5.15.148-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.15.148-rc1 review
This is the start of the stable review cycle for the 5.15.148 release. There are 374 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.148-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.148-rc1
Pablo Neira Ayuso <[email protected]>
netfilter: nft_quota: copy content when cloning expression
Pablo Neira Ayuso <[email protected]>
netfilter: nft_last: copy content when cloning expression
Phil Sutter <[email protected]>
netfilter: nft_limit: Clone packet limits' cost value
Florian Westphal <[email protected]>
netfilter: nft_limit: fix stateful object memory leak
Pablo Neira Ayuso <[email protected]>
netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: typo NULL check in _clone() function
Matthew Wilcox (Oracle) <[email protected]>
block: Remove special-casing of compound pages
Marek Szyprowski <[email protected]>
i2c: s3c24xx: fix transferring more than one message in polling mode
Marek Szyprowski <[email protected]>
i2c: s3c24xx: fix read transfers in polling mode
Nikita Zhandarovich <[email protected]>
ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
Amit Cohen <[email protected]>
selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Fix stack corruption
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Make fini symmetric to init
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_tcam: Add missing mutex_destroy()
Christophe JAILLET <[email protected]>
mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable
Amit Cohen <[email protected]>
mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
Ludvig Pärsson <[email protected]>
ethtool: netlink: Add missing ethnl_ops_begin/complete
Christophe JAILLET <[email protected]>
kdb: Fix a potential buffer overflow in kdb_local()
Fedor Pchelkin <[email protected]>
ipvs: avoid stat macros calls from preemptible context
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip dead set elements in netlink dump
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: do not allow mismatch field size and set key length
Pablo Neira Ayuso <[email protected]>
netfilter: nft_limit: do not ignore unsupported flags
Vasily Averin <[email protected]>
netfilter: nf_tables: memcg accounting for dynamically allocated objects
Pablo Neira Ayuso <[email protected]>
netfilter: nft_limit: move stateful fields out of expression data
Pablo Neira Ayuso <[email protected]>
netfilter: nft_limit: rename stateful structure
Pablo Neira Ayuso <[email protected]>
netfilter: nft_quota: move stateful fields out of expression data
Pablo Neira Ayuso <[email protected]>
netfilter: nft_last: move stateful fields out of expression data
Pablo Neira Ayuso <[email protected]>
netfilter: nft_connlimit: move stateful fields out of expression data
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject invalid set policy
Kunwu Chan <[email protected]>
net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
Hao Sun <[email protected]>
bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
Qiang Ma <[email protected]>
net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls
Nikita Yushchenko <[email protected]>
net: ravb: Fix dma_addr_t truncation in error case
Eric Dumazet <[email protected]>
mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req()
Eric Dumazet <[email protected]>
mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
Eric Dumazet <[email protected]>
mptcp: strict validation before using mp_opt->hmac
Geliang Tang <[email protected]>
mptcp: drop unused sk in mptcp_get_options
Eric Dumazet <[email protected]>
mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN
Claudiu Beznea <[email protected]>
net: phy: micrel: populate .soft_reset for KSZ9131
Sanjuán García, Jorge <[email protected]>
net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames
Lin Ma <[email protected]>
net: qualcomm: rmnet: fix global oob in rmnet_policy
Niklas Schnelle <[email protected]>
s390/pci: fix max size calculation in zpci_memcpy_toio()
Siddharth Vadapalli <[email protected]>
PCI: keystone: Fix race condition when initializing PHYs
Maurizio Lombardi <[email protected]>
nvmet-tcp: Fix the H2C expected PDU len calculation
Arnd Bergmann <[email protected]>
nvmet: re-fix tracing strncpy() warning
Christoph Niedermaier <[email protected]>
serial: imx: Correct clock error message in function probe()
Chunfeng Yun <[email protected]>
usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer
Fedor Pchelkin <[email protected]>
apparmor: avoid crash when parsed profile name is empty
Ian Rogers <[email protected]>
perf env: Avoid recursively taking env->bpf_progs.lock
Maurizio Lombardi <[email protected]>
nvmet-tcp: fix a crash in nvmet_req_complete()
Maurizio Lombardi <[email protected]>
nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
Douglas Anderson <[email protected]>
usb: core: Fix crash w/ usb_choose_configuration() if no driver
Oliver Neukum <[email protected]>
usb: cdc-acm: return correct error code on unsupported break
Jiri Slaby (SUSE) <[email protected]>
tty: use 'if' in send_break() instead of 'goto'
Jiri Slaby (SUSE) <[email protected]>
tty: don't check for signal_pending() in send_break()
Jiri Slaby (SUSE) <[email protected]>
tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
Jiri Slaby (SUSE) <[email protected]>
tty: change tty_write_lock()'s ndelay parameter to bool
Namhyung Kim <[email protected]>
perf genelf: Set ELF program header addresses properly
Nuno Sa <[email protected]>
iio: adc: ad9467: fix scale setting
Nuno Sa <[email protected]>
iio: adc: ad9467: don't ignore error codes
Nuno Sa <[email protected]>
iio: adc: ad9467: fix reset gpio handling
Uwe Kleine-König <[email protected]>
iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify
Zhao Mengmeng <[email protected]>
selftests/sgx: Skip non X86_64 platform
Jo Van Bulck <[email protected]>
selftests/sgx: Fix uninitialized pointer dereference in error path
Paul Geurts <[email protected]>
serial: imx: fix tx statemachine deadlock
Sakari Ailus <[email protected]>
software node: Let args be NULL in software_node_get_reference_args
Douglas Anderson <[email protected]>
r8152: Choose our USB config with choose_configuration() rather than probe()
Douglas Anderson <[email protected]>
usb: core: Allow subclassed USB drivers to override usb_choose_configuration()
Arnaldo Carvalho de Melo <[email protected]>
libapi: Add missing linux/types.h header to get the __u64 type on io.h
Uwe Kleine-König <[email protected]>
serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
Su Hui <[email protected]>
power: supply: bq256xx: fix some problem in bq256xx_hw_init
Jan Palus <[email protected]>
power: supply: cw2015: correct time_to_empty units in sysfs
Christophe JAILLET <[email protected]>
MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
Christophe JAILLET <[email protected]>
MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
Alexandre Ghiti <[email protected]>
riscv: Fix module_alloc() that did not reset the linear mapping permissions
Alexandre Ghiti <[email protected]>
riscv: Check if the code to patch lies in the exit section
Serge Semin <[email protected]>
mips: Fix incorrect max_low_pfn adjustment
Serge Semin <[email protected]>
mips: dmi: Fix early remap on MIPS32
Andy Shevchenko <[email protected]>
mfd: intel-lpss: Fix the fractional clock divider flags
Dang Huynh <[email protected]>
leds: aw2013: Select missing dependency REGMAP_I2C
Kunwu Chan <[email protected]>
mfd: syscon: Fix null pointer dereference in of_syscon_register()
Randy Dunlap <[email protected]>
ARM: 9330/1: davinci: also select PINCTRL
Isaac J. Manjarres <[email protected]>
iommu/dma: Trace bounce buffer usage when mapping buffers
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: set safe default SPI clock frequency
Hugo Villeneuve <[email protected]>
serial: sc16is7xx: add check for unsupported SPI modes during probe
Jason Gerecke <[email protected]>
HID: wacom: Correct behavior when processing some confidence == false touches
Marcelo Schmitt <[email protected]>
iio: adc: ad7091r: Pass iio_dev to event handler
Oliver Upton <[email protected]>
KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
Marc Zyngier <[email protected]>
KVM: arm64: vgic-v4: Restore pending state on host userspace write
Kirill A. Shutemov <[email protected]>
x86/kvm: Do not try to disable kvmclock if it was not enabled
qizhong cheng <[email protected]>
PCI: mediatek: Clear interrupt status before dispatching handler
Niklas Cassel <[email protected]>
PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
David Lin <[email protected]>
wifi: mwifiex: configure BSSID consistently when starting AP
Ilpo Järvinen <[email protected]>
wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
Ilpo Järvinen <[email protected]>
wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
Christian Marangi <[email protected]>
wifi: mt76: fix broken precal loading from MTD for mt7915
Rob Clark <[email protected]>
iommu/arm-smmu-qcom: Add missing GMU entry to match table
Jiri Olsa <[email protected]>
bpf: Fix re-attachment branch in bpf_tracing_prog_attach
Gui-Dong Han <[email protected]>
Bluetooth: Fix atomicity violation in {min,max}_key_size_set
Stefan Berger <[email protected]>
rootfs: Fix support for rootfstype= when root= is given
Jens Axboe <[email protected]>
io_uring/rw: ensure io->bytes_done is always initialized
Uwe Kleine-König <[email protected]>
pwm: jz4740: Don't use dev_err_probe() in .request()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: check if catch-all set element is active in next generation
Min Li <[email protected]>
block: add check that partition length needs to be aligned with block size
Chandrakanth patil <[email protected]>
scsi: mpi3mr: Refresh sdev queue depth after controller reset
Nam Cao <[email protected]>
fbdev: flush deferred work in fb_deferred_io_fsync()
Çağhan Demir <[email protected]>
ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx
Takashi Iwai <[email protected]>
ALSA: oxygen: Fix right channel of capture volume mixer
Christoph Niedermaier <[email protected]>
serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock
Gui-Dong Han <[email protected]>
usb: mon: Fix atomicity violation in mon_bin_vma_fault
RD Babiera <[email protected]>
usb: typec: class: fix typec_altmode_put_partner to put plugs
Heikki Krogerus <[email protected]>
Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
Frank Li <[email protected]>
usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
Frank Li <[email protected]>
usb: cdns3: fix iso transfer error when mult is not zero
Frank Li <[email protected]>
usb: cdns3: fix uvc failure work since sg support enabled
Xu Yang <[email protected]>
usb: chipidea: wait controller resume finished for wakeup irq
Thinh Nguyen <[email protected]>
Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only"
Thinh Nguyen <[email protected]>
Revert "usb: dwc3: Soft reset phy on probe for host"
Uttkarsh Aggarwal <[email protected]>
usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
Xu Yang <[email protected]>
usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
Heiko Carstens <[email protected]>
tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
Carlos Llamas <[email protected]>
binder: fix race between mmput() and do_exit()
Jan Beulich <[email protected]>
xen-netback: don't produce zero-size SKB frags
Wei Yongjun <[email protected]>
virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()
Ren Zhijie <[email protected]>
dma-mapping: Fix build error unused-value
Hans de Goede <[email protected]>
Input: atkbd - use ab83 as id when skipping the getid command
Carlos Llamas <[email protected]>
binder: fix unused alloc->free_async_space
Carlos Llamas <[email protected]>
binder: fix async space check for 0-sized buffers
David Howells <[email protected]>
keys, dns: Fix size check of V1 server-list header
Jordan Rome <[email protected]>
selftests/bpf: Add assert for user stacks in test_task_stack
Geert Uytterhoeven <[email protected]>
of: unittest: Fix of_count_phandle_with_args() expected value message
Christian A. Ehrhardt <[email protected]>
of: Fix double free in of_parse_phandle_with_args_map
Li Nan <[email protected]>
ksmbd: validate the zero field of packet header
Zhipeng Lu <[email protected]>
drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init
Sergey Gorenko <[email protected]>
IB/iser: Prevent invalidating wrong MR
Peter Robinson <[email protected]>
mmc: sdhci_omap: Fix TI SoC dependencies
Peter Robinson <[email protected]>
mmc: sdhci_am654: Fix TI SoC dependencies
Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Add missing error checks to *_ctl_get()
Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Allow passing any output to line_out_remap()
Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config()
Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Add missing error check to scarlett2_config_save()
Hans de Goede <[email protected]>
ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[]
Philipp Zabel <[email protected]>
pwm: stm32: Fix enable count for clk in .probe()
Philipp Zabel <[email protected]>
pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
Uwe Kleine-König <[email protected]>
pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable
Théo Lebrun <[email protected]>
clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw
Dmitry Baryshkov <[email protected]>
clk: fixed-rate: add devm_clk_hw_register_fixed_rate
Dmitry Baryshkov <[email protected]>
clk: asm9260: use parent index to link the reference clock
Su Hui <[email protected]>
clk: si5341: fix an error code problem in si5341_output_clk_set_rate
Vignesh Raghavendra <[email protected]>
watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused
Stefan Wahren <[email protected]>
watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
Jerry Hoemann <[email protected]>
watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
Curtis Klein <[email protected]>
watchdog: set cdev owner before adding
Jay Buddhabhatti <[email protected]>
drivers: clk: zynqmp: update divider round rate logic
Shubhrajyoti Datta <[email protected]>
clk: zynqmp: Add a check for NULL pointer
Shubhrajyoti Datta <[email protected]>
clk: zynqmp: make bestdiv unsigned
Jay Buddhabhatti <[email protected]>
drivers: clk: zynqmp: calculate closest mux rate
Satya Priya Kakitapalli <[email protected]>
clk: qcom: videocc-sm8150: Add missing PLL config property
Satya Priya Kakitapalli <[email protected]>
clk: qcom: videocc-sm8150: Update the videocc resets
Satya Priya Kakitapalli <[email protected]>
dt-bindings: clock: Update the videocc resets for sm8150
Zhipeng Lu <[email protected]>
gpu/drm/radeon: fix two memleaks in radeon_vm_init
Zhipeng Lu <[email protected]>
drivers/amd/pm: fix a use-after-free in kv_parse_power_table
Zhipeng Lu <[email protected]>
drm/amd/pm: fix a double-free in si_dpm_init
Alex Deucher <[email protected]>
drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
Christophe JAILLET <[email protected]>
media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe()
Dan Carpenter <[email protected]>
media: dvbdev: drop refcount on error path in dvb_device_open()
Eric Biggers <[email protected]>
f2fs: fix the f2fs_file_write_iter tracepoint
Chao Yu <[email protected]>
f2fs: fix to update iostat correctly in f2fs_filemap_fault()
Chao Yu <[email protected]>
f2fs: fix to check compress file in f2fs_move_file_range()
Laurent Pinchart <[email protected]>
media: rkisp1: Disable runtime PM in probe error path
Satya Priya Kakitapalli <[email protected]>
clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
Zhipeng Lu <[email protected]>
media: cx231xx: fix a memleak in cx231xx_init_isoc
Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: Fix return value on error case
Tomi Valkeinen <[email protected]>
drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable
Zhipeng Lu <[email protected]>
drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
Zhipeng Lu <[email protected]>
drm/radeon/dpm: fix a memleak in sumo_parse_power_table
Yang Yingliang <[email protected]>
drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
Dmitry Baryshkov <[email protected]>
drm/drv: propagate errors from drm_modeset_register_all()
Konrad Dybcio <[email protected]>
drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
Dmitry Baryshkov <[email protected]>
drm/msm/mdp4: flush vblank event on disable
Linus Walleij <[email protected]>
ASoC: cs35l34: Fix GPIO name and drop legacy include
Linus Walleij <[email protected]>
ASoC: cs35l33: Fix GPIO name and drop legacy include
Nikita Zhandarovich <[email protected]>
drm/radeon: check return value of radeon_ring_lock()
Nikita Zhandarovich <[email protected]>
drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
Nikita Zhandarovich <[email protected]>
drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
Chao Yu <[email protected]>
f2fs: fix to avoid dirent corruption
Dario Binacchi <[email protected]>
drm/bridge: Fix typo in post_disable() description
Ricardo B. Marliere <[email protected]>
media: pvrusb2: fix use after free on context disconnection
Tomi Valkeinen <[email protected]>
drm/tilcdc: Fix irq free on unload
Uwe Kleine-König <[email protected]>
drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
Abhinav Singh <[email protected]>
drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
Chris Morgan <[email protected]>
drm/panel-elida-kd35t133: hold panel in reset for unprepare
Junxian Huang <[email protected]>
RDMA/hns: Fix inappropriate err code for unsupported operations
Leon Romanovsky <[email protected]>
RDMA/usnic: Silence uninitialized symbol smatch warnings
Tomi Valkeinen <[email protected]>
Revert "drm/omapdrm: Annotate dma-fence critical section in commit path"
Tomi Valkeinen <[email protected]>
Revert "drm/tidss: Annotate dma-fence critical section in commit path"
Arnd Bergmann <[email protected]>
ARM: davinci: always select CONFIG_CPU_ARM926T
Eric Dumazet <[email protected]>
ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
Asmaa Mnebhi <[email protected]>
mlxbf_gige: Enable the GigE port in mlxbf_gige_open
Asmaa Mnebhi <[email protected]>
net: mellanox: mlxbf_gige: Replace non-standard interrupt handling
Asmaa Mnebhi <[email protected]>
mlxbf_gige: Fix intermittent no ip issue
Tao Liu <[email protected]>
net/sched: act_ct: fix skb leak and crash on ooo frags
Christoph Hellwig <[email protected]>
null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS
Keith Busch <[email protected]>
block: make BLK_DEF_MAX_SECTORS unsigned
Francesco Dolcini <[email protected]>
Bluetooth: btmtkuart: fix recv_buf() return value
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix bogus check for re-auth no supported with non-ssp
Florian Westphal <[email protected]>
netfilter: nf_tables: mark newset as dead on transaction abort
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: send TX path flush in rfkill
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: add calculate_bit_shift()
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent
Li Nan <[email protected]>
block: add check of 'minors' and 'first_minor' in device_add_disk()
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8150-hdk: fix SS USB regulators
Atul Dhudase <[email protected]>
soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
Joakim Zhang <[email protected]>
dma-mapping: clear dev->dma_mem to NULL after freeing it
Mark-PK Tsai <[email protected]>
dma-mapping: Add dma_release_coherent_memory to DMA API
Arseniy Krasnov <[email protected]>
virtio/vsock: fix logic which reduces credit update messages
Hangbin Liu <[email protected]>
selftests/net: fix grep checking for fib_nexthop_multiprefix
Yihang Li <[email protected]>
scsi: hisi_sas: Correct the number of global debugfs registers
Yihang Li <[email protected]>
scsi: hisi_sas: Rollback some operations if FLR failed
Yihang Li <[email protected]>
scsi: hisi_sas: Replace with standard error code return value
Qi Liu <[email protected]>
scsi: hisi_sas: Prevent parallel FLR and controller reset
Luo Jiaxing <[email protected]>
scsi: hisi_sas: Rename HISI_SAS_{RESET -> RESETTING}_BITLi Nan <[email protected]>
block: Set memalloc_noio to false on device_add_disk() error path
Andrei Matei <[email protected]>
bpf: Fix verification of indirect var-off stack access
Johan Hovold <[email protected]>
arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
Artem Chernyshev <[email protected]>
scsi: fnic: Return error if vmalloc() failed
Andrii Nakryiko <[email protected]>
bpf: fix check for attempt to corrupt spilled pointer
Douglas Anderson <[email protected]>
arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered
Douglas Anderson <[email protected]>
arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered
Douglas Anderson <[email protected]>
arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered
Douglas Anderson <[email protected]>
arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered
Douglas Anderson <[email protected]>
arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered
Krzysztof Kozlowski <[email protected]>
ARM: dts: qcom: sdx65: correct SPMI node name
Andrii Nakryiko <[email protected]>
bpf: enforce precision of R0 on callback return
Tomi Valkeinen <[email protected]>
arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
Su Hui <[email protected]>
wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
Dmitry Rokosov <[email protected]>
firmware: meson_sm: populate platform devices from sm device tree data
Christophe JAILLET <[email protected]>
firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
Peter Delevoryas <[email protected]>
net/ncsi: Fix netlink major/minor version numbers
Dmitry Baryshkov <[email protected]>
ARM: dts: qcom: apq8064: correct XOADC register address
Arnd Bergmann <[email protected]>
wifi: libertas: stop selecting wext
Luca Weiss <[email protected]>
wifi: ath11k: Defer on rproc_get failure
Jordan Rome <[email protected]>
bpf: Add crosstask check to __bpf_get_stack
Florian Lehner <[email protected]>
bpf, lpm: Fix check prefixlen before walking trie
Chih-Kang Chang <[email protected]>
wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
Trond Myklebust <[email protected]>
NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
Benjamin Coddington <[email protected]>
blocklayoutdriver: Fix reference leak of pnfs_device_node
Chengming Zhou <[email protected]>
crypto: scomp - fix req->dst buffer overflow
Ovidiu Panait <[email protected]>
crypto: sahara - do not resize req->src when doing hash operations
Ovidiu Panait <[email protected]>
crypto: sahara - fix processing hash requests with req->nbytes < sg->length
Ovidiu Panait <[email protected]>
crypto: sahara - improve error handling in sahara_sha_process()
Ovidiu Panait <[email protected]>
crypto: sahara - fix wait_for_completion_timeout() error handling
Ovidiu Panait <[email protected]>
crypto: sahara - fix ahash reqsize
Ovidiu Panait <[email protected]>
crypto: sahara - handle zero-length aes requests
Ovidiu Panait <[email protected]>
crypto: sahara - avoid skcipher fallback code duplication
wangyangxin <[email protected]>
crypto: virtio - Wait for tasklet to complete on device remove
Osama Muhammad <[email protected]>
gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
Christian Brauner <[email protected]>
fs: indicate request originates from old mount API
Sergey Shtylyov <[email protected]>
pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
Ovidiu Panait <[email protected]>
crypto: sahara - fix error handling in sahara_hw_descriptor_create()
Ovidiu Panait <[email protected]>
crypto: sahara - fix processing requests with cryptlen < sg->length
Ovidiu Panait <[email protected]>
crypto: sahara - fix ahash selftest failure
Ovidiu Panait <[email protected]>
crypto: sahara - fix cbc selftest failure
Ovidiu Panait <[email protected]>
crypto: sahara - remove FLAGS_NEW_KEY logic
Herbert Xu <[email protected]>
crypto: af_alg - Disallow multiple in-flight AIO requests
Dinghao Liu <[email protected]>
crypto: ccp - fix memleak in ccp_init_dm_workarea
Chen Ni <[email protected]>
crypto: sa2ul - Return crypto_aead_setkey to transfer the error
Gonglei (Arei) <[email protected]>
crypto: virtio - Handle dataq logic with tasklet
Mickaël Salaün <[email protected]>
selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
ZhaoLong Wang <[email protected]>
mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
Richard Fitzgerald <[email protected]>
kunit: debugfs: Fix unchecked dereference in debugfs_print_results()
Tony Luck <[email protected]>
ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error
Andy Shevchenko <[email protected]>
ACPI: LPSS: Fix the fractional clock divider flags
Wolfram Sang <[email protected]>
spi: sh-msiof: Enforce fixed DTDL for R-Car H3
Ilias Apalodimas <[email protected]>
efivarfs: force RO when remounting if SetVariable is not supported
Gavrilov Ilia <[email protected]>
calipso: fix memory leak in netlbl_calipso_add_pass()
Alexandra Diupina <[email protected]>
cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
Rob Herring <[email protected]>
cpufreq: Use of_property_present() for testing DT property presence
Rob Herring <[email protected]>
of: Add of_property_present() helper
Michael Walle <[email protected]>
of: property: define of_property_read_u{8,16,32,64}_array() unconditionallyNikita Kiryushin <[email protected]>
ACPI: LPIT: Avoid u32 multiplication overflow
Nikita Kiryushin <[email protected]>
ACPI: video: check for error while searching for backlight device parent
Ronald Monthero <[email protected]>
mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
Amit Kumar Mahapatra <[email protected]>
spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
Kunwu Chan <[email protected]>
powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
Kunwu Chan <[email protected]>
powerpc/powernv: Add a null pointer check in opal_powercap_init()
Kunwu Chan <[email protected]>
powerpc/powernv: Add a null pointer check in opal_event_init()
Kunwu Chan <[email protected]>
powerpc/powernv: Add a null pointer check to scom_debug_init_one()
Michael Ellerman <[email protected]>
selftests/powerpc: Fix error handling in FPU/VMX preemption tests
Nathan Lynch <[email protected]>
powerpc/pseries/memhp: Fix access beyond end of drmem array
Randy Dunlap <[email protected]>
powerpc/44x: select I2C for CURRITUCK
Masahiro Yamada <[email protected]>
powerpc: add crtsavres.o to always-y instead of extra-y
Masahiro Yamada <[email protected]>
powerpc: remove checks for binutils older than 2.25
Alan Modra <[email protected]>
powerpc/toc: Future proof kernel toc
Christophe Leroy <[email protected]>
powerpc: Mark .opd section read-only
Arnd Bergmann <[email protected]>
EDAC/thunderx: Fix possible out-of-bounds string access
Colin Ian King <[email protected]>
x86/lib: Fix overflow when counting digits
James Clark <[email protected]>
coresight: etm4x: Fix width of CCITMIN field
LeoLiuoc <[email protected]>
PCI: Add ACS quirk for more Zhaoxin Root Ports
Florian Eckert <[email protected]>
leds: ledtrig-tty: Free allocated ttyname buffer on deactivate
Cameron Williams <[email protected]>
parport: parport_serial: Add Brainboxes device IDs and geometry
Cameron Williams <[email protected]>
parport: parport_serial: Add Brainboxes BAR details
Guanghui Feng <[email protected]>
uio: Fix use-after-free in uio_open
Carlos Llamas <[email protected]>
binder: fix comment on binder_alloc_new_buf() return value
Carlos Llamas <[email protected]>
binder: fix trivial typo of binder_free_buf_locked()
Carlos Llamas <[email protected]>
binder: fix use-after-free in shinker's callback
Carlos Llamas <[email protected]>
binder: use EPOLLERR from eventpoll.h
Junxiao Bi <[email protected]>
Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
Masami Hiramatsu (Google) <[email protected]>
kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
Alan Maguire <[email protected]>
bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25
Greg Kroah-Hartman <[email protected]>
Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
Hans de Goede <[email protected]>
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
Jani Nikula <[email protected]>
drm/crtc: fix uninitialized variable use
Stefan Wahren <[email protected]>
ARM: sun9i: smp: fix return code check of of_property_match_string
Sarannya S <[email protected]>
net: qrtr: ns: Return 0 if server port is not present
Matthew Wilcox (Oracle) <[email protected]>
ida: Fix crash in ida_free when the bitmap is empty
Jensen Huang <[email protected]>
i2c: rk3x: fix potential spinlock recursion on poll
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
Luca Weiss <[email protected]>
Input: xpad - add Razer Wolverine V2 support
Avraham Stern <[email protected]>
wifi: iwlwifi: pcie: avoid a NULL pointer dereference
Vineet Gupta <[email protected]>
ARC: fix spare error
Vineeth Vijayan <[email protected]>
s390/scm: fix virtual vs physical address confusion
Esther Shimanovich <[email protected]>
Input: i8042 - add nomux quirk for Acer P459-G2-M
Hans de Goede <[email protected]>
Input: atkbd - skip ATKBD_CMD_GETID in translated mode
Krzysztof Kozlowski <[email protected]>
reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
Steven Rostedt (Google) <[email protected]>
ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
Zheng Yejian <[email protected]>
tracing: Fix uaf issue when open the hist or hist_debug file
Krzysztof Kozlowski <[email protected]>
MIPS: dts: loongson: drop incorrect dwmac fallback compatible
Krzysztof Kozlowski <[email protected]>
stmmac: dwmac-loongson: drop useless check for compatible fallback
Steven Rostedt (Google) <[email protected]>
tracing: Add size check when printing trace_marker output
Steven Rostedt (Google) <[email protected]>
tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
Ye Bin <[email protected]>
jbd2: fix soft lockup in journal_finish_inode_data_buffers()
Hans de Goede <[email protected]>
platform/x86: intel-vbtn: Fix missing tablet-mode-switch events
Judy Hsiao <[email protected]>
neighbour: Don't let neigh_forced_gc() disable preemption for long
Ziqi Zhao <[email protected]>
drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
Zhang Yi <[email protected]>
jbd2: correct the printing of write_flags in jbd2_write_superblock()
Weihao Li <[email protected]>
clk: rockchip: rk3128: Fix HCLK_OTG gate register
Armin Wolf <[email protected]>
hwmon: (corsair-psu) Fix probe when built-in
Inki Dae <[email protected]>
drm/exynos: fix a wrong error checking
Xiang Yang <[email protected]>
drm/exynos: fix a potential error pointer dereference
Lijo Lazar <[email protected]>
drm/amdgpu: Add NULL checks for function pointers
Keith Busch <[email protected]>
nvme: introduce helper function to get ctrl state
Srinivas Kandagatla <[email protected]>
ASoC: ops: add correct range check for limiting volume
David Rau <[email protected]>
ASoC: da7219: Support low DC impedance headset
Thinh Tran <[email protected]>
net/tg3: fix race condition in tg3_reset_task()
Dave Airlie <[email protected]>
nouveau/tu102: flush all pdbs on vmm flush
Shuming Fan <[email protected]>
ASoC: rt5650: add mutex to avoid the jack detection failure
Maciej Strozek <[email protected]>
ASoC: cs43130: Fix incorrect frame delay configuration
Maciej Strozek <[email protected]>
ASoC: cs43130: Fix the position of const qualifier
Kamil Duljas <[email protected]>
ASoC: Intel: Skylake: mem leak in skl register function
David Lin <[email protected]>
ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
Kamil Duljas <[email protected]>
ASoC: Intel: Skylake: Fix mem leak in few functions
Charles Keepax <[email protected]>
ASoC: wm8974: Correct boost mixer inputs
Keith Busch <[email protected]>
nvme-core: check for too small lba shift
Lu Yao <[email protected]>
drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
Johannes Berg <[email protected]>
debugfs: fix automount d_fsdata usage
Johannes Berg <[email protected]>
wifi: cfg80211: lock wiphy mutex for rfkill poll
Edward Adam Davis <[email protected]>
mptcp: fix uninit-value in mptcp_incoming_options
Vasiliy Kovalev <[email protected]>
ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
Charles Keepax <[email protected]>
pinctrl: lochnagar: Don't build on MIPS
Eric Biggers <[email protected]>
f2fs: explicitly null-terminate the xattr list
-------------
Diffstat:
Makefile | 4 +- arch/arc/kernel/signal.c | 6 +- arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +- arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +- arch/arm/mach-davinci/Kconfig | 2 + arch/arm/mach-sunxi/mc_smp.c | 4 +- arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +- arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +- arch/arm64/boot/dts/qcom/sc7280.dtsi | 8 +- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +- arch/arm64/boot/dts/qcom/sm8150-hdk.dts | 12 +- arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +- arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 +- arch/arm64/kvm/vgic/vgic-its.c | 5 + arch/arm64/kvm/vgic/vgic-mmio-v3.c | 27 +- arch/mips/alchemy/devboards/db1200.c | 2 +- arch/mips/alchemy/devboards/db1550.c | 2 +- arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi | 3 +- arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 3 +- arch/mips/include/asm/dmi.h | 2 +- arch/mips/kernel/setup.c | 4 +- arch/powerpc/Makefile | 16 +- arch/powerpc/boot/crt0.S | 2 +- arch/powerpc/boot/zImage.lds.S | 7 +- arch/powerpc/include/asm/sections.h | 16 +- arch/powerpc/kernel/head_64.S | 2 +- arch/powerpc/kernel/vmlinux.lds.S | 20 +- arch/powerpc/lib/Makefile | 4 +- arch/powerpc/perf/imc-pmu.c | 6 + arch/powerpc/platforms/44x/Kconfig | 1 + arch/powerpc/platforms/powernv/opal-irqchip.c | 2 + arch/powerpc/platforms/powernv/opal-powercap.c | 6 + arch/powerpc/platforms/powernv/opal-xscom.c | 5 + arch/powerpc/platforms/pseries/hotplug-memory.c | 9 +- arch/riscv/include/asm/sections.h | 1 + arch/riscv/kernel/module.c | 3 +- arch/riscv/kernel/patch.c | 11 +- arch/riscv/kernel/vmlinux-xip.lds.S | 2 + arch/riscv/kernel/vmlinux.lds.S | 2 + arch/s390/include/asm/pci_io.h | 32 ++- arch/s390/pci/pci_mmio.c | 12 +- arch/x86/kernel/kvmclock.c | 12 +- arch/x86/lib/misc.c | 2 +- block/bio.c | 7 +- block/blk-settings.c | 2 +- block/genhd.c | 5 +- block/ioctl.c | 11 +- crypto/af_alg.c | 14 +- crypto/scompress.c | 6 + drivers/acpi/acpi_extlog.c | 7 +- drivers/acpi/acpi_lpit.c | 2 +- drivers/acpi/acpi_lpss.c | 3 +- drivers/acpi/acpi_video.c | 12 +- drivers/acpi/resource.c | 7 + drivers/android/binder.c | 2 +- drivers/android/binder_alloc.c | 32 +-- drivers/base/swnode.c | 3 + drivers/block/null_blk/main.c | 13 +- drivers/bluetooth/btmtkuart.c | 11 +- drivers/clk/clk-asm9260.c | 29 +- drivers/clk/clk-fixed-rate.c | 28 +- drivers/clk/clk-si5341.c | 4 +- drivers/clk/qcom/gpucc-sm8150.c | 4 +- drivers/clk/qcom/videocc-sm8150.c | 5 + drivers/clk/rockchip/clk-rk3128.c | 2 +- drivers/clk/zynqmp/clk-mux-zynqmp.c | 2 +- drivers/clk/zynqmp/divider.c | 63 +---- drivers/cpufreq/cpufreq-dt-platdev.c | 2 +- drivers/cpufreq/imx-cpufreq-dt.c | 2 +- drivers/cpufreq/imx6q-cpufreq.c | 4 +- drivers/cpufreq/scmi-cpufreq.c | 7 +- drivers/cpufreq/tegra20-cpufreq.c | 2 +- drivers/crypto/ccp/ccp-ops.c | 5 +- drivers/crypto/sa2ul.c | 3 +- drivers/crypto/sahara.c | 248 ++++++++---------- drivers/crypto/virtio/virtio_crypto_algs.c | 2 +- drivers/crypto/virtio/virtio_crypto_common.h | 2 + drivers/crypto/virtio/virtio_crypto_core.c | 26 +- drivers/edac/thunderx_edac.c | 10 +- drivers/firmware/meson/meson_sm.c | 5 +- drivers/firmware/ti_sci.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 10 +- drivers/gpu/drm/amd/amdgpu/soc15.c | 12 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 6 +- drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 4 +- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 5 +- .../gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c | 3 +- drivers/gpu/drm/bridge/tc358767.c | 2 +- drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 +- drivers/gpu/drm/drm_crtc.c | 8 +- drivers/gpu/drm/drm_drv.c | 10 +- drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +- drivers/gpu/drm/exynos/exynos_hdmi.c | 2 + drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c | 9 + drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +- drivers/gpu/drm/nouveau/nv04_fence.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- drivers/gpu/drm/omapdrm/omap_drv.c | 9 +- drivers/gpu/drm/panel/panel-elida-kd35t133.c | 2 + drivers/gpu/drm/radeon/r100.c | 4 +- drivers/gpu/drm/radeon/r600_cs.c | 4 +- drivers/gpu/drm/radeon/radeon_display.c | 7 +- drivers/gpu/drm/radeon/radeon_vm.c | 8 +- drivers/gpu/drm/radeon/si.c | 4 + drivers/gpu/drm/radeon/sumo_dpm.c | 4 +- drivers/gpu/drm/radeon/trinity_dpm.c | 4 +- drivers/gpu/drm/tidss/tidss_kms.c | 4 - drivers/gpu/drm/tilcdc/tilcdc_drv.c | 2 +- drivers/hid/wacom_wac.c | 32 +-- drivers/hwmon/corsair-psu.c | 18 +- drivers/hwtracing/coresight/coresight-etm4x.h | 2 +- drivers/i2c/busses/i2c-rk3x.c | 13 +- drivers/i2c/busses/i2c-s3c2410.c | 40 +-- drivers/iio/adc/ad7091r-base.c | 6 +- drivers/iio/adc/ad9467.c | 114 +++++--- drivers/iio/adc/adi-axi-adc.c | 74 ++---- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +- drivers/infiniband/hw/hns/hns_roce_pd.c | 2 +- drivers/infiniband/hw/mthca/mthca_cmd.c | 4 +- drivers/infiniband/hw/mthca/mthca_main.c | 2 +- drivers/infiniband/ulp/iser/iscsi_iser.h | 2 - drivers/infiniband/ulp/iser/iser_initiator.c | 5 +- drivers/infiniband/ulp/iser/iser_memory.c | 8 +- drivers/infiniband/ulp/iser/iser_verbs.c | 1 - drivers/input/joystick/xpad.c | 1 + drivers/input/keyboard/atkbd.c | 50 +++- drivers/input/serio/i8042-acpipnpio.h | 8 + drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 + drivers/iommu/dma-iommu.c | 3 + drivers/leds/Kconfig | 1 + drivers/leds/trigger/ledtrig-tty.c | 4 + drivers/md/raid5.c | 12 - drivers/media/dvb-core/dvbdev.c | 2 + drivers/media/dvb-frontends/m88ds3103.c | 7 +- .../media/platform/rockchip/rkisp1/rkisp1-dev.c | 3 +- drivers/media/usb/cx231xx/cx231xx-core.c | 2 + drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 +- drivers/mfd/intel-lpss.c | 2 +- drivers/mfd/syscon.c | 4 + drivers/mmc/host/Kconfig | 10 +- drivers/mtd/mtd_blkdevs.c | 4 +- drivers/mtd/nand/raw/fsl_ifc_nand.c | 2 +- drivers/net/dsa/vitesse-vsc73xx-core.c | 2 + drivers/net/ethernet/broadcom/tg3.c | 11 +- drivers/net/ethernet/mellanox/mlxbf_gige/Makefile | 1 - .../net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h | 12 - .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_gpio.c | 212 --------------- .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 48 ++-- .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 6 +- .../ethernet/mellanox/mlxsw/spectrum_acl_atcam.c | 8 +- .../net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 8 +- .../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 131 +++++----- drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.c | 9 +- .../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 11 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 2 +- drivers/net/ethernet/renesas/ravb_main.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 5 - drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 + .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 10 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 5 +- drivers/net/phy/micrel.c | 1 + drivers/net/usb/r8152.c | 16 +- drivers/net/wireless/ath/ath11k/ahb.c | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c | 11 - drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 +- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 +- drivers/net/wireless/marvell/libertas/Kconfig | 2 - drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 + drivers/net/wireless/marvell/mwifiex/fw.h | 1 + drivers/net/wireless/marvell/mwifiex/ioctl.h | 1 + drivers/net/wireless/marvell/mwifiex/uap_cmd.c | 8 + drivers/net/wireless/mediatek/mt76/eeprom.c | 2 +- drivers/net/wireless/realtek/rtlwifi/pci.c | 79 ++---- drivers/net/wireless/realtek/rtlwifi/pci.h | 5 - .../net/wireless/realtek/rtlwifi/rtl8188ee/phy.c | 14 +- .../wireless/realtek/rtlwifi/rtl8192c/phy_common.c | 12 +- .../wireless/realtek/rtlwifi/rtl8192c/phy_common.h | 1 - .../net/wireless/realtek/rtlwifi/rtl8192ce/phy.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8192ce/phy.h | 1 - .../net/wireless/realtek/rtlwifi/rtl8192cu/phy.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 15 +- .../net/wireless/realtek/rtlwifi/rtl8192ee/phy.c | 16 +- .../net/wireless/realtek/rtlwifi/rtl8192se/phy.c | 15 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 5 +- drivers/net/wireless/realtek/rtlwifi/wifi.h | 7 + drivers/net/wireless/realtek/rtw88/mac80211.c | 4 +- drivers/net/xen-netback/netback.c | 44 +++- drivers/nvme/host/core.c | 5 +- drivers/nvme/host/nvme.h | 5 + drivers/nvme/target/tcp.c | 20 +- drivers/nvme/target/trace.h | 3 +- drivers/of/base.c | 1 + drivers/of/unittest-data/tests-phandle.dtsi | 10 +- drivers/of/unittest.c | 74 +++--- drivers/parport/parport_serial.c | 64 +++++ drivers/pci/controller/dwc/pci-keystone.c | 9 + drivers/pci/controller/dwc/pcie-designware-ep.c | 1 + drivers/pci/controller/pcie-mediatek.c | 10 +- drivers/pci/quirks.c | 8 +- drivers/pinctrl/cirrus/Kconfig | 3 +- drivers/platform/x86/intel/vbtn.c | 19 +- drivers/power/supply/bq256xx_charger.c | 5 +- drivers/power/supply/cw2015_battery.c | 2 +- drivers/pwm/pwm-jz4740.c | 7 +- drivers/pwm/pwm-stm32.c | 63 ++--- drivers/reset/hisilicon/hi6220_reset.c | 2 +- drivers/s390/block/scm_blk.c | 7 +- drivers/scsi/fnic/fnic_debugfs.c | 3 +- drivers/scsi/hisi_sas/hisi_sas.h | 2 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 22 +- drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 20 +- drivers/scsi/mpi3mr/mpi3mr_os.c | 10 +- drivers/soc/qcom/llcc-qcom.c | 8 +- drivers/spi/Kconfig | 3 +- drivers/spi/spi-sh-msiof.c | 17 ++ drivers/tty/serial/8250/8250_omap.c | 2 +- drivers/tty/serial/imx.c | 29 +- drivers/tty/serial/sc16is7xx.c | 8 +- drivers/tty/tty.h | 2 +- drivers/tty/tty_io.c | 35 +-- drivers/tty/tty_ioctl.c | 2 +- drivers/uio/uio.c | 7 +- drivers/usb/cdns3/cdns3-gadget.c | 142 +++++++--- drivers/usb/cdns3/cdns3-gadget.h | 3 + drivers/usb/chipidea/core.c | 7 + drivers/usb/class/cdc-acm.c | 3 + drivers/usb/core/generic.c | 16 ++ drivers/usb/dwc3/core.c | 39 +-- drivers/usb/dwc3/ep0.c | 5 +- drivers/usb/host/xhci-mtk.c | 40 ++- drivers/usb/host/xhci-mtk.h | 2 + drivers/usb/mon/mon_bin.c | 7 +- drivers/usb/phy/phy-mxs-usb.c | 3 +- drivers/usb/typec/class.c | 4 +- drivers/video/fbdev/core/fb_defio.c | 6 +- drivers/watchdog/bcm2835_wdt.c | 3 +- drivers/watchdog/hpwdt.c | 2 +- drivers/watchdog/rti_wdt.c | 13 +- drivers/watchdog/watchdog_dev.c | 3 +- fs/debugfs/file.c | 8 + fs/debugfs/inode.c | 27 +- fs/debugfs/internal.h | 10 +- fs/efivarfs/super.c | 12 + fs/f2fs/file.c | 12 +- fs/f2fs/namei.c | 2 +- fs/f2fs/xattr.c | 6 + fs/gfs2/rgrp.c | 2 +- fs/jbd2/commit.c | 1 + fs/jbd2/journal.c | 4 +- fs/ksmbd/smb_common.c | 6 +- fs/namespace.c | 11 + fs/nfs/blocklayout/blocklayout.c | 2 + fs/nfs/nfs4proc.c | 3 + fs/pstore/ram_core.c | 2 +- include/crypto/if_alg.h | 3 + include/drm/drm_bridge.h | 2 +- include/dt-bindings/clock/qcom,videocc-sm8150.h | 4 + include/linux/blkdev.h | 3 +- include/linux/clk-provider.h | 52 +++- include/linux/dma-map-ops.h | 3 + include/linux/iio/adc/adi-axi-adc.h | 4 + include/linux/of.h | 291 ++++++++++----------- include/linux/usb.h | 6 + include/net/bluetooth/hci_core.h | 1 - include/trace/events/f2fs.h | 12 +- include/uapi/linux/bpf.h | 3 + init/do_mounts.c | 9 +- io_uring/io_uring.c | 9 +- kernel/bpf/lpm_trie.c | 3 + kernel/bpf/stackmap.c | 11 +- kernel/bpf/syscall.c | 9 + kernel/bpf/verifier.c | 27 +- kernel/debug/kdb/kdb_main.c | 2 - kernel/dma/coherent.c | 12 +- kernel/kprobes.c | 23 +- kernel/time/tick-sched.c | 5 + kernel/trace/ring_buffer.c | 6 + kernel/trace/trace.c | 12 +- kernel/trace/trace.h | 1 + kernel/trace/trace_events_hist.c | 12 +- kernel/trace/trace_output.c | 6 +- lib/idr.c | 2 +- lib/kunit/debugfs.c | 4 +- lib/test_ida.c | 40 +++ net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_debugfs.c | 12 +- net/bluetooth/hci_event.c | 11 +- net/core/neighbour.c | 9 +- net/dns_resolver/dns_key.c | 2 +- net/ethtool/features.c | 9 +- net/ipv6/ip6_tunnel.c | 26 +- net/ipv6/mcast.c | 4 + net/mptcp/options.c | 12 +- net/mptcp/protocol.h | 3 +- net/mptcp/subflow.c | 18 +- net/ncsi/internal.h | 7 +- net/ncsi/ncsi-netlink.c | 4 +- net/ncsi/ncsi-pkt.h | 7 +- net/ncsi/ncsi-rsp.c | 26 +- net/netfilter/ipvs/ip_vs_xmit.c | 4 +- net/netfilter/nf_tables_api.c | 29 +- net/netfilter/nft_connlimit.c | 37 ++- net/netfilter/nft_counter.c | 2 +- net/netfilter/nft_last.c | 73 ++++-- net/netfilter/nft_limit.c | 199 ++++++++++---- net/netfilter/nft_quota.c | 56 +++- net/netlabel/netlabel_calipso.c | 49 ++-- net/qrtr/ns.c | 4 +- net/sched/act_ct.c | 12 +- net/vmw_vsock/virtio_transport_common.c | 13 +- net/wireless/core.c | 2 + scripts/Makefile.compiler | 4 - scripts/pahole-flags.sh | 3 + security/apparmor/policy_unpack.c | 4 + security/selinux/hooks.c | 7 + sound/pci/hda/patch_realtek.c | 11 + sound/pci/oxygen/oxygen_mixer.c | 2 +- sound/soc/atmel/sam9g20_wm8731.c | 61 +++++ sound/soc/codecs/cs35l33.c | 4 +- sound/soc/codecs/cs35l34.c | 4 +- sound/soc/codecs/cs43130.c | 6 +- sound/soc/codecs/da7219-aad.c | 2 +- sound/soc/codecs/nau8822.c | 9 +- sound/soc/codecs/rt5645.c | 18 +- sound/soc/codecs/wm8974.c | 6 +- sound/soc/intel/boards/bytcr_rt5640.c | 12 + sound/soc/intel/skylake/skl-pcm.c | 9 +- sound/soc/intel/skylake/skl-sst-ipc.c | 4 +- sound/soc/soc-ops.c | 2 +- sound/usb/mixer_scarlett_gen2.c | 223 ++++++++++------ tools/include/uapi/linux/bpf.h | 3 + tools/lib/api/io.h | 1 + tools/perf/util/bpf-event.c | 8 +- tools/perf/util/bpf-event.h | 12 +- tools/perf/util/env.c | 50 ++-- tools/perf/util/env.h | 4 + tools/perf/util/genelf.c | 6 +- tools/perf/util/header.c | 8 +- tools/testing/selftests/bpf/prog_tests/bpf_iter.c | 2 + .../selftests/bpf/progs/bpf_iter_task_stack.c | 5 + .../testing/selftests/drivers/net/mlxsw/qos_pfc.sh | 18 +- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 106 +++++++- .../selftests/net/fib_nexthop_multiprefix.sh | 4 +- tools/testing/selftests/powerpc/math/fpu_preempt.c | 9 +- tools/testing/selftests/powerpc/math/vmx_preempt.c | 10 +- tools/testing/selftests/sgx/Makefile | 2 +- tools/testing/selftests/sgx/sigstruct.c | 5 +- 352 files changed, 2978 insertions(+), 2010 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/374 f2fs: explicitly null-terminate the xattr list
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit e26b6d39270f5eab0087453d9b544189a38c8564 upstream.
