5.4.282-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.4.282-rc1 review
This is the start of the stable review cycle for the 5.4.282 release. There are 259 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 17 Aug 2024 13:18:17 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.282-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.282-rc1
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
WangYuli <[email protected]>
nvme/pci: Add APST quirk for Lenovo N60z laptop
Kees Cook <[email protected]>
exec: Fix ToCToU between perm check and set-uid/gid usage
Yunke Cao <[email protected]>
media: uvcvideo: Use entity get_cur in uvc_ctrl_set
Amit Daniel Kachhap <[email protected]>
arm64: cpufeature: Fix the visibility of compat hwcaps
Andi Shyti <[email protected]>
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
Florian Westphal <[email protected]>
netfilter: nf_tables: prefer nft_chain_validate
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: use timestamp to check for set element timeout
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: set element extended ACK reporting support
Nathan Chancellor <[email protected]>
kbuild: Fix '-S -c' in x86 stack protector scripts
Jari Ruusu <[email protected]>
Fix gcc 4.9 build issue in 5.4.y
Thomas Zimmermann <[email protected]>
drm/mgag200: Set DDC timeout in milliseconds
Lucas Stach <[email protected]>
drm/bridge: analogix_dp: properly handle zero sized AUX transactions
Andi Kleen <[email protected]>
x86/mtrr: Check if fixed MTRRs exist before saving them
Tze-nan Wu <[email protected]>
tracing: Fix overflow in get_free_elt()
Hans de Goede <[email protected]>
power: supply: axp288_charger: Round constant_charge_voltage writes down
Hans de Goede <[email protected]>
power: supply: axp288_charger: Fix constant_charge_voltage writes
Shay Drory <[email protected]>
genirq/irqdesc: Honor caller provided affinity in alloc_desc()
George Kennedy <[email protected]>
serial: core: check uartclk for zero to avoid divide by zero
Damien Le Moal <[email protected]>
scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Remove scsi_dma_map() error messages
Justin Stitt <[email protected]>
ntp: Safeguard against time_constant overflow
Dan Williams <[email protected]>
driver core: Fix uevent_show() vs driver detach race
Justin Stitt <[email protected]>
ntp: Clamp maxerror and esterror to operating range
Thomas Gleixner <[email protected]>
tick/broadcast: Move per CPU pointer access into the atomic section
Vamshi Gajjela <[email protected]>
scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
Chris Wulff <[email protected]>
usb: gadget: core: Check for unset descriptor
Marek Marczykowski-Górecki <[email protected]>
USB: serial: debug: do not echo input by default
Oliver Neukum <[email protected]>
usb: vhci-hcd: Do not drop references before new references are gained
Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
Steven 'Steve' Kendall <[email protected]>
ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
Takashi Iwai <[email protected]>
ALSA: line6: Fix racy access to midibuf
Ma Ke <[email protected]>
drm/client: fix null pointer dereference in drm_client_modeset_probe
Stefan Wahren <[email protected]>
spi: spi-fsl-lpspi: Fix scldiv calculation
Oleksandr Suvorov <[email protected]>
spi: fsl-lpspi: remove unneeded array
Menglong Dong <[email protected]>
bpf: kprobe: remove unused declaring of bpf_kprobe_override
Guenter Roeck <[email protected]>
i2c: smbus: Send alert notifications to all devices if source not found
Guenter Roeck <[email protected]>
i2c: smbus: Improve handling of stuck alerts
Corey Minyard <[email protected]>
i2c: smbus: Don't filter out duplicate alerts
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround (again)
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-A725 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X1C definitions
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround
Mark Rutland <[email protected]>
arm64: errata: Unify speculative SSBS errata logic
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X925 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-A720 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X3 definitions
Mark Rutland <[email protected]>
arm64: errata: Add workaround for Arm errata 3194386 and 3312417
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-V3 definitions
Mark Rutland <[email protected]>
arm64: cputype: Add Cortex-X4 definitions
Besar Wicaksono <[email protected]>
arm64: Add Neoverse-V2 part
James Morse <[email protected]>
arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
Kemeng Shi <[email protected]>
ext4: fix wrong unit use in ext4_mb_find_by_goal
Benjamin Coddington <[email protected]>
SUNRPC: Fix a race to wake a sync task
Peter Oberparleiter <[email protected]>
s390/sclp: Prevent release of buffer in I/O
Kemeng Shi <[email protected]>
jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
Michal Pecio <[email protected]>
media: uvcvideo: Fix the bandwdith quirk on USB 3.x
Ricardo Ribalda <[email protected]>
media: uvcvideo: Ignore empty TS packets
Ma Jun <[email protected]>
drm/amdgpu: Fix the null pointer dereference to ras_manager
Filipe Manana <[email protected]>
btrfs: fix bitmap leak when loading free space cache on duplicate entry
Johannes Berg <[email protected]>
wifi: nl80211: don't give key data to userspace
Roman Smirnov <[email protected]>
udf: prevent integer overflow in udf_bitmap_free_blocks()
FUJITA Tomonori <[email protected]>
PCI: Add Edimax Vendor ID to pci_ids.h
Yonghong Song <[email protected]>
selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
Thomas Weißschuh <[email protected]>
ACPI: SBS: manage alarm sysfs attribute through psy core
Thomas Weißschuh <[email protected]>
ACPI: battery: create alarm sysfs attribute atomically
Niklas Söderlund <[email protected]>
clocksource/drivers/sh_cmt: Address race condition for clock events
Yu Kuai <[email protected]>
md/raid5: avoid BUG_ON() while continue reshape after reassembling
Csókás, Bence <[email protected]>
net: fec: Stop PPS on driver remove
Dmitry Antipov <[email protected]>
Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
Eric Dumazet <[email protected]>
net: linkwatch: use system_unbound_wq
Daniele Palmas <[email protected]>
net: usb: qmi_wwan: fix memory leak for not ip packets
Kuniyuki Iwashima <[email protected]>
sctp: Fix null-ptr-deref in reuseport_add_sock().
Xin Long <[email protected]>
sctp: move hlist_node and hashent out of sctp_ep_common
Peter Zijlstra <[email protected]>
x86/mm: Fix pti_clone_pgtable() alignment assumption
Yipeng Zou <[email protected]>
irqchip/mbigen: Fix mbigen node address layout
Marc Zyngier <[email protected]>
genirq: Allow irq_chip registration functions to take a const irq_chip
Alexander Maltsev <[email protected]>
netfilter: ipset: Add list flush to cancel_gc
Ma Ke <[email protected]>
net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
Takashi Iwai <[email protected]>
ALSA: usb-audio: Correct surround channels in UAC1 channel map
Al Viro <[email protected]>
protect the fetch of ->fd[fd] in do_dup2() from mispredictions
Tatsunosuke Tobita <[email protected]>
HID: wacom: Modify pen IDs
Maciej Żenczykowski <[email protected]>
ipv6: fix ndisc_is_useropt() handling for PIO
Shahar Shitrit <[email protected]>
net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
Alexandra Winter <[email protected]>
net/iucv: fix use after free in iucv_sock_close()
Ian Forbes <[email protected]>
drm/vmwgfx: Fix overlay when using Screen Targets
Danilo Krummrich <[email protected]>
drm/nouveau: prime: fix refcount underflow
Aleksandr Mishin <[email protected]>
remoteproc: imx_rproc: Skip over memory region when node value is NULL
Dong Aisheng <[email protected]>
remoteproc: imx_rproc: Fix ignoring mapping vdev regions
Peng Fan <[email protected]>
remoteproc: imx_rproc: ignore mapping vdev regions
Shenwei Wang <[email protected]>
irqchip/imx-irqsteer: Handle runtime power management correctly
Lucas Stach <[email protected]>
irqchip/imx-irqsteer: Add runtime PM support
Lucas Stach <[email protected]>
irqchip/imx-irqsteer: Constify irq_chip struct
Marc Zyngier <[email protected]>
genirq: Allow the PM device to originate from irq domain
Zijun Hu <[email protected]>
devres: Fix memory leakage caused by driver API devm_free_percpu()
Andy Shevchenko <[email protected]>
driver core: Cast to (void *) with __force for __percpu pointer
tuhaowen <[email protected]>
dev/parport: fix the array out-of-bounds risk
Joe Perches <[email protected]>
parport: Standardize use of printmode
Joe Perches <[email protected]>
parport: Convert printk(KERN_<LEVEL> to pr_<level>(
Manivannan Sadhasivam <[email protected]>
PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
Chen-Yu Tsai <[email protected]>
PCI: rockchip: Make 'ep-gpios' DT property optional
Jan Kara <[email protected]>
mm: avoid overflows in dirty throttling logic
Leon Romanovsky <[email protected]>
nvme-pci: add missing condition check for existence of mapped data
Gerd Bayer <[email protected]>
s390/pci: Allow allocation of more than 1 MSI interrupt
Gerd Bayer <[email protected]>
s390/pci: Refactor arch_setup_msi_irqs()
Thomas Gleixner <[email protected]>
s390/pci: Rework MSI descriptor walk
Thomas Gleixner <[email protected]>
s390/pci: Do not mask MSI[-X] entries on teardown
Alexander Gordeev <[email protected]>
s390/pci: fix CPU address in MSI for directed IRQ
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
Hans de Goede <[email protected]>
ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
Thomas Gleixner <[email protected]>
ASoC: Intel: Convert to new X86 CPU match macros
Al Viro <[email protected]>
powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
Xiao Liang <[email protected]>
apparmor: Fix null pointer deref when receiving skb during sock creation
Dan Carpenter <[email protected]>
mISDN: Fix a use after free in hfcmulti_tx()
Fred Li <[email protected]>
bpf: Fix a segment issue when downgrading gso_size
Petr Machata <[email protected]>
net: nexthop: Initialize all fields in dumped nexthops
Shigeru Yoshida <[email protected]>
tipc: Return non-zero value from tipc_udp_addr2str() on error
Johannes Berg <[email protected]>
net: bonding: correctly annotate RCU in bond_should_notify_peers()
Ido Schimmel <[email protected]>
ipv4: Fix incorrect source address in Record Route option
Gregory CLEMENT <[email protected]>
MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
Lance Richardson <[email protected]>
dma: fix call order in dmam_free_coherent
Andrii Nakryiko <[email protected]>
libbpf: Fix no-args func prototype BTF dumping syntax
Johannes Berg <[email protected]>
um: time-travel: fix time-travel-start option
Jeongjun Park <[email protected]>
jfs: Fix array-index-out-of-bounds in diFree
Douglas Anderson <[email protected]>
kdb: Use the passed prompt in kdb_position_cursor()
Arnd Bergmann <[email protected]>
kdb: address -Wformat-security warnings
Ryusuke Konishi <[email protected]>
nilfs2: handle inconsistent state in nilfs_btnode_create_block()
WangYuli <[email protected]>
Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
Hilda Wu <[email protected]>
Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
Ilya Dryomov <[email protected]>
rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
Ilya Dryomov <[email protected]>
rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
Dragan Simic <[email protected]>
drm/panfrost: Mark simple_ondemand governor as softdep
Ilya Dryomov <[email protected]>
rbd: don't assume rbd_is_lock_owner() for exclusive mappings
Michael Ellerman <[email protected]>
selftests/sigaltstack: Fix ppc64 GCC build
Bart Van Assche <[email protected]>
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
Jiaxun Yang <[email protected]>
platform: mips: cpu_hwmon: Disable driver on unsupported hardware
Thomas Gleixner <[email protected]>
watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
Joy Chakraborty <[email protected]>
rtc: isl1208: Fix return value of nvmem callbacks
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix a topa_entry base address calculation
Marco Cavenati <[email protected]>
perf/x86/intel/pt: Fix topa_entry base length
Nilesh Javali <[email protected]>
scsi: qla2xxx: validate nvme_local_port correctly
Shreyas Deodhar <[email protected]>
scsi: qla2xxx: Complete command early within lock
Shreyas Deodhar <[email protected]>
scsi: qla2xxx: Fix for possible memory corruption
Manish Rangankar <[email protected]>
scsi: qla2xxx: During vport delete send async logout explicitly
Joy Chakraborty <[email protected]>
rtc: cmos: Fix return value of nvmem callbacks
Zijun Hu <[email protected]>
kobject_uevent: Fix OOB access within zap_modalias_env()
Ross Lagerwall <[email protected]>
decompress_bunzip2: fix rare decompression failure
Fedor Pchelkin <[email protected]>
ubi: eba: properly rollback inside self_check_eba
Bastien Curutchet <[email protected]>
clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
Chao Yu <[email protected]>
f2fs: fix to don't dirty inode for readonly filesystem
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
Carlos Llamas <[email protected]>
binder: fix hang of unregistered readers
Wei Liu <[email protected]>
PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
Ilpo Järvinen <[email protected]>
hwrng: amd - Convert PCIBIOS_* return codes to errnos
Alan Stern <[email protected]>
tools/memory-model: Fix bug in lock.cat
Ilpo Järvinen <[email protected]>
leds: ss4200: Convert PCIBIOS_* return codes to errnos
Rafael Beims <[email protected]>
wifi: mwifiex: Fix interface type change
Baokun Li <[email protected]>
ext4: make sure the first directory block is not a hole
Baokun Li <[email protected]>
ext4: check dot and dotdot of dx_root before making dir indexed
Paolo Pisati <[email protected]>
m68k: amiga: Turn off Warp1260 interrupts during boot
Jan Kara <[email protected]>
udf: Avoid using corrupted block bitmap buffer
Sung Joon Kim <[email protected]>
drm/amd/display: Check for NULL pointer
Ma Ke <[email protected]>
drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
Ma Ke <[email protected]>
drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
Chao Yu <[email protected]>
hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
Dikshita Agarwal <[email protected]>
media: venus: fix use after free in vdec_close
Joe Hattori <[email protected]>
char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
Nicolas Dichtel <[email protected]>
ipv6: take care of scope when choosing the src addr
Chengen Du <[email protected]>
af_packet: Handle outgoing VLAN packets without hardware offloading
Breno Leitao <[email protected]>
net: netconsole: Disable target before netpoll cleanup
Yu Liao <[email protected]>
tick/broadcast: Make takeover of broadcast hrtimer reliable
Csókás, Bence <[email protected]>
rtc: interface: Add RTC offset to alarm after fix-up
Ryusuke Konishi <[email protected]>
nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
Alex Shi <[email protected]>
fs/nilfs2: remove some unused macros to tame gcc
Peng Fan <[email protected]>
pinctrl: freescale: mxs: Fix refcount of child
Yang Yingliang <[email protected]>
pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
Uwe Kleine-König <[email protected]>
pinctrl: ti: ti-iodelay: Drop if block with always false condition
Yang Yingliang <[email protected]>
pinctrl: single: fix possible memory leak when pinctrl_enable() fails
Yang Yingliang <[email protected]>
pinctrl: core: fix possible memory leak when pinctrl_enable() fails
Pablo Neira Ayuso <[email protected]>
netfilter: ctnetlink: use helper function to calculate expect ID
Jack Wang <[email protected]>
bnxt_re: Fix imm_data endianness
Nick Bowler <[email protected]>
macintosh/therm_windtunnel: fix module unload.
Michael Ellerman <[email protected]>
powerpc/xmon: Fix disassembly CPU feature checks
Dominique Martinet <[email protected]>
MIPS: Octeron: remove source file executable bit
Dmitry Torokhov <[email protected]>
Input: elan_i2c - do not leave interrupt disabled on suspend failure
Leon Romanovsky <[email protected]>
RDMA/device: Return error earlier if port in not valid
Arnd Bergmann <[email protected]>
mtd: make mtd_test.c a separate module
Chen Ni <[email protected]>
ASoC: max98088: Check for clk_prepare_enable() error
Honggang LI <[email protected]>
RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
Leon Romanovsky <[email protected]>
RDMA/mlx4: Fix truncated output warning in alias_GUID.c
Leon Romanovsky <[email protected]>
RDMA/mlx4: Fix truncated output warning in mad.c
Andrei Lalaev <[email protected]>
Input: qt1050 - handle CHIP_ID reading error
Ilpo Järvinen <[email protected]>
PCI: Fix resource double counting on remove & rescan
Benjamin Coddington <[email protected]>
SUNRPC: Fixup gss_status tracepoint error output
Andreas Larsson <[email protected]>
sparc64: Fix incorrect function signature and add prototype for prom_cif_init
Jan Kara <[email protected]>
ext4: avoid writing unitialized memory to disk in EA inodes
NeilBrown <[email protected]>
SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
Javier Carrasco <[email protected]>
mfd: omap-usb-tll: Use struct_size to allocate tll
Chen Ni <[email protected]>
drm/qxl: Add check for drm_cvt_mode
Lucas Stach <[email protected]>
drm/etnaviv: fix DMA direction handling for cached RW buffers
Namhyung Kim <[email protected]>
perf report: Fix condition in sort__sym_cmp()
Hans de Goede <[email protected]>
leds: trigger: Unregister sysfs attributes before calling deactivate()
Laurent Pinchart <[email protected]>
media: renesas: vsp1: Store RPF partition configuration per RPF instance
Laurent Pinchart <[email protected]>
media: renesas: vsp1: Fix _irqsave and _irq mix
Daniel Schaefer <[email protected]>
media: uvcvideo: Override default flags
Ricardo Ribalda <[email protected]>
media: uvcvideo: Allow entity-defined get_info and get_cur
Aleksandr Burakov <[email protected]>
saa7134: Unchecked i2c_transfer function result fixed
Ricardo Ribalda <[email protected]>
media: imon: Fix race getting ictx->lock
Zheng Yejian <[email protected]>
media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
Greg Kroah-Hartman <[email protected]>
USB: move snd_usb_pipe_sanity_check into the USB core
Amit Cohen <[email protected]>
selftests: forwarding: devlink_lib: Wait for udev events after reloading
Alexey Kodanev <[email protected]>
bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
Johannes Berg <[email protected]>
wifi: virt_wifi: don't use strlen() in const context
Gaosheng Cui <[email protected]>
gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
En-Wei Wu <[email protected]>
wifi: virt_wifi: avoid reporting connection success with wrong SSID
Shai Malin <[email protected]>
qed: Improve the stack space of filter_config()
Adrian Hunter <[email protected]>
perf: Prevent passing zero nr_pages to rb_alloc_aux()
Adrian Hunter <[email protected]>
perf: Fix perf_aux_size() for greater-than 32-bit size
Adrian Hunter <[email protected]>
perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: rise cap on SELinux secmark context
Ismael Luceno <[email protected]>
ipvs: Avoid unnecessary calls to skb_is_gso_sctp
Csókás, Bence <[email protected]>
net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
Csókás Bence <[email protected]>
net: fec: Refactor: #define magic constants
Baochen Qiang <[email protected]>
wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
Baochen Qiang <[email protected]>
wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
Ido Schimmel <[email protected]>
mlxsw: spectrum_acl_erp: Fix object nesting warning
Ido Schimmel <[email protected]>
lib: objagg: Fix general protection fault
Geliang Tang <[email protected]>
selftests/bpf: Check length of recv in test_sockmap
Guangguan Wang <[email protected]>
net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
Stefan Raspl <[email protected]>
net/smc: Allow SMC-D 1MB DMB allocations
Samasth Norway Ananda <[email protected]>
wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
Marek Behún <[email protected]>
firmware: turris-mox-rwtm: Initialize completion before mailbox
Marek Behún <[email protected]>
firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
Thorsten Blum <[email protected]>
m68k: cmpxchg: Fix return value for default case in __arch_xchg()
Chen Ni <[email protected]>
x86/xen: Convert comma to semicolon
Eero Tamminen <[email protected]>
m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
Jerome Brunet <[email protected]>
arm64: dts: amlogic: gx: correct hdmi clocks
Rafał Miłecki <[email protected]>
arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix board reset
Michael Walle <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
Marco Felsch <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
Jonas Karlman <[email protected]>
arm64: dts: rockchip: Increase VOP clk rate on RK3328
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sdm845: add power-domain to UFS PHY
Guenter Roeck <[email protected]>
hwmon: (max6697) Fix swapped temp{1,8} critical alarms
Guenter Roeck <[email protected]>
hwmon: (max6697) Fix underflow when writing limit attributes
Uwe Kleine-König <[email protected]>
pwm: stm32: Always do lazy disabling
Wayne Tung <[email protected]>
hwmon: (adt7475) Fix default duty on fan is disabled
Ilpo Järvinen <[email protected]>
x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
Ilpo Järvinen <[email protected]>
x86/pci/xen: Fix PCIBIOS_* return code handling
Ilpo Järvinen <[email protected]>
x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
Ilpo Järvinen <[email protected]>
x86/of: Return consistent error type from x86_of_pci_irq_enable()
Chao Yu <[email protected]>
hfsplus: fix to avoid false alarm of circular locking
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_debugfs: fix wrong EC message version
Arnd Bergmann <[email protected]>
EDAC, i10nm: make skx_common.o a separate module
Qiuxu Zhuo <[email protected]>
EDAC/skx_common: Add new ADXL components for 2-level memory
Tony Luck <[email protected]>
EDAC, skx: Retrieve and print retry_rd_err_log registers
Tony Luck <[email protected]>
EDAC, skx_common: Refactor so that we initialize "dev" in result of adxl decode.
