4.19.295-rc1 review
Subsystems (13)
Greg Kroah-Hartman
maintainercover 4.19.295-rc1 review
This is the start of the stable review cycle for the 4.19.295 release. There are 273 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 22 Sep 2023 11:28:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.295-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.295-rc1
Jamal Hadi Salim <[email protected]>
net/sched: Retire rsvp classifier
valis <[email protected]>
net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
William Zhang <[email protected]>
mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller
Jeff Layton <[email protected]>
nfsd: fix change_info in NFSv4 RENAME replies
Filipe Manana <[email protected]>
btrfs: fix lockdep splat and potential deadlock after failure running delayed items
Christian Brauner <[email protected]>
attr: block mode changes of symlinks
Nigel Croxon <[email protected]>
md/raid1: fix error: ISO C90 forbids mixed declarations
Zhen Lei <[email protected]>
kobject: Add sanity check for kset->kobj.ktype in kset_register()
Sakari Ailus <[email protected]>
media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning
Christophe Leroy <[email protected]>
serial: cpm_uart: Avoid suspicious locking
Konstantin Shelekhin <[email protected]>
scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
Ma Ke <[email protected]>
usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
Hans Verkuil <[email protected]>
media: pci: cx23885: replace BUG with error return
Hans Verkuil <[email protected]>
media: tuners: qt1010: replace BUG_ON with a regular error
Andy Shevchenko <[email protected]>
iio: core: Use min() instead of min_t() to make code more robust
Zhang Shurong <[email protected]>
media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
Zhang Shurong <[email protected]>
media: anysee: fix null-ptr-deref in anysee_master_xfer
Zhang Shurong <[email protected]>
media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
Zhang Shurong <[email protected]>
media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
Zhang Shurong <[email protected]>
media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
ruanjinjie <[email protected]>
powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
Mark Brown <[email protected]>
PCI: dwc: Provide deinit callback for i.MX
Liu Shixin via Jfs-discussion <[email protected]>
jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
Andrew Kanner <[email protected]>
fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
Georg Ottinger <[email protected]>
ext2: fix datatype of block number in ext2_xattr_set2()
Zhang Shurong <[email protected]>
md: raid1: fix potential OOB in raid1_remove_disk()
Tuo Li <[email protected]>
drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
GONG, Ruiqi <[email protected]>
alx: fix OOB-read compiler warning
Alexander Steffen <[email protected]>
tpm_tis: Resend command to recover from data transfer errors
Mark O'Donovan <[email protected]>
crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
Dmitry Antipov <[email protected]>
wifi: mwifiex: fix fortify warning
Dongliang Mu <[email protected]>
wifi: ath9k: fix printk specifier
Tomislav Novak <[email protected]>
hw_breakpoint: fix single-stepping when using bpf_overflow_handler
Jiri Slaby (SUSE) <[email protected]>
ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
Abhishek Mainkar <[email protected]>
ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
Qu Wenruo <[email protected]>
btrfs: output extra debug info if we failed to find an inline backref
Fedor Pchelkin <[email protected]>
autofs: fix memory leak of waitqueues in autofs_catatonic_mode
Helge Deller <[email protected]>
parisc: Drop loops_per_jiffy from per_cpu struct
Wesley Chalmers <[email protected]>
drm/amd/display: Fix a bug when searching for insert_above_mpcc
Kuniyuki Iwashima <[email protected]>
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
Vadim Fedorenko <[email protected]>
ixgbe: fix timestamp configuration code
Shigeru Yoshida <[email protected]>
kcm: Fix memory leak in error path of kcm_sendmsg()
Hangyu Hua <[email protected]>
net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()
Namhyung Kim <[email protected]>
perf hists browser: Fix hierarchy mode header
William Zhang <[email protected]>
mtd: rawnand: brcmnand: Fix potential false time out warning
William Zhang <[email protected]>
mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
William Zhang <[email protected]>
mtd: rawnand: brcmnand: Fix crash during the panic_write
Filipe Manana <[email protected]>
btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
Damien Le Moal <[email protected]>
ata: pata_ftide010: Add missing MODULE_DESCRIPTION
Damien Le Moal <[email protected]>
ata: sata_gemini: Add missing MODULE_DESCRIPTION
Wander Lairson Costa <[email protected]>
netfilter: nfnetlink_osf: avoid OOB read
Ariel Marcovitch <[email protected]>
idr: fix param name in idr_alloc_cyclic() doc
Olga Zaborska <[email protected]>
igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
Olga Zaborska <[email protected]>
igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
Shigeru Yoshida <[email protected]>
kcm: Destroy mutex in kcm_exit_net()
valis <[email protected]>
net: sched: sch_qfq: Fix UAF in qfq_dequeue()
Kuniyuki Iwashima <[email protected]>
af_unix: Fix data race around sk->sk_err.
Kuniyuki Iwashima <[email protected]>
af_unix: Fix data-races around sk->sk_shutdown.
Kuniyuki Iwashima <[email protected]>
af_unix: Fix data-race around unix_tot_inflight.
Kuniyuki Iwashima <[email protected]>
af_unix: Fix data-races around user->unix_inflight.
Alex Henrie <[email protected]>
net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
Liang Chen <[email protected]>
veth: Fixing transmit return status for dropped packets
Corinna Vinschen <[email protected]>
igb: disable virtualization features on 82580
Eric Dumazet <[email protected]>
net: read sk->sk_family once in sk_mc_loop()
Vladimir Zapolskiy <[email protected]>
pwm: lpc32xx: Remove handling of PWM channels
Raag Jadav <[email protected]>
watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
Sean Christopherson <[email protected]>
x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
Konstantin Meskhidze <[email protected]>
kconfig: fix possible buffer overflow
Fedor Pchelkin <[email protected]>
NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
Chris Lew <[email protected]>
soc: qcom: qmi_encdec: Restrict string length in decode
Dmitry Baryshkov <[email protected]>
clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
Helge Deller <[email protected]>
parisc: led: Reduce CPU overhead for disk & lan LED computation
Helge Deller <[email protected]>
parisc: led: Fix LAN receive and transmit LEDs
Thomas Zimmermann <[email protected]>
drm/ast: Fix DRAM init on AST2200
Thomas Zimmermann <[email protected]>
fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
Quinn Tran <[email protected]>
scsi: qla2xxx: Turn off noisy message log
Quinn Tran <[email protected]>
scsi: qla2xxx: fix inconsistent TMF timeout
Tom Rix <[email protected]>
udf: initialize newblock to 0
Marco Felsch <[email protected]>
usb: typec: tcpci: clear the fault status bit
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: fix broken port 0 uart init
Daniel Mack <[email protected]>
sc16is7xx: Set iobase to device index
Kuppuswamy Sathyanarayanan <[email protected]>
PCI/ATS: Add inline to pci_prg_resp_pasid_required()
Enlin Mu <[email protected]>
pstore/ram: Check start of empty przs during init
Nicolas Dichtel <[email protected]>
net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
Thore Sommer <[email protected]>
X.509: if signature is unsupported skip validation
Gustavo A. R. Silva <[email protected]>
cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
Thomas Bourgoin <[email protected]>
crypto: stm32 - fix loop iterating through scatterlist for DMA
Jann Horn <[email protected]>
dccp: Fix out of bounds access in DCCP error handler
Alexander Aring <[email protected]>
dlm: fix plock lookup when using multiple lockspaces
Helge Deller <[email protected]>
parisc: Fix /proc/cpuinfo output for lscpu
Aleksa Sarai <[email protected]>
procfs: block chmod on /proc/thread-self/comm
Bjorn Helgaas <[email protected]>
Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
Dave Jiang <[email protected]>
ntb: Fix calculation ntb_transport_tx_free_entry()
Dave Jiang <[email protected]>
ntb: Clean up tx tail index on link down
Dave Jiang <[email protected]>
ntb: Drop packets when qp link is down
Greg Kroah-Hartman <[email protected]>
media: dvb: symbol fixup for dvb_attach()
Thomas Zimmermann <[email protected]>
backlight/lv5207lp: Compare against struct fb_info.device
Thomas Zimmermann <[email protected]>
backlight/bd6107: Compare against struct fb_info.device
Thomas Zimmermann <[email protected]>
backlight/gpio_backlight: Compare against struct fb_info.device
Gustavo A. R. Silva <[email protected]>
ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
Yi Yang <[email protected]>
ipmi_si: fix a memleak in try_smi_init()
Takashi Iwai <[email protected]>
ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
Boris Brezillon <[email protected]>
PM / devfreq: Fix leak in devfreq_dev_release()
Radoslaw Tyl <[email protected]>
igb: set max size RX buffer when store bad packet is enabled
Mohamed Khalfella <[email protected]>
skbuff: skb_segment, Call zero copy functions before using skbuff frags
Wander Lairson Costa <[email protected]>
netfilter: xt_sctp: validate the flag_info count
Wander Lairson Costa <[email protected]>
netfilter: xt_u32: validate user space input
Kyle Zeng <[email protected]>
netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
Eric Dumazet <[email protected]>
igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
ruanjinjie <[email protected]>
dmaengine: ste_dma40: Add missing IRQ check in d40_probe
Randy Dunlap <[email protected]>
um: Fix hostaudio build errors
Enrico Weigelt, metux IT consult <[email protected]>
arch: um: drivers: Kconfig: pedantic formatting
Jiasheng Jiang <[email protected]>
rpmsg: glink: Add check for kstrdup
Rahul Rameshbabu <[email protected]>
HID: multitouch: Correct devm device reference for hidinput input_dev name
Leon Romanovsky <[email protected]>
Revert "IB/isert: Fix incorrect release of isert connection"
Peng Fan <[email protected]>
amba: bus: fix refcount leak
Yi Yang <[email protected]>
serial: tegra: handle clk prepare error in tegra_uart_hw_init()
Chengfeng Ye <[email protected]>
scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
Tony Battersby <[email protected]>
scsi: core: Use 32-bit hostnum in scsi_host_lookup()
Lu Jialin <[email protected]>
cgroup:namespace: Remove unused cgroup_namespaces_init()
Hans de Goede <[email protected]>
media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
Hans de Goede <[email protected]>
media: ov2680: Fix vflip / hflip set functions
Hans de Goede <[email protected]>
media: ov2680: Fix ov2680_bayer_order()
Hans de Goede <[email protected]>
media: ov2680: Remove auto-gain and auto-exposure controls
Dave Stevenson <[email protected]>
media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
Alan Stern <[email protected]>
USB: gadget: f_mass_storage: Fix unused variable warning
Colin Ian King <[email protected]>
media: go7007: Remove redundant if statement
Xiang Yang <[email protected]>
IB/uverbs: Fix an potential error pointer dereference
Rob Clark <[email protected]>
dma-buf/sync_file: Fix docs syntax
Oleksandr Natalenko <[email protected]>
scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
Oleksandr Natalenko <[email protected]>
scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly
Randy Dunlap <[email protected]>
x86/APM: drop the duplicate APM_MINOR_DEV macro
Lin Ma <[email protected]>
scsi: qla4xxx: Add length check when parsing nlattrs
Lin Ma <[email protected]>
scsi: be2iscsi: Add length check when parsing nlattrs
Lin Ma <[email protected]>
scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
Xu Yang <[email protected]>
usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
Irui Wang <[email protected]>
media: mediatek: vcodec: Return NULL if no vdec_fb is found
Daniil Dulov <[email protected]>
media: cx24120: Add retval check for cx24120_message_send()
Christophe JAILLET <[email protected]>
media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
Daniil Dulov <[email protected]>
media: dib7000p: Fix potential division by zero
Dongliang Mu <[email protected]>
drivers: usb: smsusb: fix error handling code in smsusb_init_device
Christophe JAILLET <[email protected]>
media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
Marco Felsch <[email protected]>
media: v4l2-fwnode: simplify v4l2_fwnode_parse_link
Marco Felsch <[email protected]>
media: v4l2-fwnode: fix v4l2_fwnode_parse_link handling
Rob Herring <[email protected]>
media: Use of_node_name_eq for node name comparisons
Chuck Lever <[email protected]>
NFSD: da_addr_body field missing in some GETDEVICEINFO replies
Su Hui <[email protected]>
fs: lockd: avoid possible wrong NULL parameter
Alexei Filippov <[email protected]>
jfs: validate max amount of blocks before allocation.
Russell Currey <[email protected]>
powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
Dan Carpenter <[email protected]>
nfs/blocklayout: Use the passed in gfp flags
Ilpo Järvinen <[email protected]>
wifi: ath10k: Use RMW accessors for changing LNKCTL
Ilpo Järvinen <[email protected]>
drm/radeon: Use RMW accessors for changing LNKCTL
Frederick Lawler <[email protected]>
drm/radeon: Prefer pcie_capability_read_word()
Bjorn Helgaas <[email protected]>
drm/radeon: Replace numbers with PCI_EXP_LNKCTL2 definitions
Bjorn Helgaas <[email protected]>
drm/radeon: Correct Transmit Margin masks
Ilpo Järvinen <[email protected]>
drm/amdgpu: Use RMW accessors for changing LNKCTL
Frederick Lawler <[email protected]>
drm/amdgpu: Prefer pcie_capability_read_word()
Bjorn Helgaas <[email protected]>
drm/amdgpu: Replace numbers with PCI_EXP_LNKCTL2 definitions
Bjorn Helgaas <[email protected]>
drm/amdgpu: Correct Transmit Margin masks
Bjorn Helgaas <[email protected]>
PCI: Add #defines for Enter Compliance, Transmit Margin
Gustavo Pimentel <[email protected]>
PCI: Decode PCIe 32 GT/s link speed
Bjorn Helgaas <[email protected]>
PCI: Cleanup register definition width and whitespace
Kuppuswamy Sathyanarayanan <[email protected]>
PCI/ATS: Add pci_prg_resp_pasid_required() interface.
Ilpo Järvinen <[email protected]>
PCI/ASPM: Use RMW accessors for changing LNKCTL
Ilpo Järvinen <[email protected]>
PCI: pciehp: Use RMW accessors for changing LNKCTL
Wu Zongyong <[email protected]>
PCI: Mark NVIDIA T4 GPUs to avoid bus reset
Zhang Jianhua <[email protected]>
clk: sunxi-ng: Modify mismatched function name
Minjie Du <[email protected]>
drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
Su Hui <[email protected]>
ALSA: ac97: Fix possible error value of *rac97
Geert Uytterhoeven <[email protected]>
of: unittest: Fix overlay type in apply/revert check
Gaosheng Cui <[email protected]>
audit: fix possible soft lockup in __audit_inode_child()
Dan Carpenter <[email protected]>
smackfs: Prevent underflow in smk_set_cipso()
Daniel Vetter <[email protected]>
drm/msm/mdp5: Don't leak some plane state
Thomas Zimmermann <[email protected]>
drm/msm: Replace drm_framebuffer_{un/reference} with put, get functions
Ruan Jinjie <[email protected]>
of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
Yangtao Li <[email protected]>
drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
Tan Zhongjun <[email protected]>
drm/tegra: Remove superfluous error messages around platform_get_irq()
Rafał Miłecki <[email protected]>
ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
Bogdan Togorean <[email protected]>
drm: adv7511: Fix low refresh rate register for ADV7533/5
Krzysztof Kozlowski <[email protected]>
ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
Krzysztof Kozlowski <[email protected]>
ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
Krzysztof Kozlowski <[email protected]>
ARM: dts: s5pv210: correct ethernet unit address in SMDKV210
Krzysztof Kozlowski <[email protected]>
ARM: dts: s5pv210: use defines for IRQ flags in SMDKV210
Krzysztof Kozlowski <[email protected]>
ARM: dts: s5pv210: add RTC 32 KHz clock in SMDKV210
Krzysztof Kozlowski <[email protected]>
ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
Krzysztof Kozlowski <[email protected]>
ARM: dts: s3c64xx: align pinctrl with dtschema
Krzysztof Kozlowski <[email protected]>
ARM: dts: s3c6410: align node SROM bus node name with dtschema in Mini6410
Krzysztof Kozlowski <[email protected]>
ARM: dts: s3c6410: move fixed clocks under root node in Mini6410
Rafał Miłecki <[email protected]>
ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
Rafał Miłecki <[email protected]>
ARM: dts: BCM53573: Add cells sizes to PCIe node
Rafał Miłecki <[email protected]>
ARM: dts: BCM53573: Drop nonexistent #usb-cells
Rafał Miłecki <[email protected]>
ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
Serge Semin <[email protected]>
ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
Arnd Bergmann <[email protected]>
drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
Konrad Dybcio <[email protected]>
arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
Amit Kucheria <[email protected]>
arm64: dts: msm8996: thermal: Add interrupt support
Baokun Li <[email protected]>
quota: fix dqput() to follow the guarantees dquot_srcu should provide
Baokun Li <[email protected]>
quota: add new helper dquot_active()
Baokun Li <[email protected]>
quota: rename dquot_active() to inode_quota_active()
Baokun Li <[email protected]>
quota: factor out dquot_write_dquot()
Chengguang Xu <[email protected]>
quota: avoid increasing DQST_LOOKUPS when iterating over dirty/inuse list
Chengguang Xu <[email protected]>
quota: add dqi_dirty_list description to comment of Dquot List Management
Kuniyuki Iwashima <[email protected]>
netrom: Deny concurrent connect().
Budimir Markovic <[email protected]>
net/sched: sch_hfsc: Ensure inner classes have fsc curve
Jinjie Ruan <[email protected]>
net: arcnet: Do not call kfree_skb() under local_irq_disable()
Wang Ming <[email protected]>
wifi: ath9k: use IS_ERR() with debugfs_create_dir()
Dmitry Antipov <[email protected]>
wifi: mwifiex: avoid possible NULL skb pointer dereference
Fedor Pchelkin <[email protected]>
wifi: ath9k: protect WMI command response buffer replacement with a lock
Fedor Pchelkin <[email protected]>
wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
Polaris Pi <[email protected]>
wifi: mwifiex: Fix missed return in oob checks failed path
Dmitry Antipov <[email protected]>
wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
Artem Chernyshev <[email protected]>
fs: ocfs2: namei: check return value of ocfs2_add_entry()
Yan Zhai <[email protected]>
lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
Gaurav Jain <[email protected]>
crypto: caam - fix unchecked return value error
Yuanjun Gong <[email protected]>
Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
Dmitry Antipov <[email protected]>
wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
Christophe JAILLET <[email protected]>
mwifiex: switch from 'pci_' to 'dma_' API
Brian Norris <[email protected]>
mwifiex: drop 'set_consistent_dma_mask' log message
Polaris Pi <[email protected]>
wifi: mwifiex: Fix OOB and integer underflow when rx packets
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM
Zhang Shurong <[email protected]>
spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe()
Dan Carpenter <[email protected]>
regmap: rbtree: Use alloc_flags for memory allocations
Eric Dumazet <[email protected]>
tcp: tcp_enter_quickack_mode() should be static
Yafang Shao <[email protected]>
bpf: Clear the probe_addr for uprobe
Liao Chang <[email protected]>
cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
Wang Ming <[email protected]>
fs: Fix error checking for d_hash_and_lookup()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: missing NFT_TRANS_PREPARE_ERROR in flowtable deactivatation
wenxu <[email protected]>
netfilter: nft_flow_offload: fix underflow in flowtable reference counter
Al Viro <[email protected]>
new helper: lookup_positive_unlocked()
Wen Yang <[email protected]>
eventfd: prevent underflow for eventfd semaphores
David Woodhouse <[email protected]>
eventfd: Export eventfd_ctx_do_read()
Matthew Wilcox <[email protected]>
reiserfs: Check the return value from __getblk()
Sabrina Dubroca <[email protected]>
Revert "net: macsec: preserve ingress frame ordering"
Jan Kara <[email protected]>
udf: Handle error when adding extent to a file
Vladislav Efanov <[email protected]>
udf: Check consistency of Space Bitmap Descriptor
Christophe Leroy <[email protected]>
powerpc/32s: Fix assembler warning about r0
Joel Stanley <[email protected]>
powerpc/32: Include .branch_lt in data section
Jordan Rife <[email protected]>
net: Avoid address overwrite in kernel_connect
Takashi Iwai <[email protected]>
ALSA: seq: oss: Fix racy open/close of MIDI devices
Shyam Prasad N <[email protected]>
cifs: add a warning when the in-flight count goes negative
Dan Carpenter <[email protected]>
sctp: handle invalid error codes without calling BUG()
David Christensen <[email protected]>
bnx2x: fix page fault following EEH recovery
Dmitry Mastykin <[email protected]>
netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
Chengfeng Ye <[email protected]>
scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
Baoquan He <[email protected]>
idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
Martin Kohn <[email protected]>
net: usb: qmi_wwan: add Quectel EM05GV2
Christian Göttsche <[email protected]>
security: keys: perform capable check only on privileged operations
Hans de Goede <[email protected]>
platform/x86: intel: hid: Always call BTNL ACPI method
Guiting Shen <[email protected]>
ASoC: atmel: Fix the 8K sample parameter in I2SC master
Edgar <[email protected]>
ASoc: codecs: ES8316: Fix DMIC config
Winston Wen <[email protected]>
fs/nls: make load_nls() take a const parameter
Stefan Haberland <[email protected]>
s390/dasd: fix hanging device after request requeue
Stefan Haberland <[email protected]>
s390/dasd: use correct number of retries for ERP requests
Ben Hutchings <[email protected]>
m68k: Fix invalid .section syntax
Jiri Benc <[email protected]>
vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
Yuanjun Gong <[email protected]>
ethernet: atheros: fix return value check in atl1c_tso_csum()
Dmytro Maluka <[email protected]>
ASoC: da7219: Check for failure reading AAD IRQ events
Dmytro Maluka <[email protected]>
ASoC: da7219: Flush pending AAD IRQ when suspending
Dominique Martinet <[email protected]>
9p: virtio: make sure 'offs' is initialized in zc_request
Mario Limonciello <[email protected]>
pinctrl: amd: Don't show Invalid config param errors
Ryusuke Konishi <[email protected]>
nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
Ryusuke Konishi <[email protected]>
nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
Juerg Haefliger <[email protected]>
fsi: master-ast-cf: Add MODULE_FIRMWARE macro
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: fix bug when first setting GPIO direction
Zheng Wang <[email protected]>
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
Aaron Armstrong Skomra <[email protected]>
HID: wacom: remove the battery when the EKR is off
Slark Xiao <[email protected]>
USB: serial: option: add FOXCONN T99W368/T99W373 product
Martin Kohn <[email protected]>
USB: serial: option: add Quectel EM05G variant (0x030e)
Christoph Hellwig <[email protected]>
modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
Christoph Hellwig <[email protected]>
rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
Christoph Hellwig <[email protected]>
mmc: au1xmmc: force non-modular build and remove symbol_get usage
Arnd Bergmann <[email protected]>
ARM: pxa: remove use of symbol_get()
Gao Xiang <[email protected]>
erofs: ensure that the post-EOF tails are all zeroed
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 13 + arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 13 + arch/arm/boot/dts/bcm5301x.dtsi | 4 +- arch/arm/boot/dts/bcm53573.dtsi | 27 +- arch/arm/boot/dts/bcm947189acdbmr.dts | 6 +- arch/arm/boot/dts/s3c6410-mini6410.dts | 38 +- arch/arm/boot/dts/s3c64xx-pinctrl.dtsi | 210 +++--- arch/arm/boot/dts/s5pv210-smdkv210.dts | 24 +- arch/arm/kernel/hw_breakpoint.c | 8 +- arch/arm/mach-omap2/powerdomain.c | 2 +- arch/arm/mach-pxa/sharpsl_pm.c | 2 - arch/arm/mach-pxa/spitz.c | 14 +- arch/arm64/boot/dts/qcom/msm8996.dtsi | 7 + arch/arm64/kernel/hw_breakpoint.c | 4 +- arch/m68k/fpsp040/skeleton.S | 4 +- arch/m68k/ifpsp060/os.S | 4 +- arch/m68k/kernel/relocate_kernel.S | 4 +- arch/mips/alchemy/devboards/db1000.c | 8 +- arch/mips/alchemy/devboards/db1200.c | 19 +- arch/mips/alchemy/devboards/db1300.c | 10 +- arch/parisc/include/asm/led.h | 4 +- arch/parisc/include/asm/processor.h | 1 - arch/parisc/kernel/processor.c | 18 +- arch/powerpc/kernel/head_32.S | 2 +- arch/powerpc/kernel/iommu.c | 17 +- arch/powerpc/kernel/vmlinux.lds.S | 1 + arch/powerpc/platforms/pseries/ibmebus.c | 1 + arch/um/configs/i386_defconfig | 1 + arch/um/configs/x86_64_defconfig | 1 + arch/um/drivers/Kconfig | 366 +++++----- arch/um/drivers/Makefile | 2 +- arch/x86/include/asm/virtext.h | 6 - arch/x86/kernel/apm_32.c | 6 - crypto/asymmetric_keys/x509_public_key.c | 5 + drivers/acpi/acpica/psopcode.c | 2 +- drivers/acpi/video_detect.c | 9 + drivers/amba/bus.c | 1 + drivers/ata/pata_ftide010.c | 1 + drivers/ata/sata_gemini.c | 1 + drivers/base/regmap/regcache-rbtree.c | 10 +- drivers/bluetooth/btsdio.c | 1 + drivers/bluetooth/hci_nokia.c | 6 +- drivers/char/ipmi/ipmi_si_intf.c | 5 + drivers/char/tpm/tpm_tis_core.c | 15 +- drivers/clk/keystone/pll.c | 2 +- drivers/clk/qcom/gcc-mdm9615.c | 2 +- drivers/clk/sunxi-ng/ccu_mmc_timing.c | 2 +- drivers/cpufreq/brcmstb-avs-cpufreq.c | 6 +- drivers/cpufreq/powernow-k8.c | 3 +- drivers/crypto/caam/caampkc.c | 4 +- drivers/crypto/stm32/stm32-hash.c | 2 +- drivers/devfreq/devfreq.c | 1 + drivers/dma/Kconfig | 2 + drivers/dma/ste_dma40.c | 4 + drivers/fsi/fsi-master-ast-cf.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 + drivers/gpu/drm/amd/amdgpu/cik.c | 97 +-- drivers/gpu/drm/amd/amdgpu/si.c | 99 +-- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c | 5 +- drivers/gpu/drm/ast/ast_post.c | 2 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 9 +- drivers/gpu/drm/exynos/exynos_drm_crtc.c | 5 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 5 +- drivers/gpu/drm/radeon/cik.c | 96 +-- drivers/gpu/drm/radeon/si.c | 98 +-- drivers/gpu/drm/tegra/dpaux.c | 6 +- drivers/hid/hid-multitouch.c | 13 +- drivers/hid/wacom.h | 1 + drivers/hid/wacom_sys.c | 25 +- drivers/hid/wacom_wac.c | 1 + drivers/hid/wacom_wac.h | 1 + drivers/iio/industrialio-core.c | 2 +- .../infiniband/core/uverbs_std_types_counters.c | 2 + drivers/infiniband/ulp/isert/ib_isert.c | 2 + drivers/md/raid1.c | 3 + drivers/media/dvb-frontends/ascot2e.c | 2 +- drivers/media/dvb-frontends/atbm8830.c | 2 +- drivers/media/dvb-frontends/au8522_dig.c | 2 +- drivers/media/dvb-frontends/bcm3510.c | 2 +- drivers/media/dvb-frontends/cx22700.c | 2 +- drivers/media/dvb-frontends/cx22702.c | 2 +- drivers/media/dvb-frontends/cx24110.c | 2 +- drivers/media/dvb-frontends/cx24113.c | 2 +- drivers/media/dvb-frontends/cx24116.c | 2 +- drivers/media/dvb-frontends/cx24120.c | 6 +- drivers/media/dvb-frontends/cx24123.c | 2 +- drivers/media/dvb-frontends/cxd2820r_core.c | 2 +- drivers/media/dvb-frontends/cxd2841er.c | 4 +- drivers/media/dvb-frontends/cxd2880/cxd2880_top.c | 2 +- drivers/media/dvb-frontends/dib0070.c | 2 +- drivers/media/dvb-frontends/dib0090.c | 4 +- drivers/media/dvb-frontends/dib3000mb.c | 2 +- drivers/media/dvb-frontends/dib3000mc.c | 2 +- drivers/media/dvb-frontends/dib7000m.c | 2 +- drivers/media/dvb-frontends/dib7000p.c | 4 +- drivers/media/dvb-frontends/dib8000.c | 2 +- drivers/media/dvb-frontends/dib9000.c | 2 +- drivers/media/dvb-frontends/drx39xyj/drxj.c | 2 +- drivers/media/dvb-frontends/drxd_hard.c | 2 +- drivers/media/dvb-frontends/drxk_hard.c | 2 +- drivers/media/dvb-frontends/ds3000.c | 2 +- drivers/media/dvb-frontends/dvb-pll.c | 2 +- drivers/media/dvb-frontends/ec100.c | 2 +- drivers/media/dvb-frontends/helene.c | 4 +- drivers/media/dvb-frontends/horus3a.c | 2 +- drivers/media/dvb-frontends/isl6405.c | 2 +- drivers/media/dvb-frontends/isl6421.c | 2 +- drivers/media/dvb-frontends/isl6423.c | 2 +- drivers/media/dvb-frontends/itd1000.c | 2 +- drivers/media/dvb-frontends/ix2505v.c | 2 +- drivers/media/dvb-frontends/l64781.c | 2 +- drivers/media/dvb-frontends/lg2160.c | 2 +- drivers/media/dvb-frontends/lgdt3305.c | 2 +- drivers/media/dvb-frontends/lgdt3306a.c | 2 +- drivers/media/dvb-frontends/lgdt330x.c | 2 +- drivers/media/dvb-frontends/lgs8gxx.c | 2 +- drivers/media/dvb-frontends/lnbh25.c | 2 +- drivers/media/dvb-frontends/lnbp21.c | 4 +- drivers/media/dvb-frontends/lnbp22.c | 2 +- drivers/media/dvb-frontends/m88ds3103.c | 2 +- drivers/media/dvb-frontends/m88rs2000.c | 2 +- drivers/media/dvb-frontends/mb86a16.c | 2 +- drivers/media/dvb-frontends/mb86a20s.c | 2 +- drivers/media/dvb-frontends/mt312.c | 2 +- drivers/media/dvb-frontends/mt352.c | 2 +- drivers/media/dvb-frontends/nxt200x.c | 2 +- drivers/media/dvb-frontends/nxt6000.c | 2 +- drivers/media/dvb-frontends/or51132.c | 2 +- drivers/media/dvb-frontends/or51211.c | 2 +- drivers/media/dvb-frontends/s5h1409.c | 2 +- drivers/media/dvb-frontends/s5h1411.c | 2 +- drivers/media/dvb-frontends/s5h1420.c | 2 +- drivers/media/dvb-frontends/s5h1432.c | 2 +- drivers/media/dvb-frontends/s921.c | 2 +- drivers/media/dvb-frontends/si21xx.c | 2 +- drivers/media/dvb-frontends/sp887x.c | 2 +- drivers/media/dvb-frontends/stb0899_drv.c | 2 +- drivers/media/dvb-frontends/stb6000.c | 2 +- drivers/media/dvb-frontends/stb6100.c | 2 +- drivers/media/dvb-frontends/stv0288.c | 2 +- drivers/media/dvb-frontends/stv0297.c | 2 +- drivers/media/dvb-frontends/stv0299.c | 2 +- drivers/media/dvb-frontends/stv0367.c | 6 +- drivers/media/dvb-frontends/stv0900_core.c | 2 +- drivers/media/dvb-frontends/stv6110.c | 2 +- drivers/media/dvb-frontends/stv6110x.c | 2 +- drivers/media/dvb-frontends/tda10021.c | 2 +- drivers/media/dvb-frontends/tda10023.c | 2 +- drivers/media/dvb-frontends/tda10048.c | 2 +- drivers/media/dvb-frontends/tda1004x.c | 4 +- drivers/media/dvb-frontends/tda10086.c | 2 +- drivers/media/dvb-frontends/tda665x.c | 2 +- drivers/media/dvb-frontends/tda8083.c | 2 +- drivers/media/dvb-frontends/tda8261.c | 2 +- drivers/media/dvb-frontends/tda826x.c | 2 +- drivers/media/dvb-frontends/ts2020.c | 2 +- drivers/media/dvb-frontends/tua6100.c | 2 +- drivers/media/dvb-frontends/ves1820.c | 2 +- drivers/media/dvb-frontends/ves1x93.c | 2 +- drivers/media/dvb-frontends/zl10036.c | 2 +- drivers/media/dvb-frontends/zl10039.c | 2 +- drivers/media/dvb-frontends/zl10353.c | 2 +- drivers/media/i2c/ov2680.c | 246 ++----- drivers/media/pci/bt8xx/dst.c | 2 +- drivers/media/pci/bt8xx/dst_ca.c | 2 +- drivers/media/pci/cx23885/cx23885-video.c | 2 +- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 2 +- drivers/media/platform/exynos4-is/media-dev.c | 12 +- .../media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 5 +- drivers/media/platform/ti-vpe/cal.c | 4 +- drivers/media/platform/xilinx/xilinx-tpg.c | 2 +- drivers/media/tuners/fc0011.c | 2 +- drivers/media/tuners/fc0012.c | 2 +- drivers/media/tuners/fc0013.c | 2 +- drivers/media/tuners/max2165.c | 2 +- drivers/media/tuners/mc44s803.c | 2 +- drivers/media/tuners/mt2060.c | 2 +- drivers/media/tuners/mt2131.c | 2 +- drivers/media/tuners/mt2266.c | 2 +- drivers/media/tuners/mxl5005s.c | 2 +- drivers/media/tuners/qt1010.c | 13 +- drivers/media/tuners/tda18218.c | 2 +- drivers/media/tuners/xc4000.c | 2 +- drivers/media/tuners/xc5000.c | 2 +- drivers/media/usb/dvb-usb-v2/af9035.c | 14 +- drivers/media/usb/dvb-usb-v2/anysee.c | 2 +- drivers/media/usb/dvb-usb-v2/az6007.c | 8 + drivers/media/usb/dvb-usb/af9005.c | 5 + drivers/media/usb/dvb-usb/dw2102.c | 24 + drivers/media/usb/dvb-usb/m920x.c | 5 +- drivers/media/usb/go7007/go7007-i2c.c | 2 - drivers/media/usb/siano/smsusb.c | 21 +- drivers/media/v4l2-core/v4l2-fwnode.c | 45 +- drivers/mmc/host/Kconfig | 5 +- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 113 ++- drivers/net/arcnet/arcnet.c | 2 +- drivers/net/can/usb/gs_usb.c | 5 +- drivers/net/ethernet/atheros/alx/ethtool.c | 5 +- drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 7 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +- drivers/net/ethernet/intel/igb/igb.h | 4 +- drivers/net/ethernet/intel/igb/igb_main.c | 16 +- drivers/net/ethernet/intel/igbvf/igbvf.h | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 28 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 + drivers/net/macsec.c | 3 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/veth.c | 4 +- drivers/net/vxlan.c | 58 +- drivers/net/wireless/ath/ath10k/pci.c | 9 +- drivers/net/wireless/ath/ath9k/ahb.c | 4 +- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +- drivers/net/wireless/ath/ath9k/pci.c | 4 +- drivers/net/wireless/ath/ath9k/wmi.c | 20 +- drivers/net/wireless/marvell/mwifiex/debugfs.c | 9 +- drivers/net/wireless/marvell/mwifiex/pcie.c | 179 ++--- drivers/net/wireless/marvell/mwifiex/sta_rx.c | 12 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 9 +- drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 30 +- drivers/net/wireless/marvell/mwifiex/util.c | 10 +- drivers/ntb/ntb_transport.c | 19 +- drivers/of/unittest.c | 12 +- drivers/parisc/led.c | 4 +- drivers/pci/ats.c | 30 + drivers/pci/controller/dwc/pci-imx6.c | 1 + drivers/pci/hotplug/pciehp_hpc.c | 12 +- drivers/pci/pci-sysfs.c | 3 + drivers/pci/pci.c | 4 +- drivers/pci/pcie/aspm.c | 30 +- drivers/pci/probe.c | 2 +- drivers/pci/slot.c | 1 + drivers/pinctrl/pinctrl-amd.c | 4 +- drivers/platform/x86/intel-hid.c | 21 +- drivers/pwm/pwm-lpc32xx.c | 16 +- drivers/rpmsg/qcom_glink_native.c | 4 + drivers/rtc/rtc-ds1685.c | 2 +- drivers/s390/block/dasd.c | 125 ++-- drivers/s390/block/dasd_3990_erp.c | 2 +- drivers/scsi/be2iscsi/be_iscsi.c | 4 + drivers/scsi/fcoe/fcoe_ctlr.c | 20 +- drivers/scsi/hosts.c | 4 +- drivers/scsi/qedf/qedf_dbg.h | 2 + drivers/scsi/qedf/qedf_debugfs.c | 28 +- drivers/scsi/qedi/qedi_main.c | 5 +- drivers/scsi/qla2xxx/qla_isr.c | 1 - drivers/scsi/qla2xxx/qla_nvme.c | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 15 + drivers/scsi/scsi_transport_iscsi.c | 8 + drivers/soc/qcom/qmi_encdec.c | 4 +- drivers/spi/spi-tegra20-sflash.c | 6 +- drivers/staging/erofs/unzip_vle.c | 2 + drivers/target/iscsi/iscsi_target_configfs.c | 54 +- drivers/tty/serial/cpm_uart/cpm_uart_core.c | 13 +- drivers/tty/serial/sc16is7xx.c | 18 +- drivers/tty/serial/serial-tegra.c | 6 +- drivers/usb/gadget/function/f_mass_storage.c | 2 +- drivers/usb/gadget/udc/fsl_qe_udc.c | 2 + drivers/usb/phy/phy-mxs-usb.c | 10 +- drivers/usb/serial/option.c | 7 + drivers/usb/typec/tcpci.c | 4 + drivers/usb/typec/tcpci.h | 1 + drivers/video/backlight/bd6107.c | 2 +- drivers/video/backlight/gpio_backlight.c | 2 +- drivers/video/backlight/lv5207lp.c | 2 +- drivers/video/fbdev/ep93xx-fb.c | 1 - drivers/watchdog/intel-mid_wdt.c | 1 + fs/attr.c | 20 +- fs/autofs/waitq.c | 3 +- fs/btrfs/delayed-inode.c | 19 +- fs/btrfs/extent-tree.c | 5 + fs/btrfs/transaction.c | 7 +- fs/cifs/cifsfs.c | 7 +- fs/cifs/smb2ops.c | 1 + fs/debugfs/inode.c | 6 +- fs/dlm/plock.c | 6 +- fs/eventfd.c | 7 +- fs/ext2/xattr.c | 4 +- fs/jfs/jfs_dmap.c | 1 + fs/jfs/jfs_extent.c | 5 + fs/jfs/jfs_imap.c | 1 + fs/kernfs/mount.c | 2 +- fs/lockd/mon.c | 3 + fs/namei.c | 22 +- fs/nfs/blocklayout/dev.c | 4 +- fs/nfs/pnfs_dev.c | 2 +- fs/nfsd/blocklayoutxdr.c | 9 + fs/nfsd/flexfilelayoutxdr.c | 9 + fs/nfsd/nfs3xdr.c | 4 +- fs/nfsd/nfs4proc.c | 4 +- fs/nfsd/nfs4xdr.c | 36 +- fs/nilfs2/alloc.c | 3 +- fs/nilfs2/inode.c | 7 +- fs/nilfs2/segment.c | 5 + fs/nls/nls_base.c | 4 +- fs/ocfs2/namei.c | 4 + fs/overlayfs/namei.c | 24 +- fs/proc/base.c | 3 +- fs/pstore/ram_core.c | 2 +- fs/quota/dquot.c | 189 +++-- fs/reiserfs/journal.c | 4 +- fs/udf/balloc.c | 31 +- fs/udf/inode.c | 45 +- include/linux/eventfd.h | 6 + include/linux/if_arp.h | 4 + include/linux/namei.h | 1 + include/linux/nls.h | 2 +- include/linux/pci-ats.h | 5 + include/linux/pci.h | 1 + include/linux/perf_event.h | 22 +- include/linux/trace_events.h | 3 +- include/net/lwtunnel.h | 5 +- include/net/tcp.h | 1 - include/scsi/scsi_host.h | 2 +- include/uapi/linux/pci_regs.h | 139 ++-- include/uapi/linux/sync_file.h | 2 +- kernel/auditsc.c | 2 + kernel/cgroup/namespace.c | 6 - kernel/module.c | 15 +- kernel/trace/bpf_trace.c | 2 +- kernel/trace/trace_uprobe.c | 3 +- lib/idr.c | 2 +- lib/kobject.c | 5 + lib/mpi/mpi-cmp.c | 8 +- net/9p/trans_virtio.c | 2 +- net/core/skbuff.c | 34 +- net/core/sock.c | 9 +- net/dccp/ipv4.c | 13 +- net/dccp/ipv6.c | 15 +- net/ipv4/igmp.c | 3 +- net/ipv4/ip_output.c | 2 +- net/ipv4/tcp_input.c | 3 +- net/ipv6/addrconf.c | 2 +- net/ipv6/ip6_output.c | 2 +- net/kcm/kcmsock.c | 15 +- net/netfilter/ipset/ip_set_hash_netportnet.c | 1 + net/netfilter/nf_tables_api.c | 1 + net/netfilter/nfnetlink_osf.c | 8 + net/netfilter/nft_flow_offload.c | 3 - net/netfilter/xt_sctp.c | 2 + net/netfilter/xt_u32.c | 21 + net/netlabel/netlabel_kapi.c | 3 +- net/netrom/af_netrom.c | 5 + net/sched/Kconfig | 28 - net/sched/Makefile | 2 - net/sched/cls_fw.c | 1 - net/sched/cls_rsvp.c | 28 - net/sched/cls_rsvp.h | 775 --------------------- net/sched/cls_rsvp6.c | 28 - net/sched/sch_hfsc.c | 4 + net/sched/sch_plug.c | 2 +- net/sched/sch_qfq.c | 22 +- net/sctp/sm_sideeffect.c | 5 +- net/socket.c | 6 +- net/unix/af_unix.c | 2 +- net/unix/scm.c | 6 +- scripts/kconfig/preprocess.c | 3 + security/keys/keyctl.c | 11 +- security/smack/smackfs.c | 2 +- sound/Kconfig | 2 +- sound/core/pcm_compat.c | 8 +- sound/core/seq/oss/seq_oss_midi.c | 35 +- sound/pci/ac97/ac97_codec.c | 5 +- sound/soc/atmel/atmel-i2s.c | 5 +- sound/soc/codecs/da7219-aad.c | 12 +- sound/soc/codecs/es8316.c | 2 +- tools/perf/ui/browsers/hists.c | 2 +- 367 files changed, 2347 insertions(+), 2655 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/273 erofs: ensure that the post-EOF tails are all zeroed
4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <[email protected]>
commit e4c1cf523d820730a86cae2c6d55924833b6f7ac upstream.
This was accidentally fixed up in commit e4c1cf523d82 but we can't take the full change due to other dependancy issues, so here is just the actual bugfix that is needed.
[Background]
keltargw reported an issue [1] that with mmaped I/Os, sometimes the tail of the last page (after file ends) is not filled with zeroes.
The root cause is that such tail page could be wrongly selected for inplace I/Os so the zeroed part will then be filled with compressed data instead of zeroes.
A simple fix is to avoid doing inplace I/Os for such tail parts, actually that was already fixed upstream in commit e4c1cf523d82 ("erofs: tidy up z_erofs_do_read_page()") by accident.
[1] https://lore.kernel.org/r/[email protected]
--- drivers/staging/erofs/unzip_vle.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/staging/erofs/unzip_vle.c +2 -0
@@ -675,6 +675,8 @@ hitted: cur = end -min_t (unsigned, offset + end - map->m_la, end);if (unlikely (!(map->m_flags &EROFS_MAP_MAPPED ))) {zero_user_segment (page, cur, end); + ++spiltted; + tight = false; goto next_part; }
Greg Kroah-Hartman
maintainerPATCH 2/273 ARM: pxa: remove use of symbol_get()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 0faa29c4207e6e29cfc81b427df60e326c37083a upstream.
The spitz board file uses the obscure symbol_get() function to optionally call a function from sharpsl_pm.c if that is built. However, the two files are always built together these days, and have been for a long time, so this can be changed to a normal function call.