When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed.
--- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/f2fs/xattr.c +6 -0
@@ -745,6 +745,12 @@ static int __f2fs_setxattr(struct inodememcpy (pval, value, size); last->e_value_size =cpu_to_le16 (size); new_hsize += newsize; +/* +* Explicitly add the null terminator. The unused xattr space +* is supposed to always be zeroed, which would make this +* unnecessary, but don't depend on that. +*/ + *(u32 *)((u8 *)last + newsize) =0 ; } error =write_all_xattrs (inode, new_hsize, base_addr, ipage);
Greg Kroah-Hartman
maintainerPATCH 2/374 pinctrl: lochnagar: Dont build on MIPS
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ]
MIPS appears to define a RST symbol at a high level, which clashes with some register naming in the driver. Since there is currently no case for running this driver on MIPS devices simply cut off the build of this driver on MIPS.
--- drivers/pinctrl/cirrus/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pinctrl/cirrus/Kconfig +2 -1
@@ -1,7 +1,8 @@ # SPDX-License-Identifier: GPL-2.0-only config PINCTRL_LOCHNAGAR tristate "Cirrus Logic Lochnagar pinctrl driver" - depends on MFD_LOCHNAGAR + # Avoid clash caused by MIPS defining RST, which is used in the driver + depends on MFD_LOCHNAGAR && !MIPS select GPIOLIB select PINMUX select PINCONF
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/374 ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
[ Upstream commit 7c9caa299335df94ad1c58f70a22f16a540eab60 ]
This patch corrected the speaker and headset mic pin config to the more appropriate values.
--- sound/pci/hda/patch_realtek.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/pci/hda/patch_realtek.c +10 -0
@@ -6854,6 +6854,7 @@ enum {ALC290_FIXUP_SUBWOOFER_HSJACK ,ALC269_FIXUP_THINKPAD_ACPI ,ALC269_FIXUP_DMIC_THINKPAD_ACPI , +ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ,ALC255_FIXUP_ACER_MIC_NO_PRESENCE ,ALC255_FIXUP_ASUS_MIC_NO_PRESENCE , ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -7152,6 +7153,14 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc269_fixup_pincfg_U7x7_headset_mic, }, + [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x18 ,0x03a19020 },/* headset mic */ + {0x1b ,0x90170150 },/* speaker */ + { } + }, + }, [ALC269_FIXUP_AMIC] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -9402,6 +9411,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1d72 ,0x1901 ,"RedmiBook 14" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ), +SND_PCI_QUIRK (0x2782 ,0x0232 ,"CHUWI CoreBook XPro" ,ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ),SND_PCI_QUIRK (0x8086 ,0x2074 ,"Intel NUC 8" ,ALC233_FIXUP_INTEL_NUC8_DMIC ),SND_PCI_QUIRK (0x8086 ,0x2080 ,"Intel NUC 8 Rugged" ,ALC256_FIXUP_INTEL_NUC8_RUGGED ), SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/374 mptcp: fix uninit-value in mptcp_incoming_options
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit 237ff253f2d4f6307b7b20434d7cbcc67693298b ]
Added initialization use_ack to mptcp_parse_option().
--- net/mptcp/options.c | 1 + 1 file changed, 1 insertion(+)
net/mptcp/options.c +1 -0
@@ -103,6 +103,7 @@ static void mptcp_parse_option(const struct sk_buff *skb, mp_opt->suboptions |=OPTION_MPTCP_DSS ; mp_opt->use_map =1 ; mp_opt->mpc_map =1 ; + mp_opt->use_ack =0 ; mp_opt->data_len =get_unaligned_be16 (ptr); ptr +=2 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/374 wifi: cfg80211: lock wiphy mutex for rfkill poll
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 8e2f6f2366219b3304b227bdd2f04b64c92e3e12 ]
We want to guarantee the mutex is held for pretty much all operations, so ensure that here as well.
--- net/wireless/core.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/core.c +2 -0
@@ -216,7 +216,9 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data) {struct cfg80211_registered_device *rdev = data; +wiphy_lock (&rdev->wiphy);rdev_rfkill_poll (rdev); +wiphy_unlock (&rdev->wiphy); } void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/374 debugfs: fix automount d_fsdata usage
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 0ed04a1847a10297595ac24dc7d46b35fb35f90a ]
debugfs_create_automount() stores a function pointer in d_fsdata, but since commit 7c8d469877b1 ("debugfs: add support for more elaborate ->d_fsdata") debugfs_release_dentry() will free it, now conditionally on DEBUGFS_FSDATA_IS_REAL_FOPS_BIT, but that's not set for the function pointer in automount. As a result, removing an automount dentry would attempt to free the function pointer. Luckily, the only user of this (tracing) never removes it.
Nevertheless, it's safer if we just handle the fsdata in one way, namely either DEBUGFS_FSDATA_IS_REAL_FOPS_BIT or allocated. Thus, change the automount to allocate it, and use the real_fops in the data to indicate whether or not automount is filled, rather than adding a type tag. At least for now this isn't actually needed, but the next changes will require it.
Also check in debugfs_file_get() that it gets only called on regular files, just to make things clearer.
--- fs/debugfs/file.c | 8 ++++++++ fs/debugfs/inode.c | 27 ++++++++++++++++++++------- fs/debugfs/internal.h | 10 ++++++++-- 3 files changed, 36 insertions(+), 9 deletions(-)
fs/debugfs/file.c +8 -0
@@ -84,6 +84,14 @@ int debugfs_file_get(struct dentry *dentry)struct debugfs_fsdata *fsd;void *d_fsd; +/* +* This could only happen if some debugfs user erroneously calls +* debugfs_file_get() on a dentry that isn't even a file, let +* them know about it. +*/ +if (WARN_ON (!d_is_reg (dentry))) +return -EINVAL ; + d_fsd =READ_ONCE (dentry->d_fsdata);if (!((unsigned long )d_fsd &DEBUGFS_FSDATA_IS_REAL_FOPS_BIT )) { fsd = d_fsd;
fs/debugfs/inode.c +20 -7
@@ -214,17 +214,19 @@ static const struct super_operations debugfs_super_operations = {static void debugfs_release_dentry (struct dentry *dentry) { -void *fsd = dentry->d_fsdata; +struct debugfs_fsdata *fsd = dentry->d_fsdata; -if (!((unsigned long )fsd &DEBUGFS_FSDATA_IS_REAL_FOPS_BIT )) -kfree (dentry->d_fsdata); +if ((unsigned long )fsd &DEBUGFS_FSDATA_IS_REAL_FOPS_BIT ) +return ; + +kfree (fsd); }static struct vfsmount *debugfs_automount (struct path *path) { -debugfs_automount_t f; - f = (debugfs_automount_t )path->dentry->d_fsdata; -return f (path->dentry,d_inode (path->dentry)->i_private); +struct debugfs_fsdata *fsd = path->dentry->d_fsdata; + +return fsd->automount (path->dentry,d_inode (path->dentry)->i_private); }static const struct dentry_operations debugfs_dops = {
@@ -602,13 +604,23 @@ struct dentry *debugfs_create_automount(const char *name, void *data) {struct dentry *dentry =start_creating (name, parent); +struct debugfs_fsdata *fsd;struct inode *inode;if (IS_ERR (dentry))return dentry; + fsd =kzalloc (sizeof (*fsd),GFP_KERNEL ); +if (!fsd) { +failed_creating (dentry); +return ERR_PTR (-ENOMEM ); + } + + fsd->automount = f; +if (!(debugfs_allow &DEBUGFS_ALLOW_API )) {failed_creating (dentry); +kfree (fsd);return ERR_PTR (-EPERM ); }
@@ -616,13 +628,14 @@ struct dentry *debugfs_create_automount(const char *name,if (unlikely (!inode)) {pr_err ("out of free dentries, can not create automount '%s'\n" , name); +kfree (fsd);return failed_creating (dentry); }make_empty_dir_inode (inode); inode->i_flags |=S_AUTOMOUNT ; inode->i_private = data; - dentry->d_fsdata = (void *)f; + dentry->d_fsdata = fsd;/* directory inodes start off with i_nlink == 2 (for "." entry) */ inc_nlink (inode);d_instantiate (dentry, inode);
fs/debugfs/internal.h +8 -2
@@ -17,8 +17,14 @@ extern const struct file_operations debugfs_full_proxy_file_operations;struct debugfs_fsdata {const struct file_operations *real_fops; -refcount_t active_users; -struct completion active_users_drained; +union { +/* automount_fn is used when real_fops is NULL */ +debugfs_automount_t automount; +struct { +refcount_t active_users; +struct completion active_users_drained; + }; + }; };/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/374 drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Yao <[email protected]>
[ Upstream commit 2161e09cd05a50d80736fe397145340d2e8f6c05 ]
For 'AMDGPU_FAMILY_SI' family cards, in 'si_common_early_init' func, init 'didt_rreg' and 'didt_wreg' to 'NULL'. But in func 'amdgpu_debugfs_regs_didt_read/write', using 'RREG32_DIDT' 'WREG32_DIDT' lacks of relevant judgment. And other 'amdgpu_ip_block_version' that use these two definitions won't be added for 'AMDGPU_FAMILY_SI'.
So, add null pointer judgment before calling.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +6 -0
@@ -342,6 +342,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf,if (size &0x3 || *pos &0x3 )return -EINVAL ; +if (!adev->didt_rreg) +return -EOPNOTSUPP ; + r =pm_runtime_get_sync (adev_to_drm (adev)->dev);if (r <0 ) {pm_runtime_put_autosuspend (adev_to_drm (adev)->dev);
@@ -401,6 +404,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __userif (size &0x3 || *pos &0x3 )return -EINVAL ; +if (!adev->didt_wreg) +return -EOPNOTSUPP ; + r =pm_runtime_get_sync (adev_to_drm (adev)->dev);if (r <0 ) {pm_runtime_put_autosuspend (adev_to_drm (adev)->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/374 nvme-core: check for too small lba shift
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 74fbc88e161424b3b96a22b23a8e3e1edab9d05c ]
The block layer doesn't support logical block sizes smaller than 512 bytes. The nvme spec doesn't support that small either, but the driver isn't checking to make sure the device responded with usable data. Failing to catch this will result in a kernel bug, either from a division by zero when stacking, or a zero length bio.
--- drivers/nvme/host/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/nvme/host/core.c +3 -2
@@ -1846,9 +1846,10 @@ static void nvme_update_disk_info(struct gendisk *disk,/* * The block layer can't support LBA sizes larger than the page size -* yet, so catch this early and don't allow block I/O. +* or smaller than a sector size yet, so catch this early and don't +* allow block I/O. */ -if (ns->lba_shift >PAGE_SHIFT ) { +if (ns->lba_shift >PAGE_SHIFT || ns->lba_shift <SECTOR_SHIFT ) { capacity =0 ; bs = (1 <<9 ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/374 ASoC: wm8974: Correct boost mixer inputs
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 37e6fd0cebf0b9f71afb38fd95b10408799d1f0b ]
Bit 6 of INPPGA (INPPGAMUTE) does not control the Aux path, it controls the input PGA path, as can been seen from Figure 8 Input Boost Stage in the datasheet. Update the naming of things in the driver to match this and update the routing to also reflect this.
--- sound/soc/codecs/wm8974.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wm8974.c +3 -3
@@ -186,7 +186,7 @@ SOC_DAPM_SINGLE("PCM Playback Switch", WM8974_MONOMIX, 0, 1, 0),/* Boost mixer */ static const struct snd_kcontrol_new wm8974_boost_mixer[] = { -SOC_DAPM_SINGLE ("Aux Switch" ,WM8974_INPPGA ,6 ,1 ,1 ), +SOC_DAPM_SINGLE ("PGA Switch" ,WM8974_INPPGA ,6 ,1 ,1 ), };/* Input PGA */
@@ -246,8 +246,8 @@ static const struct snd_soc_dapm_route wm8974_dapm_routes[] = {/* Boost Mixer */ {"ADC", NULL, "Boost Mixer"}, - {"Boost Mixer", "Aux Switch", "Aux Input"}, - {"Boost Mixer", NULL, "Input PGA"}, + {"Boost Mixer", NULL, "Aux Input"}, + {"Boost Mixer", "PGA Switch", "Input PGA"}, {"Boost Mixer", NULL, "MICP"}, /* Input PGA */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/374 ASoC: Intel: Skylake: Fix mem leak in few functions
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Duljas <[email protected]>
[ Upstream commit d5c65be34df73fa01ed05611aafb73b440d89e29 ]
The resources should be freed when function return error.
--- sound/soc/intel/skylake/skl-pcm.c | 4 +++- sound/soc/intel/skylake/skl-sst-ipc.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-)
sound/soc/intel/skylake/skl-pcm.c +3 -1
@@ -251,8 +251,10 @@ static int skl_pcm_open(struct snd_pcm_substream *substream,snd_pcm_set_sync (substream); mconfig =skl_tplg_fe_get_cpr_module (dai, substream->stream); -if (!mconfig) +if (!mconfig) { +kfree (dma_params);return -EINVAL ; + }skl_tplg_d0i3_get (skl, mconfig->d0i3_caps);
sound/soc/intel/skylake/skl-sst-ipc.c +3 -1
@@ -1003,8 +1003,10 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc, reply.size = (reply.header >>32 ) &IPC_DATA_OFFSET_SZ_MASK ; buf =krealloc (reply.data, reply.size,GFP_KERNEL ); -if (!buf) +if (!buf) { +kfree (reply.data);return -ENOMEM ; + } *payload = buf; *bytes = reply.size;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/374 ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lin <[email protected]>
[ Upstream commit c1501f2597dd08601acd42256a4b0a0fc36bf302 ]
This issue is reproduced when W=1 build in compiler gcc-12. The following are sparse warnings:
sound/soc/codecs/nau8822.c:199:25: sparse: sparse: incorrect type in assignment sound/soc/codecs/nau8822.c:199:25: sparse: expected unsigned short sound/soc/codecs/nau8822.c:199:25: sparse: got restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16
--- sound/soc/codecs/nau8822.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/codecs/nau8822.c +6 -3
@@ -184,6 +184,7 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol,struct soc_bytes_ext *params = (void *)kcontrol->private_value;int i, reg;u16 reg_val, *val; +__be16 tmp; val = (u16 *)ucontrol->value.bytes.data; reg =NAU8822_REG_EQ1 ;
@@ -192,8 +193,8 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol,/* conversion of 16-bit integers between native CPU format * and big endian format */ - reg_val =cpu_to_be16 (reg_val); -memcpy (val + i, ®_val,sizeof (reg_val)); + tmp =cpu_to_be16 (reg_val); +memcpy (val + i, &tmp,sizeof (tmp)); }return 0 ;
@@ -216,6 +217,7 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol,void *data;u16 *val, value;int i, reg, ret; +__be16 *tmp; data =kmemdup (ucontrol->value.bytes.data, params->max,GFP_KERNEL |GFP_DMA );
@@ -228,7 +230,8 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol,/* conversion of 16-bit integers between native CPU format * and big endian format */ - value =be16_to_cpu (*(val + i)); + tmp = (__be16 *)(val + i); + value =be16_to_cpup (tmp); ret =snd_soc_component_write (component, reg + i, value);if (ret) { dev_err(component->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/374 ASoC: Intel: Skylake: mem leak in skl register function
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Duljas <[email protected]>
[ Upstream commit f8ba14b780273fd290ddf7ee0d7d7decb44cc365 ]
skl_platform_register() uses krealloc. When krealloc is fail, then previous memory is not freed. The leak is also when soc component registration failed.
--- sound/soc/intel/skylake/skl-pcm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/intel/skylake/skl-pcm.c +4 -1
@@ -1467,6 +1467,7 @@ int skl_platform_register(struct device *dev) dais =krealloc (skl->dais,sizeof (skl_fe_dai) +sizeof (skl_platform_dai),GFP_KERNEL );if (!dais) { +kfree (skl->dais); ret = -ENOMEM ; goto err; }
@@ -1479,8 +1480,10 @@ int skl_platform_register(struct device *dev) ret =devm_snd_soc_register_component (dev, &skl_component, skl->dais, num_dais); -if (ret) +if (ret) { +kfree (skl->dais);dev_err (dev,"soc component registration failed %d\n" , ret); + } err:return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/374 ASoC: cs43130: Fix the position of const qualifier
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Strozek <[email protected]>
[ Upstream commit e7f289a59e76a5890a57bc27b198f69f175f75d9 ]
--- sound/soc/codecs/cs43130.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/cs43130.c +2 -2
@@ -1684,7 +1684,7 @@ static ssize_t hpload_dc_r_show(struct device *dev,return cs43130_show_dc (dev, buf,HP_RIGHT ); } -static u16 const cs43130_ac_freq[CS43130_AC_FREQ ] = { +static const u16 cs43130_ac_freq[CS43130_AC_FREQ ] = {24 ,43 ,93 ,
@@ -2365,7 +2365,7 @@ static const struct regmap_config cs43130_regmap = { .use_single_write = true, }; -static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD ] = { +static const u16 cs43130_dc_threshold[CS43130_DC_THRESHOLD ] = {50 ,120 , };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/374 ASoC: cs43130: Fix incorrect frame delay configuration
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Strozek <[email protected]>
[ Upstream commit aa7e8e5e4011571022dc06e4d7a2f108feb53d1a ]
--- sound/soc/codecs/cs43130.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/cs43130.c +1 -1
@@ -579,7 +579,7 @@ static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk,break ;case SND_SOC_DAIFMT_LEFT_J : hi_size = bitwidth_sclk; - frm_delay =2 ; + frm_delay =0 ; frm_phase =1 ;break ;case SND_SOC_DAIFMT_DSP_A :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/374 ASoC: rt5650: add mutex to avoid the jack detection failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuming Fan <[email protected]>
[ Upstream commit cdba4301adda7c60a2064bf808e48fccd352aaa9 ]
This patch adds the jd_mutex to protect the jack detection control flow. And only the headset type could check the button status.
--- sound/soc/codecs/rt5645.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
sound/soc/codecs/rt5645.c +9 -1
@@ -448,6 +448,7 @@ struct rt5645_priv {struct regulator_bulk_data supplies[ARRAY_SIZE (rt5645_supply_names)];struct rt5645_eq_param_s *eq_param;struct timer_list btn_check_timer; +struct mutex jd_mutex;int codec_type;int sysclk;
@@ -3189,6 +3190,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_insert5645_enable_push_button_irq (component, true); } }else { +if (rt5645->en_button_func) +rt5645_enable_push_button_irq (component, false);snd_soc_dapm_disable_pin (dapm,"Mic Det Power" );snd_soc_dapm_sync (dapm); rt5645->jack_type =SND_JACK_HEADPHONE ;
@@ -3269,6 +3272,8 @@ static void rt5645_jack_detect_work(struct work_struct *work)if (!rt5645->component)return ; +mutex_lock (&rt5645->jd_mutex); +switch (rt5645->pdata.jd_mode) {case 0 :/* Not using rt5645 JD */ if (rt5645->gpiod_hp_det) {
@@ -3295,7 +3300,7 @@ static void rt5645_jack_detect_work(struct work_struct *work)if (!val && (rt5645->jack_type ==0 )) {/* jack in */ report =rt5645_jack_detect (rt5645->component,1 ); - }else if (!val && rt5645->jack_type !=0 ) { + }else if (!val && rt5645->jack_type ==SND_JACK_HEADSET ) {/* for push button and jack out */ btn_type =0 ;if (snd_soc_component_read (rt5645->component,RT5645_INT_IRQ_ST ) &0x4 ) {
@@ -3351,6 +3356,8 @@ static void rt5645_jack_detect_work(struct work_struct *work)rt5645_jack_detect (rt5645->component,0 ); } +mutex_unlock (&rt5645->jd_mutex); +snd_soc_jack_report (rt5645->hp_jack, report,SND_JACK_HEADPHONE );snd_soc_jack_report (rt5645->mic_jack, report,SND_JACK_MICROPHONE );if (rt5645->en_button_func)
@@ -4121,6 +4128,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, }timer_setup (&rt5645->btn_check_timer, rt5645_btn_check_callback,0 ); +mutex_init (&rt5645->jd_mutex);INIT_DELAYED_WORK (&rt5645->jack_detect_work, rt5645_jack_detect_work);INIT_DELAYED_WORK (&rt5645->rcclock_work, rt5645_rcclock_work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/374 nouveau/tu102: flush all pdbs on vmm flush
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
[ Upstream commit cb9c919364653eeafb49e7ff5cd32f1ad64063ac ]
This is a hack around a bug exposed with the GSP code, I'm not sure what is happening exactly, but it appears some of our flushes don't result in proper tlb invalidation for out BAR2 and we get a BAR2 fault from GSP and it all dies.
--- drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c +1 -1
@@ -31,7 +31,7 @@ tu102_vmm_flush(struct nvkm_vmm *vmm, int depth) type |=0x00000001 ;/* PAGE_ALL */ if (atomic_read (&vmm->engref[NVKM_SUBDEV_BAR ])) - type |=0x00000004 ;/* HUB_ONLY */ + type |=0x00000006 ;/* HUB_ONLY | ALL PDB (hack) */ mutex_lock (&vmm->mmu->mutex);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/374 net/tg3: fix race condition in tg3_reset_task()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Tran <[email protected]>
[ Upstream commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 ]
When an EEH error is encountered by a PCI adapter, the EEH driver modifies the PCI channel's state as shown below:
enum {
/* I/O channel is in normal state */ pci_channel_io_normal = (__force pci_channel_state_t) 1,
/* I/O to channel is blocked */ pci_channel_io_frozen = (__force pci_channel_state_t) 2,
/* PCI card is dead */
pci_channel_io_perm_failure = (__force pci_channel_state_t) 3,
};
If the same EEH error then causes the tg3 driver's transmit timeout logic to execute, the tg3_tx_timeout() function schedules a reset task via tg3_reset_task_schedule(), which may cause a race condition between the tg3 and EEH driver as both attempt to recover the HW via a reset action.
EEH driver gets error event
--> eeh_set_channel_state()
and set device to one of
error state above scheduler: tg3_reset_task() get
returned error from tg3_init_hw()
--> dev_close() shuts down the interfacetg3_io_slot_reset() andtg3_io_resume() fail to
reset/resume the device
To resolve this issue, we avoid the race condition by checking the PCI channel state in the tg3_reset_task() function and skip the tg3 driver initiated reset when the PCI channel is not in the normal state. (The driver has no access to tg3 device registers at this point and cannot even complete the reset task successfully without external assistance.) We'll leave the reset procedure to be managed by the EEH driver which calls the tg3_io_error_detected(), tg3_io_slot_reset() and tg3_io_resume() functions as appropriate.
Adding the same checking in tg3_dump_state() to avoid dumping all device registers when the PCI channel is not in the normal state.
--- drivers/net/ethernet/broadcom/tg3.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/tg3.c +10 -1
@@ -6448,6 +6448,14 @@ static void tg3_dump_state(struct tg3 *tp)int i;u32 *regs; +/* If it is a PCI error, all registers will be 0xffff, +* we don't dump them out, just report the error and return +*/ +if (tp->pdev->error_state != pci_channel_io_normal) { +netdev_err (tp->dev,"PCI channel ERROR!\n" ); +return ; + } + regs =kzalloc (TG3_REG_BLK_SIZE ,GFP_ATOMIC );if (!regs)return ;
@@ -11186,7 +11194,8 @@ static void tg3_reset_task(struct work_struct *work)rtnl_lock ();tg3_full_lock (tp,0 ); -if (tp->pcierr_recovery || !netif_running (tp->dev)) { +if (tp->pcierr_recovery || !netif_running (tp->dev) || + tp->pdev->error_state != pci_channel_io_normal) {tg3_flag_clear (tp,RESET_TASK_PENDING );tg3_full_unlock (tp);rtnl_unlock ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/374 ASoC: da7219: Support low DC impedance headset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rau <[email protected]>
[ Upstream commit 5f44de697383fcc9a9a1a78f99e09d1838704b90 ]
Change the default MIC detection impedance threshold to 200ohm to support low mic DC impedance headset.
--- sound/soc/codecs/da7219-aad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/da7219-aad.c +1 -1
@@ -654,7 +654,7 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev) aad_pdata->mic_det_thr =da7219_aad_fw_mic_det_thr (dev, fw_val32); else - aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_500_OHMS; + aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_200_OHMS;if (fwnode_property_read_u32 (aad_np,"dlg,jack-ins-deb" , &fw_val32) >=0 ) aad_pdata->jack_ins_deb =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/374 ASoC: ops: add correct range check for limiting volume
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <[email protected]>
[ Upstream commit fb9ad24485087e0f00d84bee7a5914640b2b9024 ]
Volume can have ranges that start with negative values, ex: -84dB to +40dB. Apply correct range check in snd_soc_limit_volume before setting the platform_max. Without this patch, for example setting a 0dB limit on a volume range of -84dB to +40dB would fail.
--- sound/soc/soc-ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-ops.c +1 -1
@@ -644,7 +644,7 @@ int snd_soc_limit_volume(struct snd_soc_card *card, kctl =snd_soc_card_get_kcontrol (card, name);if (kctl) {struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; -if (max <= mc->max) { +if (max <= mc->max - mc->min) { mc->platform_max = max; ret =0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/374 nvme: introduce helper function to get ctrl state
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 5c687c287c46fadb14644091823298875a5216aa ]
The controller state is typically written by another CPU, so reading it should ensure no optimizations are taken. This is a repeated pattern in the driver, so start with adding a convenience function that returns the controller state with READ_ONCE().
--- drivers/nvme/host/nvme.h | 5 +++++ 1 file changed, 5 insertions(+)
drivers/nvme/host/nvme.h +5 -0
@@ -365,6 +365,11 @@ struct nvme_ctrl {struct nvme_fault_inject fault_inject; }; +static inline enum nvme_ctrl_state nvme_ctrl_state (struct nvme_ctrl *ctrl) +{ +return READ_ONCE (ctrl->state); +} +enum nvme_iopolicy {NVME_IOPOLICY_NUMA ,NVME_IOPOLICY_RR ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/374 drm/amdgpu: Add NULL checks for function pointers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit 81577503efb49f4ad76af22f9941d72900ef4aab ]
Check if function is implemented before making the call.