-------------
Diffstat:
Documentation/arm64/cpu-feature-registers.rst | 38 ++++- Documentation/arm64/silicon-errata.rst | 36 +++++ Makefile | 4 +- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 21 ++- arch/arm64/Kconfig | 38 +++++ arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 4 +- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 4 +- .../boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 4 +- arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 4 +- arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 +- arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/cputype.h | 16 ++ arch/arm64/kernel/cpu_errata.c | 44 +++++ arch/arm64/kernel/cpufeature.c | 94 ++++++++--- arch/m68k/amiga/config.c | 9 ++ arch/m68k/atari/ataints.c | 6 +- arch/m68k/include/asm/cmpxchg.h | 2 +- arch/mips/include/asm/mips-cm.h | 4 + arch/mips/kernel/smp-cps.c | 5 +- arch/mips/pci/pcie-octeon.c | 0 arch/powerpc/kvm/powerpc.c | 4 +- arch/powerpc/xmon/ppc-dis.c | 33 ++-- arch/s390/pci/pci_irq.c | 132 +++++++++------ arch/sparc/include/asm/oplib_64.h | 1 + arch/sparc/prom/init_64.c | 3 - arch/sparc/prom/p1275.c | 2 +- arch/um/kernel/time.c | 4 +- arch/x86/events/intel/pt.c | 4 +- arch/x86/events/intel/pt.h | 4 +- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- arch/x86/kernel/devicetree.c | 2 +- arch/x86/mm/pti.c | 6 +- arch/x86/pci/intel_mid_pci.c | 4 +- arch/x86/pci/xen.c | 4 +- arch/x86/platform/intel/iosf_mbi.c | 4 +- arch/x86/xen/p2m.c | 4 +- drivers/acpi/battery.c | 16 +- drivers/acpi/sbs.c | 23 +-- drivers/android/binder.c | 4 +- drivers/base/core.c | 13 +- drivers/base/devres.c | 8 +- drivers/base/module.c | 4 + drivers/block/rbd.c | 35 ++-- drivers/bluetooth/btusb.c | 4 + drivers/char/hw_random/amd-rng.c | 4 +- drivers/char/tpm/eventlog/common.c | 2 + drivers/clk/davinci/da8xx-cfgchip.c | 4 +- drivers/clocksource/sh_cmt.c | 13 +- drivers/edac/Makefile | 10 +- drivers/edac/skx_base.c | 51 +++++- drivers/edac/skx_common.c | 146 ++++++++++++----- drivers/edac/skx_common.h | 19 ++- drivers/firmware/turris-mox-rwtm.c | 18 +-- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 7 +- drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 3 +- drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c | 5 +- drivers/gpu/drm/drm_client_modeset.c | 5 + drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 +- drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 + drivers/gpu/drm/gma500/psb_intel_lvds.c | 3 + drivers/gpu/drm/i915/gem/i915_gem_mman.c | 47 +++++- drivers/gpu/drm/mgag200/mgag200_i2c.c | 2 +- drivers/gpu/drm/nouveau/nouveau_prime.c | 3 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 1 + drivers/gpu/drm/qxl/qxl_display.c | 3 + drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | 2 +- drivers/hid/wacom_wac.c | 3 +- drivers/hwmon/adt7475.c | 2 +- drivers/hwmon/max6697.c | 5 +- drivers/i2c/i2c-smbus.c | 69 ++++++-- drivers/infiniband/core/device.c | 6 +- drivers/infiniband/core/iwcm.c | 11 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 6 +- drivers/infiniband/hw/mlx4/alias_GUID.c | 2 +- drivers/infiniband/hw/mlx4/mad.c | 2 +- drivers/infiniband/sw/rxe/rxe_req.c | 7 +- drivers/input/keyboard/qt1050.c | 7 +- drivers/input/mouse/elan_i2c_core.c | 2 + drivers/irqchip/irq-imx-irqsteer.c | 40 ++++- drivers/irqchip/irq-mbigen.c | 20 ++- drivers/isdn/hardware/mISDN/hfcmulti.c | 7 +- drivers/leds/led-triggers.c | 2 +- drivers/leds/leds-ss4200.c | 7 +- drivers/macintosh/therm_windtunnel.c | 2 +- drivers/md/raid5.c | 20 ++- drivers/media/pci/saa7134/saa7134-dvb.c | 8 +- drivers/media/platform/qcom/venus/vdec.c | 1 + drivers/media/platform/vsp1/vsp1_histo.c | 20 +-- drivers/media/platform/vsp1/vsp1_pipe.h | 2 +- drivers/media/platform/vsp1/vsp1_rpf.c | 8 +- drivers/media/rc/imon.c | 5 +- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++- drivers/media/usb/uvc/uvc_ctrl.c | 90 +++++++---- drivers/media/usb/uvc/uvc_video.c | 37 ++++- drivers/media/usb/uvc/uvcvideo.h | 5 + drivers/mfd/omap-usb-tll.c | 3 +- drivers/mtd/tests/Makefile | 34 ++-- drivers/mtd/tests/mtd_test.c | 9 ++ drivers/mtd/ubi/eba.c | 3 +- drivers/net/bonding/bond_main.c | 7 +- drivers/net/ethernet/brocade/bna/bna_types.h | 2 +- drivers/net/ethernet/brocade/bna/bnad.c | 11 +- drivers/net/ethernet/freescale/fec_main.c | 52 ++++-- drivers/net/ethernet/freescale/fec_ptp.c | 3 + .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 7 +- .../net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 -- drivers/net/ethernet/qlogic/qed/qed_l2.c | 23 +-- drivers/net/ethernet/qlogic/qede/qede_filter.c | 47 +++--- drivers/net/netconsole.c | 2 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/sr9700.c | 11 +- .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 18 +-- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 + drivers/net/wireless/virt_wifi.c | 20 ++- drivers/nvme/host/pci.c | 10 +- drivers/parport/daisy.c | 6 +- drivers/parport/ieee1284.c | 4 +- drivers/parport/ieee1284_ops.c | 3 +- drivers/parport/parport_amiga.c | 2 +- drivers/parport/parport_atari.c | 2 +- drivers/parport/parport_cs.c | 6 +- drivers/parport/parport_gsc.c | 15 +- drivers/parport/parport_ip32.c | 25 ++- drivers/parport/parport_mfc3.c | 2 +- drivers/parport/parport_pc.c | 178 +++++++++------------ drivers/parport/parport_sunbpp.c | 2 +- drivers/parport/probe.c | 7 +- drivers/parport/procfs.c | 28 ++-- drivers/parport/share.c | 24 +-- drivers/pci/controller/pci-hyperv.c | 4 +- drivers/pci/controller/pcie-rockchip.c | 12 +- drivers/pci/msi.c | 4 +- drivers/pci/setup-bus.c | 6 +- drivers/pinctrl/core.c | 12 +- drivers/pinctrl/freescale/pinctrl-mxs.c | 4 +- drivers/pinctrl/pinctrl-single.c | 7 +- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 14 +- drivers/platform/chrome/cros_ec_debugfs.c | 1 + drivers/platform/mips/cpu_hwmon.c | 3 + drivers/power/supply/axp288_charger.c | 24 +-- drivers/pwm/pwm-stm32.c | 5 +- drivers/remoteproc/imx_rproc.c | 5 + drivers/rtc/interface.c | 9 +- drivers/rtc/rtc-cmos.c | 10 +- drivers/rtc/rtc-isl1208.c | 11 +- drivers/s390/char/sclp_sd.c | 10 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 38 +++-- drivers/scsi/qla2xxx/qla_bsg.c | 2 +- drivers/scsi/qla2xxx/qla_mid.c | 2 +- drivers/scsi/qla2xxx/qla_nvme.c | 5 +- drivers/scsi/qla2xxx/qla_os.c | 7 +- drivers/scsi/ufs/ufshcd.c | 11 +- drivers/spi/spi-fsl-lpspi.c | 11 +- drivers/tty/serial/serial_core.c | 8 + drivers/usb/core/urb.c | 33 ++-- drivers/usb/gadget/udc/core.c | 10 +- drivers/usb/serial/usb_debug.c | 7 + drivers/usb/usbip/vhci_hcd.c | 9 +- fs/btrfs/free-space-cache.c | 1 + fs/exec.c | 8 +- fs/ext4/mballoc.c | 3 +- fs/ext4/namei.c | 73 +++++++-- fs/ext4/xattr.c | 6 + fs/f2fs/inode.c | 3 + fs/file.c | 1 + fs/hfs/inode.c | 3 + fs/hfsplus/bfind.c | 15 +- fs/hfsplus/extents.c | 9 +- fs/hfsplus/hfsplus_fs.h | 21 +++ fs/jbd2/journal.c | 1 + fs/jfs/jfs_imap.c | 5 +- fs/nilfs2/btnode.c | 25 ++- fs/nilfs2/btree.c | 4 +- fs/nilfs2/segment.c | 7 +- fs/udf/balloc.c | 51 +++--- fs/udf/super.c | 3 +- include/linux/compiler_attributes.h | 1 + include/linux/irq.h | 7 +- include/linux/irqdomain.h | 10 ++ include/linux/msi.h | 2 - include/linux/objagg.h | 1 - include/linux/pci_ids.h | 2 + include/linux/platform_data/x86/soc.h | 65 ++++++++ include/linux/qed/qed_eth_if.h | 21 +-- include/linux/trace_events.h | 1 - include/linux/usb.h | 1 + include/net/netfilter/nf_tables.h | 21 ++- include/net/sctp/sctp.h | 4 +- include/net/sctp/structs.h | 8 +- include/trace/events/rpcgss.h | 2 +- include/uapi/linux/netfilter/nf_tables.h | 2 +- include/uapi/linux/zorro_ids.h | 3 + kernel/debug/kdb/kdb_io.c | 6 +- kernel/dma/mapping.c | 2 +- kernel/events/core.c | 2 + kernel/events/internal.h | 2 +- kernel/irq/chip.c | 32 ++-- kernel/irq/irqdesc.c | 1 + kernel/time/ntp.c | 9 +- kernel/time/tick-broadcast.c | 24 +++ kernel/trace/tracing_map.c | 6 +- kernel/watchdog_hld.c | 11 +- lib/decompress_bunzip2.c | 3 +- lib/kobject_uevent.c | 17 +- lib/objagg.c | 18 +-- mm/page-writeback.c | 30 +++- net/bluetooth/l2cap_core.c | 1 + net/core/filter.c | 15 +- net/core/link_watch.c | 4 +- net/ipv4/nexthop.c | 7 +- net/ipv4/route.c | 2 +- net/ipv6/addrconf.c | 3 +- net/ipv6/ndisc.c | 34 ++-- net/iucv/af_iucv.c | 4 +- net/netfilter/ipset/ip_set_list_set.c | 3 + net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 +- net/netfilter/nf_conntrack_netlink.c | 3 +- net/netfilter/nf_tables_api.c | 128 +++------------ net/netfilter/nft_set_hash.c | 8 +- net/netfilter/nft_set_rbtree.c | 6 +- net/packet/af_packet.c | 86 +++++++++- net/sctp/input.c | 48 +++--- net/sctp/proc.c | 10 +- net/sctp/socket.c | 6 +- net/smc/smc_core.c | 32 ++-- net/sunrpc/auth_gss/gss_krb5_keys.c | 2 +- net/sunrpc/clnt.c | 3 +- net/sunrpc/sched.c | 4 +- net/tipc/udp_media.c | 5 +- net/wireless/nl80211.c | 10 +- net/wireless/util.c | 8 +- scripts/gcc-x86_32-has-stack-protector.sh | 2 +- scripts/gcc-x86_64-has-stack-protector.sh | 2 +- security/apparmor/lsm.c | 7 + sound/pci/hda/patch_hdmi.c | 2 + sound/soc/codecs/max98088.c | 10 +- sound/soc/intel/common/soc-intel-quirks.h | 55 +------ sound/usb/helper.c | 16 +- sound/usb/helper.h | 1 - sound/usb/line6/driver.c | 5 + sound/usb/mixer_scarlett_gen2.c | 2 +- sound/usb/quirks.c | 12 +- sound/usb/stream.c | 4 +- tools/lib/bpf/btf_dump.c | 8 +- tools/memory-model/lock.cat | 20 +-- tools/perf/util/sort.c | 2 +- .../testing/selftests/bpf/prog_tests/send_signal.c | 3 +- .../bpf/progs/btf_dump_test_case_multidim.c | 4 +- .../bpf/progs/btf_dump_test_case_syntax.c | 4 +- tools/testing/selftests/bpf/test_sockmap.c | 3 +- .../selftests/net/forwarding/devlink_lib.sh | 2 + .../selftests/sigaltstack/current_stack_pointer.h | 2 +- 255 files changed, 2224 insertions(+), 1257 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/259 EDAC, skx_common: Refactor so that we initialize "dev" in result of adxl decode.
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
[ Upstream commit 29b8e84fbc23cb2b70317b745641ea0569426872 ]
Simplifies the code a little.
Stable-dep-of: 123b15863550 ("EDAC, i10nm: make skx_common.o a separate module")
--- drivers/edac/skx_common.c | 48 +++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 25 deletions(-)
drivers/edac/skx_common.c +23 -25
@@ -100,6 +100,7 @@ void __exit skx_adxl_put(void)static bool skx_adxl_decode (struct decoded_addr *res) { +struct skx_dev *d;int i, len =0 ; if (res->addr >= skx_tohm || (res->addr >= skx_tolm &&
@@ -118,6 +119,24 @@ static bool skx_adxl_decode(struct decoded_addr *res) res->channel = (int )adxl_values[component_indices[INDEX_CHANNEL ]]; res->dimm = (int )adxl_values[component_indices[INDEX_DIMM ]]; +if (res->imc >NUM_IMC -1 ) { +skx_printk (KERN_ERR ,"Bad imc %d\n" , res->imc); +return false; + } + +list_for_each_entry (d, &dev_edac_list, list) { +if (d->imc[0 ].src_id == res->socket) { + res->dev = d; +break ; + } + } + +if (!res->dev) { +skx_printk (KERN_ERR ,"No device for src_id %d imc %d\n" , + res->socket, res->imc); +return false; + } +for (i =0 ; i < adxl_component_count; i++) {if (adxl_values[i] == ~0x0ull )continue ;
@@ -452,24 +471,6 @@ static void skx_unregister_mci(struct skx_imc *imc)edac_mc_free (mci); } -static struct mem_ctl_info *get_mci (int src_id,int lmc) -{ -struct skx_dev *d; - -if (lmc >NUM_IMC -1 ) { -skx_printk (KERN_ERR ,"Bad lmc %d\n" , lmc); -return NULL ; - } - -list_for_each_entry (d, &dev_edac_list, list) { -if (d->imc[0 ].src_id == src_id) -return d->imc[lmc].mci; - } - -skx_printk (KERN_ERR ,"No mci for src_id %d lmc %d\n" , src_id, lmc); -return NULL ; -} -static void skx_mce_output_error (struct mem_ctl_info *mci,const struct mce *m,struct decoded_addr *res)
@@ -580,15 +581,12 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val,if (adxl_component_count) {if (!skx_adxl_decode (&res))return NOTIFY_DONE ; - - mci =get_mci (res.socket, res.imc); - }else { -if (!skx_decode || !skx_decode (&res)) -return NOTIFY_DONE ; - - mci = res.dev->imc[res.imc].mci; + }else if (!skx_decode || !skx_decode (&res)) { +return NOTIFY_DONE ; } + mci = res.dev->imc[res.imc].mci; +if (!mci)return NOTIFY_DONE ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/259 EDAC, skx: Retrieve and print retry_rd_err_log registers
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <[email protected]>
[ Upstream commit e80634a75aba90e7485cd1fdb463fcac5d45f14d ]
Skylake logs some additional useful information in per-channel registers in addition the the architectural status/addr/misc logged in the machine check bank.
Pick up this information and add it to the EDAC log:
retry_rd_err_[five 32-bit register values]
Sorry, no definitions for these registers. OEMs and DIMM vendors will be able to use them to isolate which cells in the DIMM are causing problems.
correrrcnt[per rank corrected error counts]
Note that if additional errors are logged while these registers are being read, you may see a jumble of values some from earlier errors, others from later errors (since the registers report the most recent logged error). The correrrcnt registers provide error counts per possible rank. If these counts only change by one since the previous error logged for this channel, then it is safe to assume that the registers logged provide a coherent view of one error.