--- arch/arm/mach-pxa/sharpsl_pm.c | 2 -- arch/arm/mach-pxa/spitz.c | 14 +------------- 2 files changed, 1 insertion(+), 15 deletions(-)
arch/arm/mach-pxa/sharpsl_pm.c +0 -2
@@ -224,8 +224,6 @@ void sharpsl_battery_kick(void) {schedule_delayed_work (&sharpsl_bat,msecs_to_jiffies (125 )); } -EXPORT_SYMBOL (sharpsl_battery_kick); -static void sharpsl_battery_thread (struct work_struct *private_) {
arch/arm/mach-pxa/spitz.c +1 -13
@@ -13,7 +13,6 @@*/ #include <linux/kernel.h> -#include <linux/module.h> /* symbol_get ; symbol_put */ #include <linux/platform_device.h> #include <linux/delay.h> #include <linux/gpio_keys.h>
@@ -517,17 +516,6 @@ static struct pxa2xx_spi_chip spitz_ads7 .gpio_cs = SPITZ_GPIO_ADS7846_CS, }; -static void spitz_bl_kick_battery (void ) -{ -void (*kick_batt)(void ); - - kick_batt =symbol_get (sharpsl_battery_kick); -if (kick_batt) { -kick_batt (); -symbol_put (sharpsl_battery_kick); - } -} -static struct corgi_lcd_platform_data spitz_lcdcon_info = { .init_mode =CORGI_LCD_MODE_VGA , .max_intensity =0x2f ,
@@ -535,7 +523,7 @@ static struct corgi_lcd_platform_data sp .limit_mask = 0x0b, .gpio_backlight_cont = SPITZ_GPIO_BACKLIGHT_CONT, .gpio_backlight_on = SPITZ_GPIO_BACKLIGHT_ON, - .kick_battery = spitz_bl_kick_battery, + .kick_battery = sharpsl_battery_kick, };static struct pxa2xx_spi_chip spitz_lcdcon_chip = {
Greg Kroah-Hartman
maintainerPATCH 3/273 mmc: au1xmmc: force non-modular build and remove symbol_get usage
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit d4a5c59a955bba96b273ec1a5885bada24c56979 upstream.
au1xmmc is split somewhat awkwardly into the main mmc subsystem driver, and callbacks in platform_data that sit under arch/mips/ and are always built in. The latter than call mmc_detect_change through symbol_get. Remove the use of symbol_get by requiring the driver to be built in. In the future the interrupt handlers for card insert/eject detection should probably be moved into the main driver, and which point it can be built modular again.
--- arch/mips/alchemy/devboards/db1000.c | 8 +------- arch/mips/alchemy/devboards/db1200.c | 19 ++----------------- arch/mips/alchemy/devboards/db1300.c | 10 +--------- drivers/mmc/host/Kconfig | 5 +++-- 4 files changed, 7 insertions(+), 35 deletions(-)
arch/mips/alchemy/devboards/db1000.c +1 -7
@@ -27,7 +27,6 @@#include <linux/interrupt.h> #include <linux/leds.h> #include <linux/mmc/host.h> -#include <linux/module.h> #include <linux/platform_device.h> #include <linux/pm.h> #include <linux/spi/spi.h>
@@ -176,12 +175,7 @@ static struct platform_device db1x00_audstatic irqreturn_t db1100_mmc_cd (int irq,void *ptr) { -void (*mmc_cd)(struct mmc_host *,unsigned long ); -/* link against CONFIG_MMC=m */ - mmc_cd =symbol_get (mmc_detect_change); -mmc_cd (ptr,msecs_to_jiffies (500 )); -symbol_put (mmc_detect_change); - +mmc_detect_change (ptr,msecs_to_jiffies (500 ));return IRQ_HANDLED ; }
arch/mips/alchemy/devboards/db1200.c +2 -17
@@ -23,7 +23,6 @@#include <linux/gpio.h> #include <linux/i2c.h> #include <linux/init.h> -#include <linux/module.h> #include <linux/interrupt.h> #include <linux/io.h> #include <linux/leds.h>
@@ -355,14 +354,7 @@ static irqreturn_t db1200_mmc_cd(int irqstatic irqreturn_t db1200_mmc_cdfn (int irq,void *ptr) { -void (*mmc_cd)(struct mmc_host *,unsigned long ); - -/* link against CONFIG_MMC=m */ - mmc_cd =symbol_get (mmc_detect_change); -if (mmc_cd) { -mmc_cd (ptr,msecs_to_jiffies (200 )); -symbol_put (mmc_detect_change); - } +mmc_detect_change (ptr,msecs_to_jiffies (200 ));msleep (100 );/* debounce */ if (irq ==DB1200_SD0_INSERT_INT )
@@ -446,14 +438,7 @@ static irqreturn_t pb1200_mmc1_cd(int irstatic irqreturn_t pb1200_mmc1_cdfn (int irq,void *ptr) { -void (*mmc_cd)(struct mmc_host *,unsigned long ); - -/* link against CONFIG_MMC=m */ - mmc_cd =symbol_get (mmc_detect_change); -if (mmc_cd) { -mmc_cd (ptr,msecs_to_jiffies (200 )); -symbol_put (mmc_detect_change); - } +mmc_detect_change (ptr,msecs_to_jiffies (200 ));msleep (100 );/* debounce */ if (irq ==PB1200_SD1_INSERT_INT )
arch/mips/alchemy/devboards/db1300.c +1 -9
@@ -17,7 +17,6 @@#include <linux/interrupt.h> #include <linux/ata_platform.h> #include <linux/mmc/host.h> -#include <linux/module.h> #include <linux/mtd/mtd.h> #include <linux/mtd/rawnand.h> #include <linux/mtd/partitions.h>
@@ -457,14 +456,7 @@ static irqreturn_t db1300_mmc_cd(int irqstatic irqreturn_t db1300_mmc_cdfn (int irq,void *ptr) { -void (*mmc_cd)(struct mmc_host *,unsigned long ); - -/* link against CONFIG_MMC=m. We can only be called once MMC core has -* initialized the controller, so symbol_get() should always succeed. -*/ - mmc_cd =symbol_get (mmc_detect_change); -mmc_cd (ptr,msecs_to_jiffies (200 )); -symbol_put (mmc_detect_change); +mmc_detect_change (ptr,msecs_to_jiffies (200 ));msleep (100 );/* debounce */ if (irq ==DB1300_SD1_INSERT_INT )
drivers/mmc/host/Kconfig +3 -2
@@ -431,11 +431,12 @@ config MMC_WBSD If unsure, say N. config MMC_AU1X - tristate "Alchemy AU1XX0 MMC Card Interface support" + bool "Alchemy AU1XX0 MMC Card Interface support" depends on MIPS_ALCHEMY + depends on MMC=y help This selects the AMD Alchemy(R) Multimedia card interface. - If you have a Alchemy platform with a MMC slot, say Y or M here. + If you have a Alchemy platform with a MMC slot, say Y here. If unsure, say N.
Greg Kroah-Hartman
maintainerPATCH 4/273 rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit 95e7ebc6823170256a8ce19fad87912805bfa001 upstream.
ds1685_rtc_poweroff is only used externally via symbol_get, which was only ever intended for very internal symbols like this one. Use EXPORT_SYMBOL_GPL for it so that symbol_get can enforce only being used on EXPORT_SYMBOL_GPL symbols.
--- drivers/rtc/rtc-ds1685.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-ds1685.c +1 -1
@@ -1630,7 +1630,7 @@ ds1685_rtc_poweroff(struct platform_deviunreachable (); } } -EXPORT_SYMBOL (ds1685_rtc_poweroff); +EXPORT_SYMBOL_GPL (ds1685_rtc_poweroff);/* ----------------------------------------------------------------------- */
Greg Kroah-Hartman
maintainerPATCH 5/273 modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit 9011e49d54dcc7653ebb8a1e05b5badb5ecfa9f9 upstream.
It has recently come to my attention that nvidia is circumventing the protection added in 262e6ae7081d ("modules: inherit TAINT_PROPRIETARY_MODULE") by importing exports from their proprietary modules into an allegedly GPL licensed module and then rexporting them.
Given that symbol_get was only ever intended for tightly cooperating modules using very internal symbols it is logical to restrict it to being used on EXPORT_SYMBOL_GPL and prevent nvidia from costly DMCA Circumvention of Access Controls law suites.
All symbols except for four used through symbol_get were already exported as EXPORT_SYMBOL_GPL, and the remaining four ones were switched over in the preparation patches.
--- kernel/module.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
kernel/module.c +13 -2
@@ -2261,15 +2261,26 @@ static void free_module(struct module *mvoid *__symbol_get (const char *symbol) {struct module *owner; +enum mod_license license;const struct kernel_symbol *sym;preempt_disable (); - sym =find_symbol (symbol, &owner,NULL ,NULL , true, true); -if (sym &&strong_try_module_get (owner)) + sym =find_symbol (symbol, &owner,NULL , &license, true, true); +if (!sym) + goto fail; +if (license !=GPL_ONLY ) { +pr_warn ("failing symbol_get of non-GPLONLY symbol %s.\n" , + symbol); + goto fail; + } +if (strong_try_module_get (owner)) sym =NULL ;preempt_enable ();return sym ? (void *)kernel_symbol_value (sym) :NULL ; +fail: +preempt_enable (); +return NULL ; }EXPORT_SYMBOL_GPL (__symbol_get);
Greg Kroah-Hartman
maintainerPATCH 6/273 USB: serial: option: add Quectel EM05G variant (0x030e)
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kohn <[email protected]>
commit 873854c02364ebb991fc06f7148c14dfb5419e1b upstream.
Add Quectel EM05G with product ID 0x030e.
Interface 4 is used for qmi.
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030e Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -259,6 +259,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM05G 0x030a#define QUECTEL_PRODUCT_EM060K 0x030b#define QUECTEL_PRODUCT_EM05G_CS 0x030c +#define QUECTEL_PRODUCT_EM05GV2 0x030e#define QUECTEL_PRODUCT_EM05CN_SG 0x0310#define QUECTEL_PRODUCT_EM05G_SG 0x0311#define QUECTEL_PRODUCT_EM05CN 0x0312
@@ -1190,6 +1191,8 @@ static const struct usb_device_id option .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff), .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05GV2, 0xff), + .driver_info = RSVD(4) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff), .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_RS, 0xff),
Greg Kroah-Hartman
maintainerPATCH 7/273 USB: serial: option: add FOXCONN T99W368/T99W373 product
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <[email protected]>
commit 4d9488b294e1f8353bbcadc4c7172a7f7490199b upstream.
The difference of T99W368 and T99W373 is the chip solution. T99W368 is designed based on Qualcomm SDX65 and T99W373 is SDX62.
Test evidence as below:
T: Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e0f0 Rev=05.04 S: Manufacturer=FII S: Product=OLYMPIC USB WWAN Adapter S: SerialNumber=78ada8c4 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
T: Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e0ee Rev=05.04 S: Manufacturer=FII S: Product=OLYMPIC USB WWAN Adapter S: SerialNumber=78ada8d5 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
Both of them share the same port configuration:
0&1: MBIM, 2: Modem, 3:GNSS, 4:NMEA, 5:Diag
GNSS port don't use serial driver.
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -2235,6 +2235,10 @@ static const struct usb_device_id option .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */ .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0ee, 0xff), /* Foxconn T99W368 MBIM */ + .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */ + .driver_info = RSVD(3) }, { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
Greg Kroah-Hartman
maintainerPATCH 8/273 HID: wacom: remove the battery when the EKR is off
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Armstrong Skomra <[email protected]>
commit 9ac6678b95b0dd9458a7a6869f46e51cd55a1d84 upstream.
Currently the EKR battery remains even after we stop getting information from the device. This can lead to a stale battery persisting indefinitely in userspace.
The remote sends a heartbeat every 10 seconds. Delete the battery if we miss two heartbeats (after 21 seconds). Restore the battery once we see a heartbeat again.
--- drivers/hid/wacom.h | 1 + drivers/hid/wacom_sys.c | 25 +++++++++++++++++++++---- drivers/hid/wacom_wac.c | 1 + drivers/hid/wacom_wac.h | 1 + 4 files changed, 24 insertions(+), 4 deletions(-)
drivers/hid/wacom.h +1 -0
@@ -156,6 +156,7 @@ struct wacom_remote {struct input_dev *input;bool registered;struct wacom_battery battery; +ktime_t active_time; } remotes[WACOM_MAX_REMOTES ]; };
drivers/hid/wacom_sys.c +21 -4
@@ -2500,6 +2500,18 @@ fail:return ; } +static void wacom_remote_destroy_battery (struct wacom *wacom,int index) +{ +struct wacom_remote *remote = wacom->remote; + +if (remote->remotes[index].battery.battery) { +devres_release_group (&wacom->hdev->dev, + &remote->remotes[index].battery.bat_desc); + remote->remotes[index].battery.battery =NULL ; + remote->remotes[index].active_time =0 ; + } +} +static void wacom_remote_destroy_one (struct wacom *wacom,unsigned int index) {struct wacom_remote *remote = wacom->remote;
@@ -2514,9 +2526,7 @@ static void wacom_remote_destroy_one(str remote->remotes[i].registered = false;spin_unlock_irqrestore (&remote->remote_lock, flags); -if (remote->remotes[i].battery.battery) -devres_release_group (&wacom->hdev->dev, - &remote->remotes[i].battery.bat_desc); +wacom_remote_destroy_battery (wacom, i);if (remote->remotes[i].group.name) devres_release_group(&wacom->hdev->dev,
@@ -2524,7 +2534,6 @@ static void wacom_remote_destroy_one(str remote->remotes[i].serial =0 ; remote->remotes[i].group.name =NULL ; - remote->remotes[i].battery.battery =NULL ; wacom->led.groups[i].select =WACOM_STATUS_UNKNOWN ; } }
@@ -2609,6 +2618,9 @@ static int wacom_remote_attach_battery(sif (remote->remotes[index].battery.battery)return 0 ; +if (!remote->remotes[index].active_time) +return 0 ; +if (wacom->led.groups[index].select ==WACOM_STATUS_UNKNOWN )return 0 ;
@@ -2624,6 +2636,7 @@ static void wacom_remote_work(struct wor { struct wacom *wacom = container_of(work, struct wacom, remote_work);struct wacom_remote *remote = wacom->remote; +ktime_t kt =ktime_get ();struct wacom_remote_data data;unsigned long flags;unsigned int count;
@@ -2650,6 +2663,10 @@ static void wacom_remote_work(struct wor serial = data.remote[i].serial;if (data.remote[i].connected) { +if (kt - remote->remotes[i].active_time >WACOM_REMOTE_BATTERY_TIMEOUT + && remote->remotes[i].active_time !=0 ) +wacom_remote_destroy_battery (wacom, i); +if (remote->remotes[i].serial == serial) {wacom_remote_attach_battery (wacom, i);continue ;
drivers/hid/wacom_wac.c +1 -0
@@ -1077,6 +1077,7 @@ static int wacom_remote_irq(struct wacomif (index <0 || !remote->remotes[index].registered) goto out; + remote->remotes[i].active_time =ktime_get (); input = remote->remotes[index].input;input_report_key (input,BTN_0 , (data[9 ] &0x01 ));
drivers/hid/wacom_wac.h +1 -0
@@ -19,6 +19,7 @@#define WACOM_NAME_MAX 64#define WACOM_MAX_REMOTES 5#define WACOM_STATUS_UNKNOWN 255 +#define WACOM_REMOTE_BATTERY_TIMEOUT 21000000000ll/* packet length for individual models */ #define WACOM_PKGLEN_BBFUN 9
Greg Kroah-Hartman
maintainerPATCH 9/273 Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Wang <[email protected]>
commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 upstream.
In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame.
If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove.
--- drivers/bluetooth/btsdio.c | 1 + 1 file changed, 1 insertion(+)
drivers/bluetooth/btsdio.c +1 -0
@@ -356,6 +356,7 @@ static void btsdio_remove(struct sdio_fuif (!data)return ; +cancel_work_sync (&data->work); hdev = data->hdev;sdio_set_drvdata (func,NULL );
Greg Kroah-Hartman
maintainerPATCH 10/273 serial: sc16is7xx: fix bug when first setting GPIO direction
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <[email protected]>
commit 9baeea723c0fb9c3ba9a336369f758ed9bc6831d upstream.
When configuring a pin as an output pin with a value of logic 0, we end up as having a value of logic 1 on the output pin. Setting a logic 0 a second time (or more) after that will correctly output a logic 0 on the output pin.
By default, all GPIO pins are configured as inputs. When we enter sc16is7xx_gpio_direction_output() for the first time, we first set the desired value in IOSTATE, and then we configure the pin as an output. The datasheet states that writing to IOSTATE register will trigger a transfer of the value to the I/O pin configured as output, so if the pin is configured as an input, nothing will be transferred.
Therefore, set the direction first in IODIR, and then set the desired value in IOSTATE.
This is what is done in NXP application note AN10587.
--- drivers/tty/serial/sc16is7xx.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/tty/serial/sc16is7xx.c +10 -1
@@ -1166,9 +1166,18 @@ static int sc16is7xx_gpio_direction_outp state |=BIT (offset); else state &= ~BIT(offset); -sc16is7xx_port_write (port,SC16IS7XX_IOSTATE_REG , state); + +/* +* If we write IOSTATE first, and then IODIR, the output value is not +* transferred to the corresponding I/O pin. +* The datasheet states that each register bit will be transferred to +* the corresponding I/O pin programmed as output when writing to +* IOSTATE. Therefore, configure direction first with IODIR, and then +* set value after with IOSTATE. +*/ sc16is7xx_port_update (port,SC16IS7XX_IODIR_REG ,BIT (offset),BIT (offset)); +sc16is7xx_port_write (port,SC16IS7XX_IOSTATE_REG , state);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 11/273 fsi: master-ast-cf: Add MODULE_FIRMWARE macro
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juerg Haefliger <[email protected]>
commit 3a1d7aff6e65ad6e285e28abe55abbfd484997ee upstream.
The module loads firmware so add a MODULE_FIRMWARE macro to provide that information via modinfo.
--- drivers/fsi/fsi-master-ast-cf.c | 1 + 1 file changed, 1 insertion(+)
drivers/fsi/fsi-master-ast-cf.c +1 -0
@@ -1438,3 +1438,4 @@ static struct platform_driver fsi_mastermodule_platform_driver (fsi_master_acf);MODULE_LICENSE ("GPL" ); +MODULE_FIRMWARE (FW_FILE_NAME );
Greg Kroah-Hartman
maintainerPATCH 12/273 nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit f83913f8c5b882a312e72b7669762f8a5c9385e4 upstream.
A syzbot stress test reported that create_empty_buffers() called from nilfs_lookup_dirty_data_buffers() can cause a general protection fault.
Analysis using its reproducer revealed that the back reference "mapping" from a page/folio has been changed to NULL after dirty page/folio gang lookup in nilfs_lookup_dirty_data_buffers().
Fix this issue by excluding pages/folios from being collected if, after acquiring a lock on each page/folio, its back reference "mapping" differs from the pointer to the address space struct that held the page/folio.
---fs/nilfs2/segment.c | 5 +++++
fs/nilfs2/segment.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/nilfs2/segment.c +5 -0
@@ -730,6 +730,11 @@ static size_t nilfs_lookup_dirty_data_bustruct page *page = pvec.pages[i];lock_page (page); +if (unlikely (page->mapping != mapping)) { +/* Exclude pages removed from the address space */ +unlock_page (page); +continue ; + }if (!page_has_buffers (page))create_empty_buffers (page,i_blocksize (inode),0 );unlock_page (page);
Greg Kroah-Hartman
maintainerPATCH 13/273 nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit cdaac8e7e5a059f9b5e816cda257f08d0abffacd upstream.
A syzbot stress test using a corrupted disk image reported that mark_buffer_dirty() called from __nilfs_mark_inode_dirty() or nilfs_palloc_commit_alloc_entry() may output a kernel warning, and can panic if the kernel is booted with panic_on_warn.
This is because nilfs2 keeps buffer pointers in local structures for some metadata and reuses them, but such buffers may be forcibly discarded by nilfs_clear_dirty_page() in some critical situations.
This issue is reported to appear after commit 28a65b49eb53 ("nilfs2: do not write dirty data after degenerating to read-only"), but the issue has potentially existed before.
Fix this issue by checking the uptodate flag when attempting to reuse an internally held buffer, and reloading the metadata instead of reusing the buffer if the flag was lost.
--- fs/nilfs2/alloc.c | 3 ++- fs/nilfs2/inode.c | 7 +++++-- 2 files changed, 7 insertions(+), 3 deletions(-)
fs/nilfs2/alloc.c +2 -1
@@ -205,7 +205,8 @@ static int nilfs_palloc_get_block(structint ret;spin_lock (lock); -if (prev->bh && blkoff == prev->blkoff) { +if (prev->bh && blkoff == prev->blkoff && +likely (buffer_uptodate (prev->bh))) {get_bh (prev->bh); *bhp = prev->bh;spin_unlock (lock);
fs/nilfs2/inode.c +5 -2
@@ -1036,7 +1036,7 @@ int nilfs_load_inode_block(struct inodeint err;spin_lock (&nilfs->ns_inode_lock); -if (ii->i_bh ==NULL ) { +if (ii->i_bh ==NULL ||unlikely (!buffer_uptodate (ii->i_bh))) {spin_unlock (&nilfs->ns_inode_lock); err =nilfs_ifile_get_inode_block (ii->i_root->ifile, inode->i_ino, pbh);
@@ -1045,7 +1045,10 @@ int nilfs_load_inode_block(struct inodespin_lock (&nilfs->ns_inode_lock);if (ii->i_bh ==NULL ) ii->i_bh = *pbh; -else { +else if (unlikely (!buffer_uptodate (ii->i_bh))) { +__brelse (ii->i_bh); + ii->i_bh = *pbh; + }else {brelse (*pbh); *pbh = ii->i_bh; }
Greg Kroah-Hartman
maintainerPATCH 14/273 pinctrl: amd: Dont show `Invalid config param` errors
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
commit 87b549efcb0f7934b0916d2a00607a878b6f1e0f upstream.
On some systems amd_pinconf_set() is called with parameters 0x8 (PIN_CONFIG_DRIVE_PUSH_PULL) or 0x14 (PIN_CONFIG_PERSIST_STATE) which are not supported by pinctrl-amd.
Don't show an err message when called with an invalid parameter, downgrade this to debug instead.
--- drivers/pinctrl/pinctrl-amd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/pinctrl-amd.c +2 -2
@@ -663,7 +663,7 @@ static int amd_pinconf_get(struct pinctrbreak ;default : -dev_err (&gpio_dev->pdev->dev,"Invalid config param %04x\n" , +dev_dbg (&gpio_dev->pdev->dev,"Invalid config param %04x\n" , param);return -ENOTSUPP ; }
@@ -716,7 +716,7 @@ static int amd_pinconf_set(struct pinctrbreak ;default : -dev_err (&gpio_dev->pdev->dev, +dev_dbg (&gpio_dev->pdev->dev,"Invalid config param %04x\n" , param); ret = -ENOTSUPP ; }
Greg Kroah-Hartman
maintainerPATCH 15/273 9p: virtio: make sure offs is initialized in zc_request
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
[ Upstream commit 4a73edab69d3a6623f03817fe950a2d9585f80e4 ]
Similarly to the previous patch: offs can be used in handle_rerrors without initializing on small payloads; in this case handle_rerrors will not use it because of the size check, but it doesn't hurt to make sure it is zero to please scan-build.
This fixes the following warning:net/9p/trans_virtio.c:539:3: warning: 3rd function call argument is an uninitialized value [core.CallAndMessage]
handle_rerror(req, in_hdr_len, offs, in_pages);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--- net/9p/trans_virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/9p/trans_virtio.c +1 -1
@@ -409,7 +409,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,struct page **in_pages =NULL , **out_pages =NULL ;struct virtio_chan *chan = client->trans;struct scatterlist *sgs[4 ]; -size_t offs; +size_t offs =0 ;int need_drop =0 ;int kicked =0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 16/273 ASoC: da7219: Flush pending AAD IRQ when suspending
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmytro Maluka <[email protected]>
[ Upstream commit 91e292917dad64ab8d1d5ca2ab3069ad9dac6f72 ]
da7219_aad_suspend() disables jack detection, which should prevent generating new interrupts by DA7219 while suspended. However, there is a theoretical possibility that there is a pending interrupt generated just before suspending DA7219 and not handled yet, so the IRQ handler may still run after DA7219 is suspended. To prevent that, wait until the pending IRQ handling is done.
This patch arose as an attempt to fix the following I2C failure occurring sometimes during system suspend or resume:
[ 355.876211] i2c_designware i2c_designware.3: Transfer while suspended [ 355.876245] WARNING: CPU: 2 PID: 3576 at drivers/i2c/busses/i2c-designware-master.c:570 i2c_dw_xfer+0x411/0x440 ... [ 355.876462] Call Trace: [ 355.876468] <TASK> [ 355.876475] ? update_load_avg+0x1b3/0x615 [ 355.876484] __i2c_transfer+0x101/0x1d8 [ 355.876494] i2c_transfer+0x74/0x10d [ 355.876504] regmap_i2c_read+0x6a/0x9c [ 355.876513] _regmap_raw_read+0x179/0x223 [ 355.876521] regmap_raw_read+0x1e1/0x28e [ 355.876527] regmap_bulk_read+0x17d/0x1ba [ 355.876532] ? __wake_up+0xed/0x1bb [ 355.876542] da7219_aad_irq_thread+0x54/0x2c9 [snd_soc_da7219 5fb8ebb2179cf2fea29af090f3145d68ed8e2184] [ 355.876556] irq_thread+0x13c/0x231 [ 355.876563] ? irq_forced_thread_fn+0x5f/0x5f [ 355.876570] ? irq_thread_fn+0x4d/0x4d [ 355.876576] kthread+0x13a/0x152 [ 355.876581] ? synchronize_irq+0xc3/0xc3 [ 355.876587] ? kthread_blkcg+0x31/0x31 [ 355.876592] ret_from_fork+0x1f/0x30 [ 355.876601] </TASK>
which indicates that the AAD IRQ handler is unexpectedly running when DA7219 is suspended, and as a result, is trying to read data from DA7219 over I2C and is hitting the I2C driver "Transfer while suspended" failure.
However, with this patch the above failure is still reproducible. So this patch does not fix any real observed issue so far, but at least is useful for confirming that the above issue is not caused by a pending IRQ but rather looks like a DA7219 hardware issue with an IRQ unexpectedly generated after jack detection is already disabled.
--- sound/soc/codecs/da7219-aad.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/da7219-aad.c +2 -0
@@ -859,6 +859,8 @@ void da7219_aad_suspend(struct snd_soc_component *component) } } } + +synchronize_irq (da7219_aad->irq); }void da7219_aad_resume (struct snd_soc_component *component)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 17/273 ASoC: da7219: Check for failure reading AAD IRQ events
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmytro Maluka <[email protected]>
[ Upstream commit f0691dc16206f21b13c464434366e2cd632b8ed7 ]
When handling an AAD interrupt, if IRQ events read failed (for example, due to i2c "Transfer while suspended" failure, i.e. when attempting to read it while DA7219 is suspended, which may happen due to a spurious AAD interrupt), the events array contains garbage uninitialized values. So instead of trying to interprete those values and doing any actions based on them (potentially resulting in misbehavior, e.g. reporting bogus events), refuse to handle the interrupt.
--- sound/soc/codecs/da7219-aad.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/codecs/da7219-aad.c +7 -3
@@ -351,11 +351,15 @@ static irqreturn_t da7219_aad_irq_thread(int irq, void *data)struct da7219_priv *da7219 =snd_soc_component_get_drvdata (component);u8 events[DA7219_AAD_IRQ_REG_MAX ];u8 statusa; -int i, report =0 , mask =0 ; +int i, ret, report =0 , mask =0 ;/* Read current IRQ events */ -regmap_bulk_read (da7219->regmap,DA7219_ACCDET_IRQ_EVENT_A , - events,DA7219_AAD_IRQ_REG_MAX ); + ret =regmap_bulk_read (da7219->regmap,DA7219_ACCDET_IRQ_EVENT_A , + events,DA7219_AAD_IRQ_REG_MAX ); +if (ret) { +dev_warn_ratelimited (component->dev,"Failed to read IRQ events: %d\n" , ret); +return IRQ_NONE ; + }if (!events[DA7219_AAD_IRQ_REG_A ] && !events[DA7219_AAD_IRQ_REG_B ])return IRQ_NONE ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 18/273 ethernet: atheros: fix return value check in atl1c_tso_csum()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanjun Gong <[email protected]>
[ Upstream commit 8d01da0a1db237c44c92859ce3612df7af8d3a53 ]
in atl1c_tso_csum, it should check the return value of pskb_trim(), and return an error code if an unexpected value is returned by pskb_trim().
--- drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/atheros/atl1c/atl1c_main.c +5 -2
@@ -2002,8 +2002,11 @@ static int atl1c_tso_csum(struct atl1c_adapter *adapter, real_len = (((unsigned char *)ip_hdr (skb) - skb->data) +ntohs (ip_hdr (skb)->tot_len)); -if (real_len < skb->len) -pskb_trim (skb, real_len); +if (real_len < skb->len) { + err =pskb_trim (skb, real_len); +if (err) +return err; + } hdr_len = (skb_transport_offset (skb) +tcp_hdrlen (skb));if (unlikely (skb->len == hdr_len)) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 19/273 vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Benc <[email protected]>
[ Upstream commit 17a0a64448b568442a101de09575f81ffdc45d15 ]
The vxlan_parse_gpe_hdr function extracts the next protocol value from the GPE header and marks GPE bits as parsed.
In order to be used in the next patch, split the function into protocol extraction and bit marking. The bit marking is meaningful only in vxlan_rcv; move it directly there.
Rename the function to vxlan_parse_gpe_proto to reflect what it now does. Remove unused arguments skb and vxflags. Move the function earlier in the file to allow it to be called from more places in the next patch.
--- drivers/net/vxlan.c | 58 ++++++++++++++++++++++----------------------- 1 file changed, 28 insertions(+), 30 deletions(-)
drivers/net/vxlan.c +28 -30
@@ -542,6 +542,32 @@ static int vxlan_fdb_append(struct vxlan_fdb *f,return 1 ; } +static bool vxlan_parse_gpe_proto (struct vxlanhdr *hdr,__be16 *protocol) +{ +struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)hdr; + +/* Need to have Next Protocol set for interfaces in GPE mode. */ +if (!gpe->np_applied) +return false; +/* "The initial version is 0. If a receiver does not support the +* version indicated it MUST drop the packet. +*/ +if (gpe->version !=0 ) +return false; +/* "When the O bit is set to 1, the packet is an OAM packet and OAM +* processing MUST occur." However, we don't implement OAM +* processing, thus drop the packet. +*/ +if (gpe->oam_flag) +return false; + + *protocol =tun_p_to_eth_p (gpe->next_protocol); +if (!*protocol) +return false; + +return true; +} + static struct vxlanhdr *vxlan_gro_remcsum(struct sk_buff *skb, unsigned int off, struct vxlanhdr *vh, size_t hdrlen,
@@ -1279,35 +1305,6 @@ static void vxlan_parse_gbp_hdr(struct vxlanhdr *unparsed, unparsed->vx_flags &= ~VXLAN_GBP_USED_BITS ; } -static bool vxlan_parse_gpe_hdr (struct vxlanhdr *unparsed, -__be16 *protocol, -struct sk_buff *skb,u32 vxflags) -{ -struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)unparsed; - -/* Need to have Next Protocol set for interfaces in GPE mode. */ -if (!gpe->np_applied) -return false; -/* "The initial version is 0. If a receiver does not support the -* version indicated it MUST drop the packet. -*/ -if (gpe->version !=0 ) -return false; -/* "When the O bit is set to 1, the packet is an OAM packet and OAM -* processing MUST occur." However, we don't implement OAM -* processing, thus drop the packet. -*/ -if (gpe->oam_flag) -return false; - - *protocol =tun_p_to_eth_p (gpe->next_protocol); -if (!*protocol) -return false; - - unparsed->vx_flags &= ~VXLAN_GPE_USED_BITS ; -return true; -} -static bool vxlan_set_mac (struct vxlan_dev *vxlan,struct vxlan_sock *vs,struct sk_buff *skb,__be32 vni)
@@ -1409,8 +1406,9 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)* used by VXLAN extensions if explicitly requested. */ if (vs->flags &VXLAN_F_GPE ) { -if (!vxlan_parse_gpe_hdr (&unparsed, &protocol, skb, vs->flags)) +if (!vxlan_parse_gpe_proto (&unparsed, &protocol)) goto drop; + unparsed.vx_flags &= ~VXLAN_GPE_USED_BITS ; raw_proto = true; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 20/273 m68k: Fix invalid .section syntax
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
[ Upstream commit 922a9bd138101e3e5718f0f4d40dba68ef89bb43 ]
gas supports several different forms for .section for ELF targets, including:
.section NAME [, "FLAGS"[, @TYPE[,FLAG_SPECIFIC_ARGUMENTS]]]
and:
.section "NAME"[, #FLAGS...]
In several places we use a mix of these two forms:
.section NAME, #FLAGS...
A current development snapshot of binutils (2.40.50.20230611) treats this mixed syntax as an error.
Change to consistently use:
.section NAME, "FLAGS"
as is used elsewhere in the kernel.
--- arch/m68k/fpsp040/skeleton.S | 4 ++-- arch/m68k/ifpsp060/os.S | 4 ++-- arch/m68k/kernel/relocate_kernel.S | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-)
arch/m68k/fpsp040/skeleton.S +2 -2
@@ -499,12 +499,12 @@ in_ea: dbf %d0,morein rts - .section .fixup,#alloc,#execinstr + .section .fixup,"ax" .even 1: jbra fpsp040_die - .section __ex_table,#alloc + .section __ex_table,"a" .align 4 .long in_ea,1b
arch/m68k/ifpsp060/os.S +2 -2
@@ -379,11 +379,11 @@ _060_real_access: | Execption handling for movs access to illegal memory - .section .fixup,#alloc,#execinstr + .section .fixup,"ax" .even 1: moveq #-1,%d1 rts -.section __ex_table,#alloc +.section __ex_table,"a" .align 4 .long dmrbuae,1b .long dmrwuae,1b
arch/m68k/kernel/relocate_kernel.S +2 -2
@@ -26,7 +26,7 @@ ENTRY(relocate_new_kernel) lea %pc@(.Lcopy),%a4 2: addl #0x00000000,%a4 /* virt_to_phys() */ - .section ".m68k_fixup","aw" + .section .m68k_fixup,"aw" .long M68K_FIXUP_MEMOFFSET, 2b+2 .previous
@@ -49,7 +49,7 @@ ENTRY(relocate_new_kernel) lea %pc@(.Lcont040),%a4 5: addl #0x00000000,%a4 /* virt_to_phys() */ - .section ".m68k_fixup","aw" + .section .m68k_fixup,"aw" .long M68K_FIXUP_MEMOFFSET, 5b+2 .previous
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 21/273 s390/dasd: use correct number of retries for ERP requests
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Haberland <[email protected]>
[ Upstream commit acea28a6b74f458defda7417d2217b051ba7d444 ]
If a DASD request fails an error recovery procedure (ERP) request might be built as a copy of the original request to do error recovery.
The ERP request gets a number of retries assigned.
This number is always 256 no matter what other value might have been set for the original request. This is not what is expected when a user specifies a certain amount of retries for the device via sysfs.
Correctly use the number of retries of the original request for ERP requests.
--- drivers/s390/block/dasd_3990_erp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/block/dasd_3990_erp.c +1 -1
@@ -2436,7 +2436,7 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr) erp->block = cqr->block; erp->magic = cqr->magic; erp->expires = cqr->expires; - erp->retries =256 ; + erp->retries = device->default_retries; erp->buildclk =get_tod_clock (); erp->status =DASD_CQR_FILLED ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 22/273 s390/dasd: fix hanging device after request requeue
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Haberland <[email protected]>
[ Upstream commit 8a2278ce9c25048d999fe1a3561def75d963f471 ]
The DASD device driver has a function to requeue requests to the blocklayer.
This function is used in various cases when basic settings for the device have to be changed like High Performance Ficon related parameters or copy pair settings.
The functions iterates over the device->ccw_queue and also removes the requests from the block->ccw_queue.
In case the device is started on an alias device instead of the base device it might be removed from the block->ccw_queue without having it canceled properly before. This might lead to a hanging device since the request is no longer on a queue and can not be handled properly.
Fix by iterating over the block->ccw_queue instead of the device->ccw_queue. This will take care of all blocklayer related requests and handle them on all associated DASD devices.
--- drivers/s390/block/dasd.c | 125 +++++++++++++++----------------------- 1 file changed, 48 insertions(+), 77 deletions(-)
drivers/s390/block/dasd.c +48 -77
@@ -2826,41 +2826,32 @@ static void _dasd_wake_block_flush_cb(struct dasd_ccw_req *cqr, void *data)* Requeue a request back to the block request queue * only works for block requests */ -static int _dasd_requeue_request (struct dasd_ccw_req *cqr) +static void _dasd_requeue_request (struct dasd_ccw_req *cqr) { -struct dasd_block *block = cqr->block;struct request *req; -if (!block) -return -EINVAL ;/* * If the request is an ERP request there is nothing to requeue. * This will be done with the remaining original request. */ if (cqr->refers) -return 0 ; +return ;spin_lock_irq (&cqr->dq->lock); req = (struct request *) cqr->callback_data;blk_mq_requeue_request (req, true);spin_unlock_irq (&cqr->dq->lock); -return 0 ; +return ; } -/* -* Go through all request on the dasd_block request queue, cancel them -* on the respective dasd_device, and return them to the generic -* block layer. -*/ -static int dasd_flush_block_queue (struct dasd_block *block) +static int _dasd_requests_to_flushqueue (struct dasd_block *block, +struct list_head *flush_queue) {struct dasd_ccw_req *cqr, *n; -int rc, i; -struct list_head flush_queue;unsigned long flags; +int rc, i; -INIT_LIST_HEAD (&flush_queue); -spin_lock_bh (&block->queue_lock); +spin_lock_irqsave (&block->queue_lock, flags); rc =0 ; restart:list_for_each_entry_safe (cqr, n, &block->ccw_queue, blocklist) {
@@ -2875,13 +2866,32 @@ static int dasd_flush_block_queue(struct dasd_block *block)* is returned from the dasd_device layer. */ cqr->callback = _dasd_wake_block_flush_cb; -for (i =0 ; cqr !=NULL ; cqr = cqr->refers, i++) -list_move_tail (&cqr->blocklist, &flush_queue); +for (i =0 ; cqr; cqr = cqr->refers, i++) +list_move_tail (&cqr->blocklist, flush_queue);if (i >1 )/* moved more than one request - need to restart */ goto restart; } -spin_unlock_bh (&block->queue_lock); +spin_unlock_irqrestore (&block->queue_lock, flags); + +return rc; +} + +/* +* Go through all request on the dasd_block request queue, cancel them +* on the respective dasd_device, and return them to the generic +* block layer. +*/ +static int dasd_flush_block_queue (struct dasd_block *block) +{ +struct dasd_ccw_req *cqr, *n; +struct list_head flush_queue; +unsigned long flags; +int rc; + +INIT_LIST_HEAD (&flush_queue); + rc =_dasd_requests_to_flushqueue (block, &flush_queue); +/* Now call the callback function of flushed requests */ restart_cb:list_for_each_entry_safe (cqr, n, &flush_queue, blocklist) {
@@ -3832,75 +3842,36 @@ EXPORT_SYMBOL_GPL(dasd_generic_verify_path);*/ static int dasd_generic_requeue_all_requests (struct dasd_device *device) { +struct dasd_block *block = device->block;struct list_head requeue_queue;struct dasd_ccw_req *cqr, *n; -struct dasd_ccw_req *refers;int rc; -INIT_LIST_HEAD (&requeue_queue); -spin_lock_irq (get_ccwdev_lock (device->cdev)); - rc =0 ; -list_for_each_entry_safe (cqr, n, &device->ccw_queue, devlist) { -/* Check status and move request to flush_queue */ -if (cqr->status ==DASD_CQR_IN_IO ) { - rc = device->discipline->term_IO (cqr); -if (rc) { -/* unable to terminate requeust */ -dev_err (&device->cdev->dev, -"Unable to terminate request %p " -"on suspend\n" , cqr); -spin_unlock_irq (get_ccwdev_lock (device->cdev)); -dasd_put_device (device); -return rc; - } - } -list_move_tail (&cqr->devlist, &requeue_queue); - } -spin_unlock_irq (get_ccwdev_lock (device->cdev)); - -list_for_each_entry_safe (cqr, n, &requeue_queue, devlist) { -wait_event (dasd_flush_wq, - (cqr->status !=DASD_CQR_CLEAR_PENDING )); +if (!block) +return 0 ; -/* -* requeue requests to blocklayer will only work -* for block device requests -*/ -if (_dasd_requeue_request (cqr)) -continue ; +INIT_LIST_HEAD (&requeue_queue); + rc =_dasd_requests_to_flushqueue (block, &requeue_queue); -/* remove requests from device and block queue */ -list_del_init (&cqr->devlist); -while (cqr->refers !=NULL ) { - refers = cqr->refers; -/* remove the request from the block queue */ -list_del (&cqr->blocklist); -/* free the finished erp request */ -dasd_free_erp_request (cqr, cqr->memdev); - cqr = refers; +/* Now call the callback function of flushed requests */ +restart_cb: +list_for_each_entry_safe (cqr, n, &requeue_queue, blocklist) { +wait_event (dasd_flush_wq, (cqr->status <DASD_CQR_QUEUED )); +/* Process finished ERP request. */ +if (cqr->refers) { +spin_lock_bh (&block->queue_lock); +__dasd_process_erp (block->base, cqr); +spin_unlock_bh (&block->queue_lock); +/* restart list_for_xx loop since dasd_process_erp +* might remove multiple elements +*/ + goto restart_cb; } - -/* -* _dasd_requeue_request already checked for a valid -* blockdevice, no need to check again -* all erp requests (cqr->refers) have a cqr->block -* pointer copy from the original cqr -*/ +_dasd_requeue_request (cqr);list_del_init (&cqr->blocklist); cqr->block->base->discipline->free_cp ( cqr, (struct request *) cqr->callback_data); } - -/* -* if requests remain then they are internal request -* and go back to the device queue -*/ -if (!list_empty (&requeue_queue)) { -/* move freeze_queue to start of the ccw_queue */ -spin_lock_irq (get_ccwdev_lock (device->cdev)); -list_splice_tail (&requeue_queue, &device->ccw_queue); -spin_unlock_irq (get_ccwdev_lock (device->cdev)); - }dasd_schedule_device_bh (device);return rc; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 23/273 fs/nls: make load_nls() take a const parameter
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Winston Wen <[email protected]>
[ Upstream commit c1ed39ec116272935528ca9b348b8ee79b0791da ]
load_nls() take a char * parameter, use it to find nls module in list or construct the module name to load it.
This change make load_nls() take a const parameter, so we don't need do some cast like this:
ses->local_nls = load_nls((char *)ctx->local_nls->charset);
--- fs/nls/nls_base.c | 4 ++-- include/linux/nls.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
fs/nls/nls_base.c +2 -2
@@ -272,7 +272,7 @@ int unregister_nls(struct nls_table * nls)return -EINVAL ; } -static struct nls_table *find_nls (char *charset) +static struct nls_table *find_nls (const char *charset) {struct nls_table *nls;spin_lock (&nls_lock);
@@ -288,7 +288,7 @@ static struct nls_table *find_nls(char *charset)return nls; } -struct nls_table *load_nls (char *charset) +struct nls_table *load_nls (const char *charset) {return try_then_request_module (find_nls (charset),"nls_%s" , charset); }
include/linux/nls.h +1 -1
@@ -47,7 +47,7 @@ enum utf16_endian {/* nls_base.c */ extern int __register_nls (struct nls_table *,struct module *);extern int unregister_nls (struct nls_table *); -extern struct nls_table *load_nls (char *); +extern struct nls_table *load_nls (const char *charset);extern void unload_nls (struct nls_table *);extern struct nls_table *load_nls_default (void );#define register_nls (nls) __register_nls((nls), THIS_MODULE)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 24/273 ASoc: codecs: ES8316: Fix DMIC config
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edgar <[email protected]>
[ Upstream commit d20d35d1ad62c6cca36368c1e8f29335a068659e ]
According to the datasheet, the DMIC config should be changed to { 0, 2 ,3 }
--- sound/soc/codecs/es8316.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/es8316.c +1 -1
@@ -145,7 +145,7 @@ static const char * const es8316_dmic_txt[] = {"dmic data at high level" , "dmic data at low level", }; -static const unsigned int es8316_dmic_values[] = {0 ,1 ,2 }; +static const unsigned int es8316_dmic_values[] = {0 ,2 ,3 };static const struct soc_enum es8316_dmic_src_enum = SOC_VALUE_ENUM_SINGLE(ES8316_ADC_DMIC, 0, 3, ARRAY_SIZE(es8316_dmic_txt),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 25/273 ASoC: atmel: Fix the 8K sample parameter in I2SC master
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guiting Shen <[email protected]>
[ Upstream commit f85739c0b2b0d98a32f5ca4fcc5501d2b76df4f6 ]
The 8K sample parameter of 12.288Mhz main system bus clock doesn't work because the I2SC_MR.IMCKDIV must not be 0 according to the sama5d2 series datasheet(I2SC Mode Register of Register Summary).