--- drivers/gpu/drm/amd/amdgpu/soc15.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/soc15.c +8 -4
@@ -1615,9 +1615,11 @@ static void soc15_common_get_clockgating_state(void *handle, u32 *flags)if (amdgpu_sriov_vf (adev)) *flags =0 ; - adev->nbio.funcs->get_clockgating_state (adev, flags); +if (adev->nbio.funcs && adev->nbio.funcs->get_clockgating_state) + adev->nbio.funcs->get_clockgating_state (adev, flags); - adev->hdp.funcs->get_clock_gating_state (adev, flags); +if (adev->hdp.funcs && adev->hdp.funcs->get_clock_gating_state) + adev->hdp.funcs->get_clock_gating_state (adev, flags);if (adev->asic_type !=CHIP_ALDEBARAN ) {
@@ -1633,9 +1635,11 @@ static void soc15_common_get_clockgating_state(void *handle, u32 *flags) }/* AMD_CG_SUPPORT_ROM_MGCG */ - adev->smuio.funcs->get_clock_gating_state (adev, flags); +if (adev->smuio.funcs && adev->smuio.funcs->get_clock_gating_state) + adev->smuio.funcs->get_clock_gating_state (adev, flags); - adev->df.funcs->get_clockgating_state (adev, flags); +if (adev->df.funcs && adev->df.funcs->get_clockgating_state) + adev->df.funcs->get_clockgating_state (adev, flags); } static int soc15_common_set_powergating_state(void *handle,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/374 drm/exynos: fix a potential error pointer dereference
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Yang <[email protected]>
[ Upstream commit 73bf1c9ae6c054c53b8e84452c5e46f86dd28246 ]
Smatch reports the warning below:drivers/gpu/drm/exynos/exynos_hdmi.c:1864 hdmi_bind()
error: 'crtc' dereferencing possible ERR_PTR()
The return value of exynos_drm_crtc_get_by_type maybe ERR_PTR(-ENODEV), which can not be used directly. Fix this by checking the return value before using it.
--- drivers/gpu/drm/exynos/exynos_hdmi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/exynos/exynos_hdmi.c +2 -0
@@ -1861,6 +1861,8 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)return ret; crtc =exynos_drm_crtc_get_by_type (drm_dev,EXYNOS_DISPLAY_TYPE_HDMI ); +if (IS_ERR (crtc)) +return PTR_ERR (crtc); crtc->pipe_clk = &hdata->phy_clk; ret =hdmi_create_connector (encoder);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/374 drm/exynos: fix a wrong error checking
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inki Dae <[email protected]>
[ Upstream commit 8d1b7809684c688005706125b804e1f9792d2b1b ]
Fix a wrong error checking in exynos_drm_dma.c module.
In the exynos_drm_register_dma function, both arm_iommu_create_mapping() and iommu_get_domain_for_dev() functions are expected to return NULL as an error.
However, the error checking is performed using the statement if(IS_ERR(mapping)), which doesn't provide a suitable error value. So check if 'mapping' is NULL, and if it is, return -ENODEV.
This issue[1] was reported by Dan.
Changelog v1:
- fix build warning.
[1] https://lore.kernel.org/all/[email protected]/
--- drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/gpu/drm/exynos/exynos_drm_dma.c +3 -5
@@ -108,18 +108,16 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev,return 0 ;if (!priv->mapping) { -void *mapping; +void *mapping =NULL ;if (IS_ENABLED (CONFIG_ARM_DMA_USE_IOMMU )) mapping =arm_iommu_create_mapping (&platform_bus_type,EXYNOS_DEV_ADDR_START ,EXYNOS_DEV_ADDR_SIZE );else if (IS_ENABLED (CONFIG_IOMMU_DMA )) mapping =iommu_get_domain_for_dev (priv->dma_dev); -else - mapping =ERR_PTR (-ENODEV ); -if (IS_ERR (mapping)) -return PTR_ERR (mapping); +if (!mapping) +return -ENODEV ; priv->mapping = mapping; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/374 hwmon: (corsair-psu) Fix probe when built-in
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 307004e8b254ad28e150b63f299ab9caa4bc7c3e ]
It seems that when the driver is built-in, the HID bus is initialized after the driver is loaded, which whould cause module_hid_driver() to fail.
Fix this by registering the driver after the HID bus using late_initcall() in accordance with other hwmon HID drivers.
[groeck: Dropped "compile tested" comment; the patch has been tested
but the tester did not provide a Tested-by: tag]
--- drivers/hwmon/corsair-psu.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/hwmon/corsair-psu.c +17 -1
@@ -808,7 +808,23 @@ static struct hid_driver corsairpsu_driver = { .reset_resume = corsairpsu_resume,#endif }; -module_hid_driver (corsairpsu_driver); + +static int __init corsair_init (void ) +{ +return hid_register_driver (&corsairpsu_driver); +} + +static void __exit corsair_exit(void) +{ +hid_unregister_driver (&corsairpsu_driver); +} + +/* +* With module_init() the driver would load before the HID bus when +* built-in, so use late_initcall() instead. +*/ +late_initcall (corsair_init); +module_exit (corsair_exit);MODULE_LICENSE ("GPL" );MODULE_AUTHOR ("Wilken Gottwalt <[email protected]>" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/374 clk: rockchip: rk3128: Fix HCLK_OTG gate register
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weihao Li <[email protected]>
[ Upstream commit c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2 ]
The HCLK_OTG gate control is in CRU_CLKGATE5_CON, not CRU_CLKGATE3_CON.
--- drivers/clk/rockchip/clk-rk3128.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-rk3128.c +1 -1
@@ -490,7 +490,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {GATE (HCLK_I2S_2CH ,"hclk_i2s_2ch" ,"hclk_peri" ,0 ,RK2928_CLKGATE_CON (7 ),2 ,GFLAGS ),GATE (0 ,"hclk_usb_peri" ,"hclk_peri" ,CLK_IGNORE_UNUSED ,RK2928_CLKGATE_CON (9 ),13 ,GFLAGS ),GATE (HCLK_HOST2 ,"hclk_host2" ,"hclk_peri" ,0 ,RK2928_CLKGATE_CON (7 ),3 ,GFLAGS ), -GATE (HCLK_OTG ,"hclk_otg" ,"hclk_peri" ,0 ,RK2928_CLKGATE_CON (3 ),13 ,GFLAGS ), +GATE (HCLK_OTG ,"hclk_otg" ,"hclk_peri" ,0 ,RK2928_CLKGATE_CON (5 ),13 ,GFLAGS ),GATE (0 ,"hclk_peri_ahb" ,"hclk_peri" ,CLK_IGNORE_UNUSED ,RK2928_CLKGATE_CON (9 ),14 ,GFLAGS ),GATE (HCLK_SPDIF ,"hclk_spdif" ,"hclk_peri" ,0 ,RK2928_CLKGATE_CON (10 ),9 ,GFLAGS ), GATE(HCLK_TSP, "hclk_tsp", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 12, GFLAGS),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/374 jbd2: correct the printing of write_flags in jbd2_write_superblock()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 85559227211020b270728104c3b89918f7af27ac ]
The write_flags print in the trace of jbd2_write_superblock() is not real, so move the modification before the trace.
--- fs/jbd2/journal.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/jbd2/journal.c +3 -1
@@ -1616,9 +1616,11 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)return -EIO ; } -trace_jbd2_write_superblock (journal, write_flags);if (!(journal->j_flags &JBD2_BARRIER )) write_flags &= ~(REQ_FUA |REQ_PREFLUSH ); + +trace_jbd2_write_superblock (journal, write_flags); +if (buffer_write_io_error (bh)) {/* * Oh, dear. A previous attempt to write the journal
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/374 drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziqi Zhao <[email protected]>
[ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ]
The connector_set contains uninitialized values when allocated with kmalloc_array. However, in the "out" branch, the logic assumes that any element in connector_set would be equal to NULL if failed to initialize, which causes the bug reported by Syzbot. The fix is to use an extra variable to keep track of how many connectors are initialized indeed, and use that variable to decrease any refcounts in the "out" branch.
--- drivers/gpu/drm/drm_crtc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/drm_crtc.c +5 -4
@@ -643,8 +643,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,struct drm_mode_set set;uint32_t __user *set_connectors_ptr;struct drm_modeset_acquire_ctx ctx; -int ret; -int i; +int ret, i, num_connectors;if (!drm_core_check_feature (dev,DRIVER_MODESET ))return -EOPNOTSUPP ;
@@ -779,6 +778,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, goto out; } + num_connectors =0 ;for (i =0 ; i < crtc_req->count_connectors; i++) { connector_set[i] =NULL ; set_connectors_ptr = (uint32_t __user *)(unsigned long )crtc_req->set_connectors_ptr;
@@ -799,6 +799,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, connector->name); connector_set[i] = connector; + num_connectors++; } }
@@ -807,7 +808,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, set.y = crtc_req->y; set.mode = mode; set.connectors = connector_set; - set.num_connectors = crtc_req->count_connectors; + set.num_connectors = num_connectors; set.fb = fb;if (drm_drv_uses_atomic_modeset (dev))
@@ -820,7 +821,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,drm_framebuffer_put (fb);if (connector_set) { -for (i =0 ; i < crtc_req->count_connectors; i++) { +for (i =0 ; i < num_connectors; i++) {if (connector_set[i])drm_connector_put (connector_set[i]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/374 neighbour: Dont let neigh_forced_gc() disable preemption for long
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judy Hsiao <[email protected]>
[ Upstream commit e5dc5afff62f3e97e86c3643ec9fcad23de4f2d3 ]
We are seeing cases where neigh_cleanup_and_release() is called by neigh_forced_gc() many times in a row with preemption turned off. When running on a low powered CPU at a low CPU frequency, this has been measured to keep preemption off for ~10 ms. That's not great on a system with HZ=1000 which expects tasks to be able to schedule in with ~1ms latency.
--- net/core/neighbour.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/core/neighbour.c +8 -1
@@ -225,9 +225,11 @@ static int neigh_forced_gc(struct neigh_table *tbl) {int max_clean =atomic_read (&tbl->gc_entries) -READ_ONCE (tbl->gc_thresh2); +u64 tmax =ktime_get_ns () +NSEC_PER_MSEC ;unsigned long tref = jiffies -5 *HZ ;struct neighbour *n, *tmp;int shrunk =0 ; +int loop =0 ;NEIGH_CACHE_STAT_INC (tbl, forced_gc_runs);
@@ -250,11 +252,16 @@ static int neigh_forced_gc(struct neigh_table *tbl) shrunk++;if (shrunk >= max_clean)break ; +if (++loop ==16 ) { +if (ktime_get_ns () > tmax) + goto unlock; + loop =0 ; + } } }WRITE_ONCE (tbl->last_flush, jiffies); - +unlock:write_unlock_bh (&tbl->lock);return shrunk;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/374 platform/x86: intel-vbtn: Fix missing tablet-mode-switch events
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 14c200b7ca46b9a9f4af9e81d258a58274320b6f ]
2 issues have been reported on the Dell Inspiron 7352:
1. Sometimes the tablet-mode-switch stops reporting tablet-mode change events.
Add a "VBDL" call to notify_handler() to work around this.
2. Sometimes the tablet-mode is incorrect after suspend/resume
Add a detect_tablet_mode() to resume() to fix this.
--- drivers/platform/x86/intel/vbtn.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/platform/x86/intel/vbtn.c +15 -4
@@ -73,10 +73,10 @@ struct intel_vbtn_priv {bool wakeup_mode; }; -static void detect_tablet_mode (struct platform_device *device) +static void detect_tablet_mode (struct device *dev) { -struct intel_vbtn_priv *priv =dev_get_drvdata (&device->dev); -acpi_handle handle =ACPI_HANDLE (&device->dev); +struct intel_vbtn_priv *priv =dev_get_drvdata (dev); +acpi_handle handle =ACPI_HANDLE (dev);unsigned long long vgbs;acpi_status status;int m;
@@ -89,6 +89,8 @@ static void detect_tablet_mode(struct platform_device *device)input_report_switch (priv->switches_dev,SW_TABLET_MODE , m); m = (vgbs &VGBS_DOCK_MODE_FLAG ) ?1 :0 ;input_report_switch (priv->switches_dev,SW_DOCK , m); + +input_sync (priv->switches_dev); }/*
@@ -134,7 +136,7 @@ static int intel_vbtn_input_setup(struct platform_device *device) priv->switches_dev->id.bustype =BUS_HOST ;if (priv->has_switches) { -detect_tablet_mode (device); +detect_tablet_mode (&device->dev); ret =input_register_device (priv->switches_dev);if (ret)
@@ -198,6 +200,9 @@ static void notify_handler(acpi_handle handle, u32 event, void *context) autorelease = val && (!ke_rel || ke_rel->type ==KE_IGNORE );sparse_keymap_report_event (input_dev, event, val, autorelease); + +/* Some devices need this to report further events */ +acpi_evaluate_object (handle,"VBDL" ,NULL ,NULL ); }/*
@@ -358,7 +363,13 @@ static void intel_vbtn_pm_complete(struct device *dev)static int intel_vbtn_pm_resume (struct device *dev) { +struct intel_vbtn_priv *priv =dev_get_drvdata (dev); +intel_vbtn_pm_complete (dev); + +if (priv->has_switches) +detect_tablet_mode (dev); +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/374 jbd2: fix soft lockup in journal_finish_inode_data_buffers()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit 6c02757c936063f0631b4e43fe156f8c8f1f351f ]
There's issue when do io test:
WARN: soft lockup - CPU#45 stuck for 11s! [jbd2/dm-2-8:4170]
CPU: 45 PID: 4170 Comm: jbd2/dm-2-8 Kdump: loaded Tainted: G OE Call trace: dump_backtrace+0x0/0x1a0 show_stack+0x24/0x30 dump_stack+0xb0/0x100 watchdog_timer_fn+0x254/0x3f8 __hrtimer_run_queues+0x11c/0x380 hrtimer_interrupt+0xfc/0x2f8 arch_timer_handler_phys+0x38/0x58 handle_percpu_devid_irq+0x90/0x248 generic_handle_irq+0x3c/0x58 __handle_domain_irq+0x68/0xc0 gic_handle_irq+0x90/0x320 el1_irq+0xcc/0x180 queued_spin_lock_slowpath+0x1d8/0x320 jbd2_journal_commit_transaction+0x10f4/0x1c78 [jbd2] kjournald2+0xec/0x2f0 [jbd2] kthread+0x134/0x138 ret_from_fork+0x10/0x18
Analyzed informations from vmcore as follows:
(1) There are about 5k+ jbd2_inode in 'commit_transaction->t_inode_list';
(2) Now is processing the 855th jbd2_inode;
(3) JBD2 task has TIF_NEED_RESCHED flag;
(4) There's no pags in address_space around the 855th jbd2_inode;
(5) There are some process is doing drop caches;
(6) Mounted with 'nodioread_nolock' option;
(7) 128 CPUs;
According to informations from vmcore we know 'journal->j_list_lock' spin lock competition is fierce. So journal_finish_inode_data_buffers() maybe process slowly. Theoretically, there is scheduling point in the filemap_fdatawait_range_keep_errors(). However, if inode's address_space has no pages which taged with PAGECACHE_TAG_WRITEBACK, will not call cond_resched(). So may lead to soft lockup. journal_finish_inode_data_buffers
filemap_fdatawait_range_keep_errors
__filemap_fdatawait_range
while (index <= end)
nr_pages = pagevec_lookup_range_tag(&pvec, mapping, &index, end, PAGECACHE_TAG_WRITEBACK);
if (!nr_pages)
break; --> If 'nr_pages' is equal zero will break, then will not call cond_resched()
for (i = 0; i < nr_pages; i++)
wait_on_page_writeback(page);
cond_resched();To solve above issue, add scheduling point in the journal_finish_inode_data_buffers();
--- fs/jbd2/commit.c | 1 + 1 file changed, 1 insertion(+)
fs/jbd2/commit.c +1 -0
@@ -300,6 +300,7 @@ static int journal_finish_inode_data_buffers(journal_t *journal,if (!ret) ret = err; } +cond_resched ();spin_lock (&journal->j_list_lock); jinode->i_flags &= ~JI_COMMIT_RUNNING ;smp_mb ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/374 tracing: Have large events show up as [LINE TOO BIG] instead of nothing
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit b55b0a0d7c4aa2dac3579aa7e6802d1f57445096 ]
If a large event was added to the ring buffer that is larger than what the trace_seq can handle, it just drops the output:
~# cat /sys/kernel/tracing/trace
# tracer: nop
#
# entries-in-buffer/entries-written: 2/2 #P:8
#
# _-----=> irqs-off/BH-disabled
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / _-=> migrate-disable
# |||| / delay
# TASK-PID CPU# ||||| TIMESTAMP FUNCTION
# | | | ||||| | |
<...>-859 [001] ..... 141.118951: tracing_mark_write <...>-859 [001] ..... 141.148201: tracing_mark_write: 78901234Instead, catch this case and add some context:
~# cat /sys/kernel/tracing/trace
# tracer: nop
#
# entries-in-buffer/entries-written: 2/2 #P:8
#
# _-----=> irqs-off/BH-disabled
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / _-=> migrate-disable
# |||| / delay
# TASK-PID CPU# ||||| TIMESTAMP FUNCTION
# | | | ||||| | |
<...>-852 [001] ..... 121.550551: tracing_mark_write[LINE TOO BIG]
<...>-852 [001] ..... 121.550581: tracing_mark_write: 78901234This now emulates the same output as trace_pipe.
--- kernel/trace/trace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/trace/trace.c +5 -1
@@ -4667,7 +4667,11 @@ static int s_show(struct seq_file *m, void *v) iter->leftover = ret; }else { -print_trace_line (iter); + ret =print_trace_line (iter); +if (ret ==TRACE_TYPE_PARTIAL_LINE ) { + iter->seq.full =0 ; +trace_seq_puts (&iter->seq,"[LINE TOO BIG]\n" ); + } ret =trace_print_seq (m, &iter->seq);/* * If we overflow the seq_file buffer, then it will
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/374 tracing: Add size check when printing trace_marker output
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 60be76eeabb3d83858cc6577fc65c7d0f36ffd42 ]
If for some reason the trace_marker write does not have a nul byte for the string, it will overflow the print:
trace_seq_printf(s, ": %s", field->buf);
The field->buf could be missing the nul byte. To prevent overflow, add the max size that the buf can be by using the event size and the field location.
int max = iter->ent_size - offsetof(struct print_entry, buf); trace_seq_printf(s, ": %*.s", max, field->buf);
--- kernel/trace/trace_output.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/trace/trace_output.c +4 -2
@@ -1446,11 +1446,12 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter, {struct print_entry *field;struct trace_seq *s = &iter->seq; +int max = iter->ent_size - offsetof(struct print_entry , buf);trace_assign_type (field, iter->ent);seq_print_ip_sym (s, field->ip, flags); -trace_seq_printf (s,": %s" , field->buf); +trace_seq_printf (s,": %.*s" , max, field->buf);return trace_handle_return (s); }
@@ -1459,10 +1460,11 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags, struct trace_event *event) {struct print_entry *field; +int max = iter->ent_size - offsetof(struct print_entry , buf);trace_assign_type (field, iter->ent); -trace_seq_printf (&iter->seq,"# %lx %s" , field->ip, field->buf); +trace_seq_printf (&iter->seq,"# %lx %.*s" , field->ip, max, field->buf);return trace_handle_return (&iter->seq); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/374 stmmac: dwmac-loongson: drop useless check for compatible fallback
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 31fea092c6f9f8fb2c40a08137907f5fbeae55dd ]
Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS, so checking for some other compatible does not make sense. It cannot be bound to unsupported platform.
Drop useless, incorrect (space in between) and undocumented compatible.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +0 -5
@@ -59,11 +59,6 @@ static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_idreturn -ENODEV ; } -if (!of_device_is_compatible (np,"loongson, pci-gmac" )) { -pr_info ("dwmac_loongson_pci: Incompatible OF node\n" ); -return -ENODEV ; - } - plat =devm_kzalloc (&pdev->dev,sizeof (*plat),GFP_KERNEL );if (!plat)return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/374 MIPS: dts: loongson: drop incorrect dwmac fallback compatible
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 4907a3f54b12b8209864572a312cf967befcae80 ]
Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS, so checking for some other compatible does not make sense. It cannot be bound to unsupported platform.
Drop useless, incorrect (space in between) and undocumented compatible.
--- arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi | 3 +-- arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)
arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi +1 -2
@@ -118,8 +118,7 @@ gmac@3,0 { compatible = "pci0014,7a03.0", "pci0014,7a03", "pciclass0c0320", - "pciclass0c03", - "loongson, pci-gmac"; + "pciclass0c03"; reg = <0x1800 0x0 0x0 0x0 0x0>; interrupts = <12 IRQ_TYPE_LEVEL_LOW>,
arch/mips/boot/dts/loongson/ls7a-pch.dtsi +1 -2
@@ -186,8 +186,7 @@ gmac@3,0 { compatible = "pci0014,7a03.0", "pci0014,7a03", "pciclass020000", - "pciclass0200", - "loongson, pci-gmac"; + "pciclass0200"; reg = <0x1800 0x0 0x0 0x0 0x0>; interrupts = <12 IRQ_TYPE_LEVEL_HIGH>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/374 tracing: Fix uaf issue when open the hist or hist_debug file
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit 1cc111b9cddc71ce161cd388f11f0e9048edffdb ]
KASAN report following issue. The root cause is when opening 'hist' file of an instance and accessing 'trace_event_file' in hist_show(), but 'trace_event_file' has been freed due to the instance being removed. 'hist_debug' file has the same problem. To fix it, call tracing_{open,release}_file_tr() in file_operations callback to have the ref count and avoid 'trace_event_file' being freed.
BUG: KASAN: slab-use-after-free in hist_show+0x11e0/0x1278 Read of size 8 at addr ffff242541e336b8 by task head/190 CPU: 4 PID: 190 Comm: head Not tainted 6.7.0-rc5-g26aff849438c #133 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x98/0xf8 show_stack+0x1c/0x30 dump_stack_lvl+0x44/0x58 print_report+0xf0/0x5a0 kasan_report+0x80/0xc0 __asan_report_load8_noabort+0x1c/0x28 hist_show+0x11e0/0x1278 seq_read_iter+0x344/0xd78 seq_read+0x128/0x1c0 vfs_read+0x198/0x6c8 ksys_read+0xf4/0x1e0 __arm64_sys_read+0x70/0xa8 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Allocated by task 188: kasan_save_stack+0x28/0x50 kasan_set_track+0x28/0x38 kasan_save_alloc_info+0x20/0x30 __kasan_slab_alloc+0x6c/0x80 kmem_cache_alloc+0x15c/0x4a8 trace_create_new_event+0x84/0x348 __trace_add_new_event+0x18/0x88 event_trace_add_tracer+0xc4/0x1a0 trace_array_create_dir+0x6c/0x100 trace_array_create+0x2e8/0x568 instance_mkdir+0x48/0x80 tracefs_syscall_mkdir+0x90/0xe8 vfs_mkdir+0x3c4/0x610 do_mkdirat+0x144/0x200 __arm64_sys_mkdirat+0x8c/0xc0 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170 Freed by task 191: kasan_save_stack+0x28/0x50 kasan_set_track+0x28/0x38 kasan_save_free_info+0x34/0x58 __kasan_slab_free+0xe4/0x158 kmem_cache_free+0x19c/0x508 event_file_put+0xa0/0x120 remove_event_file_dir+0x180/0x320 event_trace_del_tracer+0xb0/0x180 __remove_instance+0x224/0x508 instance_rmdir+0x44/0x78 tracefs_syscall_rmdir+0xbc/0x140 vfs_rmdir+0x1cc/0x4c8 do_rmdir+0x220/0x2b8 __arm64_sys_unlinkat+0xc0/0x100 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xb0/0x280 do_el0_svc+0x44/0x60 el0_svc+0x34/0x68 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x168/0x170
--- kernel/trace/trace.c | 6 ++++++ kernel/trace/trace.h | 1 + kernel/trace/trace_events_hist.c | 12 ++++++++---- 3 files changed, 15 insertions(+), 4 deletions(-)
kernel/trace/trace.c +6 -0
@@ -4904,6 +4904,12 @@ int tracing_release_file_tr(struct inode *inode, struct file *filp)return 0 ; } +int tracing_single_release_file_tr (struct inode *inode,struct file *filp) +{ +tracing_release_file_tr (inode, filp); +return single_release (inode, filp); +} +static int tracing_mark_open (struct inode *inode,struct file *filp) {stream_open (inode, filp);
kernel/trace/trace.h +1 -0
@@ -593,6 +593,7 @@ int tracing_open_generic(struct inode *inode, struct file *filp);int tracing_open_generic_tr (struct inode *inode,struct file *filp);int tracing_open_file_tr (struct inode *inode,struct file *filp);int tracing_release_file_tr (struct inode *inode,struct file *filp); +int tracing_single_release_file_tr (struct inode *inode,struct file *filp);bool tracing_is_disabled (void );bool tracer_tracing_is_on (struct trace_array *tr);void tracer_tracing_on (struct trace_array *tr);
kernel/trace/trace_events_hist.c +8 -4
@@ -4946,10 +4946,12 @@ static int event_hist_open(struct inode *inode, struct file *file) {int ret; - ret =security_locked_down (LOCKDOWN_TRACEFS ); + ret =tracing_open_file_tr (inode, file);if (ret)return ret; +/* Clear private_data to avoid warning in single_open() */ + file->private_data =NULL ;return single_open (file, hist_show, file); }
@@ -4957,7 +4959,7 @@ const struct file_operations event_hist_fops = { .open = event_hist_open, .read = seq_read, .llseek = seq_lseek, - .release = single_release, + .release = tracing_single_release_file_tr, };#ifdef CONFIG_HIST_TRIGGERS_DEBUG
@@ -5218,10 +5220,12 @@ static int event_hist_debug_open(struct inode *inode, struct file *file) {int ret; - ret =security_locked_down (LOCKDOWN_TRACEFS ); + ret =tracing_open_file_tr (inode, file);if (ret)return ret; +/* Clear private_data to avoid warning in single_open() */ + file->private_data =NULL ;return single_open (file, hist_debug_show, file); }
@@ -5229,7 +5233,7 @@ const struct file_operations event_hist_debug_fops = { .open = event_hist_debug_open, .read = seq_read, .llseek = seq_lseek, - .release = single_release, + .release = tracing_single_release_file_tr, };#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/374 ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 712292308af2265cd9b126aedfa987f10f452a33 ]
As the ring buffer recording requires cmpxchg() to work, if the architecture does not support cmpxchg in NMI, then do not do any recording within an NMI.
--- kernel/trace/ring_buffer.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/trace/ring_buffer.c +6 -0
@@ -3603,6 +3603,12 @@ rb_reserve_next_event(struct trace_buffer *buffer,int nr_loops =0 ;int add_ts_default; +/* ring buffer does cmpxchg, make sure it is safe in NMI context */ +if (!IS_ENABLED (CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG ) && + (unlikely (in_nmi ()))) { +return NULL ; + } +rb_start_commit (cpu_buffer);/* The commit page can not change after this */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/374 reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit b5ec294472794ed9ecba0cb4b8208372842e7e0d ]
'type' is an enum, thus cast of pointer on 64-bit compile test with W=1 causes:
hi6220_reset.c:166:9: error: cast to smaller integer type 'enum hi6220_reset_ctrl_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
--- drivers/reset/hisilicon/hi6220_reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/reset/hisilicon/hi6220_reset.c +1 -1
@@ -164,7 +164,7 @@ static int hi6220_reset_probe(struct platform_device *pdev)if (!data)return -ENOMEM ; - type = (enum hi6220_reset_ctrl_type )of_device_get_match_data (dev); + type = (uintptr_t )of_device_get_match_data (dev); regmap =syscon_node_to_regmap (np);if (IS_ERR (regmap)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/374 Input: atkbd - skip ATKBD_CMD_GETID in translated mode
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 936e4d49ecbc8c404790504386e1422b599dec39 ]
There have been multiple reports of keyboard issues on recent laptop models which can be worked around by setting i8042.dumbkbd, with the downside being this breaks the capslock LED.
It seems that these issues are caused by recent laptops getting confused by ATKBD_CMD_GETID. Rather then adding and endless growing list of quirks for this, just skip ATKBD_CMD_GETID alltogether on laptops in translated mode.
The main goal of sending ATKBD_CMD_GETID is to skip binding to ps/2 mice/touchpads and those are never used in translated mode.
Examples of laptop models which benefit from skipping ATKBD_CMD_GETID:
* "HP Laptop 15s-fq2xxx", "HP laptop 15s-fq4xxx" and "HP Laptop 15-dy2xxx" models the kbd stops working for the first 2 - 5 minutes after boot (waiting for EC watchdog reset?)
* On "HP Spectre x360 13-aw2xxx" atkbd fails to probe the keyboard
* At least 9 different Lenovo models have issues with ATKBD_CMD_GETID, see:
https://github.com/yescallop/atkbd-nogetid
This has been tested on:
1. A MSI B550M PRO-VDH WIFI desktop, where the i8042 controller is not in translated mode when no keyboard is plugged in and with a ps/2 kbd a "AT Translated Set 2 keyboard" /dev/input/event# node shows up
2. A Lenovo ThinkPad X1 Yoga gen 8 (always has a translated set 2 keyboard)
--- drivers/input/keyboard/atkbd.c | 46 +++++++++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 4 deletions(-)
drivers/input/keyboard/atkbd.c +42 -4
@@ -756,6 +756,44 @@ static void atkbd_deactivate(struct atkbd *atkbd) ps2dev->serio->phys); } +#ifdef CONFIG_X86 +static bool atkbd_is_portable_device (void ) +{ +static const char *const chassis_types[] = { +"8" ,/* Portable */ +"9" ,/* Laptop */ +"10" ,/* Notebook */ +"14" ,/* Sub-Notebook */ +"31" ,/* Convertible */ +"32" ,/* Detachable */ + }; +int i; + +for (i =0 ; i <ARRAY_SIZE (chassis_types); i++) +if (dmi_match (DMI_CHASSIS_TYPE , chassis_types[i])) +return true; + +return false; +} + +/* +* On many modern laptops ATKBD_CMD_GETID may cause problems, on these laptops +* the controller is always in translated mode. In this mode mice/touchpads will +* not work. So in this case simply assume a keyboard is connected to avoid +* confusing some laptop keyboards. +* +* Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is +* ok in translated mode, only atkbd_select_set() checks atkbd->id and in +* translated mode that is a no-op. +*/ +static bool atkbd_skip_getid (struct atkbd *atkbd) +{ +return atkbd->translated &&atkbd_is_portable_device (); +} +#else +static inline bool atkbd_skip_getid (struct atkbd *atkbd) {return false; } +#endif +/* * atkbd_probe() probes for an AT keyboard on a serio port. */
@@ -785,12 +823,12 @@ static int atkbd_probe(struct atkbd *atkbd)*/ param[0 ] = param[1 ] =0xa5 ;/* initialize with invalid values */ -if (ps2_command (ps2dev, param,ATKBD_CMD_GETID )) { +if (atkbd_skip_getid (atkbd) ||ps2_command (ps2dev, param,ATKBD_CMD_GETID )) {/* -* If the get ID command failed, we check if we can at least set the LEDs on -* the keyboard. This should work on every keyboard out there. It also turns -* the LEDs off, which we want anyway. +* If the get ID command was skipped or failed, we check if we can at least set +* the LEDs on the keyboard. This should work on every keyboard out there. +* It also turns the LEDs off, which we want anyway. */ param[0 ] =0 ;if (ps2_command (ps2dev, param,ATKBD_CMD_SETLEDS ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/374 Input: i8042 - add nomux quirk for Acer P459-G2-M
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esther Shimanovich <[email protected]>
[ Upstream commit 335fe00319e030d481a54d5e0e68d50c5e672c0e ]
After the laptop lid is opened, and the device resumes from S3 deep sleep, if the user presses a keyboard key while the screen is still black, the mouse and keyboard become unusable.
Enabling this quirk prevents this behavior from occurring.
--- drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/input/serio/i8042-acpipnpio.h +8 -0
@@ -351,6 +351,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { }, .driver_data = (void *)(SERIO_QUIRK_DRITEK) }, + { +/* Acer TravelMate P459-G2-M */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), + DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate P459-G2-M"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) + }, {/* Amoi M636/A737 */ .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/374 s390/scm: fix virtual vs physical address confusion
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <[email protected]>
[ Upstream commit b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c ]
Fix virtual vs physical address confusion (which currently are the same).
--- drivers/s390/block/scm_blk.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/s390/block/scm_blk.c +4 -3
@@ -18,6 +18,7 @@#include <linux/genhd.h> #include <linux/slab.h> #include <linux/list.h> +#include <linux/io.h> #include <asm/eadm.h> #include "scm_blk.h"
@@ -131,7 +132,7 @@ static void scm_request_done(struct scm_request *scmrq)for (i =0 ; i < nr_requests_per_io && scmrq->request[i]; i++) { msb = &scmrq->aob->msb[i]; - aidaw = msb->data_addr; + aidaw = (u64 )phys_to_virt (msb->data_addr);if ((msb->flags &MSB_FLAG_IDA ) && aidaw &&IS_ALIGNED (aidaw,PAGE_SIZE ))
@@ -196,12 +197,12 @@ static int scm_request_prepare(struct scm_request *scmrq) msb->scm_addr = scmdev->address + ((u64 )blk_rq_pos (req) <<9 ); msb->oc = (rq_data_dir (req) ==READ ) ?MSB_OC_READ :MSB_OC_WRITE ; msb->flags |=MSB_FLAG_IDA ; - msb->data_addr = (u64 ) aidaw; + msb->data_addr = (u64 )virt_to_phys (aidaw);rq_for_each_segment (bv, req, iter) {WARN_ON (bv.bv_offset); msb->blk_count += bv.bv_len >>12 ; - aidaw->data_addr = (u64 )page_address (bv.bv_page); + aidaw->data_addr =virt_to_phys (page_address (bv.bv_page)); aidaw++; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/374 ARC: fix spare error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <[email protected]>
[ Upstream commit aca02d933f63ba8bc84258bf35f9ffaf6b664336 ]
--- arch/arc/kernel/signal.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arc/kernel/signal.c +3 -3
@@ -61,7 +61,7 @@ struct rt_sigframe {unsigned int sigret_magic; }; -static int save_arcv2_regs (struct sigcontext *mctx,struct pt_regs *regs) +static int save_arcv2_regs (struct sigcontext __user *mctx,struct pt_regs *regs) {int err =0 ;#ifndef CONFIG_ISA_ARCOMPACT
@@ -74,12 +74,12 @@ static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)#else v2abi.r58 = v2abi.r59 =0 ;#endif - err =__copy_to_user (&mctx->v2abi, &v2abi,sizeof (v2abi)); + err =__copy_to_user (&mctx->v2abi, (void const *)&v2abi,sizeof (v2abi));#endif return err; } -static int restore_arcv2_regs (struct sigcontext *mctx,struct pt_regs *regs) +static int restore_arcv2_regs (struct sigcontext __user *mctx,struct pt_regs *regs) {int err =0 ;#ifndef CONFIG_ISA_ARCOMPACT
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/374 wifi: iwlwifi: pcie: avoid a NULL pointer dereference
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit ce038edfce43fb345f8dfdca0f7b17f535896701 ]
It possible that while the rx rb is being handled, the transport has been stopped and re-started. In this case the tx queue pointer is not yet initialized, which will lead to a NULL pointer dereference. Fix it.
--- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/pcie/rx.c +1 -1
@@ -1380,7 +1380,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,* if it is true then one of the handlers took the page. */ -if (reclaim) { +if (reclaim && txq) {u16 sequence =le16_to_cpu (pkt->hdr.sequence);int index =SEQ_TO_INDEX (sequence);int cmd_index =iwl_txq_get_cmd_index (txq, index);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/374 Input: xpad - add Razer Wolverine V2 support
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit c3d1610345b79cbe29ef6ca04a4780eff0d360c7 ]
Add the VID and PID of Razer Wolverine V2 to xpad_device.
--- drivers/input/joystick/xpad.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/joystick/xpad.c +1 -0
@@ -268,6 +268,7 @@ static const struct xpad_device { { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, + { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/374 ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 99c7bb44f5749373bc01b73af02b50b69bcbf43d ]
Add a quirk for the Medion Lifetab S10346, this BYTCR tablet has no CHAN package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which is the default for BYTCR devices.
--- sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/soc/intel/boards/bytcr_rt5640.c +12 -0
@@ -870,6 +870,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {BYT_RT5640_SSP0_AIF1 | BYT_RT5640_MCLK_EN), }, + { +/* Medion Lifetab S10346 */ + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"AMI Corporation" ), +DMI_MATCH (DMI_BOARD_NAME ,"Aptio CRB" ), +/* Above strings are much too generic, also match on BIOS date */ + DMI_MATCH(DMI_BIOS_DATE, "10/22/2015"), + }, + .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | +BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, { /* Mele PCG03 Mini PC */ .matches = { DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Mini PC"),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/374 i2c: rk3x: fix potential spinlock recursion on poll
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jensen Huang <[email protected]>
[ Upstream commit 19cde9c92b8d3b7ee555d0da3bcb0232d3a784f4 ]
Possible deadlock scenario (on reboot):rk3x_i2c_xfer_common(polling)
-> rk3x_i2c_wait_xfer_poll()
-> rk3x_i2c_irq(0, i2c);
--> spin_lock(&i2c->lock);
...
<rk3x i2c interrupt>
-> rk3x_i2c_irq(0, i2c);
--> spin_lock(&i2c->lock); (deadlock here)Store the IRQ number and disable/enable it around the polling transfer. This patch has been tested on NanoPC-T4.