With this change EDAC logs look like this:
EDAC MC4: 1 CE memory read error on CPU_SrcID#2_MC#0_Chan#1_DIMM#0 (channel:1 slot:0 page:0x8f26018 offset:0x0 grain:32 syndrome:0x0 - err_code:0x0101:0x0091 socket:2 imc:0 rank:0 bg:0 ba:0 row:0x1f880 col:0x200 retry_rd_err_log[0001a209 00000000 00000001 04800001 0001f880] correrrcnt[0001 0000 0000 0000 0000 0000 0000 0000])
Stable-dep-of: 123b15863550 ("EDAC, i10nm: make skx_common.o a separate module")
--- drivers/edac/skx_base.c | 51 ++++++++++++++++++++++++++++++++++++--- drivers/edac/skx_common.c | 12 ++++++--- drivers/edac/skx_common.h | 4 ++- 3 files changed, 60 insertions(+), 7 deletions(-)
drivers/edac/skx_base.c +48 -3
@@ -46,7 +46,8 @@ static struct skx_dev *get_skx_dev(struct pci_bus *bus, u8 idx) }enum munittype { -CHAN0 ,CHAN1 ,CHAN2 ,SAD_ALL ,UTIL_ALL ,SAD +CHAN0 ,CHAN1 ,CHAN2 ,SAD_ALL ,UTIL_ALL ,SAD , +ERRCHAN0 ,ERRCHAN1 ,ERRCHAN2 , };struct munit {
@@ -68,6 +69,9 @@ static const struct munit skx_all_munits[] = { { 0x2040, { PCI_DEVFN(10, 0), PCI_DEVFN(12, 0) }, 2, 2, CHAN0 }, { 0x2044, { PCI_DEVFN(10, 4), PCI_DEVFN(12, 4) }, 2, 2, CHAN1 }, { 0x2048, { PCI_DEVFN(11, 0), PCI_DEVFN(13, 0) }, 2, 2, CHAN2 }, + { 0x2043, { PCI_DEVFN(10, 3), PCI_DEVFN(12, 3) }, 2, 2, ERRCHAN0 }, + { 0x2047, { PCI_DEVFN(10, 7), PCI_DEVFN(12, 7) }, 2, 2, ERRCHAN1 }, + { 0x204b, { PCI_DEVFN(11, 3), PCI_DEVFN(13, 3) }, 2, 2, ERRCHAN2 }, { 0x208e, { }, 1, 0, SAD }, { } };
@@ -104,10 +108,18 @@ static int get_all_munits(const struct munit *m) }switch (m->mtype) { -case CHAN0 :case CHAN1 :case CHAN2 : +case CHAN0 : +case CHAN1 : +case CHAN2 :pci_dev_get (pdev); d->imc[i].chan[m->mtype].cdev = pdev;break ; +case ERRCHAN0 : +case ERRCHAN1 : +case ERRCHAN2 : +pci_dev_get (pdev); + d->imc[i].chan[m->mtype -ERRCHAN0 ].edev = pdev; +break ;case SAD_ALL :pci_dev_get (pdev); d->sad_all = pdev;
@@ -212,6 +224,39 @@ static int skx_get_dimm_config(struct mem_ctl_info *mci)#define SKX_ILV_REMOTE (tgt) (((tgt) & 8) == 0)#define SKX_ILV_TARGET (tgt) ((tgt) & 7) +static void skx_show_retry_rd_err_log (struct decoded_addr *res, +char *msg,int len) +{ +u32 log0, log1, log2, log3, log4; +u32 corr0, corr1, corr2, corr3; +struct pci_dev *edev; +int n; + + edev = res->dev->imc[res->imc].chan[res->channel].edev; + +pci_read_config_dword (edev,0x154 , &log0); +pci_read_config_dword (edev,0x148 , &log1); +pci_read_config_dword (edev,0x150 , &log2); +pci_read_config_dword (edev,0x15c , &log3); +pci_read_config_dword (edev,0x114 , &log4); + + n =snprintf (msg, len," retry_rd_err_log[%.8x %.8x %.8x %.8x %.8x]" , + log0, log1, log2, log3, log4); + +pci_read_config_dword (edev,0x104 , &corr0); +pci_read_config_dword (edev,0x108 , &corr1); +pci_read_config_dword (edev,0x10c , &corr2); +pci_read_config_dword (edev,0x110 , &corr3); + +if (len - n >0 ) +snprintf (msg + n, len - n, +" correrrcnt[%.4x %.4x %.4x %.4x %.4x %.4x %.4x %.4x]" , + corr0 &0xffff , corr0 >>16 , + corr1 &0xffff , corr1 >>16 , + corr2 &0xffff , corr2 >>16 , + corr3 &0xffff , corr3 >>16 ); +} +static bool skx_sad_decode (struct decoded_addr *res) {struct skx_dev *d =list_first_entry (skx_edac_list,typeof (*d), list);
@@ -658,7 +703,7 @@ static int __init skx_init(void) } } -skx_set_decode (skx_decode); +skx_set_decode (skx_decode, skx_show_retry_rd_err_log);if (nvdimm_count &&skx_adxl_get () == -ENODEV )skx_printk (KERN_NOTICE ,"Only decoding DDR4 address!\n" );
drivers/edac/skx_common.c +9 -3
@@ -37,6 +37,7 @@ static char *adxl_msg;static char skx_msg[MSG_SIZE ];static skx_decode_f skx_decode; +static skx_show_retry_log_f skx_show_retry_rd_err_log;static u64 skx_tolm, skx_tohm;static LIST_HEAD (dev_edac_list);
@@ -150,9 +151,10 @@ static bool skx_adxl_decode(struct decoded_addr *res)return true; } -void skx_set_decode (skx_decode_f decode) +void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log) { skx_decode = decode; + skx_show_retry_rd_err_log = show_retry_log; }int skx_get_src_id (struct skx_dev *d,int off,u8 *id)
@@ -481,6 +483,7 @@ static void skx_mce_output_error(struct mem_ctl_info *mci,bool overflow =GET_BITFIELD (m->status,62 ,62 );bool uncorrected_error =GET_BITFIELD (m->status,61 ,61 );bool recoverable; +int len;u32 core_err_cnt =GET_BITFIELD (m->status,38 ,52 );u32 mscod =GET_BITFIELD (m->status,16 ,31 );u32 errcode =GET_BITFIELD (m->status,0 ,15 );
@@ -537,12 +540,12 @@ static void skx_mce_output_error(struct mem_ctl_info *mci, } }if (adxl_component_count) { -snprintf (skx_msg,MSG_SIZE ,"%s%s err_code:0x%04x:0x%04x %s" , + len =snprintf (skx_msg,MSG_SIZE ,"%s%s err_code:0x%04x:0x%04x %s" , overflow ?" OVERFLOW" :"" , (uncorrected_error && recoverable) ?" recoverable" :"" , mscod, errcode, adxl_msg); }else { - snprintf(skx_msg, MSG_SIZE, + len = snprintf(skx_msg, MSG_SIZE, "%s%s err_code:0x%04x:0x%04x socket:%d imc:%d rank:%d bg:%d ba:%d row:0x%x col:0x%x", overflow ? " OVERFLOW" : "", (uncorrected_error && recoverable) ? " recoverable" : "",
@@ -551,6 +554,9 @@ static void skx_mce_output_error(struct mem_ctl_info *mci, res->bank_group, res->bank_address, res->row, res->column); } +if (skx_show_retry_rd_err_log) +skx_show_retry_rd_err_log (res, skx_msg + len,MSG_SIZE - len); +edac_dbg (0 ,"%s\n" , skx_msg);/* Call the helper to output message */
drivers/edac/skx_common.h +3 -1
@@ -64,6 +64,7 @@ struct skx_dev {u8 src_id, node_id;struct skx_channel {struct pci_dev *cdev; +struct pci_dev *edev;struct skx_dimm {u8 close_pg;u8 bank_xor_enable;
@@ -113,10 +114,11 @@ struct decoded_addr {typedef int (*get_dimm_config_f )(struct mem_ctl_info *mci);typedef bool (*skx_decode_f )(struct decoded_addr *res); +typedef void (*skx_show_retry_log_f )(struct decoded_addr *res,char *msg,int len);int __init skx_adxl_get (void ); void __exit skx_adxl_put(void); -void skx_set_decode (skx_decode_f decode); +void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log);int skx_get_src_id (struct skx_dev *d,int off,u8 *id);int skx_get_node_id (struct skx_dev *d,u8 *id);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/259 EDAC/skx_common: Add new ADXL components for 2-level memory
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiuxu Zhuo <[email protected]>
[ Upstream commit 2f4348e5a86198704368a699a7c4cdeb21d569f5 ]
Some Intel servers may configure memory in 2 levels, using fast "near" memory (e.g. DDR) as a cache for larger, slower, "far" memory (e.g. 3D X-point).
In these configurations the BIOS ADXL address translation for an address in a 2-level memory range will provide details of both the "near" and far components.
Current exported ADXL components are only for 1-level memory system or for 2nd level memory of 2-level memory system. So add new ADXL components for 1st level memory of 2-level memory system to fully support 2-level memory system and the detection of memory error source(1st level memory or 2nd level memory).
Stable-dep-of: 123b15863550 ("EDAC, i10nm: make skx_common.o a separate module")
--- drivers/edac/skx_common.c | 67 ++++++++++++++++++++++++++++++++------- drivers/edac/skx_common.h | 11 +++++++ 2 files changed, 67 insertions(+), 11 deletions(-)
drivers/edac/skx_common.c +56 -11
@@ -23,10 +23,13 @@#include "skx_common.h" static const char *const component_names[] = { - [INDEX_SOCKET ] ="ProcessorSocketId" , - [INDEX_MEMCTRL ] ="MemoryControllerId" , - [INDEX_CHANNEL ] ="ChannelId" , - [INDEX_DIMM ] ="DimmSlotId" , + [INDEX_SOCKET ] ="ProcessorSocketId" , + [INDEX_MEMCTRL ] ="MemoryControllerId" , + [INDEX_CHANNEL ] ="ChannelId" , + [INDEX_DIMM ] ="DimmSlotId" , + [INDEX_NM_MEMCTRL ] ="NmMemoryControllerId" , + [INDEX_NM_CHANNEL ] ="NmChannelId" , + [INDEX_NM_DIMM ] ="NmDimmSlotId" , };static int component_indices[ARRAY_SIZE (component_names)];
@@ -34,12 +37,14 @@ static int adxl_component_count;static const char *const *adxl_component_names;static u64 *adxl_values;static char *adxl_msg; +static unsigned long adxl_nm_bitmap;static char skx_msg[MSG_SIZE ];static skx_decode_f skx_decode;static skx_show_retry_log_f skx_show_retry_rd_err_log;static u64 skx_tolm, skx_tohm;static LIST_HEAD (dev_edac_list); +static bool skx_mem_cfg_2lm;int __init skx_adxl_get (void ) {
@@ -56,14 +61,25 @@ int __init skx_adxl_get(void)for (j =0 ; names[j]; j++) {if (!strcmp (component_names[i], names[j])) { component_indices[i] = j; + +if (i >=INDEX_NM_FIRST ) + adxl_nm_bitmap |=1 << i; +break ; } } -if (!names[j]) +if (!names[j] && i <INDEX_NM_FIRST ) goto err; } +if (skx_mem_cfg_2lm) { +if (!adxl_nm_bitmap) +skx_printk (KERN_NOTICE ,"Not enough ADXL components for 2-level memory.\n" ); +else +edac_dbg (2 ,"adxl_nm_bitmap: 0x%lx\n" , adxl_nm_bitmap); + } + adxl_component_names = names;while (*names++) adxl_component_count++;
@@ -99,7 +115,7 @@ void __exit skx_adxl_put(void)kfree (adxl_msg); } -static bool skx_adxl_decode (struct decoded_addr *res) +static bool skx_adxl_decode (struct decoded_addr *res,bool error_in_1st_level_mem) {struct skx_dev *d;int i, len =0 ;
@@ -116,11 +132,20 @@ static bool skx_adxl_decode(struct decoded_addr *res) } res->socket = (int )adxl_values[component_indices[INDEX_SOCKET ]]; - res->imc = (int )adxl_values[component_indices[INDEX_MEMCTRL ]]; - res->channel = (int )adxl_values[component_indices[INDEX_CHANNEL ]]; - res->dimm = (int )adxl_values[component_indices[INDEX_DIMM ]]; +if (error_in_1st_level_mem) { + res->imc = (adxl_nm_bitmap &BIT_NM_MEMCTRL ) ? + (int )adxl_values[component_indices[INDEX_NM_MEMCTRL ]] :-1 ; + res->channel = (adxl_nm_bitmap &BIT_NM_CHANNEL ) ? + (int )adxl_values[component_indices[INDEX_NM_CHANNEL ]] :-1 ; + res->dimm = (adxl_nm_bitmap &BIT_NM_DIMM ) ? + (int )adxl_values[component_indices[INDEX_NM_DIMM ]] :-1 ; + }else { + res->imc = (int )adxl_values[component_indices[INDEX_MEMCTRL ]]; + res->channel = (int )adxl_values[component_indices[INDEX_CHANNEL ]]; + res->dimm = (int )adxl_values[component_indices[INDEX_DIMM ]]; + } -if (res->imc >NUM_IMC -1 ) { +if (res->imc >NUM_IMC -1 || res->imc <0 ) {skx_printk (KERN_ERR ,"Bad imc %d\n" , res->imc);return false; }
@@ -151,6 +176,11 @@ static bool skx_adxl_decode(struct decoded_addr *res)return true; } +void skx_set_mem_cfg (bool mem_cfg_2lm) +{ + skx_mem_cfg_2lm = mem_cfg_2lm; +} +void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log) { skx_decode = decode;
@@ -566,6 +596,21 @@ static void skx_mce_output_error(struct mem_ctl_info *mci, optype, skx_msg); } +static bool skx_error_in_1st_level_mem (const struct mce *m) +{ +u32 errcode; + +if (!skx_mem_cfg_2lm) +return false; + + errcode =GET_BITFIELD (m->status,0 ,15 ); + +if ((errcode &0xef80 ) !=0x280 ) +return false; + +return true; +} +int skx_mce_check_error (struct notifier_block *nb,unsigned long val,void *data) {
@@ -585,7 +630,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val, res.addr = mce->addr;if (adxl_component_count) { -if (!skx_adxl_decode (&res)) +if (!skx_adxl_decode (&res,skx_error_in_1st_level_mem (mce)))return NOTIFY_DONE ; }else if (!skx_decode || !skx_decode (&res)) {return NOTIFY_DONE ;
drivers/edac/skx_common.h +11 -0
@@ -9,6 +9,8 @@#ifndef _SKX_COMM_EDAC_H#define _SKX_COMM_EDAC_H +#include <linux/bits.h> +#define MSG_SIZE 1024/*
@@ -90,9 +92,17 @@ enum { INDEX_MEMCTRL,INDEX_CHANNEL ,INDEX_DIMM , +INDEX_NM_FIRST , +INDEX_NM_MEMCTRL =INDEX_NM_FIRST , +INDEX_NM_CHANNEL , +INDEX_NM_DIMM ,INDEX_MAX }; +#define BIT_NM_MEMCTRL BIT_ULL(INDEX_NM_MEMCTRL) +#define BIT_NM_CHANNEL BIT_ULL(INDEX_NM_CHANNEL) +#define BIT_NM_DIMM BIT_ULL(INDEX_NM_DIMM) +struct decoded_addr {struct skx_dev *dev;u64 addr;
@@ -119,6 +129,7 @@ typedef void (*skx_show_retry_log_f)(struct decoded_addr *res, char *msg, int leint __init skx_adxl_get (void ); void __exit skx_adxl_put(void);void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log); +void skx_set_mem_cfg (bool mem_cfg_2lm);int skx_get_src_id (struct skx_dev *d,int off,u8 *id);int skx_get_node_id (struct skx_dev *d,u8 *id);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/259 EDAC, i10nm: make skx_common.o a separate module
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 123b158635505c89ed0d3ef45c5845ff9030a466 ]
Commit 598afa050403 ("kbuild: warn objects shared among multiple modules") was added to track down cases where the same object is linked into multiple modules. This can cause serious problems if some modules are builtin while others are not.
That test triggers this warning:
scripts/Makefile.build:236: drivers/edac/Makefile: skx_common.o is added to multiple modules: i10nm_edac skx_edac
Make this a separate module instead.
