf/udf_i.h | 3 +- fs/udf/udf_sb.h | 2 + include/drm/drm_bridge.h | 77 ++- include/drm/drm_crtc.h | 34 +- include/drm/drm_mipi_dsi.h | 4 + include/drm/drm_simple_kms_helper.h | 7 +- include/drm/drm_vblank.h | 1 + include/linux/ima.h | 6 +- include/linux/interrupt.h | 15 +- include/linux/kernel_stat.h | 2 +- include/linux/kprobes.h | 2 + include/linux/pci_ids.h | 2 + include/linux/uaccess.h | 4 + include/net/sctp/structs.h | 1 + include/net/sock.h | 9 +- include/sound/soc-dapm.h | 3 + include/uapi/linux/usb/video.h | 30 + include/uapi/linux/uvcvideo.h | 2 +- kernel/backtracetest.c | 2 +- kernel/debug/debug_core.c | 2 +- kernel/fail_function.c | 5 +- kernel/irq/irqdomain.c | 31 +- kernel/irq/resend.c | 2 +- kernel/kprobes.c | 6 +- kernel/rcu/tree_exp.h | 2 + kernel/sched/deadline.c | 5 +- kernel/sched/rt.c | 10 +- kernel/time/hrtimer.c | 2 + kernel/time/posix-stubs.c | 2 + kernel/time/posix-timers.c | 2 + kernel/trace/ring_buffer.c | 7 +- lib/mpi/mpicoder.c | 3 +- mm/huge_memory.c | 3 + mm/memcontrol.c | 4 + net/9p/trans_rdma.c | 15 +- net/9p/trans_xen.c | 48 +- net/atm/pppoatm.c | 2 +- net/bluetooth/hci_sock.c | 11 +- net/bluetooth/l2cap_core.c | 24 - net/bluetooth/l2cap_sock.c | 8 + net/core/dev.c | 4 +- net/core/sock.c | 22 +- net/ipv4/inet_connection_sock.c | 1 + net/ipv4/inet_hashtables.c | 12 +- net/ipv4/tcp_minisocks.c | 7 +- net/ipv6/route.c | 11 +- net/iucv/iucv.c | 2 +- net/mac80211/sta_info.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 5 +- net/nfc/netlink.c | 4 + net/rds/message.c | 2 +- net/sched/Kconfig | 11 - net/sched/Makefile | 1 - net/sched/act_sample.c | 11 +- net/sched/cls_tcindex.c | 730 --------------------- net/sctp/stream_sched_prio.c | 52 +- net/tls/tls_sw.c | 26 +- net/wireless/sme.c | 31 +- security/integrity/ima/ima_main.c | 7 +- security/security.c | 7 +- sound/drivers/pcsp/pcsp_lib.c | 2 +- sound/pci/hda/patch_ca0132.c | 2 +- sound/pci/hda/patch_realtek.c | 1 + sound/pci/ice1712/aureon.c | 2 +- sound/soc/fsl/fsl_sai.c | 1 + sound/soc/kirkwood/kirkwood-dma.c | 2 +- sound/soc/soc-compress.c | 2 +- tools/iio/iio_utils.c | 23 +- tools/lib/bpf/nlattr.c | 2 +- tools/perf/perf-completion.sh | 11 +- tools/perf/util/llvm-utils.c | 25 +- tools/testing/ktest/ktest.pl | 26 +- tools/testing/ktest/sample.conf | 5 + .../ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- tools/testing/selftests/net/fib_tests.sh | 2 + tools/testing/selftests/net/udpgso_bench_rx.c | 6 +- virt/kvm/coalesced_mmio.c | 8 +- 356 files changed, 2777 insertions(+), 2417 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/357 HID: asus: Remove check for same LED brightness on set
From: Luke D. Jones <[email protected]>
commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream.
Remove the early return on LED brightness set so that any controller application, daemon, or desktop may set the same brightness at any stage.
This is required because many ASUS ROG keyboards will default to max brightness on laptop resume if the LEDs were set to off before sleep.
--- drivers/hid/hid-asus.c | 3 --- 1 file changed, 3 deletions(-)
drivers/hid/hid-asus.c +0 -3
@@ -351,9 +351,6 @@ static void asus_kbd_backlight_set(struc { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); -if (led->brightness == brightness) -return ; - led->brightness = brightness;schedule_work (&led->work); }
Greg Kroah-Hartman
maintainerPATCH 2/357 HID: asus: use spinlock to protect concurrent accesses
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
commit 315c537068a13f0b5681d33dd045a912f4bece6f upstream.
asus driver has a worker that may access data concurrently. Proct the accesses using a spinlock.
--- drivers/hid/hid-asus.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
drivers/hid/hid-asus.c +21 -1
@@ -92,6 +92,7 @@ struct asus_kbd_leds {struct hid_device *hdev;struct work_struct work;unsigned int brightness; +spinlock_t lock;bool removed; };
@@ -351,7 +352,12 @@ static void asus_kbd_backlight_set(struc { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); +unsigned long flags; + +spin_lock_irqsave (&led->lock, flags); led->brightness = brightness; +spin_unlock_irqrestore (&led->lock, flags); +schedule_work (&led->work); }
@@ -359,8 +365,14 @@ static enum led_brightness asus_kbd_back { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); +enum led_brightness brightness; +unsigned long flags; -return led->brightness; +spin_lock_irqsave (&led->lock, flags); + brightness = led->brightness; +spin_unlock_irqrestore (&led->lock, flags); + +return brightness; }static void asus_kbd_backlight_work (struct work_struct *work)
@@ -368,11 +380,14 @@ static void asus_kbd_backlight_work(stru struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work);u8 buf[] = {FEATURE_KBD_REPORT_ID ,0xba ,0xc5 ,0xc4 ,0x00 };int ret; +unsigned long flags;if (led->removed)return ; +spin_lock_irqsave (&led->lock, flags); buf[4 ] = led->brightness; +spin_unlock_irqrestore (&led->lock, flags); ret =asus_kbd_set_report (led->hdev, buf,sizeof (buf));if (ret <0 )
@@ -434,6 +449,7 @@ static int asus_kbd_register_leds(struct drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set; drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get;INIT_WORK (&drvdata->kbd_backlight->work, asus_kbd_backlight_work); +spin_lock_init (&drvdata->kbd_backlight->lock); ret =devm_led_classdev_register (&hdev->dev, &drvdata->kbd_backlight->cdev);if (ret <0 ) {
@@ -932,9 +948,13 @@ err_stop_hw:static void asus_remove (struct hid_device *hdev) {struct asus_drvdata *drvdata =hid_get_drvdata (hdev); +unsigned long flags;if (drvdata->kbd_backlight) { +spin_lock_irqsave (&drvdata->kbd_backlight->lock, flags); drvdata->kbd_backlight->removed = true; +spin_unlock_irqrestore (&drvdata->kbd_backlight->lock, flags); +cancel_work_sync (&drvdata->kbd_backlight->work); }
Greg Kroah-Hartman
maintainerPATCH 3/357 HID: asus: use spinlock to safely schedule workers
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream.
Use spinlocks to deal with workers introducing a wrapper asus_schedule_work(), and several spinlock checks. Otherwise, asus_kbd_backlight_set() may schedule led->work after the structure has been freed, causing a use-after-free.
--- drivers/hid/hid-asus.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/hid/hid-asus.c +11 -4
@@ -347,6 +347,16 @@ static int asus_kbd_get_functions(structreturn ret; } +static void asus_schedule_work (struct asus_kbd_leds *led) +{ +unsigned long flags; + +spin_lock_irqsave (&led->lock, flags); +if (!led->removed) +schedule_work (&led->work); +spin_unlock_irqrestore (&led->lock, flags); +} +static void asus_kbd_backlight_set (struct led_classdev *led_cdev,enum led_brightness brightness) {
@@ -358,7 +368,7 @@ static void asus_kbd_backlight_set(struc led->brightness = brightness;spin_unlock_irqrestore (&led->lock, flags); -schedule_work (&led->work); +asus_schedule_work (led); }static enum led_brightness asus_kbd_backlight_get (struct led_classdev *led_cdev)
@@ -382,9 +392,6 @@ static void asus_kbd_backlight_work(struint ret;unsigned long flags; -if (led->removed) -return ; -spin_lock_irqsave (&led->lock, flags); buf[4 ] = led->brightness;spin_unlock_irqrestore (&led->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 4/357 ARM: OMAP2+: Fix memory leak in realtime_counter_init()
In reply to Greg Kroah-HartmanFrom: Chen Hui <[email protected]>
[ Upstream commit ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac ]
The "sys_clk" resource is malloced by clk_get(),
it is not released when the function return.
Message-Id: <[email protected]>
--- arch/arm/mach-omap2/timer.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-omap2/timer.c +1 -0
@@ -700,6 +700,7 @@ static void __init realtime_counter_init(void) } rate =clk_get_rate (sys_clk); +clk_put (sys_clk);if (soc_is_dra7xx ()) {/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/357 arm64: dts: qcom: qcs404: use symbol names for PCIe resets
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 41a37d157a613444c97e8f71a5fb2a21116b70d7 ]
The commit e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") added names for PCIe resets, but it did not change the existing qcs404.dtsi to use these names. Do it now and use symbol names to make it easier to check and modify the dtsi in future.
--- arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/qcom/qcs404.dtsi +6 -6
@@ -533,7 +533,7 @@ pcie_phy: phy@7786000 { clocks = <&gcc GCC_PCIE_0_PIPE_CLK>; resets = <&gcc GCC_PCIEPHY_0_PHY_BCR>, - <&gcc 21>; + <&gcc GCC_PCIE_0_PIPE_ARES>; reset-names = "phy", "pipe"; clock-output-names = "pcie_0_pipe_clk";
@@ -991,12 +991,12 @@ pcie: pci@10000000 { <&gcc GCC_PCIE_0_SLV_AXI_CLK>; clock-names = "iface", "aux", "master_bus", "slave_bus"; - resets = <&gcc 18>, - <&gcc 17>, - <&gcc 15>, - <&gcc 19>, + resets = <&gcc GCC_PCIE_0_AXI_MASTER_ARES>, + <&gcc GCC_PCIE_0_AXI_SLAVE_ARES>, + <&gcc GCC_PCIE_0_AXI_MASTER_STICKY_ARES>, + <&gcc GCC_PCIE_0_CORE_STICKY_ARES>, <&gcc GCC_PCIE_0_BCR>, - <&gcc 16>; + <&gcc GCC_PCIE_0_AHB_ARES>; reset-names = "axi_m", "axi_s", "axi_m_sticky",
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/357 ARM: zynq: Fix refcount leak in zynq_early_slcr_init
In reply to Greg Kroah-HartmanFrom: Qiheng Lin <[email protected]>
[ Upstream commit 9eedb910a3be0005b88c696a8552c0d4c9937cd4 ]
of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on error path.
Add missing of_node_put() to avoid refcount leak.
--- arch/arm/mach-zynq/slcr.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-zynq/slcr.c +1 -0
@@ -213,6 +213,7 @@ int __init zynq_early_slcr_init(void) zynq_slcr_regmap =syscon_regmap_lookup_by_compatible ("xlnx,zynq-slcr" );if (IS_ERR (zynq_slcr_regmap)) {pr_err ("%s: failed to find zynq-slcr\n" , __func__); +of_node_put (np);return -ENODEV ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/357 arm64: dts: meson-gx: Fix Ethernet MAC address unit name
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 ]
Unit names should use hyphens instead of underscores to not cause warnings.
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -172,7 +172,7 @@ sn: sn@14 { reg = <0x14 0x10>; }; - eth_mac: eth_mac@34 { + eth_mac: eth-mac@34 { reg = <0x34 0x10>; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/357 arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit e7303651bbc76c848007f1cfac1fbeaa65f600d1 ]
Documentation/devicetree/bindings/net/ethernet-phy.yaml defines that the node name for Ethernet PHYs should match the following pattern:
^ethernet-phy(@[a-f0-9]+)?$
Replace the underscore with a hyphen to adhere to this binding.
--- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +1 -1
@@ -1783,7 +1783,7 @@ int_mdio: mdio@1 { #address-cells = <1>; #size-cells = <0>; - internal_ephy: ethernet_phy@8 { + internal_ephy: ethernet-phy@8 { compatible = "ethernet-phy-id0180.3301", "ethernet-phy-ieee802.3-c22"; interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/357 arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit f189c869ad92787ddd753558bcbae89d75825bb6 ]
Node names should be generic and use hyphens instead of underscores to not cause warnings. Also nodes without a reg property should not have a unit-address. Change the scpi_dvfs node to use clock-controller as node name without a unit address (since it does not have a reg property).
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -189,7 +189,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks"; - scpi_dvfs: scpi_clocks@0 { + scpi_dvfs: clock-controller { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/357 arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
In reply to Greg Kroah-HartmanFrom: Christian Hewitt <[email protected]>
[ Upstream commit 3cbd431c2b34d84605d358c8c57654193fd661fb ]
Amlogic G12A devices experience CPU stalls and random board wedges when the system idles and CPU cores clock down to lower opp points. Recent vendor kernels include a change to remove 100-250MHz and other distro sources also remove the 500/667MHz points. Unless all 100-667Mhz opps are removed or the CPU governor forced to performance stalls are still observed, so let's remove them to improve stability and uptime.
--- arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 -------------------- 1 file changed, 20 deletions(-)
arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +0 -20
@@ -54,26 +54,6 @@ cpu_opp_table: opp-table { compatible = "operating-points-v2"; opp-shared; - opp-100000000 { - opp-hz = /bits/ 64 <100000000>; - opp-microvolt = <731000>; - }; - - opp-250000000 { - opp-hz = /bits/ 64 <250000000>; - opp-microvolt = <731000>; - }; - - opp-500000000 { - opp-hz = /bits/ 64 <500000000>; - opp-microvolt = <731000>; - }; - - opp-667000000 { - opp-hz = /bits/ 64 <666666666>; - opp-microvolt = <731000>; - }; - opp-1000000000 { opp-hz = /bits/ 64 <1000000000>; opp-microvolt = <731000>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/357 ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 0414a100d6ab32721efa70ab55524540fdfe0ede ]
If platform_device_add() is not called or failed, it should call platform_device_put() in error case.
Message-Id: <[email protected]>
--- arch/arm/mach-omap1/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-omap1/timer.c +1 -1
@@ -165,7 +165,7 @@ static int __init omap1_dm_timer_init(void)kfree (pdata); err_free_pdev: -platform_device_unregister (pdev); +platform_device_put (pdev);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/357 ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit d15d2a617499882971ddb773a583015bf36fa492 ]
The property is wr-active:
exynos3250-rinato.dtb: fimd@11c00000: i80-if-timings: 'wr-act' does not match any of the regexes: 'pinctrl-[0-9]+'
--- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos3250-rinato.dts +1 -1
@@ -239,7 +239,7 @@ &fimd { i80-if-timings { cs-setup = <0>; wr-setup = <0>; - wr-act = <1>; + wr-active = <1>; wr-hold = <0>; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/357 ARM: imx: Call ida_simple_remove() for ida_simple_get
In reply to Greg Kroah-HartmanFrom: Angus Chen <[email protected]>
[ Upstream commit ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 ]
The function call ida_simple_get maybe fail,we should deal with it. And if ida_simple_get success ,it need to call ida_simple_remove also. BTW,devm_kasprintf can handle id is zero for consistency.
--- arch/arm/mach-imx/mmdc.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
arch/arm/mach-imx/mmdc.c +12 -12
@@ -99,6 +99,7 @@ struct mmdc_pmu {cpumask_t cpu;struct hrtimer hrtimer;unsigned int active_events; +int id;struct device *dev;struct perf_event *mmdc_events[MMDC_NUM_COUNTERS ];struct hlist_node node;
@@ -433,8 +434,6 @@ static enum hrtimer_restart mmdc_pmu_timer_handler(struct hrtimer *hrtimer)static int mmdc_pmu_init (struct mmdc_pmu *pmu_mmdc,void __iomem *mmdc_base,struct device *dev) { -int mmdc_num; - *pmu_mmdc = (struct mmdc_pmu ) { .pmu = (struct pmu ) { .task_ctx_nr = perf_invalid_context,
@@ -452,15 +451,16 @@ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, .active_events = 0, }; - mmdc_num =ida_simple_get (&mmdc_ida,0 ,0 ,GFP_KERNEL ); + pmu_mmdc->id =ida_simple_get (&mmdc_ida,0 ,0 ,GFP_KERNEL ); -return mmdc_num; +return pmu_mmdc->id; }static int imx_mmdc_remove (struct platform_device *pdev) {struct mmdc_pmu *pmu_mmdc =platform_get_drvdata (pdev); +ida_simple_remove (&mmdc_ida, pmu_mmdc->id);cpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);perf_pmu_unregister (&pmu_mmdc->pmu);iounmap (pmu_mmdc->mmdc_base);
@@ -474,7 +474,6 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b {struct mmdc_pmu *pmu_mmdc;char *name; -int mmdc_num;int ret;const struct of_device_id *of_id =of_match_device (imx_mmdc_dt_ids, &pdev->dev);
@@ -497,14 +496,14 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b cpuhp_mmdc_state = ret; } - mmdc_num =mmdc_pmu_init (pmu_mmdc, mmdc_base, &pdev->dev); - pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; -if (mmdc_num ==0 ) - name ="mmdc" ; -else - name =devm_kasprintf (&pdev->dev, -GFP_KERNEL ,"mmdc%d" , mmdc_num); + ret =mmdc_pmu_init (pmu_mmdc, mmdc_base, &pdev->dev); +if (ret <0 ) + goto pmu_free; + name =devm_kasprintf (&pdev->dev, +GFP_KERNEL ,"mmdc%d" , ret); + + pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data; hrtimer_init(&pmu_mmdc->hrtimer, CLOCK_MONOTONIC,
@@ -525,6 +524,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b pmu_register_err:pr_warn ("MMDC Perf PMU failed (%d), disabled\n" , ret); +ida_simple_remove (&mmdc_ida, pmu_mmdc->id);cpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);hrtimer_cancel (&pmu_mmdc->hrtimer); pmu_free:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/357 arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 127f79212b07c5d9a6657a87e3eafdd889335814 ]
Fixes:
scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -189,7 +189,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks"; - scpi_dvfs: clock-controller { + scpi_dvfs: clocks-0 { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/357 arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 5b7069d72f03c92a0ab919725017394ebce03a81 ]
Fixes:
scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-axg.dtsi +1 -1
@@ -150,7 +150,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks"; - scpi_dvfs: clock-controller { + scpi_dvfs: clocks-0 { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/357 arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 2ff650051493d5bdb6dd09d4c2850bb37db6be31 ]
Fixes:
scpi: sensors:compatible: 'oneOf' conditional failed, one must be fixed:
['amlogic,meson-gxbb-scpi-sensors'] is too short 'arm,scpi-sensors' was expected
--- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-axg.dtsi +1 -1
@@ -159,7 +159,7 @@ scpi_dvfs: clocks-0 { }; scpi_sensors: sensors { - compatible = "amlogic,meson-gxbb-scpi-sensors"; + compatible = "amlogic,meson-gxbb-scpi-sensors", "arm,scpi-sensors"; #thermal-sensor-cells = <1>; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/357 arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 61ff70708b98a85516eccb3755084ac97b42cf48 ]
Fixes:
bus@c8834000: rng: {...} should not be valid under {'type': 'object'}
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -464,7 +464,7 @@ periphs: bus@c8834000 { #size-cells = <2>; ranges = <0x0 0x0 0x0 0xc8834000 0x0 0x2000>; - hwrng: rng { + hwrng: rng@0 { compatible = "amlogic,meson-rng"; reg = <0x0 0x0 0x0 0x4>; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/357 arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit d19189f70ba596798ea49166d2d1ef36a8df5289 ]
Fixes:
bus@c8834000: eth-phy-mux: {...} should not be valid under {'type': 'object'}
--- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +1 -1
@@ -700,7 +700,7 @@ mux { }; }; - eth-phy-mux { + eth-phy-mux@55c { compatible = "mdio-mux-mmioreg", "mdio-mux"; #address-cells = <1>; #size-cells = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/357 arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit eee64d8fbbdaab72bbab3e462f3a7b742d20c8c2 ]
Fixes:
leds: status: {...} is not of type 'array'
--- arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts +1 -1
@@ -18,7 +18,7 @@ cvbs-connector { leds { compatible = "gpio-leds"; - status { + led { label = "n1:white:status"; gpios = <&gpio_ao GPIOAO_9 GPIO_ACTIVE_HIGH>; default-state = "on";
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/357 ARM: dts: imx7s: correct iomuxc gpr mux controller cells
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
[ Upstream commit 0e3e1946606a2919b1dda9967ab2e1c5af2fedd6 ]
Per binding doc reg-mux.yaml, the #mux-control-cells should be 1
--- arch/arm/boot/dts/imx7s.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx7s.dtsi +1 -1
@@ -504,7 +504,7 @@ gpr: iomuxc-gpr@30340000 { mux: mux-controller { compatible = "mmio-mux"; - #mux-control-cells = <0>; + #mux-control-cells = <1>; mux-reg-masks = <0x14 0x00000010>; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/357 arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 22925af785fa3470efdf566339616d801119d348 ]
Specify #pwm-cells on pwm@11006000 to make it actually usable.
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +1 -0
@@ -428,6 +428,7 @@ uart3: serial@11005000 { pwm: pwm@11006000 { compatible = "mediatek,mt7622-pwm"; reg = <0 0x11006000 0 0x1000>; + #pwm-cells = <2>; interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_LOW>; clocks = <&topckgen CLK_TOP_PWM_SEL>, <&pericfg CLK_PERI_PWM_PD>,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/357 Revert "scsi: core: run queue if SCSI device queue isnt ready and queue is idle"
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit b4fd63f42647110c963d4bfcd526ac48f5a5faff ]
This reverts commit 7e70aa789d4a0c89dbfbd2c8a974a4df717475ec.
Now that we have the patches ("blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick") and ("blk-mq: Rerun dispatching in the case of budget contention") we should no longer need the fix in the SCSI code. Revert it, resolving conflicts with other patches that have touched this code.
With this revert (and the two new patches) I can run the script that was in commit 7e70aa789d4a ("scsi: core: run queue if SCSI device queue isn't ready and queue is idle") in a loop with no failure. If I do this revert without the two new patches I can easily get a failure.
Stable-dep-of: c31e76bcc379 ("blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx")
--- drivers/scsi/scsi_lib.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/scsi/scsi_lib.c +1 -6
@@ -1645,12 +1645,7 @@ static bool scsi_mq_get_budget(struct blk_mq_hw_ctx *hctx)struct request_queue *q = hctx->queue;struct scsi_device *sdev = q->queuedata; -if (scsi_dev_queue_ready (q, sdev)) -return true; - -if (atomic_read (&sdev->device_busy) ==0 && !scsi_device_blocked (sdev)) -blk_mq_delay_run_hw_queue (hctx,SCSI_QUEUE_DELAY ); -return false; +return scsi_dev_queue_ready (q, sdev); } static blk_status_t scsi_queue_rq(struct blk_mq_hw_ctx *hctx,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/357 block: Limit number of items taken from the I/O scheduler in one go
In reply to Greg Kroah-HartmanFrom: Salman Qazi <[email protected]>
[ Upstream commit 28d65729b050977d8a9125e6726871e83bd22124 ]
Flushes bypass the I/O scheduler and get added to hctx->dispatch in blk_mq_sched_bypass_insert. This can happen while a kworker is running hctx->run_work work item and is past the point in blk_mq_sched_dispatch_requests where hctx->dispatch is checked.
The blk_mq_do_dispatch_sched call is not guaranteed to end in bounded time, because the I/O scheduler can feed an arbitrary number of commands.
Since we have only one hctx->run_work, the commands waiting in hctx->dispatch will wait an arbitrary length of time for run_work to be rerun.
A similar phenomenon exists with dispatches from the software queue.
The solution is to poll hctx->dispatch in blk_mq_do_dispatch_sched and blk_mq_do_dispatch_ctx and return from the run_work handler and let it rerun.
Stable-dep-of: c31e76bcc379 ("blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx")
--- block/blk-mq-sched.c | 64 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 51 insertions(+), 13 deletions(-)
block/blk-mq-sched.c +51 -13
@@ -93,12 +93,16 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)* Only SCSI implements .get_budget and .put_budget, and SCSI restarts * its queue by itself in its completion handler, so we don't need to * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. +* +* Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to +* be run again. This is necessary to avoid starving flushes. */ -static void blk_mq_do_dispatch_sched (struct blk_mq_hw_ctx *hctx) +static int blk_mq_do_dispatch_sched (struct blk_mq_hw_ctx *hctx) {struct request_queue *q = hctx->queue;struct elevator_queue *e = q->elevator;LIST_HEAD (rq_list); +int ret =0 ; do { struct request *rq;
@@ -106,6 +110,11 @@ static void blk_mq_do_dispatch_sched(struct blk_mq_hw_ctx *hctx)if (e->type->ops.has_work && !e->type->ops.has_work (hctx))break ; +if (!list_empty_careful (&hctx->dispatch)) { + ret = -EAGAIN ; +break ; + } +if (!blk_mq_get_dispatch_budget (hctx))break ;
@@ -122,6 +131,8 @@ static void blk_mq_do_dispatch_sched(struct blk_mq_hw_ctx *hctx)*/ list_add (&rq->queuelist, &rq_list); }while (blk_mq_dispatch_rq_list (q, &rq_list, true)); + +return ret; } static struct blk_mq_ctx *blk_mq_next_ctx(struct blk_mq_hw_ctx *hctx,
@@ -139,16 +150,25 @@ static struct blk_mq_ctx *blk_mq_next_ctx(struct blk_mq_hw_ctx *hctx,* Only SCSI implements .get_budget and .put_budget, and SCSI restarts * its queue by itself in its completion handler, so we don't need to * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. +* +* Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to +* to be run again. This is necessary to avoid starving flushes. */ -static void blk_mq_do_dispatch_ctx (struct blk_mq_hw_ctx *hctx) +static int blk_mq_do_dispatch_ctx (struct blk_mq_hw_ctx *hctx) {struct request_queue *q = hctx->queue;LIST_HEAD (rq_list);struct blk_mq_ctx *ctx =READ_ONCE (hctx->dispatch_from); +int ret =0 ; do { struct request *rq; + if (!list_empty_careful(&hctx->dispatch)) { + ret = -EAGAIN; + break; + } + if (!sbitmap_any_bit_set(&hctx->ctx_map)) break;
@@ -174,21 +194,17 @@ static void blk_mq_do_dispatch_ctx(struct blk_mq_hw_ctx *hctx) }while (blk_mq_dispatch_rq_list (q, &rq_list, true));WRITE_ONCE (hctx->dispatch_from, ctx); +return ret; } -void blk_mq_sched_dispatch_requests (struct blk_mq_hw_ctx *hctx) +int __blk_mq_sched_dispatch_requests (struct blk_mq_hw_ctx *hctx) {struct request_queue *q = hctx->queue;struct elevator_queue *e = q->elevator;const bool has_sched_dispatch = e && e->type->ops.dispatch_request; +int ret =0 ;LIST_HEAD (rq_list); -/* RCU or SRCU read lock is needed before checking quiesced flag */ -if (unlikely (blk_mq_hctx_stopped (hctx) ||blk_queue_quiesced (q))) -return ; - - hctx->run++; -/* * If we have previous entries on our dispatch list, grab them first for * more fair dispatch.
@@ -217,19 +233,41 @@ void blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx)blk_mq_sched_mark_restart_hctx (hctx);if (blk_mq_dispatch_rq_list (q, &rq_list, false)) {if (has_sched_dispatch) -blk_mq_do_dispatch_sched (hctx); + ret =blk_mq_do_dispatch_sched (hctx);else -blk_mq_do_dispatch_ctx (hctx); + ret =blk_mq_do_dispatch_ctx (hctx); } }else if (has_sched_dispatch) { -blk_mq_do_dispatch_sched (hctx); + ret =blk_mq_do_dispatch_sched (hctx); }else if (hctx->dispatch_busy) {/* dequeue request one by one from sw queue if queue is busy */ -blk_mq_do_dispatch_ctx (hctx); + ret =blk_mq_do_dispatch_ctx (hctx); }else {blk_mq_flush_busy_ctxs (hctx, &rq_list);blk_mq_dispatch_rq_list (q, &rq_list, false); } + +return ret; +} + +void blk_mq_sched_dispatch_requests (struct blk_mq_hw_ctx *hctx) +{ +struct request_queue *q = hctx->queue; + +/* RCU or SRCU read lock is needed before checking quiesced flag */ +if (unlikely (blk_mq_hctx_stopped (hctx) ||blk_queue_quiesced (q))) +return ; + + hctx->run++; + +/* +* A return of -EAGAIN is an indication that hctx->dispatch is not +* empty and we must run again in order to avoid starving flushes. +*/ +if (__blk_mq_sched_dispatch_requests (hctx) == -EAGAIN ) { +if (__blk_mq_sched_dispatch_requests (hctx) == -EAGAIN ) +blk_mq_run_hw_queue (hctx, true); + } } bool blk_mq_sched_try_merge(struct request_queue *q, struct bio *bio,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/357 blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
In reply to Greg Kroah-HartmanFrom: Kemeng Shi <[email protected]>
[ Upstream commit c31e76bcc379182fe67a82c618493b7b8868c672 ]
Commit 97889f9ac24f8 ("blk-mq: remove synchronize_rcu() from blk_mq_del_queue_tag_set()") remove handle of TAG_SHARED in restart, then shared_hctx_restart counted for how many hardware queues are marked for restart is removed too.
Remove the stale comment that we still count hardware queues need restart.
--- block/blk-mq-sched.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
block/blk-mq-sched.c +1 -2
@@ -59,8 +59,7 @@ void blk_mq_sched_assign_ioc(struct request *rq) }/* -* Mark a hardware queue as needing a restart. For shared queues, maintain -* a count of how many hardware queues are marked for restart. +* Mark a hardware queue as needing a restart. */ void blk_mq_sched_mark_restart_hctx (struct blk_mq_hw_ctx *hctx) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/357 blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
In reply to Greg Kroah-HartmanFrom: Kemeng Shi <[email protected]>
[ Upstream commit 98b99e9412d0cde8c7b442bf5efb09528a2ede8b ]
For shared queues case, we will only wait on bitmap_tags if we fail to get driver tag. However, rq could be from breserved_tags, then two problems will occur:
1. io hung if no tag is currently allocated from bitmap_tags.
2. unnecessary wakeup when tag is freed to bitmap_tags while no tag is freed to breserved_tags.
Wait on the bitmap which rq from to fix this.
--- block/blk-mq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
block/blk-mq.c +5 -1
@@ -1112,7 +1112,7 @@ static int blk_mq_dispatch_wake(wait_queue_entry_t *wait, unsigned mode,static bool blk_mq_mark_tag_wait (struct blk_mq_hw_ctx *hctx,struct request *rq) { -struct sbitmap_queue *sbq = &hctx->tags->bitmap_tags; +struct sbitmap_queue *sbq;struct wait_queue_head *wq;wait_queue_entry_t *wait;bool ret;
@@ -1135,6 +1135,10 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,if (!list_empty_careful (&wait->entry))return false; +if (blk_mq_tag_is_reserved (rq->mq_hctx->sched_tags, rq->internal_tag)) + sbq = &hctx->tags->breserved_tags; +else + sbq = &hctx->tags->bitmap_tags; wq = &bt_wait_ptr (sbq, hctx)->wait;spin_lock_irq (&wq->lock);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/357 blk-mq: correct stale comment of .get_budget
In reply to Greg Kroah-HartmanFrom: Kemeng Shi <[email protected]>
[ Upstream commit 01542f651a9f58a9b176c3d3dc3eefbacee53b78 ]
Commit 88022d7201e96 ("blk-mq: don't handle failure in .get_budget") remove BLK_STS_RESOURCE return value and we only check if we can get the budget from .get_budget() now.
Correct stale comment that ".get_budget() returns BLK_STS_NO_RESOURCE" to ".get_budget() fails to get the budget".
--- block/blk-mq-sched.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
block/blk-mq-sched.c +2 -2
@@ -91,7 +91,7 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)/* * Only SCSI implements .get_budget and .put_budget, and SCSI restarts * its queue by itself in its completion handler, so we don't need to -* restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. +* restart queue if .get_budget() fails to get the budget. * * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to * be run again. This is necessary to avoid starving flushes.
@@ -148,7 +148,7 @@ static struct blk_mq_ctx *blk_mq_next_ctx(struct blk_mq_hw_ctx *hctx,/* * Only SCSI implements .get_budget and .put_budget, and SCSI restarts * its queue by itself in its completion handler, so we don't need to -* restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. +* restart queue if .get_budget() fails to get the budget. * * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to * to be run again. This is necessary to avoid starving flushes.
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/357 s390/dasd: Prepare for additional path event handling
In reply to Greg Kroah-HartmanFrom: Jan Höppner <[email protected]>
[ Upstream commit b72949328869dfd45f6452c2410647afd7db5f1a ]
As more path events need to be handled for ECKD the current path verification infrastructure can be reused. Rename all path verifcation code to fit the more broadly based task of path event handling and put the path verification in a new separate function.
Stable-dep-of: 460e9bed82e4 ("s390/dasd: Fix potential memleak in dasd_eckd_init()")
--- drivers/s390/block/dasd.c | 4 +- drivers/s390/block/dasd_eckd.c | 78 +++++++++++++++++++--------------- drivers/s390/block/dasd_int.h | 1 + 3 files changed, 47 insertions(+), 36 deletions(-)
drivers/s390/block/dasd.c +2 -2
@@ -2128,8 +2128,8 @@ static void __dasd_device_check_path_events(struct dasd_device *device)if (device->stopped & ~(DASD_STOPPED_DC_WAIT |DASD_UNRESUMED_PM ))return ; - rc = device->discipline->verify_path (device, -dasd_path_get_tbvpm (device)); + rc = device->discipline->pe_handler (device, +dasd_path_get_tbvpm (device));if (rc)dasd_device_set_timer (device,50 );else
drivers/s390/block/dasd_eckd.c +44 -34
162 lines not on this page · raw message
drivers/s390/block/dasd_int.h +1 -0
@@ -299,6 +299,7 @@ struct dasd_discipline {* configuration. */ int (*verify_path)(struct dasd_device *,__u8 ); +int (*pe_handler)(struct dasd_device *,__u8 );/* * Last things to do when a device is set online, and first things
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/357 s390/dasd: Fix potential memleak in dasd_eckd_init()
In reply to Greg Kroah-HartmanFrom: Qiheng Lin <[email protected]>
[ Upstream commit 460e9bed82e49db1b823dcb4e421783854d86c40 ]
dasd_reserve_req is allocated before dasd_vol_info_req, and it also needs to be freed before the error returns, just like the other cases in this function.