--- drivers/i2c/busses/i2c-rk3x.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-rk3x.c +11 -2
@@ -178,6 +178,7 @@ struct rk3x_i2c_soc_data {* @clk: function clk for rk3399 or function & Bus clks for others * @pclk: Bus clk for rk3399 * @clk_rate_nb: i2c clk rate change notify +* @irq: irq number * @t: I2C known timing information * @lock: spinlock for the i2c bus * @wait: the waitqueue to wait for i2c transfer
@@ -200,6 +201,7 @@ struct rk3x_i2c {struct clk *clk;struct clk *pclk;struct notifier_block clk_rate_nb; +int irq;/* Settings */ struct i2c_timings t;
@@ -1087,13 +1089,18 @@ static int rk3x_i2c_xfer_common(struct i2c_adapter *adap,spin_unlock_irqrestore (&i2c->lock, flags); -rk3x_i2c_start (i2c); -if (!polling) { +rk3x_i2c_start (i2c); + timeout =wait_event_timeout (i2c->wait, !i2c->busy,msecs_to_jiffies (WAIT_TIMEOUT )); }else { +disable_irq (i2c->irq); +rk3x_i2c_start (i2c); + timeout =rk3x_i2c_wait_xfer_poll (i2c); + +enable_irq (i2c->irq); }spin_lock_irqsave (&i2c->lock, flags);
@@ -1301,6 +1308,8 @@ static int rk3x_i2c_probe(struct platform_device *pdev)return ret; } + i2c->irq = irq; +platform_set_drvdata (pdev, i2c);if (i2c->soc_data->calc_timings == rk3x_i2c_v0_calc_timings) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/374 ida: Fix crash in ida_free when the bitmap is empty
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ]
The IDA usually detects double-frees, but that detection failed to consider the case when there are no nearby IDs allocated and so we have a NULL bitmap rather than simply having a clear bit. Add some tests to the test-suite to be sure we don't inadvertently reintroduce this problem. Unfortunately they're quite noisy so include a message to disregard the warnings.
--- lib/idr.c | 2 +- lib/test_ida.c | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 1 deletion(-)
lib/idr.c +1 -1
@@ -508,7 +508,7 @@ void ida_free(struct ida *ida, unsigned int id) goto delete;xas_store (&xas,xa_mk_value (v)); }else { -if (!test_bit (bit, bitmap->bitmap)) +if (!bitmap || !test_bit (bit, bitmap->bitmap)) goto err;__clear_bit (bit, bitmap->bitmap);xas_set_mark (&xas,XA_FREE_MARK );
lib/test_ida.c +40 -0
@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida)IDA_BUG_ON (ida, !ida_is_empty (ida)); } +/* +* Check various situations where we attempt to free an ID we don't own. +*/ +static void ida_check_bad_free (struct ida *ida) +{ +unsigned long i; + +printk ("vvv Ignore \"not allocated\" warnings\n" ); +/* IDA is empty; all of these will fail */ +ida_free (ida,0 ); +for (i =0 ; i <31 ; i++) +ida_free (ida,1 << i); + +/* IDA contains a single value entry */ +IDA_BUG_ON (ida,ida_alloc_min (ida,3 ,GFP_KERNEL ) !=3 ); +ida_free (ida,0 ); +for (i =0 ; i <31 ; i++) +ida_free (ida,1 << i); + +/* IDA contains a single bitmap */ +IDA_BUG_ON (ida,ida_alloc_min (ida,1023 ,GFP_KERNEL ) !=1023 ); +ida_free (ida,0 ); +for (i =0 ; i <31 ; i++) +ida_free (ida,1 << i); + +/* IDA contains a tree */ +IDA_BUG_ON (ida,ida_alloc_min (ida, (1 <<20 ) -1 ,GFP_KERNEL ) != (1 <<20 ) -1 ); +ida_free (ida,0 ); +for (i =0 ; i <31 ; i++) +ida_free (ida,1 << i); +printk ("^^^ \"not allocated\" warnings over\n" ); + +ida_free (ida,3 ); +ida_free (ida,1023 ); +ida_free (ida, (1 <<20 ) -1 ); + +IDA_BUG_ON (ida, !ida_is_empty (ida)); +} +static DEFINE_IDA (ida);static int ida_checks (void )
@@ -162,6 +201,7 @@ static int ida_checks(void)ida_check_leaf (&ida,1024 *64 );ida_check_max (&ida);ida_check_conv (&ida); +ida_check_bad_free (&ida);printk ("IDA: %u of %u tests passed\n" , tests_passed, tests_run);return (tests_run != tests_passed) ?0 : -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/374 net: qrtr: ns: Return 0 if server port is not present
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarannya S <[email protected]>
[ Upstream commit 9bf2e9165f90dc9f416af53c902be7e33930f728 ]
When a 'DEL_CLIENT' message is received from the remote, the corresponding server port gets deleted. A DEL_SERVER message is then announced for this server. As part of handling the subsequent DEL_SERVER message, the name- server attempts to delete the server port which results in a '-ENOENT' error. The return value from server_del() is then propagated back to qrtr_ns_worker, causing excessive error prints.
To address this, return 0 from control_cmd_del_server() without checking the return value of server_del(), since the above scenario is not an error case and hence server_del() doesn't have any other error return value.
--- net/qrtr/ns.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/qrtr/ns.c +3 -1
@@ -569,7 +569,9 @@ static int ctrl_cmd_del_server(struct sockaddr_qrtr *from,if (!node)return -ENOENT ; -return server_del (node, port, true); +server_del (node, port, true); + +return 0 ; } static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/374 ARM: sun9i: smp: fix return code check of of_property_match_string
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit 643fe70e7bcdcc9e2d96952f7fc2bab56385cce5 ]
of_property_match_string returns an int; either an index from 0 or greater if successful or negative on failure. Even it's very unlikely that the DT CPU node contains multiple enable-methods these checks should be fixed.
This patch was inspired by the work of Nick Desaulniers.
--- arch/arm/mach-sunxi/mc_smp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-sunxi/mc_smp.c +2 -2
@@ -804,12 +804,12 @@ static int __init sunxi_mc_smp_init(void)for (i =0 ; i <ARRAY_SIZE (sunxi_mc_smp_data); i++) { ret =of_property_match_string (node,"enable-method" , sunxi_mc_smp_data[i].enable_method); -if (!ret) +if (ret >=0 )break ; }of_node_put (node); -if (ret) +if (ret <0 )return -ENODEV ; is_a83t = sunxi_mc_smp_data[i].is_a83t;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/374 drm/crtc: fix uninitialized variable use
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf ]
Commit 3823119b9c2b ("drm/crtc: Fix uninit-value bug in drm_mode_setcrtc") was supposed to fix use of an uninitialized variable, but introduced another.
num_connectors is only initialized if crtc_req->count_connectors > 0, but it's used regardless. Fix it.
--- drivers/gpu/drm/drm_crtc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/drm_crtc.c +1 -2
@@ -643,7 +643,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,struct drm_mode_set set;uint32_t __user *set_connectors_ptr;struct drm_modeset_acquire_ctx ctx; -int ret, i, num_connectors; +int ret, i, num_connectors =0 ;if (!drm_core_check_feature (dev,DRIVER_MODESET ))return -EOPNOTSUPP ;
@@ -778,7 +778,6 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, goto out; } - num_connectors =0 ;for (i =0 ; i < crtc_req->count_connectors; i++) { connector_set[i] =NULL ; set_connectors_ptr = (uint32_t __user *)(unsigned long )crtc_req->set_connectors_ptr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/374 ACPI: resource: Add another DMI match for the TongFang GMxXGxx
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit df0cced74159c79e36ce7971f0bf250673296d93 upstream.
The TongFang GMxXGxx, which needs IRQ overriding for the keyboard to work, is also sold as the Eluktronics RP-15 which does not use the standard TongFang GMxXGxx DMI board_name.
Add an entry for this laptop to the irq1_edge_low_force_override[] DMI table to make the internal keyboard functional.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -481,6 +481,13 @@ static const struct dmi_system_id mainge }, }, { +/* TongFang GMxXGxx sold as Eluktronics Inc. RP-15 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Eluktronics Inc." ), + DMI_MATCH(DMI_BOARD_NAME, "RP-15"), + }, + }, + {/* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */ .matches = { DMI_MATCH(DMI_BOARD_NAME, "GM6XGxX"),
Greg Kroah-Hartman
maintainerPATCH 51/374 Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit bc7d0133181e5f33ac33ca4f6bb2bce876c8ad88 which is commit c775cbf62ed4911e4f0f23880f01815753123690 upstream.
It is reported to cause problems, so drop it from the 5.15.y tree for now.
--- sound/soc/atmel/sam9g20_wm8731.c | 61 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+)
sound/soc/atmel/sam9g20_wm8731.c +61 -0
@@ -46,6 +46,35 @@*/ #undef ENABLE_MIC_INPUT +static struct clk *mclk; + +static int at91sam9g20ek_set_bias_level (struct snd_soc_card *card, +struct snd_soc_dapm_context *dapm, +enum snd_soc_bias_level level) +{ +static int mclk_on; +int ret =0 ; + +switch (level) { +case SND_SOC_BIAS_ON : +case SND_SOC_BIAS_PREPARE : +if (!mclk_on) + ret =clk_enable (mclk); +if (ret ==0 ) + mclk_on =1 ; +break ; + +case SND_SOC_BIAS_OFF : +case SND_SOC_BIAS_STANDBY : +if (mclk_on) +clk_disable (mclk); + mclk_on =0 ; +break ; + } + +return ret; +} +static const struct snd_soc_dapm_widget at91sam9g20ek_dapm_widgets[] = {SND_SOC_DAPM_MIC ("Int Mic" ,NULL ),SND_SOC_DAPM_SPK ("Ext Spk" ,NULL ),
@@ -106,6 +135,7 @@ static struct snd_soc_card snd_soc_at91s .owner = THIS_MODULE, .dai_link = &at91sam9g20ek_dai, .num_links = 1, + .set_bias_level = at91sam9g20ek_set_bias_level, .dapm_widgets = at91sam9g20ek_dapm_widgets, .num_dapm_widgets = ARRAY_SIZE(at91sam9g20ek_dapm_widgets),
@@ -118,6 +148,7 @@ static int at91sam9g20ek_audio_probe(str {struct device_node *np = pdev->dev.of_node;struct device_node *codec_np, *cpu_np; +struct clk *pllb;struct snd_soc_card *card = &snd_soc_at91sam9g20ek;int ret;
@@ -131,6 +162,31 @@ static int at91sam9g20ek_audio_probe(strreturn -EINVAL ; } +/* +* Codec MCLK is supplied by PCK0 - set it up. +*/ + mclk =clk_get (NULL ,"pck0" ); +if (IS_ERR (mclk)) { +dev_err (&pdev->dev,"Failed to get MCLK\n" ); + ret =PTR_ERR (mclk); + goto err; + } + + pllb =clk_get (NULL ,"pllb" ); +if (IS_ERR (pllb)) { +dev_err (&pdev->dev,"Failed to get PLLB\n" ); + ret =PTR_ERR (pllb); + goto err_mclk; + } + ret =clk_set_parent (mclk, pllb); +clk_put (pllb); +if (ret !=0 ) { +dev_err (&pdev->dev,"Failed to set MCLK parent\n" ); + goto err_mclk; + } + +clk_set_rate (mclk,MCLK_RATE ); + card->dev = &pdev->dev;/* Parse device node info */
@@ -174,6 +230,9 @@ static int at91sam9g20ek_audio_probe(strreturn ret; +err_mclk: +clk_put (mclk); + mclk =NULL ; err:atmel_ssc_put_audio (0 );return ret;
@@ -183,6 +242,8 @@ static int at91sam9g20ek_audio_remove(st {struct snd_soc_card *card =platform_get_drvdata (pdev); +clk_disable (mclk); + mclk =NULL ;snd_soc_unregister_card (card);atmel_ssc_put_audio (0 );
Greg Kroah-Hartman
maintainerPATCH 52/374 bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Maguire <[email protected]>
commit 7b99f75942da332e3f4f865e55a10fec95a30d4f upstream.
v1.25 of pahole supports filtering out functions with multiple inconsistent function prototypes or optimized-out parameters from the BTF representation. These present problems because there is no additional info in BTF saying which inconsistent prototype matches which function instance to help guide attachment, and functions with optimized-out parameters can lead to incorrect assumptions about register contents.
So for now, filter out such functions while adding BTF representations for functions that have "."-suffixes (foo.isra.0) but not optimized-out parameters. This patch assumes that below linked changes land in pahole for v1.25.
Issues with pahole filtering being too aggressive in removing functions appear to be resolved now, but CI and further testing will confirm.
[ small context conflict because of not backported --lang_exclude=rust option, which is not needed in 5.15 ]
--- scripts/pahole-flags.sh | 3 +++ 1 file changed, 3 insertions(+)
scripts/pahole-flags.sh +3 -0
@@ -20,5 +20,8 @@ fi if [ "${pahole_ver}" -ge "124" ]; then extra_paholeopt="${extra_paholeopt} --skip_encoding_btf_enum64" fi +if [ "${pahole_ver}" -ge "125" ]; then + extra_paholeopt="${extra_paholeopt} --skip_encoding_btf_inconsistent_proto --btf_gen_optimized" +fi echo ${extra_paholeopt}
Greg Kroah-Hartman
maintainerPATCH 53/374 kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <[email protected]>
commit 4fbd2f83fda0ca44a2ec6421ca3508b355b31858 upstream.
Since forcibly unoptimized kprobes will be put on the freeing_list directly in the unoptimize_kprobe(), do_unoptimize_kprobes() must continue to check the freeing_list even if unoptimizing_list is empty.
This bug can happen if a kprobe is put in an instruction which is in the middle of the jump-replaced instruction sequence of an optprobe, *and* the optprobe is recently unregistered and queued on unoptimizing_list. In this case, the optprobe will be unoptimized forcibly (means immediately) and put it into the freeing_list, expecting the optprobe will be handled in do_unoptimize_kprobe().
But if there is no other optprobes on the unoptimizing_list, current code returns from the do_unoptimize_kprobe() soon and does not handle the optprobe which is on the freeing_list. Then the optprobe will hit the WARN_ON_ONCE() in the do_free_cleaned_kprobes(), because it is not handled in the latter loop of the do_unoptimize_kprobe().
To solve this issue, do not return from do_unoptimize_kprobes() immediately even if unoptimizing_list is empty.
Moreover, this change affects another case. kill_optimized_kprobes() expects kprobe_optimizer() will just free the optprobe on freeing_list. So I changed it to just do list_move() to freeing_list if optprobes are on unoptimizing list. And the do_unoptimize_kprobe() will skip arch_disarm_kprobe() if the probe on freeing_list has gone flag.
[fp: adjust comment conflict regarding commit 223a76b268c9 ("kprobes: Fix
coding style issues")]
--- kernel/kprobes.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
kernel/kprobes.c +10 -13
@@ -549,17 +549,15 @@ static void do_unoptimize_kprobes(void)/* See comment in do_optimize_kprobes() */ lockdep_assert_cpus_held (); -/* Unoptimization must be done anytime */ -if (list_empty (&unoptimizing_list)) -return ; +if (!list_empty (&unoptimizing_list)) +arch_unoptimize_kprobes (&unoptimizing_list, &freeing_list); -arch_unoptimize_kprobes (&unoptimizing_list, &freeing_list); -/* Loop free_list for disarming */ +/* Loop on 'freeing_list' for disarming and removing from kprobe hash list */ list_for_each_entry_safe (op, tmp, &freeing_list, list) {/* Switching from detour code to origin */ op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED ; -/* Disarm probes if marked disabled */ -if (kprobe_disabled (&op->kp)) +/* Disarm probes if marked disabled and not gone */ +if (kprobe_disabled (&op->kp) && !kprobe_gone (&op->kp))arch_disarm_kprobe (&op->kp);if (kprobe_unused (&op->kp)) {/*
@@ -788,14 +786,13 @@ static void kill_optimized_kprobe(struct op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED ;if (kprobe_unused (p)) { -/* Enqueue if it is unused */ -list_add (&op->list, &freeing_list);/* -* Remove unused probes from the hash list. After waiting -* for synchronization, this probe is reclaimed. -* (reclaiming is done by do_free_cleaned_kprobes().) +* Unused kprobe is on unoptimizing or freeing list. We move it +* to freeing_list and let the kprobe_optimizer() remove it from +* the kprobe hash list and free it. */ -hlist_del_rcu (&op->kp.hlist); +if (optprobe_queued_unopt (op)) +list_move (&op->list, &freeing_list); }/* Don't touch the code, because it is already freed. */
Greg Kroah-Hartman
maintainerPATCH 54/374 Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <[email protected]>
commit bed9e27baf52a09b7ba2a3714f1e24e17ced386d upstream.
This reverts commit 5e2cf333b7bd5d3e62595a44d598a254c697cd74.
That commit introduced the following race and can cause system hung.
md_write_start: raid5d:
// mddev->in_sync == 1
set "MD_SB_CHANGE_PENDING"
// running before md_write_start wakeup it
waiting "MD_SB_CHANGE_PENDING" cleared
>>>>>>>>> hung wakeup mddev->thread
...
waiting "MD_SB_CHANGE_PENDING" cleared
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
hung, raid5d should clear this flag
but get hung by same flag.
The issue reverted commit fixing is fixed by last patch in a new way.
--- drivers/md/raid5.c | 12 ------------ 1 file changed, 12 deletions(-)
drivers/md/raid5.c +0 -12
@@ -36,7 +36,6 @@*/ #include <linux/blkdev.h> -#include <linux/delay.h> #include <linux/kthread.h> #include <linux/raid/pq.h> #include <linux/async_tx.h>
@@ -6522,18 +6521,7 @@ static void raid5d(struct md_thread *thrspin_unlock_irq (&conf->device_lock);md_check_recovery (mddev);spin_lock_irq (&conf->device_lock); - -/* -* Waiting on MD_SB_CHANGE_PENDING below may deadlock -* seeing md_check_recovery() is needed to clear -* the flag when using mdmon. -*/ -continue ; } - -wait_event_lock_irq (mddev->sb_wait, - !test_bit (MD_SB_CHANGE_PENDING , &mddev->sb_flags), - conf->device_lock); }pr_debug ("%d stripes handled\n" , handled);
Greg Kroah-Hartman
maintainerPATCH 55/374 binder: use EPOLLERR from eventpoll.h
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 6ac061db9c58ca5b9270b1b3940d2464fb3ff183 upstream.
Use EPOLLERR instead of POLLERR to make sure it is cast to the correct __poll_t type. This fixes the following sparse issue:
drivers/android/binder.c:5030:24: warning: incorrect type in return expression (different base types)
drivers/android/binder.c:5030:24: expected restricted __poll_t
drivers/android/binder.c:5030:24: got int
--- drivers/android/binder.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/android/binder.c +1 -1
@@ -4836,7 +4836,7 @@ static __poll_t binder_poll(struct file thread =binder_get_thread (proc);if (!thread) -return POLLERR ; +return EPOLLERR ;binder_inner_proc_lock (thread->proc); thread->looper |=BINDER_LOOPER_STATE_POLL ;
Greg Kroah-Hartman
maintainerPATCH 56/374 binder: fix use-after-free in shinkers callback
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 3f489c2067c5824528212b0fc18b28d51332d906 upstream.
The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated.
I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF:
==================================================================
BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758 ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368 vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8 vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7c
Fix this issue by performing instead a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade. Note that this option has better performance than upgrading to a mmap write lock which would increase contention. Plus, mmap_write_trylock() has been recently removed anyway.
--- drivers/android/binder_alloc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/android/binder_alloc.c +5 -1
@@ -1005,7 +1005,9 @@ enum lru_status binder_alloc_free_page(s goto err_mmget;if (!mmap_read_trylock (mm)) goto err_mmap_read_lock_failed; - vma =binder_alloc_get_vma (alloc); + vma =vma_lookup (mm, page_addr); +if (vma && vma !=binder_alloc_get_vma (alloc)) + goto err_invalid_vma;list_lru_isolate (lru, item);spin_unlock (lock);
@@ -1031,6 +1033,8 @@ enum lru_status binder_alloc_free_page(smutex_unlock (&alloc->mutex);return LRU_REMOVED_RETRY ; +err_invalid_vma: +mmap_read_unlock (mm); err_mmap_read_lock_failed:mmput_async (mm); err_mmget:
Greg Kroah-Hartman
maintainerPATCH 57/374 binder: fix trivial typo of binder_free_buf_locked()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 122a3c1cb0ff304c2b8934584fcfea4edb2fe5e3 upstream.
Fix minor misspelling of the function in the comment section.
No functional changes in this patch.
--- drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/android/binder_alloc.c +1 -1
@@ -706,7 +706,7 @@ void binder_alloc_free_buf(struct binder/* * We could eliminate the call to binder_alloc_clear_buf() * from binder_alloc_deferred_release() by moving this to -* binder_alloc_free_buf_locked(). However, that could +* binder_free_buf_locked(). However, that could * increase contention for the alloc mutex if clear_on_free * is used frequently for large buffers. The mutex is not * needed for correctness here.
Greg Kroah-Hartman
maintainerPATCH 58/374 binder: fix comment on binder_alloc_new_buf() return value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit e1090371e02b601cbfcea175c2a6cc7c955fa830 upstream.
Update the comments of binder_alloc_new_buf() to reflect that the return value of the function is now ERR_PTR(-errno) on failure.
No functional changes in this patch.
--- drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/android/binder_alloc.c +1 -1
@@ -557,7 +557,7 @@ err_alloc_buf_struct_failed:* is the sum of the three given sizes (each rounded up to * pointer-sized boundary) * -* Return: The allocated buffer or %NULL if error +* Return: The allocated buffer or %ERR_PTR(-errno) if error */ struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc, size_t data_size,
Greg Kroah-Hartman
maintainerPATCH 59/374 uio: Fix use-after-free in uio_open
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanghui Feng <[email protected]>
commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream.
core-1 core-2
-------------------------------------------------------uio_unregister_device uio_open
idev = idr_find()device_unregister(&idev->dev)put_device(&idev->dev)uio_device_release
get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev)
-------------------------------------------------------
In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then:
1. After core-1 kfree idev, the core-2 will do use-after-free for idev.
2. When core-2 do uio_release and put_device, the idev will be double freed.
To address this issue, we can get idev atomic & inc idev reference with minor_lock.
--- drivers/uio/uio.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/uio/uio.c +3 -4
@@ -464,13 +464,13 @@ static int uio_open(struct inode *inode,mutex_lock (&minor_lock); idev =idr_find (&uio_idr,iminor (inode)); -mutex_unlock (&minor_lock);if (!idev) { ret = -ENODEV ; +mutex_unlock (&minor_lock); goto out; } -get_device (&idev->dev); +mutex_unlock (&minor_lock);if (!try_module_get (idev->owner)) { ret = -ENODEV ;
@@ -1062,9 +1062,8 @@ void uio_unregister_device(struct uio_inwake_up_interruptible (&idev->wait);kill_fasync (&idev->async_queue,SIGIO ,POLL_HUP ); -device_unregister (&idev->dev); -uio_free_minor (minor); +device_unregister (&idev->dev);return ; }
Greg Kroah-Hartman
maintainerPATCH 60/374 parport: parport_serial: Add Brainboxes BAR details
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Williams <[email protected]>
commit 65fde134b0a4ffe838729f9ee11b459a2f6f2815 upstream.
Add BAR/enum entries for Brainboxes serial/parallel cards.
--- drivers/parport/parport_serial.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/parport/parport_serial.c +8 -0
@@ -65,6 +65,10 @@ enum parport_pc_pci_cards { sunix_5069a, sunix_5079a, sunix_5099a, + brainboxes_uc257, + brainboxes_is300, + brainboxes_uc414, + brainboxes_px263, };/* each element directly indexed from enum list, above */
@@ -158,6 +162,10 @@ static struct parport_pc_pci cards[] = { /* sunix_5069a */ { 1, { { 1, 2 }, } }, /* sunix_5079a */ { 1, { { 1, 2 }, } }, /* sunix_5099a */ { 1, { { 1, 2 }, } }, + /* brainboxes_uc257 */ { 1, { { 3, -1 }, } }, + /* brainboxes_is300 */ { 1, { { 3, -1 }, } }, + /* brainboxes_uc414 */ { 1, { { 3, -1 }, } }, + /* brainboxes_px263 */ { 1, { { 3, -1 }, } }, }; static struct pci_device_id parport_serial_pci_tbl[] = {
Greg Kroah-Hartman
maintainerPATCH 61/374 parport: parport_serial: Add Brainboxes device IDs and geometry
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Williams <[email protected]>
commit 6aa1fc5a8085bbc01687aa708dcf2dbe637a5ee3 upstream.
Add device IDs for the Brainboxes UC-203, UC-257, UC-414, UC-475, IS-300/IS-500 and PX-263/PX-295 and define the relevant "geometry" for the cards.
This patch requires part 1 of this series.
--- drivers/parport/parport_serial.c | 56 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+)
drivers/parport/parport_serial.c +56 -0
@@ -285,6 +285,38 @@ static struct pci_device_id parport_seri {PCI_VENDOR_ID_SUNIX ,PCI_DEVICE_ID_SUNIX_1999 ,PCI_VENDOR_ID_SUNIX , 0x0104, 0, 0, sunix_5099a }, +/* Brainboxes UC-203 */ + { PCI_VENDOR_ID_INTASHIELD, 0x0bc1, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0bc2, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + +/* Brainboxes UC-257 */ + { PCI_VENDOR_ID_INTASHIELD, 0x0861, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0862, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0863, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + +/* Brainboxes UC-414 */ + { PCI_VENDOR_ID_INTASHIELD, 0x0e61, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc414 }, + +/* Brainboxes UC-475 */ + { PCI_VENDOR_ID_INTASHIELD, 0x0981, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0982, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + +/* Brainboxes IS-300/IS-500 */ + { PCI_VENDOR_ID_INTASHIELD, 0x0da0, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_is300 }, + +/* Brainboxes PX-263/PX-295 */ + { PCI_VENDOR_ID_INTASHIELD, 0x402c, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_px263 }, + { 0, } /* terminate list */ };MODULE_DEVICE_TABLE (pci,parport_serial_pci_tbl);
@@ -550,6 +582,30 @@ static struct pciserial_board pci_parpor .base_baud = 921600, .uart_offset = 0x8, }, + [brainboxes_uc257] = { + .flags = FL_BASE2, + .num_ports = 2, + .base_baud = 115200, + .uart_offset = 8, + }, + [brainboxes_is300] = { + .flags = FL_BASE2, + .num_ports = 1, + .base_baud = 115200, + .uart_offset = 8, + }, + [brainboxes_uc414] = { + .flags = FL_BASE2, + .num_ports = 4, + .base_baud = 115200, + .uart_offset = 8, + }, + [brainboxes_px263] = { + .flags = FL_BASE2, + .num_ports = 4, + .base_baud = 921600, + .uart_offset = 8, + }, };struct parport_serial_private {
Greg Kroah-Hartman
maintainerPATCH 62/374 leds: ledtrig-tty: Free allocated ttyname buffer on deactivate
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Eckert <[email protected]>
commit 25054b232681c286fca9c678854f56494d1352cc upstream.
The ttyname buffer for the ledtrig_tty_data struct is allocated in the sysfs ttyname_store() function. This buffer must be released on trigger deactivation. This was missing and is thus a memory leak.
While we are at it, the TTY handler in the ledtrig_tty_data struct should also be returned in case of the trigger deactivation call.
--- drivers/leds/trigger/ledtrig-tty.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/leds/trigger/ledtrig-tty.c +4 -0
@@ -168,6 +168,10 @@ static void ledtrig_tty_deactivate(struccancel_delayed_work_sync (&trigger_data->dwork); +kfree (trigger_data->ttyname); +tty_kref_put (trigger_data->tty); + trigger_data->tty =NULL ; +kfree (trigger_data); }
Greg Kroah-Hartman
maintainerPATCH 63/374 PCI: Add ACS quirk for more Zhaoxin Root Ports
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: LeoLiuoc <[email protected]>
commit e367e3c765f5477b2e79da0f1399aed49e2d1e37 upstream.
Add more Root Port Device IDs to pci_quirk_zhaoxin_pcie_ports_acs() for some new Zhaoxin platforms.
[bhelgaas: update subject, drop changelog, add Fixes, add stable tag, fix whitespace, wrap code comment]
--- drivers/pci/quirks.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/pci/quirks.c +6 -2
@@ -4577,17 +4577,21 @@ static int pci_quirk_xgene_acs(struct pc* But the implementation could block peer-to-peer transactions between them * and provide ACS-like functionality. */ -static int pci_quirk_zhaoxin_pcie_ports_acs (struct pci_dev *dev,u16 acs_flags) +static int pci_quirk_zhaoxin_pcie_ports_acs (struct pci_dev *dev,u16 acs_flags) {if (!pci_is_pcie (dev) || ((pci_pcie_type (dev) !=PCI_EXP_TYPE_ROOT_PORT ) && (pci_pcie_type (dev) !=PCI_EXP_TYPE_DOWNSTREAM )))return -ENOTTY ; +/* +* Future Zhaoxin Root Ports and Switch Downstream Ports will +* implement ACS capability in accordance with the PCIe Spec. +*/ switch (dev->device) { case 0x0710 ... 0x071e:case 0x0721 : - case 0x0723 ... 0x0732: + case 0x0723 ... 0x0752:return pci_acs_ctrl_enabled (acs_flags,PCI_ACS_SV |PCI_ACS_RR |PCI_ACS_CR |PCI_ACS_UF ); }
Greg Kroah-Hartman
maintainerPATCH 64/374 coresight: etm4x: Fix width of CCITMIN field
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
commit cc0271a339cc70cae914c3ec20edc2a8058407da upstream.
CCITMIN is a 12 bit field and doesn't fit in a u8, so extend it to u16. This probably wasn't an issue previously because values higher than 255 never occurred.
But since commit 4aff040bcc8d ("coresight: etm: Override TRCIDR3.CCITMIN on errata affected cpus"), a comparison with 256 was done to enable the errata, generating the following W=1 build error:
coresight-etm4x-core.c:1188:24: error: result of comparison of constant 256 with expression of type 'u8' (aka 'unsigned char') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
if (drvdata->ccitmin == 256)
--- drivers/hwtracing/coresight/coresight-etm4x.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-etm4x.h +1 -1
@@ -944,7 +944,7 @@ struct etmv4_drvdata {u8 ctxid_size;u8 vmid_size;u8 ccsize; -u8 ccitmin; +u16 ccitmin;u8 s_ex_level;u8 ns_ex_level;u8 q_support;
Greg Kroah-Hartman
maintainerPATCH 65/374 x86/lib: Fix overflow when counting digits
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit a24d61c609813963aacc9f6ec8343f4fcaac7243 ]
tl;dr: The num_digits() function has a theoretical overflow issue. But it doesn't affect any actual in-tree users. Fix it by using a larger type for one of the local variables.
Long version:
There is an overflow in variable m in function num_digits when val is >= 1410065408 which leads to the digit calculation loop to iterate more times than required. This results in either more digits being counted or in some cases (for example where val is 1932683193) the value of m eventually overflows to zero and the while loop spins forever).
Currently the function num_digits is currently only being used for small values of val in the SMP boot stage for digit counting on the number of cpus and NUMA nodes, so the overflow is never encountered. However it is useful to fix the overflow issue in case the function is used for other purposes in the future. (The issue was discovered while investigating the digit counting performance in various kernel helper functions rather than any real-world use-case).
The simplest fix is to make m a long long, the overhead in multiplication speed for a long long is very minor for small values of val less than 10000 on modern processors. The alternative fix is to replace the multiplication with a constant division by 10 loop (this compiles down to an multiplication and shift) without needing to make m a long long, but this is slightly slower than the fix in this commit when measured on a range of x86 processors).
[ dhansen: subject and changelog tweaks ]
--- arch/x86/lib/misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/lib/misc.c +1 -1
@@ -6,7 +6,7 @@*/ int num_digits (int val) { -int m =10 ; +long long m =10 ;int d =1 ;if (val <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/374 EDAC/thunderx: Fix possible out-of-bounds string access
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ]
Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat():
drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr':
drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=]
1136 | strncat(msg, other, OCX_MESSAGE_SIZE);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
...
1145 | strncat(msg, other, OCX_MESSAGE_SIZE);
...
1150 | strncat(msg, other, OCX_MESSAGE_SIZE);...
Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer.
Change it to strlcat().
[ bp: Trim compiler output, fixup commit message. ]
--- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/edac/thunderx_edac.c +5 -5
@@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)decode_register (other,OCX_OTHER_SIZE , ocx_com_errors, ctx->reg_com_int); -strncat (msg, other,OCX_MESSAGE_SIZE ); +strlcat (msg, other,OCX_MESSAGE_SIZE );for (lane =0 ; lane <OCX_RX_LANES ; lane++)if (ctx->reg_com_int &BIT (lane)) {
@@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); -strncat (msg, other,OCX_MESSAGE_SIZE ); +strlcat (msg, other,OCX_MESSAGE_SIZE );decode_register (other,OCX_OTHER_SIZE , ocx_lane_errors, ctx->reg_lane_int[lane]); -strncat (msg, other,OCX_MESSAGE_SIZE ); +strlcat (msg, other,OCX_MESSAGE_SIZE ); }if (ctx->reg_com_int &OCX_COM_INT_CE )
@@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id)decode_register (other,OCX_OTHER_SIZE , ocx_com_link_errors, ctx->reg_com_link_int); -strncat (msg, other,OCX_MESSAGE_SIZE ); +strlcat (msg, other,OCX_MESSAGE_SIZE );if (ctx->reg_com_link_int &OCX_COM_LINK_INT_UE )edac_device_handle_ue (ocx->edac_dev,0 ,0 , msg);
@@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)decode_register (other,L2C_OTHER_SIZE , l2_errors, ctx->reg_int); -strncat (msg, other,L2C_MESSAGE_SIZE ); +strlcat (msg, other,L2C_MESSAGE_SIZE );if (ctx->reg_int & mask_ue)edac_device_handle_ue (l2c->edac_dev,0 ,0 , msg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/374 powerpc: Mark .opd section read-only
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 3091f5fc5f1df7741ddf326561384e0997eca2a1 ]
.opd section contains function descriptors used to locate functions in the kernel. If someone is able to modify a function descriptor he will be able to run arbitrary kernel function instead of another.
To avoid that, move .opd section inside read-only memory.
Stable-dep-of: 1b1e38002648 ("powerpc: add crtsavres.o to always-y instead of extra-y")
--- arch/powerpc/kernel/vmlinux.lds.S | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/powerpc/kernel/vmlinux.lds.S +6 -6
@@ -148,6 +148,12 @@ SECTIONS SOFT_MASK_TABLE(8) RESTART_TABLE(8) + .opd : AT(ADDR(.opd) - LOAD_OFFSET) { + __start_opd = .; + KEEP(*(.opd)) + __end_opd = .; + } + . = ALIGN(8); __stf_entry_barrier_fixup : AT(ADDR(__stf_entry_barrier_fixup) - LOAD_OFFSET) { __start___stf_entry_barrier_fixup = .;
@@ -346,12 +352,6 @@ SECTIONS *(.branch_lt) } - .opd : AT(ADDR(.opd) - LOAD_OFFSET) { - __start_opd = .; - KEEP(*(.opd)) - __end_opd = .; - } - . = ALIGN(256); .got : AT(ADDR(.got) - LOAD_OFFSET) { __toc_start = .;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/374 powerpc/toc: Future proof kernel toc
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Modra <[email protected]>
[ Upstream commit a3ad84da076009c94969fa97f604257667e2980f ]
This patch future-proofs the kernel against linker changes that might put the toc pointer at some location other than .got+0x8000, by replacing __toc_start+0x8000 with .TOC. throughout. If the kernel's idea of the toc pointer doesn't agree with the linker, bad things happen.
prom_init.c code relocating its toc is also changed so that a symbolic __prom_init_toc_start toc-pointer relative address is calculated rather than assuming that it is always at toc-pointer - 0x8000. The length calculations loading values from the toc are also avoided. It's a little incestuous to do that with unreloc_toc picking up adjusted values (which is fine in practice, they both adjust by the same amount if all goes well).
I've also changed the way .got is aligned in vmlinux.lds and zImage.lds, mostly so that dumping out section info by objdump or readelf plainly shows the alignment is 256. This linker script feature was added 2005-09-27, available in FSF binutils releases from 2.17 onwards. Should be safe to use in the kernel, I think.
Finally, put *(.got) before the prom_init.o entry which only needs *(.toc), so that the GOT header goes in the correct place. I don't believe this makes any difference for the kernel as it would for dynamic objects being loaded by ld.so. That change is just to stop lusers who blindly copy kernel scripts being led astray. Of course, this change needs the prom_init.c changes.
Some notes on .toc and .got.