So use the 6.144Mhz instead of 12.288Mhz to support 8K sample.
--- sound/soc/atmel/atmel-i2s.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/atmel/atmel-i2s.c +4 -1
@@ -174,11 +174,14 @@ struct atmel_i2s_gck_param {#define I2S_MCK_12M288 12288000UL#define I2S_MCK_11M2896 11289600UL +#define I2S_MCK_6M144 6144000UL/* mck = (32 * (imckfs+1) / (imckdiv+1)) * fs */ static const struct atmel_i2s_gck_param gck_params[] = { +/* mck = 6.144Mhz */ + {8000 ,I2S_MCK_6M144 ,1 ,47 },/* mck = 768 fs */ +/* mck = 12.288MHz */ - {8000 ,I2S_MCK_12M288 ,0 ,47 },/* mck = 1536 fs */ {16000 ,I2S_MCK_12M288 ,1 ,47 },/* mck = 768 fs */ {24000 ,I2S_MCK_12M288 ,3 ,63 },/* mck = 512 fs */ {32000 ,I2S_MCK_12M288 ,3 ,47 },/* mck = 384 fs */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 26/273 platform/x86: intel: hid: Always call BTNL ACPI method
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit e3ab18de2b09361d6f0e4aafb9cfd6d002ce43a1 ]
On a HP Elite Dragonfly G2 the 0xcc and 0xcd events for SW_TABLET_MODE are only send after the BTNL ACPI method has been called.
Likely more devices need this, so make the BTNL ACPI method unconditional instead of only doing it on devices with a 5 button array.
Note this also makes the intel_button_array_enable() call in probe() unconditional, that function does its own priv->array check. This makes the intel_button_array_enable() call in probe() consistent with the calls done on suspend/resume which also rely on the priv->array check inside the function.
--- drivers/platform/x86/intel-hid.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
drivers/platform/x86/intel-hid.c +9 -12
@@ -449,7 +449,7 @@ static bool button_array_present(struct platform_device *device)static int intel_hid_probe (struct platform_device *device) {acpi_handle handle =ACPI_HANDLE (&device->dev); -unsigned long long mode; +unsigned long long mode, dummy;struct intel_hid_priv *priv;acpi_status status;int err;
@@ -501,18 +501,15 @@ static int intel_hid_probe(struct platform_device *device)if (err) goto err_remove_notify; -if (priv->array) { -unsigned long long dummy; +intel_button_array_enable (&device->dev, true); -intel_button_array_enable (&device->dev, true); - -/* Call button load method to enable HID power button */ -if (!intel_hid_evaluate_method (handle,INTEL_HID_DSM_BTNL_FN , - &dummy)) { -dev_warn (&device->dev, -"failed to enable HID power button\n" ); - } - } +/* +* Call button load method to enable HID power button +* Always do this since it activates events on some devices without +* a button array too. +*/ +if (!intel_hid_evaluate_method (handle,INTEL_HID_DSM_BTNL_FN , &dummy)) +dev_warn (&device->dev,"failed to enable HID power button\n" );device_init_wakeup (&device->dev, true);return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 27/273 security: keys: perform capable check only on privileged operations
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Göttsche <[email protected]>
[ Upstream commit 2d7f105edbb3b2be5ffa4d833abbf9b6965e9ce7 ]
If the current task fails the check for the queried capability via capable(CAP_SYS_ADMIN) LSMs like SELinux generate a denial message. Issuing such denial messages unnecessarily can lead to a policy author granting more privileges to a subject than needed to silence them.
Reorder CAP_SYS_ADMIN checks after the check whether the operation is actually privileged.
--- security/keys/keyctl.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
security/keys/keyctl.c +8 -3
@@ -922,14 +922,19 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group) ret = -EACCES ;down_write (&key->sem); -if (!capable (CAP_SYS_ADMIN )) { + { +bool is_privileged_op = false; +/* only the sysadmin can chown a key to some other UID */ if (user != (uid_t) -1 && !uid_eq (key->uid, uid)) - goto error_put; + is_privileged_op = true;/* only the sysadmin can set the key's GID to a group other * than one of those that the current process subscribes to */ if (group != (gid_t) -1 && !gid_eq (gid, key->gid) && !in_group_p (gid)) + is_privileged_op = true; + +if (is_privileged_op && !capable (CAP_SYS_ADMIN )) goto error_put; }
@@ -1029,7 +1034,7 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm)down_write (&key->sem);/* if we're not the sysadmin, we can only change a key that we own */ -if (capable (CAP_SYS_ADMIN ) ||uid_eq (key->uid,current_fsuid ())) { +if (uid_eq (key->uid,current_fsuid ()) ||capable (CAP_SYS_ADMIN )) { key->perm = perm; ret =0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 28/273 net: usb: qmi_wwan: add Quectel EM05GV2
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kohn <[email protected]>
[ Upstream commit d4480c9bb9258db9ddf2e632f6ef81e96b41089c ]
Add support for Quectel EM05GV2 (G=global) with vendor ID 0x2c7c and product ID 0x030e
Enabling DTR on this modem was necessary to ensure stable operation. Patch for usb: serial: option: is also in progress.
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030e Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1376,6 +1376,7 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */ {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)}, /* Quectel EM05GV2 */ {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */ {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */ {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 29/273 idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <[email protected]>
[ Upstream commit b1e213a9e31c20206f111ec664afcf31cbfe0dbb ]
On s390 systems (aka mainframes), it has classic channel devices for networking and permanent storage that are currently even more common than PCI devices. Hence it could have a fully functional s390 kernel with CONFIG_PCI=n, then the relevant iomem mapping functions [including ioremap(), devm_ioremap(), etc.] are not available.
Here let FSL_EDMA and INTEL_IDMA64 depend on HAS_IOMEM so that it won't be built to cause below compiling error if PCI is unset.
--------
ERROR: modpost: "devm_platform_ioremap_resource" [drivers/dma/fsl-edma.ko] undefined!
ERROR: modpost: "devm_platform_ioremap_resource" [drivers/dma/idma64.ko] undefined!
--------
--- drivers/dma/Kconfig | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/Kconfig +2 -0
@@ -212,6 +212,7 @@ config FSL_DMA config FSL_EDMA tristate "Freescale eDMA engine support" depends on OF + depends on HAS_IOMEM select DMA_ENGINE select DMA_VIRTUAL_CHANNELS help
@@ -258,6 +259,7 @@ config IMX_SDMA config INTEL_IDMA64 tristate "Intel integrated DMA 64-bit support" + depends on HAS_IOMEM select DMA_ENGINE select DMA_VIRTUAL_CHANNELS help
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 30/273 scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <[email protected]>
[ Upstream commit dd64f80587190265ca8a0f4be6c64c2fda6d3ac2 ]
As &qedi_percpu->p_work_lock is acquired by hard IRQ qedi_msix_handler(), other acquisitions of the same lock under process context should disable IRQ, otherwise deadlock could happen if the IRQ preempts the execution while the lock is held in process context on the same CPU.
qedi_cpu_offline() is one such function which acquires the lock in process context.
[Deadlock Scenario]qedi_cpu_offline()
->spin_lock(&p->p_work_lock)
<irq>
->qedi_msix_handler()
->edi_process_completions()
->spin_lock_irqsave(&p->p_work_lock, flags); (deadlock here)This flaw was found by an experimental static analysis tool I am developing for IRQ-related deadlocks.
The tentative patch fix the potential deadlock by spin_lock_irqsave() under process context.
--- drivers/scsi/qedi/qedi_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/qedi/qedi_main.c +3 -2
@@ -1864,8 +1864,9 @@ static int qedi_cpu_offline(unsigned int cpu)struct qedi_percpu_s *p =this_cpu_ptr (&qedi_percpu);struct qedi_work *work, *tmp;struct task_struct *thread; +unsigned long flags; -spin_lock_bh (&p->p_work_lock); +spin_lock_irqsave (&p->p_work_lock, flags); thread = p->iothread; p->iothread =NULL ;
@@ -1876,7 +1877,7 @@ static int qedi_cpu_offline(unsigned int cpu)kfree (work); } -spin_unlock_bh (&p->p_work_lock); +spin_unlock_irqrestore (&p->p_work_lock, flags);if (thread)kthread_stop (thread);return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 31/273 netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Mastykin <[email protected]>
[ Upstream commit b403643d154d15176b060b82f7fc605210033edd ]
There is a shift wrapping bug in this code on 32-bit architectures. NETLBL_CATMAP_MAPTYPE is u64, bitmap is unsigned long. Every second 32-bit word of catmap becomes corrupted.
--- net/netlabel/netlabel_kapi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netlabel/netlabel_kapi.c +2 -1
@@ -871,7 +871,8 @@ int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, offset -= iter->startbit; idx = offset /NETLBL_CATMAP_MAPSIZE ; - iter->bitmap[idx] |= bitmap << (offset %NETLBL_CATMAP_MAPSIZE ); + iter->bitmap[idx] |= (NETLBL_CATMAP_MAPTYPE )bitmap + << (offset %NETLBL_CATMAP_MAPSIZE );return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 32/273 bnx2x: fix page fault following EEH recovery
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Christensen <[email protected]>
[ Upstream commit 7ebe4eda4265642859507d1b3ca330d8c196cfe5 ]
In the last step of the EEH recovery process, the EEH driver calls into bnx2x_io_resume() to re-initialize the NIC hardware via the function bnx2x_nic_load(). If an error occurs during bnx2x_nic_load(), OS and hardware resources are released and an error code is returned to the caller. When called from bnx2x_io_resume(), the return code is ignored and the network interface is brought up unconditionally. Later attempts to send a packet via this interface result in a page fault due to a null pointer reference.
This patch checks the return code of bnx2x_nic_load(), prints an error message if necessary, and does not enable the interface.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +7 -2
@@ -14464,11 +14464,16 @@ static void bnx2x_io_resume(struct pci_dev *pdev) bp->fw_seq =SHMEM_RD (bp, func_mb[BP_FW_MB_IDX (bp)].drv_mb_header) &DRV_MSG_SEQ_NUMBER_MASK ; -if (netif_running (dev)) -bnx2x_nic_load (bp,LOAD_NORMAL ); +if (netif_running (dev)) { +if (bnx2x_nic_load (bp,LOAD_NORMAL )) { +netdev_err (bp->dev,"Error during driver initialization, try unloading/reloading the driver\n" ); + goto done; + } + }netif_device_attach (dev); +done:rtnl_unlock (); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 33/273 sctp: handle invalid error codes without calling BUG()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit a0067dfcd9418fd3b0632bc59210d120d038a9c6 ]
The sctp_sf_eat_auth() function is supposed to return enum sctp_disposition values but if the call to sctp_ulpevent_make_authkey() fails, it returns -ENOMEM.
This results in calling BUG() inside the sctp_side_effects() function. Calling BUG() is an over reaction and not helpful. Call WARN_ON_ONCE() instead.
This code predates git.
--- net/sctp/sm_sideeffect.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/sctp/sm_sideeffect.c +4 -1
@@ -1255,7 +1255,10 @@ static int sctp_side_effects(enum sctp_event event_type,default :pr_err ("impossible disposition %d in state %d, event_type %d, event_id %d\n" , status, state, event_type, subtype.chunk); -BUG (); + error = status; +if (error >=0 ) + error = -EINVAL ; +WARN_ON_ONCE (1 );break ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 34/273 cifs: add a warning when the in-flight count goes negative
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shyam Prasad N <[email protected]>
[ Upstream commit e4645cc2f1e2d6f268bb8dcfac40997c52432aed ]
We've seen the in-flight count go into negative with some internal stress testing in Microsoft.
Adding a WARN when this happens, in hope of understanding why this happens when it happens.
--- fs/cifs/smb2ops.c | 1 + 1 file changed, 1 insertion(+)
fs/cifs/smb2ops.c +1 -0
@@ -79,6 +79,7 @@ smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add, *val =65000 ;/* Don't get near 64K credits, avoid srv bugs */ printk_once (KERN_WARNING "server overflowed SMB3 credits\n" ); } +WARN_ON_ONCE (server->in_flight ==0 ); server->in_flight--;if (server->in_flight ==0 && (optype &CIFS_OP_MASK ) !=CIFS_NEG_OP ) rc =change_conf (server);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 35/273 ALSA: seq: oss: Fix racy open/close of MIDI devices
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 297224fc0922e7385573a30c29ffdabb67f27b7d ]
Although snd_seq_oss_midi_open() and snd_seq_oss_midi_close() can be called concurrently from different code paths, we have no proper data protection against races. Introduce open_mutex to each seq_oss_midi object for avoiding the races.
--- sound/core/seq/oss/seq_oss_midi.c | 35 +++++++++++++++++++------------ 1 file changed, 22 insertions(+), 13 deletions(-)
sound/core/seq/oss/seq_oss_midi.c +22 -13
@@ -50,6 +50,7 @@ struct seq_oss_midi {struct snd_midi_event *coder;/* MIDI event coder */ struct seq_oss_devinfo *devinfo;/* assigned OSSseq device */ snd_use_lock_t use_lock; +struct mutex open_mutex; };
@@ -184,6 +185,7 @@ snd_seq_oss_midi_check_new_port(struct snd_seq_port_info *pinfo) mdev->flags = pinfo->capability; mdev->opened =0 ;snd_use_lock_init (&mdev->use_lock); +mutex_init (&mdev->open_mutex);/* copy and truncate the name of synth device */ strlcpy (mdev->name, pinfo->name,sizeof (mdev->name));
@@ -332,14 +334,16 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)int perm;struct seq_oss_midi *mdev;struct snd_seq_port_subscribe subs; +int err;if ((mdev =get_mididev (dp, dev)) ==NULL )return -ENODEV ; +mutex_lock (&mdev->open_mutex);/* already used? */ if (mdev->opened && mdev->devinfo != dp) { -snd_use_lock_free (&mdev->use_lock); -return -EBUSY ; + err = -EBUSY ; + goto unlock; } perm =0 ;
@@ -349,14 +353,14 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode) perm |=PERM_READ ; perm &= mdev->flags;if (perm ==0 ) { -snd_use_lock_free (&mdev->use_lock); -return -ENXIO ; + err = -ENXIO ; + goto unlock; }/* already opened? */ if ((mdev->opened & perm) == perm) { -snd_use_lock_free (&mdev->use_lock); -return 0 ; + err =0 ; + goto unlock; } perm &= ~mdev->opened;
@@ -381,13 +385,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode) }if (! mdev->opened) { -snd_use_lock_free (&mdev->use_lock); -return -ENXIO ; + err = -ENXIO ; + goto unlock; } mdev->devinfo = dp; + err =0 ; + + unlock: +mutex_unlock (&mdev->open_mutex);snd_use_lock_free (&mdev->use_lock); -return 0 ; +return err; }/*
@@ -401,10 +409,9 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)if ((mdev =get_mididev (dp, dev)) ==NULL )return -ENODEV ; -if (! mdev->opened || mdev->devinfo != dp) { -snd_use_lock_free (&mdev->use_lock); -return 0 ; - } +mutex_lock (&mdev->open_mutex); +if (!mdev->opened || mdev->devinfo != dp) + goto unlock;memset (&subs,0 ,sizeof (subs));if (mdev->opened &PERM_WRITE ) {
@@ -423,6 +430,8 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev) mdev->opened =0 ; mdev->devinfo =NULL ; + unlock: +mutex_unlock (&mdev->open_mutex);snd_use_lock_free (&mdev->use_lock);return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 36/273 net: Avoid address overwrite in kernel_connect
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <[email protected]>
commit 0bdf399342c5acbd817c9098b6c7ed21f1974312 upstream.
BPF programs that run on connect can rewrite the connect address. For the connect system call this isn't a problem, because a copy of the address is made when it is moved into kernel space. However, kernel_connect simply passes through the address it is given, so the caller may observe its address value unexpectedly change.
A practical example where this is problematic is where NFS is combined with a system such as Cilium which implements BPF-based load balancing. A common pattern in software-defined storage systems is to have an NFS mount that connects to a persistent virtual IP which in turn maps to an ephemeral server IP. This is usually done to achieve high availability:
if your server goes down you can quickly spin up a replacement and remap the virtual IP to that endpoint. With BPF-based load balancing, mounts will forget the virtual IP address when the address rewrite occurs because a pointer to the only copy of that address is passed down the stack. Server failover then breaks, because clients have forgotten the virtual IP address. Reconnects fail and mounts remain broken. This patch was tested by setting up a scenario like this and ensuring that NFS reconnects worked after applying the patch.
--- net/socket.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/socket.c +5 -1
@@ -3468,7 +3468,11 @@ EXPORT_SYMBOL(kernel_accept);int kernel_connect (struct socket *sock,struct sockaddr *addr,int addrlen,int flags) { -return sock->ops->connect (sock, addr, addrlen, flags); +struct sockaddr_storage address; + +memcpy (&address, addr, addrlen); + +return sock->ops->connect (sock, (struct sockaddr *)&address, addrlen, flags); }EXPORT_SYMBOL (kernel_connect);
Greg Kroah-Hartman
maintainerPATCH 37/273 powerpc/32: Include .branch_lt in data section
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Stanley <[email protected]>
commit 98ecc6768e8fdba95da1fc1efa0ef2d769e7fe1c upstream.
When building a 32 bit powerpc kernel with Binutils 2.31.1 this warning is emitted:
powerpc-linux-gnu-ld: warning: orphan section .branch_lt' from arch/powerpc/kernel/head_44x.o' being placed in section `.branch_lt'
As of binutils commit 2d7ad24e8726 ("Support PLT16 relocs against local symbols")[1], 32 bit targets can produce .branch_lt sections in their output.
Include these symbols in the .data section as the ppc64 kernel does.
--- arch/powerpc/kernel/vmlinux.lds.S | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/kernel/vmlinux.lds.S +1 -0
@@ -328,6 +328,7 @@ SECTIONS *(.sdata2) *(.got.plt) *(.got) *(.plt) + *(.branch_lt) } #else .data : AT(ADDR(.data) - LOAD_OFFSET) {
Greg Kroah-Hartman
maintainerPATCH 38/273 powerpc/32s: Fix assembler warning about r0
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit b51ba4fe2e134b631f9c8f45423707aab71449b5 upstream.
The assembler says:
arch/powerpc/kernel/head_32.S:1095: Warning: invalid register expression
It's objecting to the use of r0 as the RA argument. That's because when RA = 0 the literal value 0 is used, rather than the content of r0, making the use of r0 in the source potentially confusing.
Fix it to use a literal 0, the generated code is identical.
--- arch/powerpc/kernel/head_32.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/head_32.S +1 -1
@@ -987,7 +987,7 @@ start_here: */ lis r5, abatron_pteptrs@h ori r5, r5, abatron_pteptrs@l - stw r5, 0xf0(r0) /* This much match your Abatron config */ + stw r5, 0xf0(0) /* This much match your Abatron config */ lis r6, swapper_pg_dir@h ori r6, r6, swapper_pg_dir@l tophys(r5, r5)
Greg Kroah-Hartman
maintainerPATCH 39/273 udf: Check consistency of Space Bitmap Descriptor
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladislav Efanov <[email protected]>
commit 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d upstream.
Bits, which are related to Bitmap Descriptor logical blocks, are not reset when buffer headers are allocated for them. As the result, these logical blocks can be treated as free and be used for other blocks.This can cause usage of one buffer header for several types of data. UDF issues WARNING in this situation:
WARNING: CPU: 0 PID: 2703 at fs/udf/inode.c:2014 __udf_add_aext+0x685/0x7d0 fs/udf/inode.c:2014 RIP: 0010:__udf_add_aext+0x685/0x7d0 fs/udf/inode.c:2014 Call Trace: udf_setup_indirect_aext+0x573/0x880 fs/udf/inode.c:1980 udf_add_aext+0x208/0x2e0 fs/udf/inode.c:2067 udf_insert_aext fs/udf/inode.c:2233 [inline] udf_update_extents fs/udf/inode.c:1181 [inline] inode_getblk+0x1981/0x3b70 fs/udf/inode.c:885
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
[JK: Somewhat cleaned up the boundary checks]
--- fs/udf/balloc.c | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-)
fs/udf/balloc.c +27 -4
@@ -36,18 +36,41 @@ static int read_block_bitmap(struct supe unsigned long bitmap_nr) {struct buffer_head *bh =NULL ; -int retval =0 ; +int i; +int max_bits, off, count;struct kernel_lb_addr loc; loc.logicalBlockNum = bitmap->s_extPosition; loc.partitionReferenceNum =UDF_SB (sb)->s_partition; bh =udf_tread (sb,udf_get_lb_pblock (sb, &loc, block)); + bitmap->s_block_bitmap[bitmap_nr] = bh;if (!bh) - retval = -EIO ; +return -EIO ; - bitmap->s_block_bitmap[bitmap_nr] = bh; -return retval; +/* Check consistency of Space Bitmap buffer. */ + max_bits = sb->s_blocksize *8 ; +if (!bitmap_nr) { + off =sizeof (struct spaceBitmapDesc ) <<3 ; + count =min (max_bits - off, bitmap->s_nr_groups); + }else { +/* +* Rough check if bitmap number is too big to have any bitmap +* blocks reserved. +*/ +if (bitmap_nr > + (bitmap->s_nr_groups >> (sb->s_blocksize_bits +3 )) +2 ) +return 0 ; + off =0 ; + count = bitmap->s_nr_groups - bitmap_nr * max_bits + + (sizeof (struct spaceBitmapDesc ) <<3 ); + count =min (count, max_bits); + } + +for (i =0 ; i < count; i++) +if (udf_test_bit (i + off, bh->b_data)) +return -EFSCORRUPTED ; +return 0 ; } static int __load_block_bitmap(struct super_block *sb,
Greg Kroah-Hartman
maintainerPATCH 40/273 udf: Handle error when adding extent to a file
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 19fd80de0a8b5170ef34704c8984cca920dffa59 upstream.
When adding extent to a file fails, so far we've silently squelshed the error. Make sure to propagate it up properly.
--- fs/udf/inode.c | 41 +++++++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 14 deletions(-)
fs/udf/inode.c +27 -14
@@ -50,15 +50,15 @@ static int udf_update_inode(struct inodestatic int udf_sync_inode (struct inode *inode);static int udf_alloc_i_data (struct inode *inode,size_t size);static sector_t inode_getblk (struct inode *,sector_t ,int *,int *); -static int8_t udf_insert_aext (struct inode *,struct extent_position , -struct kernel_lb_addr ,uint32_t ); +static int udf_insert_aext (struct inode *,struct extent_position , +struct kernel_lb_addr ,uint32_t );static void udf_split_extents (struct inode *,int *,int ,udf_pblk_t ,struct kernel_long_ad *,int *);static void udf_prealloc_extents (struct inode *,int ,int ,struct kernel_long_ad *,int *);static void udf_merge_extents (struct inode *,struct kernel_long_ad *,int *); -static void udf_update_extents (struct inode *,struct kernel_long_ad *,int , -int ,struct extent_position *); +static int udf_update_extents (struct inode *,struct kernel_long_ad *,int , +int ,struct extent_position *);static int udf_get_block (struct inode *,sector_t ,struct buffer_head *,int );static void __udf_clear_extent_cache (struct inode *inode)
@@ -881,7 +881,9 @@ static sector_t inode_getblk(struct inod/* write back the new extents, inserting new extents if the new number * of extents is greater than the old number, and deleting extents if * the new number of extents is less than the old number */ -udf_update_extents (inode, laarr, startnum, endnum, &prev_epos); + *err =udf_update_extents (inode, laarr, startnum, endnum, &prev_epos); +if (*err <0 ) + goto out_free; newblock =udf_get_pblock (inode->i_sb, newblocknum, iinfo->i_location.partitionReferenceNum,0 );
@@ -1149,21 +1151,30 @@ static void udf_merge_extents(struct ino } } -static void udf_update_extents (struct inode *inode,struct kernel_long_ad *laarr, -int startnum,int endnum, -struct extent_position *epos) +static int udf_update_extents (struct inode *inode,struct kernel_long_ad *laarr, +int startnum,int endnum, +struct extent_position *epos) {int start =0 , i;struct kernel_lb_addr tmploc;uint32_t tmplen; +int err;if (startnum > endnum) {for (i =0 ; i < (startnum - endnum); i++)udf_delete_aext (inode, *epos); }else if (startnum < endnum) {for (i =0 ; i < (endnum - startnum); i++) { -udf_insert_aext (inode, *epos, laarr[i].extLocation, - laarr[i].extLength); + err =udf_insert_aext (inode, *epos, + laarr[i].extLocation, + laarr[i].extLength); +/* +* If we fail here, we are likely corrupting the extent +* list and leaking blocks. At least stop early to +* limit the damage. +*/ +if (err <0 ) +return err;udf_next_aext (inode, epos, &laarr[i].extLocation, &laarr[i].extLength,1 ); start++;
@@ -1175,6 +1186,7 @@ static void udf_update_extents(struct inudf_write_aext (inode, epos, &laarr[i].extLocation, laarr[i].extLength,1 ); } +return 0 ; } struct buffer_head *udf_bread(struct inode *inode, udf_pblk_t block,
@@ -2191,12 +2203,13 @@ int8_t udf_current_aext(struct inode *inreturn etype; } -static int8_t udf_insert_aext (struct inode *inode,struct extent_position epos, -struct kernel_lb_addr neloc,uint32_t nelen) +static int udf_insert_aext (struct inode *inode,struct extent_position epos, +struct kernel_lb_addr neloc,uint32_t nelen) {struct kernel_lb_addr oeloc;uint32_t oelen;int8_t etype; +int err;if (epos.bh)get_bh (epos.bh);
@@ -2206,10 +2219,10 @@ static int8_t udf_insert_aext(struct ino neloc = oeloc; nelen = (etype <<30 ) | oelen; } -udf_add_aext (inode, &epos, &neloc, nelen,1 ); + err =udf_add_aext (inode, &epos, &neloc, nelen,1 );brelse (epos.bh); -return (nelen >>30 ); +return err; }int8_t udf_delete_aext (struct inode *inode,struct extent_position epos)
Greg Kroah-Hartman
maintainerPATCH 41/273 Revert "net: macsec: preserve ingress frame ordering"
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
commit d3287e4038ca4f81e02067ab72d087af7224c68b upstream.
This reverts commit ab046a5d4be4c90a3952a0eae75617b49c0cb01b.
It was trying to work around an issue at the crypto layer by excluding ASYNC implementations of gcm(aes), because a bug in the AESNI version caused reordering when some requests bypassed the cryptd queue while older requests were still pending on the queue.
This was fixed by commit 38b2f68b4264 ("crypto: aesni - Fix cryptd reordering problem on gcm"), which pre-dates ab046a5d4be4.
Herbert Xu confirmed that all ASYNC implementations are expected to maintain the ordering of completions wrt requests, so we can use them in MACsec.
On my test machine, this restores the performance of a single netperf instance, from 1.4Gbps to 4.4Gbps.
--- drivers/net/macsec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/macsec.c +1 -2
@@ -1315,8 +1315,7 @@ static struct crypto_aead *macsec_alloc_struct crypto_aead *tfm;int ret; -/* Pick a sync gcm(aes) cipher to ensure order is preserved. */ - tfm =crypto_alloc_aead ("gcm(aes)" ,0 ,CRYPTO_ALG_ASYNC ); + tfm =crypto_alloc_aead ("gcm(aes)" ,0 ,0 );if (IS_ERR (tfm))return tfm;
Greg Kroah-Hartman
maintainerPATCH 42/273 reiserfs: Check the return value from __getblk()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox <[email protected]>
[ Upstream commit ba38980add7ffc9e674ada5b4ded4e7d14e76581 ]
__getblk() can return a NULL pointer if we run out of memory or if we try to access beyond the end of the device; check it and handle it appropriately.
--- fs/reiserfs/journal.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/reiserfs/journal.c +3 -1
@@ -2336,7 +2336,7 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,int i, j; bh =__getblk (dev, block, bufsize); -if (buffer_uptodate (bh)) +if (!bh ||buffer_uptodate (bh))return (bh);if (block +BUFNR > max_block) {
@@ -2346,6 +2346,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev, j =1 ;for (i =1 ; i < blocks; i++) { bh =__getblk (dev, block + i, bufsize); +if (!bh) +break ;if (buffer_uptodate (bh)) {brelse (bh);break ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 43/273 eventfd: Export eventfd_ctx_do_read()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <[email protected]>
[ Upstream commit 28f1326710555bbe666f64452d08f2d7dd657cae ]
Where events are consumed in the kernel, for example by KVM's irqfd_wakeup() and VFIO's virqfd_wakeup(), they currently lack a mechanism to drain the eventfd's counter.
Since the wait queue is already locked while the wakeup functions are invoked, all they really need to do is call eventfd_ctx_do_read().
Add a check for the lock, and export it for them.
Message-Id: <[email protected]>
Stable-dep-of: 758b49204781 ("eventfd: prevent underflow for eventfd semaphores")
--- fs/eventfd.c | 5 ++++- include/linux/eventfd.h | 6 ++++++ 2 files changed, 10 insertions(+), 1 deletion(-)
fs/eventfd.c +4 -1
@@ -174,11 +174,14 @@ static __poll_t eventfd_poll(struct file *file, poll_table *wait)return events; } -static void eventfd_ctx_do_read (struct eventfd_ctx *ctx,__u64 *cnt) +void eventfd_ctx_do_read (struct eventfd_ctx *ctx,__u64 *cnt) { +lockdep_assert_held (&ctx->wqh.lock); + *cnt = (ctx->flags &EFD_SEMAPHORE ) ?1 : ctx->count; ctx->count -= *cnt; } +EXPORT_SYMBOL_GPL (eventfd_ctx_do_read);/** * eventfd_ctx_remove_wait_queue - Read the current counter and removes wait queue.
include/linux/eventfd.h +6 -0
@@ -41,6 +41,7 @@ struct eventfd_ctx *eventfd_ctx_fileget(struct file *file);__u64 eventfd_signal (struct eventfd_ctx *ctx,__u64 n);int eventfd_ctx_remove_wait_queue (struct eventfd_ctx *ctx,wait_queue_entry_t *wait,__u64 *cnt); +void eventfd_ctx_do_read (struct eventfd_ctx *ctx,__u64 *cnt);DECLARE_PER_CPU (int, eventfd_wake_count);
@@ -82,6 +83,11 @@ static inline bool eventfd_signal_count(void)return false; } +static inline void eventfd_ctx_do_read (struct eventfd_ctx *ctx,__u64 *cnt) +{ + +} +#endif #endif /* _LINUX_EVENTFD_H */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 44/273 eventfd: prevent underflow for eventfd semaphores
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Yang <[email protected]>
[ Upstream commit 758b492047816a3158d027e9fca660bc5bcf20bf ]
For eventfd with flag EFD_SEMAPHORE, when its ctx->count is 0, calling eventfd_ctx_do_read will cause ctx->count to overflow to ULLONG_MAX.
An underflow can happen with EFD_SEMAPHORE eventfds in at least the following three subsystems:
(1) virt/kvm/eventfd.c
(2) drivers/vfio/virqfd.c
(3) drivers/virt/acrn/irqfd.c
where (2) and (3) are just modeled after (1). An eventfd must be specified for use with the KVM_IRQFD ioctl(). This can also be an EFD_SEMAPHORE eventfd. When the eventfd count is zero or has been decremented to zero an underflow can be triggered when the irqfd is shut down by raising the KVM_IRQFD_FLAG_DEASSIGN flag in the KVM_IRQFD ioctl():
// ctx->count == 0
kvm_vm_ioctl()
-> kvm_irqfd()
-> kvm_irqfd_deassign()
-> irqfd_deactivate()
-> irqfd_shutdown()
-> eventfd_ctx_remove_wait_queue(&cnt)
-> eventfd_ctx_do_read(&cnt)Userspace polling on the eventfd wouldn't notice the underflow because 1 is always returned as the value from eventfd_read() while ctx->count would've underflowed. It's not a huge deal because this should only be happening when the irqfd is shutdown but we should still fix it and avoid the spurious wakeup.
Message-Id: <[email protected]>
--- fs/eventfd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/eventfd.c +1 -1
@@ -178,7 +178,7 @@ void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt) {lockdep_assert_held (&ctx->wqh.lock); - *cnt = (ctx->flags &EFD_SEMAPHORE ) ?1 : ctx->count; + *cnt = ((ctx->flags &EFD_SEMAPHORE ) && ctx->count) ?1 : ctx->count; ctx->count -= *cnt; }EXPORT_SYMBOL_GPL (eventfd_ctx_do_read);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 45/273 new helper: lookup_positive_unlocked()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 6c2d4798a8d16cf4f3a28c3cd4af4f1dcbbb4d04 ]
Most of the callers of lookup_one_len_unlocked() treat negatives are ERR_PTR(-ENOENT). Provide a helper that would do just that. Note that a pinned positive dentry remains positive - it's ->d_inode is stable, etc.; a pinned _negative_ dentry can become positive at any point as long as you are not holding its parent at least shared. So using lookup_one_len_unlocked() needs to be careful; lookup_positive_unlocked() is safer and that's what the callers end up open-coding anyway.
Stable-dep-of: 0d5a4f8f775f ("fs: Fix error checking for d_hash_and_lookup()")
--- fs/cifs/cifsfs.c | 7 +------ fs/debugfs/inode.c | 6 +----- fs/kernfs/mount.c | 2 +- fs/namei.c | 20 ++++++++++++++++++++ fs/nfsd/nfs3xdr.c | 4 +--- fs/nfsd/nfs4xdr.c | 11 +---------- fs/overlayfs/namei.c | 24 ++++++++---------------- fs/quota/dquot.c | 8 +------- include/linux/namei.h | 1 + 9 files changed, 35 insertions(+), 48 deletions(-)
fs/cifs/cifsfs.c +1 -6
@@ -663,11 +663,6 @@ cifs_get_root(struct smb_vol *vol, strucstruct inode *dir =d_inode (dentry);struct dentry *child; -if (!dir) { -dput (dentry); - dentry =ERR_PTR (-ENOENT ); -break ; - }if (!S_ISDIR (dir->i_mode)) {dput (dentry); dentry =ERR_PTR (-ENOTDIR );
@@ -684,7 +679,7 @@ cifs_get_root(struct smb_vol *vol, strucwhile (*s && *s != sep) s++; - child =lookup_one_len_unlocked (p, dentry, s - p); + child =lookup_positive_unlocked (p, dentry, s - p);dput (dentry); dentry = child; }while (!IS_ERR (dentry));
fs/debugfs/inode.c +1 -5
@@ -275,13 +275,9 @@ struct dentry *debugfs_lookup(const charif (!parent) parent = debugfs_mount->mnt_root; - dentry =lookup_one_len_unlocked (name, parent,strlen (name)); + dentry =lookup_positive_unlocked (name, parent,strlen (name));if (IS_ERR (dentry))return NULL ; -if (!d_really_is_positive (dentry)) { -dput (dentry); -return NULL ; - }return dentry; }EXPORT_SYMBOL_GPL (debugfs_lookup);
fs/kernfs/mount.c +1 -1
@@ -212,7 +212,7 @@ struct dentry *kernfs_node_dentry(structdput (dentry);return ERR_PTR (-EINVAL ); } - dtmp =lookup_one_len_unlocked (kntmp->name, dentry, + dtmp =lookup_positive_unlocked (kntmp->name, dentry,strlen (kntmp->name));dput (dentry);if (IS_ERR (dtmp))
fs/namei.c +20 -0
@@ -2575,6 +2575,26 @@ struct dentry *lookup_one_len_unlocked(c }EXPORT_SYMBOL (lookup_one_len_unlocked); +/* +* Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT) +* on negatives. Returns known positive or ERR_PTR(); that's what +* most of the users want. Note that pinned negative with unlocked parent +* _can_ become positive at any time, so callers of lookup_one_len_unlocked() +* need to be very careful; pinned positives have ->d_inode stable, so +* this one avoids such problems. +*/ +struct dentry *lookup_positive_unlocked (const char *name, +struct dentry *base,int len) +{ +struct dentry *ret =lookup_one_len_unlocked (name, base, len); +if (!IS_ERR (ret) &&d_is_negative (ret)) { +dput (ret); + ret =ERR_PTR (-ENOENT ); + } +return ret; +} +EXPORT_SYMBOL (lookup_positive_unlocked); +#ifdef CONFIG_UNIX98_PTYS int path_pts (struct path *path) {
fs/nfsd/nfs3xdr.c +1 -3
@@ -855,13 +855,11 @@ compose_entry_fh(struct nfsd3_readdirres }else dchild =dget (dparent); }else - dchild =lookup_one_len_unlocked (name, dparent, namlen); + dchild =lookup_positive_unlocked (name, dparent, namlen);if (IS_ERR (dchild))return rv;if (d_mountpoint (dchild)) goto out; -if (d_really_is_negative (dchild)) - goto out;if (dchild->d_inode->i_ino != ino) goto out; rv =fh_compose (fhp, exp, dchild, &cd->fh);
fs/nfsd/nfs4xdr.c +1 -10
@@ -2984,18 +2984,9 @@ nfsd4_encode_dirent_fattr(struct xdr_str__be32 nfserr;int ignore_crossmnt =0 ; - dentry =lookup_one_len_unlocked (name, cd->rd_fhp->fh_dentry, namlen); + dentry =lookup_positive_unlocked (name, cd->rd_fhp->fh_dentry, namlen);if (IS_ERR (dentry))return nfserrno (PTR_ERR (dentry)); -if (d_really_is_negative (dentry)) { -/* -* we're not holding the i_mutex here, so there's -* a window where this directory entry could have gone -* away. -*/ -dput (dentry); -return nfserr_noent; - }exp_get (exp);/*
fs/overlayfs/namei.c +8 -16
@@ -203,7 +203,7 @@ static int ovl_lookup_single(struct dentint err;bool last_element = !post[0 ]; - this =lookup_one_len_unlocked (name, base, namelen); + this =lookup_positive_unlocked (name, base, namelen);if (IS_ERR (this)) { err =PTR_ERR (this); this =NULL ;
@@ -211,8 +211,6 @@ static int ovl_lookup_single(struct dent goto out; goto out_err; } -if (!this->d_inode) - goto put_and_out;if (ovl_dentry_weird (this)) {/* Don't support traversing automounts and other weirdness */
@@ -654,7 +652,7 @@ struct dentry *ovl_get_index_fh(struct oif (err)return ERR_PTR (err); - index =lookup_one_len_unlocked (name.name, ofs->indexdir, name.len); + index =lookup_positive_unlocked (name.name, ofs->indexdir, name.len);kfree (name.name);if (IS_ERR (index)) {if (PTR_ERR (index) == -ENOENT )
@@ -662,9 +660,7 @@ struct dentry *ovl_get_index_fh(struct oreturn index; } -if (d_is_negative (index)) - err =0 ; -else if (ovl_is_whiteout (index)) +if (ovl_is_whiteout (index)) err = -ESTALE ;else if (ovl_dentry_weird (index)) err = -EIO ;
@@ -688,7 +684,7 @@ struct dentry *ovl_lookup_index(struct oif (err)return ERR_PTR (err); - index =lookup_one_len_unlocked (name.name, ofs->indexdir, name.len); + index =lookup_positive_unlocked (name.name, ofs->indexdir, name.len);if (IS_ERR (index)) { err =PTR_ERR (index);if (err == -ENOENT ) {
@@ -703,9 +699,7 @@ struct dentry *ovl_lookup_index(struct o } inode =d_inode (index); -if (d_is_negative (index)) { - goto out_dput; - }else if (ovl_is_whiteout (index) && !verify) { +if (ovl_is_whiteout (index) && !verify) {/* * When index lookup is called with !verify for decoding an * overlay file handle, a whiteout index implies that decode
@@ -1134,7 +1128,7 @@ bool ovl_lower_positive(struct dentry *dstruct dentry *this;struct dentry *lowerdir = poe->lowerstack[i].dentry; - this =lookup_one_len_unlocked (name->name, lowerdir, + this =lookup_positive_unlocked (name->name, lowerdir, name->len);if (IS_ERR (this)) {switch (PTR_ERR (this)) {
@@ -1151,10 +1145,8 @@ bool ovl_lower_positive(struct dentry *dbreak ; } }else { -if (this->d_inode) { - positive = !ovl_is_whiteout (this); - done = true; - } + positive = !ovl_is_whiteout (this); + done = true;dput (this); } }
fs/quota/dquot.c +1 -7
@@ -2535,21 +2535,15 @@ int dquot_quota_on_mount(struct super_blstruct dentry *dentry;int error; - dentry =lookup_one_len_unlocked (qf_name, sb->s_root,strlen (qf_name)); + dentry =lookup_positive_unlocked (qf_name, sb->s_root,strlen (qf_name));if (IS_ERR (dentry))return PTR_ERR (dentry); -if (d_really_is_negative (dentry)) { - error = -ENOENT ; - goto out; - } - error =security_quota_on (dentry);if (!error) error =vfs_load_quota_inode (d_inode (dentry), type, format_id,DQUOT_USAGE_ENABLED |DQUOT_LIMITS_ENABLED ); -out:dput (dentry);return error; }
include/linux/namei.h +1 -0
@@ -84,6 +84,7 @@ extern int kern_path_mountpoint(int, conextern struct dentry *try_lookup_one_len (const char *,struct dentry *,int );extern struct dentry *lookup_one_len (const char *,struct dentry *,int );extern struct dentry *lookup_one_len_unlocked (const char *,struct dentry *,int ); +extern struct dentry *lookup_positive_unlocked (const char *,struct dentry *,int );extern int follow_down_one (struct path *);extern int follow_down (struct path *);
Greg Kroah-Hartman
maintainerPATCH 46/273 netfilter: nft_flow_offload: fix underflow in flowtable reference counter
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: wenxu <[email protected]>
commit 8ca79606cdfde2e37ee4f0707b9d1874a6f0eb38 upstream.
The .deactivate and .activate interfaces already deal with the reference counter. Otherwise, this results in spurious "Device is busy" errors.
--- net/netfilter/nft_flow_offload.c | 3 --- 1 file changed, 3 deletions(-)
net/netfilter/nft_flow_offload.c +0 -3
@@ -197,9 +197,6 @@ static void nft_flow_offload_activate(costatic void nft_flow_offload_destroy (const struct nft_ctx *ctx,const struct nft_expr *expr) { -struct nft_flow_offload *priv =nft_expr_priv (expr); - - priv->flowtable->use--;nf_ct_netns_put (ctx->net, ctx->family); }
Greg Kroah-Hartman
maintainerPATCH 47/273 netfilter: nf_tables: missing NFT_TRANS_PREPARE_ERROR in flowtable deactivatation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 26b5a5712eb85e253724e56a54c17f8519bd8e4e upstream.
Missing NFT_TRANS_PREPARE_ERROR in 1df28fde1270 ("netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain") in 4.19.
--- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_tables_api.c +1 -0
@@ -5555,6 +5555,7 @@ void nf_tables_deactivate_flowtable(cons enum nft_trans_phase phase) {switch (phase) { +case NFT_TRANS_PREPARE_ERROR :case NFT_TRANS_PREPARE :case NFT_TRANS_ABORT :case NFT_TRANS_RELEASE :
Greg Kroah-Hartman
maintainerPATCH 48/273 fs: Fix error checking for d_hash_and_lookup()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Ming <[email protected]>
[ Upstream commit 0d5a4f8f775ff990142cdc810a84eae078589d27 ]
The d_hash_and_lookup() function returns error pointers or NULL. Most incorrect error checks were fixed, but the one in int path_pts() was forgotten.