--- drivers/s390/block/dasd_eckd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/s390/block/dasd_eckd.c +3 -1
@@ -6763,8 +6763,10 @@ dasd_eckd_init(void)return -ENOMEM ; dasd_vol_info_req =kmalloc (sizeof (*dasd_vol_info_req),GFP_KERNEL |GFP_DMA ); -if (!dasd_vol_info_req) +if (!dasd_vol_info_req) { +kfree (dasd_reserve_req);return -ENOMEM ; + } pe_handler_worker =kmalloc (sizeof (*pe_handler_worker),GFP_KERNEL |GFP_DMA );if (!pe_handler_worker) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/357 sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
In reply to Greg Kroah-HartmanFrom: Dietmar Eggemann <[email protected]>
[ Upstream commit 821aecd09e5ad2f8d4c3d8195333d272b392f7d3 ]
The struct rq *rq parameter isn't used. Remove it.
Stable-dep-of: 7c4a5b89a0b5 ("sched/rt: pick_next_rt_entity(): check list_entry")
--- kernel/sched/deadline.c | 5 ++--- kernel/sched/rt.c | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-)
kernel/sched/deadline.c +2 -3
@@ -1793,8 +1793,7 @@ static void set_next_task_dl(struct rq *rq, struct task_struct *p, bool first)deadline_queue_push_tasks (rq); } -static struct sched_dl_entity *pick_next_dl_entity (struct rq *rq, -struct dl_rq *dl_rq) +static struct sched_dl_entity *pick_next_dl_entity (struct dl_rq *dl_rq) {struct rb_node *left =rb_first_cached (&dl_rq->root);
@@ -1816,7 +1815,7 @@ pick_next_task_dl(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)if (!sched_dl_runnable (rq))return NULL ; - dl_se =pick_next_dl_entity (rq, dl_rq); + dl_se =pick_next_dl_entity (dl_rq);BUG_ON (!dl_se); p =dl_task_of (dl_se);set_next_task_dl (rq, p, true);
kernel/sched/rt.c +2 -3
@@ -1550,8 +1550,7 @@ static inline void set_next_task_rt(struct rq *rq, struct task_struct *p, bool frt_queue_push_tasks (rq); } -static struct sched_rt_entity *pick_next_rt_entity (struct rq *rq, -struct rt_rq *rt_rq) +static struct sched_rt_entity *pick_next_rt_entity (struct rt_rq *rt_rq) {struct rt_prio_array *array = &rt_rq->active;struct sched_rt_entity *next =NULL ;
@@ -1573,7 +1572,7 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq)struct rt_rq *rt_rq = &rq->rt;do { - rt_se =pick_next_rt_entity (rq, rt_rq); + rt_se =pick_next_rt_entity (rt_rq);BUG_ON (!rt_se); rt_rq =group_rt_rq (rt_se); }while (rt_rq);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/357 sched/rt: pick_next_rt_entity(): check list_entry
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 7c4a5b89a0b5a57a64b601775b296abf77a9fe97 ]
Commit 326587b84078 ("sched: fix goto retry in pick_next_task_rt()") removed any path which could make pick_next_rt_entity() return NULL. However, BUG_ON(!rt_se) in _pick_next_task_rt() (the only caller of pick_next_rt_entity()) still checks the error condition, which can never happen, since list_entry() never returns NULL. Remove the BUG_ON check, and instead emit a warning in the only possible error condition here: the queue being empty which should never happen.
--- kernel/sched/rt.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/sched/rt.c +4 -1
@@ -1561,6 +1561,8 @@ static struct sched_rt_entity *pick_next_rt_entity(struct rt_rq *rt_rq)BUG_ON (idx >=MAX_RT_PRIO ); queue = array->queue + idx; +if (SCHED_WARN_ON (list_empty (queue))) +return NULL ; next = list_entry(queue->next, struct sched_rt_entity, run_list);return next;
@@ -1573,7 +1575,8 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq)do { rt_se =pick_next_rt_entity (rt_rq); -BUG_ON (!rt_se); +if (unlikely (!rt_se)) +return NULL ; rt_rq =group_rt_rq (rt_se); }while (rt_rq);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/357 block: bio-integrity: Copy flags when bio_integrity_payload is cloned
In reply to Greg Kroah-HartmanFrom: Martin K. Petersen <[email protected]>
[ Upstream commit b6a4bdcda430e3ca43bbb9cb1d4d4d34ebe15c40 ]
Make sure to copy the flags when a bio_integrity_payload is cloned. Otherwise per-I/O properties such as IP checksum flag will not be passed down to the HBA driver. Since the integrity buffer is owned by the original bio, the BIP_BLOCK_INTEGRITY flag needs to be masked off to avoid a double free in the completion path.
--- block/bio-integrity.c | 1 + 1 file changed, 1 insertion(+)
block/bio-integrity.c +1 -0
@@ -424,6 +424,7 @@ int bio_integrity_clone(struct bio *bio, struct bio *bio_src, bip->bip_vcnt = bip_src->bip_vcnt; bip->bip_iter = bip_src->bip_iter; + bip->bip_flags = bip_src->bip_flags & ~BIP_BLOCK_INTEGRITY ;return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/357 wifi: rsi: Fix memory leak in rsi_coex_attach()
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f ]
The coex_cb needs to be freed when rsi_create_kthread() failed in rsi_coex_attach().
--- drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rsi/rsi_91x_coex.c +1 -0
@@ -160,6 +160,7 @@ int rsi_coex_attach(struct rsi_common *common) rsi_coex_scheduler_thread, "Coex-Tx-Thread")) {rsi_dbg (ERR_ZONE ,"%s: Unable to init tx thrd\n" , __func__); +kfree (coex_cb);return -EINVAL ; }return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/357 net/wireless: Delete unnecessary checks before the macro call “dev_kfree_skb”
In reply to Greg Kroah-HartmanFrom: Markus Elfring <[email protected]>
[ Upstream commit 868ad21496020ef83d41fdeed3b0a63de2a3caa5 ]
The dev_kfree_skb() function performs also input parameter validation. Thus the test around the shown calls is not needed.
This issue was detected by using the Coccinelle software.
Stable-dep-of: 0c1528675d7a ("wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()")
--- drivers/net/wireless/ath/ath10k/wmi.c | 4 +--- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 8 ++------ drivers/net/wireless/intel/iwlegacy/common.c | 8 ++------ drivers/net/wireless/mediatek/mt76/mt76x02_beacon.c | 5 +---- drivers/net/wireless/st/cw1200/scan.c | 3 +-- 5 files changed, 7 insertions(+), 21 deletions(-)
drivers/net/wireless/ath/ath10k/wmi.c +1 -3
@@ -9462,7 +9462,5 @@ void ath10k_wmi_detach(struct ath10k *ar) }cancel_work_sync (&ar->svc_rdy_work); - -if (ar->svc_rdy_skb) -dev_kfree_skb (ar->svc_rdy_skb); +dev_kfree_skb (ar->svc_rdy_skb); }
drivers/net/wireless/intel/iwlegacy/3945-mac.c +2 -6
@@ -2302,9 +2302,7 @@ __il3945_down(struct il_priv *il)il3945_hw_txq_ctx_free (il); exit:memset (&il->card_alive,0 ,sizeof (struct il_alive_resp )); - -if (il->beacon_skb) -dev_kfree_skb (il->beacon_skb); +dev_kfree_skb (il->beacon_skb); il->beacon_skb =NULL ;/* clear out any free frames */
@@ -3847,9 +3845,7 @@ il3945_pci_remove(struct pci_dev *pdev)il_free_channel_map (il);il_free_geos (il);kfree (il->scan_cmd); -if (il->beacon_skb) -dev_kfree_skb (il->beacon_skb); - +dev_kfree_skb (il->beacon_skb);ieee80211_free_hw (il->hw); }
drivers/net/wireless/intel/iwlegacy/common.c +2 -6
@@ -5182,8 +5182,7 @@ il_mac_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)memset (&il->current_ht_config,0 ,sizeof (struct il_ht_config ));/* new association get rid of ibss beacon skb */ -if (il->beacon_skb) -dev_kfree_skb (il->beacon_skb); +dev_kfree_skb (il->beacon_skb); il->beacon_skb =NULL ; il->timestamp =0 ;
@@ -5302,10 +5301,7 @@ il_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif) }spin_lock_irqsave (&il->lock, flags); - -if (il->beacon_skb) -dev_kfree_skb (il->beacon_skb); - +dev_kfree_skb (il->beacon_skb); il->beacon_skb = skb; timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
drivers/net/wireless/mediatek/mt76/mt76x02_beacon.c +1 -4
@@ -77,10 +77,7 @@ int mt76x02_mac_set_beacon(struct mt76x02_dev *dev, u8 vif_idx,for (i =0 ; i <ARRAY_SIZE (dev->beacons); i++) {if (vif_idx == i) { force_update = !!dev->beacons[i] ^ !!skb; - -if (dev->beacons[i]) -dev_kfree_skb (dev->beacons[i]); - +dev_kfree_skb (dev->beacons[i]); dev->beacons[i] = skb;__mt76x02_mac_set_beacon (dev, bcn_idx, skb); }else if (force_update && dev->beacons[i]) {
drivers/net/wireless/st/cw1200/scan.c +1 -2
@@ -120,8 +120,7 @@ int cw1200_hw_scan(struct ieee80211_hw *hw, ++priv->scan.n_ssids; } -if (frame.skb) -dev_kfree_skb (frame.skb); +dev_kfree_skb (frame.skb);mutex_unlock (&priv->conf_mutex);queue_work (priv->workqueue, &priv->scan.work);return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/357 wifi: iwlegacy: common: dont call dev_kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 0c1528675d7a9787cb516b64d8f6c0f6f8efcb48 ]
It is not allowed to call consume_skb() from hardware interrupt context or with interrupts being disabled. So replace dev_kfree_skb() with dev_consume_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/intel/iwlegacy/common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlegacy/common.c +2 -2
@@ -5182,7 +5182,7 @@ il_mac_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)memset (&il->current_ht_config,0 ,sizeof (struct il_ht_config ));/* new association get rid of ibss beacon skb */ -dev_kfree_skb (il->beacon_skb); +dev_consume_skb_irq (il->beacon_skb); il->beacon_skb =NULL ; il->timestamp =0 ;
@@ -5301,7 +5301,7 @@ il_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif) }spin_lock_irqsave (&il->lock, flags); -dev_kfree_skb (il->beacon_skb); +dev_consume_skb_irq (il->beacon_skb); il->beacon_skb = skb; timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/357 wifi: libertas: fix memory leak in lbs_init_adapter()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 16a03958618fb91bb1bc7077cf3211055162cc2f ]
When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not released. Add free memory to processing error path.
--- drivers/net/wireless/marvell/libertas/main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/libertas/main.c +1 -0
@@ -870,6 +870,7 @@ static int lbs_init_adapter(struct lbs_private *priv) ret =kfifo_alloc (&priv->event_fifo,sizeof (u32) *16 ,GFP_KERNEL );if (ret) {pr_err ("Out of memory allocating event FIFO buffer\n" ); +lbs_free_cmd_buffer (priv); goto out; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/357 wifi: rtl8xxxu: dont call dev_kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 4c2005ac87685907b3719b4f40215b578efd27c4 ]
It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled.
It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal.
In this case, dev_kfree_skb() is called to free and drop the SKB when it's shutdown, so replace it with dev_kfree_skb_irq(). Compile tested only.
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +1 -1
@@ -5095,7 +5095,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv, pending = priv->rx_urb_pending_count; }else { skb = (struct sk_buff *)rx_urb->urb.context; -dev_kfree_skb (skb); +dev_kfree_skb_irq (skb);usb_free_urb (&rx_urb->urb); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 37/357 rtlwifi: fix -Wpointer-sign warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit ef41937631bfee855e2b406e1d536efdaa9ce512 ]
There are thousands of warnings in a W=2 build from just one file:
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c:3788:15: warning: pointer targets in initialization of 'u8 *' {aka 'unsigned char *'} from 'char *' differ in signedness [-Wpointer-sign]
Change the types to consistently use 'const char *' for the strings.
Stable-dep-of: 117dbeda22ec ("wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()")
--- .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 81 ++++++++++--------- .../realtek/rtlwifi/rtl8821ae/table.c | 4 +- .../realtek/rtlwifi/rtl8821ae/table.h | 4 +- 3 files changed, 45 insertions(+), 44 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +41 -40
@@ -1587,7 +1587,7 @@ static void _rtl8821ae_phy_txpower_by_rate_configuration(struct ieee80211_hw *hw }/* string is in decimal */ -static bool _rtl8812ae_get_integer_from_string (char *str,u8 *pint) +static bool _rtl8812ae_get_integer_from_string (const char *str,u8 *pint) {u16 i =0 ; *pint =0 ;
@@ -1605,7 +1605,7 @@ static bool _rtl8812ae_get_integer_from_string(char *str, u8 *pint)return true; } -static bool _rtl8812ae_eq_n_byte (u8 *str1,u8 *str2,u32 num) +static bool _rtl8812ae_eq_n_byte (const char *str1,const char *str2,u32 num) {if (num ==0 )return false;
@@ -1643,10 +1643,11 @@ static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw,return channel_index; } -static void _rtl8812ae_phy_set_txpower_limit (struct ieee80211_hw *hw,u8 *pregulation, -u8 *pband,u8 *pbandwidth, -u8 *prate_section,u8 *prf_path, -u8 *pchannel,u8 *ppower_limit) +static void _rtl8812ae_phy_set_txpower_limit (struct ieee80211_hw *hw, +const char *pregulation, +const char *pband,const char *pbandwidth, +const char *prate_section,const char *prf_path, +const char *pchannel,const char *ppower_limit) {struct rtl_priv *rtlpriv =rtl_priv (hw);struct rtl_phy *rtlphy = &rtlpriv->phy;
@@ -1654,8 +1655,8 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregulu8 channel_index;s8 power_limit =0 , prev_power_limit, ret; -if (!_rtl8812ae_get_integer_from_string ((char *)pchannel, &channel) || - !_rtl8812ae_get_integer_from_string ((char *)ppower_limit, +if (!_rtl8812ae_get_integer_from_string (pchannel, &channel) || + !_rtl8812ae_get_integer_from_string (ppower_limit, &power_limit)) { RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "Illegal index of pwr_lmt table [chnl %d][val %d]\n",
@@ -1665,42 +1666,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul power_limit = power_limit >MAX_POWER_INDEX ?MAX_POWER_INDEX : power_limit; -if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("FCC" ),3 )) +if (_rtl8812ae_eq_n_byte (pregulation,"FCC" ,3 )) regulation =0 ; -else if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("MKK" ),3 )) +else if (_rtl8812ae_eq_n_byte (pregulation,"MKK" ,3 )) regulation =1 ; -else if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("ETSI" ),4 )) +else if (_rtl8812ae_eq_n_byte (pregulation,"ETSI" ,4 )) regulation =2 ; -else if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("WW13" ),4 )) +else if (_rtl8812ae_eq_n_byte (pregulation,"WW13" ,4 )) regulation =3 ; -if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("CCK" ),3 )) +if (_rtl8812ae_eq_n_byte (prate_section,"CCK" ,3 )) rate_section =0 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("OFDM" ),4 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"OFDM" ,4 )) rate_section =1 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("HT" ),2 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("1T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && +_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) rate_section =2 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("HT" ),2 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("2T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && +_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) rate_section =3 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("VHT" ),3 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("1T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && +_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) rate_section =4 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("VHT" ),3 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("2T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && +_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) rate_section =5 ; -if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("20M" ),3 )) +if (_rtl8812ae_eq_n_byte (pbandwidth,"20M" ,3 )) bandwidth =0 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("40M" ),3 )) +else if (_rtl8812ae_eq_n_byte (pbandwidth,"40M" ,3 )) bandwidth =1 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("80M" ),3 )) +else if (_rtl8812ae_eq_n_byte (pbandwidth,"80M" ,3 )) bandwidth =2 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("160M" ),4 )) +else if (_rtl8812ae_eq_n_byte (pbandwidth,"160M" ,4 )) bandwidth =3 ; -if (_rtl8812ae_eq_n_byte (pband, (u8 *)("2.4G" ),4 )) { +if (_rtl8812ae_eq_n_byte (pband,"2.4G" ,4 )) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_2_4G , channel);
@@ -1724,7 +1725,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul regulation, bandwidth, rate_section, channel_index, rtlphy->txpwr_limit_2_4g[regulation][bandwidth] [rate_section][channel_index][RF90_PATH_A]); - }else if (_rtl8812ae_eq_n_byte (pband, (u8 *)("5G" ),2 )) { + }else if (_rtl8812ae_eq_n_byte (pband,"5G" ,2 )) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_5G , channel);
@@ -1755,10 +1756,10 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul }static void _rtl8812ae_phy_config_bb_txpwr_lmt (struct ieee80211_hw *hw, -u8 *regulation,u8 *band, -u8 *bandwidth,u8 *rate_section, -u8 *rf_path,u8 *channel, -u8 *power_limit) +const char *regulation,const char *band, +const char *bandwidth,const char *rate_section, +const char *rf_path,const char *channel, +const char *power_limit) { _rtl8812ae_phy_set_txpower_limit(hw, regulation, band, bandwidth, rate_section, rf_path, channel,
@@ -1771,7 +1772,7 @@ static void _rtl8821ae_phy_read_and_config_txpwr_lmt(struct ieee80211_hw *hw)struct rtl_hal *rtlhal =rtl_hal (rtlpriv);u32 i =0 ;u32 array_len; -u8 **array; +const char **array;if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) { array_len =RTL8812AE_TXPWR_LMT_ARRAY_LEN ;
@@ -1785,13 +1786,13 @@ static void _rtl8821ae_phy_read_and_config_txpwr_lmt(struct ieee80211_hw *hw) "\n");for (i =0 ; i < array_len; i +=7 ) { -u8 *regulation = array[i]; -u8 *band = array[i+1 ]; -u8 *bandwidth = array[i+2 ]; -u8 *rate = array[i+3 ]; -u8 *rf_path = array[i+4 ]; -u8 *chnl = array[i+5 ]; -u8 *val = array[i+6 ]; +const char *regulation = array[i]; +const char *band = array[i+1 ]; +const char *bandwidth = array[i+2 ]; +const char *rate = array[i+3 ]; +const char *rf_path = array[i+4 ]; +const char *chnl = array[i+5 ]; +const char *val = array[i+6 ]; _rtl8812ae_phy_config_bb_txpwr_lmt(hw, regulation, band, bandwidth, rate, rf_path,
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c +2 -2
@@ -2894,7 +2894,7 @@ u32 RTL8821AE_AGC_TAB_1TARRAYLEN = ARRAY_SIZE(RTL8821AE_AGC_TAB_ARRAY);* TXPWR_LMT.TXT ******************************************************************************/ -u8 *RTL8812AE_TXPWR_LMT [] = { +const char *RTL8812AE_TXPWR_LMT [] = {"FCC" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"36" ,"ETSI" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,"MKK" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,
@@ -3463,7 +3463,7 @@ u8 *RTL8812AE_TXPWR_LMT[] = {u32 RTL8812AE_TXPWR_LMT_ARRAY_LEN =ARRAY_SIZE (RTL8812AE_TXPWR_LMT ); -u8 *RTL8821AE_TXPWR_LMT [] = { +const char *RTL8821AE_TXPWR_LMT [] = {"FCC" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,"ETSI" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,"MKK" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.h +2 -2
@@ -28,7 +28,7 @@ extern u32 RTL8821AE_AGC_TAB_ARRAY[];extern u32 RTL8812AE_AGC_TAB_1TARRAYLEN ;extern u32 RTL8812AE_AGC_TAB_ARRAY [];extern u32 RTL8812AE_TXPWR_LMT_ARRAY_LEN ; -extern u8 *RTL8812AE_TXPWR_LMT []; +extern const char *RTL8812AE_TXPWR_LMT [];extern u32 RTL8821AE_TXPWR_LMT_ARRAY_LEN ; -extern u8 *RTL8821AE_TXPWR_LMT []; +extern const char *RTL8821AE_TXPWR_LMT [];#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 38/357 wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
In reply to Greg Kroah-HartmanFrom: Li Zetao <[email protected]>
[ Upstream commit 117dbeda22ec5ea0918254d03b540ef8b8a64d53 ]
There is a global-out-of-bounds reported by KASAN:
BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ... </TASK>
The root cause of the problem is that the comparison order of "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two strings from tail to head, which causes the problem. In the _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully designing the comparison order. For example, "pregulation" and "pbandwidth" are compared in order of length from small to large, first is 3 and last is 4. However, the comparison order of "prate_section" dose not obey such order requirement, therefore when "prate_section" is "HT", when comparing from tail to head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough.
Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order of "prate_section", this may cause the value of "rate_section" to not be from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver from staging to regular tree, but also added setting txpower limit function during the driver config phase, so the problem was introduced by this commit.
--- .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------ 1 file changed, 20 insertions(+), 32 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +20 -32
@@ -1605,18 +1605,6 @@ static bool _rtl8812ae_get_integer_from_string(const char *str, u8 *pint)return true; } -static bool _rtl8812ae_eq_n_byte (const char *str1,const char *str2,u32 num) -{ -if (num ==0 ) -return false; -while (num >0 ) { - num--; -if (str1[num] != str2[num]) -return false; - } -return true; -} -static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (struct ieee80211_hw *hw,u8 band,u8 channel) {
@@ -1666,42 +1654,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, power_limit = power_limit >MAX_POWER_INDEX ?MAX_POWER_INDEX : power_limit; -if (_rtl8812ae_eq_n_byte (pregulation,"FCC" ,3 )) +if (strcmp (pregulation,"FCC" ) ==0 ) regulation =0 ; -else if (_rtl8812ae_eq_n_byte (pregulation,"MKK" ,3 )) +else if (strcmp (pregulation,"MKK" ) ==0 ) regulation =1 ; -else if (_rtl8812ae_eq_n_byte (pregulation,"ETSI" ,4 )) +else if (strcmp (pregulation,"ETSI" ) ==0 ) regulation =2 ; -else if (_rtl8812ae_eq_n_byte (pregulation,"WW13" ,4 )) +else if (strcmp (pregulation,"WW13" ) ==0 ) regulation =3 ; -if (_rtl8812ae_eq_n_byte (prate_section,"CCK" ,3 )) +if (strcmp (prate_section,"CCK" ) ==0 ) rate_section =0 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"OFDM" ,4 )) +else if (strcmp (prate_section,"OFDM" ) ==0 ) rate_section =1 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && -_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) +else if (strcmp (prate_section,"HT" ) ==0 && +strcmp (prf_path,"1T" ) ==0 ) rate_section =2 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && -_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) +else if (strcmp (prate_section,"HT" ) ==0 && +strcmp (prf_path,"2T" ) ==0 ) rate_section =3 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && -_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) +else if (strcmp (prate_section,"VHT" ) ==0 && +strcmp (prf_path,"1T" ) ==0 ) rate_section =4 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && -_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) +else if (strcmp (prate_section,"VHT" ) ==0 && +strcmp (prf_path,"2T" ) ==0 ) rate_section =5 ; -if (_rtl8812ae_eq_n_byte (pbandwidth,"20M" ,3 )) +if (strcmp (pbandwidth,"20M" ) ==0 ) bandwidth =0 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth,"40M" ,3 )) +else if (strcmp (pbandwidth,"40M" ) ==0 ) bandwidth =1 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth,"80M" ,3 )) +else if (strcmp (pbandwidth,"80M" ) ==0 ) bandwidth =2 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth,"160M" ,4 )) +else if (strcmp (pbandwidth,"160M" ) ==0 ) bandwidth =3 ; -if (_rtl8812ae_eq_n_byte (pband,"2.4G" ,4 )) { +if (strcmp (pband,"2.4G" ) ==0 ) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_2_4G , channel);
@@ -1725,7 +1713,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, regulation, bandwidth, rate_section, channel_index, rtlphy->txpwr_limit_2_4g[regulation][bandwidth] [rate_section][channel_index][RF90_PATH_A]); - }else if (_rtl8812ae_eq_n_byte (pband,"5G" ,2 )) { + }else if (strcmp (pband,"5G" ) ==0 ) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_5G , channel);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 39/357 ipw2x00: switch from pci_ to dma_ API
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit e52525c0c320076deab35409a6b2cff6388959b8 ]
The wrappers in include/linux/pci-dma-compat.h should go away.
The patch has been generated with the coccinelle script below and has been hand modified to replace GFP_ with a correct flag.
It has been compile tested.
When memory is allocated in 'ipw2100_msg_allocate()' (ipw2100.c), GFP_KERNEL can be used because it is called from the probe function. The call chain is:
ipw2100_pci_init_one (the probe function)
--> ipw2100_queues_allocate
--> ipw2100_msg_allocateMoreover, 'ipw2100_msg_allocate()' already uses GFP_KERNEL for some other memory allocations.
When memory is allocated in 'status_queue_allocate()' (ipw2100.c), GFP_KERNEL can be used because it is called from the probe function. The call chain is:
ipw2100_pci_init_one (the probe function)
--> ipw2100_queues_allocate
--> ipw2100_rx_allocate
--> status_queue_allocateMoreover, 'ipw2100_rx_allocate()' already uses GFP_KERNEL for some other memory allocations.
When memory is allocated in 'bd_queue_allocate()' (ipw2100.c), GFP_KERNEL can be used because it is called from the probe function. The call chain is:
ipw2100_pci_init_one (the probe function)
--> ipw2100_queues_allocate
--> ipw2100_rx_allocate
--> bd_queue_allocateMoreover, 'ipw2100_rx_allocate()' already uses GFP_KERNEL for some other memory allocations.
When memory is allocated in 'ipw2100_tx_allocate()' (ipw2100.c), GFP_KERNEL can be used because it is called from the probe function. The call chain is:
ipw2100_pci_init_one (the probe function)
--> ipw2100_queues_allocate
--> ipw2100_tx_allocateMoreover, 'ipw2100_tx_allocate()' already uses GFP_KERNEL for some other memory allocations.
When memory is allocated in 'ipw_queue_tx_init()' (ipw2200.c), GFP_KERNEL can be used because it is called from a call chain that already uses GFP_KERNEL and no spin_lock is taken in the between.
The call chain is:
ipw_up
--> ipw_load
--> ipw_queue_reset
--> ipw_queue_tx_init'ipw_up()' already uses GFP_KERNEL for some other memory allocations.
@@
@@
- PCI_DMA_BIDIRECTIONAL
+ DMA_BIDIRECTIONAL
@@
@@
- PCI_DMA_TODEVICE
+ DMA_TO_DEVICE
@@
@@
- PCI_DMA_FROMDEVICE
+ DMA_FROM_DEVICE
@@
@@
- PCI_DMA_NONE
+ DMA_NONE
@@
expression e1, e2, e3;
@@
- pci_alloc_consistent(e1, e2, e3)
+ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
@@
expression e1, e2, e3;
@@
- pci_zalloc_consistent(e1, e2, e3)
+ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
@@
expression e1, e2, e3, e4;
@@
- pci_free_consistent(e1, e2, e3, e4)
+ dma_free_coherent(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_map_single(e1, e2, e3, e4)
+ dma_map_single(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_single(e1, e2, e3, e4)
+ dma_unmap_single(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4, e5;
@@
- pci_map_page(e1, e2, e3, e4, e5)
+ dma_map_page(&e1->dev, e2, e3, e4, e5)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_page(e1, e2, e3, e4)
+ dma_unmap_page(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_map_sg(e1, e2, e3, e4)
+ dma_map_sg(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_sg(e1, e2, e3, e4)
+ dma_unmap_sg(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_single_for_cpu(e1, e2, e3, e4)
+ dma_sync_single_for_cpu(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_single_for_device(e1, e2, e3, e4)
+ dma_sync_single_for_device(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_sg_for_cpu(e1, e2, e3, e4)
+ dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_sg_for_device(e1, e2, e3, e4)
+ dma_sync_sg_for_device(&e1->dev, e2, e3, e4)
@@
expression e1, e2;
@@
- pci_dma_mapping_error(e1, e2)
+ dma_mapping_error(&e1->dev, e2)
@@
expression e1, e2;
@@
- pci_set_dma_mask(e1, e2)
+ dma_set_mask(&e1->dev, e2)
@@
expression e1, e2;
@@
- pci_set_consistent_dma_mask(e1, e2)
+ dma_set_coherent_mask(&e1->dev, e2)
Stable-dep-of: 45fc6d7461f1 ("wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()")
--- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 121 +++++++++---------- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 56 ++++----- 2 files changed, 88 insertions(+), 89 deletions(-)
drivers/net/wireless/intel/ipw2x00/ipw2100.c +59 -62
@@ -2294,10 +2294,11 @@ static int ipw2100_alloc_skb(struct ipw2100_priv *priv,return -ENOMEM ; packet->rxp = (struct ipw2100_rx *)packet->skb->data; - packet->dma_addr =pci_map_single (priv->pci_dev, packet->skb->data, + packet->dma_addr =dma_map_single (&priv->pci_dev->dev, + packet->skb->data,sizeof (struct ipw2100_rx ), -PCI_DMA_FROMDEVICE ); -if (pci_dma_mapping_error (priv->pci_dev, packet->dma_addr)) { +DMA_FROM_DEVICE ); +if (dma_mapping_error (&priv->pci_dev->dev, packet->dma_addr)) {dev_kfree_skb (packet->skb);return -ENOMEM ; }
@@ -2478,9 +2479,8 @@ static void isr_rx(struct ipw2100_priv *priv, int i,return ; } -pci_unmap_single (priv->pci_dev, - packet->dma_addr, -sizeof (struct ipw2100_rx ),PCI_DMA_FROMDEVICE ); +dma_unmap_single (&priv->pci_dev->dev, packet->dma_addr, +sizeof (struct ipw2100_rx ),DMA_FROM_DEVICE );skb_put (packet->skb, status->frame_size);
@@ -2562,8 +2562,8 @@ static void isr_rx_monitor(struct ipw2100_priv *priv, int i,return ; } -pci_unmap_single (priv->pci_dev, packet->dma_addr, -sizeof (struct ipw2100_rx ),PCI_DMA_FROMDEVICE ); +dma_unmap_single (&priv->pci_dev->dev, packet->dma_addr, +sizeof (struct ipw2100_rx ),DMA_FROM_DEVICE );memmove (packet->skb->data +sizeof (struct ipw_rt_hdr ), packet->skb->data, status->frame_size);
@@ -2688,9 +2688,9 @@ static void __ipw2100_rx_process(struct ipw2100_priv *priv)/* Sync the DMA for the RX buffer so CPU is sure to get * the correct values */ -pci_dma_sync_single_for_cpu (priv->pci_dev, packet->dma_addr, -sizeof (struct ipw2100_rx ), -PCI_DMA_FROMDEVICE ); +dma_sync_single_for_cpu (&priv->pci_dev->dev, packet->dma_addr, +sizeof (struct ipw2100_rx ), +DMA_FROM_DEVICE );if (unlikely (ipw2100_corruption_check (priv, i))) {ipw2100_corruption_detected (priv, i);
@@ -2922,9 +2922,8 @@ static int __ipw2100_tx_process(struct ipw2100_priv *priv) (packet->index +1 + i) % txq->entries, tbd->host_addr, tbd->buf_length); -pci_unmap_single (priv->pci_dev, - tbd->host_addr, - tbd->buf_length,PCI_DMA_TODEVICE ); +dma_unmap_single (&priv->pci_dev->dev, tbd->host_addr, + tbd->buf_length,DMA_TO_DEVICE ); }libipw_txb_free (packet->info.d_struct.txb);
@@ -3164,15 +3163,13 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv) tbd->buf_length = packet->info.d_struct.txb-> fragments[i]->len -LIBIPW_3ADDR_LEN ; - tbd->host_addr =pci_map_single (priv->pci_dev, + tbd->host_addr =dma_map_single (&priv->pci_dev->dev, packet->info.d_struct. - txb->fragments[i]-> - data + + txb->fragments[i]->data +LIBIPW_3ADDR_LEN , tbd->buf_length, -PCI_DMA_TODEVICE ); -if (pci_dma_mapping_error (priv->pci_dev, - tbd->host_addr)) { +DMA_TO_DEVICE ); +if (dma_mapping_error (&priv->pci_dev->dev, tbd->host_addr)) {IPW_DEBUG_TX ("dma mapping error\n" );break ; }
@@ -3181,10 +3178,10 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv) txq->next, tbd->host_addr, tbd->buf_length); -pci_dma_sync_single_for_device (priv->pci_dev, - tbd->host_addr, - tbd->buf_length, -PCI_DMA_TODEVICE ); +dma_sync_single_for_device (&priv->pci_dev->dev, + tbd->host_addr, + tbd->buf_length, +DMA_TO_DEVICE ); txq->next++; txq->next %= txq->entries;
@@ -3439,9 +3436,9 @@ static int ipw2100_msg_allocate(struct ipw2100_priv *priv)return -ENOMEM ;for (i =0 ; i <IPW_COMMAND_POOL_SIZE ; i++) { - v =pci_zalloc_consistent (priv->pci_dev, -sizeof (struct ipw2100_cmd_header ), - &p); + v =dma_alloc_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_cmd_header ), &p, +GFP_KERNEL );if (!v) { printk(KERN_ERR DRV_NAME ": ""%s: PCI alloc failed for msg "
@@ -3460,11 +3457,10 @@ static int ipw2100_msg_allocate(struct ipw2100_priv *priv)return 0 ;for (j =0 ; j < i; j++) { -pci_free_consistent (priv->pci_dev, -sizeof (struct ipw2100_cmd_header ), - priv->msg_buffers[j].info.c_struct.cmd, - priv->msg_buffers[j].info.c_struct. - cmd_phys); +dma_free_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_cmd_header ), + priv->msg_buffers[j].info.c_struct.cmd, + priv->msg_buffers[j].info.c_struct.cmd_phys); }kfree (priv->msg_buffers);
@@ -3495,11 +3491,10 @@ static void ipw2100_msg_free(struct ipw2100_priv *priv)return ;for (i =0 ; i <IPW_COMMAND_POOL_SIZE ; i++) { -pci_free_consistent (priv->pci_dev, -sizeof (struct ipw2100_cmd_header ), - priv->msg_buffers[i].info.c_struct.cmd, - priv->msg_buffers[i].info.c_struct. - cmd_phys); +dma_free_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_cmd_header ), + priv->msg_buffers[i].info.c_struct.cmd, + priv->msg_buffers[i].info.c_struct.cmd_phys); }kfree (priv->msg_buffers);
@@ -4322,7 +4317,8 @@ static int status_queue_allocate(struct ipw2100_priv *priv, int entries)IPW_DEBUG_INFO ("enter\n" ); q->size = entries *sizeof (struct ipw2100_status ); - q->drv =pci_zalloc_consistent (priv->pci_dev, q->size, &q->nic); + q->drv =dma_alloc_coherent (&priv->pci_dev->dev, q->size, &q->nic, +GFP_KERNEL );if (!q->drv) {IPW_DEBUG_WARNING ("Can not allocate status queue.\n" );return -ENOMEM ;
@@ -4338,9 +4334,10 @@ static void status_queue_free(struct ipw2100_priv *priv)IPW_DEBUG_INFO ("enter\n" );if (priv->status_queue.drv) { -pci_free_consistent (priv->pci_dev, priv->status_queue.size, - priv->status_queue.drv, - priv->status_queue.nic); +dma_free_coherent (&priv->pci_dev->dev, + priv->status_queue.size, + priv->status_queue.drv, + priv->status_queue.nic); priv->status_queue.drv =NULL ; }
@@ -4356,7 +4353,8 @@ static int bd_queue_allocate(struct ipw2100_priv *priv, q->entries = entries; q->size = entries *sizeof (struct ipw2100_bd ); - q->drv =pci_zalloc_consistent (priv->pci_dev, q->size, &q->nic); + q->drv =dma_alloc_coherent (&priv->pci_dev->dev, q->size, &q->nic, +GFP_KERNEL );if (!q->drv) {IPW_DEBUG_INFO ("can't allocate shared memory for buffer descriptors\n" );
@@ -4376,7 +4374,8 @@ static void bd_queue_free(struct ipw2100_priv *priv, struct ipw2100_bd_queue *q)return ;if (q->drv) { -pci_free_consistent (priv->pci_dev, q->size, q->drv, q->nic); +dma_free_coherent (&priv->pci_dev->dev, q->size, q->drv, + q->nic); q->drv =NULL ; }
@@ -4436,9 +4435,9 @@ static int ipw2100_tx_allocate(struct ipw2100_priv *priv) }for (i =0 ; i <TX_PENDED_QUEUE_LENGTH ; i++) { - v =pci_alloc_consistent (priv->pci_dev, -sizeof (struct ipw2100_data_header ), - &p); + v =dma_alloc_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_data_header ), &p, +GFP_KERNEL );if (!v) { printk(KERN_ERR DRV_NAME ": %s: PCI alloc failed for tx " "buffers.\n",
@@ -4458,11 +4457,10 @@ static int ipw2100_tx_allocate(struct ipw2100_priv *priv)return 0 ;for (j =0 ; j < i; j++) { -pci_free_consistent (priv->pci_dev, -sizeof (struct ipw2100_data_header ), - priv->tx_buffers[j].info.d_struct.data, - priv->tx_buffers[j].info.d_struct. - data_phys); +dma_free_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_data_header ), + priv->tx_buffers[j].info.d_struct.data, + priv->tx_buffers[j].info.d_struct.data_phys); }kfree (priv->tx_buffers);
@@ -4539,12 +4537,10 @@ static void ipw2100_tx_free(struct ipw2100_priv *priv) priv->tx_buffers[i].info.d_struct.txb =NULL ; }if (priv->tx_buffers[i].info.d_struct.data) -pci_free_consistent (priv->pci_dev, -sizeof (struct ipw2100_data_header ), - priv->tx_buffers[i].info.d_struct. - data, - priv->tx_buffers[i].info.d_struct. - data_phys); +dma_free_coherent (&priv->pci_dev->dev, +sizeof (struct ipw2100_data_header ), + priv->tx_buffers[i].info.d_struct.data, + priv->tx_buffers[i].info.d_struct.data_phys); }kfree (priv->tx_buffers);
@@ -4607,9 +4603,10 @@ static int ipw2100_rx_allocate(struct ipw2100_priv *priv)return 0 ;for (j =0 ; j < i; j++) { -pci_unmap_single (priv->pci_dev, priv->rx_buffers[j].dma_addr, +dma_unmap_single (&priv->pci_dev->dev, + priv->rx_buffers[j].dma_addr,sizeof (struct ipw2100_rx_packet ), -PCI_DMA_FROMDEVICE ); +DMA_FROM_DEVICE );dev_kfree_skb (priv->rx_buffers[j].skb); }
@@ -4661,10 +4658,10 @@ static void ipw2100_rx_free(struct ipw2100_priv *priv)for (i =0 ; i <RX_QUEUE_LENGTH ; i++) {if (priv->rx_buffers[i].rxp) { -pci_unmap_single (priv->pci_dev, +dma_unmap_single (&priv->pci_dev->dev, priv->rx_buffers[i].dma_addr,sizeof (struct ipw2100_rx ), -PCI_DMA_FROMDEVICE ); +DMA_FROM_DEVICE );dev_kfree_skb (priv->rx_buffers[i].skb); } }
@@ -6196,7 +6193,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,pci_set_master (pci_dev);pci_set_drvdata (pci_dev, priv); - err =pci_set_dma_mask (pci_dev,DMA_BIT_MASK (32 )); + err =dma_set_mask (&pci_dev->dev,DMA_BIT_MASK (32 ));if (err) { printk(KERN_WARNING DRV_NAME "Error calling pci_set_dma_mask.\n");
drivers/net/wireless/intel/ipw2x00/ipw2200.c +29 -27
124 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 40/357 wifi: ipw2x00: dont call dev_kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 45fc6d7461f18df2f238caf0cbc5acc4163203d1 ]
It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled.