.toc is a compiler generated section of addresses. .got is a linker generated section of addresses, generally built when the linker sees R_*_*GOT* relocations. In the case of powerpc64 ld.bfd, there are multiple generated .got sections, one per input object file. So you can somewhat reasonably write in a linker script an input section statement like *prom_init.o(.got .toc) to mean "the .got and .toc section for files matching *prom_init.o". On other architectures that doesn't make sense, because the linker generally has just one .got section. Even on powerpc64, note well that the GOT entries for prom_init.o may be merged with GOT entries from other objects. That means that if prom_init.o references, say, _end via some GOT relocation, and some other object also references _end via a GOT relocation, the GOT entry for _end may be in the range __prom_init_toc_start to __prom_init_toc_end and if the kernel does something special to GOT/TOC entries in that range then the value of _end as seen by objects other than prom_init.o will be affected. On the other hand the GOT entry for _end may not be in the range __prom_init_toc_start to __prom_init_toc_end. Which way it turns out is deterministic but a detail of linker operation that should not be relied on.
A feature of ld.bfd is that input .toc (and .got) sections matching one linker input section statement may be sorted, to put entries used by small-model code first, near the toc base. This is why scripts for powerpc64 normally use *(.got .toc) rather than *(.got) *(.toc), since the first form allows more freedom to sort.
Another feature of ld.bfd is that indirect addressing sequences using the GOT/TOC may be edited by the linker to relative addressing. In many cases relative addressing would be emitted by gcc for -mcmodel=medium if you appropriately decorate variable declarations with non-default visibility.
The original patch is here:
https://lore.kernel.org/linuxppc-dev/[email protected]/
Stable-dep-of: 1b1e38002648 ("powerpc: add crtsavres.o to always-y instead of extra-y")
--- arch/powerpc/Makefile | 5 +++-- arch/powerpc/boot/crt0.S | 2 +- arch/powerpc/boot/zImage.lds.S | 7 ++----- arch/powerpc/include/asm/sections.h | 16 ++++++++-------- arch/powerpc/kernel/head_64.S | 2 +- arch/powerpc/kernel/vmlinux.lds.S | 8 +++----- 6 files changed, 18 insertions(+), 22 deletions(-)
arch/powerpc/Makefile +3 -2
@@ -437,10 +437,11 @@ PHONY += checkbin # Check toolchain versions: # - gcc-4.6 is the minimum kernel-wide version so nothing required. checkbin: - @if test "x${CONFIG_CPU_LITTLE_ENDIAN}" = "xy" \ - && $(LD) --version | head -1 | grep ' 2\.24$$' >/dev/null ; then \ + @if test "x${CONFIG_LD_IS_LLD}" != "xy" -a \ + "x$(call ld-ifversion, -le, 22400, y)" = "xy" ; then \ echo -n '*** binutils 2.24 miscompiles weak symbols ' ; \ echo 'in some circumstances.' ; \ + echo '*** binutils 2.23 do not define the TOC symbol ' ; \ echo -n '*** Please use a different binutils version.' ; \ false ; \ fi
arch/powerpc/boot/crt0.S +1 -1
@@ -28,7 +28,7 @@ p_etext: .8byte _etext p_bss_start: .8byte __bss_start p_end: .8byte _end -p_toc: .8byte __toc_start + 0x8000 - p_base +p_toc: .8byte .TOC. - p_base p_dyn: .8byte __dynamic_start - p_base p_rela: .8byte __rela_dyn_start - p_base p_prom: .8byte 0
arch/powerpc/boot/zImage.lds.S +2 -5
@@ -36,12 +36,9 @@ SECTIONS } #ifdef CONFIG_PPC64_BOOT_WRAPPER - . = ALIGN(256); - .got : + .got : ALIGN(256) { - __toc_start = .; - *(.got) - *(.toc) + *(.got .toc) } #endif
arch/powerpc/include/asm/sections.h +8 -8
@@ -26,16 +26,16 @@ extern char start_virt_trampolines[];extern char end_virt_trampolines[];#endif +/* +* This assumes the kernel is never compiled -mcmodel=small or +* the total .toc is always less than 64k. +*/ static inline unsigned long kernel_toc_addr (void ) { -/* Defined by the linker, see vmlinux.lds.S */ -extern unsigned long __toc_start; - -/* -* The TOC register (r2) points 32kB into the TOC, so that 64kB of -* the TOC can be addressed using a single machine instruction. -*/ -return (unsigned long )(&__toc_start) +0x8000UL ; +unsigned long toc_ptr; + + asmvolatile ("mr %0, 2" :"=r" (toc_ptr)); +return toc_ptr; } static inline int overlaps_interrupt_vector_text(unsigned long start,
arch/powerpc/kernel/head_64.S +1 -1
@@ -904,7 +904,7 @@ _GLOBAL(relative_toc) blr .balign 8 -p_toc: .8byte __toc_start + 0x8000 - 0b +p_toc: .8byte .TOC. - 0b /* * This is where the main kernel code starts.
arch/powerpc/kernel/vmlinux.lds.S +3 -5
@@ -352,15 +352,13 @@ SECTIONS *(.branch_lt) } - . = ALIGN(256); - .got : AT(ADDR(.got) - LOAD_OFFSET) { - __toc_start = .; + .got : AT(ADDR(.got) - LOAD_OFFSET) ALIGN(256) { + *(.got) #ifndef CONFIG_RELOCATABLE __prom_init_toc_start = .; - arch/powerpc/kernel/prom_init.o*(.toc .got) + arch/powerpc/kernel/prom_init.o*(.toc) __prom_init_toc_end = .; #endif - *(.got) *(.toc) } #endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/374 powerpc: remove checks for binutils older than 2.25
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 54a11654de163994e32b24e3aa90ef81f4a3184d ]
Commit e4412739472b ("Documentation: raise minimum supported version of binutils to 2.25") allows us to remove the checks for old binutils.
There is no more user for ld-ifversion. Remove it as well.
Stable-dep-of: 1b1e38002648 ("powerpc: add crtsavres.o to always-y instead of extra-y")
--- arch/powerpc/Makefile | 17 +---------------- arch/powerpc/lib/Makefile | 2 +- scripts/Makefile.compiler | 4 ---- 3 files changed, 2 insertions(+), 21 deletions(-)
arch/powerpc/Makefile +1 -16
@@ -44,18 +44,13 @@ machine-$(CONFIG_PPC64) += 64 machine-$(CONFIG_CPU_LITTLE_ENDIAN) += le UTS_MACHINE := $(subst $(space),,$(machine-y)) -# XXX This needs to be before we override LD below -ifdef CONFIG_PPC32 -KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o -else -ifeq ($(call ld-ifversion, -ge, 22500, y),y) +ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy) # Have the linker provide sfpr if possible. # There is a corresponding test in arch/powerpc/lib/Makefile KBUILD_LDFLAGS_MODULE += --save-restore-funcs else KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o endif -endif ifdef CONFIG_CPU_LITTLE_ENDIAN KBUILD_CFLAGS += -mlittle-endian
@@ -434,17 +429,7 @@ endif # CONFIG_PPC32 endif # CONFIG_SMP PHONY += checkbin -# Check toolchain versions: -# - gcc-4.6 is the minimum kernel-wide version so nothing required. checkbin: - @if test "x${CONFIG_LD_IS_LLD}" != "xy" -a \ - "x$(call ld-ifversion, -le, 22400, y)" = "xy" ; then \ - echo -n '*** binutils 2.24 miscompiles weak symbols ' ; \ - echo 'in some circumstances.' ; \ - echo '*** binutils 2.23 do not define the TOC symbol ' ; \ - echo -n '*** Please use a different binutils version.' ; \ - false ; \ - fi @if test "x${CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT}" = "xy" -a \ "x${CONFIG_LD_IS_BFD}" = "xy" -a \ "${CONFIG_LD_VERSION}" = "23700" ; then \
arch/powerpc/lib/Makefile +1 -1
@@ -37,7 +37,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION) += error-inject.o # 64-bit linker creates .sfpr on demand for final link (vmlinux), # so it is only needed for modules, and only for older linkers which # do not support --save-restore-funcs -ifeq ($(call ld-ifversion, -lt, 22500, y),y) +ifndef CONFIG_LD_IS_BFD extra-$(CONFIG_PPC64) += crtsavres.o endif
scripts/Makefile.compiler +0 -4
@@ -68,7 +68,3 @@ cc-ifversion = $(shell [ $(CONFIG_GCC_VERSION)0 $(1) $(2)000 ] && echo $(3) || e # ld-option # Usage: KBUILD_LDFLAGS += $(call ld-option, -X, -Y) ld-option = $(call try-run, $(LD) $(KBUILD_LDFLAGS) $(1) -v,$(1),$(2),$(3)) - -# ld-ifversion -# Usage: $(call ld-ifversion, -ge, 22252, y) -ld-ifversion = $(shell [ $(CONFIG_LD_VERSION)0 $(1) $(2)0 ] && echo $(3) || echo $(4))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/374 powerpc: add crtsavres.o to always-y instead of extra-y
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 1b1e38002648819c04773647d5242990e2824264 ]
crtsavres.o is linked to modules. However, as explained in commit d0e628cd817f ("kbuild: doc: clarify the difference between extra-y and always-y"), 'make modules' does not build extra-y.
For example, the following command fails:
$ make ARCH=powerpc LLVM=1 KBUILD_MODPOST_WARN=1 mrproper ps3_defconfig modules
[snip]
LD [M] arch/powerpc/platforms/cell/spufs/spufs.ko
ld.lld: error: cannot open arch/powerpc/lib/crtsavres.o: No such file or directory
make[3]: *** [scripts/Makefile.modfinal:56: arch/powerpc/platforms/cell/spufs/spufs.ko] Error 1
make[2]: *** [Makefile:1844: modules] Error 2
make[1]: *** [/home/masahiro/workspace/linux-kbuild/Makefile:350: __build_one_by_one] Error 2
make: *** [Makefile:234: __sub-make] Error 2--- arch/powerpc/lib/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/lib/Makefile +1 -1
@@ -38,7 +38,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION) += error-inject.o # so it is only needed for modules, and only for older linkers which # do not support --save-restore-funcs ifndef CONFIG_LD_IS_BFD -extra-$(CONFIG_PPC64) += crtsavres.o +always-$(CONFIG_PPC64) += crtsavres.o endif obj-$(CONFIG_PPC_BOOK3S_64) += copyuser_power7.o copypage_power7.o \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/374 powerpc/44x: select I2C for CURRITUCK
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 4a74197b65e69c46fe6e53f7df2f4d6ce9ffe012 ]
Fix build errors when CURRITUCK=y and I2C is not builtin (=m or is not set). Fixes these build errors:
powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `avr_halt_system':
ppc476.c:(.text+0x58): undefined reference to `i2c_smbus_write_byte_data'
powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `ppc47x_device_probe':
ppc476.c:(.init.text+0x18): undefined reference to `i2c_register_driver'
--- arch/powerpc/platforms/44x/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/44x/Kconfig +1 -0
@@ -177,6 +177,7 @@ config ISS4xx config CURRITUCK bool "IBM Currituck (476fpe) Support" depends on PPC_47x + select I2C select SWIOTLB select 476FPE select FORCE_PCI
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/374 powerpc/pseries/memhp: Fix access beyond end of drmem array
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
[ Upstream commit bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5 ]
dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with the given DRC index. When the search fails, the cursor is left pointing to &drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the last valid entry in the array. The debug message at the end of the function then dereferences this pointer:
pr_debug("Failed to hot-remove memory at %llx\n",
lmb->base_addr);
This was found by inspection and confirmed with KASAN:
pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234
==================================================================
BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658 Read of size 8 at addr c000000364e97fd0 by task bash/949 dump_stack_lvl+0xa4/0xfc (unreliable) print_report+0x214/0x63c kasan_report+0x140/0x2e0 __asan_load8+0xa8/0xe0 dlpar_memory+0x298/0x1658 handle_dlpar_errorlog+0x130/0x1d0 dlpar_store+0x18c/0x3e0 kobj_attr_store+0x68/0xa0 sysfs_kf_write+0xc4/0x110 kernfs_fop_write_iter+0x26c/0x390 vfs_write+0x2d4/0x4e0 ksys_write+0xac/0x1a0 system_call_exception+0x268/0x530 system_call_vectored_common+0x15c/0x2ec Allocated by task 1: kasan_save_stack+0x48/0x80 kasan_set_track+0x34/0x50 kasan_save_alloc_info+0x34/0x50 __kasan_kmalloc+0xd0/0x120 __kmalloc+0x8c/0x320 kmalloc_array.constprop.0+0x48/0x5c drmem_init+0x2a0/0x41c do_one_initcall+0xe0/0x5c0 kernel_init_freeable+0x4ec/0x5a0 kernel_init+0x30/0x1e0 ret_from_kernel_user_thread+0x14/0x1c The buggy address belongs to the object at c000000364e80000 which belongs to the cache kmalloc-128k of size 131072 The buggy address is located 0 bytes to the right of allocated 98256-byte region [c000000364e80000, c000000364e97fd0)
==================================================================
pseries-hotplug-mem: Failed to hot-remove memory at 0
Log failed lookups with a separate message and dereference the cursor only when it points to a valid entry.
--- arch/powerpc/platforms/pseries/hotplug-memory.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/powerpc/platforms/pseries/hotplug-memory.c +5 -4
@@ -501,14 +501,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index) } } -if (!lmb_found) +if (!lmb_found) { +pr_debug ("Failed to look up LMB for drc index %x\n" , drc_index); rc = -EINVAL ; - -if (rc) + }else if (rc) {pr_debug ("Failed to hot-remove memory at %llx\n" , lmb->base_addr); -else + }else {pr_debug ("Memory at %llx was hot-removed\n" , lmb->base_addr); + }return rc; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/374 selftests/powerpc: Fix error handling in FPU/VMX preemption tests
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 9dbd5927408c4a0707de73ae9dd9306b184e8fee ]
The FPU & VMX preemption tests do not check for errors returned by the low-level asm routines, preempt_fpu() / preempt_vsx() respectively. That means any register corruption detected by the asm routines does not result in a test failure.
Fix it by returning the return value of the asm routines from the pthread child routines.
--- tools/testing/selftests/powerpc/math/fpu_preempt.c | 9 +++++---- tools/testing/selftests/powerpc/math/vmx_preempt.c | 10 ++++++---- 2 files changed, 11 insertions(+), 8 deletions(-)
tools/testing/selftests/powerpc/math/fpu_preempt.c +5 -4
@@ -37,19 +37,20 @@ __thread double darray[] = {0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0,int threads_starting;int running; -extern void preempt_fpu (double *darray,int *threads_starting,int *running); +extern int preempt_fpu (double *darray,int *threads_starting,int *running);void *preempt_fpu_c (void *p) { +long rc;int i; +srand (pthread_self ());for (i =0 ; i <21 ; i++) darray[i] =rand (); -/* Test failed if it ever returns */ -preempt_fpu (darray, &threads_starting, &running); + rc =preempt_fpu (darray, &threads_starting, &running); -return p; +return (void *)rc; }int test_preempt_fpu (void )
tools/testing/selftests/powerpc/math/vmx_preempt.c +6 -4
@@ -37,19 +37,21 @@ __thread vector int varray[] = {{1, 2, 3, 4}, {5, 6, 7, 8}, {9, 10,11,12},int threads_starting;int running; -extern void preempt_vmx(vector int *varray, int *threads_starting, int *running); +extern int preempt_vmx(vector int *varray, int *threads_starting, int *running);void *preempt_vmx_c (void *p) {int i, j; +long rc; +srand (pthread_self ());for (i =0 ; i <12 ; i++)for (j =0 ; j <4 ; j++) varray[i][j] =rand (); -/* Test fails if it ever returns */ -preempt_vmx (varray, &threads_starting, &running); -return p; + rc =preempt_vmx (varray, &threads_starting, &running); + +return (void *)rc; }int test_preempt_vmx (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/374 powerpc/powernv: Add a null pointer check to scom_debug_init_one()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 9a260f2dd827bbc82cc60eb4f4d8c22707d80742 ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
Add a null pointer check, and release 'ent' to avoid memory leaks.
--- arch/powerpc/platforms/powernv/opal-xscom.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/powerpc/platforms/powernv/opal-xscom.c +5 -0
@@ -165,6 +165,11 @@ static int scom_debug_init_one(struct dentry *root, struct device_node *dn, ent->chip = chip;snprintf (ent->name,16 ,"%08x" , chip); ent->path.data = (void *)kasprintf (GFP_KERNEL ,"%pOF" , dn); +if (!ent->path.data) { +kfree (ent); +return -ENOMEM ; + } + ent->path.size =strlen ((char *)ent->path.data); dir =debugfs_create_dir (ent->name, root);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/374 powerpc/powernv: Add a null pointer check in opal_event_init()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 8649829a1dd25199bbf557b2621cedb4bf9b3050 ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
--- arch/powerpc/platforms/powernv/opal-irqchip.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/platforms/powernv/opal-irqchip.c +2 -0
@@ -275,6 +275,8 @@ int __init opal_event_init(void)else name =kasprintf (GFP_KERNEL ,"opal" ); +if (!name) +continue ;/* Install interrupt handler */ rc =request_irq (r->start, opal_interrupt, r->flags &IRQD_TRIGGER_MASK , name,NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/374 powerpc/powernv: Add a null pointer check in opal_powercap_init()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit e123015c0ba859cf48aa7f89c5016cc6e98e018d ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
--- arch/powerpc/platforms/powernv/opal-powercap.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/platforms/powernv/opal-powercap.c +6 -0
@@ -196,6 +196,12 @@ void __init opal_powercap_init(void) j =0 ; pcaps[i].pg.name =kasprintf (GFP_KERNEL ,"%pOFn" , node); +if (!pcaps[i].pg.name) { +kfree (pcaps[i].pattrs); +kfree (pcaps[i].pg.attrs); + goto out_pcaps_pattrs; + } +if (has_min) {powercap_add_attr (min,"powercap-min" , &pcaps[i].pattrs[j]);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/374 powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 0a233867a39078ebb0f575e2948593bbff5826b3 ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
--- arch/powerpc/perf/imc-pmu.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/perf/imc-pmu.c +6 -0
@@ -292,6 +292,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attr_group->attrs = attrs; do { ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); + if (!ev_val_str) + continue; dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); if (!dev_str) continue;
@@ -299,6 +301,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attrs[j++] = dev_str;if (pmu->events[i].scale) { ev_scale_str =kasprintf (GFP_KERNEL ,"%s.scale" , pmu->events[i].name); +if (!ev_scale_str) +continue ; dev_str =device_str_attr_create (ev_scale_str, pmu->events[i].scale);if (!dev_str)continue ;
@@ -308,6 +312,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)if (pmu->events[i].unit) { ev_unit_str =kasprintf (GFP_KERNEL ,"%s.unit" , pmu->events[i].name); +if (!ev_unit_str) +continue ; dev_str =device_str_attr_create (ev_unit_str, pmu->events[i].unit);if (!dev_str)continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/374 spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Kumar Mahapatra <[email protected]>
[ Upstream commit 424a8166764e462258fdccaaefbdeb07517c8b21 ]
ZynqMP GQSPI driver no longer uses spi-master framework. It had been converted to use spi-mem framework. So remove driver dependency from spi-master and replace it with spi-mem.
--- drivers/spi/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/Kconfig +2 -1
@@ -984,9 +984,10 @@ config SPI_ZYNQ_QSPI config SPI_ZYNQMP_GQSPI tristate "Xilinx ZynqMP GQSPI controller" - depends on (SPI_MASTER && HAS_DMA) || COMPILE_TEST + depends on (SPI_MEM && HAS_DMA) || COMPILE_TEST help Enables Xilinx GQSPI controller driver for Zynq UltraScale+ MPSoC. + This controller only supports SPI memory interface. config SPI_AMD tristate "AMD SPI controller"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/374 mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Monthero <[email protected]>
[ Upstream commit 923fb6238cb3ac529aa2bf13b3b1e53762186a8b ]
Under heavy load it is likely that the controller is done with its own task but the thread unlocking the wait is not scheduled in time. Increasing IFC_TIMEOUT_MSECS allows the controller to respond within allowable timeslice of 1 sec.
fsl,ifc-nand 7e800000.nand: Controller is not responding
[<804b2047>] (nand_get_device) from [<804b5335>] (nand_write_oob+0x1b/0x4a) [<804b5335>] (nand_write_oob) from [<804a3585>] (mtd_write+0x41/0x5c) [<804a3585>] (mtd_write) from [<804c1d47>] (ubi_io_write+0x17f/0x22c) [<804c1d47>] (ubi_io_write) from [<804c047b>] (ubi_eba_write_leb+0x5b/0x1d0)
--- drivers/mtd/nand/raw/fsl_ifc_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/fsl_ifc_nand.c +1 -1
@@ -20,7 +20,7 @@#define ERR_BYTE 0xFF/* Value returned for read bytes when read failed */ -#define IFC_TIMEOUT_MSECS 500/* Maximum number of mSecs to wait +#define IFC_TIMEOUT_MSECS 1000/* Maximum timeout to wait for IFC NAND Machine */ struct fsl_ifc_ctrl ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/374 ACPI: video: check for error while searching for backlight device parent
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Kiryushin <[email protected]>
[ Upstream commit ccd45faf4973746c4f30ea41eec864e5cf191099 ]
If acpi_get_parent() called in acpi_video_dev_register_backlight() fails, for example, because acpi_ut_acquire_mutex() fails inside acpi_get_parent), this can lead to incorrect (uninitialized) acpi_parent handle being passed to acpi_get_pci_dev() for detecting the parent pci device.
Check acpi_get_parent() result and set parent device only in case of success.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/acpi_video.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/acpi/acpi_video.c +6 -6
@@ -1793,12 +1793,12 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device)return ; count++; -acpi_get_parent (device->dev->handle, &acpi_parent); - - pdev =acpi_get_pci_dev (acpi_parent); -if (pdev) { - parent = &pdev->dev; -pci_dev_put (pdev); +if (ACPI_SUCCESS (acpi_get_parent (device->dev->handle, &acpi_parent))) { + pdev =acpi_get_pci_dev (acpi_parent); +if (pdev) { + parent = &pdev->dev; +pci_dev_put (pdev); + } }memset (&props,0 ,sizeof (struct backlight_properties ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/374 ACPI: LPIT: Avoid u32 multiplication overflow
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Kiryushin <[email protected]>
[ Upstream commit 56d2eeda87995245300836ee4dbd13b002311782 ]
In lpit_update_residency() there is a possibility of overflow in multiplication, if tsc_khz is large enough (> UINT_MAX/1000).
Change multiplication to mul_u32_u32().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/acpi_lpit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpi_lpit.c +1 -1
@@ -98,7 +98,7 @@ static void lpit_update_residency(struct lpit_residency_info *info, struct acpi_lpit_native *lpit_native) { info->frequency = lpit_native->counter_frequency ? - lpit_native->counter_frequency : tsc_khz *1000 ; + lpit_native->counter_frequency :mul_u32_u32 (tsc_khz,1000U );if (!info->frequency) info->frequency =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/374 of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit 2ca42c3ad9ed875b136065b010753a4caaaa1d38 ]
We can get rid of all the empty stubs because all these functions call of_property_read_variable_u{8,16,32,64}_array() which already have an empty stub if CONFIG_OF is not defined.
Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()")
--- include/linux/of.h | 274 ++++++++++++++++++++------------------------- 1 file changed, 124 insertions(+), 150 deletions(-)
include/linux/of.h +124 -150
@@ -415,130 +415,6 @@ extern int of_detach_node(struct device_node *);#define of_match_ptr (_ptr) (_ptr) -/** -* of_property_read_u8_array - Find and read an array of u8 from a property. -* -* @np: device node from which the property value is to be read. -* @propname: name of the property to be searched. -* @out_values: pointer to return value, modified only if return value is 0. -* @sz: number of array elements to read -* -* Search for a property in a device node and read 8-bit value(s) from -* it. -* -* dts entry of array should be like: -* ``property = /bits/ 8 <0x50 0x60 0x70>;`` -* -* Return: 0 on success, -EINVAL if the property does not exist, -* -ENODATA if property does not have a value, and -EOVERFLOW if the -* property data isn't large enough. -* -* The out_values is modified only if a valid u8 value can be decoded. -*/ -static inline int of_property_read_u8_array (const struct device_node *np, -const char *propname, -u8 *out_values,size_t sz) -{ -int ret =of_property_read_variable_u8_array (np, propname, out_values, - sz,0 ); -if (ret >=0 ) -return 0 ; -else -return ret; -} - -/** -* of_property_read_u16_array - Find and read an array of u16 from a property. -* -* @np: device node from which the property value is to be read. -* @propname: name of the property to be searched. -* @out_values: pointer to return value, modified only if return value is 0. -* @sz: number of array elements to read -* -* Search for a property in a device node and read 16-bit value(s) from -* it. -* -* dts entry of array should be like: -* ``property = /bits/ 16 <0x5000 0x6000 0x7000>;`` -* -* Return: 0 on success, -EINVAL if the property does not exist, -* -ENODATA if property does not have a value, and -EOVERFLOW if the -* property data isn't large enough. -* -* The out_values is modified only if a valid u16 value can be decoded. -*/ -static inline int of_property_read_u16_array (const struct device_node *np, -const char *propname, -u16 *out_values,size_t sz) -{ -int ret =of_property_read_variable_u16_array (np, propname, out_values, - sz,0 ); -if (ret >=0 ) -return 0 ; -else -return ret; -} - -/** -* of_property_read_u32_array - Find and read an array of 32 bit integers -* from a property. -* -* @np: device node from which the property value is to be read. -* @propname: name of the property to be searched. -* @out_values: pointer to return value, modified only if return value is 0. -* @sz: number of array elements to read -* -* Search for a property in a device node and read 32-bit value(s) from -* it. -* -* Return: 0 on success, -EINVAL if the property does not exist, -* -ENODATA if property does not have a value, and -EOVERFLOW if the -* property data isn't large enough. -* -* The out_values is modified only if a valid u32 value can be decoded. -*/ -static inline int of_property_read_u32_array (const struct device_node *np, -const char *propname, -u32 *out_values,size_t sz) -{ -int ret =of_property_read_variable_u32_array (np, propname, out_values, - sz,0 ); -if (ret >=0 ) -return 0 ; -else -return ret; -} - -/** -* of_property_read_u64_array - Find and read an array of 64 bit integers -* from a property. -* -* @np: device node from which the property value is to be read. -* @propname: name of the property to be searched. -* @out_values: pointer to return value, modified only if return value is 0. -* @sz: number of array elements to read -* -* Search for a property in a device node and read 64-bit value(s) from -* it. -* -* Return: 0 on success, -EINVAL if the property does not exist, -* -ENODATA if property does not have a value, and -EOVERFLOW if the -* property data isn't large enough. -* -* The out_values is modified only if a valid u64 value can be decoded. -*/ -static inline int of_property_read_u64_array (const struct device_node *np, -const char *propname, -u64 *out_values,size_t sz) -{ -int ret =of_property_read_variable_u64_array (np, propname, out_values, - sz,0 ); -if (ret >=0 ) -return 0 ; -else -return ret; -} -/* * struct property *prop; * const __be32 *p;
@@ -733,32 +609,6 @@ static inline int of_property_count_elems_of_size(const struct device_node *np,return -ENOSYS ; } -static inline int of_property_read_u8_array (const struct device_node *np, -const char *propname,u8 *out_values,size_t sz) -{ -return -ENOSYS ; -} - -static inline int of_property_read_u16_array (const struct device_node *np, -const char *propname,u16 *out_values,size_t sz) -{ -return -ENOSYS ; -} - -static inline int of_property_read_u32_array (const struct device_node *np, -const char *propname, -u32 *out_values,size_t sz) -{ -return -ENOSYS ; -} - -static inline int of_property_read_u64_array (const struct device_node *np, -const char *propname, -u64 *out_values,size_t sz) -{ -return -ENOSYS ; -} -static inline int of_property_read_u32_index (const struct device_node *np,const char *propname,u32 index,u32 *out_value) {
@@ -1235,6 +1085,130 @@ static inline bool of_property_read_bool(const struct device_node *np,return prop ? true : false; } +/** +* of_property_read_u8_array - Find and read an array of u8 from a property. +* +* @np: device node from which the property value is to be read. +* @propname: name of the property to be searched. +* @out_values: pointer to return value, modified only if return value is 0. +* @sz: number of array elements to read +* +* Search for a property in a device node and read 8-bit value(s) from +* it. +* +* dts entry of array should be like: +* ``property = /bits/ 8 <0x50 0x60 0x70>;`` +* +* Return: 0 on success, -EINVAL if the property does not exist, +* -ENODATA if property does not have a value, and -EOVERFLOW if the +* property data isn't large enough. +* +* The out_values is modified only if a valid u8 value can be decoded. +*/ +static inline int of_property_read_u8_array (const struct device_node *np, +const char *propname, +u8 *out_values,size_t sz) +{ +int ret =of_property_read_variable_u8_array (np, propname, out_values, + sz,0 ); +if (ret >=0 ) +return 0 ; +else +return ret; +} + +/** +* of_property_read_u16_array - Find and read an array of u16 from a property. +* +* @np: device node from which the property value is to be read. +* @propname: name of the property to be searched. +* @out_values: pointer to return value, modified only if return value is 0. +* @sz: number of array elements to read +* +* Search for a property in a device node and read 16-bit value(s) from +* it. +* +* dts entry of array should be like: +* ``property = /bits/ 16 <0x5000 0x6000 0x7000>;`` +* +* Return: 0 on success, -EINVAL if the property does not exist, +* -ENODATA if property does not have a value, and -EOVERFLOW if the +* property data isn't large enough. +* +* The out_values is modified only if a valid u16 value can be decoded. +*/ +static inline int of_property_read_u16_array (const struct device_node *np, +const char *propname, +u16 *out_values,size_t sz) +{ +int ret =of_property_read_variable_u16_array (np, propname, out_values, + sz,0 ); +if (ret >=0 ) +return 0 ; +else +return ret; +} + +/** +* of_property_read_u32_array - Find and read an array of 32 bit integers +* from a property. +* +* @np: device node from which the property value is to be read. +* @propname: name of the property to be searched. +* @out_values: pointer to return value, modified only if return value is 0. +* @sz: number of array elements to read +* +* Search for a property in a device node and read 32-bit value(s) from +* it. +* +* Return: 0 on success, -EINVAL if the property does not exist, +* -ENODATA if property does not have a value, and -EOVERFLOW if the +* property data isn't large enough. +* +* The out_values is modified only if a valid u32 value can be decoded. +*/ +static inline int of_property_read_u32_array (const struct device_node *np, +const char *propname, +u32 *out_values,size_t sz) +{ +int ret =of_property_read_variable_u32_array (np, propname, out_values, + sz,0 ); +if (ret >=0 ) +return 0 ; +else +return ret; +} + +/** +* of_property_read_u64_array - Find and read an array of 64 bit integers +* from a property. +* +* @np: device node from which the property value is to be read. +* @propname: name of the property to be searched. +* @out_values: pointer to return value, modified only if return value is 0. +* @sz: number of array elements to read +* +* Search for a property in a device node and read 64-bit value(s) from +* it. +* +* Return: 0 on success, -EINVAL if the property does not exist, +* -ENODATA if property does not have a value, and -EOVERFLOW if the +* property data isn't large enough. +* +* The out_values is modified only if a valid u64 value can be decoded. +*/ +static inline int of_property_read_u64_array (const struct device_node *np, +const char *propname, +u64 *out_values,size_t sz) +{ +int ret =of_property_read_variable_u64_array (np, propname, out_values, + sz,0 ); +if (ret >=0 ) +return 0 ; +else +return ret; +} +static inline int of_property_read_u8 (const struct device_node *np,const char *propname,u8 *out_value)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/374 of: Add of_property_present() helper
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit 9cbad37ce8122de32a1529e394b468bc101c9e7f ]
Add an of_property_present() function similar to fwnode_property_present(). of_property_read_bool() could be used directly, but it is cleaner to not use it on non-boolean properties.
Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()")
--- include/linux/of.h | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
include/linux/of.h +16 -1
@@ -1073,7 +1073,8 @@ static inline int of_property_read_string_index(const struct device_node *np,* @np: device node from which the property value is to be read. * @propname: name of the property to be searched. * -* Search for a property in a device node. +* Search for a boolean property in a device node. Usage on non-boolean +* property types is deprecated. * * Return: true if the property exists false otherwise. */
@@ -1085,6 +1086,20 @@ static inline bool of_property_read_bool(const struct device_node *np,return prop ? true : false; } +/** +* of_property_present - Test if a property is present in a node +* @np: device node to search for the property. +* @propname: name of the property to be searched. +* +* Test for a property present in a device node. +* +* Return: true if the property exists false otherwise. +*/ +static inline bool of_property_present (const struct device_node *np,const char *propname) +{ +return of_property_read_bool (np, propname); +} +/** * of_property_read_u8_array - Find and read an array of u8 from a property. *
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/374 cpufreq: Use of_property_present() for testing DT property presence
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <[email protected]>
[ Upstream commit b8f3a396a7ee43e6079176cc0fb8de2b95a23681 ]
It is preferred to use typed property access functions (i.e. of_property_read_<type> functions) rather than low-level of_get_property/of_find_property functions for reading properties. As part of this, convert of_get_property/of_find_property calls to the recently added of_property_present() helper when we just want to test for presence of a property and nothing more.
Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()")
--- drivers/cpufreq/cpufreq-dt-platdev.c | 2 +- drivers/cpufreq/imx-cpufreq-dt.c | 2 +- drivers/cpufreq/imx6q-cpufreq.c | 4 ++-- drivers/cpufreq/scmi-cpufreq.c | 2 +- drivers/cpufreq/tegra20-cpufreq.c | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-)
drivers/cpufreq/cpufreq-dt-platdev.c +1 -1
@@ -171,7 +171,7 @@ static bool __init cpu0_node_has_opp_v2_prop(void)struct device_node *np =of_cpu_device_node_get (0 );bool ret = false; -if (of_get_property (np,"operating-points-v2" ,NULL )) +if (of_property_present (np,"operating-points-v2" )) ret = true;of_node_put (np);
drivers/cpufreq/imx-cpufreq-dt.c +1 -1
@@ -89,7 +89,7 @@ static int imx_cpufreq_dt_probe(struct platform_device *pdev) cpu_dev =get_cpu_device (0 ); -if (!of_find_property (cpu_dev->of_node,"cpu-supply" ,NULL )) +if (!of_property_present (cpu_dev->of_node,"cpu-supply" ))return -ENODEV ;if (of_machine_is_compatible ("fsl,imx7ulp" )) {
drivers/cpufreq/imx6q-cpufreq.c +2 -2
@@ -230,7 +230,7 @@ static int imx6q_opp_check_speed_grading(struct device *dev)u32 val;int ret; -if (of_find_property (dev->of_node,"nvmem-cells" ,NULL )) { +if (of_property_present (dev->of_node,"nvmem-cells" )) { ret =nvmem_cell_read_u32 (dev,"speed_grade" , &val);if (ret)return ret;
@@ -285,7 +285,7 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)u32 val;int ret =0 ; -if (of_find_property (dev->of_node,"nvmem-cells" ,NULL )) { +if (of_property_present (dev->of_node,"nvmem-cells" )) { ret =nvmem_cell_read_u32 (dev,"speed_grade" , &val);if (ret)return ret;
drivers/cpufreq/scmi-cpufreq.c +1 -1
@@ -299,7 +299,7 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev)#ifdef CONFIG_COMMON_CLK /* dummy clock provider as needed by OPP if clocks property is used */ -if (of_find_property (dev->of_node,"#clock-cells" ,NULL )) +if (of_property_present (dev->of_node,"#clock-cells" ))devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get,NULL );#endif
drivers/cpufreq/tegra20-cpufreq.c +1 -1
@@ -25,7 +25,7 @@ static bool cpu0_node_has_opp_v2_prop(void)struct device_node *np =of_cpu_device_node_get (0 );bool ret = false; -if (of_get_property (np,"operating-points-v2" ,NULL )) +if (of_property_present (np,"operating-points-v2" )) ret = true;of_node_put (np);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/374 cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Diupina <[email protected]>
[ Upstream commit c4a5118a3ae1eadc687d84eef9431f9e13eb015c ]
devm_of_clk_add_hw_provider() may return an errno, so add a return value check
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/cpufreq/scmi-cpufreq.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/cpufreq/scmi-cpufreq.c +5 -2
@@ -299,8 +299,11 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev)#ifdef CONFIG_COMMON_CLK /* dummy clock provider as needed by OPP if clocks property is used */ -if (of_property_present (dev->of_node,"#clock-cells" )) -devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get,NULL ); +if (of_property_present (dev->of_node,"#clock-cells" )) { + ret =devm_of_clk_add_hw_provider (dev, of_clk_hw_simple_get,NULL ); +if (ret) +return dev_err_probe (dev, ret,"%s: registering clock provider failed\n" , __func__); + }#endif ret =cpufreq_register_driver (&scmi_cpufreq_driver);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/374 calipso: fix memory leak in netlbl_calipso_add_pass()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavrilov Ilia <[email protected]>
[ Upstream commit ec4e9d630a64df500641892f4e259e8149594a99 ]
If IPv6 support is disabled at boot (ipv6.disable=1),
the calipso_init() -> netlbl_calipso_ops_register() function isn't called, and the netlbl_calipso_ops_get() function always returns NULL. In this case, the netlbl_calipso_add_pass() function allocates memory for the doi_def variable but doesn't free it with the calipso_doi_free().