Message-Id: <[email protected]>
--- fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/namei.c +1 -1
@@ -2613,7 +2613,7 @@ int path_pts(struct path *path) this.name ="pts" ; this.len =3 ; child =d_hash_and_lookup (parent, &this); -if (!child) +if (IS_ERR_OR_NULL (child))return -ENOENT ; path->dentry = child;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 49/273 cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chang <[email protected]>
[ Upstream commit 03997da042dac73c69e60d91942c727c76828b65 ]
Since the 'cpus' field of policy structure will become empty in the cpufreq core API, it is better to use 'related_cpus' in the exit() callback of driver.
--- drivers/cpufreq/powernow-k8.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/cpufreq/powernow-k8.c +2 -1
@@ -1104,7 +1104,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol)kfree (data->powernow_table);kfree (data); -for_each_cpu (cpu, pol->cpus) +/* pol->cpus will be empty here, use related_cpus instead. */ +for_each_cpu (cpu, pol->related_cpus)per_cpu (powernow_data, cpu) =NULL ;return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 50/273 bpf: Clear the probe_addr for uprobe
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <[email protected]>
[ Upstream commit 5125e757e62f6c1d5478db4c2b61a744060ddf3f ]
To avoid returning uninitialized or random values when querying the file descriptor (fd) and accessing probe_addr, it is necessary to clear the variable prior to its use.
--- include/linux/trace_events.h | 3 ++- kernel/trace/bpf_trace.c | 2 +- kernel/trace/trace_uprobe.c | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-)
include/linux/trace_events.h +2 -1
@@ -581,7 +581,8 @@ extern int perf_uprobe_init(struct perf_event *event, bool is_retprobe);extern void perf_uprobe_destroy (struct perf_event *event);extern int bpf_get_uprobe_info (const struct perf_event *event,u32 *fd_type,const char **filename, -u64 *probe_offset,bool perf_type_tracepoint); +u64 *probe_offset,u64 *probe_addr, +bool perf_type_tracepoint);#endif extern int ftrace_profile_set_filter (struct perf_event *event,int event_id,char *filter_str);
kernel/trace/bpf_trace.c +1 -1
@@ -1274,7 +1274,7 @@ int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id,#ifdef CONFIG_UPROBE_EVENTS if (flags &TRACE_EVENT_FL_UPROBE ) err =bpf_get_uprobe_info (event, fd_type, buf, - probe_offset, + probe_offset, probe_addr, event->attr.type ==PERF_TYPE_TRACEPOINT );#endif }
kernel/trace/trace_uprobe.c +2 -1
@@ -1159,7 +1159,7 @@ static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func,int bpf_get_uprobe_info (const struct perf_event *event,u32 *fd_type,const char **filename,u64 *probe_offset, -bool perf_type_tracepoint) +u64 *probe_addr,bool perf_type_tracepoint) {const char *pevent =trace_event_name (event->tp_event);const char *group = event->tp_event->class->system;
@@ -1176,6 +1176,7 @@ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type, : BPF_FD_TYPE_UPROBE; *filename = tu->filename; *probe_offset = tu->offset; + *probe_addr =0 ; return 0; }#endif /* CONFIG_PERF_EVENTS */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 51/273 tcp: tcp_enter_quickack_mode() should be static
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 03b123debcbc8db987bda17ed8412cc011064c22 ]
After commit d2ccd7bc8acd ("tcp: avoid resetting ACK timer in DCTCP"), tcp_enter_quickack_mode() is only used from net/ipv4/tcp_input.c.
--- include/net/tcp.h | 1 - net/ipv4/tcp_input.c | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-)
include/net/tcp.h +0 -1
@@ -346,7 +346,6 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos, struct pipe_inode_info *pipe, size_t len, unsigned int flags); -void tcp_enter_quickack_mode (struct sock *sk,unsigned int max_quickacks);static inline void tcp_dec_quickack_mode (struct sock *sk,const unsigned int pkts) {
net/ipv4/tcp_input.c +1 -2
@@ -216,7 +216,7 @@ static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks) icsk->icsk_ack.quick = quickacks; } -void tcp_enter_quickack_mode (struct sock *sk,unsigned int max_quickacks) +static void tcp_enter_quickack_mode (struct sock *sk,unsigned int max_quickacks) {struct inet_connection_sock *icsk =inet_csk (sk);
@@ -224,7 +224,6 @@ void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) icsk->icsk_ack.pingpong =0 ; icsk->icsk_ack.ato =TCP_ATO_MIN ; } -EXPORT_SYMBOL (tcp_enter_quickack_mode);/* Send ACKs quickly, if "quick" count is not exhausted * and the session is not interactive.
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 52/273 regmap: rbtree: Use alloc_flags for memory allocations
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 0c8b0bf42c8cef56f7cd9cd876fbb7ece9217064 ]
The kunit tests discovered a sleeping in atomic bug. The allocations in the regcache-rbtree code should use the map->alloc_flags instead of GFP_KERNEL.
[ 5.005510] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:306
[ 5.005960] in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 117, name: kunit_try_catch
[ 5.006219] preempt_count: 1, expected: 0
[ 5.006414] 1 lock held by kunit_try_catch/117:
[ 5.006590] #0: 833b9010 (regmap_kunit:86:(config)->lock){....}-{2:2}, at: regmap_lock_spinlock+0x14/0x1c
[ 5.007493] irq event stamp: 162
[ 5.007627] hardirqs last enabled at (161): [<80786738>] crng_make_state+0x1a0/0x294
[ 5.007871] hardirqs last disabled at (162): [<80c531ec>] _raw_spin_lock_irqsave+0x7c/0x80
[ 5.008119] softirqs last enabled at (0): [<801110ac>] copy_process+0x810/0x2138
[ 5.008356] softirqs last disabled at (0): [<00000000>] 0x0
[ 5.008688] CPU: 0 PID: 117 Comm: kunit_try_catch Tainted: G N 6.4.4-rc3-g0e8d2fdfb188 #1
[ 5.009011] Hardware name: Generic DT based system
[ 5.009277] unwind_backtrace from show_stack+0x18/0x1c
[ 5.009497] show_stack from dump_stack_lvl+0x38/0x5c
[ 5.009676] dump_stack_lvl from __might_resched+0x188/0x2d0
[ 5.009860] __might_resched from __kmem_cache_alloc_node+0x1dc/0x25c
[ 5.010061] __kmem_cache_alloc_node from kmalloc_trace+0x30/0xc8
[ 5.010254] kmalloc_trace from regcache_rbtree_write+0x26c/0x468
[ 5.010446] regcache_rbtree_write from _regmap_write+0x88/0x140
[ 5.010634] _regmap_write from regmap_write+0x44/0x68
[ 5.010803] regmap_write from basic_read_write+0x8c/0x270
[ 5.010980] basic_read_write from kunit_try_run_case+0x48/0xa0--- drivers/base/regmap/regcache-rbtree.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/base/regmap/regcache-rbtree.c +5 -5
@@ -291,7 +291,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, blk =krealloc (rbnode->block, blklen * map->cache_word_size, -GFP_KERNEL ); + map->alloc_flags);if (!blk)return -ENOMEM ;
@@ -300,7 +300,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,if (BITS_TO_LONGS (blklen) >BITS_TO_LONGS (rbnode->blklen)) { present =krealloc (rbnode->cache_present,BITS_TO_LONGS (blklen) *sizeof (*present), -GFP_KERNEL ); + map->alloc_flags);if (!present)return -ENOMEM ;
@@ -334,7 +334,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)const struct regmap_range *range;int i; - rbnode =kzalloc (sizeof (*rbnode),GFP_KERNEL ); + rbnode =kzalloc (sizeof (*rbnode), map->alloc_flags);if (!rbnode)return NULL ;
@@ -360,13 +360,13 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg) } rbnode->block =kmalloc_array (rbnode->blklen, map->cache_word_size, -GFP_KERNEL ); + map->alloc_flags);if (!rbnode->block) goto err_free; rbnode->cache_present =kcalloc (BITS_TO_LONGS (rbnode->blklen),sizeof (*rbnode->cache_present), -GFP_KERNEL ); + map->alloc_flags);if (!rbnode->cache_present) goto err_free_block;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 53/273 spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit 29a449e765ff70a5bd533be94babb6d36985d096 ]
The platform_get_irq might be failed and return a negative result. So there should have an error handling code.
Fixed this by adding an error handling code.
--- drivers/spi/spi-tegra20-sflash.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/spi/spi-tegra20-sflash.c +5 -1
@@ -469,7 +469,11 @@ static int tegra_sflash_probe(struct platform_device *pdev) goto exit_free_master; } - tsd->irq =platform_get_irq (pdev,0 ); + ret =platform_get_irq (pdev,0 ); +if (ret <0 ) + goto exit_free_master; + tsd->irq = ret; + ret =request_irq (tsd->irq, tegra_sflash_isr,0 ,dev_name (&pdev->dev), tsd);if (ret <0 ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 54/273 can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
[ Upstream commit 6c8bc15f02b85bc8f47074110d8fd8caf7a1e42d ]
In case of an RX overflow error from the CAN controller and an OOM where no skb can be allocated, the error counters are not incremented.
Fix this by first incrementing the error counters and then allocate the skb.
--- drivers/net/can/usb/gs_usb.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/can/usb/gs_usb.c +3 -2
@@ -389,6 +389,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) }if (hf->flags &GS_CAN_FLAG_OVERFLOW ) { + stats->rx_over_errors++; + stats->rx_errors++; + skb =alloc_can_err_skb (netdev, &cf);if (!skb) goto resubmit_urb;
@@ -396,8 +399,6 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) cf->can_id |=CAN_ERR_CRTL ; cf->can_dlc =CAN_ERR_DLC ; cf->data[1 ] =CAN_ERR_CRTL_RX_OVERFLOW ; - stats->rx_over_errors++; - stats->rx_errors++;netif_rx (skb); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 55/273 wifi: mwifiex: Fix OOB and integer underflow when rx packets
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Polaris Pi <[email protected]>
[ Upstream commit 11958528161731c58e105b501ed60b83a91ea941 ]
Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet not out-of-bounds access the skb->data buffer.
--- drivers/net/wireless/marvell/mwifiex/sta_rx.c | 11 ++++++++++- .../net/wireless/marvell/mwifiex/uap_txrx.c | 19 +++++++++++++++++++ drivers/net/wireless/marvell/mwifiex/util.c | 10 +++++++--- 3 files changed, 36 insertions(+), 4 deletions(-)
drivers/net/wireless/marvell/mwifiex/sta_rx.c +10 -1
@@ -98,6 +98,14 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, rx_pkt_len =le16_to_cpu (local_rx_pd->rx_pkt_length); rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off; +if (sizeof (*rx_pkt_hdr) + rx_pkt_off > skb->len) { +mwifiex_dbg (priv->adapter,ERROR , +"wrong rx packet offset: len=%d, rx_pkt_off=%d\n" , + skb->len, rx_pkt_off); + priv->stats.rx_dropped++; +dev_kfree_skb_any (skb); + } + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, sizeof(bridge_tunnel_header))) || (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
@@ -203,7 +211,8 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv, rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_offset; -if ((rx_pkt_offset + rx_pkt_length) > (u16 ) skb->len) { +if ((rx_pkt_offset + rx_pkt_length) > skb->len || +sizeof (rx_pkt_hdr->eth803_hdr) + rx_pkt_offset > skb->len) {mwifiex_dbg (adapter,ERROR ,"wrong rx packet: len=%d, rx_pkt_offset=%d, rx_pkt_length=%d\n" , skb->len, rx_pkt_offset, rx_pkt_length);
drivers/net/wireless/marvell/mwifiex/uap_txrx.c +19 -0
@@ -116,6 +116,15 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,return ; } +if (sizeof (*rx_pkt_hdr) + +le16_to_cpu (uap_rx_pd->rx_pkt_offset) > skb->len) { +mwifiex_dbg (adapter,ERROR , +"wrong rx packet offset: len=%d,rx_pkt_offset=%d\n" , + skb->len,le16_to_cpu (uap_rx_pd->rx_pkt_offset)); + priv->stats.rx_dropped++; +dev_kfree_skb_any (skb); + } + if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, sizeof(bridge_tunnel_header))) || (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
@@ -385,6 +394,16 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv, rx_pkt_type =le16_to_cpu (uap_rx_pd->rx_pkt_type); rx_pkt_hdr = (void *)uap_rx_pd +le16_to_cpu (uap_rx_pd->rx_pkt_offset); +if (le16_to_cpu (uap_rx_pd->rx_pkt_offset) + +sizeof (rx_pkt_hdr->eth803_hdr) > skb->len) { +mwifiex_dbg (adapter,ERROR , +"wrong rx packet for struct ethhdr: len=%d, offset=%d\n" , + skb->len,le16_to_cpu (uap_rx_pd->rx_pkt_offset)); + priv->stats.rx_dropped++; +dev_kfree_skb_any (skb); +return 0 ; + } +ether_addr_copy (ta, rx_pkt_hdr->eth803_hdr.h_source); if ((le16_to_cpu(uap_rx_pd->rx_pkt_offset) +
drivers/net/wireless/marvell/mwifiex/util.c +7 -3
@@ -405,11 +405,15 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, } rx_pd = (struct rxpd *)skb->data; + pkt_len =le16_to_cpu (rx_pd->rx_pkt_length); +if (pkt_len <sizeof (struct ieee80211_hdr ) +sizeof (pkt_len)) { +mwifiex_dbg (priv->adapter,ERROR ,"invalid rx_pkt_length" ); +return -1 ; + }skb_pull (skb,le16_to_cpu (rx_pd->rx_pkt_offset));skb_pull (skb,sizeof (pkt_len)); - - pkt_len =le16_to_cpu (rx_pd->rx_pkt_length); + pkt_len -=sizeof (pkt_len); ieee_hdr = (void *)skb->data;if (ieee80211_is_mgmt (ieee_hdr->frame_control)) {
@@ -422,7 +426,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv, skb->data +sizeof (struct ieee80211_hdr ), pkt_len - sizeof(struct ieee80211_hdr)); - pkt_len -=ETH_ALEN +sizeof (pkt_len); + pkt_len -=ETH_ALEN ; rx_pd->rx_pkt_length =cpu_to_le16 (pkt_len); cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 56/273 mwifiex: drop set_consistent_dma_mask log message
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Norris <[email protected]>
[ Upstream commit f7369179ad32000973fc7a0a76603e0b41792b52 ]
This message is pointless.
While we're at it, include the error code in the error message, which is not pointless.
Stable-dep-of: 288c63d5cb46 ("wifi: mwifiex: fix error recovery in PCIE buffer descriptor management")
--- drivers/net/wireless/marvell/mwifiex/pcie.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/marvell/mwifiex/pcie.c +1 -2
@@ -2939,10 +2939,9 @@ static int mwifiex_init_pcie(struct mwifiex_adapter *adapter)pci_set_master (pdev); -pr_notice ("try set_consistent_dma_mask(32)\n" ); ret =pci_set_dma_mask (pdev,DMA_BIT_MASK (32 ));if (ret) { -pr_err ("set_dma_mask(32) failed\n" ); +pr_err ("set_dma_mask(32) failed: %d\n" , ret); goto err_set_dma_mask; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 57/273 mwifiex: switch from pci_ to dma_ API
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 4cf975f640fefdfdf6168a79e882558478ce057a ]
The wrappers in include/linux/pci-dma-compat.h should go away.
The patch has been generated with the coccinelle script below and has been hand modified to replace GFP_ with a correct flag.
It has been compile tested.
When memory is allocated in 'mwifiex_pcie_alloc_buffers()' (see details in the call chain below) GFP_KERNEL can be used because both 'mwifiex_register()' and 'mwifiex_reinit_sw()' already use GFP_KERNEL. (for 'mwifiex_reinit_sw()', it is hidden in a call to 'alloc_workqueue()')
The call chain is:
mwifiex_register
--> mwifiex_init_pcie (.init_if function, see mwifiex_if_ops)
[ or ]
mwifiex_reinit_sw
-->mwifiex_pcie_up_dev (.up_dev function, see mwifiex_if_ops)
[ then in both case ]
-->mwifiex_pcie_alloc_buffers
--> mwifiex_pcie_create_txbd_ring
--> mwifiex_pcie_create_rxbd_ring
--> mwifiex_pcie_create_evtbd_ring
--> mwifiex_pcie_alloc_sleep_cookie_buf@@
@@
- PCI_DMA_BIDIRECTIONAL
+ DMA_BIDIRECTIONAL
@@
@@
- PCI_DMA_TODEVICE
+ DMA_TO_DEVICE
@@
@@
- PCI_DMA_FROMDEVICE
+ DMA_FROM_DEVICE
@@
@@
- PCI_DMA_NONE
+ DMA_NONE
@@
expression e1, e2, e3;
@@
- pci_alloc_consistent(e1, e2, e3)
+ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
@@
expression e1, e2, e3;
@@
- pci_zalloc_consistent(e1, e2, e3)
+ dma_alloc_coherent(&e1->dev, e2, e3, GFP_)
@@
expression e1, e2, e3, e4;
@@
- pci_free_consistent(e1, e2, e3, e4)
+ dma_free_coherent(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_map_single(e1, e2, e3, e4)
+ dma_map_single(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_single(e1, e2, e3, e4)
+ dma_unmap_single(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4, e5;
@@
- pci_map_page(e1, e2, e3, e4, e5)
+ dma_map_page(&e1->dev, e2, e3, e4, e5)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_page(e1, e2, e3, e4)
+ dma_unmap_page(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_map_sg(e1, e2, e3, e4)
+ dma_map_sg(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_unmap_sg(e1, e2, e3, e4)
+ dma_unmap_sg(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_single_for_cpu(e1, e2, e3, e4)
+ dma_sync_single_for_cpu(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_single_for_device(e1, e2, e3, e4)
+ dma_sync_single_for_device(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_sg_for_cpu(e1, e2, e3, e4)
+ dma_sync_sg_for_cpu(&e1->dev, e2, e3, e4)
@@
expression e1, e2, e3, e4;
@@
- pci_dma_sync_sg_for_device(e1, e2, e3, e4)
+ dma_sync_sg_for_device(&e1->dev, e2, e3, e4)
@@
expression e1, e2;
@@
- pci_dma_mapping_error(e1, e2)
+ dma_mapping_error(&e1->dev, e2)
@@
expression e1, e2;
@@
- pci_set_dma_mask(e1, e2)
+ dma_set_mask(&e1->dev, e2)
@@
expression e1, e2;
@@
- pci_set_consistent_dma_mask(e1, e2)
+ dma_set_coherent_mask(&e1->dev, e2)
Stable-dep-of: 288c63d5cb46 ("wifi: mwifiex: fix error recovery in PCIE buffer descriptor management")
--- drivers/net/wireless/marvell/mwifiex/pcie.c | 153 ++++++++++---------- 1 file changed, 78 insertions(+), 75 deletions(-)
drivers/net/wireless/marvell/mwifiex/pcie.c +78 -75
@@ -58,8 +58,8 @@ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,struct pcie_service_card *card = adapter->card;struct mwifiex_dma_mapping mapping; - mapping.addr =pci_map_single (card->dev, skb->data, size, flags); -if (pci_dma_mapping_error (card->dev, mapping.addr)) { + mapping.addr =dma_map_single (&card->dev->dev, skb->data, size, flags); +if (dma_mapping_error (&card->dev->dev, mapping.addr)) {mwifiex_dbg (adapter,ERROR ,"failed to map pci memory!\n" );return -1 ; }
@@ -75,7 +75,7 @@ static void mwifiex_unmap_pci_memory(struct mwifiex_adapter *adapter,struct mwifiex_dma_mapping mapping;mwifiex_get_mapping (skb, &mapping); -pci_unmap_single (card->dev, mapping.addr, mapping.len, flags); +dma_unmap_single (&card->dev->dev, mapping.addr, mapping.len, flags); }/*
@@ -469,10 +469,9 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter,struct sk_buff *cmdrsp = card->cmdrsp_buf;for (count =0 ; count < max_delay_loop_cnt; count++) { -pci_dma_sync_single_for_cpu (card->dev, -MWIFIEX_SKB_DMA_ADDR (cmdrsp), -sizeof (sleep_cookie), -PCI_DMA_FROMDEVICE ); +dma_sync_single_for_cpu (&card->dev->dev, +MWIFIEX_SKB_DMA_ADDR (cmdrsp), +sizeof (sleep_cookie),DMA_FROM_DEVICE ); buffer = cmdrsp->data; sleep_cookie =get_unaligned_le32 (buffer);
@@ -481,10 +480,10 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter, "sleep cookie found at count %d\n", count);break ; } -pci_dma_sync_single_for_device (card->dev, -MWIFIEX_SKB_DMA_ADDR (cmdrsp), -sizeof (sleep_cookie), -PCI_DMA_FROMDEVICE ); +dma_sync_single_for_device (&card->dev->dev, +MWIFIEX_SKB_DMA_ADDR (cmdrsp), +sizeof (sleep_cookie), +DMA_FROM_DEVICE );usleep_range (20 ,30 ); }
@@ -638,7 +637,7 @@ static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter)if (mwifiex_map_pci_memory (adapter, skb,MWIFIEX_RX_DATA_BUF_SIZE , -PCI_DMA_FROMDEVICE )) +DMA_FROM_DEVICE ))return -1 ; buf_pa =MWIFIEX_SKB_DMA_ADDR (skb);
@@ -695,7 +694,7 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)skb_put (skb,MAX_EVENT_SIZE );if (mwifiex_map_pci_memory (adapter, skb,MAX_EVENT_SIZE , -PCI_DMA_FROMDEVICE )) { +DMA_FROM_DEVICE )) {kfree_skb (skb);kfree (card->evtbd_ring_vbase);return -1 ;
@@ -738,7 +737,7 @@ static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter)if (card->tx_buf_list[i]) { skb = card->tx_buf_list[i];mwifiex_unmap_pci_memory (adapter, skb, -PCI_DMA_TODEVICE ); +DMA_TO_DEVICE );dev_kfree_skb_any (skb); }memset (desc2,0 ,sizeof (*desc2));
@@ -747,7 +746,7 @@ static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter)if (card->tx_buf_list[i]) { skb = card->tx_buf_list[i];mwifiex_unmap_pci_memory (adapter, skb, -PCI_DMA_TODEVICE ); +DMA_TO_DEVICE );dev_kfree_skb_any (skb); }memset (desc,0 ,sizeof (*desc));
@@ -777,7 +776,7 @@ static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter)if (card->rx_buf_list[i]) { skb = card->rx_buf_list[i];mwifiex_unmap_pci_memory (adapter, skb, -PCI_DMA_FROMDEVICE ); +DMA_FROM_DEVICE );dev_kfree_skb_any (skb); }memset (desc2,0 ,sizeof (*desc2));
@@ -786,7 +785,7 @@ static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter)if (card->rx_buf_list[i]) { skb = card->rx_buf_list[i];mwifiex_unmap_pci_memory (adapter, skb, -PCI_DMA_FROMDEVICE ); +DMA_FROM_DEVICE );dev_kfree_skb_any (skb); }memset (desc,0 ,sizeof (*desc));
@@ -812,7 +811,7 @@ static void mwifiex_cleanup_evt_ring(struct mwifiex_adapter *adapter)if (card->evt_buf_list[i]) { skb = card->evt_buf_list[i];mwifiex_unmap_pci_memory (adapter, skb, -PCI_DMA_FROMDEVICE ); +DMA_FROM_DEVICE );dev_kfree_skb_any (skb); } card->evt_buf_list[i] =NULL ;
@@ -853,9 +852,10 @@ static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)mwifiex_dbg (adapter,INFO ,"info: txbd_ring: Allocating %d bytes\n" , card->txbd_ring_size); - card->txbd_ring_vbase =pci_alloc_consistent (card->dev, - card->txbd_ring_size, - &card->txbd_ring_pbase); + card->txbd_ring_vbase =dma_alloc_coherent (&card->dev->dev, + card->txbd_ring_size, + &card->txbd_ring_pbase, +GFP_KERNEL );if (!card->txbd_ring_vbase) { mwifiex_dbg(adapter, ERROR, "allocate consistent memory (%d bytes) failed!\n",
@@ -879,9 +879,9 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)mwifiex_cleanup_txq_ring (adapter);if (card->txbd_ring_vbase) -pci_free_consistent (card->dev, card->txbd_ring_size, - card->txbd_ring_vbase, - card->txbd_ring_pbase); +dma_free_coherent (&card->dev->dev, card->txbd_ring_size, + card->txbd_ring_vbase, + card->txbd_ring_pbase); card->txbd_ring_size =0 ; card->txbd_wrptr =0 ; card->txbd_rdptr =0 | reg->tx_rollover_ind;
@@ -917,9 +917,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)mwifiex_dbg (adapter,INFO ,"info: rxbd_ring: Allocating %d bytes\n" , card->rxbd_ring_size); - card->rxbd_ring_vbase =pci_alloc_consistent (card->dev, - card->rxbd_ring_size, - &card->rxbd_ring_pbase); + card->rxbd_ring_vbase =dma_alloc_coherent (&card->dev->dev, + card->rxbd_ring_size, + &card->rxbd_ring_pbase, +GFP_KERNEL );if (!card->rxbd_ring_vbase) { mwifiex_dbg(adapter, ERROR, "allocate consistent memory (%d bytes) failed!\n",
@@ -947,9 +948,9 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)mwifiex_cleanup_rxq_ring (adapter);if (card->rxbd_ring_vbase) -pci_free_consistent (card->dev, card->rxbd_ring_size, - card->rxbd_ring_vbase, - card->rxbd_ring_pbase); +dma_free_coherent (&card->dev->dev, card->rxbd_ring_size, + card->rxbd_ring_vbase, + card->rxbd_ring_pbase); card->rxbd_ring_size =0 ; card->rxbd_wrptr =0 ; card->rxbd_rdptr =0 | reg->rx_rollover_ind;
@@ -981,9 +982,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)mwifiex_dbg (adapter,INFO ,"info: evtbd_ring: Allocating %d bytes\n" , card->evtbd_ring_size); - card->evtbd_ring_vbase =pci_alloc_consistent (card->dev, - card->evtbd_ring_size, - &card->evtbd_ring_pbase); + card->evtbd_ring_vbase =dma_alloc_coherent (&card->dev->dev, + card->evtbd_ring_size, + &card->evtbd_ring_pbase, +GFP_KERNEL );if (!card->evtbd_ring_vbase) { mwifiex_dbg(adapter, ERROR, "allocate consistent memory (%d bytes) failed!\n",
@@ -1011,9 +1013,9 @@ static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter)mwifiex_cleanup_evt_ring (adapter);if (card->evtbd_ring_vbase) -pci_free_consistent (card->dev, card->evtbd_ring_size, - card->evtbd_ring_vbase, - card->evtbd_ring_pbase); +dma_free_coherent (&card->dev->dev, card->evtbd_ring_size, + card->evtbd_ring_vbase, + card->evtbd_ring_pbase); card->evtbd_wrptr =0 ; card->evtbd_rdptr =0 | reg->evt_rollover_ind; card->evtbd_ring_size =0 ;
@@ -1040,7 +1042,7 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) }skb_put (skb,MWIFIEX_UPLD_SIZE );if (mwifiex_map_pci_memory (adapter, skb,MWIFIEX_UPLD_SIZE , -PCI_DMA_FROMDEVICE )) { +DMA_FROM_DEVICE )) {kfree_skb (skb);return -1 ; }
@@ -1064,14 +1066,14 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter)if (card && card->cmdrsp_buf) {mwifiex_unmap_pci_memory (adapter, card->cmdrsp_buf, -PCI_DMA_FROMDEVICE ); +DMA_FROM_DEVICE );dev_kfree_skb_any (card->cmdrsp_buf); card->cmdrsp_buf =NULL ; }if (card && card->cmd_buf) {mwifiex_unmap_pci_memory (adapter, card->cmd_buf, -PCI_DMA_TODEVICE ); +DMA_TO_DEVICE );dev_kfree_skb_any (card->cmd_buf); card->cmd_buf =NULL ; }
@@ -1086,8 +1088,10 @@ static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter)struct pcie_service_card *card = adapter->card;u32 *cookie; - card->sleep_cookie_vbase =pci_alloc_consistent (card->dev,sizeof (u32), - &card->sleep_cookie_pbase); + card->sleep_cookie_vbase =dma_alloc_coherent (&card->dev->dev, +sizeof (u32), + &card->sleep_cookie_pbase, +GFP_KERNEL );if (!card->sleep_cookie_vbase) {mwifiex_dbg (adapter,ERROR ,"pci_alloc_consistent failed!\n" );
@@ -1115,9 +1119,9 @@ static int mwifiex_pcie_delete_sleep_cookie_buf(struct mwifiex_adapter *adapter) card = adapter->card;if (card && card->sleep_cookie_vbase) { -pci_free_consistent (card->dev,sizeof (u32), - card->sleep_cookie_vbase, - card->sleep_cookie_pbase); +dma_free_coherent (&card->dev->dev,sizeof (u32), + card->sleep_cookie_vbase, + card->sleep_cookie_pbase); card->sleep_cookie_vbase =NULL ; }
@@ -1189,7 +1193,7 @@ static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter)"SEND COMP: Detach skb %p at txbd_rdidx=%d\n" , skb, wrdoneidx);mwifiex_unmap_pci_memory (adapter, skb, -PCI_DMA_TODEVICE ); +DMA_TO_DEVICE ); unmap_count++;
@@ -1282,7 +1286,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,put_unaligned_le16 (MWIFIEX_TYPE_DATA , payload +2 );if (mwifiex_map_pci_memory (adapter, skb, skb->len, -PCI_DMA_TODEVICE )) +DMA_TO_DEVICE ))return -1 ; wrindx = (card->txbd_wrptr & reg->tx_mask) >> reg->tx_start_ptr;
@@ -1372,7 +1376,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,return -EINPROGRESS ; done_unmap: -mwifiex_unmap_pci_memory (adapter, skb,PCI_DMA_TODEVICE ); +mwifiex_unmap_pci_memory (adapter, skb,DMA_TO_DEVICE ); card->tx_buf_list[wrindx] =NULL ;atomic_dec (&adapter->tx_hw_pending);if (reg->pfu_enabled)
@@ -1426,7 +1430,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)if (!skb_data)return -ENOMEM ; -mwifiex_unmap_pci_memory (adapter, skb_data,PCI_DMA_FROMDEVICE ); +mwifiex_unmap_pci_memory (adapter, skb_data,DMA_FROM_DEVICE ); card->rx_buf_list[rd_index] =NULL ;/* Get data length from interface header -
@@ -1464,7 +1468,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)if (mwifiex_map_pci_memory (adapter, skb_tmp,MWIFIEX_RX_DATA_BUF_SIZE , -PCI_DMA_FROMDEVICE )) +DMA_FROM_DEVICE ))return -1 ; buf_pa =MWIFIEX_SKB_DMA_ADDR (skb_tmp);
@@ -1541,7 +1545,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)return -1 ; } -if (mwifiex_map_pci_memory (adapter, skb, skb->len,PCI_DMA_TODEVICE )) +if (mwifiex_map_pci_memory (adapter, skb, skb->len,DMA_TO_DEVICE ))return -1 ; buf_pa =MWIFIEX_SKB_DMA_ADDR (skb);
@@ -1553,7 +1557,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)mwifiex_dbg (adapter,ERROR ,"%s: failed to write download command to boot code.\n" , __func__); -mwifiex_unmap_pci_memory (adapter, skb,PCI_DMA_TODEVICE ); +mwifiex_unmap_pci_memory (adapter, skb,DMA_TO_DEVICE );return -1 ; }
@@ -1565,7 +1569,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)mwifiex_dbg (adapter,ERROR ,"%s: failed to write download command to boot code.\n" , __func__); -mwifiex_unmap_pci_memory (adapter, skb,PCI_DMA_TODEVICE ); +mwifiex_unmap_pci_memory (adapter, skb,DMA_TO_DEVICE );return -1 ; }
@@ -1574,7 +1578,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)mwifiex_dbg (adapter,ERROR ,"%s: failed to write command len to cmd_size scratch reg\n" , __func__); -mwifiex_unmap_pci_memory (adapter, skb,PCI_DMA_TODEVICE ); +mwifiex_unmap_pci_memory (adapter, skb,DMA_TO_DEVICE );return -1 ; }
@@ -1583,7 +1587,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) CPU_INTR_DOOR_BELL)) {mwifiex_dbg (adapter,ERROR ,"%s: failed to assert door-bell intr\n" , __func__); -mwifiex_unmap_pci_memory (adapter, skb,PCI_DMA_TODEVICE ); +mwifiex_unmap_pci_memory (adapter, skb,DMA_TO_DEVICE );return -1 ; }
@@ -1642,7 +1646,7 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)put_unaligned_le16 ((u16 )skb->len, &payload[0 ]);put_unaligned_le16 (MWIFIEX_TYPE_CMD , &payload[2 ]); -if (mwifiex_map_pci_memory (adapter, skb, skb->len,PCI_DMA_TODEVICE )) +if (mwifiex_map_pci_memory (adapter, skb, skb->len,DMA_TO_DEVICE ))return -1 ; card->cmd_buf = skb;
@@ -1742,17 +1746,16 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) "info: Rx CMD Response\n");if (adapter->curr_cmd) -mwifiex_unmap_pci_memory (adapter, skb,PCI_DMA_FROMDEVICE ); +mwifiex_unmap_pci_memory (adapter, skb,DMA_FROM_DEVICE );else -pci_dma_sync_single_for_cpu (card->dev, -MWIFIEX_SKB_DMA_ADDR (skb), -MWIFIEX_UPLD_SIZE , -PCI_DMA_FROMDEVICE ); +dma_sync_single_for_cpu (&card->dev->dev, +MWIFIEX_SKB_DMA_ADDR (skb), +MWIFIEX_UPLD_SIZE ,DMA_FROM_DEVICE );/* Unmap the command as a response has been received. */ if (card->cmd_buf) {mwifiex_unmap_pci_memory (adapter, card->cmd_buf, -PCI_DMA_TODEVICE ); +DMA_TO_DEVICE );dev_kfree_skb_any (card->cmd_buf); card->cmd_buf =NULL ; }
@@ -1763,10 +1766,10 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)if (!adapter->curr_cmd) {if (adapter->ps_state ==PS_STATE_SLEEP_CFM ) { -pci_dma_sync_single_for_device (card->dev, -MWIFIEX_SKB_DMA_ADDR (skb), -MWIFIEX_SLEEP_COOKIE_SIZE , -PCI_DMA_FROMDEVICE ); +dma_sync_single_for_device (&card->dev->dev, +MWIFIEX_SKB_DMA_ADDR (skb), +MWIFIEX_SLEEP_COOKIE_SIZE , +DMA_FROM_DEVICE );if (mwifiex_write_reg (adapter,PCIE_CPU_INT_EVENT ,CPU_INTR_SLEEP_CFM_DONE )) {
@@ -1777,7 +1780,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)mwifiex_delay_for_sleep_cookie (adapter,MWIFIEX_MAX_DELAY_COUNT );mwifiex_unmap_pci_memory (adapter, skb, -PCI_DMA_FROMDEVICE ); +DMA_FROM_DEVICE );skb_pull (skb, adapter->intf_hdr_len);while (reg->sleep_cookie && (count++ <10 ) &&mwifiex_pcie_ok_to_access_hw (adapter))
@@ -1793,7 +1796,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len));skb_push (skb, adapter->intf_hdr_len);if (mwifiex_map_pci_memory (adapter, skb,MWIFIEX_UPLD_SIZE , -PCI_DMA_FROMDEVICE )) +DMA_FROM_DEVICE ))return -1 ; }else if (mwifiex_pcie_ok_to_access_hw (adapter)) {skb_pull (skb, adapter->intf_hdr_len);
@@ -1835,7 +1838,7 @@ static int mwifiex_pcie_cmdrsp_complete(struct mwifiex_adapter *adapter, card->cmdrsp_buf = skb;skb_push (card->cmdrsp_buf, adapter->intf_hdr_len);if (mwifiex_map_pci_memory (adapter, skb,MWIFIEX_UPLD_SIZE , -PCI_DMA_FROMDEVICE )) +DMA_FROM_DEVICE ))return -1 ; }
@@ -1890,7 +1893,7 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter)mwifiex_dbg (adapter,INFO ,"info: Read Index: %d\n" , rdptr); skb_cmd = card->evt_buf_list[rdptr]; -mwifiex_unmap_pci_memory (adapter, skb_cmd,PCI_DMA_FROMDEVICE ); +mwifiex_unmap_pci_memory (adapter, skb_cmd,DMA_FROM_DEVICE );/* Take the pointer and set it to event pointer in adapter and will return back after event handling callback */
@@ -1970,7 +1973,7 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter,skb_put (skb,MAX_EVENT_SIZE - skb->len);if (mwifiex_map_pci_memory (adapter, skb,MAX_EVENT_SIZE , -PCI_DMA_FROMDEVICE )) +DMA_FROM_DEVICE ))return -1 ; card->evt_buf_list[rdptr] = skb; desc = card->evtbd_ring[rdptr];
@@ -2252,7 +2255,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,"interrupt status during fw dnld.\n" , __func__);mwifiex_unmap_pci_memory (adapter, skb, -PCI_DMA_TODEVICE ); +DMA_TO_DEVICE ); ret =-1 ; goto done; }
@@ -2264,12 +2267,12 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,mwifiex_dbg (adapter,ERROR ,"%s: Card failed to ACK download\n" , __func__);mwifiex_unmap_pci_memory (adapter, skb, -PCI_DMA_TODEVICE ); +DMA_TO_DEVICE ); ret =-1 ; goto done; } -mwifiex_unmap_pci_memory (adapter, skb,PCI_DMA_TODEVICE ); +mwifiex_unmap_pci_memory (adapter, skb,DMA_TO_DEVICE ); offset += txlen; }while (true);
@@ -2939,13 +2942,13 @@ static int mwifiex_init_pcie(struct mwifiex_adapter *adapter)pci_set_master (pdev); - ret =pci_set_dma_mask (pdev,DMA_BIT_MASK (32 )); + ret =dma_set_mask (&pdev->dev,DMA_BIT_MASK (32 ));if (ret) {pr_err ("set_dma_mask(32) failed: %d\n" , ret); goto err_set_dma_mask; } - ret =pci_set_consistent_dma_mask (pdev,DMA_BIT_MASK (32 )); + ret =dma_set_coherent_mask (&pdev->dev,DMA_BIT_MASK (32 ));if (ret) {pr_err ("set_consistent_dma_mask(64) failed\n" ); goto err_set_dma_mask;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 58/273 wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 288c63d5cb4667a51a04668b3e2bb0ea499bc5f4 ]
Add missing 'kfree_skb()' in 'mwifiex_init_rxq_ring()' and never do 'kfree(card->rxbd_ring_vbase)' because this area is DMAed and should be released with 'dma_free_coherent()'. The latter is performed in 'mwifiex_pcie_delete_rxbd_ring()', which is now called to recover from possible errors in 'mwifiex_pcie_create_rxbd_ring()'. Likewise for 'mwifiex_pcie_init_evt_ring()', 'kfree(card->evtbd_ring_vbase)' 'mwifiex_pcie_delete_evtbd_ring()' and 'mwifiex_pcie_create_rxbd_ring()'.
--- drivers/net/wireless/marvell/mwifiex/pcie.c | 25 ++++++++++++++------- 1 file changed, 17 insertions(+), 8 deletions(-)
drivers/net/wireless/marvell/mwifiex/pcie.c +17 -8
@@ -50,6 +50,8 @@ static int mwifiex_pcie_probe_of(struct device *dev) }static void mwifiex_pcie_work (struct work_struct *work); +static int mwifiex_pcie_delete_rxbd_ring (struct mwifiex_adapter *adapter); +static int mwifiex_pcie_delete_evtbd_ring (struct mwifiex_adapter *adapter); static int mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
@@ -631,14 +633,15 @@ static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter)if (!skb) {mwifiex_dbg (adapter,ERROR ,"Unable to allocate skb for RX ring.\n" ); -kfree (card->rxbd_ring_vbase);return -ENOMEM ; }if (mwifiex_map_pci_memory (adapter, skb,MWIFIEX_RX_DATA_BUF_SIZE , -DMA_FROM_DEVICE )) -return -1 ; +DMA_FROM_DEVICE )) { +kfree_skb (skb); +return -ENOMEM ; + } buf_pa =MWIFIEX_SKB_DMA_ADDR (skb);
@@ -688,7 +691,6 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)if (!skb) {mwifiex_dbg (adapter,ERROR ,"Unable to allocate skb for EVENT buf.\n" ); -kfree (card->evtbd_ring_vbase);return -ENOMEM ; }skb_put (skb,MAX_EVENT_SIZE );
@@ -696,8 +698,7 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)if (mwifiex_map_pci_memory (adapter, skb,MAX_EVENT_SIZE ,DMA_FROM_DEVICE )) {kfree_skb (skb); -kfree (card->evtbd_ring_vbase); -return -1 ; +return -ENOMEM ; } buf_pa =MWIFIEX_SKB_DMA_ADDR (skb);
@@ -896,6 +897,7 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)*/ static int mwifiex_pcie_create_rxbd_ring (struct mwifiex_adapter *adapter) { +int ret;struct pcie_service_card *card = adapter->card;const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
@@ -934,7 +936,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter) (u32)((u64 )card->rxbd_ring_pbase >>32 ), card->rxbd_ring_size); -return mwifiex_init_rxq_ring (adapter); + ret =mwifiex_init_rxq_ring (adapter); +if (ret) +mwifiex_pcie_delete_rxbd_ring (adapter); +return ret; }/*
@@ -965,6 +970,7 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)*/ static int mwifiex_pcie_create_evtbd_ring (struct mwifiex_adapter *adapter) { +int ret;struct pcie_service_card *card = adapter->card;const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
@@ -999,7 +1005,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter) (u32)((u64 )card->evtbd_ring_pbase >>32 ), card->evtbd_ring_size); -return mwifiex_pcie_init_evt_ring (adapter); + ret =mwifiex_pcie_init_evt_ring (adapter); +if (ret) +mwifiex_pcie_delete_evtbd_ring (adapter); +return ret; }/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 59/273 Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanjun Gong <[email protected]>
[ Upstream commit e8b5aed31355072faac8092ead4938ddec3111fd ]
in nokia_bluetooth_serdev_probe(), check the return value of clk_prepare_enable() and return the error code if clk_prepare_enable() returns an unexpected value.
--- drivers/bluetooth/hci_nokia.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/bluetooth/hci_nokia.c +5 -1
@@ -743,7 +743,11 @@ static int nokia_bluetooth_serdev_probe(struct serdev_device *serdev)return err; } -clk_prepare_enable (sysclk); + err =clk_prepare_enable (sysclk); +if (err) { +dev_err (dev,"could not enable sysclk: %d" , err); +return err; + } btdev->sysclk_speed =clk_get_rate (sysclk);clk_disable_unprepare (sysclk);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 60/273 crypto: caam - fix unchecked return value error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaurav Jain <[email protected]>
[ Upstream commit e30685204711a6be40dec2622606950ccd37dafe ]
error:
Unchecked return value (CHECKED_RETURN)check_return: Calling sg_miter_next without checking return value
fix:
added check if(!sg_miter_next)
--- drivers/crypto/caam/caampkc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/crypto/caam/caampkc.c +3 -1
@@ -194,7 +194,9 @@ static int caam_rsa_count_leading_zeros(struct scatterlist *sgl,if (len && *buff)break ; -sg_miter_next (&miter); +if (!sg_miter_next (&miter)) +break ; + buff = miter.addr; len = miter.length;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 61/273 lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yan Zhai <[email protected]>
[ Upstream commit a171fbec88a2c730b108c7147ac5e7b2f5a02b47 ]
LWTUNNEL_XMIT_CONTINUE is implicitly assumed in ip(6)_finish_output2, such that any positive return value from a xmit hook could cause unexpected continue behavior, despite that related skb may have been freed. This could be error-prone for future xmit hook ops. One of the possible errors is to return statuses of dst_output directly.
To make the code safer, redefine LWTUNNEL_XMIT_CONTINUE value to distinguish from dst_output statuses and check the continue condition explicitly.