[Tony: Added more background details to commit message]
--- drivers/edac/Makefile | 10 ++++++---- drivers/edac/skx_common.c | 21 +++++++++++++++++++-- drivers/edac/skx_common.h | 4 ++-- 3 files changed, 27 insertions(+), 8 deletions(-)
drivers/edac/Makefile +6 -4
@@ -57,11 +57,13 @@ obj-$(CONFIG_EDAC_MPC85XX) += mpc85xx_edac_mod.o layerscape_edac_mod-y := fsl_ddr_edac.o layerscape_edac.o obj-$(CONFIG_EDAC_LAYERSCAPE) += layerscape_edac_mod.o -skx_edac-y := skx_common.o skx_base.o -obj-$(CONFIG_EDAC_SKX) += skx_edac.o +skx_edac_common-y := skx_common.o -i10nm_edac-y := skx_common.o i10nm_base.o -obj-$(CONFIG_EDAC_I10NM) += i10nm_edac.o +skx_edac-y := skx_base.o +obj-$(CONFIG_EDAC_SKX) += skx_edac.o skx_edac_common.o + +i10nm_edac-y := i10nm_base.o +obj-$(CONFIG_EDAC_I10NM) += i10nm_edac.o skx_edac_common.o obj-$(CONFIG_EDAC_MV64X60) += mv64x60_edac.o obj-$(CONFIG_EDAC_CELL) += cell_edac.o
drivers/edac/skx_common.c +19 -2
@@ -46,7 +46,7 @@ static u64 skx_tolm, skx_tohm;static LIST_HEAD (dev_edac_list);static bool skx_mem_cfg_2lm; -int __init skx_adxl_get (void ) +int skx_adxl_get (void ) {const char *const *names;int i, j;
@@ -108,12 +108,14 @@ int __init skx_adxl_get(void)return -ENODEV ; } +EXPORT_SYMBOL_GPL (skx_adxl_get); -void __exit skx_adxl_put(void) +void skx_adxl_put (void ) {kfree (adxl_values);kfree (adxl_msg); } +EXPORT_SYMBOL_GPL (skx_adxl_put);static bool skx_adxl_decode (struct decoded_addr *res,bool error_in_1st_level_mem) {
@@ -180,12 +182,14 @@ void skx_set_mem_cfg(bool mem_cfg_2lm) { skx_mem_cfg_2lm = mem_cfg_2lm; } +EXPORT_SYMBOL_GPL (skx_set_mem_cfg);void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log) { skx_decode = decode; skx_show_retry_rd_err_log = show_retry_log; } +EXPORT_SYMBOL_GPL (skx_set_decode);int skx_get_src_id (struct skx_dev *d,int off,u8 *id) {
@@ -199,6 +203,7 @@ int skx_get_src_id(struct skx_dev *d, int off, u8 *id) *id =GET_BITFIELD (reg,12 ,14 );return 0 ; } +EXPORT_SYMBOL_GPL (skx_get_src_id);int skx_get_node_id (struct skx_dev *d,u8 *id) {
@@ -212,6 +217,7 @@ int skx_get_node_id(struct skx_dev *d, u8 *id) *id =GET_BITFIELD (reg,0 ,2 );return 0 ; } +EXPORT_SYMBOL_GPL (skx_get_node_id);static int get_width (u32 mtr) {
@@ -278,6 +284,7 @@ int skx_get_all_bus_mappings(unsigned int did, int off, enum type type, *list = &dev_edac_list;return ndev; } +EXPORT_SYMBOL_GPL (skx_get_all_bus_mappings);int skx_get_hi_lo (unsigned int did,int off[],u64 *tolm,u64 *tohm) {
@@ -317,6 +324,7 @@ int skx_get_hi_lo(unsigned int did, int off[], u64 *tolm, u64 *tohm)pci_dev_put (pdev);return -ENODEV ; } +EXPORT_SYMBOL_GPL (skx_get_hi_lo);static int skx_get_dimm_attr (u32 reg,int lobit,int hibit,int add,int minval,int maxval,const char *name)
@@ -370,6 +378,7 @@ int skx_get_dimm_info(u32 mtr, u32 mcmtr, u32 amap, struct dimm_info *dimm,return 1 ; } +EXPORT_SYMBOL_GPL (skx_get_dimm_info);int skx_get_nvdimm_info (struct dimm_info *dimm,struct skx_imc *imc,int chan,int dimmno,const char *mod_str)
@@ -418,6 +427,7 @@ int skx_get_nvdimm_info(struct dimm_info *dimm, struct skx_imc *imc,return (size ==0 || size == ~0ull ) ?0 :1 ; } +EXPORT_SYMBOL_GPL (skx_get_nvdimm_info); int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev, const char *ctl_name, const char *mod_str,
@@ -485,6 +495,7 @@ int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev, imc->mci =NULL ;return rc; } +EXPORT_SYMBOL_GPL (skx_register_mci);static void skx_unregister_mci (struct skx_imc *imc) {
@@ -663,6 +674,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val,return NOTIFY_DONE ; } +EXPORT_SYMBOL_GPL (skx_mce_check_error);void skx_remove (void ) {
@@ -698,3 +710,8 @@ void skx_remove(void)kfree (d); } } +EXPORT_SYMBOL_GPL (skx_remove); + +MODULE_LICENSE ("GPL v2" ); +MODULE_AUTHOR ("Tony Luck" ); +MODULE_DESCRIPTION ("MC Driver for Intel server processors" );
drivers/edac/skx_common.h +2 -2
@@ -126,8 +126,8 @@ typedef int (*get_dimm_config_f)(struct mem_ctl_info *mci);typedef bool (*skx_decode_f )(struct decoded_addr *res);typedef void (*skx_show_retry_log_f )(struct decoded_addr *res,char *msg,int len); -int __init skx_adxl_get (void ); -void __exit skx_adxl_put(void); +int skx_adxl_get (void ); +void skx_adxl_put (void );void skx_set_decode (skx_decode_f decode,skx_show_retry_log_f show_retry_log);void skx_set_mem_cfg (bool mem_cfg_2lm);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/259 platform/chrome: cros_ec_debugfs: fix wrong EC message version
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit c2a28647bbb4e0894e8824362410f72b06ac57a4 ]
ec_read_version_supported() uses ec_params_get_cmd_versions_v1 but it wrongly uses message version 0.
Fix it.
--- drivers/platform/chrome/cros_ec_debugfs.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/chrome/cros_ec_debugfs.c +1 -0
@@ -308,6 +308,7 @@ static int ec_read_version_supported(struct cros_ec_dev *ec)if (!msg)return 0 ; + msg->version =1 ; msg->command =EC_CMD_GET_CMD_VERSIONS + ec->cmd_offset; msg->outsize =sizeof (*params); msg->insize =sizeof (*response);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/259 hfsplus: fix to avoid false alarm of circular locking
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit be4edd1642ee205ed7bbf66edc0453b1be1fb8d7 ]
Syzbot report potential ABBA deadlock as below:
loop0: detected capacity change from 0 to 1024
======================================================
WARNING: possible circular locking dependency detected
6.9.0-syzkaller-10323-g8f6a15f095a6 #0 Not tainted
------------------------------------------------------
syz-executor171/5344 is trying to acquire lock:ffff88807cb980b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595
but task is already holding lock:ffff88807a930108 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x2da/0xb50 fs/hfsplus/extents.c:576
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hfsplus_file_extend+0x21b/0x1b70 fs/hfsplus/extents.c:457
hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358
hfsplus_rename_cat+0x1d0/0x1050 fs/hfsplus/catalog.c:456
hfsplus_rename+0x12e/0x1c0 fs/hfsplus/dir.c:552
vfs_rename+0xbdb/0xf00 fs/namei.c:4887
do_renameat2+0xd94/0x13f0 fs/namei.c:5044
__do_sys_rename fs/namei.c:5091 [inline]
__se_sys_rename fs/namei.c:5089 [inline]
__x64_sys_rename+0x86/0xa0 fs/namei.c:5089
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f-> #0 (&tree->tree_lock){+.+.}-{3:3}:
check_prev_add kernel/locking/lockdep.c:3134 [inline]
check_prevs_add kernel/locking/lockdep.c:3253 [inline]
validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869
__lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754
__mutex_lock_common kernel/locking/mutex.c:608 [inline]
__mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595
hfsplus_setattr+0x1ce/0x280 fs/hfsplus/inode.c:265
notify_change+0xb9d/0xe70 fs/attr.c:497
do_truncate+0x220/0x310 fs/open.c:65
handle_truncate fs/namei.c:3308 [inline]
do_open fs/namei.c:3654 [inline]
path_openat+0x2a3d/0x3280 fs/namei.c:3807
do_filp_open+0x235/0x490 fs/namei.c:3834
do_sys_openat2+0x13e/0x1d0 fs/open.c:1406
do_sys_open fs/open.c:1421 [inline]
__do_sys_creat fs/open.c:1497 [inline]
__se_sys_creat fs/open.c:1491 [inline]
__x64_sys_creat+0x123/0x170 fs/open.c:1491
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7fother info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&HFSPLUS_I(inode)->extents_lock);
lock(&tree->tree_lock);
lock(&HFSPLUS_I(inode)->extents_lock); lock(&tree->tree_lock);
This is a false alarm as tree_lock mutex are different, one is from sbi->cat_tree, and another is from sbi->ext_tree:
Thread A Thread B
- hfsplus_rename
- hfsplus_rename_cat
- hfs_find_init
- mutext_lock(cat_tree->tree_lock)
- hfsplus_setattr
- hfsplus_file_truncate
- mutex_lock(hip->extents_lock)
- hfs_find_init
- mutext_lock(ext_tree->tree_lock)
- hfs_bmap_reserve
- hfsplus_file_extend
- mutex_lock(hip->extents_lock)
So, let's call mutex_lock_nested for tree_lock mutex lock, and pass correct lock class for it.
--- fs/hfsplus/bfind.c | 15 ++------------- fs/hfsplus/extents.c | 9 ++++++--- fs/hfsplus/hfsplus_fs.h | 21 +++++++++++++++++++++ 3 files changed, 29 insertions(+), 16 deletions(-)
fs/hfsplus/bfind.c +2 -13
@@ -25,19 +25,8 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) fd->key = ptr + tree->max_key_len +2 ;hfs_dbg (BNODE_REFS ,"find_init: %d (%p)\n" , tree->cnid,__builtin_return_address (0 )); -switch (tree->cnid) { -case HFSPLUS_CAT_CNID : -mutex_lock_nested (&tree->tree_lock,CATALOG_BTREE_MUTEX ); -break ; -case HFSPLUS_EXT_CNID : -mutex_lock_nested (&tree->tree_lock,EXTENTS_BTREE_MUTEX ); -break ; -case HFSPLUS_ATTR_CNID : -mutex_lock_nested (&tree->tree_lock,ATTR_BTREE_MUTEX ); -break ; -default : -BUG (); - } +mutex_lock_nested (&tree->tree_lock, +hfsplus_btree_lock_class (tree));return 0 ; }
fs/hfsplus/extents.c +6 -3
@@ -430,7 +430,8 @@ int hfsplus_free_fork(struct super_block *sb, u32 cnid,hfsplus_free_extents (sb, ext_entry, total_blocks - start, total_blocks); total_blocks = start; -mutex_lock (&fd.tree->tree_lock); +mutex_lock_nested (&fd.tree->tree_lock, +hfsplus_btree_lock_class (fd.tree)); }while (total_blocks > blocks);hfs_find_exit (&fd);
@@ -592,7 +593,8 @@ void hfsplus_file_truncate(struct inode *inode) alloc_cnt, alloc_cnt - blk_cnt);hfsplus_dump_extent (hip->first_extents); hip->first_blocks = blk_cnt; -mutex_lock (&fd.tree->tree_lock); +mutex_lock_nested (&fd.tree->tree_lock, +hfsplus_btree_lock_class (fd.tree));break ; } res =__hfsplus_ext_cache_extent (&fd, inode, alloc_cnt);
@@ -606,7 +608,8 @@ void hfsplus_file_truncate(struct inode *inode)hfsplus_free_extents (sb, hip->cached_extents, alloc_cnt - start, alloc_cnt - blk_cnt);hfsplus_dump_extent (hip->cached_extents); -mutex_lock (&fd.tree->tree_lock); +mutex_lock_nested (&fd.tree->tree_lock, +hfsplus_btree_lock_class (fd.tree));if (blk_cnt > start) { hip->extent_state |=HFSPLUS_EXT_DIRTY ;break ;
fs/hfsplus/hfsplus_fs.h +21 -0
@@ -539,6 +539,27 @@ int hfsplus_read_wrapper(struct super_block *sb);#define __hfsp_mt2ut (t) (be32_to_cpu(t) - 2082844800U)#define __hfsp_ut2mt (t) (cpu_to_be32(t + 2082844800U)) +static inline enum hfsplus_btree_mutex_classes +hfsplus_btree_lock_class (struct hfs_btree *tree) +{ +enum hfsplus_btree_mutex_classes class; + +switch (tree->cnid) { +case HFSPLUS_CAT_CNID : + class =CATALOG_BTREE_MUTEX ; +break ; +case HFSPLUS_EXT_CNID : + class =EXTENTS_BTREE_MUTEX ; +break ; +case HFSPLUS_ATTR_CNID : + class =ATTR_BTREE_MUTEX ; +break ; +default : +BUG (); + } +return class; +} +/* compatibility */ #define hfsp_mt2ut (t) (struct timespec){ .tv_sec = __hfsp_mt2ut(t) }#define hfsp_ut2mt (t) __hfsp_ut2mt((t).tv_sec)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/259 x86/of: Return consistent error type from x86_of_pci_irq_enable()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit ec0b4c4d45cf7cf9a6c9626a494a89cb1ae7c645 ]
x86_of_pci_irq_enable() returns PCIBIOS_* code received from pci_read_config_byte() directly and also -EINVAL which are not compatible error types. x86_of_pci_irq_enable() is used as (*pcibios_enable_irq) function which should not return PCIBIOS_* codes.
Convert the PCIBIOS_* return code from pci_read_config_byte() into normal errno using pcibios_err_to_errno().
--- arch/x86/kernel/devicetree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/devicetree.c +1 -1
@@ -91,7 +91,7 @@ static int x86_of_pci_irq_enable(struct pci_dev *dev) ret =pci_read_config_byte (dev,PCI_INTERRUPT_PIN , &pin);if (ret) -return ret; +return pcibios_err_to_errno (ret);if (!pin)return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/259 x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 724852059e97c48557151b3aa4af424614819752 ]
intel_mid_pci_irq_enable() uses pci_read_config_byte() that returns PCIBIOS_* codes. The error handling, however, assumes the codes are normal errnos because it checks for < 0.
intel_mid_pci_irq_enable() also returns the PCIBIOS_* code back to the caller but the function is used as the (*pcibios_enable_irq) function which should return normal errnos.
Convert the error check to plain non-zero check which works for PCIBIOS_* return codes and convert the PCIBIOS_* return code using pcibios_err_to_errno() into normal errno before returning it.
--- arch/x86/pci/intel_mid_pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/pci/intel_mid_pci.c +2 -2
@@ -223,9 +223,9 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)return 0 ; ret =pci_read_config_byte (dev,PCI_INTERRUPT_LINE , &gsi); -if (ret <0 ) { +if (ret) {dev_warn (&dev->dev,"Failed to read interrupt line: %d\n" , ret); -return ret; +return pcibios_err_to_errno (ret); }switch (intel_mid_identify_cpu ()) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/259 x86/pci/xen: Fix PCIBIOS_* return code handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit e9d7b435dfaec58432f4106aaa632bf39f52ce9f ]
xen_pcifront_enable_irq() uses pci_read_config_byte() that returns PCIBIOS_* codes. The error handling, however, assumes the codes are normal errnos because it checks for < 0.
xen_pcifront_enable_irq() also returns the PCIBIOS_* code back to the caller but the function is used as the (*pcibios_enable_irq) function which should return normal errnos.
Convert the error check to plain non-zero check which works for PCIBIOS_* return codes and convert the PCIBIOS_* return code using pcibios_err_to_errno() into normal errno before returning it.
--- arch/x86/pci/xen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/pci/xen.c +2 -2
@@ -37,10 +37,10 @@ static int xen_pcifront_enable_irq(struct pci_dev *dev)u8 gsi; rc =pci_read_config_byte (dev,PCI_INTERRUPT_LINE , &gsi); -if (rc <0 ) { +if (rc) {dev_warn (&dev->dev,"Xen PCI: failed to read interrupt line: %d\n" , rc); -return rc; +return pcibios_err_to_errno (rc); }/* In PV DomU the Xen PCI backend puts the PIRQ in the interrupt line.*/ pirq = gsi;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/259 x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 7821fa101eab529521aa4b724bf708149d70820c ]
iosf_mbi_pci_{read,write}_mdr() use pci_{read,write}_config_dword() that return PCIBIOS_* codes but functions also return -ENODEV which are not compatible error codes. As neither of the functions are related to PCI read/write functions, they should return normal errnos.
Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal errno before returning it.
--- arch/x86/platform/intel/iosf_mbi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/platform/intel/iosf_mbi.c +2 -2
@@ -62,7 +62,7 @@ static int iosf_mbi_pci_read_mdr(u32 mcrx, u32 mcr, u32 *mdr) fail_read:dev_err (&mbi_pdev->dev,"PCI config access failed with %d\n" , result); -return result; +return pcibios_err_to_errno (result); }static int iosf_mbi_pci_write_mdr (u32 mcrx,u32 mcr,u32 mdr)
@@ -91,7 +91,7 @@ static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr) fail_write:dev_err (&mbi_pdev->dev,"PCI config access failed with %d\n" , result); -return result; +return pcibios_err_to_errno (result); }int iosf_mbi_read (u8 port,u8 opcode,u32 offset,u32 *mdr)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/259 hwmon: (adt7475) Fix default duty on fan is disabled
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Tung <[email protected]>
[ Upstream commit 39b24cced70fdc336dbc0070f8b3bde61d8513a8 ]
According to the comments on fan is disabled, we change to manual mode and set the duty cycle to 0.
For setting the duty cycle part, the register is wrong. Fix it.
--- drivers/hwmon/adt7475.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/adt7475.c +1 -1
@@ -1681,7 +1681,7 @@ static void adt7475_read_pwm(struct i2c_client *client, int index) data->pwm[CONTROL ][index] &= ~0xE0 ; data->pwm[CONTROL ][index] |= (7 <<5 ); -i2c_smbus_write_byte_data (client,PWM_CONFIG_REG (index), +i2c_smbus_write_byte_data (client,PWM_REG (index), data->pwm[INPUT ][index]); i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/259 pwm: stm32: Always do lazy disabling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 7346e7a058a2c9aa9ff1cc699c7bf18a402d9f84 ]
When the state changes from enabled to disabled, polarity, duty_cycle and period are not configured in hardware and TIM_CCER_CCxE is just cleared. However if the state changes from one disabled state to another, all parameters are written to hardware because the early exit from stm32_pwm_apply() is only taken if the pwm is currently enabled.
This yields surprises like: Applying
{ .period = 1, .duty_cycle = 0, .enabled = false }succeeds if the pwm is initially on, but fails if it's already off because 1 is a too small period.
Update the check for lazy disable to always exit early if the target state is disabled, no matter what is currently configured.
--- drivers/pwm/pwm-stm32.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/pwm/pwm-stm32.c +3 -2
@@ -451,8 +451,9 @@ static int stm32_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, enabled = pwm->state.enabled; -if (enabled && !state->enabled) { -stm32_pwm_disable (priv, pwm->hwpwm); +if (!state->enabled) { +if (enabled) +stm32_pwm_disable (priv, pwm->hwpwm);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/259 hwmon: (max6697) Fix underflow when writing limit attributes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit cbf7467828cd4ec7ceac7a8b5b5ddb2f69f07b0e ]
Using DIV_ROUND_CLOSEST() on an unbound value can result in underflows. Indeed, module test scripts report:
temp1_max: Suspected underflow: [min=0, read 255000, written -9223372036854775808]temp1_crit: Suspected underflow: [min=0, read 255000, written -9223372036854775808]
Fix by introducing an extra set of clamping.
--- drivers/hwmon/max6697.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/max6697.c +1 -0
@@ -305,6 +305,7 @@ static ssize_t temp_store(struct device *dev,return ret;mutex_lock (&data->update_lock); + temp =clamp_val (temp,-1000000 ,1000000 );/* prevent underflow */ temp =DIV_ROUND_CLOSEST (temp,1000 ) + data->temp_offset; temp =clamp_val (temp,0 , data->type == max6581 ?255 :127 ); data->temp[nr][index] = temp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/259 hwmon: (max6697) Fix swapped temp{1,8} critical alarms
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 1ea3fd1eb9869fcdcbc9c68f9728bfc47b9503f1 ]
The critical alarm bit for the local temperature sensor (temp1) is in bit 7 of register 0x45 (not bit 6), and the critical alarm bit for remote temperature sensor 7 (temp8) is in bit 6 (not bit 7).
This only affects MAX6581 since all other chips supported by this driver do not support those critical alarms.