It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal.
In this case, dev_kfree_skb() is called to free and drop the SKB when it's reset, so replace it with dev_kfree_skb_irq(). Compile tested only.
--- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/ipw2x00/ipw2200.c +1 -1
@@ -3445,7 +3445,7 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv,dma_unmap_single (&priv->pci_dev->dev, rxq->pool[i].dma_addr,IPW_RX_BUF_SIZE ,DMA_FROM_DEVICE ); -dev_kfree_skb (rxq->pool[i].skb); +dev_kfree_skb_irq (rxq->pool[i].skb); rxq->pool[i].skb =NULL ; }list_add_tail (&rxq->pool[i].list, &rxq->rx_used);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 41/357 wifi: ipw2200: fix memory leak in ipw_wdev_init()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 9fe21dc626117fb44a8eb393713a86a620128ce3 ]
In the error path of ipw_wdev_init(), exception value is returned, and the memory applied for in the function is not released. Also the memory is not released in ipw_pci_probe(). As a result, memory leakage occurs. So memory release needs to be added to the error path of ipw_wdev_init().
--- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/ipw2x00/ipw2200.c +7 -2
@@ -11414,9 +11414,14 @@ static int ipw_wdev_init(struct net_device *dev)set_wiphy_dev (wdev->wiphy, &priv->pci_dev->dev);/* With that information in place, we can now register the wiphy... */ -if (wiphy_register (wdev->wiphy)) - rc = -EIO ; + rc =wiphy_register (wdev->wiphy); +if (rc) + goto out; + +return 0 ; out: +kfree (priv->ieee->a_band.channels); +kfree (priv->ieee->bg_band.channels);return rc; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 42/357 wilc1000: let wilc_mac_xmit() return NETDEV_TX_OK
In reply to Greg Kroah-HartmanFrom: Luc Van Oostenryck <[email protected]>
[ Upstream commit cce0e08301fe43dc3fe983d5f098393d15f803f0 ]
The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', which is a typedef for an enum type defining 'NETDEV_TX_OK' but this driver returns '0' instead of 'NETDEV_TX_OK'.
Fix this by returning 'NETDEV_TX_OK' instead of '0'.
Stable-dep-of: deb962ec9e1c ("wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()")
--- drivers/staging/wilc1000/wilc_netdev.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/wilc1000/wilc_netdev.c +3 -3
@@ -717,14 +717,14 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev)if (skb->dev != ndev) {netdev_err (ndev,"Packet not destined to this device\n" ); -return 0 ; +return NETDEV_TX_OK ; } tx_data =kmalloc (sizeof (*tx_data),GFP_ATOMIC );if (!tx_data) {dev_kfree_skb (skb);netif_wake_queue (ndev); -return 0 ; +return NETDEV_TX_OK ; } tx_data->buff = skb->data;
@@ -748,7 +748,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev)mutex_unlock (&wilc->vif_mutex); } -return 0 ; +return NETDEV_TX_OK ; }static int wilc_mac_close (struct net_device *ndev)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 43/357 wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit deb962ec9e1c9a81babd3d37542ad4bd6ac3396e ]
The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add dev_kfree_skb() to fix it. Compile tested only.
--- drivers/staging/wilc1000/wilc_netdev.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/wilc1000/wilc_netdev.c +1 -0
@@ -717,6 +717,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev)if (skb->dev != ndev) {netdev_err (ndev,"Packet not destined to this device\n" ); +dev_kfree_skb (skb);return NETDEV_TX_OK ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 44/357 wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit 212fde3fe76e962598ce1d47b97cc78afdfc71b3 ]
The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Compile tested only.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +1 -0
@@ -333,6 +333,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,bphy_err (drvr,"%s: failed to expand headroom\n" ,brcmf_ifname (ifp));atomic_inc (&drvr->bus_if->stats.pktcow_failed); +dev_kfree_skb (skb); goto done; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 45/357 wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit b9f420032f2ba1e634b22ca7b433e5c40ea663af ]
After the DMA buffer is mapped to a physical address, address is stored in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr and later unmap the DMA buffer. But when count is always equal to pktids->array_size, physaddr isn't stored in pktids and the DMA buffer will not be unmapped anyway.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +4 -1
@@ -345,8 +345,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev, count++; }while (count < pktids->array_size); -if (count == pktids->array_size) +if (count == pktids->array_size) { +dma_unmap_single (dev, *physaddr, skb->len - data_offset, + pktids->direction);return -ENOMEM ; + } array[*idx].data_offset = data_offset; array[*idx].physaddr = *physaddr;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 46/357 wifi: libertas_tf: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 9388ce97b98216833c969191ee6df61a7201d797 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas_tf/if_usb.c +1 -1
@@ -613,7 +613,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,spin_lock_irqsave (&priv->driver_lock, flags);memcpy (priv->cmd_resp_buff, recvbuff +MESSAGE_HEADER_LEN , recvlength -MESSAGE_HEADER_LEN ); -kfree_skb (skb); +dev_kfree_skb_irq (skb);lbtf_cmd_response_rx (priv);spin_unlock_irqrestore (&priv->driver_lock, flags); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 47/357 wifi: libertas: if_usb: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 3968e81ba644f10a7d45bae2539560db9edac501 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas/if_usb.c +1 -1
@@ -637,7 +637,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, priv->resp_len[i] = (recvlength -MESSAGE_HEADER_LEN );memcpy (priv->resp_buf[i], recvbuff +MESSAGE_HEADER_LEN , priv->resp_len[i]); -kfree_skb (skb); +dev_kfree_skb_irq (skb);lbs_notify_command_response (priv, i);spin_unlock_irqrestore (&priv->driver_lock, flags);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 48/357 wifi: libertas: main: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit f393df151540bf858effbd29ff572ab94e76a4c4 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas/main.c +1 -1
@@ -217,7 +217,7 @@ int lbs_stop_iface(struct lbs_private *priv)spin_lock_irqsave (&priv->driver_lock, flags); priv->iface_running = false; -kfree_skb (priv->currenttxskb); +dev_kfree_skb_irq (priv->currenttxskb); priv->currenttxskb =NULL ; priv->tx_pending_len =0 ;spin_unlock_irqrestore (&priv->driver_lock, flags);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 49/357 wifi: libertas: cmdresp: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 708a49a64237f19bd404852f297aaadbc9e7fee0 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas/cmdresp.c +1 -1
@@ -48,7 +48,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv,/* Free Tx and Rx packets */ spin_lock_irqsave (&priv->driver_lock, flags); -kfree_skb (priv->currenttxskb); +dev_kfree_skb_irq (priv->currenttxskb); priv->currenttxskb =NULL ; priv->tx_pending_len =0 ;spin_unlock_irqrestore (&priv->driver_lock, flags);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 50/357 wifi: wl3501_cs: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 44bacbdf9066c590423259dbd6d520baac99c1a8 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/wl3501_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/wl3501_cs.c +1 -1
@@ -1328,7 +1328,7 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb, }else { ++dev->stats.tx_packets; dev->stats.tx_bytes += skb->len; -kfree_skb (skb); +dev_kfree_skb_irq (skb);if (this->tx_buffer_cnt <2 )netif_stop_queue (dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 51/357 crypto: x86/ghash - fix unaligned access in ghash_setkey()
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit 116db2704c193fff6d73ea6c2219625f0c9bdfc8 ]
The key can be unaligned, so use the unaligned memory access helpers.
--- arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/crypto/ghash-clmulni-intel_glue.c +3 -3
@@ -19,6 +19,7 @@#include <crypto/internal/simd.h> #include <asm/cpu_device_id.h> #include <asm/simd.h> +#include <asm/unaligned.h> #define GHASH_BLOCK_SIZE 16#define GHASH_DIGEST_SIZE 16
@@ -54,7 +55,6 @@ static int ghash_setkey(struct crypto_shash *tfm, const u8 *key, unsigned int keylen) {struct ghash_ctx *ctx =crypto_shash_ctx (tfm); -be128 *x = (be128 *)key;u64 a, b;if (keylen !=GHASH_BLOCK_SIZE ) {
@@ -63,8 +63,8 @@ static int ghash_setkey(struct crypto_shash *tfm, }/* perform multiplication by 'x' in GF(2^128) */ - a =be64_to_cpu (x->a); - b =be64_to_cpu (x->b); + a =get_unaligned_be64 (key); + b =get_unaligned_be64 (key +8 ); ctx->shash.a = (b <<1 ) | (a >>63 ); ctx->shash.b = (a <<1 ) | (b >>63 );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 52/357 ACPICA: Drop port I/O validation for some regions
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 ]
Microsoft introduced support in Windows XP for blocking port I/O to various regions. For Windows compatibility ACPICA has adopted the same protections and will disallow writes to those (presumably) the same regions.
On some systems the AML included with the firmware will issue 4 byte long writes to 0x80. These writes aren't making it over because of this blockage. The first 4 byte write attempt is rejected, and then subsequently 1 byte at a time each offset is tried. The first at 0x80 works, but then the next 3 bytes are rejected.
This manifests in bizarre failures for devices that expected the AML to write all 4 bytes. Trying the same AML on Windows 10 or 11 doesn't hit this failure and all 4 bytes are written.
Either some of these regions were wrong or some point after Windows XP some of these regions blocks have been lifted.
In the last 15 years there doesn't seem to be any reports popping up of this error in the Windows event viewer anymore. There is no documentation at Microsoft's developer site indicating that Windows ACPI interpreter blocks these regions. Between the lack of documentation and the fact that the writes actually do work in Windows 10 and 11, it's quite likely Windows doesn't actually enforce this anymore.
So to help the issue, only enforce Windows XP specific entries if the latest _OSI supported is Windows XP. Continue to enforce the ALWAYS_ILLEGAL entries.
--- drivers/acpi/acpica/hwvalid.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/acpi/acpica/hwvalid.c +4 -3
@@ -23,8 +23,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width);* * The table is used to implement the Microsoft port access rules that * first appeared in Windows XP. Some ports are always illegal, and some -* ports are only illegal if the BIOS calls _OSI with a win_XP string or -* later (meaning that the BIOS itelf is post-XP.) +* ports are only illegal if the BIOS calls _OSI with nothing newer than +* the specific _OSI strings. * * This provides ACPICA with the desired port protections and * Microsoft compatibility.
@@ -145,7 +145,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)/* Port illegality may depend on the _OSI calls made by the BIOS */ -if (acpi_gbl_osi_data >= port_info->osi_dependency) { +if (port_info->osi_dependency ==ACPI_ALWAYS_ILLEGAL || + acpi_gbl_osi_data == port_info->osi_dependency) { ACPI_DEBUG_PRINT((ACPI_DB_VALUES, "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)\n", ACPI_FORMAT_UINT64(address),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 53/357 genirq: Fix the return type of kstat_cpu_irqs_sum()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit 47904aed898a08f028572b9b5a5cc101ddfb2d82 ]
The type of member ->irqs_sum is unsigned long, but kstat_cpu_irqs_sum() returns int, which can result in truncation. Therefore, change the kstat_cpu_irqs_sum() function's return value to unsigned long to avoid truncation.
--- include/linux/kernel_stat.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/kernel_stat.h +1 -1
@@ -73,7 +73,7 @@ extern unsigned int kstat_irqs_usr(unsigned int irq);/* * Number of interrupts per cpu, since bootup */ -static inline unsigned int kstat_cpu_irqs_sum (unsigned int cpu) +static inline unsigned long kstat_cpu_irqs_sum (unsigned int cpu) {return kstat_cpu (cpu).irqs_sum; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 54/357 lib/mpi: Fix buffer overrun when SG is too long
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ]
The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes.
--- lib/mpi/mpicoder.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/mpi/mpicoder.c +2 -1
@@ -397,7 +397,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)while (sg_miter_next (&miter)) { buff = miter.addr; - len = miter.length; + len =min_t (unsigned, miter.length, nbytes); + nbytes -= len;for (x =0 ; x < len; x++) { a <<=8 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 55/357 ACPICA: nsrepair: handle cases without a return value correctly
In reply to Greg Kroah-HartmanFrom: Daniil Tatianin <[email protected]>
[ Upstream commit ca843a4c79486e99a19b859ef0b9887854afe146 ]
Previously acpi_ns_simple_repair() would crash if expected_btypes contained any combination of ACPI_RTYPE_NONE with a different type, e.g | ACPI_RTYPE_INTEGER because of slightly incorrect logic in the !return_object branch, which wouldn't return AE_AML_NO_RETURN_VALUE for such cases.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- drivers/acpi/acpica/nsrepair.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/acpi/acpica/nsrepair.c +7 -5
@@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,* Try to fix if there was no return object. Warning if failed to fix. */ if (!return_object) { -if (expected_btypes && (!(expected_btypes &ACPI_RTYPE_NONE ))) { -if (package_index !=ACPI_NOT_PACKAGE_ELEMENT ) { +if (expected_btypes) { +if (!(expected_btypes &ACPI_RTYPE_NONE ) && + package_index !=ACPI_NOT_PACKAGE_ELEMENT ) { ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname, ACPI_WARN_ALWAYS,
@@ -196,14 +197,15 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,if (ACPI_SUCCESS (status)) {return (AE_OK );/* Repair was successful */ } - }else { + } + +if (expected_btypes !=ACPI_RTYPE_NONE ) {ACPI_WARN_PREDEFINED ((AE_INFO , info->full_pathname,ACPI_WARN_ALWAYS ,"Missing expected return value" )); +return (AE_AML_NO_RETURN_VALUE ); } - -return (AE_AML_NO_RETURN_VALUE ); } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 56/357 wifi: orinoco: check return value of hermes_write_wordrec()
In reply to Greg Kroah-HartmanFrom: Alexey Kodanev <[email protected]>
[ Upstream commit 1e346cbb096a5351a637ec1992beffbf330547f0 ]
There is currently no return check for writing an authentication type (HERMES_AUTH_SHARED_KEY or HERMES_AUTH_OPEN). It looks like it was accidentally skipped.
This patch adds a return check similar to the other checks in __orinoco_hw_setup_enc() for hermes_write_wordrec().
Detected using the static analysis tool - Svace.
--- drivers/net/wireless/intersil/orinoco/hw.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intersil/orinoco/hw.c +2 -0
@@ -931,6 +931,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv) err =hermes_write_wordrec (hw,USER_BAP ,HERMES_RID_CNFAUTHENTICATION_AGERE , auth_flag); +if (err) +return err; } err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFWEPENABLED_AGERE,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 57/357 wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 ]
It is stated that ath9k_htc_rx_msg() either frees the provided skb or passes its management to another callback function. However, the skb is not freed in case there is no another callback function, and Syzkaller was able to cause a memory leak. Also minor comment fix.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/htc_hst.c +3 -1
@@ -391,7 +391,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,* HTC Messages are handled directly here and the obtained SKB * is freed. * -* Service messages (Data, WMI) passed to the corresponding +* Service messages (Data, WMI) are passed to the corresponding * endpoint RX handlers, which have to free the SKB. */ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
@@ -478,6 +478,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,if (endpoint->ep_callbacks.rx) endpoint->ep_callbacks.rx (endpoint->ep_callbacks.priv, skb, epid); +else + goto invalid; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 58/357 ath9k: hif_usb: simplify if-if to if-else
In reply to Greg Kroah-HartmanFrom: Wan Jiabing <[email protected]>
[ Upstream commit 2950833f10cfa601813262e1d9c8473f9415681b ]
Use if and else instead of if(A) and if (!A).
Stable-dep-of: 0af54343a762 ("wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails")
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +2 -3
@@ -368,10 +368,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)__skb_queue_head_init (&tx_buf->skb_queue);list_move_tail (&tx_buf->list, &hif_dev->tx.tx_buf); hif_dev->tx.tx_buf_cnt++; - } - -if (!ret) + }else {TX_STAT_INC (buf_queued); + }return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 59/357 ath9k: htc: clean up statistics macros
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit d7fc76039b74ad37b7056d5607b05d7cb31a5404 ]
I've changed *STAT_* macros a bit in previous patch and I seems like they become really unreadable. Align these macros definitions to make code cleaner and fix folllowing checkpatch warning
ERROR: Macros with complex values should be enclosed in parentheses
Also, statistics macros now accept an hif_dev as argument, since macros that depend on having a local variable with a magic name don't abide by the coding style.
No functional change
Stable-dep-of: 0af54343a762 ("wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails")
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 26 +++++++-------- drivers/net/wireless/ath/ath9k/htc.h | 32 +++++++++++-------- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +++--- 3 files changed, 36 insertions(+), 32 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +13 -13
@@ -244,11 +244,11 @@ static inline void ath9k_skb_queue_complete(struct hif_device_usb *hif_dev,ath9k_htc_txcompletion_cb (hif_dev->htc_handle, skb, txok);if (txok) { -TX_STAT_INC (skb_success); -TX_STAT_ADD (skb_success_bytes, ln); +TX_STAT_INC (hif_dev, skb_success); +TX_STAT_ADD (hif_dev, skb_success_bytes, ln); }else -TX_STAT_INC (skb_failed); +TX_STAT_INC (hif_dev, skb_failed); } }
@@ -302,7 +302,7 @@ static void hif_usb_tx_cb(struct urb *urb) hif_dev->tx.tx_buf_cnt++;if (!(hif_dev->tx.flags &HIF_USB_TX_STOP ))__hif_usb_tx (hif_dev);/* Check for pending SKBs */ -TX_STAT_INC (buf_completed); +TX_STAT_INC (hif_dev, buf_completed);spin_unlock (&hif_dev->tx.tx_lock); }
@@ -353,7 +353,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev) tx_buf->len += tx_buf->offset;__skb_queue_tail (&tx_buf->skb_queue, nskb); -TX_STAT_INC (skb_queued); +TX_STAT_INC (hif_dev, skb_queued); } usb_fill_bulk_urb(tx_buf->urb, hif_dev->udev,
@@ -369,7 +369,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)list_move_tail (&tx_buf->list, &hif_dev->tx.tx_buf); hif_dev->tx.tx_buf_cnt++; }else { -TX_STAT_INC (buf_queued); +TX_STAT_INC (hif_dev, buf_queued); }return ret;
@@ -514,7 +514,7 @@ static void hif_usb_sta_drain(void *hif_handle, u8 idx)ath9k_htc_txcompletion_cb (hif_dev->htc_handle, skb, false); hif_dev->tx.tx_skb_cnt--; -TX_STAT_INC (skb_failed); +TX_STAT_INC (hif_dev, skb_failed); } }
@@ -585,14 +585,14 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, pkt_tag =get_unaligned_le16 (ptr + index +2 );if (pkt_tag !=ATH_USB_RX_STREAM_MODE_TAG ) { -RX_STAT_INC (skb_dropped); +RX_STAT_INC (hif_dev, skb_dropped);return ; }if (pkt_len >2 *MAX_RX_BUF_SIZE ) {dev_err (&hif_dev->udev->dev,"ath9k_htc: invalid pkt_len (%x)\n" , pkt_len); -RX_STAT_INC (skb_dropped); +RX_STAT_INC (hif_dev, skb_dropped);return ; }
@@ -618,7 +618,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, goto err; }skb_reserve (nskb,32 ); -RX_STAT_INC (skb_allocated); +RX_STAT_INC (hif_dev, skb_allocated);memcpy (nskb->data, &(skb->data[chk_idx+4 ]), hif_dev->rx_transfer_len);
@@ -639,7 +639,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, goto err; }skb_reserve (nskb,32 ); -RX_STAT_INC (skb_allocated); +RX_STAT_INC (hif_dev, skb_allocated);memcpy (nskb->data, &(skb->data[chk_idx+4 ]), pkt_len);skb_put (nskb, pkt_len);
@@ -649,10 +649,10 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, err:for (i =0 ; i < pool_index; i++) { -RX_STAT_ADD (skb_completed_bytes, skb_pool[i]->len); +RX_STAT_ADD (hif_dev, skb_completed_bytes, skb_pool[i]->len);ath9k_htc_rx_msg (hif_dev->htc_handle, skb_pool[i], skb_pool[i]->len,USB_WLAN_RX_PIPE ); -RX_STAT_INC (skb_completed); +RX_STAT_INC (hif_dev, skb_completed); } }
drivers/net/wireless/ath/ath9k/htc.h +18 -14
@@ -325,14 +325,18 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb) }#ifdef CONFIG_ATH9K_HTC_DEBUGFS -#define __STAT_SAFE (expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) -#define TX_STAT_INC (c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) -#define TX_STAT_ADD (c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) -#define RX_STAT_INC (c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) -#define RX_STAT_ADD (c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) -#define CAB_STAT_INC priv->debug.tx_stats.cab_queued++ - -#define TX_QSTAT_INC (q) (priv->debug.tx_stats.queue_stats[q]++) +#define __STAT_SAFE (hif_dev, expr) ((hif_dev)->htc_handle->drv_priv ? (expr) : 0) +#define CAB_STAT_INC (priv) ((priv)->debug.tx_stats.cab_queued++) +#define TX_QSTAT_INC (priv, q) ((priv)->debug.tx_stats.queue_stats[q]++) + +#define TX_STAT_INC (hif_dev, c) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c++) +#define TX_STAT_ADD (hif_dev, c, a) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c += a) +#define RX_STAT_INC (hif_dev, c) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c++) +#define RX_STAT_ADD (hif_dev, c, a) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c += a)void ath9k_htc_err_stat_rx (struct ath9k_htc_priv *priv,struct ath_rx_status *rs);
@@ -372,13 +376,13 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw, struct ethtool_stats *stats, u64 *data);#else -#define TX_STAT_INC (c) do { } while (0) -#define TX_STAT_ADD (c, a) do { } while (0) -#define RX_STAT_INC (c) do { } while (0) -#define RX_STAT_ADD (c, a) do { } while (0) -#define CAB_STAT_INC do { } while (0) +#define TX_STAT_INC (hif_dev, c) +#define TX_STAT_ADD (hif_dev, c, a) +#define RX_STAT_INC (hif_dev, c) +#define RX_STAT_ADD (hif_dev, c, a) -#define TX_QSTAT_INC (c) do { } while (0) +#define CAB_STAT_INC (priv) +#define TX_QSTAT_INC (priv, c)static inline void ath9k_htc_err_stat_rx (struct ath9k_htc_priv *priv,struct ath_rx_status *rs)
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +5 -5
@@ -106,20 +106,20 @@ static inline enum htc_endpoint_id get_htc_epid(struct ath9k_htc_priv *priv,switch (qnum) {case 0 : -TX_QSTAT_INC (IEEE80211_AC_VO ); +TX_QSTAT_INC (priv,IEEE80211_AC_VO ); epid = priv->data_vo_ep;break ;case 1 : -TX_QSTAT_INC (IEEE80211_AC_VI ); +TX_QSTAT_INC (priv,IEEE80211_AC_VI ); epid = priv->data_vi_ep;break ;case 2 : -TX_QSTAT_INC (IEEE80211_AC_BE ); +TX_QSTAT_INC (priv,IEEE80211_AC_BE ); epid = priv->data_be_ep;break ;case 3 :default : -TX_QSTAT_INC (IEEE80211_AC_BK ); +TX_QSTAT_INC (priv,IEEE80211_AC_BK ); epid = priv->data_bk_ep;break ; }
@@ -323,7 +323,7 @@ static void ath9k_htc_tx_data(struct ath9k_htc_priv *priv,memcpy (tx_fhdr, (u8 *) &tx_hdr,sizeof (tx_hdr));if (is_cab) { -CAB_STAT_INC ; +CAB_STAT_INC (priv); tx_ctl->epid = priv->cab_ep;return ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 60/357 wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 0af54343a76263a12dbae7fafb64eb47c4a6ad38 ]
Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and freed. Added a comment describing this issue.
The patch also makes remain_skb NULL after being processed so that it cannot be referenced after potential free. The initialization of hif_dev fields which are associated with remain_skb (rx_remain_len, rx_transfer_len and rx_pad_len) is moved after a new remain_skb is allocated.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 31 +++++++++++++++++------- 1 file changed, 22 insertions(+), 9 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +22 -9
@@ -561,11 +561,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,memcpy (ptr, skb->data, rx_remain_len); rx_pkt_len += rx_remain_len; - hif_dev->rx_remain_len =0 ;skb_put (remain_skb, rx_pkt_len); skb_pool[pool_index++] = remain_skb; - + hif_dev->remain_skb =NULL ; + hif_dev->rx_remain_len =0 ; }else { index = rx_remain_len; }
@@ -584,16 +584,21 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, pkt_len =get_unaligned_le16 (ptr + index); pkt_tag =get_unaligned_le16 (ptr + index +2 ); +/* It is supposed that if we have an invalid pkt_tag or +* pkt_len then the whole input SKB is considered invalid +* and dropped; the associated packets already in skb_pool +* are dropped, too. +*/ if (pkt_tag !=ATH_USB_RX_STREAM_MODE_TAG ) {RX_STAT_INC (hif_dev, skb_dropped); -return ; + goto invalid_pkt; }if (pkt_len >2 *MAX_RX_BUF_SIZE ) {dev_err (&hif_dev->udev->dev,"ath9k_htc: invalid pkt_len (%x)\n" , pkt_len);RX_STAT_INC (hif_dev, skb_dropped); -return ; + goto invalid_pkt; } pad_len =4 - (pkt_len &0x3 );
@@ -605,11 +610,6 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,if (index >MAX_RX_BUF_SIZE ) {spin_lock (&hif_dev->rx_lock); - hif_dev->rx_remain_len = index -MAX_RX_BUF_SIZE ; - hif_dev->rx_transfer_len = -MAX_RX_BUF_SIZE - chk_idx -4 ; - hif_dev->rx_pad_len = pad_len; - nskb =__dev_alloc_skb (pkt_len +32 ,GFP_ATOMIC );if (!nskb) { dev_err(&hif_dev->udev->dev,
@@ -617,6 +617,12 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,spin_unlock (&hif_dev->rx_lock); goto err; } + + hif_dev->rx_remain_len = index -MAX_RX_BUF_SIZE ; + hif_dev->rx_transfer_len = +MAX_RX_BUF_SIZE - chk_idx -4 ; + hif_dev->rx_pad_len = pad_len; +skb_reserve (nskb,32 );RX_STAT_INC (hif_dev, skb_allocated);
@@ -654,6 +660,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, skb_pool[i]->len, USB_WLAN_RX_PIPE);RX_STAT_INC (hif_dev, skb_completed); } +return ; +invalid_pkt: +for (i =0 ; i < pool_index; i++) { +dev_kfree_skb_any (skb_pool[i]); +RX_STAT_INC (hif_dev, skb_dropped); + } +return ; }static void ath9k_hif_usb_rx_cb (struct urb *urb)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 61/357 wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
In reply to Greg Kroah-HartmanFrom: Minsuk Kang <[email protected]>
[ Upstream commit 8a2f35b9830692f7a616f2f627f943bc748af13a ]
Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9k_wmi_cmd(). The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that could no longer be valid when a timeout occurs. Set wmi->last_seq_id to 0 when a timeout occurred.
Found by a modified version of syzkaller.
BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx Write of size 4 Call Trace: memcpy ath9k_wmi_ctrl_rx ath9k_htc_rx_msg ath9k_hif_usb_reg_in_cb __usb_hcd_giveback_urb usb_hcd_giveback_urb dummy_timer call_timer_fn run_timer_softirq __do_softirq irq_exit_rcu sysvec_apic_timer_interrupt
--- drivers/net/wireless/ath/ath9k/wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath9k/wmi.c +1 -0
@@ -338,6 +338,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,if (!time_left) {ath_dbg (common,WMI ,"Timeout waiting for WMI command: %s\n" ,wmi_cmd_to_name (cmd_id)); + wmi->last_seq_id =0 ;mutex_unlock (&wmi->op_mutex);return -ETIMEDOUT ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 62/357 ACPI: battery: Fix missing NUL-termination with large strings
In reply to Greg Kroah-HartmanFrom: Armin Wolf <[email protected]>
[ Upstream commit f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc ]
When encountering a string bigger than the destination buffer (32 bytes), the string is not properly NUL-terminated, causing buffer overreads later.
This for example happens on the Inspiron 3505, where the battery model name is larger than 32 bytes, which leads to sysfs showing the model name together with the serial number string (which is NUL-terminated and thus prevents worse).
Fix this by using strscpy() which ensures that the result is always NUL-terminated.
--- drivers/acpi/battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/battery.c +1 -1
@@ -465,7 +465,7 @@ static int extract_package(struct acpi_battery *battery,u8 *ptr = (u8 *)battery + offsets[i].offset;if (element->type ==ACPI_TYPE_STRING || element->type ==ACPI_TYPE_BUFFER ) -strncpy (ptr, element->string.pointer,32 ); +strscpy (ptr, element->string.pointer,32 );else if (element->type ==ACPI_TYPE_INTEGER ) {strncpy (ptr, (u8 *)&element->integer.value,sizeof (u64));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 63/357 crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
In reply to Greg Kroah-HartmanFrom: Koba Ko <[email protected]>
[ Upstream commit 299bf602b3f92f1456aef59c6413591fb02e762a ]
The following warning appears during the CCP module re-initialization:
[ 140.965403] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:07.1/0000:03:00.2/dma/dma0chan0' [ 140.975736] CPU: 0 PID: 388 Comm: kworker/0:2 Kdump: loaded Not tainted 6.2.0-0.rc2.18.eln124.x86_64 #1 [ 140.985185] Hardware name: HPE ProLiant DL325 Gen10/ProLiant DL325 Gen10, BIOS A41 07/17/2020 [ 140.993761] Workqueue: events work_for_cpu_fn [ 140.998151] Call Trace: [ 141.000613] <TASK> [ 141.002726] dump_stack_lvl+0x33/0x46 [ 141.006415] sysfs_warn_dup.cold+0x17/0x23 [ 141.010542] sysfs_create_dir_ns+0xba/0xd0 [ 141.014670] kobject_add_internal+0xba/0x260 [ 141.018970] kobject_add+0x81/0xb0 [ 141.022395] device_add+0xdc/0x7e0 [ 141.025822] ? complete_all+0x20/0x90 [ 141.029510] __dma_async_device_channel_register+0xc9/0x130 [ 141.035119] dma_async_device_register+0x19e/0x3b0 [ 141.039943] ccp_dmaengine_register+0x334/0x3f0 [ccp] [ 141.045042] ccp5_init+0x662/0x6a0 [ccp] [ 141.049000] ? devm_kmalloc+0x40/0xd0 [ 141.052688] ccp_dev_init+0xbb/0xf0 [ccp] [ 141.056732] ? __pci_set_master+0x56/0xd0 [ 141.060768] sp_init+0x70/0x90 [ccp] [ 141.064377] sp_pci_probe+0x186/0x1b0 [ccp] [ 141.068596] local_pci_probe+0x41/0x80 [ 141.072374] work_for_cpu_fn+0x16/0x20 [ 141.076145] process_one_work+0x1c8/0x380 [ 141.080181] worker_thread+0x1ab/0x380 [ 141.083953] ? __pfx_worker_thread+0x10/0x10 [ 141.088250] kthread+0xda/0x100 [ 141.091413] ? __pfx_kthread+0x10/0x10 [ 141.095185] ret_from_fork+0x2c/0x50 [ 141.098788] </TASK> [ 141.100996] kobject_add_internal failed for dma0chan0 with -EEXIST, don't try to register things with the same name in the same directory. [ 141.113703] ccp 0000:03:00.2: ccp initialization failed
The /dma/dma0chan0 sysfs file is not removed since dma_chan object has been released in ccp_dma_release() before releasing dma device. A correct procedure would be: release dma channels first => unregister dma device => release ccp dma object.