--- include/net/lwtunnel.h | 5 ++++- net/ipv4/ip_output.c | 2 +- net/ipv6/ip6_output.c | 2 +- 3 files changed, 6 insertions(+), 3 deletions(-)
include/net/lwtunnel.h +4 -1
@@ -16,9 +16,12 @@#define LWTUNNEL_STATE_INPUT_REDIRECT BIT(1)#define LWTUNNEL_STATE_XMIT_REDIRECT BIT(2) +/* LWTUNNEL_XMIT_CONTINUE should be distinguishable from dst_output return +* values (NET_XMIT_xxx and NETDEV_TX_xxx in linux/netdevice.h) for safety. +*/ enum {LWTUNNEL_XMIT_DONE , -LWTUNNEL_XMIT_CONTINUE , +LWTUNNEL_XMIT_CONTINUE =0x100 , };
net/ipv4/ip_output.c +1 -1
@@ -221,7 +221,7 @@ static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *sif (lwtunnel_xmit_redirect (dst->lwtstate)) {int res =lwtunnel_xmit (skb); -if (res <0 || res ==LWTUNNEL_XMIT_DONE ) +if (res !=LWTUNNEL_XMIT_CONTINUE )return res; }
net/ipv6/ip6_output.c +1 -1
@@ -106,7 +106,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *if (lwtunnel_xmit_redirect (dst->lwtstate)) {int res =lwtunnel_xmit (skb); -if (res <0 || res ==LWTUNNEL_XMIT_DONE ) +if (res !=LWTUNNEL_XMIT_CONTINUE )return res; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 62/273 fs: ocfs2: namei: check return value of ocfs2_add_entry()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Chernyshev <[email protected]>
[ Upstream commit 6b72e5f9e79360fce4f2be7fe81159fbdf4256a5 ]
Process result of ocfs2_add_entry() in case we have an error value.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- fs/ocfs2/namei.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ocfs2/namei.c +4 -0
@@ -1538,6 +1538,10 @@ static int ocfs2_rename(struct inode *old_dir, status =ocfs2_add_entry (handle, new_dentry, old_inode,OCFS2_I (old_inode)->ip_blkno, new_dir_bh, &target_insert); +if (status <0 ) { +mlog_errno (status); + goto bail; + } } old_inode->i_ctime =current_time (old_inode);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 63/273 wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 9c8fd72a5c2a031cbc680a2990107ecd958ffcdb ]
Always free the zeroed page on return from 'mwifiex_histogram_read()'.
--- drivers/net/wireless/marvell/mwifiex/debugfs.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/wireless/marvell/mwifiex/debugfs.c +7 -2
@@ -265,8 +265,11 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,if (!p)return -ENOMEM ; -if (!priv || !priv->hist_data) -return -EFAULT ; +if (!priv || !priv->hist_data) { + ret = -EFAULT ; + goto free_and_exit; + } + phist_data = priv->hist_data; p += sprintf(p, "\n"
@@ -321,6 +324,8 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, ret =simple_read_from_buffer (ubuf, count, ppos, (char *)page, (unsigned long )p - page); +free_and_exit: +free_page (page);return ret; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 64/273 wifi: mwifiex: Fix missed return in oob checks failed path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Polaris Pi <[email protected]>
[ Upstream commit 2785851c627f2db05f9271f7f63661b5dbd95c4c ]
Add missed return in mwifiex_uap_queue_bridged_pkt() and mwifiex_process_rx_packet().
--- drivers/net/wireless/marvell/mwifiex/sta_rx.c | 1 + drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 1 + 2 files changed, 2 insertions(+)
drivers/net/wireless/marvell/mwifiex/sta_rx.c +1 -0
@@ -104,6 +104,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, skb->len, rx_pkt_off); priv->stats.rx_dropped++;dev_kfree_skb_any (skb); +return -1 ; } if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
drivers/net/wireless/marvell/mwifiex/uap_txrx.c +1 -0
@@ -123,6 +123,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv, skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset)); priv->stats.rx_dropped++;dev_kfree_skb_any (skb); +return ; } if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 65/273 wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit b674fb513e2e7a514fcde287c0f73915d393fdb6 ]
Currently, the synchronization between ath9k_wmi_cmd() and ath9k_wmi_ctrl_rx() is exposed to a race condition which, although being rather unlikely, can lead to invalid behaviour of ath9k_wmi_cmd().
Consider the following scenario:
CPU0 CPU1
ath9k_wmi_cmd(...)
mutex_lock(&wmi->op_mutex)
ath9k_wmi_cmd_issue(...)
wait_for_completion_timeout(...)
---
timeout
---
/* the callback is being processed * before last_seq_id became zero */ ath9k_wmi_ctrl_rx(...) spin_lock_irqsave(...) /* wmi->last_seq_id check here * doesn't detect timeout yet */ spin_unlock_irqrestore(...)
/* last_seq_id is zeroed to
* indicate there was a timeout
*/
wmi->last_seq_id = 0
mutex_unlock(&wmi->op_mutex)
return -ETIMEDOUT
ath9k_wmi_cmd(...)
mutex_lock(&wmi->op_mutex)
/* the buffer is replaced with
* another one
*/
wmi->cmd_rsp_buf = rsp_buf
wmi->cmd_rsp_len = rsp_len
ath9k_wmi_cmd_issue(...)
spin_lock_irqsave(...)
spin_unlock_irqrestore(...)
wait_for_completion_timeout(...)
/* the continuation of the
* callback left after the first
* ath9k_wmi_cmd call
*/
ath9k_wmi_rsp_callback(...)
/* copying data designated
* to already timeouted
* WMI command into an
* inappropriate wmi_cmd_buf
*/
memcpy(...)
complete(&wmi->cmd_wait) /* awakened by the bogus callback
* => invalid return result
*/
mutex_unlock(&wmi->op_mutex)
return 0
To fix this, update last_seq_id on timeout path inside ath9k_wmi_cmd() under the wmi_lock. Move ath9k_wmi_rsp_callback() under wmi_lock inside ath9k_wmi_ctrl_rx() so that the wmi->cmd_wait can be completed only for initially designated wmi_cmd call, otherwise the path would be rejected with last_seq_id check.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/net/wireless/ath/ath9k/wmi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/wmi.c +4 -2
@@ -239,10 +239,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,spin_unlock_irqrestore (&wmi->wmi_lock, flags); goto free_skb; } -spin_unlock_irqrestore (&wmi->wmi_lock, flags);/* WMI command response */ ath9k_wmi_rsp_callback (wmi, skb); +spin_unlock_irqrestore (&wmi->wmi_lock, flags); free_skb:kfree_skb (skb);
@@ -305,8 +305,8 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,struct ath_common *common =ath9k_hw_common (ah);u16 headroom =sizeof (struct htc_frame_hdr ) +sizeof (struct wmi_cmd_hdr ); +unsigned long time_left, flags;struct sk_buff *skb; -unsigned long time_left;int ret =0 ;if (ah->ah_flags &AH_UNPLUGGED )
@@ -342,7 +342,9 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,if (!time_left) {ath_dbg (common,WMI ,"Timeout waiting for WMI command: %s\n" ,wmi_cmd_to_name (cmd_id)); +spin_lock_irqsave (&wmi->wmi_lock, flags); wmi->last_seq_id =0 ; +spin_unlock_irqrestore (&wmi->wmi_lock, flags);mutex_unlock (&wmi->op_mutex);kfree_skb (skb);return -ETIMEDOUT ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 66/273 wifi: ath9k: protect WMI command response buffer replacement with a lock
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit 454994cfa9e4c18b6df9f78b60db8eadc20a6c25 ]
If ath9k_wmi_cmd() has exited with a timeout, it is possible that during next ath9k_wmi_cmd() call the wmi_rsp callback for previous wmi command writes to new wmi->cmd_rsp_buf and makes a completion. This results in an invalid ath9k_wmi_cmd() return value.
Move the replacement of WMI command response buffer and length under wmi_lock. Note that last_seq_id value is updated there, too.
Thus, the buffer cannot be written to by a belated wmi_rsp callback because that path is properly rejected by the last_seq_id check.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/net/wireless/ath/ath9k/wmi.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath9k/wmi.c +8 -6
@@ -280,7 +280,8 @@ int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi,static int ath9k_wmi_cmd_issue (struct wmi *wmi,struct sk_buff *skb, -enum wmi_cmd_id cmd,u16 len) +enum wmi_cmd_id cmd,u16 len, +u8 *rsp_buf,u32 rsp_len) {struct wmi_cmd_hdr *hdr;unsigned long flags;
@@ -290,6 +291,11 @@ static int ath9k_wmi_cmd_issue(struct wmi *wmi, hdr->seq_no =cpu_to_be16 (++wmi->tx_seq_id);spin_lock_irqsave (&wmi->wmi_lock, flags); + +/* record the rsp buffer and length */ + wmi->cmd_rsp_buf = rsp_buf; + wmi->cmd_rsp_len = rsp_len; + wmi->last_seq_id = wmi->tx_seq_id;spin_unlock_irqrestore (&wmi->wmi_lock, flags);
@@ -330,11 +336,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, goto out; } -/* record the rsp buffer and length */ - wmi->cmd_rsp_buf = rsp_buf; - wmi->cmd_rsp_len = rsp_len; - - ret =ath9k_wmi_cmd_issue (wmi, skb, cmd_id, cmd_len); + ret =ath9k_wmi_cmd_issue (wmi, skb, cmd_id, cmd_len, rsp_buf, rsp_len);if (ret) goto out;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 67/273 wifi: mwifiex: avoid possible NULL skb pointer dereference
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 35a7a1ce7c7d61664ee54f5239a1f120ab95a87e ]
In 'mwifiex_handle_uap_rx_forward()', always check the value returned by 'skb_copy()' to avoid potential NULL pointer dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop original skb in case of copying failure.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/wireless/marvell/mwifiex/uap_txrx.c +9 -1
@@ -266,7 +266,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv,if (is_multicast_ether_addr (ra)) { skb_uap =skb_copy (skb,GFP_ATOMIC ); -mwifiex_uap_queue_bridged_pkt (priv, skb_uap); +if (likely (skb_uap)) { +mwifiex_uap_queue_bridged_pkt (priv, skb_uap); + }else { +mwifiex_dbg (adapter,ERROR , +"failed to copy skb for uAP\n" ); + priv->stats.rx_dropped++; +dev_kfree_skb_any (skb); +return -1 ; + } }else {if (mwifiex_get_sta_entry (priv, ra)) {/* Requeue Intra-BSS packet */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 68/273 wifi: ath9k: use IS_ERR() with debugfs_create_dir()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Ming <[email protected]>
[ Upstream commit 1e4134610d93271535ecf900a676e1f094e9944c ]
The debugfs_create_dir() function returns error pointers, it never returns NULL. Most incorrect error checks were fixed, but the one in ath9k_htc_init_debug() was forgotten.
Fix the remaining error check.
--- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/htc_drv_debug.c +1 -1
@@ -491,7 +491,7 @@ int ath9k_htc_init_debug(struct ath_hw *ah) priv->debug.debugfs_phy =debugfs_create_dir (KBUILD_MODNAME , priv->hw->wiphy->debugfsdir); -if (!priv->debug.debugfs_phy) +if (IS_ERR (priv->debug.debugfs_phy))return -ENOMEM ;ath9k_cmn_spectral_init_debug (&priv->spec_priv, priv->debug.debugfs_phy);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 69/273 net: arcnet: Do not call kfree_skb() under local_irq_disable()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 786c96e92fb9e854cb8b0cb7399bb2fb28e15c4b ]
It is not allowed to call kfree_skb() from hardware interrupt context or with hardware interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under local_irq_disable(). Compile tested only.
--- drivers/net/arcnet/arcnet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/arcnet/arcnet.c +1 -1
@@ -434,7 +434,7 @@ static void arcnet_reply_tasklet(unsigned long data) ret =sock_queue_err_skb (sk, ackskb);if (ret) -kfree_skb (ackskb); +dev_kfree_skb_irq (ackskb);local_irq_enable (); };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 70/273 net/sched: sch_hfsc: Ensure inner classes have fsc curve
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Budimir Markovic <[email protected]>
[ Upstream commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f ]
HFSC assumes that inner classes have an fsc curve, but it is currently possible for classes without an fsc curve to become parents. This leads to bugs including a use-after-free.
Don't allow non-root classes without HFSC_FSC to become parents.
--- net/sched/sch_hfsc.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sched/sch_hfsc.c +4 -0
@@ -1021,6 +1021,10 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,if (parent ==NULL )return -ENOENT ; } +if (!(parent->cl_flags &HFSC_FSC ) && parent != &q->root) { +NL_SET_ERR_MSG (extack,"Invalid parent - parent class must have FSC" ); +return -EINVAL ; + }if (classid ==0 ||TC_H_MAJ (classid ^ sch->handle) !=0 )return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 71/273 netrom: Deny concurrent connect().
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit c2f8fd7949603efb03908e05abbf7726748c8de3 ]
syzkaller reported null-ptr-deref [0] related to AF_NETROM. This is another self-accept issue from the strace log. [1]
syz-executor creates an AF_NETROM socket and calls connect(), which is blocked at that time. Then, sk->sk_state is TCP_SYN_SENT and sock->state is SS_CONNECTING.
[pid 5059] socket(AF_NETROM, SOCK_SEQPACKET, 0) = 4
[pid 5059] connect(4, {sa_family=AF_NETROM, sa_data="..." <unfinished ...>
Another thread calls connect() concurrently, which finally fails with -EINVAL. However, the problem here is the socket state is reset even while the first connect() is blocked.
[pid 5060] connect(4, NULL, 0 <unfinished ...>
[pid 5060] <... connect resumed>) = -1 EINVAL (Invalid argument)
As sk->state is TCP_CLOSE and sock->state is SS_UNCONNECTED, the following listen() succeeds. Then, the first connect() looks up itself as a listener and puts skb into the queue with skb->sk itself. As a result, the next accept() gets another FD of itself as 3, and the first connect() finishes.
[pid 5060] listen(4, 0 <unfinished ...> [pid 5060] <... listen resumed>) = 0 [pid 5060] accept(4, NULL, NULL <unfinished ...> [pid 5060] <... accept resumed>) = 3 [pid 5059] <... connect resumed>) = 0
Then, accept4() is called but blocked, which causes the general protection fault later.
[pid 5059] accept4(4, NULL, 0x20000400, SOCK_NONBLOCK <unfinished ...>
After that, another self-accept occurs by accept() and writev().
[pid 5060] accept(4, NULL, NULL <unfinished ...>
[pid 5061] writev(3, [{iov_base=...}] <unfinished ...>
[pid 5061] <... writev resumed>) = 99
[pid 5060] <... accept resumed>) = 6Finally, the leader thread close()s all FDs. Since the three FDs reference the same socket, nr_release() does the cleanup for it three times, and the remaining accept4() causes the following fault.
[pid 5058] close(3) = 0 [pid 5058] close(4) = 0 [pid 5058] close(5) = -1 EBADF (Bad file descriptor) [pid 5058] close(6) = 0 [pid 5058] <... exit_group resumed>) = ? [ 83.456055][ T5059] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
To avoid the issue, we need to return an error for connect() if another connect() is in progress, as done in __inet_stream_connect().
[0]:
general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 PID: 5059 Comm: syz-executor.0 Not tainted 6.5.0-rc5-syzkaller-00194-gace0ab3a4b54 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:__lock_acquire+0x109/0x5de0 kernel/locking/lockdep.c:5012 Code: 45 85 c9 0f 84 cc 0e 00 00 44 8b 05 11 6e 23 0b 45 85 c0 0f 84 be 0d 00 00 48 ba 00 00 00 00 00 fc ff df 4c 89 d1 48 c1 e9 03 <80> 3c 11 00 0f 85 e8 40 00 00 49 81 3a a0 69 48 90 0f 84 96 0d 00 RSP: 0018:ffffc90003d6f9e0 EFLAGS: 00010006 RAX: ffff8880244c8000 RBX: 1ffff920007adf6c RCX: 0000000000000003 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000018 RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000018 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f51d519a6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f51d5158d58 CR3: 000000002943f000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> lock_acquire kernel/locking/lockdep.c:5761 [inline] lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162 prepare_to_wait+0x47/0x380 kernel/sched/wait.c:269 nr_accept+0x20d/0x650 net/netrom/af_netrom.c:798 do_accept+0x3a6/0x570 net/socket.c:1872 __sys_accept4_file net/socket.c:1913 [inline] __sys_accept4+0x99/0x120 net/socket.c:1943 __do_sys_accept4 net/socket.c:1954 [inline] __se_sys_accept4 net/socket.c:1951 [inline] __x64_sys_accept4+0x96/0x100 net/socket.c:1951 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f51d447cae9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f51d519a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 RAX: ffffffffffffffda RBX: 00007f51d459bf80 RCX: 00007f51d447cae9 RDX: 0000000020000400 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 00007f51d44c847a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f51d459bf80 R15: 00007ffc25c34e48 </TASK>
--- net/netrom/af_netrom.c | 5 +++++ 1 file changed, 5 insertions(+)
net/netrom/af_netrom.c +5 -0
@@ -663,6 +663,11 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr, goto out_release; } +if (sock->state ==SS_CONNECTING ) { + err = -EALREADY ; + goto out_release; + } + sk->sk_state =TCP_CLOSE ; sock->state =SS_UNCONNECTED ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 72/273 quota: add dqi_dirty_list description to comment of Dquot List Management
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengguang Xu <[email protected]>
[ Upstream commit f44840ad1f822d9ecee6a3f91f2d17825a361307 ]
Actually there are four lists for dquot management, so add the description of dqui_dirty_list to comment.
Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
--- fs/quota/dquot.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/quota/dquot.c +8 -3
@@ -223,9 +223,9 @@ static void put_quota_format(struct quota_format_type *fmt)/* * Dquot List Management: -* The quota code uses three lists for dquot management: the inuse_list, -* free_dquots, and dquot_hash[] array. A single dquot structure may be -* on all three lists, depending on its current state. +* The quota code uses four lists for dquot management: the inuse_list, +* free_dquots, dqi_dirty_list, and dquot_hash[] array. A single dquot +* structure may be on some of those lists, depending on its current state. * * All dquots are placed to the end of inuse_list when first created, and this * list is used for invalidate operation, which must look at every dquot.
@@ -236,6 +236,11 @@ static void put_quota_format(struct quota_format_type *fmt)* dqstats.free_dquots gives the number of dquots on the list. When * dquot is invalidated it's completely released from memory. * +* Dirty dquots are added to the dqi_dirty_list of quota_info when mark +* dirtied, and this list is searched when writing dirty dquots back to +* quota file. Note that some filesystems do dirty dquot tracking on their +* own (e.g. in a journal) and thus don't use dqi_dirty_list. +* * Dquots with a specific identity (device, type and id) are placed on * one of the dquot_hash[] hash chains. The provides an efficient search * mechanism to locate a specific dquot.
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 73/273 quota: avoid increasing DQST_LOOKUPS when iterating over dirty/inuse list
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengguang Xu <[email protected]>
[ Upstream commit 05848db2083d4f232e84e385845dcd98d5c511b2 ]
It is meaningless to increase DQST_LOOKUPS number while iterating over dirty/inuse list, so just avoid it.
Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
--- fs/quota/dquot.c | 2 -- 1 file changed, 2 deletions(-)
fs/quota/dquot.c +0 -2
@@ -594,7 +594,6 @@ int dquot_scan_active(struct super_block *sb,/* Now we have active dquot so we can just increase use count */ atomic_inc (&dquot->dq_count);spin_unlock (&dq_list_lock); -dqstats_inc (DQST_LOOKUPS );dqput (old_dquot); old_dquot = dquot;/*
@@ -649,7 +648,6 @@ int dquot_writeback_dquots(struct super_block *sb, int type)* use count */ dqgrab (dquot);spin_unlock (&dq_list_lock); -dqstats_inc (DQST_LOOKUPS ); err = sb->dq_op->write_dquot (dquot);if (err) {/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 74/273 quota: factor out dquot_write_dquot()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 024128477809f8073d870307c8157b8826ebfd08 ]
Refactor out dquot_write_dquot() to reduce duplicate code.
Message-Id: <[email protected]>
Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
--- fs/quota/dquot.c | 39 ++++++++++++++++----------------------- 1 file changed, 16 insertions(+), 23 deletions(-)
fs/quota/dquot.c +16 -23
@@ -618,6 +618,18 @@ int dquot_scan_active(struct super_block *sb, }EXPORT_SYMBOL (dquot_scan_active); +static inline int dquot_write_dquot (struct dquot *dquot) +{ +int ret = dquot->dq_sb->dq_op->write_dquot (dquot); +if (ret <0 ) { +quota_error (dquot->dq_sb,"Can't write quota structure " +"(error %d). Quota may get out of sync!" , ret); +/* Clear dirty bit anyway to avoid infinite loop. */ +clear_dquot_dirty (dquot); + } +return ret; +} +/* Write all dquot structures to quota files */ int dquot_writeback_dquots (struct super_block *sb,int type) {
@@ -648,16 +660,9 @@ int dquot_writeback_dquots(struct super_block *sb, int type)* use count */ dqgrab (dquot);spin_unlock (&dq_list_lock); - err = sb->dq_op->write_dquot (dquot); -if (err) { -/* -* Clear dirty bit anyway to avoid infinite -* loop here. -*/ -clear_dquot_dirty (dquot); -if (!ret) - ret = err; - } + err =dquot_write_dquot (dquot); +if (err && !ret) + ret = err;dqput (dquot);spin_lock (&dq_list_lock); }
@@ -755,8 +760,6 @@ static struct shrinker dqcache_shrinker = {*/ void dqput (struct dquot *dquot) { -int ret; -if (!dquot)return ;#ifdef CONFIG_QUOTA_DEBUG
@@ -784,17 +787,7 @@ void dqput(struct dquot *dquot)if (dquot_dirty (dquot)) {spin_unlock (&dq_list_lock);/* Commit dquot before releasing */ - ret = dquot->dq_sb->dq_op->write_dquot (dquot); -if (ret <0 ) { -quota_error (dquot->dq_sb,"Can't write quota structure" -" (error %d). Quota may get out of sync!" , - ret); -/* -* We clear dirty bit anyway, so that we avoid -* infinite loop here -*/ -clear_dquot_dirty (dquot); - } +dquot_write_dquot (dquot); goto we_slept; }if (test_bit (DQ_ACTIVE_B , &dquot->dq_flags)) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 75/273 quota: rename dquot_active() to inode_quota_active()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 4b9bdfa16535de8f49bf954aeed0f525ee2fc322 ]
Now we have a helper function dquot_dirty() to determine if dquot has DQ_MOD_B bit. dquot_active() can easily be misunderstood as a helper function to determine if dquot has DQ_ACTIVE_B bit. So we avoid this by renaming it to inode_quota_active() and later on we will add the helper function dquot_active() to determine if dquot has DQ_ACTIVE_B bit.
Message-Id: <[email protected]>
Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
--- fs/quota/dquot.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
fs/quota/dquot.c +10 -10
@@ -1404,7 +1404,7 @@ static int info_bdq_free(struct dquot *dquot, qsize_t space)return QUOTA_NL_NOWARN ; } -static int dquot_active (const struct inode *inode) +static int inode_quota_active (const struct inode *inode) {struct super_block *sb = inode->i_sb;
@@ -1427,7 +1427,7 @@ static int __dquot_initialize(struct inode *inode, int type)qsize_t rsv;int ret =0 ; -if (!dquot_active (inode)) +if (!inode_quota_active (inode))return 0 ; dquots =i_dquot (inode);
@@ -1535,7 +1535,7 @@ bool dquot_initialize_needed(struct inode *inode)struct dquot **dquots;int i; -if (!dquot_active (inode)) +if (!inode_quota_active (inode))return false; dquots =i_dquot (inode);
@@ -1646,7 +1646,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)int reserve = flags &DQUOT_SPACE_RESERVE ;struct dquot **dquots; -if (!dquot_active (inode)) { +if (!inode_quota_active (inode)) {if (reserve) {spin_lock (&inode->i_lock); *inode_reserved_space (inode) += number;
@@ -1718,7 +1718,7 @@ int dquot_alloc_inode(struct inode *inode)struct dquot_warn warn[MAXQUOTAS ];struct dquot *const *dquots; -if (!dquot_active (inode)) +if (!inode_quota_active (inode))return 0 ;for (cnt =0 ; cnt <MAXQUOTAS ; cnt++) warn[cnt].w_type =QUOTA_NL_NOWARN ;
@@ -1761,7 +1761,7 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)struct dquot **dquots;int cnt, index; -if (!dquot_active (inode)) { +if (!inode_quota_active (inode)) {spin_lock (&inode->i_lock); *inode_reserved_space (inode) -= number;__inode_add_bytes (inode, number);
@@ -1803,7 +1803,7 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)struct dquot **dquots;int cnt, index; -if (!dquot_active (inode)) { +if (!inode_quota_active (inode)) {spin_lock (&inode->i_lock); *inode_reserved_space (inode) += number;__inode_sub_bytes (inode, number);
@@ -1847,7 +1847,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags)struct dquot **dquots;int reserve = flags &DQUOT_SPACE_RESERVE , index; -if (!dquot_active (inode)) { +if (!inode_quota_active (inode)) {if (reserve) {spin_lock (&inode->i_lock); *inode_reserved_space (inode) -= number;
@@ -1902,7 +1902,7 @@ void dquot_free_inode(struct inode *inode)struct dquot *const *dquots;int index; -if (!dquot_active (inode)) +if (!inode_quota_active (inode))return ; dquots =i_dquot (inode);
@@ -2073,7 +2073,7 @@ int dquot_transfer(struct inode *inode, struct iattr *iattr)struct super_block *sb = inode->i_sb;int ret; -if (!dquot_active (inode)) +if (!inode_quota_active (inode))return 0 ;if (iattr->ia_valid &ATTR_UID && !uid_eq (iattr->ia_uid, inode->i_uid)){
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 76/273 quota: add new helper dquot_active()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 33bcfafc48cb186bc4bbcea247feaa396594229e ]
Add new helper function dquot_active() to make the code more concise.
Message-Id: <[email protected]>
Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
--- fs/quota/dquot.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
fs/quota/dquot.c +14 -9
@@ -336,6 +336,11 @@ static void wait_on_dquot(struct dquot *dquot)mutex_unlock (&dquot->dq_lock); } +static inline int dquot_active (struct dquot *dquot) +{ +return test_bit (DQ_ACTIVE_B , &dquot->dq_flags); +} +static inline int dquot_dirty (struct dquot *dquot) {return test_bit (DQ_MOD_B , &dquot->dq_flags);
@@ -351,14 +356,14 @@ int dquot_mark_dquot_dirty(struct dquot *dquot) {int ret =1 ; -if (!test_bit (DQ_ACTIVE_B , &dquot->dq_flags)) +if (!dquot_active (dquot))return 0 ;if (sb_dqopt (dquot->dq_sb)->flags &DQUOT_NOLIST_DIRTY )return test_and_set_bit (DQ_MOD_B , &dquot->dq_flags);/* If quota is dirty already, we don't have to acquire dq_list_lock */ -if (test_bit (DQ_MOD_B , &dquot->dq_flags)) +if (dquot_dirty (dquot))return 1 ;spin_lock (&dq_list_lock);
@@ -437,7 +442,7 @@ int dquot_acquire(struct dquot *dquot)smp_mb__before_atomic ();set_bit (DQ_READ_B , &dquot->dq_flags);/* Instantiate dquot if needed */ -if (!test_bit (DQ_ACTIVE_B , &dquot->dq_flags) && !dquot->dq_off) { +if (!dquot_active (dquot) && !dquot->dq_off) { ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk (dquot);/* Write the info if needed */ if (info_dirty (&dqopt->info[dquot->dq_id.type])) {
@@ -476,7 +481,7 @@ int dquot_commit(struct dquot *dquot) goto out_lock;/* Inactive dquot can be only if there was error during read/init * => we have better not writing it */ -if (test_bit (DQ_ACTIVE_B , &dquot->dq_flags)) +if (dquot_active (dquot)) ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk (dquot);else ret = -EIO ;
@@ -587,7 +592,7 @@ int dquot_scan_active(struct super_block *sb,spin_lock (&dq_list_lock);list_for_each_entry (dquot, &inuse_list, dq_inuse) { -if (!test_bit (DQ_ACTIVE_B , &dquot->dq_flags)) +if (!dquot_active (dquot))continue ;if (dquot->dq_sb != sb)continue ;
@@ -602,7 +607,7 @@ int dquot_scan_active(struct super_block *sb,* outstanding call and recheck the DQ_ACTIVE_B after that. */ wait_on_dquot (dquot); -if (test_bit (DQ_ACTIVE_B , &dquot->dq_flags)) { +if (dquot_active (dquot)) { ret =fn (dquot, priv);if (ret <0 ) goto out;
@@ -653,7 +658,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type) dquot = list_first_entry(&dirty, struct dquot, dq_dirty); -WARN_ON (!test_bit (DQ_ACTIVE_B , &dquot->dq_flags)); +WARN_ON (!dquot_active (dquot));/* Now we have active dquot from which someone is * holding reference so we can safely just increase
@@ -790,7 +795,7 @@ void dqput(struct dquot *dquot)dquot_write_dquot (dquot); goto we_slept; } -if (test_bit (DQ_ACTIVE_B , &dquot->dq_flags)) { +if (dquot_active (dquot)) {spin_unlock (&dq_list_lock); dquot->dq_sb->dq_op->release_dquot (dquot); goto we_slept;
@@ -891,7 +896,7 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid)* already finished or it will be canceled due to dq_count > 1 test */ wait_on_dquot (dquot);/* Read the dquot / allocate space in quota file */ -if (!test_bit (DQ_ACTIVE_B , &dquot->dq_flags)) { +if (!dquot_active (dquot)) {int err; err = sb->dq_op->acquire_dquot (dquot);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 77/273 quota: fix dqput() to follow the guarantees dquot_srcu should provide
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit dabc8b20756601b9e1cc85a81d47d3f98ed4d13a ]
The dquot_mark_dquot_dirty() using dquot references from the inode should be protected by dquot_srcu. quota_off code takes care to call synchronize_srcu(&dquot_srcu) to not drop dquot references while they are used by other users. But dquot_transfer() breaks this assumption. We call dquot_transfer() to drop the last reference of dquot and add it to free_dquots, but there may still be other users using the dquot at this time, as shown in the function graph below:
cpu1 cpu2
_________________|_________________wb_do_writeback CHOWN(1)
...
ext4_da_update_reserve_space
dquot_claim_block
...
dquot_mark_dquot_dirty // try to dirty old quota
test_bit(DQ_ACTIVE_B, &dquot->dq_flags) // still ACTIVE
if (test_bit(DQ_MOD_B, &dquot->dq_flags))
// test no dirty, wait dq_list_lock
...
dquot_transfer
__dquot_transfer
dqput_all(transfer_from) // rls old dquot
dqput // last dqput
dquot_release
clear_bit(DQ_ACTIVE_B, &dquot->dq_flags)
atomic_dec(&dquot->dq_count)
put_dquot_last(dquot)
list_add_tail(&dquot->dq_free, &free_dquots)
// add the dquot to free_dquots
if (!test_and_set_bit(DQ_MOD_B, &dquot->dq_flags))
add dqi_dirty_list // add released dquot to dirty_listThis can cause various issues, such as dquot being destroyed by dqcache_shrink_scan() after being added to free_dquots, which can trigger a UAF in dquot_mark_dquot_dirty(); or after dquot is added to free_dquots and then to dirty_list, it is added to free_dquots again after dquot_writeback_dquots() is executed, which causes the free_dquots list to be corrupted and triggers a UAF when dqcache_shrink_scan() is called for freeing dquot twice.
As Honza said, we need to fix dquot_transfer() to follow the guarantees dquot_srcu should provide. But calling synchronize_srcu() directly from dquot_transfer() is too expensive (and mostly unnecessary). So we add dquot whose last reference should be dropped to the new global dquot list releasing_dquots, and then queue work item which would call synchronize_srcu() and after that perform the final cleanup of all the dquots on releasing_dquots.
Message-Id: <[email protected]>
--- fs/quota/dquot.c | 96 +++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 78 insertions(+), 18 deletions(-)
fs/quota/dquot.c +78 -18
@@ -223,13 +223,22 @@ static void put_quota_format(struct quota_format_type *fmt)/* * Dquot List Management: -* The quota code uses four lists for dquot management: the inuse_list, -* free_dquots, dqi_dirty_list, and dquot_hash[] array. A single dquot -* structure may be on some of those lists, depending on its current state. +* The quota code uses five lists for dquot management: the inuse_list, +* releasing_dquots, free_dquots, dqi_dirty_list, and dquot_hash[] array. +* A single dquot structure may be on some of those lists, depending on +* its current state. * * All dquots are placed to the end of inuse_list when first created, and this * list is used for invalidate operation, which must look at every dquot. * +* When the last reference of a dquot will be dropped, the dquot will be +* added to releasing_dquots. We'd then queue work item which would call +* synchronize_srcu() and after that perform the final cleanup of all the +* dquots on the list. Both releasing_dquots and free_dquots use the +* dq_free list_head in the dquot struct. When a dquot is removed from +* releasing_dquots, a reference count is always subtracted, and if +* dq_count == 0 at that point, the dquot will be added to the free_dquots. +* * Unused dquots (dq_count == 0) are added to the free_dquots list when freed, * and this list is searched whenever we need an available dquot. Dquots are * removed from the list as soon as they are used again, and
@@ -248,6 +257,7 @@ static void put_quota_format(struct quota_format_type *fmt)static LIST_HEAD (inuse_list);static LIST_HEAD (free_dquots); +static LIST_HEAD (releasing_dquots);static unsigned int dq_hash_bits, dq_hash_mask;static struct hlist_head *dquot_hash;
@@ -258,6 +268,9 @@ static qsize_t inode_get_rsv_space(struct inode *inode);static qsize_t __inode_get_rsv_space (struct inode *inode);static int __dquot_initialize (struct inode *inode,int type); +static void quota_release_workfn (struct work_struct *work); +static DECLARE_DELAYED_WORK(quota_release_work, quota_release_workfn); +static inline unsigned int hashfn (const struct super_block *sb,struct kqid qid) {
@@ -305,12 +318,18 @@ static inline void put_dquot_last(struct dquot *dquot)dqstats_inc (DQST_FREE_DQUOTS ); } +static inline void put_releasing_dquots (struct dquot *dquot) +{ +list_add_tail (&dquot->dq_free, &releasing_dquots); +} +static inline void remove_free_dquot (struct dquot *dquot) {if (list_empty (&dquot->dq_free))return ;list_del_init (&dquot->dq_free); -dqstats_dec (DQST_FREE_DQUOTS ); +if (!atomic_read (&dquot->dq_count)) +dqstats_dec (DQST_FREE_DQUOTS ); }static inline void put_inuse (struct dquot *dquot)
@@ -542,6 +561,8 @@ static void invalidate_dquots(struct super_block *sb, int type)struct dquot *dquot, *tmp; restart: +flush_delayed_work ("a_release_work); +spin_lock (&dq_list_lock);list_for_each_entry_safe (dquot, tmp, &inuse_list, dq_inuse) {if (dquot->dq_sb != sb)
@@ -550,6 +571,12 @@ static void invalidate_dquots(struct super_block *sb, int type)continue ;/* Wait for dquot users */ if (atomic_read (&dquot->dq_count)) { +/* dquot in releasing_dquots, flush and retry */ +if (!list_empty (&dquot->dq_free)) { +spin_unlock (&dq_list_lock); + goto restart; + } +atomic_inc (&dquot->dq_count);spin_unlock (&dq_list_lock);/*
@@ -760,6 +787,49 @@ static struct shrinker dqcache_shrinker = { .seeks = DEFAULT_SEEKS, }; +/* +* Safely release dquot and put reference to dquot. +*/ +static void quota_release_workfn (struct work_struct *work) +{ +struct dquot *dquot; +struct list_head rls_head; + +spin_lock (&dq_list_lock); +/* Exchange the list head to avoid livelock. */ +list_replace_init (&releasing_dquots, &rls_head); +spin_unlock (&dq_list_lock); + +restart: +synchronize_srcu (&dquot_srcu); +spin_lock (&dq_list_lock); +while (!list_empty (&rls_head)) { + dquot = list_first_entry(&rls_head, struct dquot, dq_free); +/* Dquot got used again? */ +if (atomic_read (&dquot->dq_count) >1 ) { +remove_free_dquot (dquot); +atomic_dec (&dquot->dq_count); +continue ; + } +if (dquot_dirty (dquot)) { +spin_unlock (&dq_list_lock); +/* Commit dquot before releasing */ +dquot_write_dquot (dquot); + goto restart; + } +if (dquot_active (dquot)) { +spin_unlock (&dq_list_lock); + dquot->dq_sb->dq_op->release_dquot (dquot); + goto restart; + } +/* Dquot is inactive and clean, now move it to free list */ +remove_free_dquot (dquot); +atomic_dec (&dquot->dq_count); +put_dquot_last (dquot); + } +spin_unlock (&dq_list_lock); +} +/* * Put reference to dquot */
@@ -776,7 +846,7 @@ void dqput(struct dquot *dquot) }#endif dqstats_inc (DQST_DROPS ); -we_slept: +spin_lock (&dq_list_lock);if (atomic_read (&dquot->dq_count) >1 ) {/* We have more than one user... nothing to do */
@@ -788,25 +858,15 @@ void dqput(struct dquot *dquot)spin_unlock (&dq_list_lock);return ; } +/* Need to release dquot? */ -if (dquot_dirty (dquot)) { -spin_unlock (&dq_list_lock); -/* Commit dquot before releasing */ -dquot_write_dquot (dquot); - goto we_slept; - } -if (dquot_active (dquot)) { -spin_unlock (&dq_list_lock); - dquot->dq_sb->dq_op->release_dquot (dquot); - goto we_slept; - } -atomic_dec (&dquot->dq_count);#ifdef CONFIG_QUOTA_DEBUG /* sanity check */ BUG_ON (!list_empty (&dquot->dq_free));#endif -put_dquot_last (dquot); +put_releasing_dquots (dquot);spin_unlock (&dq_list_lock); +queue_delayed_work (system_unbound_wq, "a_release_work,1 ); }EXPORT_SYMBOL (dqput);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 78/273 arm64: dts: msm8996: thermal: Add interrupt support
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Kucheria <[email protected]>
[ Upstream commit 6eb1c8ade5e8665eb97f8416eee0942c9f90b12b ]
Register upper-lower interrupts for each of the two tsens controllers.
Stable-dep-of: 36541089c473 ("arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller")
--- arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm64/boot/dts/qcom/msm8996.dtsi +4 -0
@@ -382,6 +382,8 @@ tsens0: thermal-sensor@4a9000 { reg = <0x4a9000 0x1000>, /* TM */ <0x4a8000 0x1000>; /* SROT */ #qcom,sensors = <13>; + interrupts = <GIC_SPI 458 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "uplow"; #thermal-sensor-cells = <1>; };
@@ -390,6 +392,8 @@ tsens1: thermal-sensor@4ad000 { reg = <0x4ad000 0x1000>, /* TM */ <0x4ac000 0x1000>; /* SROT */ #qcom,sensors = <8>; + interrupts = <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "uplow"; #thermal-sensor-cells = <1>; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 79/273 arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 36541089c4733355ed844c67eebd0c3936953454 ]
The interrupt line was previously not described. Take care of that.
--- arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm64/boot/dts/qcom/msm8996.dtsi +3 -0
@@ -903,6 +903,9 @@ usb2: usb@7600000 { #size-cells = <1>; ranges; + interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "hs_phy_irq"; + clocks = <&gcc GCC_PERIPH_NOC_USB20_AHB_CLK>, <&gcc GCC_USB20_MASTER_CLK>, <&gcc GCC_USB20_MOCK_UTMI_CLK>,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 80/273 drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 822130b5e8834ab30ad410cf19a582e5014b9a85 ]
On 32-bit architectures comparing a resource against a value larger than U32_MAX can cause a warning:
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:1344:18: error: result of comparison of constant 4294967296 with expression of type 'resource_size_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
res->start > 0x100000000ull)
~~~~~~~~~~ ^ ~~~~~~~~~~~~~~As gcc does not warn about this in dead code, add an IS_ENABLED() check at the start of the function. This will always return success but not actually resize the BAR on 32-bit architectures without high memory, which is exactly what we want here, as the driver can fall back to bank switching the VRAM access.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +3 -0
@@ -735,6 +735,9 @@ int amdgpu_device_resize_fb_bar(struct amdgpu_device *adev)u16 cmd;int r; +if (!IS_ENABLED (CONFIG_PHYS_ADDR_T_64BIT )) +return 0 ; +/* Bypass for VF */ if (amdgpu_sriov_vf (adev))return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 81/273 ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <[email protected]>
[ Upstream commit 74abbfe99f43eb7466d26d9e48fbeb46b8f3d804 ]
In accordance with the Generic EHCI/OHCI bindings the corresponding node name is suppose to comply with the Generic USB HCD DT schema, which requires the USB nodes to have the name acceptable by the regexp:
"^usb(@.*)?" . Make sure the "generic-ehci" and "generic-ohci"-compatible nodes are correctly named.
Stable-dep-of: 05d2c3d552b8 ("ARM: dts: BCM53573: Drop nonexistent #usb-cells")
--- arch/arm/boot/dts/bcm5301x.dtsi | 4 ++-- arch/arm/boot/dts/bcm53573.dtsi | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/bcm5301x.dtsi +2 -2
@@ -260,7 +260,7 @@ usb2: usb2@21000 { interrupt-parent = <&gic>; - ehci: ehci@21000 { + ehci: usb@21000 { #usb-cells = <0>; compatible = "generic-ehci";
@@ -282,7 +282,7 @@ ehci_port2: port@2 { }; }; - ohci: ohci@22000 { + ohci: usb@22000 { #usb-cells = <0>; compatible = "generic-ohci";
arch/arm/boot/dts/bcm53573.dtsi +2 -2
@@ -135,7 +135,7 @@ usb2: usb2@4000 { #address-cells = <1>; #size-cells = <1>; - ehci: ehci@4000 { + ehci: usb@4000 { compatible = "generic-ehci"; reg = <0x4000 0x1000>; interrupt-parent = <&gic>;
@@ -155,7 +155,7 @@ ehci_port2: port@2 { }; }; - ohci: ohci@d000 { + ohci: usb@d000 { #usb-cells = <0>; compatible = "generic-ohci";
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 82/273 ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 9fb90ae6cae7f8fe4fbf626945f32cd9da2c3892 ]
BCM53573 family SoC have Ethernet switch connected to the first Ethernet controller (accessible over MDIO).
Stable-dep-of: 05d2c3d552b8 ("ARM: dts: BCM53573: Drop nonexistent #usb-cells")
--- arch/arm/boot/dts/bcm53573.dtsi | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
arch/arm/boot/dts/bcm53573.dtsi +18 -0
@@ -180,6 +180,24 @@ ohci_port2: port@2 { gmac0: ethernet@5000 { reg = <0x5000 0x1000>; + + mdio { + #address-cells = <1>; + #size-cells = <0>; + + switch: switch@1e { + compatible = "brcm,bcm53125"; + reg = <0x1e>; + + status = "disabled"; + + /* ports are defined in board DTS */ + ports { + #address-cells = <1>; + #size-cells = <0>; + }; + }; + }; }; gmac1: ethernet@b000 {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 83/273 ARM: dts: BCM53573: Drop nonexistent #usb-cells
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 05d2c3d552b8c92fc397377d9d1112fc58e2cd59 ]
Such property simply doesn't exist (is not documented or used anywhere).
This fixes:arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: usb@d000: Unevaluated properties are not allowed ('#usb-cells' was unexpected)
From schema: Documentation/devicetree/bindings/usb/generic-ohci.yaml
--- arch/arm/boot/dts/bcm53573.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm/boot/dts/bcm53573.dtsi +0 -2
@@ -156,8 +156,6 @@ ehci_port2: port@2 { }; ohci: usb@d000 { - #usb-cells = <0>; - compatible = "generic-ohci"; reg = <0xd000 0x1000>; interrupt-parent = <&gic>;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 84/273 ARM: dts: BCM53573: Add cells sizes to PCIe node
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 3392ef368d9b04622fe758b1079b512664b6110a ]
This fixes:arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: pcie@2000: '#address-cells' is a required property
From schema: /lib/python3.10/site-packages/dtschema/schemas/pci/pci-bus.yamlarch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: pcie@2000: '#size-cells' is a required property
From schema: /lib/python3.10/site-packages/dtschema/schemas/pci/pci-bus.yaml
Two properties that need to be added later are "device_type" and "ranges". Adding "device_type" on its own causes a new warning and the value of "ranges" needs to be determined yet.