--- drivers/hwmon/max6697.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/max6697.c +2 -2
@@ -359,14 +359,14 @@ static SENSOR_DEVICE_ATTR_RO(temp6_max_alarm, alarm, 20); static SENSOR_DEVICE_ATTR_RO(temp7_max_alarm, alarm, 21); static SENSOR_DEVICE_ATTR_RO(temp8_max_alarm, alarm, 23); -static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 14); +static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 15); static SENSOR_DEVICE_ATTR_RO(temp2_crit_alarm, alarm, 8); static SENSOR_DEVICE_ATTR_RO(temp3_crit_alarm, alarm, 9); static SENSOR_DEVICE_ATTR_RO(temp4_crit_alarm, alarm, 10); static SENSOR_DEVICE_ATTR_RO(temp5_crit_alarm, alarm, 11); static SENSOR_DEVICE_ATTR_RO(temp6_crit_alarm, alarm, 12); static SENSOR_DEVICE_ATTR_RO(temp7_crit_alarm, alarm, 13); -static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 15); +static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 14); static SENSOR_DEVICE_ATTR_RO(temp2_fault, alarm, 1); static SENSOR_DEVICE_ATTR_RO(temp3_fault, alarm, 2);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/259 arm64: dts: qcom: sdm845: add power-domain to UFS PHY
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit fd39ae8b9bc10419b1e4b849cdbc6755a967ade1 ]
The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add corresponding power-domain the the PHY node.
--- arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/boot/dts/qcom/sdm845.dtsi +2 -0
@@ -1420,6 +1420,8 @@ ufs_mem_phy: phy@1d87000 { clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>, <&gcc GCC_UFS_PHY_PHY_AUX_CLK>; + power-domains = <&gcc UFS_PHY_GDSC>; + resets = <&ufs_mem_hc 0>; reset-names = "ufsphy"; status = "disabled";
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/259 arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 02f838b7f8cdfb7a96b7f08e7f6716f230bdecba ]
Follow the example of other platforms and specify core_clk frequencies in the frequency table in addition to the core_clk_src frequencies. The driver should be setting the leaf frequency instead of some interim clock freq.
--- arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/msm8996.dtsi +1 -1
@@ -1386,7 +1386,7 @@ ufshc: ufshc@624000 { <&gcc GCC_UFS_RX_SYMBOL_0_CLK>; freq-table-hz = <100000000 200000000>, - <0 0>, + <100000000 200000000>, <0 0>, <0 0>, <0 0>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/259 arm64: dts: rockchip: Increase VOP clk rate on RK3328
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 0f2ddb128fa20f8441d903285632f2c69e90fae1 ]
The VOP on RK3328 needs to run at a higher rate in order to produce a proper 3840x2160 signal.
Change to use 300MHz for VIO clk and 400MHz for VOP clk, same rates used by vendor 4.4 kernel.
--- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3328.dtsi +2 -2
@@ -763,8 +763,8 @@ cru: clock-controller@ff440000 { <0>, <24000000>, <24000000>, <24000000>, <15000000>, <15000000>, - <100000000>, <100000000>, - <100000000>, <100000000>, + <300000000>, <100000000>, + <400000000>, <100000000>, <50000000>, <100000000>, <100000000>, <100000000>, <50000000>, <50000000>,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/259 ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <[email protected]>
[ Upstream commit 5694eed98cca5c164ebb5b831b65b4c9eee4b2d5 ]
Add ethernet-phy node so we can drop the deprecated fec phy-reset-gpios property. The reset-assert-us value is taken from the existing logic since the fec driver will add an 1ms assert delay per default if phy-reset-gpios is used and phy-reset-duration is not specified.
Stable-dep-of: edfea889a049 ("ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset")
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +13 -1
@@ -260,7 +260,19 @@ &fec { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_enet>; phy-mode = "rgmii"; - phy-reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + phy-handle = <ðphy>; + + mdio { + #address-cells = <1>; + #size-cells = <0>; + + ethphy: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <1>; + reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + reset-assert-us = <1000>; + }; + }; }; &i2c_intern {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/259 ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit edfea889a049abe80f0d55c0365bf60fbade272f ]
The PHY reset line is connected to both the SoC (GPIO1_25) and the CPLD. We must not use the GPIO1_25 as it will drive against the output buffer of the CPLD. Instead there is another GPIO (GPIO2_01), an input to the CPLD, which will tell the CPLD to assert the PHY reset line.
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +2 -2
@@ -269,7 +269,7 @@ mdio { ethphy: ethernet-phy@1 { compatible = "ethernet-phy-ieee802.3-c22"; reg = <1>; - reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; + reset-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>; reset-assert-us = <1000>; }; };
@@ -512,7 +512,7 @@ MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL 0x1b0b0 MX6QDL_PAD_ENET_MDIO__ENET_MDIO 0x1b0b0 MX6QDL_PAD_ENET_MDC__ENET_MDC 0x1b0b0 MX6QDL_PAD_ENET_REF_CLK__ENET_TX_CLK 0x1b0b0 - MX6QDL_PAD_ENET_CRS_DV__GPIO1_IO25 0x1b0b0 /* RST_GBE0_PHY# */ + MX6QDL_PAD_NANDF_D1__GPIO2_IO01 0x1b0b0 /* RST_GBE0_PHY# */ >; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/259 ARM: dts: imx6qdl-kontron-samx6i: fix board reset
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit b972d6b3b46345023aee56a95df8e2c137aa4ee4 ]
On i.MX6 the board is reset by the watchdog. But in turn to do a complete board reset, we have to assert the WDOG_B output which is routed also to the CPLD which then do a complete power-cycle of the board.
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +1 -0
@@ -813,5 +813,6 @@ &wdog1 { /* CPLD is feeded by watchdog (hardwired) */ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_wdog1>; + fsl,ext-reset-output; status = "okay"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/259 ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <[email protected]>
[ Upstream commit df35c6e9027cf9affe699e632a48082ab1bbba4c ]
The PCIe reset line is active low. Fix it.
--- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +1 -1
@@ -725,7 +725,7 @@ &pcie { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_pcie>; wake-up-gpio = <&gpio6 18 GPIO_ACTIVE_HIGH>; - reset-gpio = <&gpio3 13 GPIO_ACTIVE_HIGH>; + reset-gpio = <&gpio3 13 GPIO_ACTIVE_LOW>; }; /* LCD_BKLT_PWM */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/259 arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
[ Upstream commit aebba1030a5766cdf894ed4ab0cac7aed5aee9c1 ]
Value "emmc_rst" is a group name and should be part of the "groups" property.
This fixes:arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: pinctrl@10211000: emmc-pins-default:mux:function: ['emmc', 'emmc_rst'] is too long
from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt7622-pinctrl.yaml#arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dtb: pinctrl@10211000: emmc-pins-default:mux:function: ['emmc', 'emmc_rst'] is too long
from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt7622-pinctrl.yaml#
--- arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 4 ++-- arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +2 -2
@@ -235,8 +235,8 @@ asm_sel { /* eMMC is shared pin with parallel NAND */ emmc_pins_default: emmc-pins-default { mux { - function = "emmc", "emmc_rst"; - groups = "emmc"; + function = "emmc"; + groups = "emmc", "emmc_rst"; }; /* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",
arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts +2 -2
@@ -198,8 +198,8 @@ &pio { /* eMMC is shared pin with parallel NAND */ emmc_pins_default: emmc-pins-default { mux { - function = "emmc", "emmc_rst"; - groups = "emmc"; + function = "emmc"; + groups = "emmc", "emmc_rst"; }; /* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/259 arm64: dts: amlogic: gx: correct hdmi clocks
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 0602ba0dcd0e76067a0b7543e92b2de3fb231073 ]
The clocks provided to HDMI tx are not consistent between gx and g12:
* gx receives the peripheral clock as 'isfr' while g12 receives it as 'iahb'
* g12 gets the HDMI system clock as 'isfr' but gx does not even get it. It surely needs that clock since the driver is directly poking around the clock controller's registers for that clock.
Align gx SoCs with g12 and provide:
* the HDMI peripheral clock as 'iahb'
* the HDMI system clock as 'isfr'
--- arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 4 ++-- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +2 -2
@@ -326,8 +326,8 @@ &hdmi_tx { <&reset RESET_HDMI_SYSTEM_RESET>, <&reset RESET_HDMI_TX>; reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy"; - clocks = <&clkc CLKID_HDMI_PCLK>, - <&clkc CLKID_CLK81>, + clocks = <&clkc CLKID_HDMI>, + <&clkc CLKID_HDMI_PCLK>, <&clkc CLKID_GCLK_VENCI_INT0>; clock-names = "isfr", "iahb", "venci"; };
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +2 -2
@@ -273,8 +273,8 @@ &hdmi_tx { <&reset RESET_HDMI_SYSTEM_RESET>, <&reset RESET_HDMI_TX>; reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy"; - clocks = <&clkc CLKID_HDMI_PCLK>, - <&clkc CLKID_CLK81>, + clocks = <&clkc CLKID_HDMI>, + <&clkc CLKID_HDMI_PCLK>, <&clkc CLKID_GCLK_VENCI_INT0>; clock-names = "isfr", "iahb", "venci"; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/259 m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eero Tamminen <[email protected]>
[ Upstream commit f70065a9fd988983b2c693631b801f25a615fc04 ]
Avoid freeze on Atari TT / MegaSTe boot with continuous messages of:
unexpected interrupt from 112
Which was due to VBL interrupt being enabled in SCU sys mask, but there being no handler for that any more.
(Bug and fix were first verified on real Atari TT HW by Christian,
this patch later on in Hatari emulator.)
--- arch/m68k/atari/ataints.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
arch/m68k/atari/ataints.c +1 -5
@@ -302,11 +302,7 @@ void __init atari_init_IRQ(void)if (ATARIHW_PRESENT (SCU )) {/* init the SCU if present */ - tt_scu.sys_mask =0x10 ;/* enable VBL (for the cursor) and -* disable HSYNC interrupts (who -* needs them?) MFP and SCC are -* enabled in VME mask -*/ + tt_scu.sys_mask =0x0 ;/* disable all interrupts */ tt_scu.vme_mask =0x60 ;/* enable MFP and SCC ints */ }else {/* If no SCU and no Hades, the HSYNC interrupt needs to be
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/259 x86/xen: Convert comma to semicolon
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 349d271416c61f82b853336509b1d0dc04c1fcbb ]
Replace a comma between expression statements by a semicolon.
--- arch/x86/xen/p2m.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/xen/p2m.c +2 -2
@@ -741,7 +741,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,* immediate unmapping. */ map_ops[i].status = GNTST_general_error; - unmap[0 ].host_addr = map_ops[i].host_addr, + unmap[0 ].host_addr = map_ops[i].host_addr; unmap[0 ].handle = map_ops[i].handle; map_ops[i].handle = ~0 ;if (map_ops[i].flags & GNTMAP_device_map)
@@ -751,7 +751,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,if (kmap_ops) { kmap_ops[i].status = GNTST_general_error; - unmap[1 ].host_addr = kmap_ops[i].host_addr, + unmap[1 ].host_addr = kmap_ops[i].host_addr; unmap[1 ].handle = kmap_ops[i].handle; kmap_ops[i].handle = ~0 ;if (kmap_ops[i].flags & GNTMAP_device_map)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/259 m68k: cmpxchg: Fix return value for default case in __arch_xchg()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <[email protected]>
[ Upstream commit 21b9e722ad28c19c2bc83f18f540b3dbd89bf762 ]
The return value of __invalid_xchg_size() is assigned to tmp instead of the return variable x. Assign it to x instead.
--- arch/m68k/include/asm/cmpxchg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/m68k/include/asm/cmpxchg.h +1 -1
@@ -33,7 +33,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void * ptr, int siz x = tmp;break ;default : - tmp =__invalid_xchg_size (x, ptr, size); + x =__invalid_xchg_size (x, ptr, size);break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/259 firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit 8467cfe821ac3526f7598682ad5f90689fa8cc49 ]
The wait_for_completion_timeout() function returns 0 if timed out, and a positive value if completed. Fix the usage of this function.
--- drivers/firmware/turris-mox-rwtm.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/firmware/turris-mox-rwtm.c +6 -9
@@ -186,9 +186,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm)if (ret <0 )return ret; - ret =wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 ); -if (ret <0 ) -return ret; +if (!wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 )) +return -ETIMEDOUT ; ret =mox_get_status (MBOX_CMD_BOARD_INFO , reply->retval);if (ret == -ENODATA ) {
@@ -222,9 +221,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm)if (ret <0 )return ret; - ret =wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 ); -if (ret <0 ) -return ret; +if (!wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 )) +return -ETIMEDOUT ; ret =mox_get_status (MBOX_CMD_ECDSA_PUB_KEY , reply->retval);if (ret == -ENODATA ) {
@@ -261,9 +259,8 @@ static int check_get_random_support(struct mox_rwtm *rwtm)if (ret <0 )return ret; - ret =wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 ); -if (ret <0 ) -return ret; +if (!wait_for_completion_timeout (&rwtm->cmd_done,HZ /2 )) +return -ETIMEDOUT ;return mox_get_status (MBOX_CMD_GET_RANDOM , rwtm->reply.retval); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/259 firmware: turris-mox-rwtm: Initialize completion before mailbox
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <[email protected]>
[ Upstream commit 49e24c80d3c81c43e2a56101449e1eea32fcf292 ]
Initialize the completion before the mailbox channel is requested.
--- drivers/firmware/turris-mox-rwtm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/firmware/turris-mox-rwtm.c +1 -2
@@ -337,6 +337,7 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev)platform_set_drvdata (pdev, rwtm);mutex_init (&rwtm->busy); +init_completion (&rwtm->cmd_done); rwtm->mbox_client.dev = dev; rwtm->mbox_client.rx_callback = mox_rwtm_rx_callback;
@@ -350,8 +351,6 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev) goto remove_files; } -init_completion (&rwtm->cmd_done); - ret =mox_get_board_info (rwtm);if (ret <0 )dev_warn (dev,"Cannot read board information: %i\n" , ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/259 wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
[ Upstream commit c636fa85feb450ca414a10010ed05361a73c93a6 ]
The band_idx variable in the function wlc_lcnphy_tx_iqlo_cal() will never be set to 1 as BCM4313 is the only device for which the LCN PHY code is used. This is a 2G-only device.
--- .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +9 -9
@@ -2625,7 +2625,6 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi,struct lcnphy_txgains cal_gains, temp_gains;u16 hash; -u8 band_idx;int j;u16 ncorr_override[5 ];u16 syst_coeffs[] = {0x0000 ,0x0000 ,0x0000 ,0x0000 ,0x0000 ,0x0000 ,
@@ -2657,6 +2656,9 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi,u16 *values_to_save;struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy; +if (WARN_ON (CHSPEC_IS5G (pi->radio_chanspec))) +return ; + values_to_save =kmalloc_array (20 ,sizeof (u16),GFP_ATOMIC );if (NULL == values_to_save)return ;
@@ -2720,20 +2722,18 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, hash = (target_gains->gm_gain <<8 ) | (target_gains->pga_gain <<4 ) | (target_gains->pad_gain); - band_idx = (CHSPEC_IS5G (pi->radio_chanspec) ?1 :0 ); - cal_gains = *target_gains;memset (ncorr_override,0 ,sizeof (ncorr_override)); -for (j =0 ; j < iqcal_gainparams_numgains_lcnphy[band_idx]; j++) { -if (hash == tbl_iqcal_gainparams_lcnphy[band_idx][j][0 ]) { +for (j =0 ; j < iqcal_gainparams_numgains_lcnphy[0 ]; j++) { +if (hash == tbl_iqcal_gainparams_lcnphy[0 ][j][0 ]) { cal_gains.gm_gain = - tbl_iqcal_gainparams_lcnphy[band_idx][j][1 ]; + tbl_iqcal_gainparams_lcnphy[0 ][j][1 ]; cal_gains.pga_gain = - tbl_iqcal_gainparams_lcnphy[band_idx][j][2 ]; + tbl_iqcal_gainparams_lcnphy[0 ][j][2 ]; cal_gains.pad_gain = - tbl_iqcal_gainparams_lcnphy[band_idx][j][3 ]; + tbl_iqcal_gainparams_lcnphy[0 ][j][3 ];memcpy (ncorr_override, - &tbl_iqcal_gainparams_lcnphy[band_idx][j][3 ], + &tbl_iqcal_gainparams_lcnphy[0 ][j][3 ],sizeof (ncorr_override));break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/259 net/smc: Allow SMC-D 1MB DMB allocations
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Raspl <[email protected]>
[ Upstream commit 67161779a9ea926fccee8de047ae66cbd3482b91 ]
Commit a3fe3d01bd0d7 ("net/smc: introduce sg-logic for RMBs") introduced a restriction for RMB allocations as used by SMC-R. However, SMC-D does not use scatter-gather lists to back its DMBs, yet it was limited by this restriction, still.
This patch exempts SMC, but limits allocations to the maximum RMB/DMB size respectively.
Stable-dep-of: 3ac14b9dfbd3 ("net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined")
--- net/smc/smc_core.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-)
net/smc/smc_core.c +16 -15
@@ -681,21 +681,30 @@ int smc_conn_create(struct smc_sock *smc, struct smc_init_info *ini)return rc; } -/* convert the RMB size into the compressed notation - minimum 16K. +#define SMCD_DMBE_SIZES 6/* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */ +#define SMCR_RMBE_SIZES 5/* 0 -> 16KB, 1 -> 32KB, .. 5 -> 512KB */ + +/* convert the RMB size into the compressed notation (minimum 16K, see +* SMCD/R_DMBE_SIZES. * In contrast to plain ilog2, this rounds towards the next power of 2, * so the socket application gets at least its desired sndbuf / rcvbuf size. */ -static u8 smc_compress_bufsize (int size) +static u8 smc_compress_bufsize (int size,bool is_smcd,bool is_rmb) { +const unsigned int max_scat =SG_MAX_SINGLE_ALLOC *PAGE_SIZE ;u8 compressed;if (size <=SMC_BUF_MIN_SIZE )return 0 ; - size = (size -1 ) >>14 ; - compressed =ilog2 (size) +1 ; -if (compressed >=SMC_RMBE_SIZES ) - compressed =SMC_RMBE_SIZES -1 ; + size = (size -1 ) >>14 ;/* convert to 16K multiple */ + compressed =min_t (u8,ilog2 (size) +1 , + is_smcd ?SMCD_DMBE_SIZES :SMCR_RMBE_SIZES ); + +if (!is_smcd && is_rmb) +/* RMBs are backed by & limited to max size of scatterlists */ + compressed =min_t (u8, compressed,ilog2 (max_scat >>14 )); +return compressed; }
@@ -796,17 +805,12 @@ static struct smc_buf_desc *smcr_new_buf_create(struct smc_link_group *lgr,return buf_desc; } -#define SMCD_DMBE_SIZES 6/* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */ -static struct smc_buf_desc *smcd_new_buf_create (struct smc_link_group *lgr,bool is_dmb,int bufsize) {struct smc_buf_desc *buf_desc;int rc; -if (smc_compress_bufsize (bufsize) >SMCD_DMBE_SIZES ) -return ERR_PTR (-EAGAIN ); -/* try to alloc a new DMB */ buf_desc =kzalloc (sizeof (*buf_desc),GFP_KERNEL );if (!buf_desc)
@@ -850,9 +854,8 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb)/* use socket send buffer size (w/o overhead) as start value */ sk_buf_size = smc->sk.sk_sndbuf /2 ; -for (bufsize_short =smc_compress_bufsize (sk_buf_size); +for (bufsize_short =smc_compress_bufsize (sk_buf_size, is_smcd, is_rmb); bufsize_short >=0 ; bufsize_short--) { -if (is_rmb) { lock = &lgr->rmbs_lock; buf_list = &lgr->rmbs[bufsize_short];
@@ -861,8 +864,6 @@ static int __smc_buf_create(struct smc_sock *smc, bool is_smcd, bool is_rmb) buf_list = &lgr->sndbufs[bufsize_short]; } bufsize =smc_uncompress_bufsize (bufsize_short); -if ((1 <<get_order (bufsize)) >SG_MAX_SINGLE_ALLOC ) -continue ;/* check for reusable slot in the link group */ buf_desc =smc_buf_get_slot (bufsize_short, lock, buf_list);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/259 net/smc: set rmbs SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangguan Wang <[email protected]>
[ Upstream commit 3ac14b9dfbd345e891d48d89f6c2fa519848f0f4 ]
SG_MAX_SINGLE_ALLOC is used to limit maximum number of entries that will be allocated in one piece of scatterlist. When the entries of scatterlist exceeds SG_MAX_SINGLE_ALLOC, sg chain will be used. From commit 7c703e54cc71 ("arch: switch the default on ARCH_HAS_SG_CHAIN"), we can know that the macro CONFIG_ARCH_NO_SG_CHAIN is used to identify whether sg chain is supported. So, SMC-R's rmb buffer should be limited by SG_MAX_SINGLE_ALLOC only when the macro CONFIG_ARCH_NO_SG_CHAIN is defined.