--- drivers/crypto/ccp/ccp-dmaengine.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/crypto/ccp/ccp-dmaengine.c +17 -4
@@ -643,14 +643,26 @@ static void ccp_dma_release(struct ccp_device *ccp) chan = ccp->ccp_dma_chan + i; dma_chan = &chan->dma_chan; -if (dma_chan->client_count) -dma_release_channel (dma_chan); -tasklet_kill (&chan->cleanup_tasklet);list_del_rcu (&dma_chan->device_node); } } +static void ccp_dma_release_channels (struct ccp_device *ccp) +{ +struct ccp_dma_chan *chan; +struct dma_chan *dma_chan; +unsigned int i; + +for (i =0 ; i < ccp->cmd_q_count; i++) { + chan = ccp->ccp_dma_chan + i; + dma_chan = &chan->dma_chan; + +if (dma_chan->client_count) +dma_release_channel (dma_chan); + } +} +int ccp_dmaengine_register (struct ccp_device *ccp) {struct ccp_dma_chan *chan;
@@ -771,8 +783,9 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp)if (!dmaengine)return ; -ccp_dma_release (ccp); +ccp_dma_release_channels (ccp);dma_async_device_unregister (dma_dev); +ccp_dma_release (ccp);kmem_cache_destroy (ccp->dma_desc_cache);kmem_cache_destroy (ccp->dma_cmd_cache);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 64/357 crypto: essiv - remove redundant null pointer check before kfree
In reply to Greg Kroah-HartmanFrom: Chen Wandun <[email protected]>
[ Upstream commit e18036da5c23530994faf7243b592e581f1efed2 ]
kfree has taken null pointer check into account. so it is safe to remove the unnecessary check.
Stable-dep-of: b5a772adf45a ("crypto: essiv - Handle EBUSY correctly")
--- crypto/essiv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
crypto/essiv.c +1 -2
@@ -188,8 +188,7 @@ static void essiv_aead_done(struct crypto_async_request *areq, int err)struct aead_request *req = areq->data;struct essiv_aead_request_ctx *rctx =aead_request_ctx (req); -if (rctx->assoc) -kfree (rctx->assoc); +kfree (rctx->assoc);aead_request_complete (req, err); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 65/357 crypto: essiv - Handle EBUSY correctly
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit b5a772adf45a32c68bef28e60621f12617161556 ]
As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request.
However, as the caller of essiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.
--- crypto/essiv.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
crypto/essiv.c +6 -1
@@ -188,7 +188,12 @@ static void essiv_aead_done(struct crypto_async_request *areq, int err)struct aead_request *req = areq->data;struct essiv_aead_request_ctx *rctx =aead_request_ctx (req); +if (err == -EINPROGRESS ) + goto out; +kfree (rctx->assoc); + +out:aead_request_complete (req, err); }
@@ -264,7 +269,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) err = enc ?crypto_aead_encrypt (subreq) :crypto_aead_decrypt (subreq); -if (rctx->assoc && err != -EINPROGRESS ) +if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY )kfree (rctx->assoc);return err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 66/357 crypto: seqiv - Handle EBUSY correctly
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 32e62025e5e52fbe4812ef044759de7010b15dbc ]
As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request.
However, as the caller of seqiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.
--- crypto/seqiv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/seqiv.c +1 -1
@@ -25,7 +25,7 @@ static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err)struct aead_request *subreq =aead_request_ctx (req);struct crypto_aead *geniv; -if (err == -EINPROGRESS ) +if (err == -EINPROGRESS || err == -EBUSY )return ;if (err)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 67/357 powercap: fix possible name leak in powercap_register_zone()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 1b6599f741a4525ca761ecde46e5885ff1e6ba58 ]
In the error path after calling dev_set_name(), the device name is leaked. To fix this, calling dev_set_name() before device_register(), and call put_device() if it returns error.
All the resources is released in powercap_release(), so it can return from powercap_register_zone() directly.
--- drivers/powercap/powercap_sys.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/powercap/powercap_sys.c +9 -5
@@ -530,9 +530,6 @@ struct powercap_zone *powercap_register_zone( power_zone->name =kstrdup (name,GFP_KERNEL );if (!power_zone->name) goto err_name_alloc; -dev_set_name (&power_zone->dev,"%s:%x" , -dev_name (power_zone->dev.parent), - power_zone->id); power_zone->constraints =kcalloc (nr_constraints,sizeof (*power_zone->constraints),GFP_KERNEL );
@@ -555,9 +552,16 @@ struct powercap_zone *powercap_register_zone( power_zone->dev_attr_groups[0 ] = &power_zone->dev_zone_attr_group; power_zone->dev_attr_groups[1 ] =NULL ; power_zone->dev.groups = power_zone->dev_attr_groups; +dev_set_name (&power_zone->dev,"%s:%x" , +dev_name (power_zone->dev.parent), + power_zone->id); result =device_register (&power_zone->dev); -if (result) - goto err_dev_ret; +if (result) { +put_device (&power_zone->dev); +mutex_unlock (&control_type->lock); + +return ERR_PTR (result); + } control_type->nr_zones++;mutex_unlock (&control_type->lock);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 68/357 net/mlx5: Enhance debug print in page allocation failure
In reply to Greg Kroah-HartmanFrom: Jack Morgenstein <[email protected]>
[ Upstream commit 7eef93003e5d20e1a6a6e59e12d914b5431cbda2 ]
Provide more details to aid debugging.
--- drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +2 -1
@@ -167,7 +167,8 @@ static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr) fp = list_entry(dev->priv.free_list.next, struct fw_page, list); n =find_first_bit (&fp->bitmask,8 *sizeof (fp->bitmask));if (n >=MLX5_NUM_4K_IN_PAGE ) { -mlx5_core_warn (dev,"alloc 4k bug\n" ); +mlx5_core_warn (dev,"alloc 4k bug: fw page = 0x%llx, n = %u, bitmask: %lu, max num of 4K pages: %d\n" , + fp->addr, n, fp->bitmask,MLX5_NUM_4K_IN_PAGE );return -ENOENT ; }clear_bit (n, &fp->bitmask);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 69/357 irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 071d068b89e95d1b078aa6bbcb9d0961b77d6aa1 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/irqchip/irq-alpine-msi.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-alpine-msi.c +1 -0
@@ -199,6 +199,7 @@ static int alpine_msix_init_domains(struct alpine_msix_data *priv, } gic_domain =irq_find_host (gic_node); +of_node_put (gic_node);if (!gic_domain) {pr_err ("Failed to find the GIC domain\n" );return -ENXIO ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 70/357 irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9419e700021a393f67be36abd0c4f3acc6139041 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/irqchip/irq-mvebu-gicp.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-mvebu-gicp.c +1 -0
@@ -223,6 +223,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev) } parent_domain =irq_find_host (irq_parent_dn); +of_node_put (irq_parent_dn);if (!parent_domain) {dev_err (&pdev->dev,"failed to find parent IRQ domain\n" );return -ENODEV ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 71/357 irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 02298b7bae12936ca313975b02e7f98b06670d37 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/irqchip/irq-ti-sci-intr.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-ti-sci-intr.c +1 -0
@@ -205,6 +205,7 @@ static int ti_sci_intr_irq_domain_probe(struct platform_device *pdev) } parent_domain =irq_find_host (parent_node); +of_node_put (parent_node);if (!parent_domain) {dev_err (dev,"Failed to find IRQ parent domain\n" );return -ENODEV ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 72/357 mptcp: add sk_stop_timer_sync helper
In reply to Greg Kroah-HartmanFrom: Geliang Tang <[email protected]>
[ Upstream commit 08b81d873126b413cda511b1ea1cbb0e99938bbd ]
This patch added a new helper sk_stop_timer_sync, it deactivates a timer like sk_stop_timer, but waits for the handler to finish.
Stable-dep-of: 584f3742890e ("net: add sock_init_data_uid()")
--- include/net/sock.h | 2 ++ net/core/sock.c | 7 +++++++ 2 files changed, 9 insertions(+)
include/net/sock.h +2 -0
@@ -2185,6 +2185,8 @@ void sk_reset_timer(struct sock *sk, struct timer_list *timer,void sk_stop_timer (struct sock *sk,struct timer_list *timer); +void sk_stop_timer_sync (struct sock *sk,struct timer_list *timer); + int __sk_queue_drop_skb(struct sock *sk, struct sk_buff_head *sk_queue, struct sk_buff *skb, unsigned int flags, void (*destructor)(struct sock *sk,
net/core/sock.c +7 -0
@@ -2882,6 +2882,13 @@ void sk_stop_timer(struct sock *sk, struct timer_list* timer) }EXPORT_SYMBOL (sk_stop_timer); +void sk_stop_timer_sync (struct sock *sk,struct timer_list *timer) +{ +if (del_timer_sync (timer)) +__sock_put (sk); +} +EXPORT_SYMBOL (sk_stop_timer_sync); +void sock_init_data (struct socket *sock,struct sock *sk) {sk_init_common (sk);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 73/357 net: add sock_init_data_uid()
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 584f3742890e966d2f0a1f3c418c9ead70b2d99e ]
Add sock_init_data_uid() to explicitly initialize the socket uid. To initialise the socket uid, sock_init_data() assumes a the struct socket* sock is always embedded in a struct socket_alloc, used to access the corresponding inode uid. This may not be true. Examples are sockets created in tun_chr_open() and tap_open().
--- include/net/sock.h | 7 ++++++- net/core/sock.c | 15 ++++++++++++--- 2 files changed, 18 insertions(+), 4 deletions(-)
include/net/sock.h +6 -1
@@ -1706,7 +1706,12 @@ void sk_common_release(struct sock *sk);* Default socket callbacks and setup code */ -/* Initialise core socket variables */ +/* Initialise core socket variables using an explicit uid. */ +void sock_init_data_uid (struct socket *sock,struct sock *sk,kuid_t uid); + +/* Initialise core socket variables. +* Assumes struct socket *sock is embedded in a struct socket_alloc. +*/ void sock_init_data (struct socket *sock,struct sock *sk);/*
net/core/sock.c +12 -3
@@ -2889,7 +2889,7 @@ void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer) }EXPORT_SYMBOL (sk_stop_timer_sync); -void sock_init_data (struct socket *sock,struct sock *sk) +void sock_init_data_uid (struct socket *sock,struct sock *sk,kuid_t uid) {sk_init_common (sk); sk->sk_send_head =NULL ;
@@ -2908,11 +2908,10 @@ void sock_init_data(struct socket *sock, struct sock *sk) sk->sk_type = sock->type;RCU_INIT_POINTER (sk->sk_wq, &sock->wq); sock->sk = sk; - sk->sk_uid =SOCK_INODE (sock)->i_uid; }else {RCU_INIT_POINTER (sk->sk_wq,NULL ); - sk->sk_uid =make_kuid (sock_net (sk)->user_ns,0 ); } + sk->sk_uid = uid;rwlock_init (&sk->sk_callback_lock);if (sk->sk_kern_sock)
@@ -2970,6 +2969,16 @@ void sock_init_data(struct socket *sock, struct sock *sk)refcount_set (&sk->sk_refcnt,1 );atomic_set (&sk->sk_drops,0 ); } +EXPORT_SYMBOL (sock_init_data_uid); + +void sock_init_data (struct socket *sock,struct sock *sk) +{ +kuid_t uid = sock ? +SOCK_INODE (sock)->i_uid : +make_kuid (sock_net (sk)->user_ns,0 ); + +sock_init_data_uid (sock, sk, uid); +}EXPORT_SYMBOL (sock_init_data);void lock_sock_nested (struct sock *sk,int subclass)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 74/357 tun: tun_chr_open(): correctly initialize socket uid
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit a096ccca6e503a5c575717ff8a36ace27510ab0a ]
sock_init_data() assumes that the struct socket passed in input is contained in a struct socket_alloc allocated with sock_alloc(). However, tun_chr_open() passes a struct socket embedded in a struct tun_file allocated with sk_alloc().
This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the struct sock in input.
On default configuration, the type confused field overlaps with the high 4 bytes of struct tun_struct __rcu *tun of struct tun_file, NULL at the time of call, which makes the uid of all tun sockets 0, i.e., the root one.
Fix the assignment by using sock_init_data_uid().
--- drivers/net/tun.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/tun.c +1 -1
@@ -3525,7 +3525,7 @@ static int tun_chr_open(struct inode *inode, struct file * file) tfile->socket.file = file; tfile->socket.ops = &tun_socket_ops; -sock_init_data (&tfile->socket, &tfile->sk); +sock_init_data_uid (&tfile->socket, &tfile->sk, inode->i_uid); tfile->sk.sk_write_space = tun_sock_write_space; tfile->sk.sk_sndbuf =INT_MAX ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 75/357 tap: tap_open(): correctly initialize socket uid
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 66b2c338adce580dfce2199591e65e2bab889cff ]
sock_init_data() assumes that the struct socket passed in input is contained in a struct socket_alloc allocated with sock_alloc(). However, tap_open() passes a struct socket embedded in a struct tap_queue allocated with sk_alloc().
This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the struct sock in input.
On default configuration, the type confused field overlaps with padding bytes between int vnet_hdr_sz and struct tap_dev __rcu *tap in struct tap_queue, which makes the uid of all tap sockets 0, i.e., the root one.
Fix the assignment by using sock_init_data_uid().
--- drivers/net/tap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/tap.c +1 -1
@@ -525,7 +525,7 @@ static int tap_open(struct inode *inode, struct file *file) q->sock.state =SS_CONNECTED ; q->sock.file = file; q->sock.ops = &tap_socket_ops; -sock_init_data (&q->sock, &q->sk); +sock_init_data_uid (&q->sock, &q->sk, inode->i_uid); q->sk.sk_write_space = tap_sock_write_space; q->sk.sk_destruct = tap_sock_destruct; q->flags =IFF_VNET_HDR |IFF_NO_PI |IFF_TAP ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 76/357 OPP: fix error checking in opp_migrate_dentry()
In reply to Greg Kroah-HartmanFrom: Qi Zheng <[email protected]>
[ Upstream commit eca4c0eea53432ec4b711b2a8ad282cbad231b4f ]
Since commit ff9fb72bc077 ("debugfs: return error values, not NULL") changed return value of debugfs_rename() in error cases from %NULL to %ERR_PTR(-ERROR), we should also check error values instead of NULL.
--- drivers/opp/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/opp/debugfs.c +1 -1
@@ -162,7 +162,7 @@ static void opp_migrate_dentry(struct opp_device *opp_dev, dentry =debugfs_rename (rootdir, opp_dev->dentry, rootdir, opp_table->dentry_name); -if (!dentry) { +if (IS_ERR (dentry)) {dev_err (dev,"%s: Failed to rename link from: %s to %s\n" , __func__,dev_name (opp_dev->dev),dev_name (dev));return ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 77/357 Bluetooth: L2CAP: Fix potential user-after-free
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit df5703348813235874d851934e957c3723d71644 ]
This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which makes it possible that the chan is disconnected in the meantime.
--- net/bluetooth/l2cap_core.c | 24 ------------------------ net/bluetooth/l2cap_sock.c | 8 ++++++++ 2 files changed, 8 insertions(+), 24 deletions(-)
net/bluetooth/l2cap_core.c +0 -24
@@ -2526,14 +2526,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)if (IS_ERR (skb))return PTR_ERR (skb); -/* Channel lock is released before requesting new skb and then -* reacquired thus we need to recheck channel state. -*/ -if (chan->state !=BT_CONNECTED ) { -kfree_skb (skb); -return -ENOTCONN ; - } -l2cap_do_send (chan, skb);return len; }
@@ -2577,14 +2569,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)if (IS_ERR (skb))return PTR_ERR (skb); -/* Channel lock is released before requesting new skb and then -* reacquired thus we need to recheck channel state. -*/ -if (chan->state !=BT_CONNECTED ) { -kfree_skb (skb); -return -ENOTCONN ; - } -l2cap_do_send (chan, skb); err = len;break ;
@@ -2605,14 +2589,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)*/ err =l2cap_segment_sdu (chan, &seg_queue, msg, len); -/* The channel could have been closed while segmenting, -* check that it is still connected. -*/ -if (chan->state !=BT_CONNECTED ) { -__skb_queue_purge (&seg_queue); - err = -ENOTCONN ; - } -if (err)break ;
net/bluetooth/l2cap_sock.c +8 -0
@@ -1433,6 +1433,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,if (!skb)return ERR_PTR (err); +/* Channel lock is released before requesting new skb and then +* reacquired thus we need to recheck channel state. +*/ +if (chan->state !=BT_CONNECTED ) { +kfree_skb (skb); +return ERR_PTR (-ENOTCONN ); + } + skb->priority = sk->sk_priority;bt_cb (skb)->l2cap.chan = chan;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 78/357 libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
[ Upstream commit 17bcd27a08a21397698edf143084d7c87ce17946 ]
The code assumes that everything that comes after nlmsgerr are nlattrs. When calculating their size, it does not account for the initial nlmsghdr. This may lead to accessing uninitialized memory.
--- tools/lib/bpf/nlattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/nlattr.c +1 -1
@@ -177,7 +177,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh) hlen +=nlmsg_len (&err->msg); attr = (struct nlattr *) ((void *) err + hlen); - alen = nlh->nlmsg_len - hlen; + alen = (void *)nlh + nlh->nlmsg_len - (void *)attr;if (libbpf_nla_parse (tb,NLMSGERR_ATTR_MAX , attr, alen, extack_policy) !=0 ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 79/357 rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 68762148d1b011d47bc2ceed7321739b5aea1e63 ]
rds_rm_zerocopy_callback() uses list_add_tail() with swapped arguments. This links the list head with the new entry, losing the references to the remaining part of the list.
--- net/rds/message.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/message.c +1 -1
@@ -118,7 +118,7 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs, ck = &info->zcookies;memset (ck,0 ,sizeof (*ck));WARN_ON (!rds_zcookie_add (info, cookie)); -list_add_tail (&q->zcookie_head, &info->rs_zcookie_next); +list_add_tail (&info->rs_zcookie_next, &q->zcookie_head);spin_unlock_irqrestore (&q->lock, flags);/* caller invokes rds_wake_sk_sleep() */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 80/357 crypto: rsa-pkcs1pad - Use akcipher_request_complete
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 ]
Use the akcipher_request_complete helper instead of calling the completion function directly. In fact the previous code was buggy in that EINPROGRESS was never passed back to the original caller.
--- crypto/rsa-pkcs1pad.c | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-)
crypto/rsa-pkcs1pad.c +15 -19
@@ -213,16 +213,14 @@ static void pkcs1pad_encrypt_sign_complete_cb( struct crypto_async_request *child_async_req, int err) {struct akcipher_request *req = child_async_req->data; -struct crypto_async_request async_req;if (err == -EINPROGRESS ) -return ; + goto out; + + err =pkcs1pad_encrypt_sign_complete (req, err); - async_req.data = req->base.data; - async_req.tfm =crypto_akcipher_tfm (crypto_akcipher_reqtfm (req)); - async_req.flags = child_async_req->flags; - req->base.complete (&async_req, -pkcs1pad_encrypt_sign_complete (req, err)); +out: +akcipher_request_complete (req, err); }static int pkcs1pad_encrypt (struct akcipher_request *req)
@@ -331,15 +329,14 @@ static void pkcs1pad_decrypt_complete_cb( struct crypto_async_request *child_async_req, int err) {struct akcipher_request *req = child_async_req->data; -struct crypto_async_request async_req;if (err == -EINPROGRESS ) -return ; + goto out; + + err =pkcs1pad_decrypt_complete (req, err); - async_req.data = req->base.data; - async_req.tfm =crypto_akcipher_tfm (crypto_akcipher_reqtfm (req)); - async_req.flags = child_async_req->flags; - req->base.complete (&async_req,pkcs1pad_decrypt_complete (req, err)); +out: +akcipher_request_complete (req, err); }static int pkcs1pad_decrypt (struct akcipher_request *req)
@@ -511,15 +508,14 @@ static void pkcs1pad_verify_complete_cb( struct crypto_async_request *child_async_req, int err) {struct akcipher_request *req = child_async_req->data; -struct crypto_async_request async_req;if (err == -EINPROGRESS ) -return ; + goto out; - async_req.data = req->base.data; - async_req.tfm =crypto_akcipher_tfm (crypto_akcipher_reqtfm (req)); - async_req.flags = child_async_req->flags; - req->base.complete (&async_req,pkcs1pad_verify_complete (req, err)); + err =pkcs1pad_verify_complete (req, err); + +out: +akcipher_request_complete (req, err); }/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 81/357 m68k: /proc/hardware should depend on PROC_FS
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 1e5b5df65af99013b4d31607ddb3ca5731dbe44d ]
When CONFIG_PROC_FS is not set, there is a build error for an unused function. Make PROC_HARDWARE depend on PROC_FS to prevent this error.
In file included from ../arch/m68k/kernel/setup.c:3:../arch/m68k/kernel/setup_mm.c:477:12: error: 'hardware_proc_show' defined but not used [-Werror=unused-function]
477 | static int hardware_proc_show(struct seq_file *m, void *v)
| ^~~~~~~~~~~~~~~~~~
--- arch/m68k/Kconfig.devices | 1 + 1 file changed, 1 insertion(+)
arch/m68k/Kconfig.devices +1 -0
@@ -19,6 +19,7 @@ config HEARTBEAT # We have a dedicated heartbeat LED. :-) config PROC_HARDWARE bool "/proc/hardware support" + depends on PROC_FS help Say Y here to support the /proc/hardware file, which gives you access to information about the machine you're running on,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 82/357 RISC-V: time: initialize hrtimer based broadcast clock event device
In reply to Greg Kroah-HartmanFrom: Conor Dooley <[email protected]>
[ Upstream commit 8b3b8fbb4896984b5564789a42240e4b3caddb61 ]
Similarly to commit 022eb8ae8b5e ("ARM: 8938/1: kernel: initialize broadcast hrtimer based clock event device"), RISC-V needs to initiate hrtimer based broadcast clock event device before C3STOP can be used. Otherwise, the introduction of C3STOP for the RISC-V arch timer in commit 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend") leaves us without any broadcast timer registered. This prevents the kernel from entering oneshot mode, which breaks timer behaviour, for example clock_nanosleep().
A test app that sleeps each cpu for 6, 5, 4, 3 ms respectively, HZ=250 & C3STOP enabled, the sleep times are rounded up to the next jiffy:
== CPU: 1 == == CPU: 2 == == CPU: 3 == == CPU: 4 == Mean: 7.974992 Mean: 7.976534 Mean: 7.962591 Mean: 3.952179
Std Dev: 0.154374 Std Dev: 0.156082 Std Dev: 0.171018 Std Dev: 0.076193
Hi: 9.472000 Hi: 10.495000 Hi: 8.864000 Hi: 4.736000
Lo: 6.087000 Lo: 6.380000 Lo: 4.872000 Lo: 3.403000
Samples: 521 Samples: 521 Samples: 521 Samples: 521
--- arch/riscv/kernel/time.c | 3 +++ 1 file changed, 3 insertions(+)
arch/riscv/kernel/time.c +3 -0
@@ -5,6 +5,7 @@*/ #include <linux/of_clk.h> +#include <linux/clockchips.h> #include <linux/clocksource.h> #include <linux/delay.h> #include <asm/sbi.h>
@@ -28,4 +29,6 @@ void __init time_init(void)of_clk_init (NULL );timer_probe (); + +tick_setup_hrtimer_broadcast (); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 83/357 usb: gadget: udc: Avoid tasklet passing a global
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit f9dc3713df1229aa8168169e9cf1010fbac68de5 ]
There's no reason for the tasklet callback to set an argument since it always uses a global. Instead, use the global directly, in preparation for converting the tasklet subsystem to modern callback conventions.
Stable-dep-of: 1fdeb8b9f29d ("wifi: iwl3945: Add missing check for create_singlethread_workqueue")
--- drivers/usb/gadget/udc/snps_udc_core.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/usb/gadget/udc/snps_udc_core.c +2 -4
@@ -96,9 +96,7 @@ static int stop_pollstall_timer;static DECLARE_COMPLETION (on_pollstall_exit);/* tasklet for usb disconnect */ -static DECLARE_TASKLET(disconnect_tasklet, udc_tasklet_disconnect, - (unsigned long) &udc); - +static DECLARE_TASKLET(disconnect_tasklet, udc_tasklet_disconnect, 0);/* endpoint names used for print */ static const char ep0_string[] ="ep0in" ;
@@ -1661,7 +1659,7 @@ static void usb_disconnect(struct udc *dev)/* Tasklet for disconnect to be outside of interrupt context */ static void udc_tasklet_disconnect (unsigned long par) { -struct udc *dev = (struct udc *)(*((struct udc **) par)); +struct udc *dev = udc;u32 tmp;DBG (dev,"Tasklet disconnect\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 84/357 treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit b13fecb1c3a603c4b8e99b306fecf4f668c11b32 ]
This converts all the existing DECLARE_TASKLET() (and ...DISABLED) macros with DECLARE_TASKLET_OLD() in preparation for refactoring the tasklet callback type. All existing DECLARE_TASKLET() users had a "0" data argument, it has been removed here as well.
Stable-dep-of: 1fdeb8b9f29d ("wifi: iwl3945: Add missing check for create_singlethread_workqueue")
--- drivers/input/keyboard/omap-keypad.c | 2 +- drivers/input/serio/hil_mlc.c | 2 +- drivers/net/wan/farsync.c | 4 ++-- drivers/s390/crypto/ap_bus.c | 2 +- drivers/staging/most/dim2/dim2.c | 2 +- drivers/staging/octeon/ethernet-tx.c | 2 +- drivers/tty/vt/keyboard.c | 2 +- drivers/usb/gadget/udc/snps_udc_core.c | 2 +- drivers/usb/host/fhci-sched.c | 2 +- include/linux/interrupt.h | 15 ++++++++++----- kernel/backtracetest.c | 2 +- kernel/debug/debug_core.c | 2 +- kernel/irq/resend.c | 2 +- net/atm/pppoatm.c | 2 +- net/iucv/iucv.c | 2 +- sound/drivers/pcsp/pcsp_lib.c | 2 +- 16 files changed, 26 insertions(+), 21 deletions(-)
drivers/input/keyboard/omap-keypad.c +1 -1
@@ -46,7 +46,7 @@ struct omap_kp {unsigned short keymap[]; }; -static DECLARE_TASKLET_DISABLED(kp_tasklet, omap_kp_tasklet, 0); +static DECLARE_TASKLET_DISABLED_OLD(kp_tasklet, omap_kp_tasklet);static unsigned int *row_gpios;static unsigned int *col_gpios;
drivers/input/serio/hil_mlc.c +1 -1
@@ -77,7 +77,7 @@ static struct timer_list hil_mlcs_kicker;static int hil_mlcs_probe, hil_mlc_stop;static void hil_mlcs_process (unsigned long unused); -static DECLARE_TASKLET_DISABLED(hil_mlcs_tasklet, hil_mlcs_process, 0); +static DECLARE_TASKLET_DISABLED_OLD(hil_mlcs_tasklet, hil_mlcs_process);/* #define HIL_MLC_DEBUG */
drivers/net/wan/farsync.c +2 -2
@@ -569,8 +569,8 @@ static void do_bottom_half_rx(struct fst_card_info *card);static void fst_process_tx_work_q (unsigned long work_q);static void fst_process_int_work_q (unsigned long work_q); -static DECLARE_TASKLET(fst_tx_task, fst_process_tx_work_q, 0); -static DECLARE_TASKLET(fst_int_task, fst_process_int_work_q, 0); +static DECLARE_TASKLET_OLD(fst_tx_task, fst_process_tx_work_q); +static DECLARE_TASKLET_OLD(fst_int_task, fst_process_int_work_q);static struct fst_card_info *fst_card_array[FST_MAX_CARDS ];static spinlock_t fst_work_q_lock;
drivers/s390/crypto/ap_bus.c +1 -1
@@ -91,7 +91,7 @@ static DECLARE_WORK(ap_scan_work, ap_scan_bus);* Tasklet & timer for AP request polling and interrupts */ static void ap_tasklet_fn (unsigned long ); -static DECLARE_TASKLET(ap_tasklet, ap_tasklet_fn, 0); +static DECLARE_TASKLET_OLD(ap_tasklet, ap_tasklet_fn);static DECLARE_WAIT_QUEUE_HEAD (ap_poll_wait);static struct task_struct *ap_poll_kthread;static DEFINE_MUTEX (ap_poll_thread_mutex);
drivers/staging/most/dim2/dim2.c +1 -1
@@ -47,7 +47,7 @@ MODULE_PARM_DESC(fcnt, "Num of frames per sub-buffer for sync channels as a powestatic DEFINE_SPINLOCK (dim_lock);static void dim2_tasklet_fn (unsigned long data); -static DECLARE_TASKLET(dim2_tasklet, dim2_tasklet_fn, 0); +static DECLARE_TASKLET_OLD(dim2_tasklet, dim2_tasklet_fn);/** * struct hdm_channel - private structure to keep channel specific data
drivers/staging/octeon/ethernet-tx.c +1 -1
@@ -41,7 +41,7 @@#endif static void cvm_oct_tx_do_cleanup (unsigned long arg); -static DECLARE_TASKLET(cvm_oct_tx_cleanup_tasklet, cvm_oct_tx_do_cleanup, 0); +static DECLARE_TASKLET_OLD(cvm_oct_tx_cleanup_tasklet, cvm_oct_tx_do_cleanup);/* Maximum number of SKBs to try to free per xmit packet. */ #define MAX_SKB_TO_FREE (MAX_OUT_QUEUE_DEPTH * 2)
drivers/tty/vt/keyboard.c +1 -1
@@ -1241,7 +1241,7 @@ static void kbd_bh(unsigned long dummy) } } -DECLARE_TASKLET_DISABLED (keyboard_tasklet, kbd_bh,0 ); +DECLARE_TASKLET_DISABLED_OLD (keyboard_tasklet, kbd_bh); #if defined(CONFIG_X86) || defined(CONFIG_IA64) || defined(CONFIG_ALPHA) ||\ defined(CONFIG_MIPS) || defined(CONFIG_PPC) || defined(CONFIG_SPARC) ||\
drivers/usb/gadget/udc/snps_udc_core.c +1 -1
@@ -96,7 +96,7 @@ static int stop_pollstall_timer;static DECLARE_COMPLETION (on_pollstall_exit);/* tasklet for usb disconnect */ -static DECLARE_TASKLET(disconnect_tasklet, udc_tasklet_disconnect, 0); +static DECLARE_TASKLET_OLD(disconnect_tasklet, udc_tasklet_disconnect);/* endpoint names used for print */ static const char ep0_string[] ="ep0in" ;
drivers/usb/host/fhci-sched.c +1 -1
@@ -677,7 +677,7 @@ static void process_done_list(unsigned long data)enable_irq (fhci_to_hcd (fhci)->irq); } -DECLARE_TASKLET (fhci_tasklet, process_done_list,0 ); +DECLARE_TASKLET_OLD (fhci_tasklet, process_done_list);/* transfer complted callback */ u32 fhci_transfer_confirm_callback (struct fhci_hcd *fhci)
include/linux/interrupt.h +10 -5
@@ -598,12 +598,17 @@ struct tasklet_structunsigned long data; }; -#define DECLARE_TASKLET (name, func, data) \ -struct tasklet_struct name = { NULL, 0, ATOMIC_INIT(0), func, data } - -#define DECLARE_TASKLET_DISABLED (name, func, data) \ -struct tasklet_struct name = { NULL, 0, ATOMIC_INIT(1), func, data } +#define DECLARE_TASKLET_OLD (name, _func) \ +struct tasklet_struct name = { \ + .count = ATOMIC_INIT(0), \ + .func = _func, \ +} +#define DECLARE_TASKLET_DISABLED_OLD (name, _func) \ +struct tasklet_struct name = { \ + .count = ATOMIC_INIT(1), \ + .func = _func, \ +}enum {
kernel/backtracetest.c +1 -1
@@ -29,7 +29,7 @@ static void backtrace_test_irq_callback(unsigned long data)complete (&backtrace_work); } -static DECLARE_TASKLET(backtrace_tasklet, &backtrace_test_irq_callback, 0); +static DECLARE_TASKLET_OLD(backtrace_tasklet, &backtrace_test_irq_callback);static void backtrace_test_irq (void ) {
kernel/debug/debug_core.c +1 -1
@@ -1043,7 +1043,7 @@ static void kgdb_tasklet_bpt(unsigned long ing)atomic_set (&kgdb_break_tasklet_var,0 ); } -static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0); +static DECLARE_TASKLET_OLD(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt);void kgdb_schedule_breakpoint (void ) {
kernel/irq/resend.c +1 -1
@@ -45,7 +45,7 @@ static void resend_irqs(unsigned long arg) }/* Tasklet to handle resend: */ -static DECLARE_TASKLET(resend_tasklet, resend_irqs, 0); +static DECLARE_TASKLET_OLD(resend_tasklet, resend_irqs);#endif
net/atm/pppoatm.c +1 -1
@@ -393,7 +393,7 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg)* Each PPPoATM instance has its own tasklet - this is just a * prototypical one used to initialize them */ - static const DECLARE_TASKLET(tasklet_proto, pppoatm_wakeup_sender, 0); + static const DECLARE_TASKLET_OLD(tasklet_proto, pppoatm_wakeup_sender);if (copy_from_user (&be, arg,sizeof be))return -EFAULT ; if (be.encaps != PPPOATM_ENCAPS_AUTODETECT &&
net/iucv/iucv.c +1 -1
@@ -128,7 +128,7 @@ static LIST_HEAD(iucv_task_queue);* The tasklet for fast delivery of iucv interrupts. */ static void iucv_tasklet_fn (unsigned long ); -static DECLARE_TASKLET(iucv_tasklet, iucv_tasklet_fn,0); +static DECLARE_TASKLET_OLD(iucv_tasklet, iucv_tasklet_fn);/* * Queue of interrupt buffers for delivery via a work queue
sound/drivers/pcsp/pcsp_lib.c +1 -1
@@ -36,7 +36,7 @@ static void pcsp_call_pcm_elapsed(unsigned long priv) } } -static DECLARE_TASKLET(pcsp_pcm_tasklet, pcsp_call_pcm_elapsed, 0); +static DECLARE_TASKLET_OLD(pcsp_pcm_tasklet, pcsp_call_pcm_elapsed);/* write the port and returns the next expire time in ns; * called at the trigger-start and in hrtimer callback
Signature · 1 line
2.39.2
Re: [PATCH 5.4 084/357] treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
Quoted 9 lines · Greg Kroah-Hartman
From: Kees Cook <[email protected]>
[ Upstream commit
b13fecb1c3a603c4b8e99b306fecf4f668c11b32]This converts all the existing
DECLARE_TASKLET()(and ...DISABLED) macros withDECLARE_TASKLET_OLD()in preparation for refactoring the tasklet callback type. All existingDECLARE_TASKLET()users had a "0" data argument, it has been removed here as well.