--- arch/arm/boot/dts/bcm53573.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/bcm53573.dtsi +3 -0
@@ -127,6 +127,9 @@ uart0: serial@300 { pcie0: pcie@2000 { reg = <0x00002000 0x1000>; + + #address-cells = <3>; + #size-cells = <2>; }; usb2: usb2@4000 {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 85/273 ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 2c0fd6b3d0778ceab40205315ccef74568490f17 ]
Switch away from deprecated properties.
This fixes:arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-sck: False schema does not allow [[3, 21, 0]]
From schema: Documentation/devicetree/bindings/spi/spi-gpio.yamlarch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-miso: False schema does not allow [[3, 22, 0]]
From schema: Documentation/devicetree/bindings/spi/spi-gpio.yamlarch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-mosi: False schema does not allow [[3, 23, 0]]
From schema: Documentation/devicetree/bindings/spi/spi-gpio.yamlarch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: 'sck-gpios' is a required property
From schema: Documentation/devicetree/bindings/spi/spi-gpio.yamlarch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: Unevaluated properties are not allowed ('gpio-miso', 'gpio-mosi', 'gpio-sck' were unexpected)
From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
--- arch/arm/boot/dts/bcm947189acdbmr.dts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/bcm947189acdbmr.dts +3 -3
@@ -61,9 +61,9 @@ wps { spi { compatible = "spi-gpio"; num-chipselects = <1>; - gpio-sck = <&chipcommon 21 0>; - gpio-miso = <&chipcommon 22 0>; - gpio-mosi = <&chipcommon 23 0>; + sck-gpios = <&chipcommon 21 0>; + miso-gpios = <&chipcommon 22 0>; + mosi-gpios = <&chipcommon 23 0>; cs-gpios = <&chipcommon 24 0>; #address-cells = <1>; #size-cells = <0>;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 86/273 ARM: dts: s3c6410: move fixed clocks under root node in Mini6410
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 8b81a8decea77bf2ca3c718732184d4aaf949096 ]
The fixed clocks are kept under dedicated 'clocks' node but this causes multiple dtschema warnings:
clocks: $nodename:0: 'clocks' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
clocks: #size-cells:0:0: 0 is not one of [1, 2]
clocks: oscillator@0:reg:0: [0] is too short
clocks: oscillator@1:reg:0: [1] is too short
clocks: 'ranges' is a required property
oscillator@0: 'reg' does not match any of the regexes: 'pinctrl-[0-9]+'
Stable-dep-of: cf0cb2af6a18 ("ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)")
--- arch/arm/boot/dts/s3c6410-mini6410.dts | 30 ++++++++++---------------- 1 file changed, 11 insertions(+), 19 deletions(-)
arch/arm/boot/dts/s3c6410-mini6410.dts +11 -19
@@ -28,26 +28,18 @@ chosen { bootargs = "console=ttySAC0,115200n8 earlyprintk rootwait root=/dev/mmcblk0p1"; }; - clocks { - compatible = "simple-bus"; - #address-cells = <1>; - #size-cells = <0>; - - fin_pll: oscillator@0 { - compatible = "fixed-clock"; - reg = <0>; - clock-frequency = <12000000>; - clock-output-names = "fin_pll"; - #clock-cells = <0>; - }; + fin_pll: oscillator-0 { + compatible = "fixed-clock"; + clock-frequency = <12000000>; + clock-output-names = "fin_pll"; + #clock-cells = <0>; + }; - xusbxti: oscillator@1 { - compatible = "fixed-clock"; - reg = <1>; - clock-output-names = "xusbxti"; - clock-frequency = <48000000>; - #clock-cells = <0>; - }; + xusbxti: oscillator-1 { + compatible = "fixed-clock"; + clock-output-names = "xusbxti"; + clock-frequency = <48000000>; + #clock-cells = <0>; }; srom-cs1@18000000 {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 87/273 ARM: dts: s3c6410: align node SROM bus node name with dtschema in Mini6410
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5911622eff5134c4bf1e16e4e1e2fd18c4f24889 ]
The SROM controller is modeled with a bus so align the device node name with dtschema to fix warning:
srom-cs1@18000000: $nodename:0: 'srom-cs1@18000000'
does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
Stable-dep-of: cf0cb2af6a18 ("ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)")
--- arch/arm/boot/dts/s3c6410-mini6410.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/s3c6410-mini6410.dts +1 -1
@@ -42,7 +42,7 @@ xusbxti: oscillator-1 { #clock-cells = <0>; }; - srom-cs1@18000000 { + srom-cs1-bus@18000000 { compatible = "simple-bus"; #address-cells = <1>; #size-cells = <1>;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 88/273 ARM: dts: s3c64xx: align pinctrl with dtschema
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 9e47ccc01284aba7fe5fbf6ee2a7abc29bf2a740 ]
Align the pin controller related nodes with dtschema. No functional change expected.
Stable-dep-of: cf0cb2af6a18 ("ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)")
--- arch/arm/boot/dts/s3c6410-mini6410.dts | 4 +- arch/arm/boot/dts/s3c64xx-pinctrl.dtsi | 210 ++++++++++++------------- 2 files changed, 107 insertions(+), 107 deletions(-)
arch/arm/boot/dts/s3c6410-mini6410.dts +2 -2
@@ -193,12 +193,12 @@ &uart3 { }; &pinctrl0 { - gpio_leds: gpio-leds { + gpio_leds: gpio-leds-pins { samsung,pins = "gpk-4", "gpk-5", "gpk-6", "gpk-7"; samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>; }; - gpio_keys: gpio-keys { + gpio_keys: gpio-keys-pins { samsung,pins = "gpn-0", "gpn-1", "gpn-2", "gpn-3", "gpn-4", "gpn-5", "gpl-11", "gpl-12"; samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
arch/arm/boot/dts/s3c64xx-pinctrl.dtsi +105 -105
754 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 89/273 ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit cf0cb2af6a18f28b84f9f1416bff50ca60d6e98a ]
The davicom,dm9000 Ethernet Controller accepts two reg addresses.
--- arch/arm/boot/dts/s3c6410-mini6410.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/s3c6410-mini6410.dts +1 -1
@@ -51,7 +51,7 @@ srom-cs1-bus@18000000 { ethernet@18000000 { compatible = "davicom,dm9000"; - reg = <0x18000000 0x2 0x18000004 0x2>; + reg = <0x18000000 0x2>, <0x18000004 0x2>; interrupt-parent = <&gpn>; interrupts = <7 IRQ_TYPE_LEVEL_HIGH>; davicom,no-eeprom;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 90/273 ARM: dts: s5pv210: add RTC 32 KHz clock in SMDKV210
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 7260b363457a22b8723d5cbc43fee67397896d07 ]
The S3C RTC requires 32768 Hz clock as input which is provided by PMIC. However the PMIC is not described in DTS at all so at least add a workaround to model its clock with a fixed-clock.
This fixes dtbs_check warnings:
rtc@e2800000: clocks: [[2, 145]] is too short
rtc@e2800000: clock-names: ['rtc'] is too short
Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)")
--- arch/arm/boot/dts/s5pv210-smdkv210.dts | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/arm/boot/dts/s5pv210-smdkv210.dts +9 -0
@@ -31,6 +31,13 @@ memory@20000000 { reg = <0x20000000 0x40000000>; }; + pmic_ap_clk: clock-0 { + /* Workaround for missing PMIC and its clock */ + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <32768>; + }; + ethernet@18000000 { compatible = "davicom,dm9000"; reg = <0xA8000000 0x2 0xA8000002 0x2>;
@@ -147,6 +154,8 @@ &uart3 { &rtc { status = "okay"; + clocks = <&clocks CLK_RTC>, <&pmic_ap_clk>; + clock-names = "rtc", "rtc_src"; }; &sdhci0 {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 91/273 ARM: dts: s5pv210: use defines for IRQ flags in SMDKV210
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit c272f1cc9492d61dac362d2064ec41ca97fcb1e2 ]
Replace hard-coded flags with defines for readability. No functional change.
Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)")
--- arch/arm/boot/dts/s5pv210-smdkv210.dts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/boot/dts/s5pv210-smdkv210.dts +2 -1
@@ -15,6 +15,7 @@ */ /dts-v1/; +#include <dt-bindings/interrupt-controller/irq.h> #include <dt-bindings/input/input.h> #include "s5pv210.dtsi"
@@ -42,7 +43,7 @@ ethernet@18000000 { compatible = "davicom,dm9000"; reg = <0xA8000000 0x2 0xA8000002 0x2>; interrupt-parent = <&gph1>; - interrupts = <1 4>; + interrupts = <1 IRQ_TYPE_LEVEL_HIGH>; local-mac-address = [00 00 de ad be ef]; davicom,no-eeprom; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 92/273 ARM: dts: s5pv210: correct ethernet unit address in SMDKV210
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 28ab4caccd17d7b84fd8aa36b13af5e735870bad ]
The SROM bank 5 is at address 0xa8000000, just like the one put in "reg" property of ethernet node. Fix the unit address of ethernet node.
Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)")
--- arch/arm/boot/dts/s5pv210-smdkv210.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/s5pv210-smdkv210.dts +1 -1
@@ -39,7 +39,7 @@ pmic_ap_clk: clock-0 { clock-frequency = <32768>; }; - ethernet@18000000 { + ethernet@a8000000 { compatible = "davicom,dm9000"; reg = <0xA8000000 0x2 0xA8000002 0x2>; interrupt-parent = <&gph1>;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 93/273 ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit b77904ba177a9c67b6dbc3637fdf1faa22df6e5c ]
Backlight is supplied by DC5V regulator. The DTS has no PMIC node, so just add a regulator-fixed to solve it and fix dtbs_check warning:
s5pv210-smdkv210.dtb: backlight: 'power-supply' is a required property
Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)")
--- arch/arm/boot/dts/s5pv210-smdkv210.dts | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm/boot/dts/s5pv210-smdkv210.dts +8 -0
@@ -55,6 +55,14 @@ backlight { default-brightness-level = <6>; pinctrl-names = "default"; pinctrl-0 = <&pwm3_out>; + power-supply = <&dc5v_reg>; + }; + + dc5v_reg: regulator-0 { + compatible = "regulator-fixed"; + regulator-name = "DC5V"; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; }; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 94/273 ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 982655cb0e7f18934d7532c32366e574ad61dbd7 ]
The davicom,dm9000 Ethernet Controller accepts two reg addresses.
--- arch/arm/boot/dts/s5pv210-smdkv210.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/s5pv210-smdkv210.dts +1 -1
@@ -41,7 +41,7 @@ pmic_ap_clk: clock-0 { ethernet@a8000000 { compatible = "davicom,dm9000"; - reg = <0xA8000000 0x2 0xA8000002 0x2>; + reg = <0xa8000000 0x2>, <0xa8000002 0x2>; interrupt-parent = <&gph1>; interrupts = <1 IRQ_TYPE_LEVEL_HIGH>; local-mac-address = [00 00 de ad be ef];
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 95/273 drm: adv7511: Fix low refresh rate register for ADV7533/5
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bogdan Togorean <[email protected]>
[ Upstream commit d281eeaa4de2636ff0c8e6ae387bb07b50e5fcbb ]
For ADV7533 and ADV7535 low refresh rate is selected using bits [3:2] of 0x4a main register.
So depending on ADV model write 0xfb or 0x4a register.
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +7 -2
@@ -756,8 +756,13 @@ static void adv7511_mode_set(struct adv7511 *adv7511,else low_refresh_rate =ADV7511_LOW_REFRESH_RATE_NONE ; -regmap_update_bits (adv7511->regmap,0xfb , -0x6 , low_refresh_rate <<1 ); +if (adv7511->type ==ADV7511 ) +regmap_update_bits (adv7511->regmap,0xfb , +0x6 , low_refresh_rate <<1 ); +else +regmap_update_bits (adv7511->regmap,0x4a , +0xc , low_refresh_rate <<2 ); +regmap_update_bits (adv7511->regmap,0x17 ,0x60 , (vsync_polarity <<6 ) | (hsync_polarity <<5 ));
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 96/273 ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit 44ad8207806973f4e4f7d870fff36cc01f494250 ]
Both Luxul's XAP devices (XAP-810 and XAP-1440) are access points that use a non-default design. They don't include switch but have a single Ethernet port and BCM54210E PHY connected to the Ethernet controller's MDIO bus.
Support for those devices regressed due to two changes:
1. Describing MDIO bus with switch
After commit 9fb90ae6cae7 ("ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch") Linux stopped probing for MDIO devices.
2. Dropping hardcoded BCM54210E delays
In commit fea7fda7f50a ("net: phy: broadcom: Fix RGMII delays configuration for BCM54210E") support for other PHY modes was added but that requires a proper "phy-mode" value in DT.
Both above changes are correct (they don't need to be reverted or anything) but they need this fix for DT data to be correct and for Linux to work properly.
--- arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 13 +++++++++++++ arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 13 +++++++++++++ 2 files changed, 26 insertions(+)
arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts +13 -0
@@ -48,3 +48,16 @@ restart { }; }; }; + +&gmac0 { + phy-mode = "rgmii"; + phy-handle = <&bcm54210e>; + + mdio { + /delete-node/ switch@1e; + + bcm54210e: ethernet-phy@0 { + reg = <0>; + }; + }; +};
arch/arm/boot/dts/bcm47189-luxul-xap-810.dts +13 -0
@@ -85,3 +85,16 @@ pcie0_chipcommon: chipcommon@0 { }; }; }; + +&gmac0 { + phy-mode = "rgmii"; + phy-handle = <&bcm54210e>; + + mdio { + /delete-node/ switch@1e; + + bcm54210e: ethernet-phy@0 { + reg = <0>; + }; + }; +};
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 97/273 drm/tegra: Remove superfluous error messages around platform_get_irq()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tan Zhongjun <[email protected]>
[ Upstream commit d12919bb5da571ec50588ef97683d37e36dc2de5 ]
The platform_get_irq() prints error message telling that interrupt is missing,hence there is no need to duplicated that message in the drivers.
Stable-dep-of: 2a1ca44b6543 ("drm/tegra: dpaux: Fix incorrect return value of platform_get_irq")
--- drivers/gpu/drm/tegra/dpaux.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/tegra/dpaux.c +1 -3
@@ -449,10 +449,8 @@ static int tegra_dpaux_probe(struct platform_device *pdev)return PTR_ERR (dpaux->regs); dpaux->irq =platform_get_irq (pdev,0 ); -if (dpaux->irq <0 ) { -dev_err (&pdev->dev,"failed to get IRQ\n" ); +if (dpaux->irq <0 )return -ENXIO ; - }if (!pdev->dev.pm_domain) { dpaux->rst =devm_reset_control_get (&pdev->dev,"dpaux" );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 98/273 drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 2a1ca44b654346cadfc538c4fb32eecd8daf3140 ]
When platform_get_irq fails, we should return dpaux->irq instead of -ENXIO.
--- drivers/gpu/drm/tegra/dpaux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/tegra/dpaux.c +1 -1
@@ -450,7 +450,7 @@ static int tegra_dpaux_probe(struct platform_device *pdev) dpaux->irq =platform_get_irq (pdev,0 );if (dpaux->irq <0 ) -return -ENXIO ; +return dpaux->irq;if (!pdev->dev.pm_domain) { dpaux->rst =devm_reset_control_get (&pdev->dev,"dpaux" );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 99/273 of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruan Jinjie <[email protected]>
[ Upstream commit d6ce4f0ea19c32f10867ed93d8386924326ab474 ]
when kmalloc() fail to allocate memory in kasprintf(), name or full_name will be NULL, strcmp() will cause null pointer dereference.
--- drivers/of/unittest.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/of/unittest.c +6 -4
@@ -52,7 +52,7 @@ static void __init of_unittest_find_node_by_name(void) np =of_find_node_by_path ("/testcase-data" ); name =kasprintf (GFP_KERNEL ,"%pOF" , np); -unittest (np && !strcmp ("/testcase-data" , name), +unittest (np && name && !strcmp ("/testcase-data" , name),"find /testcase-data failed\n" );of_node_put (np);kfree (name);
@@ -63,14 +63,14 @@ static void __init of_unittest_find_node_by_name(void) np =of_find_node_by_path ("/testcase-data/phandle-tests/consumer-a" ); name =kasprintf (GFP_KERNEL ,"%pOF" , np); -unittest (np && !strcmp ("/testcase-data/phandle-tests/consumer-a" , name), +unittest (np && name && !strcmp ("/testcase-data/phandle-tests/consumer-a" , name),"find /testcase-data/phandle-tests/consumer-a failed\n" );of_node_put (np);kfree (name); np =of_find_node_by_path ("testcase-alias" ); name =kasprintf (GFP_KERNEL ,"%pOF" , np); -unittest (np && !strcmp ("/testcase-data" , name), +unittest (np && name && !strcmp ("/testcase-data" , name),"find testcase-alias failed\n" );of_node_put (np);kfree (name);
@@ -81,7 +81,7 @@ static void __init of_unittest_find_node_by_name(void) np =of_find_node_by_path ("testcase-alias/phandle-tests/consumer-a" ); name =kasprintf (GFP_KERNEL ,"%pOF" , np); -unittest (np && !strcmp ("/testcase-data/phandle-tests/consumer-a" , name), +unittest (np && name && !strcmp ("/testcase-data/phandle-tests/consumer-a" , name),"find testcase-alias/phandle-tests/consumer-a failed\n" );of_node_put (np);kfree (name);
@@ -1138,6 +1138,8 @@ static void attach_node_and_children(struct device_node *np)const char *full_name; full_name =kasprintf (GFP_KERNEL ,"%pOF" , np); +if (!full_name) +return ;if (!strcmp (full_name,"/__local_fixups__" ) || !strcmp (full_name,"/__fixups__" )) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 100/273 drm/msm: Replace drm_framebuffer_{un/reference} with put, get functions
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit f2152d492ca4ff6d53b37edf1a137480c909f6ce ]
This patch unifies the naming of DRM functions for reference counting of struct drm_framebuffer. The resulting code is more aligned with the rest of the Linux kernel interfaces.
Stable-dep-of: fd0ad3b2365c ("drm/msm/mdp5: Don't leak some plane state")
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +2 -2
@@ -185,7 +185,7 @@ static void mdp5_plane_reset(struct drm_plane *plane)struct mdp5_plane_state *mdp5_state;if (plane->state && plane->state->fb) -drm_framebuffer_unreference (plane->state->fb); +drm_framebuffer_put (plane->state->fb);kfree (to_mdp5_plane_state (plane->state)); plane->state =NULL ;
@@ -231,7 +231,7 @@ static void mdp5_plane_destroy_state(struct drm_plane *plane,struct mdp5_plane_state *pstate =to_mdp5_plane_state (state);if (state->fb) -drm_framebuffer_unreference (state->fb); +drm_framebuffer_put (state->fb);kfree (pstate); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 101/273 drm/msm/mdp5: Dont leak some plane state
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <[email protected]>
[ Upstream commit fd0ad3b2365c1c58aa5a761c18efc4817193beb6 ]
Apparently no one noticed that mdp5 plane states leak like a sieve ever since we introduced plane_state->commit refcount a few years ago in 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too early by tracking commits, v3.")
Fix it by using the right helpers.
Patchwork: https://patchwork.freedesktop.org/patch/551236/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +1 -2
@@ -230,8 +230,7 @@ static void mdp5_plane_destroy_state(struct drm_plane *plane, {struct mdp5_plane_state *pstate =to_mdp5_plane_state (state); -if (state->fb) -drm_framebuffer_put (state->fb); +__drm_atomic_helper_plane_destroy_state (state);kfree (pstate); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 102/273 smackfs: Prevent underflow in smk_set_cipso()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 3ad49d37cf5759c3b8b68d02e3563f633d9c1aee ]
There is a upper bound to "catlen" but no lower bound to prevent negatives. I don't see that this necessarily causes a problem but we may as well be safe.
--- security/smack/smackfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/smack/smackfs.c +1 -1
@@ -923,7 +923,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, } ret =sscanf (rule,"%d" , &catlen); -if (ret !=1 || catlen >SMACK_CIPSO_MAXCATNUM ) +if (ret !=1 || catlen <0 || catlen >SMACK_CIPSO_MAXCATNUM ) goto out; if (format == SMK_FIXED24_FMT &&
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 103/273 audit: fix possible soft lockup in __audit_inode_child()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <[email protected]>
[ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ]
Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup.
For example:
1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n
2. auditctl -a exit,always -S open -k key
3. sysctl -w kernel.watchdog_thresh=5
4. mkdir /sys/kernel/debug/tracing/instances/test
There may be a soft lockup as follows:
watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] Kernel panic - not syncing: softlockup: hung tasks Call trace: dump_backtrace+0x0/0x30c show_stack+0x20/0x30 dump_stack+0x11c/0x174 panic+0x27c/0x494 watchdog_timer_fn+0x2bc/0x390 __run_hrtimer+0x148/0x4fc __hrtimer_run_queues+0x154/0x210 hrtimer_interrupt+0x2c4/0x760 arch_timer_handler_phys+0x48/0x60 handle_percpu_devid_irq+0xe0/0x340 __handle_domain_irq+0xbc/0x130 gic_handle_irq+0x78/0x460 el1_irq+0xb8/0x140 __audit_inode_child+0x240/0x7bc tracefs_create_file+0x1b8/0x2a0 trace_create_file+0x18/0x50 event_create_dir+0x204/0x30c __trace_add_new_event+0xac/0x100 event_trace_add_tracer+0xa0/0x130 trace_array_create_dir+0x60/0x140 trace_array_create+0x1e0/0x370 instance_mkdir+0x90/0xd0 tracefs_syscall_mkdir+0x68/0xa0 vfs_mkdir+0x21c/0x34c do_mkdirat+0x1b4/0x1d4 __arm64_sys_mkdirat+0x4c/0x60 el0_svc_common.constprop.0+0xa8/0x240 do_el0_svc+0x8c/0xc0 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180
Therefore, we add cond_resched() to __audit_inode_child() to fix it.
--- kernel/auditsc.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/auditsc.c +2 -0
@@ -1923,6 +1923,8 @@ void __audit_inode_child(struct inode *parent, } } +cond_resched (); +/* is there a matching child entry? */ list_for_each_entry (n, &context->names_list, list) {/* can only match entries that have a name */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 104/273 of: unittest: Fix overlay type in apply/revert check
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 6becf8f845ae1f0b1cfed395bbeccbd23654162d ]
The removal check in of_unittest_apply_revert_overlay_check() always uses the platform device overlay type, while it should use the actual overlay type, as passed as a parameter to the function.
This has no impact on any current test, as all tests calling of_unittest_apply_revert_overlay_check() use the platform device overlay type.
--- drivers/of/unittest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/of/unittest.c +1 -1
@@ -1573,7 +1573,7 @@ static int __init of_unittest_apply_revert_overlay_check(int overlay_nr, }/* unittest device must be again in before state */ -if (of_unittest_device_exists (unittest_nr,PDEV_OVERLAY ) != before) { +if (of_unittest_device_exists (unittest_nr, ovtype) != before) { unittest(0, "%s with device @\"%s\" %s\n", overlay_name_from_nr(overlay_nr), unittest_path(unittest_nr, ovtype),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 105/273 ALSA: ac97: Fix possible error value of *rac97
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 67de40c9df94037769967ba28c7d951afb45b7fb ]
Before committing 79597c8bf64c, *rac97 always be NULL if there is an error. When error happens, make sure *rac97 is NULL is safer.
For examble, in snd_vortex_mixer():
err = snd_ac97_mixer(pbus, &ac97, &vortex->codec); vortex->isquad = ((vortex->codec == NULL) ? 0 : (vortex->codec->ext_id&0x80));
If error happened but vortex->codec isn't NULL, this may cause some problems.
Move the judgement order to be clearer and better.
--- sound/pci/ac97/ac97_codec.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
sound/pci/ac97/ac97_codec.c +2 -3
@@ -2026,10 +2026,9 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, .dev_disconnect = snd_ac97_dev_disconnect, }; -if (!rac97) -return -EINVAL ; -if (snd_BUG_ON (!bus || !template)) +if (snd_BUG_ON (!bus || !template || !rac97))return -EINVAL ; + *rac97 =NULL ;if (snd_BUG_ON (template->num >=4 ))return -EINVAL ;if (bus->codec[template->num])
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 106/273 drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjie Du <[email protected]>
[ Upstream commit a995c50db887ef97f3160775aef7d772635a6f6e ]
The function clk_register_pll() may return NULL or an ERR_PTR. Don't treat an ERR_PTR as valid.
--- drivers/clk/keystone/pll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/keystone/pll.c +1 -1
@@ -213,7 +213,7 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl) } clk =clk_register_pll (NULL , node->name, parent_name, pll_data); -if (clk) { +if (!IS_ERR_OR_NULL (clk)) {of_clk_add_provider (node, of_clk_src_simple_get, clk);return ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 107/273 clk: sunxi-ng: Modify mismatched function name
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Jianhua <[email protected]>
[ Upstream commit 075d9ca5b4e17f84fd1c744a405e69ec743be7f0 ]
No functional modification involved.
drivers/clk/sunxi-ng/ccu_mmc_timing.c:54: warning: expecting prototype for sunxi_ccu_set_mmc_timing_mode(). Prototype was for sunxi_ccu_get_mmc_timing_mode() instead
--- drivers/clk/sunxi-ng/ccu_mmc_timing.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/sunxi-ng/ccu_mmc_timing.c +1 -1
@@ -50,7 +50,7 @@ int sunxi_ccu_set_mmc_timing_mode(struct clk *clk, bool new_mode)EXPORT_SYMBOL_GPL (sunxi_ccu_set_mmc_timing_mode);/** -* sunxi_ccu_set_mmc_timing_mode: Get the current MMC clock timing mode +* sunxi_ccu_get_mmc_timing_mode: Get the current MMC clock timing mode * @clk: clock to query * * Returns 0 if the clock is in old timing mode, > 0 if it is in
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 108/273 PCI: Mark NVIDIA T4 GPUs to avoid bus reset
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wu Zongyong <[email protected]>
[ Upstream commit d5af729dc2071273f14cbb94abbc60608142fd83 ]
NVIDIA T4 GPUs do not work with SBR. This problem is found when the T4 card is direct attached to a Root Port only. Avoid bus reset by marking T4 GPUs PCI_DEV_FLAGS_NO_BUS_RESET.
--- drivers/pci/quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/quirks.c +1 -1
@@ -3472,7 +3472,7 @@ static void quirk_no_bus_reset(struct pci_dev *dev)*/ static void quirk_nvidia_no_bus_reset (struct pci_dev *dev) { -if ((dev->device &0xffc0 ) ==0x2340 ) +if ((dev->device &0xffc0 ) ==0x2340 || dev->device ==0x1eb8 )quirk_no_bus_reset (dev); } DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 109/273 PCI: pciehp: Use RMW accessors for changing LNKCTL
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 5f75f96c61039151c193775d776fde42477eace1 ]
As hotplug is not the only driver touching LNKCTL, use the RMW capability accessor which handles concurrent changes correctly.
--- drivers/pci/hotplug/pciehp_hpc.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
drivers/pci/hotplug/pciehp_hpc.c +3 -9
@@ -298,17 +298,11 @@ int pciehp_check_link_status(struct controller *ctrl)static int __pciehp_link_set (struct controller *ctrl,bool enable) {struct pci_dev *pdev =ctrl_dev (ctrl); -u16 lnk_ctrl; -pcie_capability_read_word (pdev,PCI_EXP_LNKCTL , &lnk_ctrl); +pcie_capability_clear_and_set_word (pdev,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_LD , + enable ?0 :PCI_EXP_LNKCTL_LD ); -if (enable) - lnk_ctrl &= ~PCI_EXP_LNKCTL_LD ; -else - lnk_ctrl |=PCI_EXP_LNKCTL_LD ; - -pcie_capability_write_word (pdev,PCI_EXP_LNKCTL , lnk_ctrl); -ctrl_dbg (ctrl,"%s: lnk_ctrl = %x\n" , __func__, lnk_ctrl);return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 110/273 PCI/ASPM: Use RMW accessors for changing LNKCTL
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit e09060b3b6b4661278ff8e1b7b81a37d5ea86eae ]
Don't assume that the device is fully under the control of ASPM and use RMW capability accessors which do proper locking to avoid losing concurrent updates to the register values.
If configuration fails in pcie_aspm_configure_common_clock(), the function attempts to restore the old PCI_EXP_LNKCTL_CCC settings. Store only the old PCI_EXP_LNKCTL_CCC bit for the relevant devices rather than the content of the whole LNKCTL registers. It aligns better with how pcie_lnkctl_clear_and_set() expects its parameter and makes the code more obvious to understand.
--- drivers/pci/pcie/aspm.c | 30 +++++++++++++----------------- 1 file changed, 13 insertions(+), 17 deletions(-)
drivers/pci/pcie/aspm.c +13 -17
@@ -260,7 +260,7 @@ static int pcie_retrain_link(struct pcie_link_state *link)static void pcie_aspm_configure_common_clock (struct pcie_link_state *link) {int same_clock =1 ; -u16 reg16, parent_reg, child_reg[8 ]; +u16 reg16, ccc, parent_old_ccc, child_old_ccc[8 ];struct pci_dev *child, *parent = link->pdev;struct pci_bus *linkbus = parent->subordinate;/*
@@ -282,6 +282,7 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)/* Port might be already in common clock mode */ pcie_capability_read_word (parent,PCI_EXP_LNKCTL , ®16); + parent_old_ccc = reg16 &PCI_EXP_LNKCTL_CCC ;if (same_clock && (reg16 &PCI_EXP_LNKCTL_CCC )) {bool consistent = true;
@@ -298,34 +299,29 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)pci_warn (parent,"ASPM: current common clock configuration is broken, reconfiguring\n" ); } + ccc = same_clock ?PCI_EXP_LNKCTL_CCC :0 ;/* Configure downstream component, all functions */ list_for_each_entry (child, &linkbus->devices, bus_list) {pcie_capability_read_word (child,PCI_EXP_LNKCTL , ®16); - child_reg[PCI_FUNC (child->devfn)] = reg16; -if (same_clock) - reg16 |=PCI_EXP_LNKCTL_CCC ; -else - reg16 &= ~PCI_EXP_LNKCTL_CCC ; -pcie_capability_write_word (child,PCI_EXP_LNKCTL , reg16); + child_old_ccc[PCI_FUNC (child->devfn)] = reg16 &PCI_EXP_LNKCTL_CCC ; +pcie_capability_clear_and_set_word (child,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_CCC , ccc); }/* Configure upstream component */ -pcie_capability_read_word (parent,PCI_EXP_LNKCTL , ®16); - parent_reg = reg16; -if (same_clock) - reg16 |=PCI_EXP_LNKCTL_CCC ; -else - reg16 &= ~PCI_EXP_LNKCTL_CCC ; -pcie_capability_write_word (parent,PCI_EXP_LNKCTL , reg16); +pcie_capability_clear_and_set_word (parent,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_CCC , ccc);if (pcie_retrain_link (link)) {/* Training failed. Restore common clock configurations */ pci_err (parent,"ASPM: Could not configure common clock\n" );list_for_each_entry (child, &linkbus->devices, bus_list) -pcie_capability_write_word (child,PCI_EXP_LNKCTL , - child_reg[PCI_FUNC (child->devfn)]); -pcie_capability_write_word (parent,PCI_EXP_LNKCTL , parent_reg); +pcie_capability_clear_and_set_word (child,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_CCC , + child_old_ccc[PCI_FUNC (child->devfn)]); +pcie_capability_clear_and_set_word (parent,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_CCC , parent_old_ccc); } }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 111/273 PCI/ATS: Add pci_prg_resp_pasid_required() interface.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuppuswamy Sathyanarayanan <[email protected]>
[ Upstream commit e5567f5f67621877726f99be040af9fbedda37dc ]
Return the PRG Response PASID Required bit in the Page Request Status Register.
As per PCIe spec r4.0, sec 10.5.2.3, if this bit is Set, the device expects a PASID TLP Prefix on PRG Response Messages when the corresponding Page Requests had a PASID TLP Prefix. If Clear, the device does not expect PASID TLP Prefixes on any PRG Response Message, and the device behavior is undefined if the device receives a PRG Response Message with a PASID TLP Prefix. Also the device behavior is undefined if this bit is Set and the device receives a PRG Response Message with no PASID TLP Prefix when the corresponding Page Requests had a PASID TLP Prefix.
This function will be used by drivers like IOMMU, if it is required to check the status of the PRG Response PASID Required bit before enabling the PASID support of the device.
Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
--- drivers/pci/ats.c | 30 ++++++++++++++++++++++++++++++ include/linux/pci-ats.h | 5 +++++ include/uapi/linux/pci_regs.h | 1 + 3 files changed, 36 insertions(+)
drivers/pci/ats.c +30 -0
@@ -368,6 +368,36 @@ int pci_pasid_features(struct pci_dev *pdev) }EXPORT_SYMBOL_GPL (pci_pasid_features); +/** +* pci_prg_resp_pasid_required - Return PRG Response PASID Required bit +* status. +* @pdev: PCI device structure +* +* Returns 1 if PASID is required in PRG Response Message, 0 otherwise. +* +* Even though the PRG response PASID status is read from PRI Status +* Register, since this API will mainly be used by PASID users, this +* function is defined within #ifdef CONFIG_PCI_PASID instead of +* CONFIG_PCI_PRI. +*/ +int pci_prg_resp_pasid_required (struct pci_dev *pdev) +{ +u16 status; +int pos; + + pos =pci_find_ext_capability (pdev,PCI_EXT_CAP_ID_PRI ); +if (!pos) +return 0 ; + +pci_read_config_word (pdev, pos +PCI_PRI_STATUS , &status); + +if (status &PCI_PRI_STATUS_PASID ) +return 1 ; + +return 0 ; +} +EXPORT_SYMBOL_GPL (pci_prg_resp_pasid_required); +#define PASID_NUMBER_SHIFT 8#define PASID_NUMBER_MASK (0x1f << PASID_NUMBER_SHIFT)/**
include/linux/pci-ats.h +5 -0
@@ -40,6 +40,7 @@ void pci_disable_pasid(struct pci_dev *pdev);void pci_restore_pasid_state (struct pci_dev *pdev);int pci_pasid_features (struct pci_dev *pdev);int pci_max_pasids (struct pci_dev *pdev); +int pci_prg_resp_pasid_required (struct pci_dev *pdev);#else /* CONFIG_PCI_PASID */
@@ -66,6 +67,10 @@ static inline int pci_max_pasids(struct pci_dev *pdev) return -EINVAL; } +static int pci_prg_resp_pasid_required (struct pci_dev *pdev) +{ +return 0 ; +}#endif /* CONFIG_PCI_PASID */
include/uapi/linux/pci_regs.h +1 -0
@@ -885,6 +885,7 @@#define PCI_PRI_STATUS_RF 0x001/* Response Failure */ #define PCI_PRI_STATUS_UPRGI 0x002/* Unexpected PRG index */ #define PCI_PRI_STATUS_STOPPED 0x100/* PRI Stopped */ +#define PCI_PRI_STATUS_PASID 0x8000/* PRG Response PASID Required */ #define PCI_PRI_MAX_REQ 0x08/* PRI max reqs supported */ #define PCI_PRI_ALLOC_REQ 0x0c/* PRI max reqs allowed */ #define PCI_EXT_CAP_PRI_SIZEOF 16
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 112/273 PCI: Cleanup register definition width and whitespace
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit 35d0a06dad2220d62042fd1a91a216d17744e724 ]
Follow the file conventions of:
- register offsets not indented
- fields within a register indented one space
- field masks use same width as register
- register field values indented an additional space
No functional change intended.
Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
--- include/uapi/linux/pci_regs.h | 132 +++++++++++++++++----------------- 1 file changed, 65 insertions(+), 67 deletions(-)
include/uapi/linux/pci_regs.h +65 -67
@@ -1,7 +1,5 @@/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ /* -* pci_regs.h -* * PCI standard defines * Copyright 1994, Drew Eckhardt * Copyright 1997--1999 Martin Mares <[email protected]>
@@ -15,7 +13,7 @@* PCI System Design Guide * * For HyperTransport information, please consult the following manuals -* from http://www.hypertransport.org +* from http://www.hypertransport.org : * * The HyperTransport I/O Link Specification */
@@ -300,7 +298,7 @@#define PCI_SID_ESR_FIC 0x20/* First In Chassis Flag */ #define PCI_SID_CHASSIS_NR 3/* Chassis Number */ -/* Message Signalled Interrupts registers */ +/* Message Signalled Interrupt registers */ #define PCI_MSI_FLAGS 2/* Message Control */ #define PCI_MSI_FLAGS_ENABLE 0x0001/* MSI feature enabled */
@@ -318,7 +316,7 @@#define PCI_MSI_MASK_64 16/* Mask bits register for 64-bit devices */ #define PCI_MSI_PENDING_64 20/* Pending intrs for 64-bit devices */ -/* MSI-X registers */ +/* MSI-X registers (in MSI-X capability) */ #define PCI_MSIX_FLAGS 2/* Message Control */ #define PCI_MSIX_FLAGS_QSIZE 0x07FF/* Table size */ #define PCI_MSIX_FLAGS_MASKALL 0x4000/* Mask all vectors for this function */
@@ -332,13 +330,13 @@#define PCI_MSIX_FLAGS_BIRMASK PCI_MSIX_PBA_BIR/* deprecated */ #define PCI_CAP_MSIX_SIZEOF 12/* size of MSIX registers */ -/* MSI-X Table entry format */ +/* MSI-X Table entry format (in memory mapped by a BAR) */ #define PCI_MSIX_ENTRY_SIZE 16 -#define PCI_MSIX_ENTRY_LOWER_ADDR 0 -#define PCI_MSIX_ENTRY_UPPER_ADDR 4 -#define PCI_MSIX_ENTRY_DATA 8 -#define PCI_MSIX_ENTRY_VECTOR_CTRL 12 -#define PCI_MSIX_ENTRY_CTRL_MASKBIT 1 +#define PCI_MSIX_ENTRY_LOWER_ADDR 0/* Message Address */ +#define PCI_MSIX_ENTRY_UPPER_ADDR 4/* Message Upper Address */ +#define PCI_MSIX_ENTRY_DATA 8/* Message Data */ +#define PCI_MSIX_ENTRY_VECTOR_CTRL 12/* Vector Control */ +#define PCI_MSIX_ENTRY_CTRL_MASKBIT 0x00000001/* CompactPCI Hotswap Register */
@@ -464,19 +462,19 @@/* PCI Express capability registers */ #define PCI_EXP_FLAGS 2/* Capabilities register */ -#define PCI_EXP_FLAGS_VERS 0x000f/* Capability version */ -#define PCI_EXP_FLAGS_TYPE 0x00f0/* Device/Port type */ -#define PCI_EXP_TYPE_ENDPOINT 0x0/* Express Endpoint */ -#define PCI_EXP_TYPE_LEG_END 0x1/* Legacy Endpoint */ -#define PCI_EXP_TYPE_ROOT_PORT 0x4/* Root Port */ -#define PCI_EXP_TYPE_UPSTREAM 0x5/* Upstream Port */ -#define PCI_EXP_TYPE_DOWNSTREAM 0x6/* Downstream Port */ -#define PCI_EXP_TYPE_PCI_BRIDGE 0x7/* PCIe to PCI/PCI-X Bridge */ -#define PCI_EXP_TYPE_PCIE_BRIDGE 0x8/* PCI/PCI-X to PCIe Bridge */ -#define PCI_EXP_TYPE_RC_END 0x9/* Root Complex Integrated Endpoint */ -#define PCI_EXP_TYPE_RC_EC 0xa/* Root Complex Event Collector */ -#define PCI_EXP_FLAGS_SLOT 0x0100/* Slot implemented */ -#define PCI_EXP_FLAGS_IRQ 0x3e00/* Interrupt message number */ +#define PCI_EXP_FLAGS_VERS 0x000f/* Capability version */ +#define PCI_EXP_FLAGS_TYPE 0x00f0/* Device/Port type */ +#define PCI_EXP_TYPE_ENDPOINT 0x0/* Express Endpoint */ +#define PCI_EXP_TYPE_LEG_END 0x1/* Legacy Endpoint */ +#define PCI_EXP_TYPE_ROOT_PORT 0x4/* Root Port */ +#define PCI_EXP_TYPE_UPSTREAM 0x5/* Upstream Port */ +#define PCI_EXP_TYPE_DOWNSTREAM 0x6/* Downstream Port */ +#define PCI_EXP_TYPE_PCI_BRIDGE 0x7/* PCIe to PCI/PCI-X Bridge */ +#define PCI_EXP_TYPE_PCIE_BRIDGE 0x8/* PCI/PCI-X to PCIe Bridge */ +#define PCI_EXP_TYPE_RC_END 0x9/* Root Complex Integrated Endpoint */ +#define PCI_EXP_TYPE_RC_EC 0xa/* Root Complex Event Collector */ +#define PCI_EXP_FLAGS_SLOT 0x0100/* Slot implemented */ +#define PCI_EXP_FLAGS_IRQ 0x3e00/* Interrupt message number */ #define PCI_EXP_DEVCAP 4/* Device capabilities */ #define PCI_EXP_DEVCAP_PAYLOAD 0x00000007/* Max_Payload_Size */ #define PCI_EXP_DEVCAP_PHANTOM 0x00000018/* Phantom functions */
@@ -621,8 +619,8 @@#define PCI_EXP_RTCAP 30/* Root Capabilities */ #define PCI_EXP_RTCAP_CRSVIS 0x0001/* CRS Software Visibility capability */ #define PCI_EXP_RTSTA 32/* Root Status */ -#define PCI_EXP_RTSTA_PME 0x00010000/* PME status */ -#define PCI_EXP_RTSTA_PENDING 0x00020000/* PME pending */ +#define PCI_EXP_RTSTA_PME 0x00010000/* PME status */ +#define PCI_EXP_RTSTA_PENDING 0x00020000/* PME pending */ /* * The Device Capabilities 2, Device Status 2, Device Control 2, * Link Capabilities 2, Link Status 2, Link Control 2,
@@ -642,13 +640,13 @@#define PCI_EXP_DEVCAP2_OBFF_MASK 0x000c0000/* OBFF support mechanism */ #define PCI_EXP_DEVCAP2_OBFF_MSG 0x00040000/* New message signaling */ #define PCI_EXP_DEVCAP2_OBFF_WAKE 0x00080000/* Re-use WAKE# for OBFF */ -#define PCI_EXP_DEVCAP2_EE_PREFIX 0x00200000/* End-End TLP Prefix */ +#define PCI_EXP_DEVCAP2_EE_PREFIX 0x00200000/* End-End TLP Prefix */ #define PCI_EXP_DEVCTL2 40/* Device Control 2 */ #define PCI_EXP_DEVCTL2_COMP_TIMEOUT 0x000f/* Completion Timeout Value */ #define PCI_EXP_DEVCTL2_COMP_TMOUT_DIS 0x0010/* Completion Timeout Disable */ #define PCI_EXP_DEVCTL2_ARI 0x0020/* Alternative Routing-ID */ -#define PCI_EXP_DEVCTL2_ATOMIC_REQ 0x0040/* Set Atomic requests */ -#define PCI_EXP_DEVCTL2_ATOMIC_EGRESS_BLOCK 0x0080/* Block atomic egress */ +#define PCI_EXP_DEVCTL2_ATOMIC_REQ 0x0040/* Set Atomic requests */ +#define PCI_EXP_DEVCTL2_ATOMIC_EGRESS_BLOCK 0x0080/* Block atomic egress */ #define PCI_EXP_DEVCTL2_IDO_REQ_EN 0x0100/* Allow IDO for requests */ #define PCI_EXP_DEVCTL2_IDO_CMP_EN 0x0200/* Allow IDO for completions */ #define PCI_EXP_DEVCTL2_LTR_EN 0x0400/* Enable LTR mechanism */
@@ -664,11 +662,11 @@#define PCI_EXP_LNKCAP2_SLS_16_0GB 0x00000010/* Supported Speed 16GT/s */ #define PCI_EXP_LNKCAP2_CROSSLINK 0x00000100/* Crosslink supported */ #define PCI_EXP_LNKCTL2 48/* Link Control 2 */ -#define PCI_EXP_LNKCTL2_TLS 0x000f -#define PCI_EXP_LNKCTL2_TLS_2_5GT 0x0001/* Supported Speed 2.5GT/s */ -#define PCI_EXP_LNKCTL2_TLS_5_0GT 0x0002/* Supported Speed 5GT/s */ -#define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003/* Supported Speed 8GT/s */ -#define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004/* Supported Speed 16GT/s */ +#define PCI_EXP_LNKCTL2_TLS 0x000f +#define PCI_EXP_LNKCTL2_TLS_2_5GT 0x0001/* Supported Speed 2.5GT/s */ +#define PCI_EXP_LNKCTL2_TLS_5_0GT 0x0002/* Supported Speed 5GT/s */ +#define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003/* Supported Speed 8GT/s */ +#define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004/* Supported Speed 16GT/s */ #define PCI_EXP_LNKSTA2 50/* Link Status 2 */ #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52/* v2 endpoints with link end here */ #define PCI_EXP_SLTCAP2 52/* Slot Capabilities 2 */
@@ -757,18 +755,18 @@#define PCI_ERR_CAP_ECRC_CHKE 0x00000100/* ECRC Check Enable */ #define PCI_ERR_HEADER_LOG 28/* Header Log Register (16 bytes) */ #define PCI_ERR_ROOT_COMMAND 44/* Root Error Command */ -#define PCI_ERR_ROOT_CMD_COR_EN 0x00000001/* Correctable Err Reporting Enable */ -#define PCI_ERR_ROOT_CMD_NONFATAL_EN 0x00000002/* Non-Fatal Err Reporting Enable */ -#define PCI_ERR_ROOT_CMD_FATAL_EN 0x00000004/* Fatal Err Reporting Enable */ +#define PCI_ERR_ROOT_CMD_COR_EN 0x00000001/* Correctable Err Reporting Enable */ +#define PCI_ERR_ROOT_CMD_NONFATAL_EN 0x00000002/* Non-Fatal Err Reporting Enable */ +#define PCI_ERR_ROOT_CMD_FATAL_EN 0x00000004/* Fatal Err Reporting Enable */ #define PCI_ERR_ROOT_STATUS 48 -#define PCI_ERR_ROOT_COR_RCV 0x00000001/* ERR_COR Received */ -#define PCI_ERR_ROOT_MULTI_COR_RCV 0x00000002/* Multiple ERR_COR */ -#define PCI_ERR_ROOT_UNCOR_RCV 0x00000004/* ERR_FATAL/NONFATAL */ -#define PCI_ERR_ROOT_MULTI_UNCOR_RCV 0x00000008/* Multiple FATAL/NONFATAL */ -#define PCI_ERR_ROOT_FIRST_FATAL 0x00000010/* First UNC is Fatal */ -#define PCI_ERR_ROOT_NONFATAL_RCV 0x00000020/* Non-Fatal Received */ -#define PCI_ERR_ROOT_FATAL_RCV 0x00000040/* Fatal Received */ -#define PCI_ERR_ROOT_AER_IRQ 0xf8000000/* Advanced Error Interrupt Message Number */ +#define PCI_ERR_ROOT_COR_RCV 0x00000001/* ERR_COR Received */ +#define PCI_ERR_ROOT_MULTI_COR_RCV 0x00000002/* Multiple ERR_COR */ +#define PCI_ERR_ROOT_UNCOR_RCV 0x00000004/* ERR_FATAL/NONFATAL */ +#define PCI_ERR_ROOT_MULTI_UNCOR_RCV 0x00000008/* Multiple FATAL/NONFATAL */ +#define PCI_ERR_ROOT_FIRST_FATAL 0x00000010/* First UNC is Fatal */ +#define PCI_ERR_ROOT_NONFATAL_RCV 0x00000020/* Non-Fatal Received */ +#define PCI_ERR_ROOT_FATAL_RCV 0x00000040/* Fatal Received */ +#define PCI_ERR_ROOT_AER_IRQ 0xf8000000/* Advanced Error Interrupt Message Number */ #define PCI_ERR_ROOT_ERR_SRC 52/* Error Source Identification */ /* Virtual Channel */
@@ -879,12 +877,12 @@/* Page Request Interface */ #define PCI_PRI_CTRL 0x04/* PRI control register */ -#define PCI_PRI_CTRL_ENABLE 0x01/* Enable */ -#define PCI_PRI_CTRL_RESET 0x02/* Reset */ +#define PCI_PRI_CTRL_ENABLE 0x0001/* Enable */ +#define PCI_PRI_CTRL_RESET 0x0002/* Reset */ #define PCI_PRI_STATUS 0x06/* PRI status register */ -#define PCI_PRI_STATUS_RF 0x001/* Response Failure */ -#define PCI_PRI_STATUS_UPRGI 0x002/* Unexpected PRG index */ -#define PCI_PRI_STATUS_STOPPED 0x100/* PRI Stopped */ +#define PCI_PRI_STATUS_RF 0x0001/* Response Failure */ +#define PCI_PRI_STATUS_UPRGI 0x0002/* Unexpected PRG index */ +#define PCI_PRI_STATUS_STOPPED 0x0100/* PRI Stopped */ #define PCI_PRI_STATUS_PASID 0x8000/* PRG Response PASID Required */ #define PCI_PRI_MAX_REQ 0x08/* PRI max reqs supported */ #define PCI_PRI_ALLOC_REQ 0x0c/* PRI max reqs allowed */
@@ -902,16 +900,16 @@/* Single Root I/O Virtualization */ #define PCI_SRIOV_CAP 0x04/* SR-IOV Capabilities */ -#define PCI_SRIOV_CAP_VFM 0x01/* VF Migration Capable */ +#define PCI_SRIOV_CAP_VFM 0x00000001/* VF Migration Capable */ #define PCI_SRIOV_CAP_INTR (x) ((x) >> 21)/* Interrupt Message Number */ #define PCI_SRIOV_CTRL 0x08/* SR-IOV Control */ -#define PCI_SRIOV_CTRL_VFE 0x01/* VF Enable */ -#define PCI_SRIOV_CTRL_VFM 0x02/* VF Migration Enable */ -#define PCI_SRIOV_CTRL_INTR 0x04/* VF Migration Interrupt Enable */ -#define PCI_SRIOV_CTRL_MSE 0x08/* VF Memory Space Enable */ -#define PCI_SRIOV_CTRL_ARI 0x10/* ARI Capable Hierarchy */ +#define PCI_SRIOV_CTRL_VFE 0x0001/* VF Enable */ +#define PCI_SRIOV_CTRL_VFM 0x0002/* VF Migration Enable */ +#define PCI_SRIOV_CTRL_INTR 0x0004/* VF Migration Interrupt Enable */ +#define PCI_SRIOV_CTRL_MSE 0x0008/* VF Memory Space Enable */ +#define PCI_SRIOV_CTRL_ARI 0x0010/* ARI Capable Hierarchy */ #define PCI_SRIOV_STATUS 0x0a/* SR-IOV Status */ -#define PCI_SRIOV_STATUS_VFM 0x01/* VF Migration Status */ +#define PCI_SRIOV_STATUS_VFM 0x0001/* VF Migration Status */ #define PCI_SRIOV_INITIAL_VF 0x0c/* Initial VFs */ #define PCI_SRIOV_TOTAL_VF 0x0e/* Total VFs */ #define PCI_SRIOV_NUM_VF 0x10/* Number of VFs */
@@ -941,13 +939,13 @@/* Access Control Service */ #define PCI_ACS_CAP 0x04/* ACS Capability Register */ -#define PCI_ACS_SV 0x01/* Source Validation */ -#define PCI_ACS_TB 0x02/* Translation Blocking */ -#define PCI_ACS_RR 0x04/* P2P Request Redirect */ -#define PCI_ACS_CR 0x08/* P2P Completion Redirect */ -#define PCI_ACS_UF 0x10/* Upstream Forwarding */ -#define PCI_ACS_EC 0x20/* P2P Egress Control */ -#define PCI_ACS_DT 0x40/* Direct Translated P2P */ +#define PCI_ACS_SV 0x0001/* Source Validation */ +#define PCI_ACS_TB 0x0002/* Translation Blocking */ +#define PCI_ACS_RR 0x0004/* P2P Request Redirect */ +#define PCI_ACS_CR 0x0008/* P2P Completion Redirect */ +#define PCI_ACS_UF 0x0010/* Upstream Forwarding */ +#define PCI_ACS_EC 0x0020/* P2P Egress Control */ +#define PCI_ACS_DT 0x0040/* Direct Translated P2P */ #define PCI_ACS_EGRESS_BITS 0x05/* ACS Egress Control Vector Size */ #define PCI_ACS_CTRL 0x06/* ACS Control Register */ #define PCI_ACS_EGRESS_CTL_V 0x08/* ACS Egress Control Vector */
@@ -997,9 +995,9 @@#define PCI_EXP_DPC_CAP_DL_ACTIVE 0x1000/* ERR_COR signal on DL_Active supported */ #define PCI_EXP_DPC_CTL 6/* DPC control */ -#define PCI_EXP_DPC_CTL_EN_FATAL 0x0001/* Enable trigger on ERR_FATAL message */ -#define PCI_EXP_DPC_CTL_EN_NONFATAL 0x0002/* Enable trigger on ERR_NONFATAL message */ -#define PCI_EXP_DPC_CTL_INT_EN 0x0008/* DPC Interrupt Enable */ +#define PCI_EXP_DPC_CTL_EN_FATAL 0x0001/* Enable trigger on ERR_FATAL message */ +#define PCI_EXP_DPC_CTL_EN_NONFATAL 0x0002/* Enable trigger on ERR_NONFATAL message */ +#define PCI_EXP_DPC_CTL_INT_EN 0x0008/* DPC Interrupt Enable */ #define PCI_EXP_DPC_STATUS 8/* DPC Status */ #define PCI_EXP_DPC_STATUS_TRIGGER 0x0001/* Trigger Status */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 113/273 PCI: Decode PCIe 32 GT/s link speed
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo Pimentel <[email protected]>
[ Upstream commit de76cda215d56256ffcda7ffa538b70f9fb301a7 ]
PCIe r5.0, sec 7.5.3.18, defines a new 32.0 GT/s bit in the Supported Link Speeds Vector of Link Capabilities 2. Decode this new speed. This does not affect the speed of the link, which should be negotiated automatically by the hardware; it only adds decoding when showing the speed to the user.
Previously, reading the speed of a link operating at this speed showed "Unknown speed" instead of "32.0 GT/s".
Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
--- drivers/pci/pci-sysfs.c | 3 +++ drivers/pci/pci.c | 4 +++- drivers/pci/probe.c | 2 +- drivers/pci/slot.c | 1 + include/linux/pci.h | 1 + include/uapi/linux/pci_regs.h | 4 ++++ 6 files changed, 13 insertions(+), 2 deletions(-)
drivers/pci/pci-sysfs.c +3 -0
@@ -182,6 +182,9 @@ static ssize_t current_link_speed_show(struct device *dev,return -EINVAL ;switch (linkstat &PCI_EXP_LNKSTA_CLS ) { +case PCI_EXP_LNKSTA_CLS_32_0GB : + speed ="32 GT/s" ; +break ;case PCI_EXP_LNKSTA_CLS_16_0GB : speed ="16 GT/s" ;break ;
drivers/pci/pci.c +3 -1
@@ -5575,7 +5575,9 @@ enum pci_bus_speed pcie_get_speed_cap(struct pci_dev *dev)*/ pcie_capability_read_dword (dev,PCI_EXP_LNKCAP2 , &lnkcap2);if (lnkcap2) {/* PCIe r3.0-compliant */ -if (lnkcap2 &PCI_EXP_LNKCAP2_SLS_16_0GB ) +if (lnkcap2 &PCI_EXP_LNKCAP2_SLS_32_0GB ) +return PCIE_SPEED_32_0GT ; +else if (lnkcap2 &PCI_EXP_LNKCAP2_SLS_16_0GB )return PCIE_SPEED_16_0GT ;else if (lnkcap2 &PCI_EXP_LNKCAP2_SLS_8_0GB )return PCIE_SPEED_8_0GT ;
drivers/pci/probe.c +1 -1
@@ -667,7 +667,7 @@ const unsigned char pcie_link_speed[] = {PCIE_SPEED_5_0GT ,/* 2 */ PCIE_SPEED_8_0GT ,/* 3 */ PCIE_SPEED_16_0GT ,/* 4 */ -PCI_SPEED_UNKNOWN ,/* 5 */ +PCIE_SPEED_32_0GT ,/* 5 */ PCI_SPEED_UNKNOWN ,/* 6 */ PCI_SPEED_UNKNOWN ,/* 7 */ PCI_SPEED_UNKNOWN, /* 8 */
drivers/pci/slot.c +1 -0
@@ -75,6 +75,7 @@ static const char *pci_bus_speed_strings[] = {"5.0 GT/s PCIe" ,/* 0x15 */ "8.0 GT/s PCIe" ,/* 0x16 */ "16.0 GT/s PCIe" ,/* 0x17 */ + "32.0 GT/s PCIe", /* 0x18 */ };static ssize_t bus_speed_read (enum pci_bus_speed speed,char *buf)
include/linux/pci.h +1 -0
@@ -260,6 +260,7 @@ enum pci_bus_speed {PCIE_SPEED_5_0GT =0x15 ,PCIE_SPEED_8_0GT =0x16 ,PCIE_SPEED_16_0GT =0x17 , +PCIE_SPEED_32_0GT =0x18 , PCI_SPEED_UNKNOWN = 0xff, };
include/uapi/linux/pci_regs.h +4 -0
@@ -527,6 +527,7 @@#define PCI_EXP_LNKCAP_SLS_5_0GB 0x00000002/* LNKCAP2 SLS Vector bit 1 */ #define PCI_EXP_LNKCAP_SLS_8_0GB 0x00000003/* LNKCAP2 SLS Vector bit 2 */ #define PCI_EXP_LNKCAP_SLS_16_0GB 0x00000004/* LNKCAP2 SLS Vector bit 3 */ +#define PCI_EXP_LNKCAP_SLS_32_0GB 0x00000005/* LNKCAP2 SLS Vector bit 4 */ #define PCI_EXP_LNKCAP_MLW 0x000003f0/* Maximum Link Width */ #define PCI_EXP_LNKCAP_ASPMS 0x00000c00/* ASPM Support */ #define PCI_EXP_LNKCAP_L0SEL 0x00007000/* L0s Exit Latency */
@@ -555,6 +556,7 @@#define PCI_EXP_LNKSTA_CLS_5_0GB 0x0002/* Current Link Speed 5.0GT/s */ #define PCI_EXP_LNKSTA_CLS_8_0GB 0x0003/* Current Link Speed 8.0GT/s */ #define PCI_EXP_LNKSTA_CLS_16_0GB 0x0004/* Current Link Speed 16.0GT/s */ +#define PCI_EXP_LNKSTA_CLS_32_0GB 0x0005/* Current Link Speed 32.0GT/s */ #define PCI_EXP_LNKSTA_NLW 0x03f0/* Negotiated Link Width */ #define PCI_EXP_LNKSTA_NLW_X1 0x0010/* Current Link Width x1 */ #define PCI_EXP_LNKSTA_NLW_X2 0x0020/* Current Link Width x2 */
@@ -660,6 +662,7 @@#define PCI_EXP_LNKCAP2_SLS_5_0GB 0x00000004/* Supported Speed 5GT/s */ #define PCI_EXP_LNKCAP2_SLS_8_0GB 0x00000008/* Supported Speed 8GT/s */ #define PCI_EXP_LNKCAP2_SLS_16_0GB 0x00000010/* Supported Speed 16GT/s */ +#define PCI_EXP_LNKCAP2_SLS_32_0GB 0x00000020/* Supported Speed 32GT/s */ #define PCI_EXP_LNKCAP2_CROSSLINK 0x00000100/* Crosslink supported */ #define PCI_EXP_LNKCTL2 48/* Link Control 2 */ #define PCI_EXP_LNKCTL2_TLS 0x000f
@@ -667,6 +670,7 @@#define PCI_EXP_LNKCTL2_TLS_5_0GT 0x0002/* Supported Speed 5GT/s */ #define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003/* Supported Speed 8GT/s */ #define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004/* Supported Speed 16GT/s */ +#define PCI_EXP_LNKCTL2_TLS_32_0GT 0x0005/* Supported Speed 32GT/s */ #define PCI_EXP_LNKSTA2 50/* Link Status 2 */ #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52/* v2 endpoints with link end here */ #define PCI_EXP_SLTCAP2 52/* Slot Capabilities 2 */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 114/273 PCI: Add #defines for Enter Compliance, Transmit Margin
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit bbdb2f5ecdf1e66b2f09710134db3c2e5c43a958 ]
Add definitions for the Enter Compliance and Transmit Margin fields of the PCIe Link Control 2 register.
Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
--- include/uapi/linux/pci_regs.h | 2 ++ 1 file changed, 2 insertions(+)
include/uapi/linux/pci_regs.h +2 -0
@@ -671,6 +671,8 @@#define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003/* Supported Speed 8GT/s */ #define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004/* Supported Speed 16GT/s */ #define PCI_EXP_LNKCTL2_TLS_32_0GT 0x0005/* Supported Speed 32GT/s */ +#define PCI_EXP_LNKCTL2_ENTER_COMP 0x0010/* Enter Compliance */ +#define PCI_EXP_LNKCTL2_TX_MARGIN 0x0380/* Transmit Margin */ #define PCI_EXP_LNKSTA2 50/* Link Status 2 */ #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52/* v2 endpoints with link end here */ #define PCI_EXP_SLTCAP2 52/* Slot Capabilities 2 */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 115/273 drm/amdgpu: Correct Transmit Margin masks
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit 19d7a95a8ba66b198f759cf610cc935ce9840d5b ]
Previously we masked PCIe Link Control 2 register values with "7 << 9", which was apparently intended to be the Transmit Margin field, but instead was the high order bit of Transmit Margin, the Enter Modified Compliance bit, and the Compliance SOS bit.
Correct the mask to "7 << 7", which is the Transmit Margin field.
Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
--- drivers/gpu/drm/amd/amdgpu/cik.c | 8 ++++---- drivers/gpu/drm/amd/amdgpu/si.c | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/amdgpu/cik.c +4 -4
@@ -1491,13 +1491,13 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)/* linkctl2 */ pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<9 )); - tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<9 ))); + tmp16 &= ~((1 <<4 ) | (7 <<7 )); + tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<7 )));pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , tmp16);pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<9 )); - tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<9 ))); + tmp16 &= ~((1 <<4 ) | (7 <<7 )); + tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<7 )));pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); tmp =RREG32_PCIE (ixPCIE_LC_CNTL4);
drivers/gpu/drm/amd/amdgpu/si.c +4 -4
@@ -1662,13 +1662,13 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL , tmp16);pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<9 )); - tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<9 ))); + tmp16 &= ~((1 <<4 ) | (7 <<7 )); + tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<7 )));pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , tmp16);pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<9 )); - tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<9 ))); + tmp16 &= ~((1 <<4 ) | (7 <<7 )); + tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<7 )));pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); tmp =RREG32_PCIE_PORT (PCIE_LC_CNTL4 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 116/273 drm/amdgpu: Replace numbers with PCI_EXP_LNKCTL2 definitions
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit 35e768e296729ac96a8c33b7810b6cb1673ae961 ]
Replace hard-coded magic numbers with the descriptive PCI_EXP_LNKCTL2 definitions. No functional change intended.
Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
--- drivers/gpu/drm/amd/amdgpu/cik.c | 22 ++++++++++++++-------- drivers/gpu/drm/amd/amdgpu/si.c | 22 ++++++++++++++-------- 2 files changed, 28 insertions(+), 16 deletions(-)
drivers/gpu/drm/amd/amdgpu/cik.c +14 -8
@@ -1491,13 +1491,19 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)/* linkctl2 */ pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<7 )); - tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<7 ))); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ); + tmp16 |= (bridge_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ));pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , tmp16);pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<7 )); - tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<7 ))); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ); + tmp16 |= (gpu_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ));pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); tmp =RREG32_PCIE (ixPCIE_LC_CNTL4);
@@ -1514,13 +1520,13 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)WREG32_PCIE (ixPCIE_LC_SPEED_CNTL, speed_cntl);pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~0xf ; + tmp16 &= ~PCI_EXP_LNKCTL2_TLS ;if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3 ) - tmp16 |=3 ;/* gen3 */ + tmp16 |=PCI_EXP_LNKCTL2_TLS_8_0GT ;/* gen3 */ else if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 ) - tmp16 |=2 ;/* gen2 */ + tmp16 |=PCI_EXP_LNKCTL2_TLS_5_0GT ;/* gen2 */ else - tmp16 |=1 ;/* gen1 */ + tmp16 |=PCI_EXP_LNKCTL2_TLS_2_5GT ;/* gen1 */ pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); speed_cntl =RREG32_PCIE (ixPCIE_LC_SPEED_CNTL);
drivers/gpu/drm/amd/amdgpu/si.c +14 -8
@@ -1662,13 +1662,19 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL , tmp16);pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<7 )); - tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<7 ))); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ); + tmp16 |= (bridge_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ));pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , tmp16);pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<7 )); - tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<7 ))); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ); + tmp16 |= (gpu_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ));pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); tmp =RREG32_PCIE_PORT (PCIE_LC_CNTL4 );
@@ -1683,13 +1689,13 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)WREG32_PCIE_PORT (PCIE_LC_SPEED_CNTL , speed_cntl);pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~0xf ; + tmp16 &= ~PCI_EXP_LNKCTL2_TLS ;if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3 ) - tmp16 |=3 ; + tmp16 |=PCI_EXP_LNKCTL2_TLS_8_0GT ;/* gen3 */ else if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 ) - tmp16 |=2 ; + tmp16 |=PCI_EXP_LNKCTL2_TLS_5_0GT ;/* gen2 */ else - tmp16 |=1 ; + tmp16 |=PCI_EXP_LNKCTL2_TLS_2_5GT ;/* gen1 */ pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); speed_cntl =RREG32_PCIE_PORT (PCIE_LC_SPEED_CNTL );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 117/273 drm/amdgpu: Prefer pcie_capability_read_word()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederick Lawler <[email protected]>
[ Upstream commit 88027c89ea146e32485251f1c2dddcde43c8d04e ]
Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability") added accessors for the PCI Express Capability so that drivers didn't need to be aware of differences between v1 and v2 of the PCI Express Capability.
Replace pci_read_config_word() and pci_write_config_word() calls with pcie_capability_read_word() and pcie_capability_write_word().
Stable-dep-of: ce7d88110b9e ("drm/amdgpu: Use RMW accessors for changing LNKCTL")
--- drivers/gpu/drm/amd/amdgpu/cik.c | 71 ++++++++++++++++++++------------ drivers/gpu/drm/amd/amdgpu/si.c | 71 ++++++++++++++++++++------------ 2 files changed, 90 insertions(+), 52 deletions(-)
drivers/gpu/drm/amd/amdgpu/cik.c +45 -26
@@ -1377,7 +1377,6 @@ static int cik_set_vce_clocks(struct amdgpu_device *adev, u32 evclk, u32 ecclk)static void cik_pcie_gen3_enable (struct amdgpu_device *adev) {struct pci_dev *root = adev->pdev->bus->self; -int bridge_pos, gpu_pos;u32 speed_cntl, current_data_rate;int i;u16 tmp16;
@@ -1412,12 +1411,7 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)DRM_INFO ("enabling PCIE gen 2 link speeds, disable with amdgpu.pcie_gen2=0\n" ); } - bridge_pos =pci_pcie_cap (root); -if (!bridge_pos) -return ; - - gpu_pos =pci_pcie_cap (adev->pdev); -if (!gpu_pos) +if (!pci_is_pcie (root) || !pci_is_pcie (adev->pdev))return ;if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3 ) {
@@ -1427,14 +1421,17 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)u16 bridge_cfg2, gpu_cfg2;u32 max_lw, current_lw, tmp; -pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL , &bridge_cfg); -pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL , &gpu_cfg); +pcie_capability_read_word (root,PCI_EXP_LNKCTL , + &bridge_cfg); +pcie_capability_read_word (adev->pdev,PCI_EXP_LNKCTL , + &gpu_cfg); tmp16 = bridge_cfg |PCI_EXP_LNKCTL_HAWD ; -pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL , tmp16); +pcie_capability_write_word (root,PCI_EXP_LNKCTL , tmp16); tmp16 = gpu_cfg |PCI_EXP_LNKCTL_HAWD ; -pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL , tmp16); +pcie_capability_write_word (adev->pdev,PCI_EXP_LNKCTL , + tmp16); tmp =RREG32_PCIE (ixPCIE_LC_STATUS1); max_lw = (tmp & PCIE_LC_STATUS1__LC_DETECTED_LINK_WIDTH_MASK) >>
@@ -1458,15 +1455,23 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)for (i =0 ; i <10 ; i++) {/* check status */ -pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_DEVSTA , &tmp16); +pcie_capability_read_word (adev->pdev, +PCI_EXP_DEVSTA , + &tmp16);if (tmp16 &PCI_EXP_DEVSTA_TRPND )break ; -pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL , &bridge_cfg); -pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL , &gpu_cfg); +pcie_capability_read_word (root,PCI_EXP_LNKCTL , + &bridge_cfg); +pcie_capability_read_word (adev->pdev, +PCI_EXP_LNKCTL , + &gpu_cfg); -pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &bridge_cfg2); -pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &gpu_cfg2); +pcie_capability_read_word (root,PCI_EXP_LNKCTL2 , + &bridge_cfg2); +pcie_capability_read_word (adev->pdev, +PCI_EXP_LNKCTL2 , + &gpu_cfg2); tmp =RREG32_PCIE (ixPCIE_LC_CNTL4); tmp |=PCIE_LC_CNTL4__LC_SET_QUIESCE_MASK ;
@@ -1479,32 +1484,45 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)msleep (100 );/* linkctl */ -pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL , &tmp16); +pcie_capability_read_word (root,PCI_EXP_LNKCTL , + &tmp16); tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; tmp16 |= (bridge_cfg &PCI_EXP_LNKCTL_HAWD ); -pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL , tmp16); +pcie_capability_write_word (root,PCI_EXP_LNKCTL , + tmp16); -pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL , &tmp16); +pcie_capability_read_word (adev->pdev, +PCI_EXP_LNKCTL , + &tmp16); tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; tmp16 |= (gpu_cfg &PCI_EXP_LNKCTL_HAWD ); -pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL , tmp16); +pcie_capability_write_word (adev->pdev, +PCI_EXP_LNKCTL , + tmp16);/* linkctl2 */ -pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &tmp16); +pcie_capability_read_word (root,PCI_EXP_LNKCTL2 , + &tmp16); tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |PCI_EXP_LNKCTL2_TX_MARGIN ); tmp16 |= (bridge_cfg2 & (PCI_EXP_LNKCTL2_ENTER_COMP |PCI_EXP_LNKCTL2_TX_MARGIN )); -pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , tmp16); +pcie_capability_write_word (root, +PCI_EXP_LNKCTL2 , + tmp16); -pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); +pcie_capability_read_word (adev->pdev, +PCI_EXP_LNKCTL2 , + &tmp16); tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |PCI_EXP_LNKCTL2_TX_MARGIN ); tmp16 |= (gpu_cfg2 & (PCI_EXP_LNKCTL2_ENTER_COMP |PCI_EXP_LNKCTL2_TX_MARGIN )); -pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); +pcie_capability_write_word (adev->pdev, +PCI_EXP_LNKCTL2 , + tmp16); tmp =RREG32_PCIE (ixPCIE_LC_CNTL4); tmp &= ~PCIE_LC_CNTL4__LC_SET_QUIESCE_MASK ;
@@ -1519,15 +1537,16 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) speed_cntl &= ~PCIE_LC_SPEED_CNTL__LC_FORCE_DIS_SW_SPEED_CHANGE_MASK ;WREG32_PCIE (ixPCIE_LC_SPEED_CNTL, speed_cntl); -pci_read_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); +pcie_capability_read_word (adev->pdev,PCI_EXP_LNKCTL2 , &tmp16); tmp16 &= ~PCI_EXP_LNKCTL2_TLS ; +if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3 ) tmp16 |=PCI_EXP_LNKCTL2_TLS_8_0GT ;/* gen3 */ else if (adev->pm.pcie_gen_mask &CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 ) tmp16 |=PCI_EXP_LNKCTL2_TLS_5_0GT ;/* gen2 */ else tmp16 |=PCI_EXP_LNKCTL2_TLS_2_5GT ;/* gen1 */ -pci_write_config_word (adev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); +pcie_capability_write_word (adev->pdev,PCI_EXP_LNKCTL2 , tmp16); speed_cntl =RREG32_PCIE (ixPCIE_LC_SPEED_CNTL); speed_cntl |=PCIE_LC_SPEED_CNTL__LC_INITIATE_LINK_SPEED_CHANGE_MASK ;
drivers/gpu/drm/amd/amdgpu/si.c +45 -26
139 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 118/273 drm/amdgpu: Use RMW accessors for changing LNKCTL
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit ce7d88110b9ed5f33fe79ea6d4ed049fb0e57bce ]
Don't assume that only the driver would be accessing LNKCTL. ASPM policy changes can trigger write to LNKCTL outside of driver's control. And in the case of upstream bridge, the driver does not even own the device it's changing the registers for.
Use RMW capability accessors which do proper locking to avoid losing concurrent updates to the register value.
--- drivers/gpu/drm/amd/amdgpu/cik.c | 36 +++++++++----------------------- drivers/gpu/drm/amd/amdgpu/si.c | 36 +++++++++----------------------- 2 files changed, 20 insertions(+), 52 deletions(-)
drivers/gpu/drm/amd/amdgpu/cik.c +10 -26
@@ -1421,17 +1421,8 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)u16 bridge_cfg2, gpu_cfg2;u32 max_lw, current_lw, tmp; -pcie_capability_read_word (root,PCI_EXP_LNKCTL , - &bridge_cfg); -pcie_capability_read_word (adev->pdev,PCI_EXP_LNKCTL , - &gpu_cfg); - - tmp16 = bridge_cfg |PCI_EXP_LNKCTL_HAWD ; -pcie_capability_write_word (root,PCI_EXP_LNKCTL , tmp16); - - tmp16 = gpu_cfg |PCI_EXP_LNKCTL_HAWD ; -pcie_capability_write_word (adev->pdev,PCI_EXP_LNKCTL , - tmp16); +pcie_capability_set_word (root,PCI_EXP_LNKCTL ,PCI_EXP_LNKCTL_HAWD ); +pcie_capability_set_word (adev->pdev,PCI_EXP_LNKCTL ,PCI_EXP_LNKCTL_HAWD ); tmp =RREG32_PCIE (ixPCIE_LC_STATUS1); max_lw = (tmp & PCIE_LC_STATUS1__LC_DETECTED_LINK_WIDTH_MASK) >>
@@ -1484,21 +1475,14 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)msleep (100 );/* linkctl */ -pcie_capability_read_word (root,PCI_EXP_LNKCTL , - &tmp16); - tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; - tmp16 |= (bridge_cfg &PCI_EXP_LNKCTL_HAWD ); -pcie_capability_write_word (root,PCI_EXP_LNKCTL , - tmp16); - -pcie_capability_read_word (adev->pdev, -PCI_EXP_LNKCTL , - &tmp16); - tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; - tmp16 |= (gpu_cfg &PCI_EXP_LNKCTL_HAWD ); -pcie_capability_write_word (adev->pdev, -PCI_EXP_LNKCTL , - tmp16); +pcie_capability_clear_and_set_word (root,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_HAWD , + bridge_cfg & +PCI_EXP_LNKCTL_HAWD ); +pcie_capability_clear_and_set_word (adev->pdev,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_HAWD , + gpu_cfg & +PCI_EXP_LNKCTL_HAWD );/* linkctl2 */ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
drivers/gpu/drm/amd/amdgpu/si.c +10 -26
@@ -1601,17 +1601,8 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)u16 bridge_cfg2, gpu_cfg2;u32 max_lw, current_lw, tmp; -pcie_capability_read_word (root,PCI_EXP_LNKCTL , - &bridge_cfg); -pcie_capability_read_word (adev->pdev,PCI_EXP_LNKCTL , - &gpu_cfg); - - tmp16 = bridge_cfg |PCI_EXP_LNKCTL_HAWD ; -pcie_capability_write_word (root,PCI_EXP_LNKCTL , tmp16); - - tmp16 = gpu_cfg |PCI_EXP_LNKCTL_HAWD ; -pcie_capability_write_word (adev->pdev,PCI_EXP_LNKCTL , - tmp16); +pcie_capability_set_word (root,PCI_EXP_LNKCTL ,PCI_EXP_LNKCTL_HAWD ); +pcie_capability_set_word (adev->pdev,PCI_EXP_LNKCTL ,PCI_EXP_LNKCTL_HAWD ); tmp =RREG32_PCIE (PCIE_LC_STATUS1 ); max_lw = (tmp &LC_DETECTED_LINK_WIDTH_MASK ) >>LC_DETECTED_LINK_WIDTH_SHIFT ;
@@ -1656,21 +1647,14 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)mdelay (100 ); -pcie_capability_read_word (root,PCI_EXP_LNKCTL , - &tmp16); - tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; - tmp16 |= (bridge_cfg &PCI_EXP_LNKCTL_HAWD ); -pcie_capability_write_word (root,PCI_EXP_LNKCTL , - tmp16); - -pcie_capability_read_word (adev->pdev, -PCI_EXP_LNKCTL , - &tmp16); - tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; - tmp16 |= (gpu_cfg &PCI_EXP_LNKCTL_HAWD ); -pcie_capability_write_word (adev->pdev, -PCI_EXP_LNKCTL , - tmp16); +pcie_capability_clear_and_set_word (root,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_HAWD , + bridge_cfg & +PCI_EXP_LNKCTL_HAWD ); +pcie_capability_clear_and_set_word (adev->pdev,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_HAWD , + gpu_cfg & +PCI_EXP_LNKCTL_HAWD );pcie_capability_read_word (root,PCI_EXP_LNKCTL2 , &tmp16);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 119/273 drm/radeon: Correct Transmit Margin masks
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit 40bd4be5a652ce56068a8273b68caa38cb0d8f4b ]
Previously we masked PCIe Link Control 2 register values with "7 << 9", which was apparently intended to be the Transmit Margin field, but instead was the high order bit of Transmit Margin, the Enter Modified Compliance bit, and the Compliance SOS bit.
Correct the mask to "7 << 7", which is the Transmit Margin field.
Stable-dep-of: 7189576e8a82 ("drm/radeon: Use RMW accessors for changing LNKCTL")
--- drivers/gpu/drm/radeon/cik.c | 8 ++++---- drivers/gpu/drm/radeon/si.c | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/gpu/drm/radeon/cik.c +4 -4
@@ -9615,13 +9615,13 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)/* linkctl2 */ pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<9 )); - tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<9 ))); + tmp16 &= ~((1 <<4 ) | (7 <<7 )); + tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<7 )));pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , tmp16);pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<9 )); - tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<9 ))); + tmp16 &= ~((1 <<4 ) | (7 <<7 )); + tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<7 )));pci_write_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); tmp =RREG32_PCIE_PORT (PCIE_LC_CNTL4 );
drivers/gpu/drm/radeon/si.c +4 -4
@@ -7198,13 +7198,13 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)/* linkctl2 */ pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<9 )); - tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<9 ))); + tmp16 &= ~((1 <<4 ) | (7 <<7 )); + tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<7 )));pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , tmp16);pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<9 )); - tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<9 ))); + tmp16 &= ~((1 <<4 ) | (7 <<7 )); + tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<7 )));pci_write_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); tmp =RREG32_PCIE_PORT (PCIE_LC_CNTL4 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 120/273 drm/radeon: Replace numbers with PCI_EXP_LNKCTL2 definitions
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit ca56f99c18cafdeae6961ce9d87fc978506152ca ]
Replace hard-coded magic numbers with the descriptive PCI_EXP_LNKCTL2 definitions. No functional change intended.
Stable-dep-of: 7189576e8a82 ("drm/radeon: Use RMW accessors for changing LNKCTL")
--- drivers/gpu/drm/radeon/cik.c | 22 ++++++++++++++-------- drivers/gpu/drm/radeon/si.c | 22 ++++++++++++++-------- 2 files changed, 28 insertions(+), 16 deletions(-)
drivers/gpu/drm/radeon/cik.c +14 -8
@@ -9615,13 +9615,19 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)/* linkctl2 */ pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<7 )); - tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<7 ))); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ); + tmp16 |= (bridge_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ));pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , tmp16);pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<7 )); - tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<7 ))); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ); + tmp16 |= (gpu_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ));pci_write_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); tmp =RREG32_PCIE_PORT (PCIE_LC_CNTL4 );
@@ -9637,13 +9643,13 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)WREG32_PCIE_PORT (PCIE_LC_SPEED_CNTL , speed_cntl);pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~0xf ; + tmp16 &= ~PCI_EXP_LNKCTL2_TLS ;if (speed_cap ==PCIE_SPEED_8_0GT ) - tmp16 |=3 ;/* gen3 */ + tmp16 |=PCI_EXP_LNKCTL2_TLS_8_0GT ;/* gen3 */ else if (speed_cap ==PCIE_SPEED_5_0GT ) - tmp16 |=2 ;/* gen2 */ + tmp16 |=PCI_EXP_LNKCTL2_TLS_5_0GT ;/* gen2 */ else - tmp16 |=1 ;/* gen1 */ + tmp16 |=PCI_EXP_LNKCTL2_TLS_2_5GT ;/* gen1 */ pci_write_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); speed_cntl =RREG32_PCIE_PORT (PCIE_LC_SPEED_CNTL );
drivers/gpu/drm/radeon/si.c +14 -8
@@ -7198,13 +7198,19 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)/* linkctl2 */ pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<7 )); - tmp16 |= (bridge_cfg2 & ((1 <<4 ) | (7 <<7 ))); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ); + tmp16 |= (bridge_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ));pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , tmp16);pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~((1 <<4 ) | (7 <<7 )); - tmp16 |= (gpu_cfg2 & ((1 <<4 ) | (7 <<7 ))); + tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ); + tmp16 |= (gpu_cfg2 & + (PCI_EXP_LNKCTL2_ENTER_COMP | +PCI_EXP_LNKCTL2_TX_MARGIN ));pci_write_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); tmp =RREG32_PCIE_PORT (PCIE_LC_CNTL4 );
@@ -7220,13 +7226,13 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)WREG32_PCIE_PORT (PCIE_LC_SPEED_CNTL , speed_cntl);pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); - tmp16 &= ~0xf ; + tmp16 &= ~PCI_EXP_LNKCTL2_TLS ;if (speed_cap ==PCIE_SPEED_8_0GT ) - tmp16 |=3 ;/* gen3 */ + tmp16 |=PCI_EXP_LNKCTL2_TLS_8_0GT ;/* gen3 */ else if (speed_cap ==PCIE_SPEED_5_0GT ) - tmp16 |=2 ;/* gen2 */ + tmp16 |=PCI_EXP_LNKCTL2_TLS_5_0GT ;/* gen2 */ else - tmp16 |=1 ;/* gen1 */ + tmp16 |=PCI_EXP_LNKCTL2_TLS_2_5GT ;/* gen1 */ pci_write_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); speed_cntl =RREG32_PCIE_PORT (PCIE_LC_SPEED_CNTL );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 121/273 drm/radeon: Prefer pcie_capability_read_word()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederick Lawler <[email protected]>
[ Upstream commit 3d581b11e34a92350983e5d3ecf469b5c677e295 ]
Commit 8c0d3a02c130 ("PCI: Add accessors for PCI Express Capability") added accessors for the PCI Express Capability so that drivers didn't need to be aware of differences between v1 and v2 of the PCI Express Capability.
Replace pci_read_config_word() and pci_write_config_word() calls with pcie_capability_read_word() and pcie_capability_write_word().
Stable-dep-of: 7189576e8a82 ("drm/radeon: Use RMW accessors for changing LNKCTL")
--- drivers/gpu/drm/radeon/cik.c | 70 +++++++++++++++++++++------------- drivers/gpu/drm/radeon/si.c | 73 +++++++++++++++++++++++------------- 2 files changed, 90 insertions(+), 53 deletions(-)
drivers/gpu/drm/radeon/cik.c +44 -26
@@ -9500,7 +9500,6 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) {struct pci_dev *root = rdev->pdev->bus->self;enum pci_bus_speed speed_cap; -int bridge_pos, gpu_pos;u32 speed_cntl, current_data_rate;int i;u16 tmp16;
@@ -9542,12 +9541,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)DRM_INFO ("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n" ); } - bridge_pos =pci_pcie_cap (root); -if (!bridge_pos) -return ; - - gpu_pos =pci_pcie_cap (rdev->pdev); -if (!gpu_pos) +if (!pci_is_pcie (root) || !pci_is_pcie (rdev->pdev))return ;if (speed_cap ==PCIE_SPEED_8_0GT ) {
@@ -9557,14 +9551,17 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)u16 bridge_cfg2, gpu_cfg2;u32 max_lw, current_lw, tmp; -pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL , &bridge_cfg); -pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL , &gpu_cfg); +pcie_capability_read_word (root,PCI_EXP_LNKCTL , + &bridge_cfg); +pcie_capability_read_word (rdev->pdev,PCI_EXP_LNKCTL , + &gpu_cfg); tmp16 = bridge_cfg |PCI_EXP_LNKCTL_HAWD ; -pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL , tmp16); +pcie_capability_write_word (root,PCI_EXP_LNKCTL , tmp16); tmp16 = gpu_cfg |PCI_EXP_LNKCTL_HAWD ; -pci_write_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL , tmp16); +pcie_capability_write_word (rdev->pdev,PCI_EXP_LNKCTL , + tmp16); tmp =RREG32_PCIE_PORT (PCIE_LC_STATUS1 ); max_lw = (tmp &LC_DETECTED_LINK_WIDTH_MASK ) >>LC_DETECTED_LINK_WIDTH_SHIFT ;
@@ -9582,15 +9579,23 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)for (i =0 ; i <10 ; i++) {/* check status */ -pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_DEVSTA , &tmp16); +pcie_capability_read_word (rdev->pdev, +PCI_EXP_DEVSTA , + &tmp16);if (tmp16 &PCI_EXP_DEVSTA_TRPND )break ; -pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL , &bridge_cfg); -pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL , &gpu_cfg); +pcie_capability_read_word (root,PCI_EXP_LNKCTL , + &bridge_cfg); +pcie_capability_read_word (rdev->pdev, +PCI_EXP_LNKCTL , + &gpu_cfg); -pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &bridge_cfg2); -pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &gpu_cfg2); +pcie_capability_read_word (root,PCI_EXP_LNKCTL2 , + &bridge_cfg2); +pcie_capability_read_word (rdev->pdev, +PCI_EXP_LNKCTL2 , + &gpu_cfg2); tmp =RREG32_PCIE_PORT (PCIE_LC_CNTL4 ); tmp |=LC_SET_QUIESCE ;
@@ -9603,32 +9608,45 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)mdelay (100 );/* linkctl */ -pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL , &tmp16); +pcie_capability_read_word (root,PCI_EXP_LNKCTL , + &tmp16); tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; tmp16 |= (bridge_cfg &PCI_EXP_LNKCTL_HAWD ); -pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL , tmp16); +pcie_capability_write_word (root,PCI_EXP_LNKCTL , + tmp16); -pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL , &tmp16); +pcie_capability_read_word (rdev->pdev, +PCI_EXP_LNKCTL , + &tmp16); tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; tmp16 |= (gpu_cfg &PCI_EXP_LNKCTL_HAWD ); -pci_write_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL , tmp16); +pcie_capability_write_word (rdev->pdev, +PCI_EXP_LNKCTL , + tmp16);/* linkctl2 */ -pci_read_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , &tmp16); +pcie_capability_read_word (root,PCI_EXP_LNKCTL2 , + &tmp16); tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |PCI_EXP_LNKCTL2_TX_MARGIN ); tmp16 |= (bridge_cfg2 & (PCI_EXP_LNKCTL2_ENTER_COMP |PCI_EXP_LNKCTL2_TX_MARGIN )); -pci_write_config_word (root, bridge_pos +PCI_EXP_LNKCTL2 , tmp16); +pcie_capability_write_word (root, +PCI_EXP_LNKCTL2 , + tmp16); -pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); +pcie_capability_read_word (rdev->pdev, +PCI_EXP_LNKCTL2 , + &tmp16); tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |PCI_EXP_LNKCTL2_TX_MARGIN ); tmp16 |= (gpu_cfg2 & (PCI_EXP_LNKCTL2_ENTER_COMP |PCI_EXP_LNKCTL2_TX_MARGIN )); -pci_write_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); +pcie_capability_write_word (rdev->pdev, +PCI_EXP_LNKCTL2 , + tmp16); tmp =RREG32_PCIE_PORT (PCIE_LC_CNTL4 ); tmp &= ~LC_SET_QUIESCE ;
@@ -9642,7 +9660,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE ;WREG32_PCIE_PORT (PCIE_LC_SPEED_CNTL , speed_cntl); -pci_read_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , &tmp16); +pcie_capability_read_word (rdev->pdev,PCI_EXP_LNKCTL2 , &tmp16); tmp16 &= ~PCI_EXP_LNKCTL2_TLS ;if (speed_cap ==PCIE_SPEED_8_0GT ) tmp16 |=PCI_EXP_LNKCTL2_TLS_8_0GT ;/* gen3 */
@@ -9650,7 +9668,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev) tmp16 |=PCI_EXP_LNKCTL2_TLS_5_0GT ;/* gen2 */ else tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */ -pci_write_config_word (rdev->pdev, gpu_pos +PCI_EXP_LNKCTL2 , tmp16); +pcie_capability_write_word (rdev->pdev,PCI_EXP_LNKCTL2 , tmp16); speed_cntl =RREG32_PCIE_PORT (PCIE_LC_SPEED_CNTL ); speed_cntl |=LC_INITIATE_LINK_SPEED_CHANGE ;
drivers/gpu/drm/radeon/si.c +46 -27
147 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 122/273 drm/radeon: Use RMW accessors for changing LNKCTL
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 7189576e8a829130192b33c5b64e8a475369c776 ]
Don't assume that only the driver would be accessing LNKCTL. ASPM policy changes can trigger write to LNKCTL outside of driver's control. And in the case of upstream bridge, the driver does not even own the device it's changing the registers for.