--- net/smc/smc_core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/smc/smc_core.c +3 -2
@@ -691,7 +691,6 @@ int smc_conn_create(struct smc_sock *smc, struct smc_init_info *ini)*/ static u8 smc_compress_bufsize (int size,bool is_smcd,bool is_rmb) { -const unsigned int max_scat =SG_MAX_SINGLE_ALLOC *PAGE_SIZE ;u8 compressed;if (size <=SMC_BUF_MIN_SIZE )
@@ -701,9 +700,11 @@ static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb) compressed =min_t (u8,ilog2 (size) +1 , is_smcd ?SMCD_DMBE_SIZES :SMCR_RMBE_SIZES ); +#ifdef CONFIG_ARCH_NO_SG_CHAIN if (!is_smcd && is_rmb)/* RMBs are backed by & limited to max size of scatterlists */ - compressed =min_t (u8, compressed,ilog2 (max_scat >>14 )); + compressed =min_t (u8, compressed,ilog2 ((SG_MAX_SINGLE_ALLOC *PAGE_SIZE ) >>14 )); +#endif return compressed; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/259 selftests/bpf: Check length of recv in test_sockmap
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <[email protected]>
[ Upstream commit de1b5ea789dc28066cc8dc634b6825bd6148f38b ]
The value of recv in msg_loop may be negative, like EWOULDBLOCK, so it's necessary to check if it is positive before accumulating it to bytes_recvd.
--- tools/testing/selftests/bpf/test_sockmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/test_sockmap.c +2 -1
@@ -552,7 +552,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, } } - s->bytes_recvd += recv; +if (recv >0 ) + s->bytes_recvd += recv;if (data) { int chunk_sz = opt->sendpage ?
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/259 lib: objagg: Fix general protection fault
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit b4a3a89fffcdf09702b1f161b914e52abca1894d ]
The library supports aggregation of objects into other objects only if the parent object does not have a parent itself. That is, nesting is not supported.
Aggregation happens in two cases: Without and with hints, where hints are a pre-computed recommendation on how to aggregate the provided objects.
Nesting is not possible in the first case due to a check that prevents it, but in the second case there is no check because the assumption is that nesting cannot happen when creating objects based on hints. The violation of this assumption leads to various warnings and eventually to a general protection fault [1].
Before fixing the root cause, error out when nesting happens and warn.
[1]
general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>
--- lib/objagg.c | 3 +++ 1 file changed, 3 insertions(+)
lib/objagg.c +3 -0
@@ -167,6 +167,9 @@ static int objagg_obj_parent_assign(struct objagg *objagg, {void *delta_priv; +if (WARN_ON (!objagg_obj_is_root (parent))) +return -EINVAL ; + delta_priv = objagg->ops->delta_create (objagg->priv, parent->obj, objagg_obj->obj);if (IS_ERR (delta_priv))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/259 mlxsw: spectrum_acl_erp: Fix object nesting warning
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 97d833ceb27dc19f8777d63f90be4a27b5daeedf ]
ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited.
In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters.
The driver uses the "objagg" library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask.
The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal. Therefore, the driver will periodically ask the library to compute a more optimal set ("hints") by looking at all the existing objects.
When the library asks the driver whether two objects can be aggregated the driver only compares the provided masks and ignores the A-TCAM / C-TCAM indication. This is the right thing to do since the goal is to move as many filters as possible to the A-TCAM. The driver also forbids two identical masks from being aggregated since this can only happen if one was intentionally put in the C-TCAM to avoid a conflict in the A-TCAM.
The above can result in the following set of hints:
H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta
H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta
After getting the hints from the library the driver will start migrating filters from one region to another while consulting the computed hints and instructing the device to perform a lookup in both regions during the transition.
Assuming a filter with mask X is being migrated into the A-TCAM in the new region, the hints lookup will return H1. Since H2 is the parent of H1, the library will try to find the object associated with it and create it if necessary in which case another hints lookup (recursive) will be performed. This hints lookup for {mask Y, A-TCAM} will either return H2 or H3 since the driver passes the library an object comparison function that ignores the A-TCAM / C-TCAM indication.
This can eventually lead to nested objects which are not supported by the library [1].
Fix by removing the object comparison function from both the driver and the library as the driver was the only user. That way the lookup will only return exact matches.
I do not have a reliable reproducer that can reproduce the issue in a timely manner, but before the fix the issue would reproduce in several minutes and with the fix it does not reproduce in over an hour.
Note that the current usefulness of the hints is limited because they include the C-TCAM indication and represent aggregation that cannot actually happen. This will be addressed in net-next.
[1]
WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 Modules linked in: CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 [...] Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370
--- .../ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 ------------- include/linux/objagg.h | 1 - lib/objagg.c | 15 --------------- 3 files changed, 29 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +0 -13
@@ -1217,18 +1217,6 @@ static bool mlxsw_sp_acl_erp_delta_check(void *priv, const void *parent_obj,return err ? false : true; } -static int mlxsw_sp_acl_erp_hints_obj_cmp (const void *obj1,const void *obj2) -{ -const struct mlxsw_sp_acl_erp_key *key1 = obj1; -const struct mlxsw_sp_acl_erp_key *key2 = obj2; - -/* For hints purposes, two objects are considered equal -* in case the masks are the same. Does not matter what -* the "ctcam" value is. -*/ -return memcmp (key1->mask, key2->mask,sizeof (key1->mask)); -} -static void *mlxsw_sp_acl_erp_delta_create (void *priv,void *parent_obj,void *obj) {
@@ -1308,7 +1296,6 @@ static void mlxsw_sp_acl_erp_root_destroy(void *priv, void *root_priv)static const struct objagg_ops mlxsw_sp_acl_erp_objagg_ops = { .obj_size =sizeof (struct mlxsw_sp_acl_erp_key ), .delta_check = mlxsw_sp_acl_erp_delta_check, - .hints_obj_cmp = mlxsw_sp_acl_erp_hints_obj_cmp, .delta_create = mlxsw_sp_acl_erp_delta_create, .delta_destroy = mlxsw_sp_acl_erp_delta_destroy, .root_create = mlxsw_sp_acl_erp_root_create,
include/linux/objagg.h +0 -1
@@ -8,7 +8,6 @@ struct objagg_ops {size_t obj_size;bool (*delta_check)(void *priv,const void *parent_obj,const void *obj); -int (*hints_obj_cmp)(const void *obj1,const void *obj2);void * (*delta_create)(void *priv,void *parent_obj,void *obj);void (*delta_destroy)(void *priv,void *delta_priv);void * (*root_create)(void *priv,void *obj,unsigned int root_id);
lib/objagg.c +0 -15
@@ -909,20 +909,6 @@ static const struct objagg_opt_algo *objagg_opt_algos[] = { [OBJAGG_OPT_ALGO_SIMPLE_GREEDY] = &objagg_opt_simple_greedy, }; -static int objagg_hints_obj_cmp (struct rhashtable_compare_arg *arg, -const void *obj) -{ -struct rhashtable *ht = arg->ht; -struct objagg_hints *objagg_hints = - container_of(ht, struct objagg_hints, node_ht); -const struct objagg_ops *ops = objagg_hints->ops; -const char *ptr = obj; - - ptr += ht->p.key_offset; -return ops->hints_obj_cmp ? ops->hints_obj_cmp (ptr, arg->key) : -memcmp (ptr, arg->key, ht->p.key_len); -} -/** * objagg_hints_get - obtains hints instance * @objagg: objagg instance
@@ -961,7 +947,6 @@ struct objagg_hints *objagg_hints_get(struct objagg *objagg, offsetof(struct objagg_hints_node , obj); objagg_hints->ht_params.head_offset = offsetof(struct objagg_hints_node , ht_node); - objagg_hints->ht_params.obj_cmpfn = objagg_hints_obj_cmp; err =rhashtable_init (&objagg_hints->node_ht, &objagg_hints->ht_params);if (err)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/259 wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit 9ee0d44f055276fe2802b2f65058e920853f4f99 ]
rates_996 is mistakenly written as rates_969, fix it.
--- net/wireless/util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/wireless/util.c +2 -2
@@ -1281,7 +1281,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) 2048, /* 1.000000... */ };u32 rates_160M[3 ] = {960777777 ,907400000 ,816666666 }; -u32 rates_969[3 ] = {480388888 ,453700000 ,408333333 }; +u32 rates_996[3 ] = {480388888 ,453700000 ,408333333 };u32 rates_484[3 ] = {229411111 ,216666666 ,195000000 };u32 rates_242[3 ] = {114711111 ,108333333 ,97500000 };u32 rates_106[3 ] = {40000000 ,37777777 ,34000000 };
@@ -1306,7 +1306,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)else if (rate->bw ==RATE_INFO_BW_80 || (rate->bw ==RATE_INFO_BW_HE_RU && rate->he_ru_alloc ==NL80211_RATE_INFO_HE_RU_ALLOC_996 )) - result = rates_969[rate->he_gi]; + result = rates_996[rate->he_gi];else if (rate->bw ==RATE_INFO_BW_40 || (rate->bw ==RATE_INFO_BW_HE_RU && rate->he_ru_alloc ==NL80211_RATE_INFO_HE_RU_ALLOC_484 ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/259 wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <[email protected]>
[ Upstream commit bcbd771cd5d68c0c52567556097d75f9fc4e7cd6 ]
Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in cfg80211_calculate_bitrate_he(), leading to below warning:
kernel: invalid HE MCS: bw:6, ru:6
kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211]
Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth.
--- net/wireless/util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/wireless/util.c +3 -1
@@ -1301,7 +1301,9 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)if (WARN_ON_ONCE (rate->nss <1 || rate->nss >8 ))return 0 ; -if (rate->bw ==RATE_INFO_BW_160 ) +if (rate->bw ==RATE_INFO_BW_160 || + (rate->bw ==RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996)) result = rates_160M[rate->he_gi]; else if (rate->bw == RATE_INFO_BW_80 || (rate->bw == RATE_INFO_BW_HE_RU &&
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/259 net: fec: Refactor: #define magic constants
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás Bence <[email protected]>
[ Upstream commit ff049886671ccd4e624a30ec464cb20e4c39a313 ]
Add defines for bits of ECR, RCR control registers, TX watermark etc.
Stable-dep-of: c32fe1986f27 ("net: fec: Fix FEC_ECR_EN1588 being cleared on link-down")
--- drivers/net/ethernet/freescale/fec_main.c | 46 +++++++++++++++-------- 1 file changed, 30 insertions(+), 16 deletions(-)
drivers/net/ethernet/freescale/fec_main.c +30 -16
@@ -223,8 +223,8 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address");#define PKT_MINBUF_SIZE 64/* FEC receive acceleration */ -#define FEC_RACC_IPDIS (1 << 1) -#define FEC_RACC_PRODIS (1 << 2) +#define FEC_RACC_IPDIS BIT(1) +#define FEC_RACC_PRODIS BIT(2)#define FEC_RACC_SHIFT16 BIT(7)#define FEC_RACC_OPTIONS (FEC_RACC_IPDIS | FEC_RACC_PRODIS)
@@ -256,8 +256,23 @@ MODULE_PARM_DESC(macaddr, "FEC Ethernet MAC address");#define FEC_MMFR_TA (2 << 16)#define FEC_MMFR_DATA (v) (v & 0xffff)/* FEC ECR bits definition */ -#define FEC_ECR_MAGICEN (1 << 2) -#define FEC_ECR_SLEEP (1 << 3) +#define FEC_ECR_RESET BIT(0) +#define FEC_ECR_ETHEREN BIT(1) +#define FEC_ECR_MAGICEN BIT(2) +#define FEC_ECR_SLEEP BIT(3) +#define FEC_ECR_EN1588 BIT(4) +#define FEC_ECR_BYTESWP BIT(8) +/* FEC RCR bits definition */ +#define FEC_RCR_LOOP BIT(0) +#define FEC_RCR_HALFDPX BIT(1) +#define FEC_RCR_MII BIT(2) +#define FEC_RCR_PROMISC BIT(3) +#define FEC_RCR_BC_REJ BIT(4) +#define FEC_RCR_FLOWCTL BIT(5) +#define FEC_RCR_RMII BIT(8) +#define FEC_RCR_10BASET BIT(9) +/* TX WMARK bits */ +#define FEC_TXWMRK_STRFWD BIT(8)#define FEC_MII_TIMEOUT 30000/* us */
@@ -953,7 +968,7 @@ fec_restart(struct net_device *ndev)u32 val;u32 temp_mac[2 ];u32 rcntl =OPT_FRAME_SIZE |0x04 ; -u32 ecntl =0x2 ;/* ETHEREN */ +u32 ecntl =FEC_ECR_ETHEREN ;/* Whack a reset. We should wait for this. * For i.MX6SX SOC, enet use AXI bus, we use disable MAC
@@ -1029,18 +1044,18 @@ fec_restart(struct net_device *ndev) fep->phy_interface == PHY_INTERFACE_MODE_RGMII_TXID) rcntl |= (1 <<6 ); else if (fep->phy_interface == PHY_INTERFACE_MODE_RMII) - rcntl |= (1 << 8); + rcntl |= FEC_RCR_RMII; else - rcntl &= ~(1 << 8); + rcntl &= ~FEC_RCR_RMII;/* 1G, 100M or 10M */ if (ndev->phydev) {if (ndev->phydev->speed ==SPEED_1000 ) ecntl |= (1 <<5 );else if (ndev->phydev->speed ==SPEED_100 ) - rcntl &= ~(1 <<9 ); + rcntl &= ~FEC_RCR_10BASET ;else - rcntl |= (1 <<9 ); + rcntl |=FEC_RCR_10BASET ; } }else {#ifdef FEC_MIIGSK_ENR
@@ -1099,13 +1114,13 @@ fec_restart(struct net_device *ndev)if (fep->quirks &FEC_QUIRK_ENET_MAC ) {/* enable ENET endian swap */ - ecntl |= (1 <<8 ); + ecntl |=FEC_ECR_BYTESWP ;/* enable ENET store and forward mode */ -writel (1 <<8 , fep->hwp +FEC_X_WMRK ); +writel (FEC_TXWMRK_STRFWD , fep->hwp +FEC_X_WMRK ); }if (fep->bufdesc_ex) - ecntl |= (1 <<4 ); + ecntl |=FEC_ECR_EN1588 ;#ifndef CONFIG_M5272 /* Enable the MIB statistic event counters */
@@ -1152,7 +1167,7 @@ static void fec_stop(struct net_device *ndev) {struct fec_enet_private *fep =netdev_priv (ndev); -u32 rmii_mode =readl (fep->hwp +FEC_R_CNTRL ) & (1 <<8 ); +u32 rmii_mode =readl (fep->hwp +FEC_R_CNTRL ) &FEC_RCR_RMII ;u32 val;/* We cannot expect a graceful transmit stop without link !!! */
@@ -1171,7 +1186,7 @@ fec_stop(struct net_device *ndev)if (fep->quirks &FEC_QUIRK_HAS_AVB ) {writel (0 , fep->hwp +FEC_ECNTRL ); }else { -writel (1 , fep->hwp +FEC_ECNTRL ); +writel (FEC_ECR_RESET , fep->hwp +FEC_ECNTRL );udelay (10 ); }writel (FEC_DEFAULT_IMASK , fep->hwp +FEC_IMASK );
@@ -1187,12 +1202,11 @@ fec_stop(struct net_device *ndev)/* We have to keep ENET enabled to have MII interrupt stay working */ if (fep->quirks &FEC_QUIRK_ENET_MAC && !(fep->wol_flag &FEC_WOL_FLAG_SLEEP_ON )) { -writel (2 , fep->hwp +FEC_ECNTRL ); +writel (FEC_ECR_ETHEREN , fep->hwp +FEC_ECNTRL );writel (rmii_mode, fep->hwp +FEC_R_CNTRL ); } } -static void fec_timeout (struct net_device *ndev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/259 net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit c32fe1986f27cac329767d3497986e306cad1d5e ]
FEC_ECR_EN1588 bit gets cleared after MAC reset in fec_stop(), which makes all 1588 functionality shut down, and all the extended registers disappear, on link-down, making the adapter fall back to compatibility "dumb mode". However, some functionality needs to be retained (e.g. PPS) even without link.
--- drivers/net/ethernet/freescale/fec_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/freescale/fec_main.c +6 -0
@@ -1205,6 +1205,12 @@ fec_stop(struct net_device *ndev)writel (FEC_ECR_ETHEREN , fep->hwp +FEC_ECNTRL );writel (rmii_mode, fep->hwp +FEC_R_CNTRL ); } + +if (fep->bufdesc_ex) { + val =readl (fep->hwp +FEC_ECNTRL ); + val |=FEC_ECR_EN1588 ; +writel (val, fep->hwp +FEC_ECNTRL ); + } } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/259 ipvs: Avoid unnecessary calls to skb_is_gso_sctp
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ismael Luceno <[email protected]>
[ Upstream commit 53796b03295cf7ab1fc8600016fa6dfbf4a494a0 ]
In the context of the SCTP SNAT/DNAT handler, these calls can only return true.