Quoted 6 lines
Reviewed-by Greg Kroah-Hartman <[email protected]>Acked-by Thomas Gleixner <[email protected]>Signed-off-by Kees Cook <[email protected]>Stable-dep-of:
1fdeb8b9f29d("wifi: iwl3945: Add missing check forcreate_singlethread_workqueue")Signed-off-by Sasha Levin <[email protected]>---
I noticed kernelci.org bot (5.4) reports:
Build Failures Detected:
mips:
ip27_defconfig: (gcc-10) FAIL
ip28_defconfig: (gcc-10) FAIL
lasat_defconfig: (gcc-10) FAIL
Errors summary:
1 arch/mips/lasat/picvue_proc.c:87:20: error: ‘pvc_display_tasklet’ undeclared (first use in this function)
1 arch/mips/lasat/picvue_proc.c:42:44: error: expected ‘)’ before ‘&’ token
1 arch/mips/lasat/picvue_proc.c:33:13: error: ‘pvc_display’ defined but not used [-Werror=unused-function]
Here's what I found...
this backport to 5.4.y of:b13fecb1c3a6 ("treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()") changed all locations of DECLARE_TASKLET with DECLARE_TASKLET_OLD, except one, in arch/mips/lasat/pcivue_proc.c.
This is due to:10760dde9be3 ("MIPS: Remove support for LASAT") preceeding b13fecb1c3a6 ("treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()") upstream and the former not being present in 5.4.y.
I rolled a revert/re-apply with fixes in the attached mbox, however maybe just a revert makes more sense? Up to you.
I have yet to try building this on mips, just did this by inspection.
Regards,
--Tom
Greg Kroah-Hartman
maintainerRe: [PATCH 5.4 084/357] treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
Quoted 45 lines · Tom Saeger
Quoted 9 lines · Greg Kroah-Hartman
From: Kees Cook <[email protected]>
[ Upstream commit
b13fecb1c3a603c4b8e99b306fecf4f668c11b32]This converts all the existing
DECLARE_TASKLET()(and ...DISABLED) macros withDECLARE_TASKLET_OLD()in preparation for refactoring the tasklet callback type. All existingDECLARE_TASKLET()users had a "0" data argument, it has been removed here as well.Quoted 6 lines
Reviewed-by Greg Kroah-Hartman <[email protected]>Acked-by Thomas Gleixner <[email protected]>Signed-off-by Kees Cook <[email protected]>Stable-dep-of:
1fdeb8b9f29d("wifi: iwl3945: Add missing check forcreate_singlethread_workqueue")Signed-off-by Sasha Levin <[email protected]>---
I noticed kernelci.org bot (5.4) reports:
Build Failures Detected:
mips:
ip27_defconfig: (gcc-10) FAIL
ip28_defconfig: (gcc-10) FAIL
lasat_defconfig: (gcc-10) FAILErrors summary:
1
arch/mips/lasat/picvue_proc.c:87:20: error: ‘pvc_display_tasklet’ undeclared (first use in this function)
1arch/mips/lasat/picvue_proc.c:42:44: error: expected ‘)’ before ‘&’ token
1arch/mips/lasat/picvue_proc.c:33:13: error: ‘pvc_display’ defined but not used [-Werror=unused-function]Here's what I found...
this backport to 5.4.y of:b13fecb1c3a6("treewide: ReplaceDECLARE_TASKLET()withDECLARE_TASKLET_OLD()") changed all locations ofDECLARE_TASKLETwithDECLARE_TASKLET_OLD, except one, inarch/mips/lasat/pcivue_proc.c.This is due to:
10760dde9be3("MIPS: Remove support for LASAT") preceedingb13fecb1c3a6("treewide: ReplaceDECLARE_TASKLET()withDECLARE_TASKLET_OLD()") upstream and the former not being present in 5.4.y.
Quoted 4 lines
I rolled a revert/re-apply with fixes in the attached mbox, however maybe just a revert makes more sense? Up to you.
I have yet to try building this on mips, just did this by inspection.
I've taken your patches, let's see how that works...
thanks!
greg k-h
Re: [PATCH 5.4 084/357] treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
Quoted 46 lines · Greg Kroah-Hartman
Quoted 45 lines · Tom Saeger
Quoted 9 lines · Greg Kroah-Hartman
From: Kees Cook <[email protected]>
[ Upstream commit
b13fecb1c3a603c4b8e99b306fecf4f668c11b32]This converts all the existing
DECLARE_TASKLET()(and ...DISABLED) macros withDECLARE_TASKLET_OLD()in preparation for refactoring the tasklet callback type. All existingDECLARE_TASKLET()users had a "0" data argument, it has been removed here as well.Quoted 6 lines
Reviewed-by Greg Kroah-Hartman <[email protected]>Acked-by Thomas Gleixner <[email protected]>Signed-off-by Kees Cook <[email protected]>Stable-dep-of:
1fdeb8b9f29d("wifi: iwl3945: Add missing check forcreate_singlethread_workqueue")Signed-off-by Sasha Levin <[email protected]>---
I noticed kernelci.org bot (5.4) reports:
Build Failures Detected:
mips:
ip27_defconfig: (gcc-10) FAIL
ip28_defconfig: (gcc-10) FAIL
lasat_defconfig: (gcc-10) FAILErrors summary:
1
arch/mips/lasat/picvue_proc.c:87:20: error: ‘pvc_display_tasklet’ undeclared (first use in this function)
1arch/mips/lasat/picvue_proc.c:42:44: error: expected ‘)’ before ‘&’ token
1arch/mips/lasat/picvue_proc.c:33:13: error: ‘pvc_display’ defined but not used [-Werror=unused-function]Here's what I found...
this backport to 5.4.y of:b13fecb1c3a6("treewide: ReplaceDECLARE_TASKLET()withDECLARE_TASKLET_OLD()") changed all locations ofDECLARE_TASKLETwithDECLARE_TASKLET_OLD, except one, inarch/mips/lasat/pcivue_proc.c.This is due to:
10760dde9be3("MIPS: Remove support for LASAT") preceedingb13fecb1c3a6("treewide: ReplaceDECLARE_TASKLET()withDECLARE_TASKLET_OLD()") upstream and the former not being present in 5.4.y.
Quoted 7 lines
Quoted 4 lines
I rolled a revert/re-apply with fixes in the attached mbox, however maybe just a revert makes more sense? Up to you.
I have yet to try building this on mips, just did this by inspection.
I've taken your patches, let's see how that works...
Ugh, It didn't go well. I now see a problem. The change to DECLARE_TASKLET_OLD also removed the last parameter. I missed that. I'll spin-up a mips build.
--Tom
Re: [PATCH 5.4 084/357] treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
Quoted 50 lines · Tom Saeger
Quoted 49 lines · Greg Kroah-Hartman
Quoted 48 lines · Tom Saeger
Quoted 9 lines · Greg Kroah-Hartman
From: Kees Cook <[email protected]>
[ Upstream commit
b13fecb1c3a603c4b8e99b306fecf4f668c11b32]This converts all the existing
DECLARE_TASKLET()(and ...DISABLED) macros withDECLARE_TASKLET_OLD()in preparation for refactoring the tasklet callback type. All existingDECLARE_TASKLET()users had a "0" data argument, it has been removed here as well.Quoted 6 lines
Reviewed-by Greg Kroah-Hartman <[email protected]>Acked-by Thomas Gleixner <[email protected]>Signed-off-by Kees Cook <[email protected]>Stable-dep-of:
1fdeb8b9f29d("wifi: iwl3945: Add missing check forcreate_singlethread_workqueue")Signed-off-by Sasha Levin <[email protected]>---
I noticed kernelci.org bot (5.4) reports:
Build Failures Detected:
mips:
ip27_defconfig: (gcc-10) FAIL
ip28_defconfig: (gcc-10) FAIL
lasat_defconfig: (gcc-10) FAILErrors summary:
1
arch/mips/lasat/picvue_proc.c:87:20: error: ‘pvc_display_tasklet’ undeclared (first use in this function)
1arch/mips/lasat/picvue_proc.c:42:44: error: expected ‘)’ before ‘&’ token
1arch/mips/lasat/picvue_proc.c:33:13: error: ‘pvc_display’ defined but not used [-Werror=unused-function]Here's what I found...
this backport to 5.4.y of:b13fecb1c3a6("treewide: ReplaceDECLARE_TASKLET()withDECLARE_TASKLET_OLD()") changed all locations ofDECLARE_TASKLETwithDECLARE_TASKLET_OLD, except one, inarch/mips/lasat/pcivue_proc.c.This is due to:
10760dde9be3("MIPS: Remove support for LASAT") preceedingb13fecb1c3a6("treewide: ReplaceDECLARE_TASKLET()withDECLARE_TASKLET_OLD()") upstream and the former not being present in 5.4.y.I rolled a revert/re-apply with fixes in the attached mbox, however maybe just a revert makes more sense? Up to you.
Quoted 8 lines
Quoted 4 lines
Quoted 1 line
I have yet to try building this on mips, just did this by inspection.
I've taken your patches, let's see how that works...
Ugh, It didn't go well. I now see a problem. The change to
DECLARE_TASKLET_OLDalso removed the last parameter. I missed that. I'll spin-up a mips build.
I've now confirmed locally with gcc-10 mips build of lasat_defconfig
fixup patch should be:
arch/mips/lasat/picvue_proc.c +1 -1
@@ -39,7 +39,7 @@ static void pvc_display(unsigned long data)pvc_write_string (pvc_lines[i],0 , i); } -static DECLARE_TASKLET(pvc_display_tasklet, &pvc_display, 0); +static DECLARE_TASKLET_OLD(pvc_display_tasklet, &pvc_display);static int pvc_line_proc_show (struct seq_file *m,void *v) {
Attached is a reflow of these two patches.
--Tom
Daniel Díaz
Tested-by Linux Kernel Functional TestingRe: [PATCH 5.4 084/357] treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
Hello!
Quoted 81 lines · Tom Saeger
Quoted 50 lines · Tom Saeger
Quoted 49 lines · Greg Kroah-Hartman
Quoted 48 lines · Tom Saeger
Quoted 9 lines · Greg Kroah-Hartman
From: Kees Cook <[email protected]>
[ Upstream commit
b13fecb1c3a603c4b8e99b306fecf4f668c11b32]This converts all the existing
DECLARE_TASKLET()(and ...DISABLED) macros withDECLARE_TASKLET_OLD()in preparation for refactoring the tasklet callback type. All existingDECLARE_TASKLET()users had a "0" data argument, it has been removed here as well.Quoted 6 lines
Reviewed-by Greg Kroah-Hartman <[email protected]>Acked-by Thomas Gleixner <[email protected]>Signed-off-by Kees Cook <[email protected]>Stable-dep-of:
1fdeb8b9f29d("wifi: iwl3945: Add missing check forcreate_singlethread_workqueue")Signed-off-by Sasha Levin <[email protected]>---
I noticed kernelci.org bot (5.4) reports:
Build Failures Detected:
mips:
ip27_defconfig: (gcc-10) FAIL
ip28_defconfig: (gcc-10) FAIL
lasat_defconfig: (gcc-10) FAILErrors summary:
1
arch/mips/lasat/picvue_proc.c:87:20: error: ‘pvc_display_tasklet’ undeclared (first use in this function)
1arch/mips/lasat/picvue_proc.c:42:44: error: expected ‘)’ before ‘&’ token
1arch/mips/lasat/picvue_proc.c:33:13: error: ‘pvc_display’ defined but not used [-Werror=unused-function]Here's what I found...
this backport to 5.4.y of:b13fecb1c3a6("treewide: ReplaceDECLARE_TASKLET()withDECLARE_TASKLET_OLD()") changed all locations ofDECLARE_TASKLETwithDECLARE_TASKLET_OLD, except one, inarch/mips/lasat/pcivue_proc.c.This is due to:
10760dde9be3("MIPS: Remove support for LASAT") preceedingb13fecb1c3a6("treewide: ReplaceDECLARE_TASKLET()withDECLARE_TASKLET_OLD()") upstream and the former not being present in 5.4.y.I rolled a revert/re-apply with fixes in the attached mbox, however maybe just a revert makes more sense? Up to you.
Quoted 8 lines
Quoted 4 lines
Quoted 1 line
I have yet to try building this on mips, just did this by inspection.
I've taken your patches, let's see how that works...
Ugh, It didn't go well. I now see a problem. The change to
DECLARE_TASKLET_OLDalso removed the last parameter. I missed that. I'll spin-up a mips build.I've now confirmed locally with gcc-10 mips build of
lasat_defconfigfixup patch should be:
arch/mips/lasat/picvue_proc.c +1
-1@@ -39,7 +39,7 @@ static void pvc_display(unsigned long data)pvc_write_string (pvc_lines[i],0 , i); } -static DECLARE_TASKLET(pvc_display_tasklet, &pvc_display, 0); +static DECLARE_TASKLET_OLD(pvc_display_tasklet, &pvc_display);static int pvc_line_proc_show (struct seq_file *m,void *v) {
Quoted 1 line
Attached is a reflow of these two patches.
We don't generally build lasat_defconfig but can reproduce the problem on the most recent 5.4.y RC (5.4.240-rc1). Bisection led to "treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()" (5de7a4254eb2) (as expected), and reverting it also made the build pass (as expected, I guess).
With those two patches applied on top of 5.4.240-rc1, MIPS' lasat_defconfig builds with GCC-12 for us.
Greetings!
Daniel Díaz
[email protected]
Greg Kroah-Hartman
maintainerRe: [PATCH 5.4 084/357] treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
In reply to Tom SaegerQuoted 50 lines · Tom Saeger
Quoted 49 lines · Greg Kroah-Hartman
Quoted 48 lines · Tom Saeger
Quoted 9 lines · Greg Kroah-Hartman
From: Kees Cook <[email protected]>
[ Upstream commit
b13fecb1c3a603c4b8e99b306fecf4f668c11b32]This converts all the existing
DECLARE_TASKLET()(and ...DISABLED) macros withDECLARE_TASKLET_OLD()in preparation for refactoring the tasklet callback type. All existingDECLARE_TASKLET()users had a "0" data argument, it has been removed here as well.Quoted 6 lines
Reviewed-by Greg Kroah-Hartman <[email protected]>Acked-by Thomas Gleixner <[email protected]>Signed-off-by Kees Cook <[email protected]>Stable-dep-of:
1fdeb8b9f29d("wifi: iwl3945: Add missing check forcreate_singlethread_workqueue")Signed-off-by Sasha Levin <[email protected]>---
I noticed kernelci.org bot (5.4) reports:
Build Failures Detected:
mips:
ip27_defconfig: (gcc-10) FAIL
ip28_defconfig: (gcc-10) FAIL
lasat_defconfig: (gcc-10) FAILErrors summary:
1
arch/mips/lasat/picvue_proc.c:87:20: error: ‘pvc_display_tasklet’ undeclared (first use in this function)
1arch/mips/lasat/picvue_proc.c:42:44: error: expected ‘)’ before ‘&’ token
1arch/mips/lasat/picvue_proc.c:33:13: error: ‘pvc_display’ defined but not used [-Werror=unused-function]Here's what I found...
this backport to 5.4.y of:b13fecb1c3a6("treewide: ReplaceDECLARE_TASKLET()withDECLARE_TASKLET_OLD()") changed all locations ofDECLARE_TASKLETwithDECLARE_TASKLET_OLD, except one, inarch/mips/lasat/pcivue_proc.c.This is due to:
10760dde9be3("MIPS: Remove support for LASAT") preceedingb13fecb1c3a6("treewide: ReplaceDECLARE_TASKLET()withDECLARE_TASKLET_OLD()") upstream and the former not being present in 5.4.y.I rolled a revert/re-apply with fixes in the attached mbox, however maybe just a revert makes more sense? Up to you.
Quoted 7 lines
Quoted 4 lines
Quoted 1 line
I have yet to try building this on mips, just did this by inspection.
I've taken your patches, let's see how that works...
Ugh, It didn't go well. I now see a problem. The change to
DECLARE_TASKLET_OLDalso removed the last parameter. I missed that. I'll spin-up a mips build.
Ick, ok, let me go drop both of these patches from the tree and we can try again the next round of releases...
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 85/357 wifi: iwl3945: Add missing check for create_singlethread_workqueue
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb ]
Add the check for the return value of the create_singlethread_workqueue in order to avoid NULL pointer dereference.
--- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/iwlegacy/3945-mac.c +12 -4
@@ -3382,10 +3382,12 @@ static DEVICE_ATTR(dump_errors, 0200, NULL, il3945_dump_error_log);* *****************************************************************************/ -static void +static int il3945_setup_deferred_work (struct il_priv *il) { il->workqueue =create_singlethread_workqueue (DRV_NAME ); +if (!il->workqueue) +return -ENOMEM ;init_waitqueue_head (&il->wait_command_queue);
@@ -3404,6 +3406,8 @@ il3945_setup_deferred_work(struct il_priv *il)tasklet_init (&il->irq_tasklet, il3945_irq_tasklet, (unsigned long )il); + +return 0 ; } static void
@@ -3725,7 +3729,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) }il_set_rxon_channel (il, &il->bands[NL80211_BAND_2GHZ ].channels[5 ]); -il3945_setup_deferred_work (il); + err =il3945_setup_deferred_work (il); +if (err) + goto out_remove_sysfs; +il3945_setup_handlers (il);il_power_initialize (il);
@@ -3737,7 +3744,7 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err =il3945_setup_mac (il);if (err) - goto out_remove_sysfs; + goto out_destroy_workqueue;il_dbgfs_register (il,DRV_NAME );
@@ -3746,9 +3753,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)return 0 ; -out_remove_sysfs: +out_destroy_workqueue:destroy_workqueue (il->workqueue); il->workqueue =NULL ; +out_remove_sysfs:sysfs_remove_group (&pdev->dev.kobj, &il3945_attribute_group); out_release_irq:free_irq (il->pci_dev->irq, il);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 86/357 wifi: iwl4965: Add missing check for create_singlethread_workqueue()
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 ]
Add the check for the return value of the create_singlethread_workqueue() in order to avoid NULL pointer dereference.
--- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlegacy/4965-mac.c +10 -2
@@ -6217,10 +6217,12 @@ il4965_bg_txpower_work(struct work_struct *work)mutex_unlock (&il->mutex); } -static void +static int il4965_setup_deferred_work (struct il_priv *il) { il->workqueue =create_singlethread_workqueue (DRV_NAME ); +if (!il->workqueue) +return -ENOMEM ;init_waitqueue_head (&il->wait_command_queue);
@@ -6241,6 +6243,8 @@ il4965_setup_deferred_work(struct il_priv *il)tasklet_init (&il->irq_tasklet, il4965_irq_tasklet, (unsigned long )il); + +return 0 ; } static void
@@ -6630,7 +6634,10 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) goto out_disable_msi; } -il4965_setup_deferred_work (il); + err =il4965_setup_deferred_work (il); +if (err) + goto out_free_irq; +il4965_setup_handlers (il);/*********************************************
@@ -6668,6 +6675,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) out_destroy_workqueue:destroy_workqueue (il->workqueue); il->workqueue =NULL ; +out_free_irq:free_irq (il->pci_dev->irq, il); out_disable_msi:pci_disable_msi (il->pci_dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 87/357 wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 ]
This code re-uses "i" to be the iterator for both the inside and outside loops. It means the outside loop will exit earlier than intended.
--- drivers/net/wireless/marvell/mwifiex/11n.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/mwifiex/11n.c +3 -3
@@ -890,7 +890,7 @@ mwifiex_send_delba_txbastream_tbl(struct mwifiex_private *priv, u8 tid)*/ void mwifiex_update_ampdu_txwinsize (struct mwifiex_adapter *adapter) { -u8 i; +u8 i, j;u32 tx_win_size;struct mwifiex_private *priv;
@@ -921,8 +921,8 @@ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter)if (tx_win_size != priv->add_ba_param.tx_win_size) {if (!priv->media_connected)continue ; -for (i =0 ; i <MAX_NUM_TID ; i++) -mwifiex_send_delba_txbastream_tbl (priv, i); +for (j =0 ; j <MAX_NUM_TID ; j++) +mwifiex_send_delba_txbastream_tbl (priv, j); } } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 88/357 crypto: crypto4xx - Call dma_unmap_page when done
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit bcdda4301bdc4955d45f7e1ffefb6207967b067e ]
In crypto4xx_cipher_done, we should be unmapping the dst page, not mapping it.
This was flagged by a sparse warning about the unused addr variable. While we're at it, also fix a sparse warning regarding the unused ctx variable in crypto4xx_ahash_done (by actually using it).
--- drivers/crypto/amcc/crypto4xx_core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/crypto/amcc/crypto4xx_core.c +4 -6
@@ -521,7 +521,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, {struct skcipher_request *req;struct scatterlist *dst; -dma_addr_t addr; req =skcipher_request_cast (pd_uinfo->async_req);
@@ -530,8 +529,8 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, req->cryptlen, req->dst); }else { dst = pd_uinfo->dest_va; - addr =dma_map_page (dev->core_dev->device,sg_page (dst), - dst->offset, dst->length,DMA_FROM_DEVICE ); +dma_unmap_page (dev->core_dev->device, pd->dest, dst->length, +DMA_FROM_DEVICE ); }if (pd_uinfo->sa_va->sa_command_0.bf.save_iv ==SA_SAVE_IV ) {
@@ -556,10 +555,9 @@ static void crypto4xx_ahash_done(struct crypto4xx_device *dev,struct ahash_request *ahash_req; ahash_req =ahash_request_cast (pd_uinfo->async_req); - ctx =crypto_tfm_ctx (ahash_req->base.tfm); + ctx =crypto_ahash_ctx (crypto_ahash_reqtfm (ahash_req)); -crypto4xx_copy_digest_to_dst (ahash_req->result, pd_uinfo, -crypto_tfm_ctx (ahash_req->base.tfm)); +crypto4xx_copy_digest_to_dst (ahash_req->result, pd_uinfo, ctx);crypto4xx_ret_sg_desc (dev, pd_uinfo);if (pd_uinfo->state &PD_ENTRY_BUSY )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 89/357 wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
In reply to Greg Kroah-HartmanFrom: Shayne Chen <[email protected]>
[ Upstream commit 59336e07b287d91dc4ec265e07724e8f7e3d0209 ]
The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to u16 after being assigned to rate variable, which causes information loss in STA_STATS_FIELD_TYPE and later bitfields.
--- net/mac80211/sta_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/sta_info.c +1 -1
@@ -2121,7 +2121,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,static int sta_set_rate_info_rx (struct sta_info *sta,struct rate_info *rinfo) { -u16 rate =READ_ONCE (sta_get_last_rx_stats (sta)->last_rate); +u32 rate =READ_ONCE (sta_get_last_rx_stats (sta)->last_rate);if (rate ==STA_STATS_RATE_INVALID )return -EINVAL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 90/357 thermal/drivers/hisi: Drop second sensor hi3660
In reply to Greg Kroah-HartmanFrom: Yongqin Liu <[email protected]>
[ Upstream commit 15cc25829a97c3957e520e971868aacc84341317 ]
The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm allocators") exposes a panic "BRK handler: Fatal exception" on the hi3660_thermal_probe funciton.
This is because the function allocates memory for only one sensors array entry, but tries to fill up a second one.
Fix this by removing the unneeded second access.
--- drivers/thermal/hisi_thermal.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/thermal/hisi_thermal.c +0 -4
@@ -435,10 +435,6 @@ static int hi3660_thermal_probe(struct hisi_thermal_data *data) data->sensor[0 ].irq_name ="tsensor_a73" ; data->sensor[0 ].data = data; - data->sensor[1 ].id =HI3660_LITTLE_SENSOR ; - data->sensor[1 ].irq_name ="tsensor_a53" ; - data->sensor[1 ].data = data; -return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 91/357 can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
In reply to Greg Kroah-HartmanFrom: Frank Jungclaus <[email protected]>
[ Upstream commit 118469f88180438ef43dee93d71f77c00e7b425d ]
Move the supply for cf->data[3] (bit stream position of CAN error), in case of a bus- or protocol-error, outside of the "switch (ecc & SJA1000_ECC_MASK){}"-statement, because this bit stream position is independent of the error type.
--- drivers/net/can/usb/esd_usb2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/can/usb/esd_usb2.c +3 -1
@@ -278,7 +278,6 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv, cf->data[2 ] |=CAN_ERR_PROT_STUFF ;break ;default : - cf->data[3 ] = ecc &SJA1000_ECC_SEG ;break ; }
@@ -286,6 +285,9 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,if (!(ecc &SJA1000_ECC_DIR )) cf->data[2 ] |=CAN_ERR_PROT_TX ; +/* Bit stream position in CAN frame as the error was detected */ + cf->data[3 ] = ecc &SJA1000_ECC_SEG ; +if (priv->can.state ==CAN_STATE_ERROR_WARNING || priv->can.state ==CAN_STATE_ERROR_PASSIVE ) { cf->data[1] = (txerr > rxerr) ?
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 92/357 irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 94debe03e8afa1267f95a9001786a6aa506b9ff3 ]
When support for the level triggered interrupt controller flavor was added with c0ca7262088e, we forgot to update the flags to be set to contain IRQ_LEVEL. While the flow handler is correct, the output from /proc/interrupts does not show such interrupts as being level triggered when they are, correct that.
--- drivers/irqchip/irq-brcmstb-l2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/irqchip/irq-brcmstb-l2.c +5 -1
@@ -161,6 +161,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np, *init_params) {unsigned int clr =IRQ_NOREQUEST |IRQ_NOPROBE |IRQ_NOAUTOEN ; +unsigned int set =0 ;struct brcmstb_l2_intc_data *data;struct irq_chip_type *ct;int ret;
@@ -208,9 +209,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,if (IS_ENABLED (CONFIG_MIPS ) &&IS_ENABLED (CONFIG_CPU_BIG_ENDIAN )) flags |=IRQ_GC_BE_IO ; +if (init_params->handler == handle_level_irq) + set |=IRQ_LEVEL ; +/* Allocate a single Generic IRQ chip for this node */ ret =irq_alloc_domain_generic_chips (data->domain,32 ,1 , - np->full_name, init_params->handler, clr,0 , flags); + np->full_name, init_params->handler, clr, set, flags);if (ret) {pr_err ("failed to allocate generic irq chip\n" ); goto out_free_domain;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 93/357 irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 13a157b38ca5b4f9eed81442b8821db293755961 ]
When support for the interrupt controller was added with a5042de2688d, we forgot to update the flags to be set to contain IRQ_LEVEL. While the flow handler is correct, the output from /proc/interrupts does not show such interrupts as being level triggered when they are, correct that.
--- drivers/irqchip/irq-bcm7120-l2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/irqchip/irq-bcm7120-l2.c +2 -1
@@ -268,7 +268,8 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn, flags |=IRQ_GC_BE_IO ; ret =irq_alloc_domain_generic_chips (data->domain,IRQS_PER_WORD ,1 , - dn->full_name, handle_level_irq, clr,0 , flags); + dn->full_name, handle_level_irq, clr, +IRQ_LEVEL , flags);if (ret) {pr_err ("failed to allocate generic irq chip\n" ); goto out_free_domain;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 94/357 selftests/net: Interpret UDP_GRO cmsg data as an int value
In reply to Greg Kroah-HartmanFrom: Jakub Sitnicki <[email protected]>
[ Upstream commit 436864095a95fcc611c20c44a111985fa9848730 ]
Data passed to user-space with a (SOL_UDP, UDP_GRO) cmsg carries an int (see udp_cmsg_recv), not a u16 value, as strace confirms:
recvmsg(8, {msg_name=...,
msg_iov=[{iov_base="\0\0..."..., iov_len=96000}],
msg_iovlen=1,
msg_control=[{cmsg_len=20, <-- sizeof(cmsghdr) + 4
cmsg_level=SOL_UDP,
cmsg_type=0x68}], <-- UDP_GRO
msg_controllen=24,
msg_flags=0}, 0) = 11200Interpreting the data as an u16 value won't work on big-endian platforms. Since it is too late to back out of this API decision [1], fix the test.
[1]: https://lore.kernel.org/netdev/[email protected]/
--- tools/testing/selftests/net/udpgso_bench_rx.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
tools/testing/selftests/net/udpgso_bench_rx.c +2 -4
@@ -214,11 +214,10 @@ static void do_verify_udp(const char *data, int len)static int recv_msg (int fd,char *buf,int len,int *gso_size) { -char control[CMSG_SPACE (sizeof (uint16_t ))] = {0 }; +char control[CMSG_SPACE (sizeof (int ))] = {0 };struct msghdr msg = {0 };struct iovec iov = {0 };struct cmsghdr *cmsg; -uint16_t *gsosizeptr;int ret; iov.iov_base = buf;
@@ -237,8 +236,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size) cmsg = CMSG_NXTHDR(&msg, cmsg)) {if (cmsg->cmsg_level ==SOL_UDP && cmsg->cmsg_type ==UDP_GRO ) { - gsosizeptr = (uint16_t *)CMSG_DATA (cmsg); - *gso_size = *gsosizeptr; + *gso_size = *(int *)CMSG_DATA (cmsg);break ; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 95/357 selftest: fib_tests: Always cleanup before exit
In reply to Greg Kroah-HartmanFrom: Roxana Nicolescu <[email protected]>
[ Upstream commit b60417a9f2b890a8094477b2204d4f73c535725e ]
Usage of set -e before executing a command causes immediate exit on failure, without cleanup up the resources allocated at setup. This can affect the next tests that use the same resources, leading to a chain of failures.
A simple fix is to always call cleanup function when the script exists. This approach is already used by other existing tests.
--- tools/testing/selftests/net/fib_tests.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/fib_tests.sh +2 -0
@@ -1662,6 +1662,8 @@ EOF ################################################################################ # main +trap cleanup EXIT + while getopts :t:pPhv o do case $o in
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 96/357 drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 6fb6c979ca628583d4d0c59a0f8ff977e581ecc0 ]
As of commit eae06120f1974e1a ("drm: refuse ADDFB2 ioctl for broken bigendian drivers"), drivers must set the quirk_addfb_prefer_host_byte_order quirk to make the drm_mode_addfb() compat code work correctly on big-endian machines.
While that works fine for big-endian XRGB8888 and ARGB8888, which are mapped to the existing little-endian BGRX8888 and BGRA8888 formats, it does not work for big-endian XRGB1555 and RGB565, as the latter are not listed in the format database.
Fix this by adding the missing formats. Limit this to big-endian platforms, as there is currently no need to support these formats on little-endian platforms.
--- drivers/gpu/drm/drm_fourcc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/drm_fourcc.c +4 -0
@@ -178,6 +178,10 @@ const struct drm_format_info *__drm_format_info(u32 format) { .format = DRM_FORMAT_BGRA5551, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1, .has_alpha = true }, { .format = DRM_FORMAT_RGB565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, { .format = DRM_FORMAT_BGR565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, +#ifdef __BIG_ENDIAN + { .format = DRM_FORMAT_XRGB1555 | DRM_FORMAT_BIG_ENDIAN, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_RGB565 | DRM_FORMAT_BIG_ENDIAN, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, +#endif { .format = DRM_FORMAT_RGB888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 }, { .format = DRM_FORMAT_BGR888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 }, { .format = DRM_FORMAT_XRGB8888, .depth = 24, .num_planes = 1, .cpp = { 4, 0, 0 }, .hsub = 1, .vsub = 1 },
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 97/357 drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 7783cc67862f9166c901bfa0f80b717aa8d354dd ]
Freescale/NXP i.MX LCDIF and eLCDIF LCD controllers are only present on Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXS || ARCH_MXC, to prevent asking the user about this driver when configuring a kernel without Freescale/NXP i.MX support.
--- drivers/gpu/drm/mxsfb/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/mxsfb/Kconfig +1 -0
@@ -8,6 +8,7 @@ config DRM_MXSFB tristate "i.MX23/i.MX28/i.MX6SX MXSFB LCD controller" depends on DRM && OF depends on COMMON_CLK + depends on ARCH_MXS || ARCH_MXC || COMPILE_TEST select DRM_MXS select DRM_KMS_HELPER select DRM_KMS_CMA_HELPER
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 98/357 drm/bridge: megachips: Fix error handling in i2c_register_driver()
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit 4ecff954c370b82bce45bdca2846c5c5563e8a8a ]
A problem about insmod megachips-stdpxxxx-ge-b850v3-fw.ko failed is triggered with the following log given:
[ 4497.981497] Error: Driver 'stdp4028-ge-b850v3-fw' is already registered, aborting...
insmod: ERROR: could not insert module megachips-stdpxxxx-ge-b850v3-fw.ko: Device or resource busy
The reason is that stdpxxxx_ge_b850v3_init() returns i2c_add_driver() directly without checking its return value, if i2c_add_driver() failed, it returns without calling i2c_del_driver() on the previous i2c driver, resulting the megachips-stdpxxxx-ge-b850v3-fw can never be installed later.
A simple call graph is shown as below:
stdpxxxx_ge_b850v3_init()
i2c_add_driver(&stdp4028_ge_b850v3_fw_driver)
i2c_add_driver(&stdp2690_ge_b850v3_fw_driver)
i2c_register_driver()
driver_register()
bus_add_driver()
priv = kzalloc(...) # OOM happened
# return without delete stdp4028_ge_b850v3_fw_driver
Fix by calling i2c_del_driver() on stdp4028_ge_b850v3_fw_driver when i2c_add_driver() returns error.
--- drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +5 -1
@@ -426,7 +426,11 @@ static int __init stdpxxxx_ge_b850v3_init(void)if (ret)return ret; -return i2c_add_driver (&stdp2690_ge_b850v3_fw_driver); + ret =i2c_add_driver (&stdp2690_ge_b850v3_fw_driver); +if (ret) +i2c_del_driver (&stdp4028_ge_b850v3_fw_driver); + +return ret; }module_init (stdpxxxx_ge_b850v3_init);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 99/357 drm/vc4: dpi: Add option for inverting pixel clock and output enable
In reply to Greg Kroah-HartmanFrom: Dave Stevenson <[email protected]>
[ Upstream commit 3c2707632146b22e97b0fbf6778bab8add2eaa1d ]
DRM provides flags for inverting pixel clock and output enable signals, but these were not mapped to the relevant registers.
Add those mappings.
Stable-dep-of: 0870d86eac8a ("drm/vc4: dpi: Fix format mapping for RGB565")
--- drivers/gpu/drm/vc4/vc4_dpi.c | 66 ++++++++++++++++++++--------------- 1 file changed, 38 insertions(+), 28 deletions(-)
drivers/gpu/drm/vc4/vc4_dpi.c +38 -28
@@ -151,35 +151,45 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder) }drm_connector_list_iter_end (&conn_iter); -if (connector && connector->display_info.num_bus_formats) { -u32 bus_format = connector->display_info.bus_formats[0 ]; - -switch (bus_format) { -case MEDIA_BUS_FMT_RGB888_1X24 : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_24BIT_888_RGB , -DPI_FORMAT ); -break ; -case MEDIA_BUS_FMT_BGR888_1X24 : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_24BIT_888_RGB , -DPI_FORMAT ); - dpi_c |=VC4_SET_FIELD (DPI_ORDER_BGR ,DPI_ORDER ); -break ; -case MEDIA_BUS_FMT_RGB666_1X24_CPADHI : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_18BIT_666_RGB_2 , -DPI_FORMAT ); -break ; -case MEDIA_BUS_FMT_RGB666_1X18 : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_18BIT_666_RGB_1 , -DPI_FORMAT ); -break ; -case MEDIA_BUS_FMT_RGB565_1X16 : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_16BIT_565_RGB_3 , -DPI_FORMAT ); -break ; -default : -DRM_ERROR ("Unknown media bus format %d\n" , bus_format); -break ; +if (connector) { +if (connector->display_info.num_bus_formats) { +u32 bus_format = connector->display_info.bus_formats[0 ]; + +switch (bus_format) { +case MEDIA_BUS_FMT_RGB888_1X24 : + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_24BIT_888_RGB , +DPI_FORMAT ); +break ; +case MEDIA_BUS_FMT_BGR888_1X24 : + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_24BIT_888_RGB , +DPI_FORMAT ); + dpi_c |=VC4_SET_FIELD (DPI_ORDER_BGR , +DPI_ORDER ); +break ; +case MEDIA_BUS_FMT_RGB666_1X24_CPADHI : + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_18BIT_666_RGB_2 , +DPI_FORMAT ); +break ; +case MEDIA_BUS_FMT_RGB666_1X18 : + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_18BIT_666_RGB_1 , +DPI_FORMAT ); +break ; +case MEDIA_BUS_FMT_RGB565_1X16 : + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_16BIT_565_RGB_3 , +DPI_FORMAT ); +break ; +default : +DRM_ERROR ("Unknown media bus format %d\n" , + bus_format); +break ; + } } + +if (connector->display_info.bus_flags &DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE ) + dpi_c |=DPI_PIXEL_CLK_INVERT ; + +if (connector->display_info.bus_flags &DRM_BUS_FLAG_DE_LOW ) + dpi_c |=DPI_OUTPUT_ENABLE_INVERT ; }else {/* Default to 24bit if no connector found. */ dpi_c |=VC4_SET_FIELD (DPI_FORMAT_24BIT_888_RGB ,DPI_FORMAT );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 100/357 drm/vc4: dpi: Fix format mapping for RGB565
In reply to Greg Kroah-HartmanFrom: Dave Stevenson <[email protected]>
[ Upstream commit 0870d86eac8a9abd89a0be1b719d5dc5bac936f0 ]
The mapping is incorrect for RGB565_1X16 as it should be DPI_FORMAT_18BIT_666_RGB_1 instead of DPI_FORMAT_18BIT_666_RGB_3.
--- drivers/gpu/drm/vc4/vc4_dpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_dpi.c +1 -1
@@ -175,7 +175,7 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder) DPI_FORMAT);break ;case MEDIA_BUS_FMT_RGB565_1X16 : - dpi_c |=VC4_SET_FIELD (DPI_FORMAT_16BIT_565_RGB_3 , + dpi_c |=VC4_SET_FIELD (DPI_FORMAT_16BIT_565_RGB_1 ,DPI_FORMAT );break ;default :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 101/357 gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 9afdf98cfdfa2ba8ec068cf08c5fcdc1ed8daf3f ]
In ipu_add_client_devices(), we need to call of_node_put() for reference returned by of_graph_get_port_by_id() in fail path.
--- drivers/gpu/ipu-v3/ipu-common.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/ipu-v3/ipu-common.c +1 -0
@@ -1235,6 +1235,7 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) pdev =platform_device_alloc (reg->name, id++);if (!pdev) { ret = -ENOMEM ; +of_node_put (of_node); goto err_register; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 102/357 drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit afe4cb96153a0d8003e4e4ebd91b5c543e10df84 ]
Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference in hdmi_hdcp.c and hdmi_hpd.c.
Patchwork: https://patchwork.freedesktop.org/patch/517211/
--- drivers/gpu/drm/msm/hdmi/hdmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/msm/hdmi/hdmi.c +4 -0
@@ -248,6 +248,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)pm_runtime_enable (&pdev->dev); hdmi->workq =alloc_ordered_workqueue ("msm_hdmi" ,0 ); +if (!hdmi->workq) { + ret = -ENOMEM ; + goto fail; + } hdmi->i2c =msm_hdmi_i2c_init (hdmi);if (IS_ERR (hdmi->i2c)) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 103/357 pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit dcef18c8ac40aa85bb339f64c1dd31dd458b06fb ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/stm32/pinctrl-stm32.c +1 -0
@@ -1250,6 +1250,7 @@ static struct irq_domain *stm32_pctrl_get_irq_domain(struct device_node *np)return ERR_PTR (-ENXIO ); domain =irq_find_host (parent); +of_node_put (parent);if (!domain)/* domain not registered yet */ return ERR_PTR (-EPROBE_DEFER );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 104/357 ASoC: fsl_sai: initialize is_dsp_mode flag
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit a23924b7dd7b748fff8e305e1daf590fed2af21b ]
Initialize is_dsp_mode flag in the beginning of function fsl_sai_set_dai_fmt_tr().
When the DAIFMT is DAIFMT_DSP_B the first time, is_dsp_mode is true, then the second time DAIFMT is DAIFMT_I2S, is_dsp_mode still true, which is a wrong state. So need to initialize is_dsp_mode flag every time.
--- sound/soc/fsl/fsl_sai.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/fsl/fsl_sai.c +1 -0
@@ -212,6 +212,7 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai,if (!sai->is_lsb_first) val_cr4 |=FSL_SAI_CR4_MF ; + sai->is_dsp_mode = false;/* DAI mode */ switch (fmt &SND_SOC_DAIFMT_FORMAT_MASK ) {case SND_SOC_DAIFMT_I2S :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 105/357 ALSA: hda/ca0132: minor fix for allocation size
In reply to Greg Kroah-HartmanFrom: Alexey V. Vissarionov <[email protected]>
[ Upstream commit 3ee0fe7fa39b14d1cea455b7041f2df933bd97d2 ]
Although the "dma_chan" pointer occupies more or equal space compared to "*dma_chan", the allocation size should use the size of variable itself.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/pci/hda/patch_ca0132.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_ca0132.c +1 -1
@@ -2047,7 +2047,7 @@ static int dspio_set_uint_param_no_source(struct hda_codec *codec, int mod_id,static int dspio_alloc_dma_chan (struct hda_codec *codec,unsigned int *dma_chan) {int status =0 ; -unsigned int size =sizeof (dma_chan); +unsigned int size =sizeof (*dma_chan);codec_dbg (codec," dspio_alloc_dma_chan() -- begin\n" ); status = dspio_scp(codec, MASTERCONTROL, 0x20,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 106/357 drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
In reply to Greg Kroah-HartmanFrom: Daniel Mentz <[email protected]>
[ Upstream commit c9d27c6be518b4ef2966d9564654ef99292ea1b3 ]
The MIPI DCS specification demands that brightness values are sent in big endian byte order. It also states that one parameter (i.e. one byte) shall be sent/received for 8 bit wide values, and two parameters shall be used for values that are between 9 and 16 bits wide.
Add new functions to properly handle 16-bit brightness in big endian, since the two 8- and 16-bit cases are distinct from each other.
[richard: use separate functions instead of switch/case] [richard: split into 16-bit component]
--- drivers/gpu/drm/drm_mipi_dsi.c | 52 ++++++++++++++++++++++++++++++++++ include/drm/drm_mipi_dsi.h | 4 +++ 2 files changed, 56 insertions(+)
drivers/gpu/drm/drm_mipi_dsi.c +52 -0
@@ -1091,6 +1091,58 @@ int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi, }EXPORT_SYMBOL (mipi_dsi_dcs_get_display_brightness); +/** +* mipi_dsi_dcs_set_display_brightness_large() - sets the 16-bit brightness value +* of the display +* @dsi: DSI peripheral device +* @brightness: brightness value +* +* Return: 0 on success or a negative error code on failure. +*/ +int mipi_dsi_dcs_set_display_brightness_large (struct mipi_dsi_device *dsi, +u16 brightness) +{ +u8 payload[2 ] = { brightness >>8 , brightness &0xff }; +ssize_t err; + + err =mipi_dsi_dcs_write (dsi,MIPI_DCS_SET_DISPLAY_BRIGHTNESS , + payload,sizeof (payload)); +if (err <0 ) +return err; + +return 0 ; +} +EXPORT_SYMBOL (mipi_dsi_dcs_set_display_brightness_large); + +/** +* mipi_dsi_dcs_get_display_brightness_large() - gets the current 16-bit +* brightness value of the display +* @dsi: DSI peripheral device +* @brightness: brightness value +* +* Return: 0 on success or a negative error code on failure. +*/ +int mipi_dsi_dcs_get_display_brightness_large (struct mipi_dsi_device *dsi, +u16 *brightness) +{ +u8 brightness_be[2 ]; +ssize_t err; + + err =mipi_dsi_dcs_read (dsi,MIPI_DCS_GET_DISPLAY_BRIGHTNESS , + brightness_be,sizeof (brightness_be)); +if (err <=0 ) { +if (err ==0 ) + err = -ENODATA ; + +return err; + } + + *brightness = (brightness_be[0 ] <<8 ) | brightness_be[1 ]; + +return 0 ; +} +EXPORT_SYMBOL (mipi_dsi_dcs_get_display_brightness_large); +static int mipi_dsi_drv_probe (struct device *dev) {struct mipi_dsi_driver *drv =to_mipi_dsi_driver (dev->driver);
include/drm/drm_mipi_dsi.h +4 -0
@@ -279,6 +279,10 @@ int mipi_dsi_dcs_set_display_brightness(struct mipi_dsi_device *dsi, u16 brightness);int mipi_dsi_dcs_get_display_brightness (struct mipi_dsi_device *dsi,u16 *brightness); +int mipi_dsi_dcs_set_display_brightness_large (struct mipi_dsi_device *dsi, +u16 brightness); +int mipi_dsi_dcs_get_display_brightness_large (struct mipi_dsi_device *dsi, +u16 *brightness);/** * struct mipi_dsi_driver - DSI driver
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 107/357 drm/msm: use strscpy instead of strncpy
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit d7fd8634f48d76aa799ed57beb7d87dab91bde80 ]
Using strncpy can result in non-NULL-terminated destination string. Use strscpy instead. This fixes following warning:
drivers/gpu/drm/msm/msm_fence.c: In function ‘msm_fence_context_alloc’:drivers/gpu/drm/msm/msm_fence.c:25:9: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation]
25 | strncpy(fctx->name, name, sizeof(fctx->name));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Patchwork: https://patchwork.freedesktop.org/patch/518787/
--- drivers/gpu/drm/msm/msm_fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_fence.c +1 -1
@@ -20,7 +20,7 @@ msm_fence_context_alloc(struct drm_device *dev, const char *name)return ERR_PTR (-ENOMEM ); fctx->dev = dev; -strncpy (fctx->name, name,sizeof (fctx->name)); +strscpy (fctx->name, name,sizeof (fctx->name)); fctx->context =dma_fence_context_alloc (1 );init_waitqueue_head (&fctx->event);spin_lock_init (&fctx->spinlock);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 108/357 drm/msm/dpu: Add check for cstate
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit c96988b7d99327bb08bd9efd29a203b22cd88ace ]
As kzalloc may fail and return NULL pointer,
it should be better to check cstate
in order to avoid the NULL pointer dereference
in __drm_atomic_helper_crtc_reset.
Patchwork: https://patchwork.freedesktop.org/patch/514163/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +4 -1
@@ -651,7 +651,10 @@ static void dpu_crtc_reset(struct drm_crtc *crtc)if (crtc->state)dpu_crtc_destroy_state (crtc, crtc->state); -__drm_atomic_helper_crtc_reset (crtc, &cstate->base); +if (cstate) +__drm_atomic_helper_crtc_reset (crtc, &cstate->base); +else +__drm_atomic_helper_crtc_reset (crtc,NULL ); }/**
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 109/357 drm/msm/dpu: Add check for pstates
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 93340e10b9c5fc86730d149636e0aa8b47bb5a34 ]
As kzalloc may fail and return NULL pointer,
it should be better to check pstates
in order to avoid the NULL pointer dereference.
Patchwork: https://patchwork.freedesktop.org/patch/514160/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +2 -0
@@ -836,6 +836,8 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, } pstates =kzalloc (sizeof (*pstates) *DPU_STAGE_MAX *4 ,GFP_KERNEL ); +if (!pstates) +return -ENOMEM ; dpu_crtc =to_dpu_crtc (crtc); cstate =to_dpu_crtc_state (state);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 110/357 drm/exynos: Dont reset bridge->next
In reply to Greg Kroah-HartmanFrom: Boris Brezillon <[email protected]>
[ Upstream commit bd19c4527056b3e42e8c286136660aa14d0b6c90 ]
bridge->next is only points to the new bridge if drm_bridge_attach() succeeds. No need to reset it manually here.
Note that this change is part of the attempt to make the bridge chain a double-linked list. In order to do that we must patch all drivers manipulating the bridge->next field.
Stable-dep-of: 13fcfcb2a9a4 ("drm/msm/mdp5: Add check for kzalloc")
--- drivers/gpu/drm/exynos/exynos_dp.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/exynos/exynos_dp.c +0 -1
@@ -109,7 +109,6 @@ static int exynos_dp_bridge_attach(struct analogix_dp_plat_data *plat_data,if (ret) {DRM_DEV_ERROR (dp->dev,"Failed to attach bridge to drm\n" ); - bridge->next =NULL ;return ret; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 111/357 drm/bridge: Rename bridge helpers targeting a bridge chain
In reply to Greg Kroah-HartmanFrom: Boris Brezillon <[email protected]>
[ Upstream commit ea099adfdf4bf35903dc1c0f59a0d60175759c70 ]
Change the prefix of bridge helpers targeting a bridge chain from drm_bridge_ to drm_bridge_chain_ to better reflect the fact that the operation will happen on all elements of chain, starting at the bridge passed in argument.
Stable-dep-of: 13fcfcb2a9a4 ("drm/msm/mdp5: Add check for kzalloc")
--- drivers/gpu/drm/drm_atomic_helper.c | 19 ++-- drivers/gpu/drm/drm_bridge.c | 125 ++++++++++++------------ drivers/gpu/drm/drm_probe_helper.c | 2 +- drivers/gpu/drm/exynos/exynos_drm_dsi.c | 8 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 4 +- drivers/gpu/drm/vc4/vc4_dsi.c | 8 +- include/drm/drm_bridge.h | 64 ++++++------ 7 files changed, 120 insertions(+), 110 deletions(-)
drivers/gpu/drm/drm_atomic_helper.c +11 -8
@@ -445,8 +445,9 @@ mode_fixup(struct drm_atomic_state *state) encoder = new_conn_state->best_encoder; funcs = encoder->helper_private; - ret =drm_bridge_mode_fixup (encoder->bridge, &new_crtc_state->mode, - &new_crtc_state->adjusted_mode); + ret =drm_bridge_chain_mode_fixup (encoder->bridge, + &new_crtc_state->mode, + &new_crtc_state->adjusted_mode);if (!ret) {DRM_DEBUG_ATOMIC ("Bridge fixup failed\n" );return -EINVAL ;
@@ -511,7 +512,7 @@ static enum drm_mode_status mode_valid_path(struct drm_connector *connector,return ret; } - ret =drm_bridge_mode_valid (encoder->bridge, mode); + ret =drm_bridge_chain_mode_valid (encoder->bridge, mode);if (ret !=MODE_OK ) {DRM_DEBUG_ATOMIC ("[BRIDGE] mode_valid() failed\n" );return ret;
@@ -1030,7 +1031,7 @@ disable_outputs(struct drm_device *dev, struct drm_atomic_state *old_state)* Each encoder has at most one connector (since we always steal * it away), so we won't call disable hooks twice. */ -drm_atomic_bridge_disable (encoder->bridge, old_state); +drm_atomic_bridge_chain_disable (encoder->bridge, old_state);/* Right function depends upon target state. */ if (funcs) {
@@ -1044,7 +1045,8 @@ disable_outputs(struct drm_device *dev, struct drm_atomic_state *old_state) funcs->dpms (encoder,DRM_MODE_DPMS_OFF ); } -drm_atomic_bridge_post_disable (encoder->bridge, old_state); +drm_atomic_bridge_chain_post_disable (encoder->bridge, + old_state); }for_each_oldnew_crtc_in_state (old_state, crtc, old_crtc_state, new_crtc_state, i) {
@@ -1225,7 +1227,8 @@ crtc_set_mode(struct drm_device *dev, struct drm_atomic_state *old_state) funcs->mode_set (encoder, mode, adjusted_mode); } -drm_bridge_mode_set (encoder->bridge, mode, adjusted_mode); +drm_bridge_chain_mode_set (encoder->bridge, mode, + adjusted_mode); } }
@@ -1342,7 +1345,7 @@ void drm_atomic_helper_commit_modeset_enables(struct drm_device *dev,* Each encoder has at most one connector (since we always steal * it away), so we won't call enable hooks twice. */ -drm_atomic_bridge_pre_enable (encoder->bridge, old_state); +drm_atomic_bridge_chain_pre_enable (encoder->bridge, old_state);if (funcs) {if (funcs->atomic_enable)
@@ -1353,7 +1356,7 @@ void drm_atomic_helper_commit_modeset_enables(struct drm_device *dev, funcs->commit (encoder); } -drm_atomic_bridge_enable (encoder->bridge, old_state); +drm_atomic_bridge_chain_enable (encoder->bridge, old_state); }drm_atomic_helper_commit_writebacks (dev, old_state);
drivers/gpu/drm/drm_bridge.c +64 -61
305 lines not on this page · raw message
drivers/gpu/drm/drm_probe_helper.c +1 -1
@@ -112,7 +112,7 @@ drm_mode_validate_pipeline(struct drm_display_mode *mode,continue ; } - ret =drm_bridge_mode_valid (encoder->bridge, mode); + ret =drm_bridge_chain_mode_valid (encoder->bridge, mode);if (ret !=MODE_OK ) {/* There is also no point in continuing for crtc check * here. */
drivers/gpu/drm/exynos/exynos_drm_dsi.c +4 -4
@@ -1389,7 +1389,7 @@ static void exynos_dsi_enable(struct drm_encoder *encoder)if (ret <0 ) goto err_put_sync; }else { -drm_bridge_pre_enable (dsi->out_bridge); +drm_bridge_chain_pre_enable (dsi->out_bridge); }exynos_dsi_set_display_mode (dsi);
@@ -1400,7 +1400,7 @@ static void exynos_dsi_enable(struct drm_encoder *encoder)if (ret <0 ) goto err_display_disable; }else { -drm_bridge_enable (dsi->out_bridge); +drm_bridge_chain_enable (dsi->out_bridge); } dsi->state |=DSIM_STATE_VIDOUT_AVAILABLE ;
@@ -1425,10 +1425,10 @@ static void exynos_dsi_disable(struct drm_encoder *encoder) dsi->state &= ~DSIM_STATE_VIDOUT_AVAILABLE ;drm_panel_disable (dsi->panel); -drm_bridge_disable (dsi->out_bridge); +drm_bridge_chain_disable (dsi->out_bridge);exynos_dsi_set_display_enable (dsi, false);drm_panel_unprepare (dsi->panel); -drm_bridge_post_disable (dsi->out_bridge); +drm_bridge_chain_post_disable (dsi->out_bridge); dsi->state &= ~DSIM_STATE_ENABLED ;pm_runtime_put_sync (dsi->dev); }
drivers/gpu/drm/mediatek/mtk_hdmi.c +2 -2
@@ -1246,8 +1246,8 @@ static int mtk_hdmi_conn_mode_valid(struct drm_connector *conn,struct drm_display_mode adjusted_mode;drm_mode_copy (&adjusted_mode, mode); -if (!drm_bridge_mode_fixup (hdmi->bridge.next, mode, - &adjusted_mode)) +if (!drm_bridge_chain_mode_fixup (hdmi->bridge.next, mode, + &adjusted_mode))return MODE_BAD ; }
drivers/gpu/drm/vc4/vc4_dsi.c +4 -4
@@ -752,9 +752,9 @@ static void vc4_dsi_encoder_disable(struct drm_encoder *encoder)struct vc4_dsi *dsi = vc4_encoder->dsi;struct device *dev = &dsi->pdev->dev; -drm_bridge_disable (dsi->bridge); +drm_bridge_chain_disable (dsi->bridge);vc4_dsi_ulps (dsi, true); -drm_bridge_post_disable (dsi->bridge); +drm_bridge_chain_post_disable (dsi->bridge);clk_disable_unprepare (dsi->pll_phy_clock);clk_disable_unprepare (dsi->escape_clock);
@@ -1052,7 +1052,7 @@ static void vc4_dsi_encoder_enable(struct drm_encoder *encoder)vc4_dsi_ulps (dsi, false); -drm_bridge_pre_enable (dsi->bridge); +drm_bridge_chain_pre_enable (dsi->bridge);if (dsi->mode_flags &MIPI_DSI_MODE_VIDEO ) { DSI_PORT_WRITE(DISP0_CTRL,
@@ -1069,7 +1069,7 @@ static void vc4_dsi_encoder_enable(struct drm_encoder *encoder) DSI_DISP0_ENABLE); } -drm_bridge_enable (dsi->bridge); +drm_bridge_chain_enable (dsi->bridge);if (debug_dump_regs) {struct drm_printer p =drm_info_printer (&dsi->pdev->dev);
include/drm/drm_bridge.h +34 -30
98 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 112/357 drm/bridge: Introduce drm_bridge_get_next_bridge()
In reply to Greg Kroah-HartmanFrom: Boris Brezillon <[email protected]>
[ Upstream commit fadf872d9d9274a3be34d8438e0f6bb465c8f98b ]
And use it in drivers accessing the bridge->next field directly. This is part of our attempt to make the bridge chain a double-linked list based on the generic list helpers.
Stable-dep-of: 13fcfcb2a9a4 ("drm/msm/mdp5: Add check for kzalloc")
--- drivers/gpu/drm/drm_encoder.c | 2 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 6 ++++-- drivers/gpu/drm/omapdrm/omap_drv.c | 4 ++-- drivers/gpu/drm/omapdrm/omap_encoder.c | 3 ++- include/drm/drm_bridge.h | 13 +++++++++++++ 5 files changed, 22 insertions(+), 6 deletions(-)
drivers/gpu/drm/drm_encoder.c +1 -1
@@ -170,7 +170,7 @@ void drm_encoder_cleanup(struct drm_encoder *encoder)struct drm_bridge *next;while (bridge) { - next = bridge->next; + next =drm_bridge_get_next_bridge (bridge);drm_bridge_detach (bridge); bridge = next; }
drivers/gpu/drm/mediatek/mtk_hdmi.c +4 -2
@@ -1237,16 +1237,18 @@ static int mtk_hdmi_conn_mode_valid(struct drm_connector *conn, struct drm_display_mode *mode) {struct mtk_hdmi *hdmi =hdmi_ctx_from_conn (conn); +struct drm_bridge *next_bridge;dev_dbg (hdmi->dev,"xres=%d, yres=%d, refresh=%d, intl=%d clock=%d\n" , mode->hdisplay, mode->vdisplay, mode->vrefresh, !!(mode->flags &DRM_MODE_FLAG_INTERLACE ), mode->clock *1000 ); -if (hdmi->bridge.next) { + next_bridge =drm_bridge_get_next_bridge (&hdmi->bridge); +if (next_bridge) {struct drm_display_mode adjusted_mode;drm_mode_copy (&adjusted_mode, mode); -if (!drm_bridge_chain_mode_fixup (hdmi->bridge.next, mode, +if (!drm_bridge_chain_mode_fixup (next_bridge, mode, &adjusted_mode))return MODE_BAD ; }
drivers/gpu/drm/omapdrm/omap_drv.c +2 -2
@@ -216,8 +216,8 @@ static int omap_display_id(struct omap_dss_device *output) }else if (output->bridge) {struct drm_bridge *bridge = output->bridge; -while (bridge->next) - bridge = bridge->next; +while (drm_bridge_get_next_bridge (bridge)) + bridge =drm_bridge_get_next_bridge (bridge); node = bridge->of_node; }else if (output->panel) {
drivers/gpu/drm/omapdrm/omap_encoder.c +2 -1
@@ -125,7 +125,8 @@ static void omap_encoder_mode_set(struct drm_encoder *encoder,for (dssdev = output; dssdev; dssdev = dssdev->next)omap_encoder_update_videomode_flags (&vm, dssdev->bus_flags); -for (bridge = output->bridge; bridge; bridge = bridge->next) { +for (bridge = output->bridge; bridge; + bridge =drm_bridge_get_next_bridge (bridge)) {if (!bridge->timings)continue ;
include/drm/drm_bridge.h +13 -0
@@ -409,6 +409,19 @@ struct drm_bridge *of_drm_find_bridge(struct device_node *np);int drm_bridge_attach (struct drm_encoder *encoder,struct drm_bridge *bridge,struct drm_bridge *previous); +/** +* drm_bridge_get_next_bridge() - Get the next bridge in the chain +* @bridge: bridge object +* +* RETURNS: +* the next bridge in the chain after @bridge, or NULL if @bridge is the last. +*/ +static inline struct drm_bridge * +drm_bridge_get_next_bridge (struct drm_bridge *bridge) +{ +return bridge->next; +} +bool drm_bridge_chain_mode_fixup (struct drm_bridge *bridge,const struct drm_display_mode *mode,struct drm_display_mode *adjusted_mode);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 113/357 drm: Initialize struct drm_crtc_state.no_vblank from device settings
In reply to Greg Kroah-HartmanFrom: Thomas Zimmermann <[email protected]>
[ Upstream commit 7beb691f1e6f349c9df3384a85e7a53c5601aaaf ]
At the end of a commit, atomic helpers can generate a fake VBLANK event automatically. Originally implemented for writeback connectors, the functionality can be used by any driver and/or hardware without proper VBLANK interrupt.
The patch updates the documentation to make this behaviour official:
settings struct drm_crtc_state.no_vblank to true enables automatic generation of fake VBLANK events.
The new interface drm_dev_has_vblank() returns true if vblanking has been initialized for a device, or false otherwise. Atomic helpers use this function when initializing no_vblank in the CRTC state in drm_atomic_helper_check_modeset(). If vblanking has been initialized for a device, no_blank is disabled. Otherwise it's enabled. Hence, atomic helpers will automatically send out fake VBLANK events with any driver that did not initialize vblanking.
v5:
* more precise documentation and commit message
v4:
* replace drm_crtc_has_vblank() with drm_dev_has_vblank()
* add drm_dev_has_vblank() in this patch
* move driver changes into separate patches
v3:
* squash all related changes patches into this patch
Stable-dep-of: 13fcfcb2a9a4 ("drm/msm/mdp5: Add check for kzalloc")
--- drivers/gpu/drm/drm_atomic_helper.c | 10 ++++++++- drivers/gpu/drm/drm_vblank.c | 28 ++++++++++++++++++++++++ include/drm/drm_crtc.h | 34 +++++++++++++++++++++++------ include/drm/drm_simple_kms_helper.h | 7 ++++-- include/drm/drm_vblank.h | 1 + 5 files changed, 70 insertions(+), 10 deletions(-)
drivers/gpu/drm/drm_atomic_helper.c +9 -1
@@ -589,6 +589,7 @@ mode_valid(struct drm_atomic_state *state)* &drm_crtc_state.connectors_changed is set when a connector is added or * removed from the crtc. &drm_crtc_state.active_changed is set when * &drm_crtc_state.active changes, which is used for DPMS. +* &drm_crtc_state.no_vblank is set from the result of drm_dev_has_vblank(). * See also: drm_atomic_crtc_needs_modeset() * * IMPORTANT:
@@ -655,6 +656,11 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,return -EINVAL ; } + +if (drm_dev_has_vblank (dev)) + new_crtc_state->no_vblank = false; +else + new_crtc_state->no_vblank = true; } ret =handle_conflicting_encoders (state, false);
@@ -2205,7 +2211,9 @@ EXPORT_SYMBOL(drm_atomic_helper_wait_for_dependencies);* when a job is queued, and any change to the pipeline that does not touch the * connector is leading to timeouts when calling * drm_atomic_helper_wait_for_vblanks() or -* drm_atomic_helper_wait_for_flip_done(). +* drm_atomic_helper_wait_for_flip_done(). In addition to writeback +* connectors, this function can also fake VBLANK events for CRTCs without +* VBLANK interrupt. * * This is part of the atomic helper support for nonblocking commits, see * drm_atomic_helper_setup_commit() for an overview.
drivers/gpu/drm/drm_vblank.c +28 -0
@@ -69,6 +69,12 @@* &drm_driver.max_vblank_count. In that case the vblank core only disables the * vblanks after a timer has expired, which can be configured through the * ``vblankoffdelay`` module parameter. +* +* Drivers for hardware without support for vertical-blanking interrupts +* must not call drm_vblank_init(). For such drivers, atomic helpers will +* automatically generate fake vblank events as part of the display update. +* This functionality also can be controlled by the driver by enabling and +* disabling struct drm_crtc_state.no_vblank. */ /* Retry timestamp calculation up to 3 times to satisfy
@@ -488,6 +494,28 @@ int drm_vblank_init(struct drm_device *dev, unsigned int num_crtcs) }EXPORT_SYMBOL (drm_vblank_init); +/** +* drm_dev_has_vblank - test if vblanking has been initialized for +* a device +* @dev: the device +* +* Drivers may call this function to test if vblank support is +* initialized for a device. For most hardware this means that vblanking +* can also be enabled. +* +* Atomic helpers use this function to initialize +* &drm_crtc_state.no_vblank. See also drm_atomic_helper_check_modeset(). +* +* Returns: +* True if vblanking has been initialized for the given device, false +* otherwise. +*/ +bool drm_dev_has_vblank (const struct drm_device *dev) +{ +return dev->num_crtcs !=0 ; +} +EXPORT_SYMBOL (drm_dev_has_vblank); +/** * drm_crtc_vblank_waitqueue - get vblank waitqueue for the CRTC * @crtc: which CRTC's vblank waitqueue to retrieve
include/drm/drm_crtc.h +27 -7
@@ -175,12 +175,25 @@ struct drm_crtc_state {* @no_vblank: * * Reflects the ability of a CRTC to send VBLANK events. This state -* usually depends on the pipeline configuration, and the main usuage -* is CRTCs feeding a writeback connector operating in oneshot mode. -* In this case the VBLANK event is only generated when a job is queued -* to the writeback connector, and we want the core to fake VBLANK -* events when this part of the pipeline hasn't changed but others had -* or when the CRTC and connectors are being disabled. +* usually depends on the pipeline configuration. If set to true, DRM +* atomic helpers will send out a fake VBLANK event during display +* updates after all hardware changes have been committed. This is +* implemented in drm_atomic_helper_fake_vblank(). +* +* One usage is for drivers and/or hardware without support for VBLANK +* interrupts. Such drivers typically do not initialize vblanking +* (i.e., call drm_vblank_init() with the number of CRTCs). For CRTCs +* without initialized vblanking, this field is set to true in +* drm_atomic_helper_check_modeset(), and a fake VBLANK event will be +* send out on each update of the display pipeline by +* drm_atomic_helper_fake_vblank(). +* +* Another usage is CRTCs feeding a writeback connector operating in +* oneshot mode. In this case the fake VBLANK event is only generated +* when a job is queued to the writeback connector, and we want the +* core to fake VBLANK events when this part of the pipeline hasn't +* changed but others had or when the CRTC and connectors are being +* disabled. * * __drm_atomic_helper_crtc_duplicate_state() will not reset the value * from the current state, the CRTC driver is then responsible for
@@ -336,7 +349,14 @@ struct drm_crtc_state {* - Events for disabled CRTCs are not allowed, and drivers can ignore * that case. * -* This can be handled by the drm_crtc_send_vblank_event() function, +* For very simple hardware without VBLANK interrupt, enabling +* &struct drm_crtc_state.no_vblank makes DRM's atomic commit helpers +* send a fake VBLANK event at the end of the display update after all +* hardware changes have been applied. See +* drm_atomic_helper_fake_vblank(). +* +* For more complex hardware this +* can be handled by the drm_crtc_send_vblank_event() function, * which the driver should call on the provided event upon completion of * the atomic commit. Note that if the driver supports vblank signalling * and timestamping the vblank counters and timestamps must agree with
include/drm/drm_simple_kms_helper.h +5 -2
@@ -100,8 +100,11 @@ struct drm_simple_display_pipe_funcs {* This is the function drivers should submit the * &drm_pending_vblank_event from. Using either * drm_crtc_arm_vblank_event(), when the driver supports vblank -* interrupt handling, or drm_crtc_send_vblank_event() directly in case -* the hardware lacks vblank support entirely. +* interrupt handling, or drm_crtc_send_vblank_event() for more +* complex case. In case the hardware lacks vblank support entirely, +* drivers can set &struct drm_crtc_state.no_vblank in +* &struct drm_simple_display_pipe_funcs.check and let DRM's +* atomic helper fake a vblank event. */ void (*update)(struct drm_simple_display_pipe *pipe,struct drm_plane_state *old_plane_state);
include/drm/drm_vblank.h +1 -0
@@ -195,6 +195,7 @@ struct drm_vblank_crtc { };int drm_vblank_init (struct drm_device *dev,unsigned int num_crtcs); +bool drm_dev_has_vblank (const struct drm_device *dev);u64 drm_crtc_vblank_count (struct drm_crtc *crtc);u64 drm_crtc_vblank_count_and_time (struct drm_crtc *crtc,ktime_t *vblanktime);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 114/357 drm/msm/mdp5: Add check for kzalloc
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 13fcfcb2a9a4787fe4e49841d728f6f2e9fa6911 ]
As kzalloc may fail and return NULL pointer,
it should be better to check the return value
in order to avoid the NULL pointer dereference.