BUG: memory leak
unreferenced object 0xffff888011d68180 (size 64):
comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s)
hex dump (first 32 bytes):
00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<...>] kmalloc include/linux/slab.h:552 [inline]
[<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline]
[<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111
[<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739
[<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
[<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800
[<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515
[<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811
[<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
[<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339
[<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934
[<...>] sock_sendmsg_nosec net/socket.c:651 [inline]
[<...>] sock_sendmsg+0x157/0x190 net/socket.c:671
[<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342
[<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396
[<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429
[<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
[<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller
--- net/netlabel/netlabel_calipso.c | 49 +++++++++++++++++---------------- 1 file changed, 26 insertions(+), 23 deletions(-)
net/netlabel/netlabel_calipso.c +26 -23
@@ -54,6 +54,28 @@ static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = { [NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 }, }; +static const struct netlbl_calipso_ops *calipso_ops; + +/** +* netlbl_calipso_ops_register - Register the CALIPSO operations +* @ops: ops to register +* +* Description: +* Register the CALIPSO packet engine operations. +* +*/ +const struct netlbl_calipso_ops * +netlbl_calipso_ops_register (const struct netlbl_calipso_ops *ops) +{ +return xchg (&calipso_ops, ops); +} +EXPORT_SYMBOL (netlbl_calipso_ops_register); + +static const struct netlbl_calipso_ops *netlbl_calipso_ops_get (void ) +{ +return READ_ONCE (calipso_ops); +} +/* NetLabel Command Handlers */ /**
@@ -96,15 +118,18 @@ static int netlbl_calipso_add_pass(struct genl_info *info,* */ static int netlbl_calipso_add (struct sk_buff *skb,struct genl_info *info) - {int ret_val = -EINVAL ;struct netlbl_audit audit_info; +const struct netlbl_calipso_ops *ops =netlbl_calipso_ops_get ();if (!info->attrs[NLBL_CALIPSO_A_DOI ] || !info->attrs[NLBL_CALIPSO_A_MTYPE ])return -EINVAL ; +if (!ops) +return -EOPNOTSUPP ; +netlbl_netlink_auditinfo (&audit_info);switch (nla_get_u32 (info->attrs[NLBL_CALIPSO_A_MTYPE ])) {case CALIPSO_MAP_PASS :
@@ -362,28 +387,6 @@ int __init netlbl_calipso_genl_init(void)return genl_register_family (&netlbl_calipso_gnl_family); } -static const struct netlbl_calipso_ops *calipso_ops; - -/** -* netlbl_calipso_ops_register - Register the CALIPSO operations -* @ops: ops to register -* -* Description: -* Register the CALIPSO packet engine operations. -* -*/ -const struct netlbl_calipso_ops * -netlbl_calipso_ops_register (const struct netlbl_calipso_ops *ops) -{ -return xchg (&calipso_ops, ops); -} -EXPORT_SYMBOL (netlbl_calipso_ops_register); - -static const struct netlbl_calipso_ops *netlbl_calipso_ops_get (void ) -{ -return READ_ONCE (calipso_ops); -} -/** * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine * @doi_def: the DOI structure
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/374 efivarfs: force RO when remounting if SetVariable is not supported
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilias Apalodimas <[email protected]>
[ Upstream commit 0e8d2444168dd519fea501599d150e62718ed2fe ]
If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this:
$ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK
[ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]---
Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime.
--- fs/efivarfs/super.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
fs/efivarfs/super.c +12 -0
@@ -13,6 +13,7 @@#include <linux/ucs2_string.h> #include <linux/slab.h> #include <linux/magic.h> +#include <linux/printk.h> #include "internal.h"
@@ -231,8 +232,19 @@ static int efivarfs_get_tree(struct fs_context *fc)return get_tree_single (fc, efivarfs_fill_super); } +static int efivarfs_reconfigure (struct fs_context *fc) +{ +if (!efivar_supports_writes () && !(fc->sb_flags &SB_RDONLY )) { +pr_err ("Firmware does not support SetVariableRT. Can not remount with rw\n" ); +return -EINVAL ; + } + +return 0 ; +} +static const struct fs_context_operations efivarfs_context_ops = { .get_tree = efivarfs_get_tree, + .reconfigure = efivarfs_reconfigure, };static int efivarfs_init_fs_context (struct fs_context *fc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/374 spi: sh-msiof: Enforce fixed DTDL for R-Car H3
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit e5c7bcb499840551cfbe85c6df177ebc50432bf0 ]
Documentation says only DTDL of 200 is allowed for this SoC.
--- drivers/spi/spi-sh-msiof.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/spi/spi-sh-msiof.c +17 -0
@@ -30,12 +30,15 @@#include <asm/unaligned.h> +#define SH_MSIOF_FLAG_FIXED_DTDL_200 BIT(0) +struct sh_msiof_chipdata {u32 bits_per_word_mask;u16 tx_fifo_size;u16 rx_fifo_size;u16 ctlr_flags;u16 min_div_pow; +u32 flags; };struct sh_msiof_spi_priv {
@@ -1073,6 +1076,16 @@ static const struct sh_msiof_chipdata rcar_gen3_data = { .min_div_pow = 1, }; +static const struct sh_msiof_chipdata rcar_r8a7795_data = { + .bits_per_word_mask =SPI_BPW_MASK (8 ) |SPI_BPW_MASK (16 ) | +SPI_BPW_MASK (24 ) |SPI_BPW_MASK (32 ), + .tx_fifo_size =64 , + .rx_fifo_size =64 , + .ctlr_flags =SPI_CONTROLLER_MUST_TX , + .min_div_pow =1 , + .flags =SH_MSIOF_FLAG_FIXED_DTDL_200 , +}; +static const struct of_device_id sh_msiof_match[] = { { .compatible ="renesas,sh-mobile-msiof" , .data = &sh_data }, { .compatible ="renesas,msiof-r8a7743" , .data = &rcar_gen2_data },
@@ -1083,6 +1096,7 @@ static const struct of_device_id sh_msiof_match[] = { { .compatible = "renesas,msiof-r8a7793", .data = &rcar_gen2_data }, { .compatible = "renesas,msiof-r8a7794", .data = &rcar_gen2_data }, { .compatible = "renesas,rcar-gen2-msiof", .data = &rcar_gen2_data }, + { .compatible = "renesas,msiof-r8a7795", .data = &rcar_r8a7795_data }, { .compatible = "renesas,msiof-r8a7796", .data = &rcar_gen3_data }, { .compatible = "renesas,rcar-gen3-msiof", .data = &rcar_gen3_data }, { .compatible = "renesas,sh-msiof", .data = &sh_data }, /* Deprecated */
@@ -1279,6 +1293,9 @@ static int sh_msiof_spi_probe(struct platform_device *pdev)return -ENXIO ; } +if (chipdata->flags &SH_MSIOF_FLAG_FIXED_DTDL_200 ) + info->dtdl =200 ; +if (info->mode ==MSIOF_SPI_SLAVE ) ctlr =spi_alloc_slave (&pdev->dev,sizeof (struct sh_msiof_spi_priv ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/374 ACPI: LPSS: Fix the fractional clock divider flags
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 3ebccf1d1ca74bbb78e6f8c38d1d172e468d91f8 ]
The conversion to CLK_FRAC_DIVIDER_POWER_OF_TWO_PS uses wrong flags in the parameters and hence miscalculates the values in the clock divider. Fix this by applying the flag to the proper parameter.
--- drivers/acpi/acpi_lpss.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/acpi/acpi_lpss.c +2 -1
@@ -439,8 +439,9 @@ static int register_device_clock(struct acpi_device *adev,if (!clk_name)return -ENOMEM ; clk =clk_register_fractional_divider (NULL , clk_name, parent, +0 , prv_base,1 ,15 ,16 ,15 ,CLK_FRAC_DIVIDER_POWER_OF_TWO_PS , - prv_base,1 ,15 ,16 ,15 ,0 ,NULL ); +NULL ); parent = clk_name; clk_name =kasprintf (GFP_KERNEL ,"%s-update" , devname);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/374 ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
[ Upstream commit 38c872a9e96f72f2947affc0526cc05659367d3d ]
When both CONFIG_RAS_CEC and CONFIG_ACPI_EXTLOG are enabled, Linux does not clear the status word of the BIOS supplied error record for corrected errors. This may prevent logging of subsequent uncorrected errors.
Fix by clearing the status.
--- drivers/acpi/acpi_extlog.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/acpi/acpi_extlog.c +6 -1
@@ -145,9 +145,14 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,static u32 err_seq; estatus =extlog_elog_entry_check (cpu, bank); -if (estatus ==NULL || (mce->kflags &MCE_HANDLED_CEC )) +if (!estatus)return NOTIFY_DONE ; +if (mce->kflags &MCE_HANDLED_CEC ) { + estatus->block_status =0 ; +return NOTIFY_DONE ; + } +memcpy (elog_buf, (void *)estatus,ELOG_ENTRY_LEN );/* clear record status to enable BIOS to update it again */ estatus->block_status =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/374 kunit: debugfs: Fix unchecked dereference in debugfs_print_results()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 34dfd5bb2e5507e69d9b6d6c90f546600c7a4977 ]
Move the call to kunit_suite_has_succeeded() after the check that the kunit_suite pointer is valid.
This was found by smatch:
lib/kunit/debugfs.c:66 debugfs_print_results() warn: variable dereferenced before check 'suite' (see line 63)
--- lib/kunit/debugfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
lib/kunit/debugfs.c +3 -1
@@ -52,12 +52,14 @@ static void debugfs_print_result(struct seq_file *seq,static int debugfs_print_results (struct seq_file *seq,void *v) {struct kunit_suite *suite = (struct kunit_suite *)seq->private; -enum kunit_status success =kunit_suite_has_succeeded (suite); +enum kunit_status success;struct kunit_case *test_case;if (!suite || !suite->log)return 0 ; + success =kunit_suite_has_succeeded (suite); +seq_printf (seq,"%s" , suite->log);kunit_suite_for_each_test_case (suite, test_case)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/374 mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhaoLong Wang <[email protected]>
[ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ]
If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read().
ubi_gluebi_init
ubi_register_volume_notifier
ubi_enumerate_volumes
ubi_notify_all
gluebi_notify nb->notifier_call()
gluebi_create
mtd_device_register
mtd_device_parse_register
add_mtd_device
blktrans_notify_add not->add()
ftl_add_mtd tr->add_mtd()
scan_header
mtd_read
mtd_read_oob
mtd_read_oob_std
gluebi_read mtd->read()
gluebi->desc - NULLDetailed reproduction information available at the Link [1],
In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference.
The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME.
--- drivers/mtd/mtd_blkdevs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mtd/mtd_blkdevs.c +2 -2
@@ -457,7 +457,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) {struct mtd_blktrans_ops *tr; -if (mtd->type ==MTD_ABSENT ) +if (mtd->type ==MTD_ABSENT || mtd->type ==MTD_UBIVOLUME )return ;list_for_each_entry (tr, &blktrans_majors, list)
@@ -497,7 +497,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)mutex_lock (&mtd_table_mutex);list_add (&tr->list, &blktrans_majors);mtd_for_each_device (mtd) -if (mtd->type !=MTD_ABSENT ) +if (mtd->type !=MTD_ABSENT && mtd->type !=MTD_UBIVOLUME ) tr->add_mtd (tr, mtd);mutex_unlock (&mtd_table_mutex);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/374 selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mickaël Salaün <[email protected]>
[ Upstream commit bbf5a1d0e5d0fb3bdf90205aa872636122692a50 ]
The IPv6 network stack first checks the sockaddr length (-EINVAL error) before checking the family (-EAFNOSUPPORT error).
This was discovered thanks to commit a549d055a22e ("selftests/landlock:
Add network tests").
--- security/selinux/hooks.c | 7 +++++++ 1 file changed, 7 insertions(+)
security/selinux/hooks.c +7 -0
@@ -4774,6 +4774,13 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, inreturn -EINVAL ; addr4 = (struct sockaddr_in *)address;if (family_sa ==AF_UNSPEC ) { +if (family ==PF_INET6 ) { +/* Length check from inet6_bind_sk() */ +if (addrlen <SIN6_LEN_RFC2133 ) +return -EINVAL ; +/* Family check from __inet6_bind() */ + goto err_af; + }/* see __inet_bind(), we only want to allow * AF_UNSPEC if the address is INADDR_ANY */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/374 crypto: virtio - Handle dataq logic with tasklet
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gonglei (Arei) <[email protected]>
[ Upstream commit fed93fb62e05c38152b0fc1dc9609639e63eed76 ]
Doing ipsec produces a spinlock recursion warning.
This is due to crypto_finalize_request() being called in the upper half. Move virtual data queue processing of virtio-crypto driver to tasklet.
--- drivers/crypto/virtio/virtio_crypto_common.h | 2 ++ drivers/crypto/virtio/virtio_crypto_core.c | 23 +++++++++++--------- 2 files changed, 15 insertions(+), 10 deletions(-)
drivers/crypto/virtio/virtio_crypto_common.h +2 -0
@@ -10,6 +10,7 @@#include <linux/virtio.h> #include <linux/crypto.h> #include <linux/spinlock.h> +#include <linux/interrupt.h> #include <crypto/aead.h> #include <crypto/aes.h> #include <crypto/engine.h>
@@ -27,6 +28,7 @@ struct data_queue {char name[32 ];struct crypto_engine *engine; +struct tasklet_struct done_task; };struct virtio_crypto {
drivers/crypto/virtio/virtio_crypto_core.c +13 -10
@@ -22,27 +22,28 @@ virtcrypto_clear_request(struct virtio_crypto_request *vc_req) } } -static void virtcrypto_dataq_callback (struct virtqueue *vq) +static void virtcrypto_done_task (unsigned long data) { -struct virtio_crypto *vcrypto = vq->vdev->priv; +struct data_queue *data_vq = (struct data_queue *)data; +struct virtqueue *vq = data_vq->vq;struct virtio_crypto_request *vc_req; -unsigned long flags;unsigned int len; -unsigned int qid = vq->index; -spin_lock_irqsave (&vcrypto->data_vq[qid].lock, flags);do {virtqueue_disable_cb (vq);while ((vc_req =virtqueue_get_buf (vq, &len)) !=NULL ) { -spin_unlock_irqrestore ( - &vcrypto->data_vq[qid].lock, flags);if (vc_req->alg_cb) vc_req->alg_cb (vc_req, len); -spin_lock_irqsave ( - &vcrypto->data_vq[qid].lock, flags); } }while (!virtqueue_enable_cb (vq)); -spin_unlock_irqrestore (&vcrypto->data_vq[qid].lock, flags); +} + +static void virtcrypto_dataq_callback (struct virtqueue *vq) +{ +struct virtio_crypto *vcrypto = vq->vdev->priv; +struct data_queue *dq = &vcrypto->data_vq[vq->index]; + +tasklet_schedule (&dq->done_task); }static int virtcrypto_find_vqs (struct virtio_crypto *vi)
@@ -99,6 +100,8 @@ static int virtcrypto_find_vqs(struct virtio_crypto *vi) ret = -ENOMEM ; goto err_engine; } +tasklet_init (&vi->data_vq[i].done_task, virtcrypto_done_task, + (unsigned long )&vi->data_vq[i]); }kfree (names);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/374 crypto: sa2ul - Return crypto_aead_setkey to transfer the error
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit ce852f1308ac738e61c5b2502517deea593a1554 ]
Return crypto_aead_setkey() in order to transfer the error if it fails.
--- drivers/crypto/sa2ul.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/crypto/sa2ul.c +1 -2
@@ -1868,9 +1868,8 @@ static int sa_aead_setkey(struct crypto_aead *authenc,crypto_aead_set_flags (ctx->fallback.aead,crypto_aead_get_flags (authenc) &CRYPTO_TFM_REQ_MASK ); -crypto_aead_setkey (ctx->fallback.aead, key, keylen); -return 0 ; +return crypto_aead_setkey (ctx->fallback.aead, key, keylen); }static int sa_aead_setauthsize (struct crypto_aead *tfm,unsigned int authsize)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/374 crypto: ccp - fix memleak in ccp_init_dm_workarea
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <[email protected]>
[ Upstream commit a1c95dd5bc1d6a5d7a75a376c2107421b7d6240d ]
When dma_map_single() fails, wa->address is supposed to be freed by the callers of ccp_init_dm_workarea() through ccp_dm_free(). However, many of the call spots don't expect to have to call ccp_dm_free() on failure of ccp_init_dm_workarea(), which may lead to a memleak. Let's free wa->address in ccp_init_dm_workarea() when dma_map_single() fails.
--- drivers/crypto/ccp/ccp-ops.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/crypto/ccp/ccp-ops.c +4 -1
@@ -179,8 +179,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa, wa->dma.address =dma_map_single (wa->dev, wa->address, len, dir); -if (dma_mapping_error (wa->dev, wa->dma.address)) +if (dma_mapping_error (wa->dev, wa->dma.address)) { +kfree (wa->address); + wa->address =NULL ;return -ENOMEM ; + } wa->dma.length = len; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/374 crypto: af_alg - Disallow multiple in-flight AIO requests
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 67b164a871af1d736f131fd6fe78a610909f06f3 ]
Having multiple in-flight AIO requests results in unpredictable output because they all share the same IV. Fix this by only allowing one request at a time.
--- crypto/af_alg.c | 14 +++++++++++++- include/crypto/if_alg.h | 3 +++ 2 files changed, 16 insertions(+), 1 deletion(-)
crypto/af_alg.c +13 -1
@@ -1045,9 +1045,13 @@ EXPORT_SYMBOL_GPL(af_alg_sendpage);void af_alg_free_resources (struct af_alg_async_req *areq) {struct sock *sk = areq->sk; +struct af_alg_ctx *ctx;af_alg_free_areq_sgls (areq);sock_kfree_s (sk, areq, areq->areqlen); + + ctx =alg_sk (sk)->private; + ctx->inflight = false; }EXPORT_SYMBOL_GPL (af_alg_free_resources);
@@ -1117,11 +1121,19 @@ EXPORT_SYMBOL_GPL(af_alg_poll);struct af_alg_async_req *af_alg_alloc_areq (struct sock *sk,unsigned int areqlen) { -struct af_alg_async_req *areq =sock_kmalloc (sk, areqlen,GFP_KERNEL ); +struct af_alg_ctx *ctx =alg_sk (sk)->private; +struct af_alg_async_req *areq; + +/* Only one AIO request can be in flight. */ +if (ctx->inflight) +return ERR_PTR (-EBUSY ); + areq =sock_kmalloc (sk, areqlen,GFP_KERNEL );if (unlikely (!areq))return ERR_PTR (-ENOMEM ); + ctx->inflight = true; + areq->areqlen = areqlen; areq->sk = sk; areq->last_rsgl =NULL ;
include/crypto/if_alg.h +3 -0
@@ -138,6 +138,7 @@ struct af_alg_async_req {* recvmsg is invoked. * @init: True if metadata has been sent. * @len: Length of memory allocated for this data structure. +* @inflight: Non-zero when AIO requests are in flight. */ struct af_alg_ctx {struct list_head tsgl_list;
@@ -156,6 +157,8 @@ struct af_alg_ctx {bool init;unsigned int len; + +unsigned int inflight; };int af_alg_register_type (const struct af_alg_type *type);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/374 crypto: sahara - remove FLAGS_NEW_KEY logic
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 8fd183435728b139248a77978ea3732039341779 ]
Remove the FLAGS_NEW_KEY logic as it has the following issues:
- the wrong key may end up being used when there are multiple data streams:
t1 t2
setkey()
encrypt()
setkey()
encrypt()
encrypt() <--- key from t2 is used
- switching between encryption and decryption with the same key is not possible, as the hdr flags are only updated when a new setkey() is performed
With this change, the key is always sent along with the cryptdata when performing encryption/decryption operations.
--- drivers/crypto/sahara.c | 34 +++++++++++++--------------------- 1 file changed, 13 insertions(+), 21 deletions(-)
drivers/crypto/sahara.c +13 -21
@@ -44,7 +44,6 @@#define FLAGS_MODE_MASK 0x000f#define FLAGS_ENCRYPT BIT(0)#define FLAGS_CBC BIT(1) -#define FLAGS_NEW_KEY BIT(3)#define SAHARA_HDR_BASE 0x00800000#define SAHARA_HDR_SKHA_ALG_AES 0
@@ -142,8 +141,6 @@ struct sahara_hw_link { };struct sahara_ctx { -unsigned long flags; -/* AES-specific context */ int keylen;u8 key[AES_KEYSIZE_128 ];
@@ -448,26 +445,22 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)int i, j;int idx =0 ; -/* Copy new key if necessary */ -if (ctx->flags &FLAGS_NEW_KEY ) { -memcpy (dev->key_base, ctx->key, ctx->keylen); - ctx->flags &= ~FLAGS_NEW_KEY ; +memcpy (dev->key_base, ctx->key, ctx->keylen); -if (dev->flags &FLAGS_CBC ) { - dev->hw_desc[idx]->len1 =AES_BLOCK_SIZE ; - dev->hw_desc[idx]->p1 = dev->iv_phys_base; - }else { - dev->hw_desc[idx]->len1 =0 ; - dev->hw_desc[idx]->p1 =0 ; - } - dev->hw_desc[idx]->len2 = ctx->keylen; - dev->hw_desc[idx]->p2 = dev->key_phys_base; - dev->hw_desc[idx]->next = dev->hw_phys_desc[1 ]; +if (dev->flags &FLAGS_CBC ) { + dev->hw_desc[idx]->len1 =AES_BLOCK_SIZE ; + dev->hw_desc[idx]->p1 = dev->iv_phys_base; + }else { + dev->hw_desc[idx]->len1 =0 ; + dev->hw_desc[idx]->p1 =0 ; + } + dev->hw_desc[idx]->len2 = ctx->keylen; + dev->hw_desc[idx]->p2 = dev->key_phys_base; + dev->hw_desc[idx]->next = dev->hw_phys_desc[1 ]; + dev->hw_desc[idx]->hdr =sahara_aes_key_hdr (dev); - dev->hw_desc[idx]->hdr =sahara_aes_key_hdr (dev); + idx++; - idx++; - } dev->nb_in_sg =sg_nents_for_len (dev->in_sg, dev->total);if (dev->nb_in_sg <0 ) {
@@ -609,7 +602,6 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key,/* SAHARA only supports 128bit keys */ if (keylen ==AES_KEYSIZE_128 ) {memcpy (ctx->key, key, keylen); - ctx->flags |=FLAGS_NEW_KEY ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/374 crypto: sahara - fix cbc selftest failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 9f10bc28c0fb676ae58aa3bfa358db8f5de124bb ]
The kernel crypto API requires that all CBC implementations update the IV buffer to contain the last ciphertext block.
This fixes the following cbc selftest error:
alg: skcipher: sahara-cbc-aes encryption test failed (wrong output IV) on test vector 0, cfg="in-place (one sglist)"
--- drivers/crypto/sahara.c | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-)
drivers/crypto/sahara.c +31 -2
@@ -149,6 +149,7 @@ struct sahara_ctx {struct sahara_aes_reqctx {unsigned long mode; +u8 iv_out[AES_BLOCK_SIZE ];struct skcipher_request fallback_req;// keep at the end };
@@ -542,8 +543,24 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)return -EINVAL ; } +static void sahara_aes_cbc_update_iv (struct skcipher_request *req) +{ +struct crypto_skcipher *skcipher =crypto_skcipher_reqtfm (req); +struct sahara_aes_reqctx *rctx =skcipher_request_ctx (req); +unsigned int ivsize =crypto_skcipher_ivsize (skcipher); + +/* Update IV buffer to contain the last ciphertext block */ +if (rctx->mode &FLAGS_ENCRYPT ) { +sg_pcopy_to_buffer (req->dst,sg_nents (req->dst), req->iv, + ivsize, req->cryptlen - ivsize); + }else { +memcpy (req->iv, rctx->iv_out, ivsize); + } +} +static int sahara_aes_process (struct skcipher_request *req) { +struct crypto_skcipher *skcipher =crypto_skcipher_reqtfm (req);struct sahara_dev *dev = dev_ptr;struct sahara_ctx *ctx;struct sahara_aes_reqctx *rctx;
@@ -565,8 +582,17 @@ static int sahara_aes_process(struct skcipher_request *req) rctx->mode &=FLAGS_MODE_MASK ; dev->flags = (dev->flags & ~FLAGS_MODE_MASK ) | rctx->mode; -if ((dev->flags &FLAGS_CBC ) && req->iv) -memcpy (dev->iv_base, req->iv,AES_KEYSIZE_128 ); +if ((dev->flags &FLAGS_CBC ) && req->iv) { +unsigned int ivsize =crypto_skcipher_ivsize (skcipher); + +memcpy (dev->iv_base, req->iv, ivsize); + +if (!(dev->flags &FLAGS_ENCRYPT )) { +sg_pcopy_to_buffer (req->src,sg_nents (req->src), + rctx->iv_out, ivsize, + req->cryptlen - ivsize); + } + }/* assign new context to device */ dev->ctx = ctx;
@@ -589,6 +615,9 @@ static int sahara_aes_process(struct skcipher_request *req)dma_unmap_sg (dev->device, dev->in_sg, dev->nb_in_sg,DMA_TO_DEVICE ); +if ((dev->flags &FLAGS_CBC ) && req->iv) +sahara_aes_cbc_update_iv (req); +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/374 crypto: sahara - fix ahash selftest failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit afffcf3db98b9495114b79d5381f8cc3f69476fb ]
update() calls should not modify the result buffer, so add an additional check for "rctx->last" to make sure that only the final hash value is copied into the buffer.
Fixes the following selftest failure:
alg: ahash: sahara-sha256 update() used result buffer on test vector 3, cfg="init+update+final aligned buffer"
--- drivers/crypto/sahara.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/sahara.c +1 -1
@@ -1048,7 +1048,7 @@ static int sahara_sha_process(struct ahash_request *req)memcpy (rctx->context, dev->context_base, rctx->context_size); -if (req->result) +if (req->result && rctx->last)memcpy (req->result, rctx->context, rctx->digest_size);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/374 crypto: sahara - fix processing requests with cryptlen < sg->length
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 5b8668ce3452827d27f8c34ff6ba080a8f983ed0 ]
It's not always the case that the entire sg entry needs to be processed. Currently, when cryptlen is less than sg->legth, "Descriptor length" errors are encountered.
The error was noticed when testing xts(sahara-ecb-aes) with arbitrary sized input data. To fix this, take the actual request size into account when populating the hw links.
--- drivers/crypto/sahara.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/crypto/sahara.c +7 -2
@@ -445,6 +445,7 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)int ret;int i, j;int idx =0 ; +u32 len;memcpy (dev->key_base, ctx->key, ctx->keylen);
@@ -495,12 +496,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)/* Create input links */ dev->hw_desc[idx]->p1 = dev->hw_phys_link[0 ]; sg = dev->in_sg; + len = dev->total;for (i =0 ; i < dev->nb_in_sg; i++) { - dev->hw_link[i]->len = sg->length; + dev->hw_link[i]->len =min (len, sg->length); dev->hw_link[i]->p = sg->dma_address;if (i == (dev->nb_in_sg -1 )) { dev->hw_link[i]->next =0 ; }else { + len -=min (len, sg->length); dev->hw_link[i]->next = dev->hw_phys_link[i +1 ]; sg =sg_next (sg); }
@@ -509,12 +512,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)/* Create output links */ dev->hw_desc[idx]->p2 = dev->hw_phys_link[i]; sg = dev->out_sg; + len = dev->total;for (j = i; j < dev->nb_out_sg + i; j++) { - dev->hw_link[j]->len = sg->length; + dev->hw_link[j]->len =min (len, sg->length); dev->hw_link[j]->p = sg->dma_address;if (j == (dev->nb_out_sg + i -1 )) { dev->hw_link[j]->next =0 ; }else { + len -=min (len, sg->length); dev->hw_link[j]->next = dev->hw_phys_link[j +1 ]; sg =sg_next (sg); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/374 crypto: sahara - fix error handling in sahara_hw_descriptor_create()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit ee6e6f0a7f5b39d50a5ef5fcc006f4f693db18a7 ]
Do not call dma_unmap_sg() for scatterlists that were not mapped successfully.
--- drivers/crypto/sahara.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/crypto/sahara.c +3 -5
@@ -484,13 +484,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) DMA_TO_DEVICE);if (ret != dev->nb_in_sg) {dev_err (dev->device,"couldn't map in sg\n" ); - goto unmap_in; +return -EINVAL ; } + ret =dma_map_sg (dev->device, dev->out_sg, dev->nb_out_sg,DMA_FROM_DEVICE );if (ret != dev->nb_out_sg) {dev_err (dev->device,"couldn't map out sg\n" ); - goto unmap_out; + goto unmap_in; }/* Create input links */
@@ -538,9 +539,6 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)return 0 ; -unmap_out: -dma_unmap_sg (dev->device, dev->out_sg, dev->nb_out_sg, -DMA_FROM_DEVICE ); unmap_in:dma_unmap_sg (dev->device, dev->in_sg, dev->nb_in_sg,DMA_TO_DEVICE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/374 pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit 86222a8fc16ec517de8da2604d904c9df3a08e5d ]
In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return 64-bit value since persistent_ram_zone::buffer_size has type size_t which is derived from the 64-bit *unsigned long*, while the ecc_blocks variable this value gets assigned to has (always 32-bit) *int* type. Even if that value fits into *int* type, an overflow is still possible when calculating the size_t typed ecc_total variable further below since there's no cast to any 64-bit type before multiplication. Declaring the ecc_blocks variable as *size_t* should fix this mess...
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- fs/pstore/ram_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/pstore/ram_core.c +1 -1
@@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz, {int numerr;struct persistent_ram_buffer *buffer = prz->buffer; -int ecc_blocks; +size_t ecc_blocks;size_t ecc_total;if (!ecc_info || !ecc_info->ecc_size)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/374 fs: indicate request originates from old mount API
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <[email protected]>
[ Upstream commit f67d922edb4e95a4a56d07d5d40a76dd4f23a85b ]
We already communicate to filesystems when a remount request comes from the old mount API as some filesystems choose to implement different behavior in the new mount API than the old mount API to e.g., take the chance to fix significant API bugs. Allow the same for regular mount requests.
--- fs/namespace.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
fs/namespace.c +11 -0
@@ -2647,7 +2647,12 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags,if (IS_ERR (fc))return PTR_ERR (fc); +/* +* Indicate to the filesystem that the remount request is coming +* from the legacy mount system call. +*/ fc->oldapi = true; + err =parse_monolithic_mount_data (fc, data);if (!err) {down_write (&sb->s_umount);
@@ -2981,6 +2986,12 @@ static int do_new_mount(struct path *path, const char *fstype, int sb_flags,if (IS_ERR (fc))return PTR_ERR (fc); +/* +* Indicate to the filesystem that the mount request is coming +* from the legacy mount system call. +*/ + fc->oldapi = true; +if (subtype) err =vfs_parse_fs_string (fc,"subtype" , subtype,strlen (subtype));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/374 gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Muhammad <[email protected]>
[ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ]
Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that.
--- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/rgrp.c +1 -1
@@ -2316,7 +2316,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long )rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_requested, rgd->rd_reserved, rgd->rd_extfail_pt); -if (rgd->rd_sbd->sd_args.ar_rgrplvb) { +if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) {struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/374 crypto: virtio - Wait for tasklet to complete on device remove
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangyangxin <[email protected]>
[ Upstream commit 67cc511e8d436456cc98033e6d4ba83ebfc8e672 ]
The scheduled tasklet needs to be executed on device remove.
--- drivers/crypto/virtio/virtio_crypto_core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/crypto/virtio/virtio_crypto_core.c +3 -0
@@ -434,11 +434,14 @@ static void virtcrypto_free_unused_reqs(struct virtio_crypto *vcrypto)static void virtcrypto_remove (struct virtio_device *vdev) {struct virtio_crypto *vcrypto = vdev->priv; +int i;dev_info (&vdev->dev,"Start virtcrypto_remove.\n" );if (virtcrypto_dev_started (vcrypto))virtcrypto_dev_stop (vcrypto); +for (i =0 ; i < vcrypto->max_data_queues; i++) +tasklet_kill (&vcrypto->data_vq[i].done_task); vdev->config->reset (vdev);virtcrypto_free_unused_reqs (vcrypto);virtcrypto_clear_crypto_engines (vcrypto);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/374 crypto: sahara - avoid skcipher fallback code duplication
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 01d70a4bbff20ea05cadb4c208841985a7cc6596 ]
Factor out duplicated skcipher fallback handling code to a helper function sahara_aes_fallback(). Also, keep a single check if fallback is required in sahara_aes_crypt().
Stable-dep-of: d1d6351e37aa ("crypto: sahara - handle zero-length aes requests")
--- drivers/crypto/sahara.c | 85 ++++++++++++----------------------------- 1 file changed, 25 insertions(+), 60 deletions(-)
drivers/crypto/sahara.c +25 -60
@@ -649,12 +649,37 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key,return crypto_skcipher_setkey (ctx->fallback, key, keylen); } +static int sahara_aes_fallback (struct skcipher_request *req,unsigned long mode) +{ +struct sahara_aes_reqctx *rctx =skcipher_request_ctx (req); +struct sahara_ctx *ctx =crypto_skcipher_ctx ( +crypto_skcipher_reqtfm (req)); + +skcipher_request_set_tfm (&rctx->fallback_req, ctx->fallback); +skcipher_request_set_callback (&rctx->fallback_req, + req->base.flags, + req->base.complete, + req->base.data); +skcipher_request_set_crypt (&rctx->fallback_req, req->src, + req->dst, req->cryptlen, req->iv); + +if (mode &FLAGS_ENCRYPT ) +return crypto_skcipher_encrypt (&rctx->fallback_req); + +return crypto_skcipher_decrypt (&rctx->fallback_req); +} +static int sahara_aes_crypt (struct skcipher_request *req,unsigned long mode) {struct sahara_aes_reqctx *rctx =skcipher_request_ctx (req); +struct sahara_ctx *ctx =crypto_skcipher_ctx ( +crypto_skcipher_reqtfm (req));struct sahara_dev *dev = dev_ptr;int err =0 ; +if (unlikely (ctx->keylen !=AES_KEYSIZE_128 )) +return sahara_aes_fallback (req, mode); +dev_dbg (dev->device,"nbytes: %d, enc: %d, cbc: %d\n" , req->cryptlen, !!(mode &FLAGS_ENCRYPT ), !!(mode &FLAGS_CBC ));
@@ -677,81 +702,21 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)static int sahara_aes_ecb_encrypt (struct skcipher_request *req) { -struct sahara_aes_reqctx *rctx =skcipher_request_ctx (req); -struct sahara_ctx *ctx =crypto_skcipher_ctx ( -crypto_skcipher_reqtfm (req)); - -if (unlikely (ctx->keylen !=AES_KEYSIZE_128 )) { -skcipher_request_set_tfm (&rctx->fallback_req, ctx->fallback); -skcipher_request_set_callback (&rctx->fallback_req, - req->base.flags, - req->base.complete, - req->base.data); -skcipher_request_set_crypt (&rctx->fallback_req, req->src, - req->dst, req->cryptlen, req->iv); -return crypto_skcipher_encrypt (&rctx->fallback_req); - } -return sahara_aes_crypt (req,FLAGS_ENCRYPT ); }static int sahara_aes_ecb_decrypt (struct skcipher_request *req) { -struct sahara_aes_reqctx *rctx =skcipher_request_ctx (req); -struct sahara_ctx *ctx =crypto_skcipher_ctx ( -crypto_skcipher_reqtfm (req)); - -if (unlikely (ctx->keylen !=AES_KEYSIZE_128 )) { -skcipher_request_set_tfm (&rctx->fallback_req, ctx->fallback); -skcipher_request_set_callback (&rctx->fallback_req, - req->base.flags, - req->base.complete, - req->base.data); -skcipher_request_set_crypt (&rctx->fallback_req, req->src, - req->dst, req->cryptlen, req->iv); -return crypto_skcipher_decrypt (&rctx->fallback_req); - } -return sahara_aes_crypt (req,0 ); }static int sahara_aes_cbc_encrypt (struct skcipher_request *req) { -struct sahara_aes_reqctx *rctx =skcipher_request_ctx (req); -struct sahara_ctx *ctx =crypto_skcipher_ctx ( -crypto_skcipher_reqtfm (req)); - -if (unlikely (ctx->keylen !=AES_KEYSIZE_128 )) { -skcipher_request_set_tfm (&rctx->fallback_req, ctx->fallback); -skcipher_request_set_callback (&rctx->fallback_req, - req->base.flags, - req->base.complete, - req->base.data); -skcipher_request_set_crypt (&rctx->fallback_req, req->src, - req->dst, req->cryptlen, req->iv); -return crypto_skcipher_encrypt (&rctx->fallback_req); - } -return sahara_aes_crypt (req,FLAGS_ENCRYPT |FLAGS_CBC ); }static int sahara_aes_cbc_decrypt (struct skcipher_request *req) { -struct sahara_aes_reqctx *rctx =skcipher_request_ctx (req); -struct sahara_ctx *ctx =crypto_skcipher_ctx ( -crypto_skcipher_reqtfm (req)); - -if (unlikely (ctx->keylen !=AES_KEYSIZE_128 )) { -skcipher_request_set_tfm (&rctx->fallback_req, ctx->fallback); -skcipher_request_set_callback (&rctx->fallback_req, - req->base.flags, - req->base.complete, - req->base.data); -skcipher_request_set_crypt (&rctx->fallback_req, req->src, - req->dst, req->cryptlen, req->iv); -return crypto_skcipher_decrypt (&rctx->fallback_req); - } -return sahara_aes_crypt (req,FLAGS_CBC ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/374 crypto: sahara - handle zero-length aes requests
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit d1d6351e37aac14b32a291731d0855996c459d11 ]
In case of a zero-length input, exit gracefully from sahara_aes_crypt().