--- net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/ipvs/ip_vs_proto_sctp.c +2 -2
@@ -126,7 +126,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,if (sctph->source != cp->vport || payload_csum || skb->ip_summed ==CHECKSUM_PARTIAL ) { sctph->source = cp->vport; -if (!skb_is_gso (skb) || !skb_is_gso_sctp (skb)) +if (!skb_is_gso (skb))sctp_nat_csum (skb, sctph, sctphoff); }else { skb->ip_summed =CHECKSUM_UNNECESSARY ;
@@ -175,7 +175,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, (skb->ip_summed == CHECKSUM_PARTIAL && !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { sctph->dest = cp->dport; -if (!skb_is_gso (skb) || !skb_is_gso_sctp (skb)) +if (!skb_is_gso (skb))sctp_nat_csum (skb, sctph, sctphoff); } else if (skb->ip_summed != CHECKSUM_PARTIAL) { skb->ip_summed =CHECKSUM_UNNECESSARY ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/259 netfilter: nf_tables: rise cap on SELinux secmark context
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e29630247be24c3987e2b048f8e152771b32d38b ]
secmark context is artificially limited 256 bytes, rise it to 4Kbytes.
--- include/uapi/linux/netfilter/nf_tables.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/netfilter/nf_tables.h +1 -1
@@ -1213,7 +1213,7 @@ enum nft_secmark_attributes {#define NFTA_SECMARK_MAX (__NFTA_SECMARK_MAX - 1)/* Max security context length */ -#define NFT_SECMARK_CTX_MAXLEN 256 +#define NFT_SECMARK_CTX_MAXLEN 4096/** * enum nft_reject_types - nf_tables reject expression reject types
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/259 perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 3520b251dcae2b4a27b95cd6f745c54fd658bda5 ]
Currently, perf allocates an array of page pointers which is limited in size by MAX_PAGE_ORDER. That in turn limits the maximum Intel PT buffer size to 2GiB. Should that limitation be lifted, the Intel PT driver can support larger sizes, except for one calculation in pt_topa_entry_for_page(), which is limited to 32-bits.
Fix pt_topa_entry_for_page() address calculation by adding a cast.
--- arch/x86/events/intel/pt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/events/intel/pt.c +1 -1
@@ -935,7 +935,7 @@ pt_topa_entry_for_page(struct pt_buffer *buf, unsigned int pg)* order allocations, there shouldn't be many of these. */ list_for_each_entry (topa, &buf->tables, list) { -if (topa->offset + topa->size > pg <<PAGE_SHIFT ) +if (topa->offset + topa->size > (unsigned long )pg <<PAGE_SHIFT ) goto found; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/259 perf: Fix perf_aux_size() for greater-than 32-bit size
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit 3df94a5b1078dfe2b0c03f027d018800faf44c82 ]
perf_buffer->aux_nr_pages uses a 32-bit type, so a cast is needed to calculate a 64-bit size.
--- kernel/events/internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/internal.h +1 -1
@@ -122,7 +122,7 @@ static inline unsigned long perf_data_size(struct ring_buffer *rb)static inline unsigned long perf_aux_size (struct ring_buffer *rb) { -return rb->aux_nr_pages <<PAGE_SHIFT ; +return (unsigned long )rb->aux_nr_pages <<PAGE_SHIFT ; }#define __DEFINE_OUTPUT_COPY_BODY (advance_buf, memcpy_func, ...) \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/259 perf: Prevent passing zero nr_pages to rb_alloc_aux()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
[ Upstream commit dbc48c8f41c208082cfa95e973560134489e3309 ]
nr_pages is unsigned long but gets passed to rb_alloc_aux() as an int, and is stored as an int.
Only power-of-2 values are accepted, so if nr_pages is a 64_bit value, it will be passed to rb_alloc_aux() as zero.
That is not ideal because:
1. the value is incorrect
2. rb_alloc_aux() is at risk of misbehaving, although it manages to return -ENOMEM in that case, it is a result of passing zero to get_order() even though the get_order() result is documented to be undefined in that case.
Fix by simply validating the maximum supported value in the first place. Use -ENOMEM error code for consistency with the current error code that is returned in that case.
--- kernel/events/core.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/events/core.c +2 -0
@@ -5830,6 +5830,8 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)return -EINVAL ; nr_pages = vma_size /PAGE_SIZE ; +if (nr_pages >INT_MAX ) +return -ENOMEM ;mutex_lock (&event->mmap_mutex); ret = -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/259 qed: Improve the stack space of filter_config()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shai Malin <[email protected]>
[ Upstream commit f55e36d5ab76c3097ff36ecea60b91c6b0d80fc8 ]
As it was reported and discussed in: https://lore.kernel.org/lkml/CAHk-=whF9F89vsfH8E9TGc0tZA-yhzi2Di8wOtquNB5vRkFX5w@mail.gmail.com/
This patch improves the stack space of qede_config_rx_mode() by
splitting filter_config() to 3 functions and removing the
union qed_filter_type_params.
Stable-dep-of: b5d14b0c6716 ("wifi: virt_wifi: avoid reporting connection success with wrong SSID")
--- drivers/net/ethernet/qlogic/qed/qed_l2.c | 23 ++------- .../net/ethernet/qlogic/qede/qede_filter.c | 47 ++++++++----------- include/linux/qed/qed_eth_if.h | 21 ++++----- 3 files changed, 30 insertions(+), 61 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_l2.c +3 -20
@@ -2781,25 +2781,6 @@ static int qed_configure_filter_mcast(struct qed_dev *cdev,return qed_filter_mcast_cmd (cdev, &mcast,QED_SPQ_MODE_CB ,NULL ); } -static int qed_configure_filter (struct qed_dev *cdev, -struct qed_filter_params *params) -{ -enum qed_filter_rx_mode_type accept_flags; - -switch (params->type) { -case QED_FILTER_TYPE_UCAST : -return qed_configure_filter_ucast (cdev, ¶ms->filter.ucast); -case QED_FILTER_TYPE_MCAST : -return qed_configure_filter_mcast (cdev, ¶ms->filter.mcast); -case QED_FILTER_TYPE_RX_MODE : - accept_flags = params->filter.accept_flags; -return qed_configure_filter_rx_mode (cdev, accept_flags); -default : -DP_NOTICE (cdev,"Unknown filter type %d\n" , (int )params->type); -return -EINVAL ; - } -} -static int qed_configure_arfs_searcher (struct qed_dev *cdev,enum qed_filter_config_mode mode) {
@@ -2932,7 +2913,9 @@ static const struct qed_eth_ops qed_eth_ops_pass = { .q_rx_stop = &qed_stop_rxq, .q_tx_start = &qed_start_txq, .q_tx_stop = &qed_stop_txq, - .filter_config = &qed_configure_filter, + .filter_config_rx_mode = &qed_configure_filter_rx_mode, + .filter_config_ucast = &qed_configure_filter_ucast, + .filter_config_mcast = &qed_configure_filter_mcast, .fastpath_stop = &qed_fastpath_stop, .eth_cqe_completion = &qed_fp_cqe_completion, .get_vport_stats = &qed_get_vport_stats,
drivers/net/ethernet/qlogic/qede/qede_filter.c +19 -28
92 lines not on this page · raw message
include/linux/qed/qed_eth_if.h +8 -13
@@ -171,12 +171,6 @@ struct qed_filter_mcast_params {unsigned char mac[64 ][ETH_ALEN ]; }; -union qed_filter_type_params { -enum qed_filter_rx_mode_type accept_flags; -struct qed_filter_ucast_params ucast; -struct qed_filter_mcast_params mcast; -}; -enum qed_filter_type {QED_FILTER_TYPE_UCAST ,QED_FILTER_TYPE_MCAST ,
@@ -184,11 +178,6 @@ enum qed_filter_type { QED_MAX_FILTER_TYPES, }; -struct qed_filter_params { -enum qed_filter_type type; -union qed_filter_type_params filter; -}; -struct qed_tunn_params {u16 vxlan_port;u8 update_vxlan_port;
@@ -340,8 +329,14 @@ struct qed_eth_ops {int (*q_tx_stop)(struct qed_dev *cdev,u8 rss_id,void *handle); -int (*filter_config)(struct qed_dev *cdev, -struct qed_filter_params *params); +int (*filter_config_rx_mode)(struct qed_dev *cdev, +enum qed_filter_rx_mode_type type); + +int (*filter_config_ucast)(struct qed_dev *cdev, +struct qed_filter_ucast_params *params); + +int (*filter_config_mcast)(struct qed_dev *cdev, +struct qed_filter_mcast_params *params);int (*fastpath_stop)(struct qed_dev *cdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/259 wifi: virt_wifi: avoid reporting connection success with wrong SSID
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: En-Wei Wu <[email protected]>
[ Upstream commit b5d14b0c6716fad7f0c94ac6e1d6f60a49f985c7 ]
When user issues a connection with a different SSID than the one virt_wifi has advertised, the __cfg80211_connect_result() will trigger the warning: WARN_ON(bss_not_found).
The issue is because the connection code in virt_wifi does not check the SSID from user space (it only checks the BSSID), and virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS even if the SSID is different from the one virt_wifi has advertised. Eventually cfg80211 won't be able to find the cfg80211_bss and generate the warning.
Fixed it by checking the SSID (from user space) in the connection code.
--- drivers/net/wireless/virt_wifi.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
drivers/net/wireless/virt_wifi.c +16 -3
@@ -136,6 +136,8 @@ static struct ieee80211_supported_band band_5ghz = {/* Assigned at module init. Guaranteed locally-administered and unicast. */ static u8 fake_router_bssid[ETH_ALEN ]__ro_after_init = {}; +#define VIRT_WIFI_SSID "VirtWifi" +static void virt_wifi_inform_bss (struct wiphy *wiphy) {u64 tsf =div_u64 (ktime_get_boottime_ns (),1000 );
@@ -146,8 +148,8 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy)u8 ssid[8 ]; }__packed ssid = { .tag =WLAN_EID_SSID , - .len =8 , - .ssid ="VirtWifi" , + .len =strlen (VIRT_WIFI_SSID ), + .ssid =VIRT_WIFI_SSID , }; informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz,
@@ -213,6 +215,8 @@ struct virt_wifi_netdev_priv {struct net_device *upperdev;u32 tx_packets;u32 tx_failed; +u32 connect_requested_ssid_len; +u8 connect_requested_ssid[IEEE80211_MAX_SSID_LEN ];u8 connect_requested_bss[ETH_ALEN ];bool is_up;bool is_connected;
@@ -229,6 +233,12 @@ static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev,if (priv->being_deleted || !priv->is_up)return -EBUSY ; +if (!sme->ssid) +return -EINVAL ; + + priv->connect_requested_ssid_len = sme->ssid_len; +memcpy (priv->connect_requested_ssid, sme->ssid, sme->ssid_len); + could_schedule =schedule_delayed_work (&priv->connect,HZ *2 );if (!could_schedule)return -EBUSY ;
@@ -252,12 +262,15 @@ static void virt_wifi_connect_complete(struct work_struct *work) container_of(work, struct virt_wifi_netdev_priv, connect.work);u8 *requested_bss = priv->connect_requested_bss;bool right_addr =ether_addr_equal (requested_bss, fake_router_bssid); +bool right_ssid = priv->connect_requested_ssid_len ==strlen (VIRT_WIFI_SSID ) && + !memcmp (priv->connect_requested_ssid,VIRT_WIFI_SSID , + priv->connect_requested_ssid_len);u16 status =WLAN_STATUS_SUCCESS ;if (is_zero_ether_addr (requested_bss)) requested_bss =NULL ; -if (!priv->is_up || (requested_bss && !right_addr)) +if (!priv->is_up || (requested_bss && !right_addr) || !right_ssid) status =WLAN_STATUS_UNSPECIFIED_FAILURE ;else priv->is_connected = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/259 gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <[email protected]>
[ Upstream commit a3123341dc358952ce2bf8067fbdfb7eaadf71bb ]
If we fail to call crypto_sync_skcipher_setkey, we should free the memory allocation for cipher, replace err_return with err_free_cipher to free the memory of cipher.
--- net/sunrpc/auth_gss/gss_krb5_keys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sunrpc/auth_gss/gss_krb5_keys.c +1 -1
@@ -161,7 +161,7 @@ u32 krb5_derive_key(const struct gss_krb5_enctype *gk5e,if (IS_ERR (cipher)) goto err_return;if (crypto_sync_skcipher_setkey (cipher, inkey->data, inkey->len)) - goto err_return; + goto err_free_cipher;/* allocate and set up buffers */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/259 wifi: virt_wifi: dont use strlen() in const context
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 6e909f489191b365364e9d636dec33b5dfd4e5eb ]
Looks like not all compilers allow strlen(constant) as a constant, so don't do that. Instead, revert back to defining the length as the first submission had it.
--- drivers/net/wireless/virt_wifi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/virt_wifi.c +3 -2
@@ -137,6 +137,7 @@ static struct ieee80211_supported_band band_5ghz = {static u8 fake_router_bssid[ETH_ALEN ]__ro_after_init = {};#define VIRT_WIFI_SSID "VirtWifi" +#define VIRT_WIFI_SSID_LEN 8static void virt_wifi_inform_bss (struct wiphy *wiphy) {
@@ -148,7 +149,7 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy)u8 ssid[8 ]; }__packed ssid = { .tag =WLAN_EID_SSID , - .len =strlen (VIRT_WIFI_SSID ), + .len =VIRT_WIFI_SSID_LEN , .ssid =VIRT_WIFI_SSID , };
@@ -262,7 +263,7 @@ static void virt_wifi_connect_complete(struct work_struct *work) container_of(work, struct virt_wifi_netdev_priv, connect.work);u8 *requested_bss = priv->connect_requested_bss;bool right_addr =ether_addr_equal (requested_bss, fake_router_bssid); -bool right_ssid = priv->connect_requested_ssid_len ==strlen (VIRT_WIFI_SSID ) && +bool right_ssid = priv->connect_requested_ssid_len ==VIRT_WIFI_SSID_LEN && !memcmp (priv->connect_requested_ssid,VIRT_WIFI_SSID , priv->connect_requested_ssid_len);u16 status =WLAN_STATUS_SUCCESS ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/259 bna: adjust name buf size of bna_tcb and bna_ccb structures
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <[email protected]>
[ Upstream commit c9741a03dc8e491e57b95fba0058ab46b7e506da ]
To have enough space to write all possible sprintf() args. Currently 'name' size is 16, but the first '%s' specifier may already need at least 16 characters, since 'bnad->netdev->name' is used there.
For '%d' specifiers, assume that they require:
* 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8
* 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX is 16
And replace sprintf with snprintf.
Detected using the static analysis tool - Svace.
--- drivers/net/ethernet/brocade/bna/bna_types.h | 2 +- drivers/net/ethernet/brocade/bna/bnad.c | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-)
drivers/net/ethernet/brocade/bna/bna_types.h +1 -1
@@ -410,7 +410,7 @@ struct bna_ib {/* Tx object */ /* Tx datapath control structure */ -#define BNA_Q_NAME_SIZE 16 +#define BNA_Q_NAME_SIZE (IFNAMSIZ + 6)struct bna_tcb {/* Fast path */ void **sw_qpt;
drivers/net/ethernet/brocade/bna/bnad.c +6 -5
@@ -1535,8 +1535,9 @@ bnad_tx_msix_register(struct bnad *bnad, struct bnad_tx_info *tx_info,for (i =0 ; i < num_txqs; i++) { vector_num = tx_info->tcb[i]->intr_vector; -sprintf (tx_info->tcb[i]->name,"%s TXQ %d" , bnad->netdev->name, - tx_id + tx_info->tcb[i]->id); +snprintf (tx_info->tcb[i]->name,BNA_Q_NAME_SIZE ,"%s TXQ %d" , + bnad->netdev->name, + tx_id + tx_info->tcb[i]->id); err = request_irq(bnad->msix_table[vector_num].vector, (irq_handler_t)bnad_msix_tx, 0, tx_info->tcb[i]->name,
@@ -1586,9 +1587,9 @@ bnad_rx_msix_register(struct bnad *bnad, struct bnad_rx_info *rx_info,for (i =0 ; i < num_rxps; i++) { vector_num = rx_info->rx_ctrl[i].ccb->intr_vector; -sprintf (rx_info->rx_ctrl[i].ccb->name,"%s CQ %d" , - bnad->netdev->name, - rx_id + rx_info->rx_ctrl[i].ccb->id); +snprintf (rx_info->rx_ctrl[i].ccb->name,BNA_Q_NAME_SIZE , +"%s CQ %d" , bnad->netdev->name, + rx_id + rx_info->rx_ctrl[i].ccb->id); err = request_irq(bnad->msix_table[vector_num].vector, (irq_handler_t)bnad_msix_rx, 0, rx_info->rx_ctrl[i].ccb->name,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/259 selftests: forwarding: devlink_lib: Wait for udev events after reloading
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <[email protected]>
[ Upstream commit f67a90a0c8f5b3d0acc18f10650d90fec44775f9 ]
Lately, an additional locking was added by commit c0a40097f0bc ("drivers: core: synchronize really_probe() and dev_uevent()"). The locking protects dev_uevent() calling. This function is used to send messages from the kernel to user space. Uevent messages notify user space about changes in device states, such as when a device is added, removed, or changed. These messages are used by udev (or other similar user-space tools) to apply device-specific rules.
After reloading devlink instance, udev events should be processed. This locking causes a short delay of udev events handling.
One example for useful udev rule is renaming ports. 'forwading.config' can be configured to use names after udev rules are applied. Some tests run devlink_reload() and immediately use the updated names. This worked before the above mentioned commit was pushed, but now the delay of uevent messages causes that devlink_reload() returns before udev events are handled and tests fail.
Adjust devlink_reload() to not assume that udev events are already processed when devlink reload is done, instead, wait for udev events to ensure they are processed before returning from the function.
Without this patch:
TESTS='rif_mac_profile' ./resource_scale.sh
TEST: 'rif_mac_profile' 4 [ OK ]
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory
sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory Cannot find device "swp1"
Cannot find device "swp2"
TEST: setup_wait_dev (: Interface swp1 does not come up.) [FAIL]
With this patch:
$ TESTS='rif_mac_profile' ./resource_scale.sh TEST: 'rif_mac_profile' 4 [ OK ] TEST: 'rif_mac_profile' overflow 5 [ OK ]
This is relevant not only for this test.
--- tools/testing/selftests/net/forwarding/devlink_lib.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/forwarding/devlink_lib.sh +2 -0
@@ -102,6 +102,8 @@ devlink_reload() still_pending=$(devlink resource show "$DEVLINK_DEV" | \ grep -c "size_new") check_err $still_pending "Failed reload - There are still unset sizes" + + udevadm settle } declare -A DEVLINK_ORIG
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/259 USB: move snd_usb_pipe_sanity_check into the USB core
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
[ Upstream commit fcc2cc1f35613c016e1de25bb001bfdd9eaa25f9 ]
snd_usb_pipe_sanity_check() is a great function, so let's move it into the USB core so that other parts of the kernel, including the USB core, can call it.