Patchwork: https://patchwork.freedesktop.org/patch/514154/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +4 -1
@@ -1050,7 +1050,10 @@ static void mdp5_crtc_reset(struct drm_crtc *crtc)if (crtc->state)mdp5_crtc_destroy_state (crtc, crtc->state); -__drm_atomic_helper_crtc_reset (crtc, &mdp5_cstate->base); +if (mdp5_cstate) +__drm_atomic_helper_crtc_reset (crtc, &mdp5_cstate->base); +else +__drm_atomic_helper_crtc_reset (crtc,NULL );drm_crtc_vblank_reset (crtc); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 115/357 gpu: host1x: Dont skip assigning syncpoints to channels
In reply to Greg Kroah-HartmanFrom: Mikko Perttunen <[email protected]>
[ Upstream commit eb258cc1fd458e584082be987dbc6ec42668c05e ]
The code to write the syncpoint channel assignment register incorrectly skips the write if hypervisor registers are not available.
The register, however, is within the guest aperture so remove the check and assign syncpoints properly even on virtualized systems.
--- drivers/gpu/host1x/hw/syncpt_hw.c | 3 --- 1 file changed, 3 deletions(-)
drivers/gpu/host1x/hw/syncpt_hw.c +0 -3
@@ -106,9 +106,6 @@ static void syncpt_assign_to_channel(struct host1x_syncpt *sp,#if HOST1X_HW >=6 struct host1x *host = sp->host; -if (!host->hv_regs) -return ; -host1x_sync_writel (host,HOST1X_SYNC_SYNCPT_CH_APP_CH (ch ? ch->id :0xff ),HOST1X_SYNC_SYNCPT_CH_APP (sp->id));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 116/357 drm/mediatek: remove cast to pointers passed to kfree
In reply to Greg Kroah-HartmanFrom: Wambui Karuga <[email protected]>
[ Upstream commit 2ec35bd21d3290c8f76020dc60503deacd18e24b ]
Remove unnecessary casts to pointer types passed to kfree. Issue detected by coccinelle:
@@
type t1;
expression *e;
@@
-kfree((t1 *)e);
+kfree(e);
Stable-dep-of: 4744cde06f57 ("drm/mediatek: Use NULL instead of 0 for NULL pointer")
--- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_drm_gem.c +2 -2
@@ -271,7 +271,7 @@ void *mtk_drm_gem_prime_vmap(struct drm_gem_object *obj) pgprot_writecombine(PAGE_KERNEL)); out: -kfree ((void *)sgt); +kfree (sgt);return mtk_gem->kvaddr; }
@@ -285,5 +285,5 @@ void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr)vunmap (vaddr); mtk_gem->kvaddr =0 ; -kfree ((void *)mtk_gem->pages); +kfree (mtk_gem->pages); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 117/357 drm/mediatek: Use NULL instead of 0 for NULL pointer
In reply to Greg Kroah-HartmanFrom: Miles Chen <[email protected]>
[ Upstream commit 4744cde06f57dd6fbaac468663b1fe2f653eaa16 ]
Use NULL for NULL pointer to fix the following sparse warning:drivers/gpu/drm/mediatek/mtk_drm_gem.c:265:27: sparse: warning: Using plain integer as NULL pointer
--- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/mediatek/mtk_drm_gem.c +1 -1
@@ -284,6 +284,6 @@ void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr)return ;vunmap (vaddr); - mtk_gem->kvaddr =0 ; + mtk_gem->kvaddr =NULL ;kfree (mtk_gem->pages); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 118/357 drm/mediatek: Drop unbalanced obj unref
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
[ Upstream commit 4deef811828e87e26a978d5d6433b261d4713849 ]
In the error path, mtk_drm_gem_object_mmap() is dropping an obj reference that it doesn't own.
--- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_drm_gem.c +0 -2
@@ -142,8 +142,6 @@ static int mtk_drm_gem_object_mmap(struct drm_gem_object *obj, ret =dma_mmap_attrs (priv->dma_dev, vma, mtk_gem->cookie, mtk_gem->dma_addr, obj->size, mtk_gem->dma_attrs); -if (ret) -drm_gem_vm_close (vma);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 119/357 drm/mediatek: Clean dangling pointer on bind error path
In reply to Greg Kroah-HartmanFrom: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit 36aa8c61af55675ed967900fbe5deb32d776f051 ]
mtk_drm_bind() can fail, in which case drm_dev_put() is called, destroying the drm_device object. However a pointer to it was still being held in the private object, and that pointer would be passed along to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that point, resulting in a panic. Clean the pointer when destroying the object in the error path to prevent this from happening.
--- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/mediatek/mtk_drm_drv.c +1 -0
@@ -417,6 +417,7 @@ static int mtk_drm_bind(struct device *dev) err_deinit:mtk_drm_kms_deinit (drm); err_free: + private->drm =NULL ;drm_dev_put (drm);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 120/357 ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
[ Upstream commit ffe4c0f0bfaa571a676a0e946d4a6a0607f94294 ]
commit d3268a40d4b19f ("ASoC: soc-compress.c: fix NULL dereference") enables DPCM capture, but it should independent from playback. This patch fixup it.
--- sound/soc/soc-compress.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-compress.c +1 -1
@@ -927,7 +927,7 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) rtd->fe_compr =1 ;if (rtd->dai_link->dpcm_playback) be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK ].substream->private_data = rtd; -else if (rtd->dai_link->dpcm_capture) +if (rtd->dai_link->dpcm_capture) be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE ].substream->private_data = rtd;memcpy (compr->ops, &soc_compr_dyn_ops,sizeof (soc_compr_dyn_ops)); }else {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 121/357 gpio: vf610: connect GPIO label to dev name
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
[ Upstream commit 6f8ecb7f85f441eb7d78ba2a4df45ee8a821934e ]
Current GPIO label is fixed, so can't distinguish different GPIO controllers through labels. Use dev name instead.
--- drivers/gpio/gpio-vf610.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-vf610.c +1 -1
@@ -304,7 +304,7 @@ static int vf610_gpio_probe(struct platform_device *pdev) gc = &port->gc; gc->of_node = np; gc->parent = dev; - gc->label ="vf610-gpio" ; + gc->label =dev_name (dev); gc->ngpio =VF610_GPIO_PER_PORT ; gc->base =of_alias_get_id (np,"gpio" ) *VF610_GPIO_PER_PORT ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 122/357 hwmon: (ltc2945) Handle error case in ltc2945_value_store
In reply to Greg Kroah-HartmanFrom: Jonathan Cormier <[email protected]>
[ Upstream commit 178b01eccfb0b8149682f61388400bd3d903dddc ]
ltc2945_val_to_reg errors were not being handled which would have resulted in register being set to 0 (clamped) instead of being left alone.
--- drivers/hwmon/ltc2945.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/hwmon/ltc2945.c +2 -0
@@ -248,6 +248,8 @@ static ssize_t ltc2945_value_store(struct device *dev,/* convert to register value, then clamp and write result */ regval =ltc2945_val_to_reg (dev, reg, val); +if (regval <0 ) +return regval;if (is_power_reg (reg)) { regval =clamp_val (regval,0 ,0xffffff ); regbuf[0 ] = regval >>16 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 123/357 scsi: aic94xx: Add missing check for dma_map_single()
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 32fe45274edb5926abc0fac7263d9f889d02d9cf ]
Add check for dma_map_single() and return error if it fails in order to avoid invalid DMA address.
--- drivers/scsi/aic94xx/aic94xx_task.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/aic94xx/aic94xx_task.c +3 -0
@@ -50,6 +50,9 @@ static int asd_map_scatterlist(struct sas_task *task,dma_addr_t dma =dma_map_single (&asd_ha->pcidev->dev, p, task->total_xfer_len, task->data_dir); +if (dma_mapping_error (&asd_ha->pcidev->dev, dma)) +return -ENOMEM ; + sg_arr[0 ].bus_addr =cpu_to_le64 ((u64 )dma); sg_arr[0 ].size =cpu_to_le32 (task->total_xfer_len); sg_arr[0 ].flags |=ASD_SG_EL_LIST_EOL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 124/357 spi: bcm63xx-hsspi: fix pm_runtime
In reply to Greg Kroah-HartmanFrom: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit 216e8e80057a9f0b6366327881acf88eaf9f1fd4 ]
The driver sets auto_runtime_pm to true, but it doesn't call pm_runtime_enable(), which results in "Failed to power device" when PM support is enabled.
Stable-dep-of: 811ff802aaf8 ("spi: bcm63xx-hsspi: Fix multi-bit mode setting")
--- drivers/spi/spi-bcm63xx-hsspi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/spi/spi-bcm63xx-hsspi.c +7 -1
@@ -20,6 +20,8 @@#include <linux/spi/spi.h> #include <linux/mutex.h> #include <linux/of.h> +#include <linux/reset.h> +#include <linux/pm_runtime.h> #define HSSPI_GLOBAL_CTRL_REG 0x0#define GLOBAL_CTRL_CS_POLARITY_SHIFT 0
@@ -428,13 +430,17 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)if (ret) goto out_put_master; +pm_runtime_enable (&pdev->dev); +/* register and we are done */ ret =devm_spi_register_master (dev, master);if (ret) - goto out_put_master; + goto out_pm_disable;return 0 ; +out_pm_disable: +pm_runtime_disable (&pdev->dev); out_put_master:spi_master_put (master); out_disable_pll_clk:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 125/357 spi: bcm63xx-hsspi: Fix multi-bit mode setting
In reply to Greg Kroah-HartmanFrom: William Zhang <[email protected]>
[ Upstream commit 811ff802aaf878ebbbaeac0307a0164fa21e7d40 ]
Currently the driver always sets the controller to dual data bit mode for both tx and rx data in the profile mode control register even for single data bit transfer. Luckily the opcode is set correctly according to SPI transfer data bit width so it does not actually cause issues.
This change fixes the problem by setting tx and rx data bit mode field correctly according to the actual SPI transfer tx and rx data bit width.
--- drivers/spi/spi-bcm63xx-hsspi.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/spi/spi-bcm63xx-hsspi.c +9 -3
@@ -163,6 +163,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)int step_size =HSSPI_BUFFER_LEN ;const u8 *tx = t->tx_buf;u8 *rx = t->rx_buf; +u32 val =0 ;bcm63xx_hsspi_set_clk (bs, spi, t->speed_hz);bcm63xx_hsspi_set_cs (bs, spi->chip_select, true);
@@ -178,11 +179,16 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) step_size -=HSSPI_OPCODE_LEN ;if ((opcode ==HSSPI_OP_READ && t->rx_nbits ==SPI_NBITS_DUAL ) || - (opcode ==HSSPI_OP_WRITE && t->tx_nbits ==SPI_NBITS_DUAL )) + (opcode ==HSSPI_OP_WRITE && t->tx_nbits ==SPI_NBITS_DUAL )) { opcode |=HSSPI_OP_MULTIBIT ; -__raw_writel (1 <<MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT | -1 <<MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT |0xff , +if (t->rx_nbits ==SPI_NBITS_DUAL ) + val |=1 <<MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT ; +if (t->tx_nbits ==SPI_NBITS_DUAL ) + val |=1 <<MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT ; + } + +__raw_writel (val |0xff , bs->regs +HSSPI_PROFILE_MODE_CTRL_REG (chip_select));while (pending >0 ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 126/357 hwmon: (mlxreg-fan) Return zero speed for broken fan
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit a1ffd3c46267ee5c807acd780e15df9bb692223f ]
Currently for broken fan driver returns value calculated based on error code (0xFF) in related fan speed register.
Thus, for such fan user gets fan{n}_fault to 1 and fan{n}_input with misleading value.
Add check for fan fault prior return speed value and return zero if fault is detected.
--- drivers/hwmon/mlxreg-fan.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hwmon/mlxreg-fan.c +6 -0
@@ -127,6 +127,12 @@ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,if (err)return err; +if (MLXREG_FAN_GET_FAULT (regval, tacho->mask)) { +/* FAN is broken - return zero for FAN speed. */ + *val =0 ; +return 0 ; + } + *val =MLXREG_FAN_GET_RPM (regval, fan->divider, fan->samples);break ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 127/357 dm: remove flush_scheduled_work() during local_exit()
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
[ Upstream commit 0b22ff5360f5c4e11050b89206370fdf7dc0a226 ]
Commit acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred device removal") switched from using system workqueue to a single workqueue local to DM. But it didn't eliminate the call to flush_scheduled_work() that was introduced purely for the benefit of deferred device removal with commit 2c140a246dc ("dm: allow remove to be deferred").
Since DM core uses its own workqueue (and queue_work) there is no need to call flush_scheduled_work() from local_exit(). local_exit()'s destroy_workqueue(deferred_remove_workqueue) handles flushing work started with queue_work().
--- drivers/md/dm.c | 1 - 1 file changed, 1 deletion(-)
drivers/md/dm.c +0 -1
@@ -263,7 +263,6 @@ static int __init local_init(void)static void local_exit (void ) { -flush_scheduled_work ();destroy_workqueue (deferred_remove_workqueue);unregister_blkdev (_major, _name);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 128/357 spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit e6a0b671880207566e1ece983bf989dde60bc1d7 ]
wait_for_completion_timeout() never returns a <0 value. It returns either on timeout or a positive value (at least 1, or number of jiffies left till timeout)
So, fix the error handling path and return -ETIMEDOUT should a timeout occur.
--- drivers/spi/spi-synquacer.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/spi/spi-synquacer.c +3 -4
@@ -472,10 +472,9 @@ static int synquacer_spi_transfer_one(struct spi_master *master,read_fifo (sspi); } -if (status <0 ) { -dev_err (sspi->dev,"failed to transfer. status: 0x%x\n" , - status); -return status; +if (status ==0 ) { +dev_err (sspi->dev,"failed to transfer. Timeout.\n" ); +return -ETIMEDOUT ; }return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 129/357 ASoC: dapm: declare missing structure prototypes
In reply to Greg Kroah-HartmanFrom: Tzung-Bi Shih <[email protected]>
[ Upstream commit 3d62ef4280a377bb2ccaee4e8f6c5093f5b8f9d4 ]
To fix compilation warnings:
- struct 'snd_soc_pcm_runtime' declared inside parameter list will not be visible outside of this definition or declaration
- struct 'soc_enum' declared inside parameter list will not be visible outside of this definition or declaration
Declares the missing structure prototypes.
Stable-dep-of: fdff966bfde7 ("ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared")
--- include/sound/soc-dapm.h | 2 ++ 1 file changed, 2 insertions(+)
include/sound/soc-dapm.h +2 -0
@@ -16,6 +16,8 @@#include <sound/asoc.h> struct device ; +struct snd_soc_pcm_runtime ; +struct soc_enum ;/* widget has no PM register bit */ #define SND_SOC_NOPM -1
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 130/357 ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
In reply to Greg Kroah-HartmanFrom: Lucas Tanure <[email protected]>
[ Upstream commit fdff966bfde7cf0c85562d2bfb1ff1ba83da5f7b ]
Add struct snd_pcm_substream forward declaration
--- include/sound/soc-dapm.h | 1 + 1 file changed, 1 insertion(+)
include/sound/soc-dapm.h +1 -0
@@ -16,6 +16,7 @@#include <sound/asoc.h> struct device ; +struct snd_pcm_substream ;struct snd_soc_pcm_runtime ;struct soc_enum ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 131/357 HID: bigben: use spinlock to protect concurrent accesses
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 ]
bigben driver has a worker that may access data concurrently. Proct the accesses using a spinlock.
--- drivers/hid/hid-bigbenff.c | 52 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 50 insertions(+), 2 deletions(-)
drivers/hid/hid-bigbenff.c +50 -2
@@ -174,6 +174,7 @@ static __u8 pid0902_rdesc_fixed[] = {struct bigben_device {struct hid_device *hid;struct hid_report *report; +spinlock_t lock;bool removed;u8 led_state;/* LED1 = 1 .. LED4 = 8 */ u8 right_motor_on;/* right motor off/on 0/1 */
@@ -190,12 +191,27 @@ static void bigben_worker(struct work_struct *work)struct bigben_device *bigben =container_of (work, struct bigben_device, worker);struct hid_field *report_field = bigben->report->field[0 ]; +bool do_work_led = false; +bool do_work_ff = false; +u8 *buf; +u32 len; +unsigned long flags;if (bigben->removed || !report_field)return ; + buf =hid_alloc_report_buf (bigben->report,GFP_KERNEL ); +if (!buf) +return ; + + len =hid_report_len (bigben->report); + +/* LED work */ +spin_lock_irqsave (&bigben->lock, flags); +if (bigben->work_led) { bigben->work_led = false; + do_work_led = true; report_field->value[0 ] =0x01 ;/* 1 = led message */ report_field->value[1 ] =0x08 ;/* reserved value, always 8 */ report_field->value[2 ] = bigben->led_state;
@@ -204,11 +220,22 @@ static void bigben_worker(struct work_struct *work) report_field->value[5 ] =0x00 ;/* padding */ report_field->value[6 ] =0x00 ;/* padding */ report_field->value[7 ] =0x00 ;/* padding */ -hid_hw_request (bigben->hid, bigben->report,HID_REQ_SET_REPORT ); +hid_output_report (bigben->report, buf); + } + +spin_unlock_irqrestore (&bigben->lock, flags); + +if (do_work_led) { +hid_hw_raw_request (bigben->hid, bigben->report->id, buf, len, + bigben->report->type,HID_REQ_SET_REPORT ); } +/* FF work */ +spin_lock_irqsave (&bigben->lock, flags); +if (bigben->work_ff) { bigben->work_ff = false; + do_work_ff = true; report_field->value[0 ] =0x02 ;/* 2 = rumble effect message */ report_field->value[1 ] =0x08 ;/* reserved value, always 8 */ report_field->value[2 ] = bigben->right_motor_on;
@@ -217,8 +244,17 @@ static void bigben_worker(struct work_struct *work) report_field->value[5 ] =0x00 ;/* padding */ report_field->value[6 ] =0x00 ;/* padding */ report_field->value[7 ] =0x00 ;/* padding */ -hid_hw_request (bigben->hid, bigben->report,HID_REQ_SET_REPORT ); +hid_output_report (bigben->report, buf); + } + +spin_unlock_irqrestore (&bigben->lock, flags); + +if (do_work_ff) { +hid_hw_raw_request (bigben->hid, bigben->report->id, buf, len, + bigben->report->type,HID_REQ_SET_REPORT ); } + +kfree (buf); } static int hid_bigben_play_effect(struct input_dev *dev, void *data,
@@ -228,6 +264,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data,struct bigben_device *bigben =hid_get_drvdata (hid);u8 right_motor_on;u8 left_motor_force; +unsigned long flags;if (!bigben) {hid_err (hid,"no device data\n" );
@@ -242,9 +279,12 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data,if (right_motor_on != bigben->right_motor_on || left_motor_force != bigben->left_motor_force) { +spin_lock_irqsave (&bigben->lock, flags); bigben->right_motor_on = right_motor_on; bigben->left_motor_force = left_motor_force; bigben->work_ff = true; +spin_unlock_irqrestore (&bigben->lock, flags); +schedule_work (&bigben->worker); }
@@ -259,6 +299,7 @@ static void bigben_set_led(struct led_classdev *led,struct bigben_device *bigben =hid_get_drvdata (hid);int n;bool work; +unsigned long flags;if (!bigben) {hid_err (hid,"no device data\n" );
@@ -267,6 +308,7 @@ static void bigben_set_led(struct led_classdev *led,for (n =0 ; n <NUM_LEDS ; n++) {if (led == bigben->leds[n]) { +spin_lock_irqsave (&bigben->lock, flags);if (value ==LED_OFF ) { work = (bigben->led_state &BIT (n)); bigben->led_state &= ~BIT (n);
@@ -274,6 +316,7 @@ static void bigben_set_led(struct led_classdev *led, work = !(bigben->led_state &BIT (n)); bigben->led_state |=BIT (n); } +spin_unlock_irqrestore (&bigben->lock, flags);if (work) { bigben->work_led = true;
@@ -307,8 +350,12 @@ static enum led_brightness bigben_get_led(struct led_classdev *led)static void bigben_remove (struct hid_device *hid) {struct bigben_device *bigben =hid_get_drvdata (hid); +unsigned long flags; +spin_lock_irqsave (&bigben->lock, flags); bigben->removed = true; +spin_unlock_irqrestore (&bigben->lock, flags); +cancel_work_sync (&bigben->worker);hid_hw_stop (hid); }
@@ -362,6 +409,7 @@ static int bigben_probe(struct hid_device *hid,set_bit (FF_RUMBLE , hidinput->input->ffbit);INIT_WORK (&bigben->worker, bigben_worker); +spin_lock_init (&bigben->lock); error =input_ff_create_memless (hidinput->input,NULL , hid_bigben_play_effect);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 132/357 HID: bigben_worker() remove unneeded check on report_field
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 27d2a2fd844ec7da70d19fabb482304fd1e0595b ]
bigben_worker() checks report_field to be non-NULL. The check has been added in commit918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") to prevent a NULL pointer crash.
However, the true root cause was a missing check for output reports, patched in commitc7bf714f8755 ("HID: check empty report_list in bigben_probe()"), where the type-confused report list_entry was overlapping with a NULL pointer, which was then causing the crash.
--- drivers/hid/hid-bigbenff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/hid-bigbenff.c +1 -1
@@ -197,7 +197,7 @@ static void bigben_worker(struct work_struct *work)u32 len;unsigned long flags; -if (bigben->removed || !report_field) +if (bigben->removed)return ; buf =hid_alloc_report_buf (bigben->report,GFP_KERNEL );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 133/357 HID: bigben: use spinlock to safely schedule workers
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 76ca8da989c7d97a7f76c75d475fe95a584439d7 ]
Use spinlocks to deal with workers introducing a wrapper bigben_schedule_work(), and several spinlock checks. Otherwise, bigben_set_led() may schedule bigben->worker after the structure has been freed, causing a use-after-free.
--- drivers/hid/hid-bigbenff.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
drivers/hid/hid-bigbenff.c +12 -6
@@ -185,6 +185,15 @@ struct bigben_device {struct work_struct worker; }; +static inline void bigben_schedule_work (struct bigben_device *bigben) +{ +unsigned long flags; + +spin_lock_irqsave (&bigben->lock, flags); +if (!bigben->removed) +schedule_work (&bigben->worker); +spin_unlock_irqrestore (&bigben->lock, flags); +}static void bigben_worker (struct work_struct *work) {
@@ -197,9 +206,6 @@ static void bigben_worker(struct work_struct *work)u32 len;unsigned long flags; -if (bigben->removed) -return ; - buf =hid_alloc_report_buf (bigben->report,GFP_KERNEL );if (!buf)return ;
@@ -285,7 +291,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, bigben->work_ff = true;spin_unlock_irqrestore (&bigben->lock, flags); -schedule_work (&bigben->worker); +bigben_schedule_work (bigben); }return 0 ;
@@ -320,7 +326,7 @@ static void bigben_set_led(struct led_classdev *led,if (work) { bigben->work_led = true; -schedule_work (&bigben->worker); +bigben_schedule_work (bigben); }return ; }
@@ -450,7 +456,7 @@ static int bigben_probe(struct hid_device *hid, bigben->left_motor_force =0 ; bigben->work_led = true; bigben->work_ff = true; -schedule_work (&bigben->worker); +bigben_schedule_work (bigben);hid_info (hid,"LED and force feedback support for BigBen gamepad\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 134/357 HID: asus: Only set EV_REP if we are adding a mapping
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 4e4c60f826772dfeaacdf718f64afa38f46b6875 ]
Make asus_input_mapping() only set EV_REP if we are adding a mapping.
The T100CHI bluetooth keyboard dock has a few input reports for which we do not create any mappings (these input-reports are present in the descriptors but never send).
The hid-asus code relies on the HID core not creating input devices for input-reports without any mappings. But the present of the EV_REP but counts as a mapping causing 6 /dev/input/event# nodes to be created for the T100CHI bluetooth keyboard dock. This change brings the amount of created /dev/input/event# nodes / input-devices down to 4.
Stable-dep-of: 4ab3a086d10e ("HID: asus: use spinlock to safely schedule workers")
--- drivers/hid/hid-asus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hid/hid-asus.c +2 -2
@@ -714,7 +714,6 @@ static int asus_input_mapping(struct hid_device *hdev,/* ASUS-specific keyboard hotkeys */ if ((usage->hid &HID_USAGE_PAGE ) ==0xff310000 ) { -set_bit (EV_REP , hi->input->evbit);switch (usage->hid &HID_USAGE ) {case 0x10 :asus_map_key_clear (KEY_BRIGHTNESSDOWN );break ;case 0x20 :asus_map_key_clear (KEY_BRIGHTNESSUP );break ;
@@ -757,11 +756,11 @@ static int asus_input_mapping(struct hid_device *hdev,if (drvdata->quirks &QUIRK_USE_KBD_BACKLIGHT ) drvdata->enable_backlight = true; +set_bit (EV_REP , hi->input->evbit);return 1 ; }if ((usage->hid &HID_USAGE_PAGE ) ==HID_UP_MSVENDOR ) { -set_bit (EV_REP , hi->input->evbit);switch (usage->hid &HID_USAGE ) {case 0xff01 :asus_map_key_clear (BTN_1 );break ;case 0xff02 :asus_map_key_clear (BTN_2 );break ;
@@ -784,6 +783,7 @@ static int asus_input_mapping(struct hid_device *hdev,return 0 ; } +set_bit (EV_REP , hi->input->evbit);return 1 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 135/357 HID: asus: Add report_size to struct asus_touchpad_info
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit a61f9e428bf092349fdfebeee37ddefedd3f0fd1 ]
Add the report_size to struct asus_touchpad_info instead of calculating it.
This is a preparation patch for adding support for the multi-touch touchpad found on the Medion Akoya E1239T's keyboard-dock, which uses the same custom multi-touch protocol as the Asus keyboard-docks (same chipset vendor, Integrated Technology Express / ITE).
The only difference in that the Akoya E1239T keyboard-dock's input-reports have a 5 byte footer instead of a 1 byte footer, which requires the report_size to be configurable per touchpad-model.
Stable-dep-of: 4ab3a086d10e ("HID: asus: use spinlock to safely schedule workers")
--- drivers/hid/hid-asus.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/hid/hid-asus.c +7 -1
@@ -103,6 +103,7 @@ struct asus_touchpad_info {int res_y;int contact_size;int max_contacts; +int report_size; };struct asus_drvdata {
@@ -127,6 +128,7 @@ static const struct asus_touchpad_info asus_i2c_tp = { .max_y = 1758, .contact_size = 5, .max_contacts = 5, + .report_size = 28 /* 2 byte header + 5 * 5 + 1 byte footer */, };static const struct asus_touchpad_info asus_t100ta_tp = {
@@ -136,6 +138,7 @@ static const struct asus_touchpad_info asus_t100ta_tp = { .res_y = 27, /* units/mm */ .contact_size = 5, .max_contacts = 5, + .report_size = 28 /* 2 byte header + 5 * 5 + 1 byte footer */, };static const struct asus_touchpad_info asus_t100ha_tp = {
@@ -145,6 +148,7 @@ static const struct asus_touchpad_info asus_t100ha_tp = { .res_y = 29, /* units/mm */ .contact_size = 5, .max_contacts = 5, + .report_size = 28 /* 2 byte header + 5 * 5 + 1 byte footer */, };static const struct asus_touchpad_info asus_t200ta_tp = {
@@ -154,6 +158,7 @@ static const struct asus_touchpad_info asus_t200ta_tp = { .res_y = 28, /* units/mm */ .contact_size = 5, .max_contacts = 5, + .report_size = 28 /* 2 byte header + 5 * 5 + 1 byte footer */, };static const struct asus_touchpad_info asus_t100chi_tp = {
@@ -163,6 +168,7 @@ static const struct asus_touchpad_info asus_t100chi_tp = { .res_y = 29, /* units/mm */ .contact_size = 3, .max_contacts = 4, + .report_size = 15 /* 2 byte header + 3 * 4 + 1 byte footer */, }; static void asus_report_contact_down(struct asus_drvdata *drvdat,
@@ -230,7 +236,7 @@ static int asus_report_input(struct asus_drvdata *drvdat, u8 *data, int size)int i, toolType =MT_TOOL_FINGER ;u8 *contactData = data +2 ; -if (size !=3 + drvdat->tp->contact_size * drvdat->tp->max_contacts) +if (size != drvdat->tp->report_size)return 0 ;for (i =0 ; i < drvdat->tp->max_contacts; i++) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 136/357 HID: asus: Add support for multi-touch touchpad on Medion Akoya E1239T
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit e271f6c2df78d60dd4873c790a51dba40e6dfb72 ]
The multi-touch touchpad found on the Medion Akoya E1239T's keyboard-dock, uses the same custom multi-touch protocol as the Asus keyboard-docks (same chipset vendor, Integrated Technology Express / ITE).
Add support for this using the existing multi-touch touchpad support in the hid-asus driver.
Stable-dep-of: 4ab3a086d10e ("HID: asus: use spinlock to safely schedule workers")
--- drivers/hid/hid-asus.c | 26 +++++++++++++++++++++++++- drivers/hid/hid-ids.h | 1 + 2 files changed, 26 insertions(+), 1 deletion(-)
drivers/hid/hid-asus.c +25 -1
@@ -40,6 +40,7 @@ MODULE_AUTHOR("Frederik Wenigwieser <[email protected]>");MODULE_DESCRIPTION ("Asus HID Keyboard and TouchPad" );#define T100_TPAD_INTF 2 +#define MEDION_E1239T_TPAD_INTF 1#define T100CHI_MOUSE_REPORT_ID 0x06#define FEATURE_REPORT_ID 0x0d
@@ -77,6 +78,7 @@ MODULE_DESCRIPTION("Asus HID Keyboard and TouchPad");#define QUIRK_G752_KEYBOARD BIT(8)#define QUIRK_T101HA_DOCK BIT(9)#define QUIRK_T90CHI BIT(10) +#define QUIRK_MEDION_E1239T BIT(11)#define I2C_KEYBOARD_QUIRKS (QUIRK_FIX_NOTEBOOK_REPORT | \ QUIRK_NO_INIT_REPORTS | \
@@ -171,6 +173,16 @@ static const struct asus_touchpad_info asus_t100chi_tp = { .report_size = 15 /* 2 byte header + 3 * 4 + 1 byte footer */, }; +static const struct asus_touchpad_info medion_e1239t_tp = { + .max_x =2640 , + .max_y =1380 , + .res_x =29 ,/* units/mm */ + .res_y =28 ,/* units/mm */ + .contact_size =5 , + .max_contacts =5 , + .report_size =32 /* 2 byte header + 5 * 5 + 5 byte footer */ , +}; +static void asus_report_contact_down (struct asus_drvdata *drvdat,int toolType,u8 *data) {
@@ -903,6 +915,17 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) drvdata->tp = &asus_t100chi_tp; } +if ((drvdata->quirks &QUIRK_MEDION_E1239T ) && +hid_is_using_ll_driver (hdev, &usb_hid_driver)) { +struct usb_host_interface *alt = +to_usb_interface (hdev->dev.parent)->altsetting; + +if (alt->desc.bInterfaceNumber ==MEDION_E1239T_TPAD_INTF ) { + drvdata->quirks |=QUIRK_SKIP_INPUT_MAPPING ; + drvdata->tp = &medion_e1239t_tp; + } + } +if (drvdata->quirks &QUIRK_NO_INIT_REPORTS ) hdev->quirks |=HID_QUIRK_NO_INIT_REPORTS ;
@@ -1086,7 +1109,8 @@ static const struct hid_device_id asus_devices[] = { { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_ASUS_MD_5112) }, { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_T100CHI_KEYBOARD), QUIRK_T100CHI }, - + { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE_MEDION_E1239T), + QUIRK_MEDION_E1239T }, { } };MODULE_DEVICE_TABLE (hid, asus_devices);
drivers/hid/hid-ids.h +1 -0
@@ -650,6 +650,7 @@#define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720 0x837a#define USB_DEVICE_ID_ITE_LENOVO_YOGA900 0x8396#define USB_DEVICE_ID_ITE8595 0x8595 +#define USB_DEVICE_ID_ITE_MEDION_E1239T 0xce50#define USB_VENDOR_ID_JABRA 0x0b0e#define USB_DEVICE_ID_JABRA_SPEAK_410 0x0412
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 137/357 HID: asus: Fix mute and touchpad-toggle keys on Medion Akoya E1239T
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 350bd245fc180032b442633d40ab37ff8e60e8eb ]
The mute key, is broken. All the consumer keys on the keyboard USB interface work normally, except for mute which only sends press events and never sends release events.
The touchpad key sends the otherwise unused input report with a report-id of 5 on the touchpad interface. It too only sends press events. This also requires extra special handling since the multi-touch touchpad events and the KEY_F21 events for the touchpad toggle must not be send from the same input_dev (userspace cannot handle this).
This commit adds special handlig for both, fixing these keys not working.