--- drivers/crypto/sahara.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/crypto/sahara.c +3 -0
@@ -677,6 +677,9 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)struct sahara_dev *dev = dev_ptr;int err =0 ; +if (!req->cryptlen) +return 0 ; +if (unlikely (ctx->keylen !=AES_KEYSIZE_128 ))return sahara_aes_fallback (req, mode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/374 crypto: sahara - fix ahash reqsize
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit efcb50f41740ac55e6ccc4986c1a7740e21c62b4 ]
Set the reqsize for sha algorithms to sizeof(struct sahara_sha_reqctx), the extra space is not needed.
--- drivers/crypto/sahara.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/crypto/sahara.c +1 -2
@@ -1163,8 +1163,7 @@ static int sahara_sha_import(struct ahash_request *req, const void *in)static int sahara_sha_cra_init (struct crypto_tfm *tfm) {crypto_ahash_set_reqsize (__crypto_ahash_cast (tfm), -sizeof (struct sahara_sha_reqctx ) + -SHA_BUFFER_LEN +SHA256_BLOCK_SIZE ); +sizeof (struct sahara_sha_reqctx ));return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/374 crypto: sahara - fix wait_for_completion_timeout() error handling
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 2dba8e1d1a7957dcbe7888846268538847b471d1 ]
The sg lists are not unmapped in case of timeout errors. Fix this.
--- drivers/crypto/sahara.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/crypto/sahara.c +10 -8
@@ -608,16 +608,17 @@ static int sahara_aes_process(struct skcipher_request *req) timeout =wait_for_completion_timeout (&dev->dma_completion,msecs_to_jiffies (SAHARA_TIMEOUT_MS )); -if (!timeout) { -dev_err (dev->device,"AES timeout\n" ); -return -ETIMEDOUT ; - }dma_unmap_sg (dev->device, dev->out_sg, dev->nb_out_sg,DMA_FROM_DEVICE );dma_unmap_sg (dev->device, dev->in_sg, dev->nb_in_sg,DMA_TO_DEVICE ); +if (!timeout) { +dev_err (dev->device,"AES timeout\n" ); +return -ETIMEDOUT ; + } +if ((dev->flags &FLAGS_CBC ) && req->iv)sahara_aes_cbc_update_iv (req);
@@ -1008,15 +1009,16 @@ static int sahara_sha_process(struct ahash_request *req) timeout =wait_for_completion_timeout (&dev->dma_completion,msecs_to_jiffies (SAHARA_TIMEOUT_MS )); -if (!timeout) { -dev_err (dev->device,"SHA timeout\n" ); -return -ETIMEDOUT ; - }if (rctx->sg_in_idx)dma_unmap_sg (dev->device, dev->in_sg, dev->nb_in_sg,DMA_TO_DEVICE ); +if (!timeout) { +dev_err (dev->device,"SHA timeout\n" ); +return -ETIMEDOUT ; + } +memcpy (rctx->context, dev->context_base, rctx->context_size);if (req->result && rctx->last)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/374 crypto: sahara - improve error handling in sahara_sha_process()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 5deff027fca49a1eb3b20359333cf2ae562a2343 ]
sahara_sha_hw_data_descriptor_create() returns negative error codes on failure, so make sure the errors are correctly handled / propagated.
--- drivers/crypto/sahara.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/crypto/sahara.c +8 -2
@@ -988,7 +988,10 @@ static int sahara_sha_process(struct ahash_request *req)return ret;if (rctx->first) { -sahara_sha_hw_data_descriptor_create (dev, rctx, req,0 ); + ret =sahara_sha_hw_data_descriptor_create (dev, rctx, req,0 ); +if (ret) +return ret; + dev->hw_desc[0 ]->next =0 ; rctx->first =0 ; }else {
@@ -996,7 +999,10 @@ static int sahara_sha_process(struct ahash_request *req)sahara_sha_hw_context_descriptor_create (dev, rctx, req,0 ); dev->hw_desc[0 ]->next = dev->hw_phys_desc[1 ]; -sahara_sha_hw_data_descriptor_create (dev, rctx, req,1 ); + ret =sahara_sha_hw_data_descriptor_create (dev, rctx, req,1 ); +if (ret) +return ret; + dev->hw_desc[1 ]->next =0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/374 crypto: sahara - fix processing hash requests with req->nbytes < sg->length
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 7bafa74d1ba35dcc173e1ce915e983d65905f77e ]
It's not always the case that the entire sg entry needs to be processed. Currently, when nbytes is less than sg->length, "Descriptor length" errors are encountered.
To fix this, take the actual request size into account when populating the hw links.
--- drivers/crypto/sahara.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/crypto/sahara.c +4 -1
@@ -777,6 +777,7 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev, int start) {struct scatterlist *sg; +unsigned int len;unsigned int i;int ret;
@@ -798,12 +799,14 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,if (!ret)return -EFAULT ; + len = rctx->total;for (i = start; i < dev->nb_in_sg + start; i++) { - dev->hw_link[i]->len = sg->length; + dev->hw_link[i]->len =min (len, sg->length); dev->hw_link[i]->p = sg->dma_address;if (i == (dev->nb_in_sg + start -1 )) { dev->hw_link[i]->next =0 ; }else { + len -=min (len, sg->length); dev->hw_link[i]->next = dev->hw_phys_link[i +1 ]; sg =sg_next (sg); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/374 crypto: sahara - do not resize req->src when doing hash operations
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit a3c6f4f4d249cecaf2f34471aadbfb4f4ef57298 ]
When testing sahara sha256 speed performance with tcrypt (mode=404) on imx53-qsrb board, multiple "Invalid numbers of src SG." errors are reported. This was traced to sahara_walk_and_recalc() resizing req->src and causing the subsequent dma_map_sg() call to fail.
Now that the previous commit fixed sahara_sha_hw_links_create() to take into account the actual request size, rather than relying on sg->length values, the resize operation is no longer necessary.
Therefore, remove sahara_walk_and_recalc() and simplify associated logic.
--- drivers/crypto/sahara.c | 38 ++------------------------------------ 1 file changed, 2 insertions(+), 36 deletions(-)
drivers/crypto/sahara.c +2 -36
@@ -887,24 +887,6 @@ static int sahara_sha_hw_context_descriptor_create(struct sahara_dev *dev,return 0 ; } -static int sahara_walk_and_recalc (struct scatterlist *sg,unsigned int nbytes) -{ -if (!sg || !sg->length) -return nbytes; - -while (nbytes && sg) { -if (nbytes <= sg->length) { - sg->length = nbytes; -sg_mark_end (sg); -break ; - } - nbytes -= sg->length; - sg =sg_next (sg); - } - -return nbytes; -} -static int sahara_sha_prepare_request (struct ahash_request *req) {struct crypto_ahash *tfm =crypto_ahash_reqtfm (req);
@@ -941,36 +923,20 @@ static int sahara_sha_prepare_request(struct ahash_request *req) hash_later, 0); } -/* nbytes should now be multiple of blocksize */ - req->nbytes = req->nbytes - hash_later; - -sahara_walk_and_recalc (req->src, req->nbytes); - + rctx->total = len - hash_later;/* have data from previous operation and current */ if (rctx->buf_cnt && req->nbytes) {sg_init_table (rctx->in_sg_chain,2 );sg_set_buf (rctx->in_sg_chain, rctx->rembuf, rctx->buf_cnt); -sg_chain (rctx->in_sg_chain,2 , req->src); - - rctx->total = req->nbytes + rctx->buf_cnt; rctx->in_sg = rctx->in_sg_chain; - - req->src = rctx->in_sg_chain;/* only data from previous operation */ }else if (rctx->buf_cnt) { -if (req->src) - rctx->in_sg = req->src; -else - rctx->in_sg = rctx->in_sg_chain; -/* buf was copied into rembuf above */ + rctx->in_sg = rctx->in_sg_chain;sg_init_one (rctx->in_sg, rctx->rembuf, rctx->buf_cnt); - rctx->total = rctx->buf_cnt;/* no data from previous operation */ }else { rctx->in_sg = req->src; - rctx->total = req->nbytes; - req->src = rctx->in_sg; }/* on next call, we only have the remaining data in the buffer */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/374 crypto: scomp - fix req->dst buffer overflow
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengming Zhou <[email protected]>
[ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ]
The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem.
--- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+)
crypto/scompress.c +6 -0
@@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)struct crypto_scomp *scomp = *tfm_ctx;void **ctx =acomp_request_ctx (req);struct scomp_scratch *scratch; +unsigned int dlen;int ret;if (!req->src || !req->slen || req->slen >SCOMP_SCRATCH_SIZE )
@@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)if (!req->dlen || req->dlen >SCOMP_SCRATCH_SIZE ) req->dlen =SCOMP_SCRATCH_SIZE ; + dlen = req->dlen; + scratch =raw_cpu_ptr (&scomp_scratch);spin_lock (&scratch->lock);
@@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM ; goto out; } + }else if (req->dlen > dlen) { + ret = -ENOSPC ; + goto out; }scatterwalk_map_and_copy (scratch->dst, req->dst,0 , req->dlen,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/374 blocklayoutdriver: Fix reference leak of pnfs_device_node
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
[ Upstream commit 1530827b90025cdf80c9b0d07a166d045a0a7b81 ]
The error path for blocklayout's device lookup is missing a reference drop for the case where a lookup finds the device, but the device is marked with NFS_DEVICEID_UNAVAILABLE.
--- fs/nfs/blocklayout/blocklayout.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/blocklayout/blocklayout.c +2 -0
@@ -599,6 +599,8 @@ bl_find_get_deviceid(struct nfs_server *server,nfs4_delete_deviceid (node->ld, node->nfs_client, id); goto retry; } + +nfs4_put_deviceid_node (node);return ERR_PTR (-ENODEV ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/374 NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 037e56a22ff37f9a9c2330b66cff55d3d1ff9b90 ]
Once the client has processed the CB_LAYOUTRECALL, but has not yet successfully returned the layout, the server is supposed to switch to returning NFS4ERR_RETURNCONFLICT. This patch ensures that we handle that return value correctly.
--- fs/nfs/nfs4proc.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfs/nfs4proc.c +3 -0
@@ -173,6 +173,7 @@ static int nfs4_map_errors(int err)case -NFS4ERR_RESOURCE :case -NFS4ERR_LAYOUTTRYLATER :case -NFS4ERR_RECALLCONFLICT : +case -NFS4ERR_RETURNCONFLICT :return -EREMOTEIO ;case -NFS4ERR_WRONGSEC :case -NFS4ERR_WRONG_CRED :
@@ -560,6 +561,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server,case -NFS4ERR_GRACE :case -NFS4ERR_LAYOUTTRYLATER :case -NFS4ERR_RECALLCONFLICT : +case -NFS4ERR_RETURNCONFLICT : exception->delay =1 ;return 0 ;
@@ -9588,6 +9590,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task, status = -EBUSY ;break ;case -NFS4ERR_RECALLCONFLICT : +case -NFS4ERR_RETURNCONFLICT : status = -ERECALLCONFLICT ;break ;case -NFS4ERR_DELEG_REVOKED :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/374 wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chih-Kang Chang <[email protected]>
[ Upstream commit 53ee0b3b99edc6a47096bffef15695f5a895386f ]
The broadcast packets will be filtered in the FIF_ALLMULTI flag in the original code, which causes beacon packets to be filtered out and disconnection. Therefore, we fix it.
--- drivers/net/wireless/realtek/rtw88/mac80211.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw88/mac80211.c +2 -2
@@ -267,9 +267,9 @@ static void rtw_ops_configure_filter(struct ieee80211_hw *hw,if (changed_flags &FIF_ALLMULTI ) {if (*new_flags &FIF_ALLMULTI ) - rtwdev->hal.rcr |=BIT_AM |BIT_AB ; + rtwdev->hal.rcr |=BIT_AM ;else - rtwdev->hal.rcr &= ~(BIT_AM |BIT_AB ); + rtwdev->hal.rcr &= ~(BIT_AM ); }if (changed_flags &FIF_FCSFAIL ) {if (*new_flags &FIF_FCSFAIL )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/374 bpf, lpm: Fix check prefixlen before walking trie
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Lehner <[email protected]>
[ Upstream commit 9b75dbeb36fcd9fc7ed51d370310d0518a387769 ]
When looking up an element in LPM trie, the condition 'matchlen == trie->max_prefixlen' will never return true, if key->prefixlen is larger than trie->max_prefixlen. Consequently all elements in the LPM trie will be visited and no element is returned in the end.
To resolve this, check key->prefixlen first before walking the LPM trie.
--- kernel/bpf/lpm_trie.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/bpf/lpm_trie.c +3 -0
@@ -230,6 +230,9 @@ static void *trie_lookup_elem(struct bpf_map *map, void *_key)struct lpm_trie_node *node, *found =NULL ;struct bpf_lpm_trie_key *key = _key; +if (key->prefixlen > trie->max_prefixlen) +return NULL ; +/* Start walking the trie from the root node ... */ for (node = rcu_dereference_check(trie->root, rcu_read_lock_bh_held());
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/374 bpf: Add crosstask check to __bpf_get_stack
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rome <[email protected]>
[ Upstream commit b8e3a87a627b575896e448021e5c2f8a3bc19931 ]
Currently get_perf_callchain only supports user stack walking for the current task. Passing the correct *crosstask* param will return 0 frames if the task passed to __bpf_get_stack isn't the current one instead of a single incorrect frame/address. This change passes the correct *crosstask* param but also does a preemptive check in __bpf_get_stack if the task is current and returns -EOPNOTSUPP if it is not.
This issue was found using bpf_get_task_stack inside a BPF iterator ("iter/task"), which iterates over all tasks. bpf_get_task_stack works fine for fetching kernel stacks but because get_perf_callchain relies on the caller to know if the requested *task* is the current one (via *crosstask*) it was failing in a confusing way.
It might be possible to get user stacks for all tasks utilizing something like access_process_vm but that requires the bpf program calling bpf_get_task_stack to be sleepable and would therefore be a breaking change.
--- include/uapi/linux/bpf.h | 3 +++ kernel/bpf/stackmap.c | 11 ++++++++++- tools/include/uapi/linux/bpf.h | 3 +++ 3 files changed, 16 insertions(+), 1 deletion(-)
include/uapi/linux/bpf.h +3 -0
@@ -4245,6 +4245,8 @@ union bpf_attr {* long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags) * Description * Return a user or a kernel stack in bpf program provided buffer. +* Note: the user stack will only be populated if the *task* is +* the current task; all other tasks will return -EOPNOTSUPP. * To achieve this, the helper needs *task*, which is a valid * pointer to **struct task_struct**. To store the stacktrace, the * bpf program provides *buf* with a nonnegative *size*.
@@ -4256,6 +4258,7 @@ union bpf_attr {* * **BPF_F_USER_STACK** * Collect a user space stack instead of a kernel stack. +* The *task* must be the current task. * **BPF_F_USER_BUILD_ID** * Collect buildid+offset instead of ips for user stack, * only valid if **BPF_F_USER_STACK** is also specified.
kernel/bpf/stackmap.c +10 -1
@@ -435,6 +435,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, {u32 trace_nr, copy_len, elem_size, num_elem, max_depth;bool user_build_id = flags &BPF_F_USER_BUILD_ID ; +bool crosstask = task && task != current;u32 skip = flags &BPF_F_SKIP_FIELD_MASK ;bool user = flags &BPF_F_USER_STACK ;struct perf_callchain_entry *trace;
@@ -457,6 +458,14 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,if (task && user && !user_mode (regs)) goto err_fault; +/* get_perf_callchain does not support crosstask user stack walking +* but returns an empty stack instead of NULL. +*/ +if (crosstask && user) { + err = -EOPNOTSUPP ; + goto clear; + } + num_elem = size / elem_size; max_depth = num_elem + skip;if (sysctl_perf_event_max_stack < max_depth)
@@ -468,7 +477,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, trace =get_callchain_entry_for_task (task, max_depth); else trace =get_perf_callchain (regs,0 , kernel, user, max_depth, - false, false); + crosstask, false);if (unlikely (!trace)) goto err_fault;
tools/include/uapi/linux/bpf.h +3 -0
@@ -4245,6 +4245,8 @@ union bpf_attr {* long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags) * Description * Return a user or a kernel stack in bpf program provided buffer. +* Note: the user stack will only be populated if the *task* is +* the current task; all other tasks will return -EOPNOTSUPP. * To achieve this, the helper needs *task*, which is a valid * pointer to **struct task_struct**. To store the stacktrace, the * bpf program provides *buf* with a nonnegative *size*.
@@ -4256,6 +4258,7 @@ union bpf_attr {* * **BPF_F_USER_STACK** * Collect a user space stack instead of a kernel stack. +* The *task* must be the current task. * **BPF_F_USER_BUILD_ID** * Collect buildid+offset instead of ips for user stack, * only valid if **BPF_F_USER_STACK** is also specified.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/374 wifi: ath11k: Defer on rproc_get failure
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit 2a3ec40b98b46c339adb57313d3b933ee5e7a8e8 ]
If we already have gotten the rproc_handle (meaning the "qcom,rproc" property is defined in the devicetree), it's a valid state that the remoteproc module hasn't probed yet so we should defer probing instead of just failing to probe.
This resolves a race condition when the ath11k driver probes and fails before the wpss remoteproc driver has probed, like the following:
[ 6.232360] ath11k 17a10040.wifi: failed to get rproc
[ 6.232366] ath11k 17a10040.wifi: failed to get rproc: -22
[ 6.232478] ath11k: probe of 17a10040.wifi failed with error -22
...
[ 6.252415] remoteproc remoteproc2: 8a00000.remoteproc is available
[ 6.252776] remoteproc remoteproc2: powering up 8a00000.remoteproc
[ 6.252781] remoteproc remoteproc2: Booting fw image qcom/qcm6490/fairphone5/wpss.mdt, size 7188So, defer the probe if we hit that so we can retry later once the wpss remoteproc is available.
Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-01264-QCAMSLSWPLZ-1.37886.3
--- drivers/net/wireless/ath/ath11k/ahb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath11k/ahb.c +2 -2
@@ -650,8 +650,8 @@ static int ath11k_core_get_rproc(struct ath11k_base *ab) prproc =rproc_get_by_phandle (rproc_phandle);if (!prproc) { -ath11k_err (ab,"failed to get rproc\n" ); -return -EINVAL ; +ath11k_dbg (ab,ATH11K_DBG_AHB ,"failed to get rproc, deferring\n" ); +return -EPROBE_DEFER ; } ab_ahb->tgt_rproc = prproc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/374 wifi: libertas: stop selecting wext
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 8170b04c2c92eee52ea50b96db4c54662197e512 ]
Libertas no longer references the iw_handler infrastructure or wext_spy, so neither of the 'select' statements are used any more.
--- drivers/net/wireless/marvell/libertas/Kconfig | 2 -- 1 file changed, 2 deletions(-)
drivers/net/wireless/marvell/libertas/Kconfig +0 -2
@@ -2,8 +2,6 @@ config LIBERTAS tristate "Marvell 8xxx Libertas WLAN driver support" depends on CFG80211 - select WIRELESS_EXT - select WEXT_SPY select LIB80211 select FW_LOADER help
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/374 ARM: dts: qcom: apq8064: correct XOADC register address
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 554557542e709e190eff8a598f0cde02647d533a ]
The XOADC is present at the address 0x197 rather than just 197. It doesn't change a lot (since the driver hardcodes all register addresses), but the DT should present correct address anyway.
--- arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/qcom-apq8064.dtsi +1 -1
@@ -760,7 +760,7 @@ pwrkey@1c { xoadc: xoadc@197 { compatible = "qcom,pm8921-adc"; - reg = <197>; + reg = <0x197>; interrupts-extended = <&pmicintc 78 IRQ_TYPE_EDGE_RISING>; #address-cells = <2>; #size-cells = <0>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/374 net/ncsi: Fix netlink major/minor version numbers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Delevoryas <[email protected]>
[ Upstream commit 3084b58bfd0b9e4b5e034f31f31b42977db35f12 ]
The netlink interface for major and minor version numbers doesn't actually return the major and minor version numbers.
It reports a u32 that contains the (major, minor, update, alpha1) components as the major version number, and then alpha2 as the minor version number.
For whatever reason, the u32 byte order was reversed (ntohl): maybe it was assumed that the encoded value was a single big-endian u32, and alpha2 was the minor version.
The correct way to get the supported NC-SI version from the network controller is to parse the Get Version ID response as described in 8.4.44 of the NC-SI spec[1].
Get Version ID Response Packet Format
Bits
+--------+--------+--------+--------+
Bytes | 31..24 | 23..16 | 15..8 | 7..0 |
+-------+--------+--------+--------+--------+
| 0..15 | NC-SI Header |
+-------+--------+--------+--------+--------+
| 16..19| Response code | Reason code |
+-------+--------+--------+--------+--------+
|20..23 | Major | Minor | Update | Alpha1 |
+-------+--------+--------+--------+--------+
|24..27 | reserved | Alpha2 |
+-------+--------+--------+--------+--------+
| .... other stuff .... |The major, minor, and update fields are all binary-coded decimal (BCD) encoded [2]. The spec provides examples below the Get Version ID response format in section 8.4.44.1, but for practical purposes, this is an example from a live network card:
root@bmc:~# ncsi-util 0x15
NC-SI Command Response:
cmd: GET_VERSION_ID(0x15)
Response: COMMAND_COMPLETED(0x0000) Reason: NO_ERROR(0x0000)
Payload length = 40 20: 0xf1 0xf1 0xf0 0x00 <<<<<<<<< (major, minor, update, alpha1)
24: 0x00 0x00 0x00 0x00 <<<<<<<<< (_, _, _, alpha2)
28: 0x6d 0x6c 0x78 0x30
32: 0x2e 0x31 0x00 0x00
36: 0x00 0x00 0x00 0x00
40: 0x16 0x1d 0x07 0xd2
44: 0x10 0x1d 0x15 0xb3
48: 0x00 0x17 0x15 0xb3
52: 0x00 0x00 0x81 0x19This should be parsed as "1.1.0".
"f" in the upper-nibble means to ignore it, contributing zero.
If both nibbles are "f", I think the whole field is supposed to be ignored. Major and minor are "required", meaning they're not supposed to be "ff", but the update field is "optional" so I think it can be ff. I think the simplest thing to do is just set the major and minor to zero instead of juggling some conditional logic or something.
bcd2bin() from "include/linux/bcd.h" seems to assume both nibbles are 0-9, so I've provided a custom BCD decoding function.
Alpha1 and alpha2 are ISO/IEC 8859-1 encoded, which just means ASCII characters as far as I can tell, although the full encoding table for non-alphabetic characters is slightly different (I think).
I imagine the alpha fields are just supposed to be alphabetic characters, but I haven't seen any network cards actually report a non-zero value for either.
If people wrote software against this netlink behavior, and were parsing the major and minor versions themselves from the u32, then this would definitely break their code.
[1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0222_1.0.0.pdf
[2] https://en.wikipedia.org/wiki/Binary-coded_decimal
[2] https://en.wikipedia.org/wiki/ISO/IEC_8859-1
--- net/ncsi/internal.h | 7 +++++-- net/ncsi/ncsi-netlink.c | 4 ++-- net/ncsi/ncsi-pkt.h | 7 +++++-- net/ncsi/ncsi-rsp.c | 26 ++++++++++++++++++++++++-- 4 files changed, 36 insertions(+), 8 deletions(-)
net/ncsi/internal.h +5 -2
@@ -105,8 +105,11 @@ enum {struct ncsi_channel_version { -u32 version;/* Supported BCD encoded NCSI version */ -u32 alpha2;/* Supported BCD encoded NCSI version */ +u8 major;/* NCSI version major */ +u8 minor;/* NCSI version minor */ +u8 update;/* NCSI version update */ +char alpha1;/* NCSI version alpha1 */ +char alpha2;/* NCSI version alpha2 */ u8 fw_name[12 ];/* Firmware name string */ u32 fw_version;/* Firmware version */ u16 pci_ids[4 ];/* PCI identification */
net/ncsi/ncsi-netlink.c +2 -2
@@ -71,8 +71,8 @@ static int ncsi_write_channel_info(struct sk_buff *skb,if (nc == nc->package->preferred_channel)nla_put_flag (skb,NCSI_CHANNEL_ATTR_FORCED ); -nla_put_u32 (skb,NCSI_CHANNEL_ATTR_VERSION_MAJOR , nc->version.version); -nla_put_u32 (skb,NCSI_CHANNEL_ATTR_VERSION_MINOR , nc->version.alpha2); +nla_put_u32 (skb,NCSI_CHANNEL_ATTR_VERSION_MAJOR , nc->version.major); +nla_put_u32 (skb,NCSI_CHANNEL_ATTR_VERSION_MINOR , nc->version.minor);nla_put_string (skb,NCSI_CHANNEL_ATTR_VERSION_STR , nc->version.fw_name); vid_nest =nla_nest_start_noflag (skb,NCSI_CHANNEL_ATTR_VLAN_LIST );
net/ncsi/ncsi-pkt.h +5 -2
@@ -197,9 +197,12 @@ struct ncsi_rsp_gls_pkt {/* Get Version ID */ struct ncsi_rsp_gvi_pkt {struct ncsi_rsp_pkt_hdr rsp;/* Response header */ -__be32 ncsi_version;/* NCSI version */ +unsigned char major;/* NCSI version major */ +unsigned char minor;/* NCSI version minor */ +unsigned char update;/* NCSI version update */ +unsigned char alpha1;/* NCSI version alpha1 */ unsigned char reserved[3 ];/* Reserved */ -unsigned char alpha2;/* NCSI version */ +unsigned char alpha2;/* NCSI version alpha2 */ unsigned char fw_name[12 ];/* f/w name string */ __be32 fw_version;/* f/w version */ __be16 pci_ids[4 ];/* PCI IDs */
net/ncsi/ncsi-rsp.c +24 -2
@@ -19,6 +19,19 @@#include "ncsi-pkt.h" #include "ncsi-netlink.h" +/* Nibbles within [0xA, 0xF] add zero "0" to the returned value. +* Optional fields (encoded as 0xFF) will default to zero. +*/ +static u8 decode_bcd_u8 (u8 x) +{ +int lo = x &0xF ; +int hi = x >>4 ; + + lo = lo <0xA ? lo :0 ; + hi = hi <0xA ? hi :0 ; +return lo + hi *10 ; +} +static int ncsi_validate_rsp_pkt (struct ncsi_request *nr,unsigned short payload) {
@@ -755,9 +768,18 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr)if (!nc)return -ENODEV ; -/* Update to channel's version info */ +/* Update channel's version info +* +* Major, minor, and update fields are supposed to be +* unsigned integers encoded as packed BCD. +* +* Alpha1 and alpha2 are ISO/IEC 8859-1 characters. +*/ ncv = &nc->version; - ncv->version =ntohl (rsp->ncsi_version); + ncv->major =decode_bcd_u8 (rsp->major); + ncv->minor =decode_bcd_u8 (rsp->minor); + ncv->update =decode_bcd_u8 (rsp->update); + ncv->alpha1 = rsp->alpha1; ncv->alpha2 = rsp->alpha2;memcpy (ncv->fw_name, rsp->fw_name,12 ); ncv->fw_version =ntohl (rsp->fw_version);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/374 firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 964946b88887089f447a9b6a28c39ee97dc76360 ]
The ending NULL is not taken into account by strncat(), so switch to snprintf() to correctly build 'debug_name'.
Using snprintf() also makes the code more readable.
--- drivers/firmware/ti_sci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/firmware/ti_sci.c +5 -5
@@ -161,7 +161,7 @@ static int ti_sci_debugfs_create(struct platform_device *pdev, {struct device *dev = &pdev->dev;struct resource *res; -char debug_name[50 ] ="ti_sci_debug@" ; +char debug_name[50 ];/* Debug region is optional */ res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -178,10 +178,10 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,/* Setup NULL termination */ info->debug_buffer[info->debug_region_size] =0 ; - info->d =debugfs_create_file (strncat (debug_name,dev_name (dev), -sizeof (debug_name) - -sizeof ("ti_sci_debug@" )), -0444 ,NULL , info, &ti_sci_debug_fops); +snprintf (debug_name,sizeof (debug_name),"ti_sci_debug@%s" , +dev_name (dev)); + info->d =debugfs_create_file (debug_name,0444 ,NULL , info, + &ti_sci_debug_fops);if (IS_ERR (info->d))return PTR_ERR (info->d);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/374 firmware: meson_sm: populate platform devices from sm device tree data
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Rokosov <[email protected]>
[ Upstream commit e45f243409db98d610248c843b25435e7fb0baf3 ]
In some meson boards, secure monitor device has children, for example, power secure controller. By default, secure monitor isn't the bus in terms of device tree subsystem, so the of_platform initialization code doesn't populate its device tree data. As a result, secure monitor's children aren't probed at all.
Run the 'of_platform_populate()' routine manually to resolve such issues.
Stable-dep-of: d8385d7433f9 ("firmware: meson-sm: unmap out_base shmem in error path")
--- drivers/firmware/meson/meson_sm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/firmware/meson/meson_sm.c +4 -1
@@ -313,11 +313,14 @@ static int __init meson_sm_probe(struct platform_device *pdev)platform_set_drvdata (pdev, fw); -pr_info ("secure-monitor enabled\n" ); +if (devm_of_platform_populate (dev)) + goto out_in_base;if (sysfs_create_group (&pdev->dev.kobj, &meson_sm_sysfs_attr_group)) goto out_in_base; +pr_info ("secure-monitor enabled\n" ); +return 0 ; out_in_base:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/374 wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit bc8263083af60e7e57c6120edbc1f75d6c909a35 ]
Clang static checker warns:
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c:184:49:
The result of the left shift is undefined due to shifting by '32', which is greater or equal to the width of type 'u32'. [core.UndefinedBinaryOperatorResult]
If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined.[1][2]
For example, when using different gcc's compilation optimization options (-O0 or -O2), the result of '(u32)data << 32' is different. One is 0, the other is old value of data. Let _rtl8821ae_phy_calculate_bit_shift()'s return value less than 32 to fix this problem. Warn if bitmask is zero.
[1] https://stackoverflow.com/questions/11270492/what-does-the-c-standard-say-about-bitshifting-more-bits-than-the-width-of-type
[2] https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf
--- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +3 -2
@@ -29,9 +29,10 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw, u32 data);static u32 _rtl8821ae_phy_calculate_bit_shift (u32 bitmask) { -u32 i =ffs (bitmask); +if (WARN_ON_ONCE (!bitmask)) +return 0 ; -return i ? i -1 :32 ; +return __ffs (bitmask); }static bool _rtl8821ae_phy_bb8821a_config_parafile (struct ieee80211_hw *hw);/*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/374 arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit b57160859263c083c49482b0d083a586b1517f78 ]
DSS irq trigger type is set to IRQ_TYPE_EDGE_RISING in the DT file, but the TRM says it is level triggered.
For some reason triggering on rising edge results in double the amount of expected interrupts, e.g. for normal page flipping test the number of interrupts per second is 2 * fps. It is as if the IRQ triggers on both edges. There are no other side effects to this issue than slightly increased CPU & power consumption due to the extra interrupt.
Switching to IRQ_TYPE_LEVEL_HIGH is correct and fixes the issue, so let's do that.
--- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/ti/k3-am65-main.dtsi +1 -1
@@ -855,7 +855,7 @@ dss: dss@4a00000 { assigned-clocks = <&k3_clks 67 2>; assigned-clock-parents = <&k3_clks 67 5>; - interrupts = <GIC_SPI 166 IRQ_TYPE_EDGE_RISING>; + interrupts = <GIC_SPI 166 IRQ_TYPE_LEVEL_HIGH>; dma-coherent;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/374 bpf: enforce precision of R0 on callback return
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 0acd03a5bd188b0c501d285d938439618bd855c4 ]
Given verifier checks actual value, r0 has to be precise, so we need to propagate precision properly. r0 also has to be marked as read, otherwise subsequent state comparisons will ignore such register as unimportant and precision won't really help here.
--- kernel/bpf/verifier.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/bpf/verifier.c +7 -0
@@ -6244,6 +6244,13 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)verbose (env,"R0 not a scalar value\n" );return -EACCES ; } + +/* we are going to rely on register's precise value */ + err =mark_reg_read (env, r0, r0->parent,REG_LIVE_READ64 ); + err = err ?:mark_chain_precision (env,BPF_REG_0 ); +if (err) +return err; +if (!tnum_in (range, r0->var_off)) {verbose_invalid_scalar (env, r0, &range,"callback return" ,"R0" );return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/374 ARM: dts: qcom: sdx65: correct SPMI node name
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit a900ad783f507cb396e402827052e70c0c565ae9 ]
Node names should not have vendor prefixes:
qcom-sdx65-mtp.dtb: qcom,spmi@c440000: $nodename:0: 'qcom,spmi@c440000' does not match '^spmi@.*
--- arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/qcom-sdx55.dtsi +1 -1
@@ -457,7 +457,7 @@ restart@c264000 { reg = <0x0c264000 0x1000>; }; - spmi_bus: qcom,spmi@c440000 { + spmi_bus: spmi@c440000 { compatible = "qcom,spmi-pmic-arb"; reg = <0x0c440000 0x0000d00>, <0x0c600000 0x2000000>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/374 arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 7ac90b4cf107a3999b30844d7899e0331686b33b ]
On sc7180 when the watchdog timer fires your logs get filled with:
watchdog0: pretimeout event
watchdog0: pretimeout event
watchdog0: pretimeout event
...
watchdog0: pretimeout event
If you're using console-ramoops to debug crashes the above gets quite annoying since it blows away any other log messages that might have been there.
The issue is that the "bark" interrupt (AKA the "pretimeout" interrupt) remains high until the watchdog is pet. Since we've got things configured as "level" triggered we'll keep getting interrupted over and over.
Let's switch to edge triggered. Now we'll get one interrupt when the "bark" interrupt goes off and won't get another one until the "bark" interrupt is cleared and asserts again.
This matches how many older Qualcomm SoCs have things configured.
--- arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sc7180.dtsi +1 -1
@@ -3366,7 +3366,7 @@ watchdog@17c10000 { compatible = "qcom,apss-wdt-sc7180", "qcom,kpss-wdt"; reg = <0 0x17c10000 0 0x1000>; clocks = <&sleep_clk>; - interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>; }; timer@17c20000{
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/374 arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 6897fac411db7b43243f67d4fd4d3f95abf7f656 ]
As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered"), the Qualcomm watchdog timer's bark interrupt should be configured as edge triggered. Make the change.
--- arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sc7280.dtsi +1 -1
@@ -1711,7 +1711,7 @@ watchdog@17c10000 { compatible = "qcom,apss-wdt-sc7280", "qcom,kpss-wdt"; reg = <0 0x17c10000 0 0x1000>; clocks = <&sleep_clk>; - interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>; }; timer@17c20000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/374 arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 263b348499454f38d36b9442c3cf9279c571bb54 ]
As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered"), the Qualcomm watchdog timer's bark interrupt should be configured as edge triggered. Make the change.
--- arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sdm845.dtsi +1 -1
@@ -4725,7 +4725,7 @@ watchdog@17980000 { compatible = "qcom,apss-wdt-sdm845", "qcom,kpss-wdt"; reg = <0 0x17980000 0 0x1000>; clocks = <&sleep_clk>; - interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>; }; apss_shared: mailbox@17990000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/374 arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 9204e9a4099212c850e1703c374ef4538080825b ]
As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered"), the Qualcomm watchdog timer's bark interrupt should be configured as edge triggered. Make the change.
--- arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8150.dtsi +1 -1
@@ -3359,7 +3359,7 @@ watchdog@17c10000 { compatible = "qcom,apss-wdt-sm8150", "qcom,kpss-wdt"; reg = <0 0x17c10000 0 0x1000>; clocks = <&sleep_clk>; - interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>; }; timer@17c20000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/374 arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 735d80e2e8e5d073ae8b1fff8b1589ea284aa5af ]
As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered"), the Qualcomm watchdog timer's bark interrupt should be configured as edge triggered. Make the change.
--- arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8250.dtsi +1 -1
@@ -3947,7 +3947,7 @@ watchdog@17c10000 { compatible = "qcom,apss-wdt-sm8250", "qcom,kpss-wdt"; reg = <0 0x17c10000 0 0x1000>; clocks = <&sleep_clk>; - interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>; }; timer@17c20000 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/374 bpf: fix check for attempt to corrupt spilled pointer
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit ab125ed3ec1c10ccc36bc98c7a4256ad114a3dae ]
When register is spilled onto a stack as a 1/2/4-byte register, we set slot_type[BPF_REG_SIZE - 1] (plus potentially few more below it, depending on actual spill size). So to check if some stack slot has spilled register we need to consult slot_type[7], not slot_type[0].
To avoid the need to remember and double-check this in the future, just use is_spilled_reg() helper.
--- kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/verifier.c +1 -1
@@ -2844,7 +2844,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,* so it's aligned access and [off, off + size) are within stack limits */ if (!env->allow_ptr_leaks && - state->stack[spi].slot_type[0 ] ==STACK_SPILL && +is_spilled_reg (&state->stack[spi]) && size !=BPF_REG_SIZE ) {verbose (env,"attempt to corrupt spilled pointer on stack\n" );return -EACCES ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/374 scsi: fnic: Return error if vmalloc() failed
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Chernyshev <[email protected]>
[ Upstream commit f5f27a332a14f43463aa0075efa3a0c662c0f4a8 ]
In fnic_init_module() exists redundant check for return value from fnic_debugfs_init(), because at moment it only can return zero. It make sense to process theoretical vmalloc() failure.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/scsi/fnic/fnic_debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/fnic/fnic_debugfs.c +2 -1
@@ -66,9 +66,10 @@ int fnic_debugfs_init(void) fc_trc_flag->fnic_trace =2 ; fc_trc_flag->fc_trace =3 ; fc_trc_flag->fc_clear =4 ; +return 0 ; } -return 0 ; +return -ENOMEM ; }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/374 arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit dc6b5562acbac0285ab3b2dad23930b6434bdfc6 ]
There is no "panic-indicator" default trigger but a property with that name:
qrb5165-rb5.dtb: leds: led-user4: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected)
--- arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +1 -1
@@ -58,8 +58,8 @@ leds { user4 { label = "green:user4"; gpios = <&pm8150_gpios 10 GPIO_ACTIVE_HIGH>; - linux,default-trigger = "panic-indicator"; default-state = "off"; + panic-indicator; }; wlan {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/374 arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 0c90c75e663246203a2b7f6dd9e08a110f4c3c43 ]
There is no "panic-indicator" default trigger but a property with that name:
sdm845-db845c.dtb: leds: led-0: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected)
--- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sdm845-db845c.dts +1 -1
@@ -55,8 +55,8 @@ leds { user4 { label = "green:user4"; gpios = <&pm8998_gpio 13 GPIO_ACTIVE_HIGH>; - linux,default-trigger = "panic-indicator"; default-state = "off"; + panic-indicator; }; wlan {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/374 arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit 24f8aba9a7c77c7e9d814a5754798e8346c7dd28 ]
The DP/DM wakeup interrupts are edge triggered and which edge to trigger on depends on use-case and whether a Low speed or Full/High speed device is connected.
Note that only triggering on rising edges can be used to detect resume events but not disconnect events.
--- arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/sc7280.dtsi +2 -2
@@ -1290,8 +1290,8 @@ usb_2: usb@8cf8800 { assigned-clock-rates = <19200000>, <200000000>; interrupts-extended = <&intc GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>, - <&pdc 13 IRQ_TYPE_EDGE_RISING>, - <&pdc 12 IRQ_TYPE_EDGE_RISING>; + <&pdc 12 IRQ_TYPE_EDGE_BOTH>, + <&pdc 13 IRQ_TYPE_EDGE_BOTH>; interrupt-names = "hs_phy_irq", "dm_hs_phy_irq", "dp_hs_phy_irq";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/374 bpf: Fix verification of indirect var-off stack access
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Matei <[email protected]>
[ Upstream commit a833a17aeac73b33f79433d7cee68d5cafd71e4f ]
This patch fixes a bug around the verification of possibly-zero-sized stack accesses. When the access was done through a var-offset stack pointer, check_stack_access_within_bounds was incorrectly computing the maximum-offset of a zero-sized read to be the same as the register's min offset. Instead, we have to take in account the register's maximum possible value. The patch also simplifies how the max offset is checked; the check is now simpler than for min offset.
The bug was allowing accesses to erroneously pass the check_stack_access_within_bounds() checks, only to later crash in check_stack_range_initialized() when all the possibly-affected stack slots are iterated (this time with a correct max offset). check_stack_range_initialized() is relying on check_stack_access_within_bounds() for its accesses to the stack-tracking vector to be within bounds; in the case of zero-sized accesses, we were essentially only verifying that the lowest possible slot was within bounds. We would crash when the max-offset of the stack pointer was >= 0 (which shouldn't pass verification, and hopefully is not something anyone's code attempts to do in practice).
Thanks Hao for reporting!
--- kernel/bpf/verifier.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
kernel/bpf/verifier.c +4 -10
@@ -4305,10 +4305,7 @@ static int check_stack_access_within_bounds(if (tnum_is_const (reg->var_off)) { min_off = reg->var_off.value + off; -if (access_size >0 ) - max_off = min_off + access_size -1 ; -else - max_off = min_off; + max_off = min_off + access_size; }else {if (reg->smax_value >=BPF_MAX_VAR_OFF || reg->smin_value <= -BPF_MAX_VAR_OFF ) {
@@ -4317,15 +4314,12 @@ static int check_stack_access_within_bounds(return -EACCES ; } min_off = reg->smin_value + off; -if (access_size >0 ) - max_off = reg->smax_value + off + access_size -1 ; -else - max_off = min_off; + max_off = reg->smax_value + off + access_size; } err =check_stack_slot_within_bounds (min_off, state, type); -if (!err) - err =check_stack_slot_within_bounds (max_off, state, type); +if (!err && max_off >0 ) + err = -EINVAL ;/* out of stack access into non-negative offsets */ if (err) {if (tnum_is_const (reg->var_off)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/374 block: Set memalloc_noio to false on device_add_disk() error path
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit 5fa3d1a00c2d4ba14f1300371ad39d5456e890d7 ]
On the error path of device_add_disk(), device's memalloc_noio flag was set but not cleared. As the comment of pm_runtime_set_memalloc_noio(), "The function should be called between device_add() and device_del()". Clear this flag before device_del() now.
--- block/genhd.c | 1 + 1 file changed, 1 insertion(+)
block/genhd.c +1 -0
@@ -538,6 +538,7 @@ out_del_integrity: out_del_block_link:if (!sysfs_deprecated)sysfs_remove_link (block_depr,dev_name (ddev)); +pm_runtime_set_memalloc_noio (ddev, false); out_device_del:device_del (ddev); out_free_ext_minor:
Greg Kroah-Hartman
maintainerPATCH 142/374 scsi: hisi_sas: Rename HISI_SAS_{RESET -> RESETTING}_BIT
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Jiaxing <[email protected]>
[ Upstream commit b5a9fa20e3bf59d89b5f48315a0c0c32963796ed ]
HISI_SAS_RESET_BIT means that the controller is being reset, and so the name is a bit vague. Rename it to HISI_SAS_RESETTING_BIT.
Stable-dep-of: d34ee535705e ("scsi: hisi_sas: Replace with standard error code return value")
--- drivers/scsi/hisi_sas/hisi_sas.h | 2 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 12 ++++++------ drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +++++----- 5 files changed, 14 insertions(+), 14 deletions(-)
drivers/scsi/hisi_sas/hisi_sas.h +1 -1
@@ -35,7 +35,7 @@#define HISI_SAS_QUEUE_SLOTS 4096#define HISI_SAS_MAX_ITCT_ENTRIES 1024#define HISI_SAS_MAX_DEVICES HISI_SAS_MAX_ITCT_ENTRIES -#define HISI_SAS_RESET_BIT 0 +#define HISI_SAS_RESETTING_BIT 0#define HISI_SAS_REJECT_CMD_BIT 1#define HISI_SAS_PM_BIT 2#define HISI_SAS_HW_FAULT_BIT 3
drivers/scsi/hisi_sas/hisi_sas_main.c +6 -6
@@ -724,7 +724,7 @@ static int hisi_sas_init_device(struct domain_device *device)*/ local_phy =sas_get_local_phy (device);if (!scsi_is_sas_phy_local (local_phy) && - !test_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags)) { + !test_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags)) {unsigned long deadline =ata_deadline (jiffies,20000 );struct sata_device *sata_dev = &device->sata_dev;struct ata_host *ata_host = sata_dev->ata_host;
@@ -1072,7 +1072,7 @@ static void hisi_sas_dev_gone(struct domain_device *device) sas_dev->device_id, sas_dev->dev_type);down (&hisi_hba->sem); -if (!test_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags)) { +if (!test_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags)) {hisi_sas_internal_task_abort (hisi_hba, device,HISI_SAS_INT_ABT_DEV ,0 , true);
@@ -1576,7 +1576,7 @@ void hisi_sas_controller_reset_done(struct hisi_hba *hisi_hba)hisi_sas_reset_init_all_devices (hisi_hba);up (&hisi_hba->sem);scsi_unblock_requests (shost); -clear_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags); +clear_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags);hisi_sas_rescan_topology (hisi_hba, hisi_hba->phy_state); }
@@ -1587,7 +1587,7 @@ static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba)if (!hisi_hba->hw->soft_reset)return -1 ; -if (test_and_set_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags)) +if (test_and_set_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags))return -1 ;if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0 ].itct)
@@ -1611,7 +1611,7 @@ static int hisi_sas_controller_reset(struct hisi_hba *hisi_hba)clear_bit (HISI_SAS_REJECT_CMD_BIT , &hisi_hba->flags);up (&hisi_hba->sem);scsi_unblock_requests (shost); -clear_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags); +clear_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags);return rc; }
@@ -2251,7 +2251,7 @@ void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy, }else {struct hisi_sas_port *port = phy->port; -if (test_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags) || +if (test_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags) || phy->in_reset) {dev_info (dev,"ignore flutter phy%d down\n" , phy_no);return ;
drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +1 -1
@@ -1422,7 +1422,7 @@ static irqreturn_t int_bcast_v1_hw(int irq, void *p) goto end; } -if (!test_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags)) +if (!test_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags))sas_notify_port_event (sas_phy,PORTE_BROADCAST_RCVD ,GFP_ATOMIC );
drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +1 -1
@@ -2831,7 +2831,7 @@ static void phy_bcast_v2_hw(int phy_no, struct hisi_hba *hisi_hba)hisi_sas_phy_write32 (hisi_hba, phy_no,SL_RX_BCAST_CHK_MSK ,1 ); bcast_status =hisi_sas_phy_read32 (hisi_hba, phy_no,RX_PRIMS_STATUS );if ((bcast_status &RX_BCAST_CHG_MSK ) && - !test_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags)) + !test_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags))sas_notify_port_event (sas_phy,PORTE_BROADCAST_RCVD ,GFP_ATOMIC ); hisi_sas_phy_write32(hisi_hba, phy_no, CHL_INT0,
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +5 -5
@@ -1622,7 +1622,7 @@ static irqreturn_t phy_bcast_v3_hw(int phy_no, struct hisi_hba *hisi_hba)hisi_sas_phy_write32 (hisi_hba, phy_no,SL_RX_BCAST_CHK_MSK ,1 ); bcast_status =hisi_sas_phy_read32 (hisi_hba, phy_no,RX_PRIMS_STATUS );if ((bcast_status &RX_BCAST_CHG_MSK ) && - !test_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags)) + !test_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags))sas_notify_port_event (sas_phy,PORTE_BROADCAST_RCVD ,GFP_ATOMIC ); hisi_sas_phy_write32(hisi_hba, phy_no, CHL_INT0,
@@ -4935,7 +4935,7 @@ static void hisi_sas_reset_prepare_v3_hw(struct pci_dev *pdev)int rc;dev_info (dev,"FLR prepare\n" ); -set_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags); +set_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags);hisi_sas_controller_reset_prepare (hisi_hba); rc =disable_host_v3_hw (hisi_hba);
@@ -4981,7 +4981,7 @@ static int _suspend_v3_hw(struct device *device)return -ENODEV ; } -if (test_and_set_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags)) +if (test_and_set_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags))return -1 ;scsi_block_requests (shost);
@@ -4992,7 +4992,7 @@ static int _suspend_v3_hw(struct device *device)if (rc) {dev_err (dev,"PM suspend: disable host failed rc=%d\n" , rc);clear_bit (HISI_SAS_REJECT_CMD_BIT , &hisi_hba->flags); -clear_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags); +clear_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags);scsi_unblock_requests (shost);return rc; }
@@ -5031,7 +5031,7 @@ static int _resume_v3_hw(struct device *device) }phys_init_v3_hw (hisi_hba);sas_resume_ha (sha); -clear_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags); +clear_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/374 scsi: hisi_sas: Prevent parallel FLR and controller reset
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Liu <[email protected]>
[ Upstream commit 16775db613c2bdea09705dcb876942c0641a1098 ]
If we issue a controller reset command during executing a FLR a hung task may be found:
Call trace: __switch_to+0x158/0x1cc __schedule+0x2e8/0x85c schedule+0x7c/0x110 schedule_timeout+0x190/0x1cc __down+0x7c/0xd4 down+0x5c/0x7c hisi_sas_task_exec+0x510/0x680 [hisi_sas_main] hisi_sas_queue_command+0x24/0x30 [hisi_sas_main] smp_execute_task_sg+0xf4/0x23c [libsas] sas_smp_phy_control+0x110/0x1e0 [libsas] transport_sas_phy_reset+0xc8/0x190 [libsas] phy_reset_work+0x2c/0x40 [libsas] process_one_work+0x1dc/0x48c worker_thread+0x15c/0x464 kthread+0x160/0x170 ret_from_fork+0x10/0x18
This is a race condition which occurs when the FLR completes first.
Here the host HISI_SAS_RESETTING_BIT flag out gets of sync as HISI_SAS_RESETTING_BIT is not always cleared with the hisi_hba.sem held, so now only set/unset HISI_SAS_RESETTING_BIT under hisi_hba.sem .
Stable-dep-of: d34ee535705e ("scsi: hisi_sas: Replace with standard error code return value")
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +++++--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_main.c +5 -3
@@ -1548,7 +1548,6 @@ void hisi_sas_controller_reset_prepare(struct hisi_hba *hisi_hba) {struct Scsi_Host *shost = hisi_hba->shost; -down (&hisi_hba->sem); hisi_hba->phy_state = hisi_hba->hw->get_phys_state (hisi_hba);scsi_block_requests (shost);
@@ -1574,9 +1573,9 @@ void hisi_sas_controller_reset_done(struct hisi_hba *hisi_hba)if (hisi_hba->reject_stp_links_msk)hisi_sas_terminate_stp_reject (hisi_hba);hisi_sas_reset_init_all_devices (hisi_hba); -up (&hisi_hba->sem);scsi_unblock_requests (shost);clear_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags); +up (&hisi_hba->sem);hisi_sas_rescan_topology (hisi_hba, hisi_hba->phy_state); }
@@ -1587,8 +1586,11 @@ static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba)if (!hisi_hba->hw->soft_reset)return -1 ; -if (test_and_set_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags)) +down (&hisi_hba->sem); +if (test_and_set_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags)) { +up (&hisi_hba->sem);return -1 ; + }if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0 ].itct) hisi_hba->hw->debugfs_snapshot_regs (hisi_hba);
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -0
@@ -4935,6 +4935,7 @@ static void hisi_sas_reset_prepare_v3_hw(struct pci_dev *pdev)int rc;dev_info (dev,"FLR prepare\n" ); +down (&hisi_hba->sem);set_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags);hisi_sas_controller_reset_prepare (hisi_hba);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/374 scsi: hisi_sas: Replace with standard error code return value
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit d34ee535705eb43885bc0f561c63046f697355ad ]
In function hisi_sas_controller_prereset(), -ENOSYS (Function not implemented) should be returned if the driver does not support .soft_reset. Returns -EPERM (Operation not permitted) if HISI_SAS_RESETTING_BIT is already be set.
In function _suspend_v3_hw(), returns -EPERM (Operation not permitted) if HISI_SAS_RESETTING_BIT is already be set.
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 4 ++-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_main.c +2 -2
@@ -1584,12 +1584,12 @@ EXPORT_SYMBOL_GPL(hisi_sas_controller_reset_done);static int hisi_sas_controller_prereset (struct hisi_hba *hisi_hba) {if (!hisi_hba->hw->soft_reset) -return -1 ; +return -ENOENT ;down (&hisi_hba->sem);if (test_and_set_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags)) {up (&hisi_hba->sem); -return -1 ; +return -EPERM ; }if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0 ].itct)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -1
@@ -4983,7 +4983,7 @@ static int _suspend_v3_hw(struct device *device) }if (test_and_set_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags)) -return -1 ; +return -EPERM ;scsi_block_requests (shost);set_bit (HISI_SAS_REJECT_CMD_BIT , &hisi_hba->flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/374 scsi: hisi_sas: Rollback some operations if FLR failed
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit 7ea3e7763c50b20a8bd25cf524ea0c6463de69be ]
We obtain the semaphore and set HISI_SAS_RESETTING_BIT in hisi_sas_reset_prepare_v3_hw(), block the scsi host and set HISI_SAS_REJECT_CMD_BIT in hisi_sas_controller_reset_prepare(), released them in hisi_sas_controller_reset_done(). However, if the HW reset failure in FLR results in early return, the semaphore and flag bits will not be release.
Rollback some operations including clearing flags / releasing semaphore when FLR is failed.
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +5 -0
@@ -4948,6 +4948,7 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev) {struct sas_ha_struct *sha =pci_get_drvdata (pdev);struct hisi_hba *hisi_hba = sha->lldd_ha; +struct Scsi_Host *shost = hisi_hba->shost;struct device *dev = hisi_hba->dev;int rc;
@@ -4956,6 +4957,10 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev) rc =hw_init_v3_hw (hisi_hba);if (rc) {dev_err (dev,"FLR: hw init failed rc=%d\n" , rc); +clear_bit (HISI_SAS_REJECT_CMD_BIT , &hisi_hba->flags); +scsi_unblock_requests (shost); +clear_bit (HISI_SAS_RESETTING_BIT , &hisi_hba->flags); +up (&hisi_hba->sem);return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/374 scsi: hisi_sas: Correct the number of global debugfs registers
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit 73e33f969ef05328766b23a99b2c07bfff765009 ]
In function debugfs_debugfs_snapshot_global_reg_v3_hw() it uses debugfs_axi_reg.count (which is the number of axi debugfs registers) to acquire the number of global debugfs registers.
Use debugfs_global_reg.count to acquire the number of global debugfs registers instead.
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -1
@@ -3331,7 +3331,7 @@ static void debugfs_snapshot_global_reg_v3_hw(struct hisi_hba *hisi_hba)u32 *databuf = hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL ].data;int i; -for (i =0 ; i < debugfs_axi_reg.count; i++, databuf++) +for (i =0 ; i < debugfs_global_reg.count; i++, databuf++) *databuf =hisi_sas_read32 (hisi_hba,4 * i); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/374 selftests/net: fix grep checking for fib_nexthop_multiprefix
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit a33e9da3470499e9ff476138f271fb52d6bfe767 ]
When running fib_nexthop_multiprefix test I saw all IPv6 test failed. e.g.
]# ./fib_nexthop_multiprefix.sh
TEST: IPv4: host 0 to host 1, mtu 1300 [ OK ]
TEST: IPv6: host 0 to host 1, mtu 1300 [FAIL]
With -v it shows
COMMAND: ip netns exec h0 /usr/sbin/ping6 -s 1350 -c5 -w5 2001:db8:101::1 PING 2001:db8:101::1(2001:db8:101::1) 1350 data bytes
From 2001:db8:100::64 icmp_seq=1 Packet too big: mtu=1300
--- 2001:db8:101::1 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
Route get
2001:db8:101::1 via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 metric 1024 expires 599sec mtu 1300 pref medium Searching for:
2001:db8:101::1 from :: via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 .* mtu 1300
The reason is when CONFIG_IPV6_SUBTREES is not enabled, rt6_fill_node() will not put RTA_SRC info. After fix:
]# ./fib_nexthop_multiprefix.sh
TEST: IPv4: host 0 to host 1, mtu 1300 [ OK ]
TEST: IPv6: host 0 to host 1, mtu 1300 [ OK ]
--- tools/testing/selftests/net/fib_nexthop_multiprefix.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/fib_nexthop_multiprefix.sh +2 -2
@@ -209,12 +209,12 @@ validate_v6_exception() echo "Route get" ip -netns h0 -6 ro get ${dst} echo "Searching for:" - echo " ${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" + echo " ${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" echo fi ip -netns h0 -6 ro get ${dst} | \ - grep -q "${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" + grep -q "${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" rc=$? log_test $rc 0 "IPv6: host 0 to host ${i}, mtu ${mtu}"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/374 virtio/vsock: fix logic which reduces credit update messages
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arseniy Krasnov <[email protected]>
[ Upstream commit 93b80887668226180ea5f5349cc728ca6dc700ab ]
Add one more condition for sending credit update during dequeue from stream socket: when number of bytes in the rx queue is smaller than SO_RCVLOWAT value of the socket. This is actual for non-default value of SO_RCVLOWAT (e.g. not 1) - idea is to "kick" peer to continue data transmission, because we need at least SO_RCVLOWAT bytes in our rx queue to wake up user for reading data (in corner case it is also possible to stuck both tx and rx sides, this is why 'Fixes' is used).
--- net/vmw_vsock/virtio_transport_common.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
net/vmw_vsock/virtio_transport_common.c +10 -3
@@ -355,6 +355,8 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,struct virtio_vsock_pkt *pkt;size_t bytes, total =0 ;u32 free_space; +u32 fwd_cnt_delta; +bool low_rx_bytes;int err = -EFAULT ;spin_lock_bh (&vvs->rx_lock);
@@ -386,7 +388,10 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk, } } - free_space = vvs->buf_alloc - (vvs->fwd_cnt - vvs->last_fwd_cnt); + fwd_cnt_delta = vvs->fwd_cnt - vvs->last_fwd_cnt; + free_space = vvs->buf_alloc - fwd_cnt_delta; + low_rx_bytes = (vvs->rx_bytes < +sock_rcvlowat (sk_vsock (vsk),0 ,INT_MAX ));spin_unlock_bh (&vvs->rx_lock);
@@ -396,9 +401,11 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,* too high causes extra messages. Too low causes transmitter * stalls. As stalls are in theory more expensive than extra * messages, we set the limit to a high value. TODO: experiment -* with different values. +* with different values. Also send credit update message when +* number of bytes in rx queue is not enough to wake up reader. */ -if (free_space <VIRTIO_VSOCK_MAX_PKT_BUF_SIZE ) +if (fwd_cnt_delta && + (free_space <VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || low_rx_bytes))virtio_transport_send_credit_update (vsk);return total;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 149/374 dma-mapping: Add dma_release_coherent_memory to DMA API
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark-PK Tsai <[email protected]>
[ Upstream commit e61c451476e61450f6771ce03bbc01210a09be16 ]
Add dma_release_coherent_memory to DMA API to allow dma user call it to release dev->dma_mem when the device is removed.
Stable-dep-of: b07bc2347672 ("dma-mapping: clear dev->dma_mem to NULL after freeing it")
--- include/linux/dma-map-ops.h | 3 +++ kernel/dma/coherent.c | 10 ++++++++-- 2 files changed, 11 insertions(+), 2 deletions(-)
include/linux/dma-map-ops.h +3 -0
@@ -166,6 +166,7 @@ static inline void dma_pernuma_cma_reserve(void) { }#ifdef CONFIG_DMA_DECLARE_COHERENT int dma_declare_coherent_memory (struct device *dev,phys_addr_t phys_addr,dma_addr_t device_addr,size_t size); +void dma_release_coherent_memory (struct device *dev);int dma_alloc_from_dev_coherent (struct device *dev,ssize_t size,dma_addr_t *dma_handle,void **ret);int dma_release_from_dev_coherent (struct device *dev,int order,void *vaddr);
@@ -177,6 +178,8 @@ static inline int dma_declare_coherent_memory(struct device *dev, {return -ENOSYS ; } + +#define dma_release_coherent_memory (dev) (0)#define dma_alloc_from_dev_coherent (dev, size, handle, ret) (0)#define dma_release_from_dev_coherent (dev, order, vaddr) (0)#define dma_mmap_from_dev_coherent (dev, vma, vaddr, order, ret) (0)
kernel/dma/coherent.c +8 -2
@@ -75,7 +75,7 @@ static struct dma_coherent_mem *dma_init_coherent_memory(phys_addr_t phys_addr,return ERR_PTR (-ENOMEM ); } -static void dma_release_coherent_memory (struct dma_coherent_mem *mem) +static void _dma_release_coherent_memory (struct dma_coherent_mem *mem) {if (!mem)return ;
@@ -127,10 +127,16 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr, ret =dma_assign_coherent_memory (dev, mem);if (ret) -dma_release_coherent_memory (mem); +_dma_release_coherent_memory (mem);return ret; } +void dma_release_coherent_memory (struct device *dev) +{ +if (dev) +_dma_release_coherent_memory (dev->dma_mem); +} +static void *__dma_alloc_from_coherent (struct device *dev,struct dma_coherent_mem *mem,ssize_t size,dma_addr_t *dma_handle)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/374 dma-mapping: clear dev->dma_mem to NULL after freeing it
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Zhang <[email protected]>
[ Upstream commit b07bc2347672cc8c7293c64499f1488278c5ca3d ]
Reproduced with below sequence:
dma_declare_coherent_memory()->dma_release_coherent_memory() ->dma_declare_coherent_memory()->"return -EBUSY" error
It will return -EBUSY from the dma_assign_coherent_memory() in dma_declare_coherent_memory(), the reason is that dev->dma_mem pointer has not been set to NULL after it's freed.
--- kernel/dma/coherent.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/dma/coherent.c +3 -1
@@ -133,8 +133,10 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr,void dma_release_coherent_memory (struct device *dev) { -if (dev) +if (dev) {_dma_release_coherent_memory (dev->dma_mem); + dev->dma_mem =NULL ; + } } static void *__dma_alloc_from_coherent(struct device *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 151/374 soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atul Dhudase <[email protected]>
[ Upstream commit eed6e57e9f3e2beac37563eb6a0129549daa330e ]
Commit c14e64b46944 ("soc: qcom: llcc: Support chipsets that can
write to llcc") add the support for chipset where capacity based
allocation and retention through power collapse can be programmed based on content of SCT table mentioned in the llcc driver where the target like sdm845 where the entire programming related to it is controlled in firmware. However, the commit introduces a bug where capacity/retention register get overwritten each time it gets programmed for each slice and that results in misconfiguration of the register based on SCT table and that is not expected behaviour instead it should be read modify write to retain the configuration of other slices.
This issue is totally caught from code review and programming test and not through any power/perf numbers so, it is not known what impact this could make if we don't have this change however, this feature are for these targets and they should have been programmed accordingly as per their configuration mentioned in SCT table like others bits information.
This change brings one difference where it keeps capacity/retention bits of the slices that are not mentioned in SCT table in unknown state where as earlier it was initialized to zero.
--- drivers/soc/qcom/llcc-qcom.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soc/qcom/llcc-qcom.c +4 -4
@@ -450,14 +450,14 @@ static int _qcom_llcc_cfg_program(const struct llcc_slice_config *config,u32 disable_cap_alloc, retain_pc; disable_cap_alloc = config->dis_cap_alloc << config->slice_id; - ret =regmap_write (drv_data->bcast_regmap, -LLCC_TRP_SCID_DIS_CAP_ALLOC , disable_cap_alloc); + ret =regmap_update_bits (drv_data->bcast_regmap,LLCC_TRP_SCID_DIS_CAP_ALLOC , +BIT (config->slice_id), disable_cap_alloc);if (ret)return ret; retain_pc = config->retain_on_pc << config->slice_id; - ret =regmap_write (drv_data->bcast_regmap, -LLCC_TRP_PCB_ACT , retain_pc); + ret =regmap_update_bits (drv_data->bcast_regmap,LLCC_TRP_PCB_ACT , +BIT (config->slice_id), retain_pc);if (ret)return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/374 arm64: dts: qcom: sm8150-hdk: fix SS USB regulators
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit a509adf05b2aac31b22781f5aa09e4768a5b6c39 ]
The SM8150-HDK uses two different regulators to power up SuperSpeed USB PHYs. The L5A regulator is used for the second USB host, while the first (OTG) USB host uses different regulator, L18A. Fix the regulator for the usb_1 QMPPHY and (to remove possible confusion) drop the usb_ss_dp_core_1/_2 labels.
--- arch/arm64/boot/dts/qcom/sm8150-hdk.dts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/qcom/sm8150-hdk.dts +8 -4
@@ -126,8 +126,6 @@ vdda_qrefs_0p875_5: vdda_sp_sensor: vdda_ufs_2ln_core_1: vdda_ufs_2ln_core_2: - vdda_usb_ss_dp_core_1: - vdda_usb_ss_dp_core_2: vdda_qlink_lv: vdda_qlink_lv_ck: vreg_l5a_0p875: ldo5 {
@@ -209,6 +207,12 @@ vreg_l17a_3p0: ldo17 { regulator-max-microvolt = <3008000>; regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>; }; + + vreg_l18a_0p8: ldo18 { + regulator-min-microvolt = <880000>; + regulator-max-microvolt = <880000>; + regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>; + }; }; pm8150l-rpmh-regulators {
@@ -441,13 +445,13 @@ &usb_2_hsphy { &usb_1_qmpphy { status = "okay"; vdda-phy-supply = <&vreg_l3c_1p2>; - vdda-pll-supply = <&vdda_usb_ss_dp_core_1>; + vdda-pll-supply = <&vreg_l18a_0p8>; }; &usb_2_qmpphy { status = "okay"; vdda-phy-supply = <&vreg_l3c_1p2>; - vdda-pll-supply = <&vdda_usb_ss_dp_core_1>; + vdda-pll-supply = <&vreg_l5a_0p875>; }; &usb_1 {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 153/374 block: add check of minors and first_minor in device_add_disk()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <[email protected]>
[ Upstream commit 4c434392c4777881d01beada6701eff8c76b43fe ]
'first_minor' represents the starting minor number of disks, and 'minors' represents the number of partitions in the device. Neither of them can be greater than MINORMASK + 1.
Commit e338924bd05d ("block: check minor range in device_add_disk()") only added the check of 'first_minor + minors'. However, their sum might be less than MINORMASK but their values are wrong. Complete the checks now.
--- block/genhd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
block/genhd.c +3 -1
@@ -421,7 +421,9 @@ int device_add_disk(struct device *parent, struct gendisk *disk, DISK_MAX_PARTS); disk->minors =DISK_MAX_PARTS ; } -if (disk->first_minor + disk->minors >MINORMASK +1 ) +if (disk->first_minor >MINORMASK || + disk->minors >MINORMASK +1 || + disk->first_minor + disk->minors >MINORMASK +1 )return -EINVAL ; }else {if (WARN_ON (disk->minors))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 154/374 arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 827f5fc8d912203c1f971e47d61130b13c6820ba ]
The SDHCI hosts on SC7280 are cache-coherent, just like on most fairly recent Qualcomm SoCs. Mark them as such.
--- arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/sc7280.dtsi +2 -0
@@ -485,6 +485,7 @@ sdhc_1: sdhci@7c4000 { bus-width = <8>; supports-cqe; + dma-coherent; qcom,dll-config = <0x0007642c>; qcom,ddr-config = <0x80040868>;
@@ -1174,6 +1175,7 @@ sdhc_2: sdhci@8804000 { operating-points-v2 = <&sdhc2_opp_table>; bus-width = <4>; + dma-coherent; qcom,dll-config = <0x0007642c>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 155/374 wifi: rtlwifi: add calculate_bit_shift()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 52221dfddbbfb5b4e029bb2efe9bb7da33ec1e46 ]
There are many same functions like _rtl88e_phy_calculate_bit_shift(), _rtl92c_phy_calculate_bit_shift() and so on. And these functions can cause undefined bitwise shift behavior. Add calculate_bit_shift() to replace them and fix undefined behavior in subsequent patches.
Stable-dep-of: 969bc926f04b ("wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()")
--- drivers/net/wireless/realtek/rtlwifi/wifi.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/wireless/realtek/rtlwifi/wifi.h +7 -0
@@ -3106,4 +3106,11 @@ static inline struct ieee80211_sta *rtl_find_sta(struct ieee80211_hw *hw, return ieee80211_find_sta(mac->vif, mac_addr); } +static inline u32 calculate_bit_shift (u32 bitmask) +{ +if (WARN_ON_ONCE (!bitmask)) +return 0 ; + +return __ffs (bitmask); +}#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/374 wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 969bc926f04b438676768aeffffffb050e480b62 ]
Using calculate_bit_shift() to replace _rtl88e_phy_calculate_bit_shift(). And fix the undefined bitwise shift behavior problem.
--- .../net/wireless/realtek/rtlwifi/rtl8188ee/phy.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c +4 -10
@@ -16,12 +16,6 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw,static void _rtl88e_phy_rf_serial_write (struct ieee80211_hw *hw,enum radio_path rfpath,u32 offset,u32 data); -static u32 _rtl88e_phy_calculate_bit_shift (u32 bitmask) -{ -u32 i =ffs (bitmask); - -return i ? i -1 :32 ; -}static bool _rtl88e_phy_bb8188e_config_parafile (struct ieee80211_hw *hw);static bool _rtl88e_phy_config_mac_with_headerfile (struct ieee80211_hw *hw); static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw,
@@ -51,7 +45,7 @@ u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)rtl_dbg (rtlpriv,COMP_RF ,DBG_TRACE ,"regaddr(%#x), bitmask(%#x)\n" , regaddr, bitmask); originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl88e_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); returnvalue = (originalvalue & bitmask) >> bitshift; rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
@@ -74,7 +68,7 @@ void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,if (bitmask !=MASKDWORD ) { originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl88e_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((originalvalue & (~bitmask)) | (data << bitshift)); }
@@ -99,7 +93,7 @@ u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw, original_value =_rtl88e_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl88e_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift;spin_unlock (&rtlpriv->locks.rf_lock);
@@ -127,7 +121,7 @@ void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =_rtl88e_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl88e_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/374 wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 1dedc3a6699d827d345019e921b8d8f37f694333 ]
Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). And fix the undefined bitwise shift behavior problem.
--- .../wireless/realtek/rtlwifi/rtl8192c/phy_common.c | 12 ++---------- .../wireless/realtek/rtlwifi/rtl8192c/phy_common.h | 1 - 2 files changed, 2 insertions(+), 11 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c +2 -10
@@ -17,7 +17,7 @@ u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)rtl_dbg (rtlpriv,COMP_RF ,DBG_TRACE ,"regaddr(%#x), bitmask(%#x)\n" , regaddr, bitmask); originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); returnvalue = (originalvalue & bitmask) >> bitshift; rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
@@ -40,7 +40,7 @@ void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw,if (bitmask !=MASKDWORD ) { originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((originalvalue & (~bitmask)) | (data << bitshift)); }
@@ -143,14 +143,6 @@ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw, }EXPORT_SYMBOL (_rtl92c_phy_rf_serial_write); -u32 _rtl92c_phy_calculate_bit_shift (u32 bitmask) -{ -u32 i =ffs (bitmask); - -return i ? i -1 :32 ; -} -EXPORT_SYMBOL (_rtl92c_phy_calculate_bit_shift); -static void _rtl92c_phy_bb_config_1t (struct ieee80211_hw *hw) {rtl_set_bbreg (hw,RFPGA0_TXINFO ,0x3 ,0x2 );
drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h +0 -1
@@ -196,7 +196,6 @@ bool rtl92c_phy_set_rf_power_state(struct ieee80211_hw *hw,void rtl92ce_phy_set_rf_on (struct ieee80211_hw *hw);void rtl92c_phy_set_io (struct ieee80211_hw *hw);void rtl92c_bb_block_on (struct ieee80211_hw *hw); -u32 _rtl92c_phy_calculate_bit_shift (u32 bitmask);long _rtl92c_phy_txpwr_idx_to_dbm (struct ieee80211_hw *hw,enum wireless_mode wirelessmode,u8 txpwridx);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 158/374 wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit f4088c8fcbabadad9dd17d17ae9ba24e9e3221ec ]
Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). And fix an undefined bitwise shift behavior problem.
--- drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c +3 -3
@@ -32,7 +32,7 @@ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw, original_value =_rtl92c_phy_fw_rf_serial_read (hw, rfpath, regaddr); } - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift; rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n",
@@ -56,7 +56,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =_rtl92c_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
@@ -67,7 +67,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =_rtl92c_phy_fw_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 159/374 wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 3d03e8231031bcc65a48cd88ef9c71b6524ce70b ]
Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). And fix the undefined bitwise shift behavior problem.
--- drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c | 6 +++--- drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h | 1 - 2 files changed, 3 insertions(+), 4 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c +3 -3
@@ -39,7 +39,7 @@ u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw, rfpath, regaddr); } - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift;spin_unlock (&rtlpriv->locks.rf_lock);
@@ -110,7 +110,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =_rtl92c_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
@@ -122,7 +122,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =_rtl92c_phy_fw_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h +0 -1
@@ -94,7 +94,6 @@ u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath, u32 offset);u32 _rtl92c_phy_fw_rf_serial_read (struct ieee80211_hw *hw,enum radio_path rfpath,u32 offset); -u32 _rtl92c_phy_calculate_bit_shift (u32 bitmask);void _rtl92c_phy_rf_serial_write (struct ieee80211_hw *hw,enum radio_path rfpath,u32 offset,u32 data); void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw,
Signature · 1 line
2.43.0