Use RMW capability accessors which do proper locking to avoid losing concurrent updates to the register value.
--- drivers/gpu/drm/radeon/cik.c | 36 ++++++++++------------------------- drivers/gpu/drm/radeon/si.c | 37 ++++++++++-------------------------- 2 files changed, 20 insertions(+), 53 deletions(-)
drivers/gpu/drm/radeon/cik.c +10 -26
@@ -9551,17 +9551,8 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)u16 bridge_cfg2, gpu_cfg2;u32 max_lw, current_lw, tmp; -pcie_capability_read_word (root,PCI_EXP_LNKCTL , - &bridge_cfg); -pcie_capability_read_word (rdev->pdev,PCI_EXP_LNKCTL , - &gpu_cfg); - - tmp16 = bridge_cfg |PCI_EXP_LNKCTL_HAWD ; -pcie_capability_write_word (root,PCI_EXP_LNKCTL , tmp16); - - tmp16 = gpu_cfg |PCI_EXP_LNKCTL_HAWD ; -pcie_capability_write_word (rdev->pdev,PCI_EXP_LNKCTL , - tmp16); +pcie_capability_set_word (root,PCI_EXP_LNKCTL ,PCI_EXP_LNKCTL_HAWD ); +pcie_capability_set_word (rdev->pdev,PCI_EXP_LNKCTL ,PCI_EXP_LNKCTL_HAWD ); tmp =RREG32_PCIE_PORT (PCIE_LC_STATUS1 ); max_lw = (tmp &LC_DETECTED_LINK_WIDTH_MASK ) >>LC_DETECTED_LINK_WIDTH_SHIFT ;
@@ -9608,21 +9599,14 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)mdelay (100 );/* linkctl */ -pcie_capability_read_word (root,PCI_EXP_LNKCTL , - &tmp16); - tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; - tmp16 |= (bridge_cfg &PCI_EXP_LNKCTL_HAWD ); -pcie_capability_write_word (root,PCI_EXP_LNKCTL , - tmp16); - -pcie_capability_read_word (rdev->pdev, -PCI_EXP_LNKCTL , - &tmp16); - tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; - tmp16 |= (gpu_cfg &PCI_EXP_LNKCTL_HAWD ); -pcie_capability_write_word (rdev->pdev, -PCI_EXP_LNKCTL , - tmp16); +pcie_capability_clear_and_set_word (root,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_HAWD , + bridge_cfg & +PCI_EXP_LNKCTL_HAWD ); +pcie_capability_clear_and_set_word (rdev->pdev,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_HAWD , + gpu_cfg & +PCI_EXP_LNKCTL_HAWD );/* linkctl2 */ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
drivers/gpu/drm/radeon/si.c +10 -27
@@ -7134,17 +7134,8 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)u16 bridge_cfg2, gpu_cfg2;u32 max_lw, current_lw, tmp; -pcie_capability_read_word (root,PCI_EXP_LNKCTL , - &bridge_cfg); -pcie_capability_read_word (rdev->pdev,PCI_EXP_LNKCTL , - &gpu_cfg); - - tmp16 = bridge_cfg |PCI_EXP_LNKCTL_HAWD ; -pcie_capability_write_word (root,PCI_EXP_LNKCTL , tmp16); - - tmp16 = gpu_cfg |PCI_EXP_LNKCTL_HAWD ; -pcie_capability_write_word (rdev->pdev,PCI_EXP_LNKCTL , - tmp16); +pcie_capability_set_word (root,PCI_EXP_LNKCTL ,PCI_EXP_LNKCTL_HAWD ); +pcie_capability_set_word (rdev->pdev,PCI_EXP_LNKCTL ,PCI_EXP_LNKCTL_HAWD ); tmp =RREG32_PCIE (PCIE_LC_STATUS1 ); max_lw = (tmp &LC_DETECTED_LINK_WIDTH_MASK ) >>LC_DETECTED_LINK_WIDTH_SHIFT ;
@@ -7191,22 +7182,14 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)mdelay (100 );/* linkctl */ -pcie_capability_read_word (root,PCI_EXP_LNKCTL , - &tmp16); - tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; - tmp16 |= (bridge_cfg &PCI_EXP_LNKCTL_HAWD ); -pcie_capability_write_word (root, -PCI_EXP_LNKCTL , - tmp16); - -pcie_capability_read_word (rdev->pdev, -PCI_EXP_LNKCTL , - &tmp16); - tmp16 &= ~PCI_EXP_LNKCTL_HAWD ; - tmp16 |= (gpu_cfg &PCI_EXP_LNKCTL_HAWD ); -pcie_capability_write_word (rdev->pdev, -PCI_EXP_LNKCTL , - tmp16); +pcie_capability_clear_and_set_word (root,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_HAWD , + bridge_cfg & +PCI_EXP_LNKCTL_HAWD ); +pcie_capability_clear_and_set_word (rdev->pdev,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_HAWD , + gpu_cfg & +PCI_EXP_LNKCTL_HAWD );/* linkctl2 */ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 123/273 wifi: ath10k: Use RMW accessors for changing LNKCTL
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit f139492a09f15254fa261245cdbd65555cdf39e3 ]
Don't assume that only the driver would be accessing LNKCTL. ASPM policy changes can trigger write to LNKCTL outside of driver's control.
Use RMW capability accessors which does proper locking to avoid losing concurrent updates to the register value. On restore, clear the ASPMC field properly.
--- drivers/net/wireless/ath/ath10k/pci.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath10k/pci.c +5 -4
@@ -1957,8 +1957,9 @@ static int ath10k_pci_hif_start(struct ath10k *ar)ath10k_pci_irq_enable (ar);ath10k_pci_rx_post (ar); -pcie_capability_write_word (ar_pci->pdev,PCI_EXP_LNKCTL , - ar_pci->link_ctl); +pcie_capability_clear_and_set_word (ar_pci->pdev,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_ASPMC , + ar_pci->link_ctl &PCI_EXP_LNKCTL_ASPMC );return 0 ; }
@@ -2813,8 +2814,8 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar)pcie_capability_read_word (ar_pci->pdev,PCI_EXP_LNKCTL , &ar_pci->link_ctl); -pcie_capability_write_word (ar_pci->pdev,PCI_EXP_LNKCTL , - ar_pci->link_ctl & ~PCI_EXP_LNKCTL_ASPMC ); +pcie_capability_clear_word (ar_pci->pdev,PCI_EXP_LNKCTL , +PCI_EXP_LNKCTL_ASPMC );/* * Bring the target up cleanly.
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 124/273 nfs/blocklayout: Use the passed in gfp flags
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 08b45fcb2d4675f6182fe0edc0d8b1fe604051fa ]
This allocation should use the passed in GFP_ flags instead of GFP_KERNEL. One places where this matters is in filelayout_pg_init_write() which uses GFP_NOFS as the allocation flags.
--- fs/nfs/blocklayout/dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfs/blocklayout/dev.c +2 -2
@@ -422,7 +422,7 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_block_dev *d,int ret, i; d->children =kcalloc (v->concat.volumes_count, -sizeof (struct pnfs_block_dev ),GFP_KERNEL ); +sizeof (struct pnfs_block_dev ), gfp_mask);if (!d->children)return -ENOMEM ;
@@ -451,7 +451,7 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d,int ret, i; d->children =kcalloc (v->stripe.volumes_count, -sizeof (struct pnfs_block_dev ),GFP_KERNEL ); +sizeof (struct pnfs_block_dev ), gfp_mask);if (!d->children)return -ENOMEM ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 125/273 powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell Currey <[email protected]>
[ Upstream commit c37b6908f7b2bd24dcaaf14a180e28c9132b9c58 ]
fail_iommu_setup() registers the fail_iommu_bus_notifier struct to both PCI and VIO buses. struct notifier_block is a linked list node, so this causes any notifiers later registered to either bus type to also be registered to the other since they share the same node.
This causes issues in (at least) the vgaarb code, which registers a notifier for PCI buses. pci_notify() ends up being called on a vio device, converted with to_pci_dev() even though it's not a PCI device, and finally makes a bad access in vga_arbiter_add_pci_device() as discovered with KASAN:
BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device+0x60/0xe00 Read of size 4 at addr c000000264c26fdc by task swapper/0/1 Call Trace: dump_stack_lvl+0x1bc/0x2b8 (unreliable) print_report+0x3f4/0xc60 kasan_report+0x244/0x698 __asan_load4+0xe8/0x250 vga_arbiter_add_pci_device+0x60/0xe00 pci_notify+0x88/0x444 notifier_call_chain+0x104/0x320 blocking_notifier_call_chain+0xa0/0x140 device_add+0xac8/0x1d30 device_register+0x58/0x80 vio_register_device_node+0x9ac/0xce0 vio_bus_scan_register_devices+0xc4/0x13c __machine_initcall_pseries_vio_device_init+0x94/0xf0 do_one_initcall+0x12c/0xaa8 kernel_init_freeable+0xa48/0xba8 kernel_init+0x64/0x400 ret_from_kernel_thread+0x5c/0x64
Fix this by creating separate notifier_block structs for each bus type.
--- arch/powerpc/kernel/iommu.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
arch/powerpc/kernel/iommu.c +14 -3
@@ -145,17 +145,28 @@ static int fail_iommu_bus_notify(struct notifier_block *nb,return 0 ; } -static struct notifier_block fail_iommu_bus_notifier = { +/* +* PCI and VIO buses need separate notifier_block structs, since they're linked +* list nodes. Sharing a notifier_block would mean that any notifiers later +* registered for PCI buses would also get called by VIO buses and vice versa. +*/ +static struct notifier_block fail_iommu_pci_bus_notifier = { .notifier_call = fail_iommu_bus_notify }; +#ifdef CONFIG_IBMVIO +static struct notifier_block fail_iommu_vio_bus_notifier = { + .notifier_call = fail_iommu_bus_notify +}; +#endif +static int __init fail_iommu_setup (void ) {#ifdef CONFIG_PCI -bus_register_notifier (&pci_bus_type, &fail_iommu_bus_notifier); +bus_register_notifier (&pci_bus_type, &fail_iommu_pci_bus_notifier);#endif #ifdef CONFIG_IBMVIO -bus_register_notifier (&vio_bus_type, &fail_iommu_bus_notifier); +bus_register_notifier (&vio_bus_type, &fail_iommu_vio_bus_notifier);#endif return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 126/273 jfs: validate max amount of blocks before allocation.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Filippov <[email protected]>
[ Upstream commit 0225e10972fa809728b8d4c1bd2772b3ec3fdb57 ]
The lack of checking bmp->db_max_freebud in extBalloc() can lead to shift out of bounds, so this patch prevents undefined behavior, because bmp->db_max_freebud == -1 only if there is no free space.
--- fs/jfs/jfs_extent.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/jfs/jfs_extent.c +5 -0
@@ -521,6 +521,11 @@ extBalloc(struct inode *ip, s64 hint, s64 * nblocks, s64 * blkno)* blocks in the map. in that case, we'll start off with the * maximum free. */ + +/* give up if no space left */ +if (bmp->db_maxfreebud ==-1 ) +return -ENOSPC ; + max = (s64 )1 << bmp->db_maxfreebud;if (*nblocks >= max && *nblocks > nbperpage) nb = nblks = (max > nbperpage) ? max : nbperpage;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 127/273 fs: lockd: avoid possible wrong NULL parameter
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit de8d38cf44bac43e83bad28357ba84784c412752 ]
clang's static analysis warning: fs/lockd/mon.c: line 293, column 2:
Null pointer passed as 2nd argument to memory copy function.
Assuming 'hostname' is NULL and calling 'nsm_create_handle()', this will pass NULL as 2nd argument to memory copy function 'memcpy()'. So return NULL if 'hostname' is invalid.
--- fs/lockd/mon.c | 3 +++ 1 file changed, 3 insertions(+)
fs/lockd/mon.c +3 -0
@@ -275,6 +275,9 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap, {struct nsm_handle *new; +if (!hostname) +return NULL ; + new =kzalloc (sizeof (*new) + hostname_len +1 ,GFP_KERNEL );if (unlikely (new ==NULL ))return NULL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 128/273 NFSD: da_addr_body field missing in some GETDEVICEINFO replies
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
[ Upstream commit 6372e2ee629894433fe6107d7048536a3280a284 ]
The XDR specification in RFC 8881 looks like this:
struct device_addr4 {
layouttype4 da_layout_type;
opaque da_addr_body<>;
};struct GETDEVICEINFO4resok {
device_addr4 gdir_device_addr;
bitmap4 gdir_notification;
};union GETDEVICEINFO4res switch (nfsstat4 gdir_status) { case NFS4_OK:
GETDEVICEINFO4resok gdir_resok4; case NFS4ERR_TOOSMALL: count4 gdir_mincount; default: void; };
Looking at nfsd4_encode_getdeviceinfo() ....
When the client provides a zero gd_maxcount, then the Linux NFS server implementation encodes the da_layout_type field and then skips the da_addr_body field completely, proceeding directly to encode gdir_notification field.
There does not appear to be an option in the specification to skip encoding da_addr_body. Moreover, Section 18.40.3 says:
Quoted 4 lines
If the client wants to just update or turn off notifications, it MAY send a GETDEVICEINFO operation with
gdia_maxcountset to zero. In that event, if the device ID is valid, the reply'sda_addr_bodyfield of thegdir_device_addrfield will be of zero length.
Since the layout drivers are responsible for encoding the da_addr_body field, put this fix inside the ->encode_getdeviceinfo methods.
--- fs/nfsd/blocklayoutxdr.c | 9 +++++++++ fs/nfsd/flexfilelayoutxdr.c | 9 +++++++++ fs/nfsd/nfs4xdr.c | 25 +++++++++++-------------- 3 files changed, 29 insertions(+), 14 deletions(-)
fs/nfsd/blocklayoutxdr.c +9 -0
@@ -82,6 +82,15 @@ nfsd4_block_encode_getdeviceinfo(struct xdr_stream *xdr,int len =sizeof (__be32), ret, i;__be32 *p; +/* +* See paragraph 5 of RFC 8881 S18.40.3. +*/ +if (!gdp->gd_maxcount) { +if (xdr_stream_encode_u32 (xdr,0 ) !=XDR_UNIT ) +return nfserr_resource; +return nfs_ok; + } + p =xdr_reserve_space (xdr, len +sizeof (__be32));if (!p)return nfserr_resource;
fs/nfsd/flexfilelayoutxdr.c +9 -0
@@ -85,6 +85,15 @@ nfsd4_ff_encode_getdeviceinfo(struct xdr_stream *xdr,int addr_len;__be32 *p; +/* +* See paragraph 5 of RFC 8881 S18.40.3. +*/ +if (!gdp->gd_maxcount) { +if (xdr_stream_encode_u32 (xdr,0 ) !=XDR_UNIT ) +return nfserr_resource; +return nfs_ok; + } +/* len + padding for two strings */ addr_len =16 + da->netaddr.netid_len + da->netaddr.addr_len; ver_len =20 ;
fs/nfsd/nfs4xdr.c +11 -14
@@ -4126,20 +4126,17 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr, *p++ =cpu_to_be32 (gdev->gd_layout_type); -/* If maxcount is 0 then just update notifications */ -if (gdev->gd_maxcount !=0 ) { - ops = nfsd4_layout_ops[gdev->gd_layout_type]; - nfserr = ops->encode_getdeviceinfo (xdr, gdev); -if (nfserr) { -/* -* We don't bother to burden the layout drivers with -* enforcing gd_maxcount, just tell the client to -* come back with a bigger buffer if it's not enough. -*/ -if (xdr->buf->len +4 > gdev->gd_maxcount) - goto toosmall; -return nfserr; - } + ops = nfsd4_layout_ops[gdev->gd_layout_type]; + nfserr = ops->encode_getdeviceinfo (xdr, gdev); +if (nfserr) { +/* +* We don't bother to burden the layout drivers with +* enforcing gd_maxcount, just tell the client to +* come back with a bigger buffer if it's not enough. +*/ +if (xdr->buf->len +4 > gdev->gd_maxcount) + goto toosmall; +return nfserr; }if (gdev->gd_notify_types) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 129/273 media: Use of_node_name_eq for node name comparisons
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit 2fc6e404117e5b921097c929ba572a00e4421b50 ]
Convert string compares of DT node names to use of_node_name_eq helper instead. This removes direct access to the node name pointer.
Stable-dep-of: d7b13edd4cb4 ("media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()")
--- drivers/media/platform/exynos4-is/media-dev.c | 12 ++++++------ drivers/media/platform/ti-vpe/cal.c | 4 ++-- drivers/media/platform/xilinx/xilinx-tpg.c | 2 +- drivers/media/v4l2-core/v4l2-fwnode.c | 6 ++---- 4 files changed, 11 insertions(+), 13 deletions(-)
drivers/media/platform/exynos4-is/media-dev.c +6 -6
@@ -445,7 +445,7 @@ static int fimc_md_parse_port_node(struct fimc_md *fmd,*/ np =of_get_parent (rem); -if (np && !of_node_cmp (np->name,"i2c-isp" )) +if (of_node_name_eq (np,"i2c-isp" )) pd->fimc_bus_type =FIMC_BUS_TYPE_ISP_WRITEBACK ;else pd->fimc_bus_type = pd->sensor_bus_type;
@@ -492,7 +492,7 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd)for_each_available_child_of_node (parent, node) {struct device_node *port; -if (of_node_cmp (node->name,"csis" )) +if (!of_node_name_eq (node,"csis" ))continue ;/* The csis node can have only port subnode. */ port =of_get_next_child (node,NULL );
@@ -713,13 +713,13 @@ static int fimc_md_register_platform_entities(struct fimc_md *fmd,continue ;/* If driver of any entity isn't ready try all again later. */ -if (!strcmp (node->name,CSIS_OF_NODE_NAME )) +if (of_node_name_eq (node,CSIS_OF_NODE_NAME )) plat_entity =IDX_CSIS ; -else if (!strcmp (node->name,FIMC_IS_OF_NODE_NAME )) +else if (of_node_name_eq (node,FIMC_IS_OF_NODE_NAME )) plat_entity =IDX_IS_ISP ; -else if (!strcmp (node->name,FIMC_LITE_OF_NODE_NAME )) +else if (of_node_name_eq (node,FIMC_LITE_OF_NODE_NAME )) plat_entity =IDX_FLITE ; -else if (!strcmp (node->name,FIMC_OF_NODE_NAME ) && +else if (of_node_name_eq (node,FIMC_OF_NODE_NAME ) && !of_property_read_bool (node,"samsung,lcd-wb" )) plat_entity =IDX_FIMC ;
drivers/media/platform/ti-vpe/cal.c +2 -2
@@ -1618,7 +1618,7 @@ of_get_next_port(const struct device_node *parent,return NULL ; } prev = port; - }while (of_node_cmp (port->name,"port" ) !=0 ); + }while (!of_node_name_eq (port,"port" )); }return port;
@@ -1638,7 +1638,7 @@ of_get_next_endpoint(const struct device_node *parent,if (!ep)return NULL ; prev = ep; - }while (of_node_cmp (ep->name,"endpoint" ) !=0 ); + }while (!of_node_name_eq (ep,"endpoint" ));return ep; }
drivers/media/platform/xilinx/xilinx-tpg.c +1 -1
@@ -725,7 +725,7 @@ static int xtpg_parse_of(struct xtpg_device *xtpg)const struct xvip_video_format *format;struct device_node *endpoint; -if (!port->name ||of_node_cmp (port->name,"port" )) +if (!of_node_name_eq (port,"port" ))continue ; format =xvip_of_get_format (port);
drivers/media/v4l2-core/v4l2-fwnode.c +2 -4
@@ -290,8 +290,7 @@ int v4l2_fwnode_parse_link(struct fwnode_handle *__fwnode, fwnode =fwnode_get_parent (__fwnode);fwnode_property_read_u32 (fwnode, port_prop, &link->local_port); fwnode =fwnode_get_next_parent (fwnode); -if (is_of_node (fwnode) && -of_node_cmp (to_of_node (fwnode)->name,"ports" ) ==0 ) +if (is_of_node (fwnode) &&of_node_name_eq (to_of_node (fwnode),"ports" )) fwnode =fwnode_get_next_parent (fwnode); link->local_node = fwnode;
@@ -304,8 +303,7 @@ int v4l2_fwnode_parse_link(struct fwnode_handle *__fwnode, fwnode =fwnode_get_parent (fwnode);fwnode_property_read_u32 (fwnode, port_prop, &link->remote_port); fwnode =fwnode_get_next_parent (fwnode); -if (is_of_node (fwnode) && -of_node_cmp (to_of_node (fwnode)->name,"ports" ) ==0 ) +if (is_of_node (fwnode) &&of_node_name_eq (to_of_node (fwnode),"ports" )) fwnode =fwnode_get_next_parent (fwnode); link->remote_node = fwnode;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 130/273 media: v4l2-fwnode: fix v4l2_fwnode_parse_link handling
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <[email protected]>
[ Upstream commit 453b0c8304dcbc6eed2836de8fee90bf5bcc7006 ]
Currently the driver differentiate the port number property handling for ACPI and DT. This is wrong as because ACPI should use the "reg" val too [1].
[1] https://patchwork.kernel.org/patch/11421985/
Stable-dep-of: d7b13edd4cb4 ("media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()")
--- drivers/media/v4l2-core/v4l2-fwnode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/v4l2-core/v4l2-fwnode.c +1 -1
@@ -282,7 +282,7 @@ EXPORT_SYMBOL_GPL(v4l2_fwnode_endpoint_alloc_parse);int v4l2_fwnode_parse_link (struct fwnode_handle *__fwnode,struct v4l2_fwnode_link *link) { -const char *port_prop =is_of_node (__fwnode) ?"reg" :"port" ; +const char *port_prop ="reg" ;struct fwnode_handle *fwnode;memset (link,0 ,sizeof (*link));
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 131/273 media: v4l2-fwnode: simplify v4l2_fwnode_parse_link
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <[email protected]>
[ Upstream commit 507a0ba93aa1cf2837d2abc4ab0cbad3c29409d3 ]
This helper was introduced before those helpers where awailable. Convert it to cleanup the code and improbe readability.
Stable-dep-of: d7b13edd4cb4 ("media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()")
--- drivers/media/v4l2-core/v4l2-fwnode.c | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-)
drivers/media/v4l2-core/v4l2-fwnode.c +9 -16
@@ -279,33 +279,26 @@ struct v4l2_fwnode_endpoint *v4l2_fwnode_endpoint_alloc_parse( }EXPORT_SYMBOL_GPL (v4l2_fwnode_endpoint_alloc_parse); -int v4l2_fwnode_parse_link (struct fwnode_handle *__fwnode, +int v4l2_fwnode_parse_link (struct fwnode_handle *fwnode,struct v4l2_fwnode_link *link) { -const char *port_prop ="reg" ; -struct fwnode_handle *fwnode; +struct fwnode_endpoint fwep;memset (link,0 ,sizeof (*link)); - fwnode =fwnode_get_parent (__fwnode); -fwnode_property_read_u32 (fwnode, port_prop, &link->local_port); - fwnode =fwnode_get_next_parent (fwnode); -if (is_of_node (fwnode) &&of_node_name_eq (to_of_node (fwnode),"ports" )) - fwnode =fwnode_get_next_parent (fwnode); - link->local_node = fwnode; +fwnode_graph_parse_endpoint (fwnode, &fwep); + link->local_port = fwep.port; + link->local_node =fwnode_graph_get_port_parent (fwnode); - fwnode =fwnode_graph_get_remote_endpoint (__fwnode); + fwnode =fwnode_graph_get_remote_endpoint (fwnode);if (!fwnode) {fwnode_handle_put (fwnode);return -ENOLINK ; } - fwnode =fwnode_get_parent (fwnode); -fwnode_property_read_u32 (fwnode, port_prop, &link->remote_port); - fwnode =fwnode_get_next_parent (fwnode); -if (is_of_node (fwnode) &&of_node_name_eq (to_of_node (fwnode),"ports" )) - fwnode =fwnode_get_next_parent (fwnode); - link->remote_node = fwnode; +fwnode_graph_parse_endpoint (fwnode, &fwep); + link->remote_port = fwep.port; + link->remote_node =fwnode_graph_get_port_parent (fwnode);return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 132/273 media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit d7b13edd4cb4bfa335b6008ab867ac28582d3e5c ]
If fwnode_graph_get_remote_endpoint() fails, 'fwnode' is known to be NULL, so fwnode_handle_put() is a no-op.
Release the reference taken from a previous fwnode_graph_get_port_parent() call instead.
Also handle fwnode_graph_get_port_parent() failures.
In order to fix these issues, add an error handling path to the function and the needed gotos.
--- drivers/media/v4l2-core/v4l2-fwnode.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/media/v4l2-core/v4l2-fwnode.c +14 -4
@@ -289,18 +289,28 @@ int v4l2_fwnode_parse_link(struct fwnode_handle *fwnode,fwnode_graph_parse_endpoint (fwnode, &fwep); link->local_port = fwep.port; link->local_node =fwnode_graph_get_port_parent (fwnode); +if (!link->local_node) +return -ENOLINK ; fwnode =fwnode_graph_get_remote_endpoint (fwnode); -if (!fwnode) { -fwnode_handle_put (fwnode); -return -ENOLINK ; - } +if (!fwnode) + goto err_put_local_node;fwnode_graph_parse_endpoint (fwnode, &fwep); link->remote_port = fwep.port; link->remote_node =fwnode_graph_get_port_parent (fwnode); +if (!link->remote_node) + goto err_put_remote_endpoint;return 0 ; + +err_put_remote_endpoint: +fwnode_handle_put (fwnode); + +err_put_local_node: +fwnode_handle_put (link->local_node); + +return -ENOLINK ; }EXPORT_SYMBOL_GPL (v4l2_fwnode_parse_link);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 133/273 drivers: usb: smsusb: fix error handling code in smsusb_init_device
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongliang Mu <[email protected]>
[ Upstream commit b9c7141f384097fa4fa67d2f72e5731d628aef7c ]
The previous commit 4b208f8b561f ("[media] siano: register media controller earlier")moves siano_media_device_register before smscore_register_device, and adds corresponding error handling code if smscore_register_device fails. However, it misses the following error handling code of smsusb_init_device.
Fix this by moving error handling code at the end of smsusb_init_device and adding a goto statement in the following error handling parts.
--- drivers/media/usb/siano/smsusb.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
drivers/media/usb/siano/smsusb.c +11 -10
@@ -467,12 +467,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) rc =smscore_register_device (¶ms, &dev->coredev,0 , mdev);if (rc <0 ) {pr_err ("smscore_register_device(...) failed, rc %d\n" , rc); -smsusb_term_device (intf); -#ifdef CONFIG_MEDIA_CONTROLLER_DVB -media_device_unregister (mdev); -#endif -kfree (mdev); -return rc; + goto err_unregister_device; }smscore_set_board_id (dev->coredev, board_id);
@@ -489,8 +484,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) rc =smsusb_start_streaming (dev);if (rc <0 ) {pr_err ("smsusb_start_streaming(...) failed\n" ); -smsusb_term_device (intf); -return rc; + goto err_unregister_device; } dev->state =SMSUSB_ACTIVE ;
@@ -498,13 +492,20 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id) rc =smscore_start_device (dev->coredev);if (rc <0 ) {pr_err ("smscore_start_device(...) failed\n" ); -smsusb_term_device (intf); -return rc; + goto err_unregister_device; }pr_debug ("device 0x%p created\n" , dev);return rc; + +err_unregister_device: +smsusb_term_device (intf); +#ifdef CONFIG_MEDIA_CONTROLLER_DVB +media_device_unregister (mdev); +#endif +kfree (mdev); +return rc; } static int smsusb_probe(struct usb_interface *intf,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 134/273 media: dib7000p: Fix potential division by zero
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <[email protected]>
[ Upstream commit a1db7b2c5533fc67e2681eb5efc921a67bc7d5b8 ]
Variable loopdiv can be assigned 0, then it is used as a denominator, without checking it for 0.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/media/dvb-frontends/dib7000p.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/dib7000p.c +1 -1
@@ -500,7 +500,7 @@ static int dib7000p_update_pll(struct dvb_frontend *fe, struct dibx000_bandwidth prediv = reg_1856 &0x3f ; loopdiv = (reg_1856 >>6 ) &0x3f ; -if ((bw !=NULL ) && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) { +if (loopdiv && bw && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) {dprintk ("Updating pll (prediv: old = %d new = %d ; loopdiv : old = %d new = %d)\n" , prediv, bw->pll_prediv, loopdiv, bw->pll_ratio); reg_1856 &=0xf000 ; reg_1857 =dib7000p_read_word (state,1857 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 135/273 media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit ea9ef6c2e001c5dc94bee35ebd1c8a98621cf7b8 ]
'read' is freed when it is known to be NULL, but not when a read error occurs.
Revert the logic to avoid a small leak, should a m920x_read() call fail.
--- drivers/media/usb/dvb-usb/m920x.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/usb/dvb-usb/m920x.c +3 -2
@@ -280,7 +280,6 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nuchar *read =kmalloc (1 ,GFP_KERNEL );if (!read) { ret = -ENOMEM ; -kfree (read); goto unlock; }
@@ -291,8 +290,10 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nuif ((ret =m920x_read (d->udev,M9206_I2C ,0x0 ,0x20 | stop, - read,1 )) !=0 ) + read,1 )) !=0 ) { +kfree (read); goto unlock; + } msg[i].buf[j] = read[0 ]; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 136/273 media: cx24120: Add retval check for cx24120_message_send()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <[email protected]>
[ Upstream commit 96002c0ac824e1773d3f706b1f92e2a9f2988047 ]
If cx24120_message_send() returns error, we should keep local struct unchanged.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/media/dvb-frontends/cx24120.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/dvb-frontends/cx24120.c +3 -1
@@ -980,7 +980,9 @@ static void cx24120_set_clock_ratios(struct dvb_frontend *fe) cmd.arg[8 ] = (clock_ratios_table[idx].rate >>8 ) &0xff ; cmd.arg[9 ] = (clock_ratios_table[idx].rate >>0 ) &0xff ; -cx24120_message_send (state, &cmd); + ret =cx24120_message_send (state, &cmd); +if (ret !=0 ) +return ;/* Calculate ber window rates for stat work */ cx24120_calculate_ber_window (state, clock_ratios_table[idx].rate);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 137/273 media: mediatek: vcodec: Return NULL if no vdec_fb is found
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Irui Wang <[email protected]>
[ Upstream commit dfa2d6e07432270330ae191f50a0e70636a4cd2b ]
"fb_use_list" is used to store used or referenced frame buffers for vp9 stateful decoder. "NULL" should be returned when getting target frame buffer failed from "fb_use_list", not a random unexpected one.
--- drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c +3 -2
@@ -230,10 +230,11 @@ static struct vdec_fb *vp9_rm_from_fb_use_list(struct vdec_vp9_instif (fb->base_y.va == addr) {list_move_tail (&node->list, &inst->available_fb_node_list); -break ; +return fb; } } -return fb; + +return NULL ; } static void vp9_add_to_fb_free_list(struct vdec_vp9_inst *inst,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 138/273 usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit 5eda42aebb7668b4dcff025cd3ccb0d3d7c53da6 ]
The function mxs_phy_is_otg_host() will return true if OTG_ID_VALUE is 0 at USBPHY_CTRL register. However, OTG_ID_VALUE will not reflect the real state if the ID pin is float, such as Host-only or Type-C cases. The value of OTG_ID_VALUE is always 1 which means device mode.
This patch will fix the issue by judging the current mode based on last_event. The controller will update last_event in time.
--- drivers/usb/phy/phy-mxs-usb.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
drivers/usb/phy/phy-mxs-usb.c +2 -8
@@ -312,14 +312,8 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect)static bool mxs_phy_is_otg_host (struct mxs_phy *mxs_phy) { -void __iomem *base = mxs_phy->phy.io_priv; -u32 phyctrl =readl (base +HW_USBPHY_CTRL ); - -if (IS_ENABLED (CONFIG_USB_OTG ) && - !(phyctrl &BM_USBPHY_CTRL_OTG_ID_VALUE )) -return true; - -return false; +return IS_ENABLED (CONFIG_USB_OTG ) && + mxs_phy->phy.last_event ==USB_EVENT_ID ; }static void mxs_phy_disconnect_line (struct mxs_phy *mxs_phy,bool on)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 139/273 scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit ce51c817008450ef4188471db31639d42d37a5e1 ]
The functions iscsi_if_set_param() and iscsi_if_set_host_param() convert an nlattr payload to type char* and then call C string handling functions like sscanf and kstrdup:
char *data = (char*)ev + sizeof(*ev); ... sscanf(data, "%d", &value);
However, since the nlattr is provided by the user-space program and the nlmsg skb is allocated with GFP_KERNEL instead of GFP_ZERO flag (see netlink_alloc_large_skb() in netlink_sendmsg()), dirty data on the heap can lead to an OOB access for those string handling functions.
By investigating how the bug is introduced, we find it is really interesting as the old version parsing code starting from commit fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up") treated the nlattr as integer bytes instead of string and had length check in iscsi_copy_param():
if (ev->u.set_param.len != sizeof(uint32_t))
BUG();But, since the commit a54a52caad4b ("[SCSI] iscsi: fixup set/get param functions"), the code treated the nlattr as C string while forgetting to add any strlen checks(), opening the possibility of an OOB access.
Fix the potential OOB by adding the strlen() check before accessing the buf. If the data passes this check, all low-level set_param handlers can safely treat this buf as legal C string.
--- drivers/scsi/scsi_transport_iscsi.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/scsi/scsi_transport_iscsi.c +8 -0
@@ -2765,6 +2765,10 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)if (!conn || !session)return -EINVAL ; +/* data will be regarded as NULL-ended string, do length check */ +if (strlen (data) > ev->u.set_param.len) +return -EINVAL ; +switch (ev->u.set_param.param) {case ISCSI_PARAM_SESS_RECOVERY_TMO :sscanf (data,"%d" , &value);
@@ -2917,6 +2921,10 @@ iscsi_set_host_param(struct iscsi_transport *transport,return -ENODEV ; } +/* see similar check in iscsi_if_set_param() */ +if (strlen (data) > ev->u.set_host_param.len) +return -EINVAL ; + err = transport->set_host_param (shost, ev->u.set_host_param.param, data, ev->u.set_host_param.len);scsi_host_put (shost);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 140/273 scsi: be2iscsi: Add length check when parsing nlattrs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit ee0268f230f66cb472df3424f380ea668da2749a ]
beiscsi_iface_set_param() parses nlattr with nla_for_each_attr and assumes every attributes can be viewed as struct iscsi_iface_param_info.
This is not true because there is no any nla_policy to validate the attributes passed from the upper function iscsi_set_iface_params().
Add the nla_len check before accessing the nlattr data and return EINVAL if the length check fails.
--- drivers/scsi/be2iscsi/be_iscsi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/scsi/be2iscsi/be_iscsi.c +4 -0
@@ -445,6 +445,10 @@ int beiscsi_iface_set_param(struct Scsi_Host *shost, }nla_for_each_attr (attrib, data, dt_len, rm_len) { +/* ignore nla_type as it is never used */ +if (nla_len (attrib) <sizeof (*iface_param)) +return -EINVAL ; + iface_param =nla_data (attrib);if (iface_param->param_type !=ISCSI_NET_PARAM )
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 141/273 scsi: qla4xxx: Add length check when parsing nlattrs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit 47cd3770e31df942e2bb925a9a855c79ed0662eb ]
There are three places that qla4xxx parses nlattrs:
- qla4xxx_set_chap_entry()
- qla4xxx_iface_set_param()
- qla4xxx_sysfs_ddb_set_param()
and each of them directly converts the nlattr to specific pointer of structure without length checking. This could be dangerous as those attributes are not validated and a malformed nlattr (e.g., length 0) could result in an OOB read that leaks heap dirty data.
Add the nla_len check before accessing the nlattr data and return EINVAL if the length check fails.
--- drivers/scsi/qla4xxx/ql4_os.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/scsi/qla4xxx/ql4_os.c +15 -0
@@ -940,6 +940,11 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len)memset (&chap_rec,0 ,sizeof (chap_rec));nla_for_each_attr (attr, data, len, rem) { +if (nla_len (attr) <sizeof (*param_info)) { + rc = -EINVAL ; + goto exit_set_chap; + } + param_info =nla_data (attr);switch (param_info->param) {
@@ -2724,6 +2729,11 @@ qla4xxx_iface_set_param(struct Scsi_Host *shost, void *data, uint32_t len) }nla_for_each_attr (attr, data, len, rem) { +if (nla_len (attr) <sizeof (*iface_param)) { + rval = -EINVAL ; + goto exit_init_fw_cb; + } + iface_param =nla_data (attr);if (iface_param->param_type ==ISCSI_NET_PARAM ) {
@@ -8098,6 +8108,11 @@ qla4xxx_sysfs_ddb_set_param(struct iscsi_bus_flash_session *fnode_sess,memset ((void *)&chap_tbl,0 ,sizeof (chap_tbl));nla_for_each_attr (attr, data, len, rem) { +if (nla_len (attr) <sizeof (*fnode_param)) { + rc = -EINVAL ; + goto exit_set_param; + } + fnode_param =nla_data (attr);switch (fnode_param->param) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 142/273 x86/APM: drop the duplicate APM_MINOR_DEV macro
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 4ba2909638a29630a346d6c4907a3105409bee7d ]
This source file already includes <linux/miscdevice.h>, which contains the same macro. It doesn't need to be defined here again.
--- arch/x86/kernel/apm_32.c | 6 ------ 1 file changed, 6 deletions(-)
arch/x86/kernel/apm_32.c +0 -6
@@ -246,12 +246,6 @@extern int (*console_blank_hook)(int );#endif -/* -* The apm_bios device is one of the misc char devices. -* This is its minor number. -*/ -#define APM_MINOR_DEV 134 -/* * Various options can be changed at boot time as follows: * (We allow underscores for compatibility with the modules code)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 143/273 scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksandr Natalenko <[email protected]>
[ Upstream commit 7d3d20dee4f648ec44e9717d5f647d594d184433 ]
The qedf_dbg_stop_io_on_error_cmd_read() function invokes sprintf() directly on a __user pointer, which may crash the kernel.
Avoid doing that by using a small on-stack buffer for scnprintf() and then calling simple_read_from_buffer() which does a proper copy_to_user() call.
--- drivers/scsi/qedf/qedf_debugfs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/scsi/qedf/qedf_debugfs.c +3 -4
@@ -204,18 +204,17 @@ qedf_dbg_stop_io_on_error_cmd_read(struct file *filp, char __user *buffer, size_t count, loff_t *ppos) { int cnt; +char cbuf[7 ];struct qedf_dbg_ctx *qedf_dbg = (struct qedf_dbg_ctx *)filp->private_data;struct qedf_ctx *qedf =container_of (qedf_dbg, struct qedf_ctx, dbg_ctx);QEDF_INFO (qedf_dbg,QEDF_LOG_DEBUGFS ,"entered\n" ); - cnt =sprintf (buffer,"%s\n" , + cnt =scnprintf (cbuf,sizeof (cbuf),"%s\n" , qedf->stop_io_on_error ?"true" :"false" ); - cnt =min_t (int, count, cnt - *ppos); - *ppos += cnt; -return cnt; +return simple_read_from_buffer (buffer, count, ppos, cbuf, cnt); } static ssize_t
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 144/273 scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksandr Natalenko <[email protected]>
[ Upstream commit 25dbc20deab5165f847b4eb42f376f725a986ee8 ]
The qedf_dbg_fp_int_cmd_read() function invokes sprintf() directly on a __user pointer, which may crash the kernel.
Avoid doing that by vmalloc()'ating a buffer for scnprintf() and then calling simple_read_from_buffer() which does a proper copy_to_user() call.
--- drivers/scsi/qedf/qedf_dbg.h | 2 ++ drivers/scsi/qedf/qedf_debugfs.c | 21 +++++++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-)
drivers/scsi/qedf/qedf_dbg.h +2 -0
@@ -63,6 +63,8 @@ extern uint qedf_debug;#define QEDF_LOG_NOTICE 0x40000000/* Notice logs */ #define QEDF_LOG_WARN 0x80000000/* Warning logs */ +#define QEDF_DEBUGFS_LOG_LEN (2 * PAGE_SIZE) +/* Debug context structure */ struct qedf_dbg_ctx {unsigned int host_no;
drivers/scsi/qedf/qedf_debugfs.c +15 -6
@@ -11,6 +11,7 @@#include <linux/uaccess.h> #include <linux/debugfs.h> #include <linux/module.h> +#include <linux/vmalloc.h> #include "qedf.h" #include "qedf_dbg.h"
@@ -117,7 +118,9 @@ static ssize_t qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count, loff_t *ppos) { + ssize_t ret;size_t cnt =0 ; +char *cbuf;int id;struct qedf_fastpath *fp =NULL ; struct qedf_dbg_ctx *qedf_dbg =
@@ -127,19 +130,25 @@ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,QEDF_INFO (qedf_dbg,QEDF_LOG_DEBUGFS ,"entered\n" ); - cnt =sprintf (buffer,"\nFastpath I/O completions\n\n" ); + cbuf =vmalloc (QEDF_DEBUGFS_LOG_LEN ); +if (!cbuf) +return 0 ; + + cnt +=scnprintf (cbuf + cnt,QEDF_DEBUGFS_LOG_LEN - cnt,"\nFastpath I/O completions\n\n" );for (id =0 ; id < qedf->num_queues; id++) { fp = &(qedf->fp_array[id]);if (fp->sb_id ==QEDF_SB_ID_NULL )continue ; - cnt +=sprintf ((buffer + cnt),"#%d: %lu\n" , id, - fp->completions); + cnt +=scnprintf (cbuf + cnt,QEDF_DEBUGFS_LOG_LEN - cnt, +"#%d: %lu\n" , id, fp->completions); } - cnt =min_t (int, count, cnt - *ppos); - *ppos += cnt; -return cnt; + ret =simple_read_from_buffer (buffer, count, ppos, cbuf, cnt); + +vfree (cbuf); + +return ret; } static ssize_t
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 145/273 dma-buf/sync_file: Fix docs syntax
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 05d56d8079d510a2994039470f65bea85f0075ee ]
Fixes the warning:
include/uapi/linux/sync_file.h:77: warning: Function parameter or member 'num_fences' not described in 'sync_file_info'
--- include/uapi/linux/sync_file.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/sync_file.h +1 -1
@@ -52,7 +52,7 @@ struct sync_fence_info {* @name: name of fence * @status: status of fence. 1: signaled 0:active <0:error * @flags: sync_file_info flags -* @num_fences number of fences in the sync_file +* @num_fences: number of fences in the sync_file * @pad: padding for 64-bit alignment, should always be zero * @sync_fence_info: pointer to array of structs sync_fence_info with all * fences in the sync_file
Signature · 1 line
2.40.1