Stable-dep-of: 4ab3a086d10e ("HID: asus: use spinlock to safely schedule workers")
--- drivers/hid/hid-asus.c | 60 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+)
drivers/hid/hid-asus.c +60 -0
@@ -42,6 +42,7 @@ MODULE_DESCRIPTION("Asus HID Keyboard and TouchPad");#define T100_TPAD_INTF 2#define MEDION_E1239T_TPAD_INTF 1 +#define E1239T_TP_TOGGLE_REPORT_ID 0x05#define T100CHI_MOUSE_REPORT_ID 0x06#define FEATURE_REPORT_ID 0x0d#define INPUT_REPORT_ID 0x5d
@@ -112,6 +113,7 @@ struct asus_drvdata {unsigned long quirks;struct hid_device *hdev;struct input_dev *input; +struct input_dev *tp_kbd_input;struct asus_kbd_leds *kbd_backlight;const struct asus_touchpad_info *tp;bool enable_backlight;
@@ -276,6 +278,34 @@ static int asus_report_input(struct asus_drvdata *drvdat, u8 *data, int size)return 1 ; } +static int asus_e1239t_event (struct asus_drvdata *drvdat,u8 *data,int size) +{ +if (size !=3 ) +return 0 ; + +/* Handle broken mute key which only sends press events */ +if (!drvdat->tp && + data[0 ] ==0x02 && data[1 ] ==0xe2 && data[2 ] ==0x00 ) { +input_report_key (drvdat->input,KEY_MUTE ,1 ); +input_sync (drvdat->input); +input_report_key (drvdat->input,KEY_MUTE ,0 ); +input_sync (drvdat->input); +return 1 ; + } + +/* Handle custom touchpad toggle key which only sends press events */ +if (drvdat->tp_kbd_input && + data[0 ] ==0x05 && data[1 ] ==0x02 && data[2 ] ==0x28 ) { +input_report_key (drvdat->tp_kbd_input,KEY_F21 ,1 ); +input_sync (drvdat->tp_kbd_input); +input_report_key (drvdat->tp_kbd_input,KEY_F21 ,0 ); +input_sync (drvdat->tp_kbd_input); +return 1 ; + } + +return 0 ; +} +static int asus_event (struct hid_device *hdev,struct hid_field *field,struct hid_usage *usage,__s32 value) {
@@ -300,6 +330,9 @@ static int asus_raw_event(struct hid_device *hdev,if (drvdata->tp && data[0 ] ==INPUT_REPORT_ID )return asus_report_input (drvdata, data, size); +if (drvdata->quirks &QUIRK_MEDION_E1239T ) +return asus_e1239t_event (drvdata, data, size); +return 0 ; }
@@ -653,6 +686,21 @@ static int asus_input_configured(struct hid_device *hdev, struct hid_input *hi) hi->report->id != T100CHI_MOUSE_REPORT_ID)return 0 ; +/* Handle MULTI_INPUT on E1239T mouse/touchpad USB interface */ +if (drvdata->tp && (drvdata->quirks &QUIRK_MEDION_E1239T )) { +switch (hi->report->id) { +case E1239T_TP_TOGGLE_REPORT_ID : +input_set_capability (input,EV_KEY ,KEY_F21 ); + input->name ="Asus Touchpad Keys" ; + drvdata->tp_kbd_input = input; +return 0 ; +case INPUT_REPORT_ID : +break ;/* Touchpad report, handled below */ +default : +return 0 ;/* Ignore other reports */ + } + } +if (drvdata->tp) {int ret;
@@ -820,6 +868,16 @@ static int asus_input_mapping(struct hid_device *hdev, } } +/* +* The mute button is broken and only sends press events, we +* deal with this in our raw_event handler, so do not map it. +*/ +if ((drvdata->quirks &QUIRK_MEDION_E1239T ) && + usage->hid == (HID_UP_CONSUMER |0xe2 )) { +input_set_capability (hi->input,EV_KEY ,KEY_MUTE ); +return -1 ; + } +return 0 ; }
@@ -921,6 +979,8 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)to_usb_interface (hdev->dev.parent)->altsetting;if (alt->desc.bInterfaceNumber ==MEDION_E1239T_TPAD_INTF ) { +/* For separate input-devs for tp and tp toggle key */ + hdev->quirks |=HID_QUIRK_MULTI_INPUT ; drvdata->quirks |=QUIRK_SKIP_INPUT_MAPPING ; drvdata->tp = &medion_e1239t_tp; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 138/357 hid: bigben_probe(): validate report count
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit b94335f899542a0da5fafc38af8edcaf90195843 ]
bigben_probe() does not validate that the output report has the needed report values in the first field.
A malicious device registering a report with one field and a single value causes an head OOB write in bigben_worker() when accessing report_field->value[1] to report_field->value[7]. Use hid_validate_values() which takes care of all the needed checks.
--- drivers/hid/hid-bigbenff.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/hid/hid-bigbenff.c +2 -5
@@ -371,7 +371,6 @@ static int bigben_probe(struct hid_device *hid, {struct bigben_device *bigben;struct hid_input *hidinput; -struct list_head *report_list;struct led_classdev *led;char *name;size_t name_sz;
@@ -396,14 +395,12 @@ static int bigben_probe(struct hid_device *hid,return error; } - report_list = &hid->report_enum[HID_OUTPUT_REPORT ].report_list; -if (list_empty (report_list)) { + bigben->report =hid_validate_values (hid,HID_OUTPUT_REPORT ,0 ,0 ,8 ); +if (!bigben->report) {hid_err (hid,"no output report found\n" ); error = -ENODEV ; goto error_hw_stop; } - bigben->report =list_entry (report_list->next, - struct hid_report, list);if (list_empty (&hid->inputs)) {hid_err (hid,"no inputs found\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 139/357 nfsd: fix race to check ls_layouts
In reply to Greg Kroah-HartmanFrom: Benjamin Coddington <[email protected]>
[ Upstream commit fb610c4dbc996415d57d7090957ecddd4fd64fb6 ]
Its possible for __break_lease to find the layout's lease before we've added the layout to the owner's ls_layouts list. In that case, setting ls_recalled = true without actually recalling the layout will cause the server to never send a recall callback.
Move the check for ls_layouts before setting ls_recalled.
--- fs/nfsd/nfs4layouts.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfsd/nfs4layouts.c +2 -2
@@ -322,11 +322,11 @@ nfsd4_recall_file_layout(struct nfs4_layout_stateid *ls)if (ls->ls_recalled) goto out_unlock; - ls->ls_recalled = true; -atomic_inc (&ls->ls_stid.sc_file->fi_lo_recalls);if (list_empty (&ls->ls_layouts)) goto out_unlock; + ls->ls_recalled = true; +atomic_inc (&ls->ls_stid.sc_file->fi_lo_recalls);trace_nfsd_layout_recall (&ls->ls_stid.sc_stateid);refcount_inc (&ls->ls_stid.sc_count);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 140/357 cifs: Fix lost destroy smbd connection when MR allocate failed
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
[ Upstream commit e9d3401d95d62a9531082cd2453ed42f2740e3fd ]
If the MR allocate failed, the smb direct connection info is NULL, then smbd_destroy() will directly return, then the connection info will be leaked.
Let's set the smb direct connection info to the server before call smbd_destroy().
--- fs/cifs/smbdirect.c | 1 + 1 file changed, 1 insertion(+)
fs/cifs/smbdirect.c +1 -0
@@ -1784,6 +1784,7 @@ static struct smbd_connection *_smbd_get_connection( allocate_mr_failed:/* At this point, need to a full transport shutdown */ + server->smbd_conn = info;smbd_destroy (server);return NULL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 141/357 cifs: Fix warning and UAF when destroy the MR list
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
[ Upstream commit 3e161c2791f8e661eed24a2c624087084d910215 ]
If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR:
WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 RIP: 0010:__flush_work.isra.0+0xf7/0x110 Call Trace: <TASK> __cancel_work_timer+0x2ba/0x2e0 smbd_destroy+0x4e1/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 Call Trace: dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 smbd_destroy+0x4fc/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Allocated by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7a/0x90 _smbd_get_connection+0x1b6f/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 __kmem_cache_free+0xc8/0x330 _smbd_get_connection+0x1c6a/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Let's initialize the MR recovery work before MR allocate to prevent the warning, remove the MRs from the list to prevent the UAF.
--- fs/cifs/smbdirect.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/cifs/smbdirect.c +2 -1
@@ -2348,6 +2348,7 @@ static int allocate_mr_list(struct smbd_connection *info)atomic_set (&info->mr_ready_count,0 );atomic_set (&info->mr_used_count,0 );init_waitqueue_head (&info->wait_for_mr_cleanup); +INIT_WORK (&info->mr_recovery_work, smbd_mr_recovery_work);/* Allocate more MRs (2x) than hardware responder_resources */ for (i =0 ; i < info->responder_resources *2 ; i++) { smbdirect_mr =kzalloc (sizeof (*smbdirect_mr),GFP_KERNEL );
@@ -2376,13 +2377,13 @@ static int allocate_mr_list(struct smbd_connection *info)list_add_tail (&smbdirect_mr->list, &info->mr_list);atomic_inc (&info->mr_ready_count); } -INIT_WORK (&info->mr_recovery_work, smbd_mr_recovery_work);return 0 ; out:kfree (smbdirect_mr);list_for_each_entry_safe (smbdirect_mr, tmp, &info->mr_list, list) { +list_del (&smbdirect_mr->list);ib_dereg_mr (smbdirect_mr->mr);kfree (smbdirect_mr->sgl);kfree (smbdirect_mr);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 142/357 gfs2: jdata writepage fix
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit cbb60951ce18c9b6e91d2eb97deb41d8ff616622 ]
The ->writepage() and ->writepages() operations are supposed to write entire pages. However, on filesystems with a block size smaller than PAGE_SIZE, __gfs2_jdata_writepage() only adds the first block to the current transaction instead of adding the entire page. Fix that.
--- fs/gfs2/aops.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/gfs2/aops.c +1 -2
@@ -156,7 +156,6 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w {struct inode *inode = page->mapping->host;struct gfs2_inode *ip =GFS2_I (inode); -struct gfs2_sbd *sdp =GFS2_SB (inode);if (PageChecked (page)) {ClearPageChecked (page);
@@ -164,7 +163,7 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *wcreate_empty_buffers (page, inode->i_sb->s_blocksize,BIT (BH_Dirty)|BIT (BH_Uptodate)); } -gfs2_page_add_databufs (ip, page,0 , sdp->sd_vfs->s_blocksize); +gfs2_page_add_databufs (ip, page,0 ,PAGE_SIZE ); }return gfs2_write_full_page (page, gfs2_get_block_noalloc, wbc); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 143/357 perf llvm: Fix inadvertent file creation
In reply to Greg Kroah-HartmanFrom: Ian Rogers <[email protected]>
[ Upstream commit 9f19aab47ced012eddef1e2bc96007efc7713b61 ]
The LLVM template is first echo-ed into command_out and then command_out executed. The echo surrounds the template with double quotes, however, the template itself may contain quotes. This is generally innocuous but in tools/perf/tests/bpf-script-test-prologue.c we see:
...SEC("func=null_lseek file->f_mode offset orig")
...
where the first double quote ends the double quote of the echo, then the > redirects output into a file called f_mode.
To avoid this inadvertent behavior substitute redirects and similar characters to be ASCII control codes, then substitute the output in the echo back again.
--- tools/perf/util/llvm-utils.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
tools/perf/util/llvm-utils.c +24 -1
@@ -523,14 +523,37 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,pr_debug ("llvm compiling command template: %s\n" , template); +/* +* Below, substitute control characters for values that can cause the +* echo to misbehave, then substitute the values back. +*/ err = -ENOMEM ; -if (asprintf (&command_echo,"echo -n \"%s\"" , template) <0 ) +if (asprintf (&command_echo,"echo -n \a%s\a" , template) <0 ) goto errout; +#define SWAP_CHAR (a, b) do { if (*p == a) *p = b; } while (0) +for (char *p = command_echo; *p; p++) { +SWAP_CHAR ('<' ,'\001' ); +SWAP_CHAR ('>' ,'\002' ); +SWAP_CHAR ('"' ,'\003' ); +SWAP_CHAR ('\'' ,'\004' ); +SWAP_CHAR ('|' ,'\005' ); +SWAP_CHAR ('&' ,'\006' ); +SWAP_CHAR ('\a' ,'"' ); + } err =read_from_pipe (command_echo, (void **) &command_out,NULL );if (err) goto errout; +for (char *p = command_out; *p; p++) { +SWAP_CHAR ('\001' ,'<' ); +SWAP_CHAR ('\002' ,'>' ); +SWAP_CHAR ('\003' ,'"' ); +SWAP_CHAR ('\004' ,'\'' ); +SWAP_CHAR ('\005' ,'|' ); +SWAP_CHAR ('\006' ,'&' ); + } +#undef SWAP_CHARpr_debug ("llvm compiling command : %s\n" , command_out); err =read_from_pipe (template, &obj_buf, &obj_buf_sz);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 144/357 perf tools: Fix auto-complete on aarch64
In reply to Greg Kroah-HartmanFrom: Yicong Yang <[email protected]>
[ Upstream commit ffd1240e8f0814262ceb957dbe961f6e0aef1e7a ]
On aarch64 CPU related events are not under event_source/devices/cpu/events, they're under event_source/devices/armv8_pmuv3_0/events on my machine. Using current auto-complete script will generate below error:
[root@localhost bin]# perf stat -e
ls: cannot access '/sys/bus/event_source/devices/cpu/events': No such file or directory
Fix this by not testing /sys/bus/event_source/devices/cpu/events on aarch64 machine.
--- tools/perf/perf-completion.sh | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
tools/perf/perf-completion.sh +8 -3
@@ -165,7 +165,12 @@ __perf_main () local cur1=${COMP_WORDS[COMP_CWORD]} local raw_evts=$($cmd list --raw-dump) - local arr s tmp result + local arr s tmp result cpu_evts + + # aarch64 doesn't have /sys/bus/event_source/devices/cpu/events + if [[ `uname -m` != aarch64 ]]; then + cpu_evts=$(ls /sys/bus/event_source/devices/cpu/events) + fi if [[ "$cur1" == */* && ${cur1#*/} =~ ^[A-Z] ]]; then OLD_IFS="$IFS"
@@ -183,9 +188,9 @@ __perf_main () fi done - evts=${result}" "$(ls /sys/bus/event_source/devices/cpu/events) + evts=${result}" "${cpu_evts} else - evts=${raw_evts}" "$(ls /sys/bus/event_source/devices/cpu/events) + evts=${raw_evts}" "${cpu_evts} fi if [[ "$cur1" == , ]]; then
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 145/357 sparc: allow PM configs for sparc32 COMPILE_TEST
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 7be6a87c2473957090995b7eb541e31d57a2c801 ]
When doing randconfig builds for sparc32 with COMPILE_TEST, some (non-Sparc) drivers cause kconfig warnings with the Kconfig symbols PM, PM_GENERIC_DOMAINS, or PM_GENERIC_DOMAINS_OF.
This is due to arch/sparc/Kconfig not using the PM Kconfig for Sparc32:
if SPARC64
source "kernel/power/Kconfig"
endif
Arnd suggested adding "|| COMPILE_TEST" to the conditional, instead of trying to track down every driver that selects any of these PM symbols.
Fixes the following kconfig warnings:
WARNING: unmet direct dependencies detected for PM
Depends on [n]: SPARC64 [=n]
Selected by [y]:
- SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
WARNING: unmet direct dependencies detected for PM
Depends on [n]: SPARC64 [=n]
Selected by [y]:
- SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS
Depends on [n]: SPARC64 [=n] && PM [=y]
Selected by [y]:
- QCOM_GDSC [=y] && COMMON_CLK [=y] && PM [=y]
- SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
- MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
- BCM2835_POWER [=y] && (ARCH_BCM2835 || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
- BCM_PMB [=y] && (ARCH_BCMBCA || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
- ROCKCHIP_PM_DOMAINS [=y] && (ARCH_ROCKCHIP || COMPILE_TEST [=y]) && PM [=y] Selected by [m]:
- ARM_SCPI_POWER_DOMAIN [=m] && (ARM_SCPI_PROTOCOL [=m] || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
- MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
- QCOM_AOSS_QMP [=m] && (ARCH_QCOM || COMPILE_TEST [=y]) && MAILBOX [=y] && COMMON_CLK [=y] && PM [=y]
WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS_OF
Depends on [n]: SPARC64 [=n] && PM_GENERIC_DOMAINS [=y] && OF [=y] Selected by [y]:
- MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] Selected by [m]:
- MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
--- arch/sparc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/sparc/Kconfig +1 -1
@@ -321,7 +321,7 @@ config FORCE_MAX_ZONEORDER This config option is actually maximum order plus one. For example, a value of 13 means that the largest free memory block is 2^12 pages. -if SPARC64 +if SPARC64 || COMPILE_TEST source "kernel/power/Kconfig" endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 146/357 selftests/ftrace: Fix bash specific "==" operator
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit 1e6b485c922fbedf41d5a9f4e6449c5aeb923a32 ]
Since commit a1d6cd88c897 ("selftests/ftrace: event_triggers: wait longer for test_event_enable") introduced bash specific "==" comparation operator, that test will fail when we run it on a posix-shell. checkbashisms warned it as below.
possible bashism in ftrace/func_event_triggers.tc line 45 (should be 'b = a'):
if [ "$e" == $val ]; then
This replaces it with "=".
--- .../selftests/ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc +1 -1
@@ -46,7 +46,7 @@ test_event_enabled() { while [ $check_times -ne 0 ]; do e=`cat $EVENT_ENABLE` - if [ "$e" == $val ]; then + if [ "$e" = $val ]; then return 0 fi sleep $SLEEP_TIME
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 147/357 mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
In reply to Greg Kroah-HartmanFrom: Qiheng Lin <[email protected]>
[ Upstream commit 8b450dcff23aa254844492831a8e2b508a9d522d ]
req is allocated in pcf50633_adc_async_read(), but adc_enqueue_request() could fail to insert the req into queue. We need to check the return value and free it in the case of failure.
--- drivers/mfd/pcf50633-adc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/mfd/pcf50633-adc.c +6 -1
@@ -136,6 +136,7 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, void *callback_param) {struct pcf50633_adc_request *req; +int ret;/* req is freed when the result is ready, in interrupt handler */ req =kmalloc (sizeof (*req),GFP_KERNEL );
@@ -147,7 +148,11 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, req->callback = callback; req->callback_param = callback_param; -return adc_enqueue_request (pcf, req); + ret =adc_enqueue_request (pcf, req); +if (ret) +kfree (req); + +return ret; }EXPORT_SYMBOL_GPL (pcf50633_adc_async_read);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 148/357 clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 712c64caf31374de57aa193a9dff57172b2f6f82 ]
On the QCS404 platform the driver for the Global Clock Controller doens't define gpll0_out_aux and gpll4_out_aux clocks, so it's not possible to use them as parents. Remove entries for these clocks.
Note: backporting this patch to earlier kernels would also require a previous patch which switches the gcc driver to use ARRAY_SIZE for parent data arrays.
--- drivers/clk/qcom/gcc-qcs404.c | 16 ---------------- 1 file changed, 16 deletions(-)
drivers/clk/qcom/gcc-qcs404.c +0 -16
@@ -25,11 +25,9 @@ enum {P_CORE_BI_PLL_TEST_SE ,P_DSI0_PHY_PLL_OUT_BYTECLK ,P_DSI0_PHY_PLL_OUT_DSICLK , -P_GPLL0_OUT_AUX ,P_GPLL0_OUT_MAIN ,P_GPLL1_OUT_MAIN ,P_GPLL3_OUT_MAIN , -P_GPLL4_OUT_AUX ,P_GPLL4_OUT_MAIN ,P_GPLL6_OUT_AUX , P_HDMI_PHY_PLL_CLK,
@@ -109,28 +107,24 @@ static const char * const gcc_parent_names_4[] = {static const struct parent_map gcc_parent_map_5[] = { {P_XO ,0 }, {P_DSI0_PHY_PLL_OUT_BYTECLK ,1 }, - {P_GPLL0_OUT_AUX ,2 }, {P_CORE_BI_PLL_TEST_SE ,7 }, };static const char *const gcc_parent_names_5[] = {"cxo" ,"dsi0pll_byteclk_src" , -"gpll0_out_aux" ,"core_bi_pll_test_se" , };static const struct parent_map gcc_parent_map_6[] = { {P_XO ,0 }, {P_DSI0_PHY_PLL_OUT_BYTECLK ,2 }, - {P_GPLL0_OUT_AUX ,3 }, {P_CORE_BI_PLL_TEST_SE ,7 }, };static const char *const gcc_parent_names_6[] = {"cxo" ,"dsi0_phy_pll_out_byteclk" , -"gpll0_out_aux" ,"core_bi_pll_test_se" , };
@@ -139,7 +133,6 @@ static const struct parent_map gcc_parent_map_7[] = { { P_GPLL0_OUT_MAIN, 1 }, { P_GPLL3_OUT_MAIN, 2 }, { P_GPLL6_OUT_AUX, 3 }, - { P_GPLL4_OUT_AUX, 4 }, { P_CORE_BI_PLL_TEST_SE, 7 }, };
@@ -148,7 +141,6 @@ static const char * const gcc_parent_names_7[] = {"gpll0_out_main" ,"gpll3_out_main" ,"gpll6_out_aux" , -"gpll4_out_aux" , "core_bi_pll_test_se", };
@@ -207,14 +199,12 @@ static const char * const gcc_parent_names_11[] = {static const struct parent_map gcc_parent_map_12[] = { {P_XO ,0 }, {P_DSI0_PHY_PLL_OUT_DSICLK ,1 }, - {P_GPLL0_OUT_AUX ,2 }, {P_CORE_BI_PLL_TEST_SE ,7 }, };static const char *const gcc_parent_names_12[] = {"cxo" ,"dsi0pll_pclk_src" , -"gpll0_out_aux" ,"core_bi_pll_test_se" , };
@@ -237,40 +227,34 @@ static const char * const gcc_parent_names_13[] = {static const struct parent_map gcc_parent_map_14[] = { {P_XO ,0 }, {P_GPLL0_OUT_MAIN ,1 }, - {P_GPLL4_OUT_AUX ,2 }, {P_CORE_BI_PLL_TEST_SE ,7 }, };static const char *const gcc_parent_names_14[] = {"cxo" ,"gpll0_out_main" , -"gpll4_out_aux" ,"core_bi_pll_test_se" , };static const struct parent_map gcc_parent_map_15[] = { {P_XO ,0 }, - {P_GPLL0_OUT_AUX ,2 }, {P_CORE_BI_PLL_TEST_SE ,7 }, };static const char *const gcc_parent_names_15[] = {"cxo" , -"gpll0_out_aux" ,"core_bi_pll_test_se" , };static const struct parent_map gcc_parent_map_16[] = { {P_XO ,0 }, {P_GPLL0_OUT_MAIN ,1 }, - {P_GPLL0_OUT_AUX ,2 }, {P_CORE_BI_PLL_TEST_SE ,7 }, };static const char *const gcc_parent_names_16[] = {"cxo" ,"gpll0_out_main" , -"gpll0_out_aux" ,"core_bi_pll_test_se" , };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 149/357 clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 47d94d30cd3dcc743241b4208b1eec7247610c84 ]
The QCS404 uses 28nm LPM DSI PHY, which registers dsi0pll and dsi0pllbyte clocks. Fix all DSI PHY clock names used as parents inside the GCC driver.
--- drivers/clk/qcom/gcc-qcs404.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/clk/qcom/gcc-qcs404.c +4 -4
@@ -112,7 +112,7 @@ static const struct parent_map gcc_parent_map_5[] = {static const char *const gcc_parent_names_5[] = {"cxo" , -"dsi0pll_byteclk_src" , +"dsi0pllbyte" ,"core_bi_pll_test_se" , };
@@ -124,7 +124,7 @@ static const struct parent_map gcc_parent_map_6[] = {static const char *const gcc_parent_names_6[] = {"cxo" , -"dsi0_phy_pll_out_byteclk" , +"dsi0pllbyte" ,"core_bi_pll_test_se" , };
@@ -167,7 +167,7 @@ static const struct parent_map gcc_parent_map_9[] = {static const char *const gcc_parent_names_9[] = {"cxo" ,"gpll0_out_main" , -"dsi0_phy_pll_out_dsiclk" , +"dsi0pll" ,"gpll6_out_aux" ,"core_bi_pll_test_se" , };
@@ -204,7 +204,7 @@ static const struct parent_map gcc_parent_map_12[] = {static const char *const gcc_parent_names_12[] = {"cxo" , -"dsi0pll_pclk_src" , +"dsi0pll" ,"core_bi_pll_test_se" , };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 150/357 mtd: rawnand: sunxi: Fix the size of the last OOB region
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 34569d869532b54d6e360d224a0254dcdd6a1785 ]
The previous code assigned to the wrong structure member.
--- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/sunxi_nand.c +1 -1
@@ -1587,7 +1587,7 @@ static int sunxi_nand_ooblayout_free(struct mtd_info *mtd, int section,if (section < ecc->steps) oobregion->length =4 ;else - oobregion->offset = mtd->oobsize - oobregion->offset; + oobregion->length = mtd->oobsize - oobregion->offset;return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 151/357 clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed
In reply to Greg Kroah-HartmanFrom: Alexey Khoroshilov <[email protected]>
[ Upstream commit fbfd614aeaa2853c2c575299dfe2458db8eff67e ]
If cpg_mssr_common_init() fails after assigning priv to global variable cpg_mssr_priv, it deallocates priv, but cpg_mssr_priv keeps dangling pointer that potentially can be used later.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/clk/renesas/renesas-cpg-mssr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/clk/renesas/renesas-cpg-mssr.c +2 -1
@@ -907,7 +907,6 @@ static int __init cpg_mssr_common_init(struct device *dev, goto out_err; } - cpg_mssr_priv = priv; priv->num_core_clks = info->num_total_core_clks; priv->num_mod_clks = info->num_hw_mod_clks; priv->last_dt_core_clk = info->last_dt_core_clk;
@@ -921,6 +920,8 @@ static int __init cpg_mssr_common_init(struct device *dev,if (error) goto out_err; + cpg_mssr_priv = priv; +return 0 ; out_err:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 152/357 clk: renesas: cpg-mssr: Use enum clk_reg_layout instead of a boolean flag
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
[ Upstream commit ffbf9cf3f9460e320c3f1a90a51145da86c16781 ]
Geert suggested defining multiple register layout variants using an enum
[1] to support further devices like R-Car V3U. So, use enum clk_reg_layout instead of a boolean .stbyctrl flag. No behavioral change.
Stable-dep-of: 1c052043c79a ("clk: renesas: cpg-mssr: Remove superfluous check in resume code")
--- drivers/clk/renesas/r7s9210-cpg-mssr.c | 2 +- drivers/clk/renesas/renesas-cpg-mssr.c | 27 +++++++++++++------------- drivers/clk/renesas/renesas-cpg-mssr.h | 12 +++++++----- 3 files changed, 22 insertions(+), 19 deletions(-)
drivers/clk/renesas/r7s9210-cpg-mssr.c +1 -1
@@ -213,7 +213,7 @@ const struct cpg_mssr_info r7s9210_cpg_mssr_info __initconst = { .cpg_clk_register = rza2_cpg_clk_register,/* RZ/A2 has Standby Control Registers */ - .stbyctrl = true, + .reg_layout = CLK_REG_LAYOUT_RZ_A, };static void __init r7s9210_cpg_mssr_early_init (struct device_node *np)
drivers/clk/renesas/renesas-cpg-mssr.c +14 -13
@@ -111,12 +111,12 @@ static const u16 srcr[] = {* @rcdev: Optional reset controller entity * @dev: CPG/MSSR device * @base: CPG/MSSR register block base address +* @reg_layout: CPG/MSSR register layout * @rmw_lock: protects RMW register accesses * @np: Device node in DT for this CPG/MSSR module * @num_core_clks: Number of Core Clocks in clks[] * @num_mod_clks: Number of Module Clocks in clks[] * @last_dt_core_clk: ID of the last Core Clock exported to DT -* @stbyctrl: This device has Standby Control Registers * @notifiers: Notifier chain to save/restore clock state for system resume * @smstpcr_saved[].mask: Mask of SMSTPCR[] bits under our control * @smstpcr_saved[].val: Saved values of SMSTPCR[]
@@ -128,13 +128,13 @@ struct cpg_mssr_priv {#endif struct device *dev;void __iomem *base; +enum clk_reg_layout reg_layout;spinlock_t rmw_lock;struct device_node *np;unsigned int num_core_clks;unsigned int num_mod_clks;unsigned int last_dt_core_clk; -bool stbyctrl;struct raw_notifier_head notifiers;struct {
@@ -177,7 +177,7 @@ static int cpg_mstp_clock_endisable(struct clk_hw *hw, bool enable) enable ? "ON" : "OFF");spin_lock_irqsave (&priv->rmw_lock, flags); -if (priv->stbyctrl) { +if (priv->reg_layout ==CLK_REG_LAYOUT_RZ_A ) { value =readb (priv->base +STBCR (reg));if (enable) value &= ~bitmask;
@@ -199,7 +199,7 @@ static int cpg_mstp_clock_endisable(struct clk_hw *hw, bool enable)spin_unlock_irqrestore (&priv->rmw_lock, flags); -if (!enable || priv->stbyctrl) +if (!enable || priv->reg_layout ==CLK_REG_LAYOUT_RZ_A )return 0 ;for (i =1000 ; i >0 ; --i) {
@@ -233,7 +233,7 @@ static int cpg_mstp_clock_is_enabled(struct clk_hw *hw)struct cpg_mssr_priv *priv = clock->priv;u32 value; -if (priv->stbyctrl) +if (priv->reg_layout ==CLK_REG_LAYOUT_RZ_A ) value =readb (priv->base +STBCR (clock->index /32 ));else value =readl (priv->base +MSTPSR (clock->index /32 ));
@@ -272,7 +272,7 @@ struct clk *cpg_mssr_clk_src_twocell_get(struct of_phandle_args *clkspec,case CPG_MOD : type ="module" ; -if (priv->stbyctrl) { +if (priv->reg_layout ==CLK_REG_LAYOUT_RZ_A ) { idx =MOD_CLK_PACK_10 (clkidx); range_check =7 - (clkidx %10 ); }else {
@@ -800,7 +800,8 @@ static int cpg_mssr_suspend_noirq(struct device *dev)/* Save module registers with bits under our control */ for (reg =0 ; reg <ARRAY_SIZE (priv->smstpcr_saved); reg++) {if (priv->smstpcr_saved[reg].mask) - priv->smstpcr_saved[reg].val = priv->stbyctrl ? + priv->smstpcr_saved[reg].val = + priv->reg_layout ==CLK_REG_LAYOUT_RZ_A ?readb (priv->base +STBCR (reg)) :readl (priv->base +SMSTPCR (reg)); }
@@ -830,7 +831,7 @@ static int cpg_mssr_resume_noirq(struct device *dev)if (!mask)continue ; -if (priv->stbyctrl) +if (priv->reg_layout ==CLK_REG_LAYOUT_RZ_A ) oldval =readb (priv->base +STBCR (reg));else oldval =readl (priv->base +SMSTPCR (reg));
@@ -839,7 +840,7 @@ static int cpg_mssr_resume_noirq(struct device *dev)if (newval == oldval)continue ; -if (priv->stbyctrl) { +if (priv->reg_layout ==CLK_REG_LAYOUT_RZ_A ) {writeb (newval, priv->base +STBCR (reg));/* dummy read to ensure write has completed */ readb (priv->base +STBCR (reg));
@@ -862,8 +863,8 @@ static int cpg_mssr_resume_noirq(struct device *dev)if (!i)dev_warn (dev,"Failed to enable %s%u[0x%x]\n" , - priv->stbyctrl ?"STB" :"SMSTP" , reg, - oldval & mask); + priv->reg_layout ==CLK_REG_LAYOUT_RZ_A ? +"STB" :"SMSTP" , reg, oldval & mask); }return 0 ;
@@ -911,7 +912,7 @@ static int __init cpg_mssr_common_init(struct device *dev, priv->num_mod_clks = info->num_hw_mod_clks; priv->last_dt_core_clk = info->last_dt_core_clk;RAW_INIT_NOTIFIER_HEAD (&priv->notifiers); - priv->stbyctrl = info->stbyctrl; + priv->reg_layout = info->reg_layout;for (i =0 ; i < nclks; i++) priv->clks[i] =ERR_PTR (-ENOENT );
@@ -991,7 +992,7 @@ static int __init cpg_mssr_probe(struct platform_device *pdev)return error;/* Reset Controller not supported for Standby Control SoCs */ -if (info->stbyctrl) +if (priv->reg_layout ==CLK_REG_LAYOUT_RZ_A )return 0 ; error =cpg_mssr_reset_controller_register (priv);
drivers/clk/renesas/renesas-cpg-mssr.h +7 -5
@@ -85,6 +85,11 @@ struct mssr_mod_clk {struct device_node ; +enum clk_reg_layout { +CLK_REG_LAYOUT_RCAR_GEN2_AND_GEN3 =0 , +CLK_REG_LAYOUT_RZ_A , +}; +/** * SoC-specific CPG/MSSR Description *
@@ -105,6 +110,7 @@ struct device_node;* @crit_mod_clks: Array with Module Clock IDs of critical clocks that * should not be disabled without a knowledgeable driver * @num_crit_mod_clks: Number of entries in crit_mod_clks[] +* @reg_layout: CPG/MSSR register layout from enum clk_reg_layout * * @core_pm_clks: Array with IDs of Core Clocks that are suitable for Power * Management, in addition to Module Clocks
@@ -112,10 +118,6 @@ struct device_node;* * @init: Optional callback to perform SoC-specific initialization * @cpg_clk_register: Optional callback to handle special Core Clock types -* -* @stbyctrl: This device has Standby Control Registers which are 8-bits -* wide, no status registers (MSTPSR) and have different address -* offsets. */ struct cpg_mssr_info {
@@ -130,7 +132,7 @@ struct cpg_mssr_info {unsigned int num_core_clks;unsigned int last_dt_core_clk;unsigned int num_total_core_clks; -bool stbyctrl; +enum clk_reg_layout reg_layout;/* Module Clocks */ const struct mssr_mod_clk *mod_clks;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 153/357 clk: renesas: cpg-mssr: Remove superfluous check in resume code
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 1c052043c79af5f70e80e2acd4dd70904ae08666 ]
When the code flow arrives at printing the error message in cpg_mssr_resume_noirq(), we know for sure that we are not running on an RZ/A Soc, as the code checked for that before.
--- drivers/clk/renesas/renesas-cpg-mssr.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/clk/renesas/renesas-cpg-mssr.c +2 -3
@@ -862,9 +862,8 @@ static int cpg_mssr_resume_noirq(struct device *dev) }if (!i) -dev_warn (dev,"Failed to enable %s%u[0x%x]\n" , - priv->reg_layout ==CLK_REG_LAYOUT_RZ_A ? -"STB" :"SMSTP" , reg, oldval & mask); +dev_warn (dev,"Failed to enable SMSTP%u[0x%x]\n" , reg, + oldval & mask); }return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 154/357 Input: ads7846 - dont report pressure for ads7845
In reply to Greg Kroah-HartmanFrom: Luca Ellero <[email protected]>
[ Upstream commit d50584d783313c8b05b84d0b07a2142f1bde46dd ]
ADS7845 doesn't support pressure.
Avoid the following error reported by libinput-list-devices:
"ADS7845 Touchscreen: kernel bug: device has min == max on ABS_PRESSURE".
--- drivers/input/touchscreen/ads7846.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/input/touchscreen/ads7846.c +3 -2
@@ -1376,8 +1376,9 @@ static int ads7846_probe(struct spi_device *spi) pdata->y_min ? :0 , pdata->y_max ? :MAX_12BIT , 0, 0); -input_set_abs_params (input_dev,ABS_PRESSURE , - pdata->pressure_min, pdata->pressure_max,0 ,0 ); +if (ts->model !=7845 ) +input_set_abs_params (input_dev,ABS_PRESSURE , + pdata->pressure_min, pdata->pressure_max,0 ,0 );/* * Parse common framework properties. Must be done here to ensure the
Signature · 1 line
2.39.2