Name it usb_pipe_type_check() to match the existing usb_urb_ep_type_check() call, which now uses this function.
Stable-dep-of: 2052138b7da5 ("media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()")
--- drivers/usb/core/urb.c | 31 +++++++++++++++++++++++-------- include/linux/usb.h | 1 + sound/usb/helper.c | 16 +--------------- sound/usb/helper.h | 1 - sound/usb/mixer_scarlett_gen2.c | 2 +- sound/usb/quirks.c | 12 ++++++------ 6 files changed, 32 insertions(+), 31 deletions(-)
drivers/usb/core/urb.c +23 -8
@@ -192,24 +192,39 @@ static const int pipetypes[4] = { };/** -* usb_urb_ep_type_check - sanity check of endpoint in the given urb -* @urb: urb to be checked +* usb_pipe_type_check - sanity check of a specific pipe for a usb device +* @dev: struct usb_device to be checked +* @pipe: pipe to check * * This performs a light-weight sanity check for the endpoint in the -* given urb. It returns 0 if the urb contains a valid endpoint, otherwise -* a negative error code. +* given usb device. It returns 0 if the pipe is valid for the specific usb +* device, otherwise a negative error code. */ -int usb_urb_ep_type_check (const struct urb *urb) +int usb_pipe_type_check (struct usb_device *dev,unsigned int pipe) {const struct usb_host_endpoint *ep; - ep =usb_pipe_endpoint (urb->dev, urb->pipe); + ep =usb_pipe_endpoint (dev, pipe);if (!ep)return -EINVAL ; -if (usb_pipetype (urb->pipe) != pipetypes[usb_endpoint_type (&ep->desc)]) +if (usb_pipetype (pipe) != pipetypes[usb_endpoint_type (&ep->desc)])return -EINVAL ;return 0 ; } +EXPORT_SYMBOL_GPL (usb_pipe_type_check); + +/** +* usb_urb_ep_type_check - sanity check of endpoint in the given urb +* @urb: urb to be checked +* +* This performs a light-weight sanity check for the endpoint in the +* given urb. It returns 0 if the urb contains a valid endpoint, otherwise +* a negative error code. +*/ +int usb_urb_ep_type_check (const struct urb *urb) +{ +return usb_pipe_type_check (urb->dev, urb->pipe); +}EXPORT_SYMBOL_GPL (usb_urb_ep_type_check);/**
@@ -474,7 +489,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)*/ /* Check that the pipe's type matches the endpoint's type */ -if (usb_urb_ep_type_check (urb)) +if (usb_pipe_type_check (urb->dev, urb->pipe))dev_WARN (&dev->dev,"BOGUS urb xfer, pipe %x != type %x\n" ,usb_pipetype (urb->pipe), pipetypes[xfertype]);
include/linux/usb.h +1 -0
@@ -1763,6 +1763,7 @@ static inline int usb_urb_dir_out(struct urb *urb)return (urb->transfer_flags &URB_DIR_MASK ) ==URB_DIR_OUT ; } +int usb_pipe_type_check (struct usb_device *dev,unsigned int pipe);int usb_urb_ep_type_check (const struct urb *urb); void *usb_alloc_coherent(struct usb_device *dev, size_t size,
sound/usb/helper.c +1 -15
@@ -63,20 +63,6 @@ void *snd_usb_find_csint_desc(void *buffer, int buflen, void *after, u8 dsubtypereturn NULL ; } -/* check the validity of pipe and EP types */ -int snd_usb_pipe_sanity_check (struct usb_device *dev,unsigned int pipe) -{ -static const int pipetypes[4 ] = { -PIPE_CONTROL ,PIPE_ISOCHRONOUS ,PIPE_BULK ,PIPE_INTERRUPT - }; -struct usb_host_endpoint *ep; - - ep =usb_pipe_endpoint (dev, pipe); -if (!ep ||usb_pipetype (pipe) != pipetypes[usb_endpoint_type (&ep->desc)]) -return -EINVAL ; -return 0 ; -} -/* * Wrapper for usb_control_msg(). * Allocates a temp buffer to prevent dmaing from/to the stack.
@@ -89,7 +75,7 @@ int snd_usb_ctl_msg(struct usb_device *dev, unsigned int pipe, __u8 request,void *buf =NULL ;int timeout; -if (snd_usb_pipe_sanity_check (dev, pipe)) +if (usb_pipe_type_check (dev, pipe))return -EINVAL ;if (size >0 ) {
sound/usb/helper.h +0 -1
@@ -7,7 +7,6 @@ unsigned int snd_usb_combine_bytes(unsigned char *bytes, int size);void *snd_usb_find_desc (void *descstart,int desclen,void *after,u8 dtype);void *snd_usb_find_csint_desc (void *descstart,int desclen,void *after,u8 dsubtype); -int snd_usb_pipe_sanity_check (struct usb_device *dev,unsigned int pipe);int snd_usb_ctl_msg (struct usb_device *dev,unsigned int pipe,__u8 request,__u8 requesttype,__u16 value,__u16 index,void *data,__u16 size);
sound/usb/mixer_scarlett_gen2.c +1 -1
@@ -1988,7 +1988,7 @@ static int scarlett2_mixer_status_create(struct usb_mixer_interface *mixer)return 0 ; } -if (snd_usb_pipe_sanity_check (dev, pipe)) +if (usb_pipe_type_check (dev, pipe))return -EINVAL ; mixer->urb =usb_alloc_urb (0 ,GFP_KERNEL );
sound/usb/quirks.c +6 -6
@@ -854,7 +854,7 @@ static int snd_usb_accessmusic_boot_quirk(struct usb_device *dev)static const u8 seq[] = {0x4e ,0x73 ,0x52 ,0x01 };void *buf; -if (snd_usb_pipe_sanity_check (dev,usb_sndintpipe (dev,0x05 ))) +if (usb_pipe_type_check (dev,usb_sndintpipe (dev,0x05 )))return -EINVAL ; buf =kmemdup (seq,ARRAY_SIZE (seq),GFP_KERNEL );if (!buf)
@@ -883,7 +883,7 @@ static int snd_usb_nativeinstruments_boot_quirk(struct usb_device *dev) {int ret; -if (snd_usb_pipe_sanity_check (dev,usb_sndctrlpipe (dev,0 ))) +if (usb_pipe_type_check (dev,usb_sndctrlpipe (dev,0 )))return -EINVAL ; ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), 0xaf, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -992,7 +992,7 @@ static int snd_usb_axefx3_boot_quirk(struct usb_device *dev)dev_dbg (&dev->dev,"Waiting for Axe-Fx III to boot up...\n" ); -if (snd_usb_pipe_sanity_check (dev,usb_sndctrlpipe (dev,0 ))) +if (usb_pipe_type_check (dev,usb_sndctrlpipe (dev,0 )))return -EINVAL ;/* If the Axe-Fx III has not fully booted, it will timeout when trying * to enable the audio streaming interface. A more generous timeout is
@@ -1026,7 +1026,7 @@ static int snd_usb_motu_microbookii_communicate(struct usb_device *dev, u8 *buf, {int err, actual_length; -if (snd_usb_pipe_sanity_check (dev,usb_sndintpipe (dev,0x01 ))) +if (usb_pipe_type_check (dev,usb_sndintpipe (dev,0x01 )))return -EINVAL ; err =usb_interrupt_msg (dev,usb_sndintpipe (dev,0x01 ), buf, *length, &actual_length,1000 );
@@ -1038,7 +1038,7 @@ static int snd_usb_motu_microbookii_communicate(struct usb_device *dev, u8 *buf,memset (buf,0 , buf_size); -if (snd_usb_pipe_sanity_check (dev,usb_rcvintpipe (dev,0x82 ))) +if (usb_pipe_type_check (dev,usb_rcvintpipe (dev,0x82 )))return -EINVAL ; err =usb_interrupt_msg (dev,usb_rcvintpipe (dev,0x82 ), buf, buf_size, &actual_length,1000 );
@@ -1125,7 +1125,7 @@ static int snd_usb_motu_m_series_boot_quirk(struct usb_device *dev) {int ret; -if (snd_usb_pipe_sanity_check (dev,usb_sndctrlpipe (dev,0 ))) +if (usb_pipe_type_check (dev,usb_sndctrlpipe (dev,0 )))return -EINVAL ; ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), 1, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/259 media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c ]
Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)
Looking into the codes, there is a loop in dvb_usb_read_remote_control(), that is in rc_core_dvb_usb_remote_init() create a work that will call dvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively call dvb_usb_read_remote_control(), see following code snippet:
rc_core_dvb_usb_remote_init() {
...
INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control);
schedule_delayed_work(&d->rc_query_work,
msecs_to_jiffies(rc_interval));
...
}
dvb_usb_read_remote_control() {
...
err = d->props.rc.core.rc_query(d);
if (err)
err(...) // Did not return even if query failed
schedule_delayed_work(&d->rc_query_work,
msecs_to_jiffies(rc_interval));
}When the infinite log printing occurs, the query callback 'd->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to the failure of finding a valid 'generic_bulk_ctrl_endpoint' in usb_bulk_msg(), see following code snippet:
cxusb_rc_query() {
cxusb_ctrl_msg() {
dvb_usb_generic_rw() {
ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev,
d->props.generic_bulk_ctrl_endpoint),...);
if (ret)
err("bulk message failed: %d (%d/%d)",ret,wlen,actlen);
...
}
...
}By analyzing the corresponding USB descriptor, it shows that the bNumEndpoints is 0 in its interface descriptor, but
the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this 'invalid' USB device should be rejected before it calls into dvb_usb_read_remote_control().
To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'. And as Sean suggested, the same check and clear halts should be done for 'generic_bulk_ctrl_endpoint_response'. So introduce dvb_usb_check_bulk_endpoint() to do it for both of them.
--- drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++++++++++++++++++++--- 1 file changed, 31 insertions(+), 4 deletions(-)
drivers/media/usb/dvb-usb/dvb-usb-init.c +31 -4
@@ -23,11 +23,40 @@ static int dvb_usb_force_pid_filter_usage;module_param_named (force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int,0444 );MODULE_PARM_DESC (force_pid_filter_usage,"force all dvb-usb-devices to use a PID filter, if any (default: 0)." ); +static int dvb_usb_check_bulk_endpoint (struct dvb_usb_device *d,u8 endpoint) +{ +if (endpoint) { +int ret; + + ret =usb_pipe_type_check (d->udev,usb_sndbulkpipe (d->udev, endpoint)); +if (ret) +return ret; + ret =usb_pipe_type_check (d->udev,usb_rcvbulkpipe (d->udev, endpoint)); +if (ret) +return ret; + } +return 0 ; +} + +static void dvb_usb_clear_halt (struct dvb_usb_device *d,u8 endpoint) +{ +if (endpoint) { +usb_clear_halt (d->udev,usb_sndbulkpipe (d->udev, endpoint)); +usb_clear_halt (d->udev,usb_rcvbulkpipe (d->udev, endpoint)); + } +} +static int dvb_usb_adapter_init (struct dvb_usb_device *d,short *adapter_nrs) {struct dvb_usb_adapter *adap;int ret, n, o; + ret =dvb_usb_check_bulk_endpoint (d, d->props.generic_bulk_ctrl_endpoint); +if (ret) +return ret; + ret =dvb_usb_check_bulk_endpoint (d, d->props.generic_bulk_ctrl_endpoint_response); +if (ret) +return ret;for (n =0 ; n < d->props.num_adapters; n++) { adap = &d->adapter[n]; adap->dev = d;
@@ -103,10 +132,8 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs)* when reloading the driver w/o replugging the device * sometimes a timeout occurs, this helps */ -if (d->props.generic_bulk_ctrl_endpoint !=0 ) { -usb_clear_halt (d->udev,usb_sndbulkpipe (d->udev, d->props.generic_bulk_ctrl_endpoint)); -usb_clear_halt (d->udev,usb_rcvbulkpipe (d->udev, d->props.generic_bulk_ctrl_endpoint)); - } +dvb_usb_clear_halt (d, d->props.generic_bulk_ctrl_endpoint); +dvb_usb_clear_halt (d, d->props.generic_bulk_ctrl_endpoint_response);return 0 ;
Signature · 1 line
2.43.0
Re: [PATCH 5.4 051/259] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
Quoted 20 lines · Greg Kroah-Hartman
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit
2052138b7da52ad5ccaf74f736d00f39a1c9198c]Infinite log printing occurs during fuzz test:
rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ...
...
dvb-usb: schedule remote query interval to 100 msecs.
dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ...
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
dvb-usb: bulk message failed: -22 (1/0)
...
dvb-usb: bulk message failed: -22 (1/0)
Quoted 5 lines
Looking into the codes, there is a loop in
dvb_usb_read_remote_control(), that is inrc_core_dvb_usb_remote_init()create a work that will calldvb_usb_read_remote_control(), and this work will reschedule itself at 'rc_interval' intervals to recursively calldvb_usb_read_remote_control(), see following code snippet:
This commit causes problems and has been reverted upstream.
https://git.linuxtv.org/media_stage.git/commit/?h=fixes&id=0c84bde4f37ba27d50e4c70ecacd33fe4a57030d
Please don't apply.
Thanks,
Sean
Greg Kroah-Hartman
maintainerPATCH 52/259 media: imon: Fix race getting ictx->lock
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 24147897507cd3a7d63745d1518a638bf4132238 ]
Lets fix a race between mutex_is_lock() and mutex_lock().
<-mutex is not locked
if (!mutex_is_locked(&ictx->lock)) {
unlock = true; <- mutex is locked externaly
mutex_lock(&ictx->lock);
}Let's use mutex_trylock() that does mutex_is_lock() and mutex_lock() atomically.
Fix the following cocci warning:
drivers/media/rc/imon.c:1167:1-7: preceding lock on line 1153
--- drivers/media/rc/imon.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/media/rc/imon.c +1 -4
@@ -1117,10 +1117,7 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 *rc_proto)memcpy (ictx->usb_tx_buf, &ir_proto_packet,sizeof (ir_proto_packet)); -if (!mutex_is_locked (&ictx->lock)) { - unlock = true; -mutex_lock (&ictx->lock); - } + unlock =mutex_trylock (&ictx->lock); retval =send_packet (ictx);if (retval)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/259 saa7134: Unchecked i2c_transfer function result fixed
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Burakov <[email protected]>
[ Upstream commit 9d8683b3fd93f0e378f24dc3d9604e5d7d3e0a17 ]
Return value of function 'i2c_transfer' is not checked that may cause undefined behaviour.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/media/pci/saa7134/saa7134-dvb.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/media/pci/saa7134/saa7134-dvb.c +6 -2
@@ -466,7 +466,9 @@ static int philips_europa_tuner_sleep(struct dvb_frontend *fe)/* switch the board to analog mode */ if (fe->ops.i2c_gate_ctrl) fe->ops.i2c_gate_ctrl (fe,1 ); -i2c_transfer (&dev->i2c_adap, &analog_msg,1 ); +if (i2c_transfer (&dev->i2c_adap, &analog_msg,1 ) !=1 ) +return -EIO ; +return 0 ; }
@@ -1018,7 +1020,9 @@ static int md8800_set_voltage2(struct dvb_frontend *fe,else wbuf[1 ] = rbuf &0xef ; msg[0 ].len =2 ; -i2c_transfer (&dev->i2c_adap, msg,1 ); +if (i2c_transfer (&dev->i2c_adap, msg,1 ) !=1 ) +return -EIO ; +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/259 media: uvcvideo: Allow entity-defined get_info and get_cur
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit 65900c581d014499f0f8ceabfc02c652e9a88771 ]
Allows controls to get their properties and current value from an entity-defined function instead of via a query to the USB device.
Stable-dep-of: 86419686e66d ("media: uvcvideo: Override default flags")
--- drivers/media/usb/uvc/uvc_ctrl.c | 22 ++++++++++++++++++---- drivers/media/usb/uvc/uvcvideo.h | 5 +++++ 2 files changed, 23 insertions(+), 4 deletions(-)
drivers/media/usb/uvc/uvc_ctrl.c +18 -4
@@ -1002,10 +1002,20 @@ static int __uvc_ctrl_get(struct uvc_video_chain *chain,return -EACCES ;if (!ctrl->loaded) { - ret =uvc_query_ctrl (chain->dev,UVC_GET_CUR , ctrl->entity->id, - chain->dev->intfnum, ctrl->info.selector, +if (ctrl->entity->get_cur) { + ret = ctrl->entity->get_cur (chain->dev, + ctrl->entity, + ctrl->info.selector,uvc_ctrl_data (ctrl,UVC_CTRL_DATA_CURRENT ), ctrl->info.size); + }else { + ret =uvc_query_ctrl (chain->dev,UVC_GET_CUR , + ctrl->entity->id, + chain->dev->intfnum, + ctrl->info.selector, +uvc_ctrl_data (ctrl,UVC_CTRL_DATA_CURRENT ), + ctrl->info.size); + }if (ret <0 )return ret;
@@ -1718,8 +1728,12 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev,if (data ==NULL )return -ENOMEM ; - ret =uvc_query_ctrl (dev,UVC_GET_INFO , ctrl->entity->id, dev->intfnum, - info->selector, data,1 ); +if (ctrl->entity->get_info) + ret = ctrl->entity->get_info (dev, ctrl->entity, + ctrl->info.selector, data); +else + ret =uvc_query_ctrl (dev,UVC_GET_INFO , ctrl->entity->id, + dev->intfnum, info->selector, data,1 );if (!ret) info->flags |= (data[0 ] &UVC_CONTROL_CAP_GET ?UVC_CTRL_FLAG_GET_CUR :0 )
drivers/media/usb/uvc/uvcvideo.h +5 -0
@@ -350,6 +350,11 @@ struct uvc_entity {u8 bNrInPins;u8 *baSourceID; +int (*get_info)(struct uvc_device *dev,struct uvc_entity *entity, +u8 cs,u8 *caps); +int (*get_cur)(struct uvc_device *dev,struct uvc_entity *entity, +u8 cs,void *data,u16 size); +unsigned int ncontrols;struct uvc_control *controls; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/259 media: uvcvideo: Override default flags
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Schaefer <[email protected]>
[ Upstream commit 86419686e66da5b90a07fb8a40ab138fe97189b5 ]
When the UVC device has a control that is readonly it doesn't set the SET_CUR flag. For example the privacy control has SET_CUR flag set in the defaults in the uvc_ctrls variable. Even if the device does not have it set, it's not cleared by uvc_ctrl_get_flags().
Originally written with assignment in commit 859086ae3636 ("media:
uvcvideo: Apply flags from device to actual properties"). But changed to |= in commit 0dc68cabdb62 ("media: uvcvideo: Prevent setting unavailable flags"). It would not clear the default flags.
With this patch applied the correct flags are reported to user space. Tested with:
``` > v4l2-ctl --list-ctrls | grep privacy privacy 0x009a0910 (bool) : default=0 value=0 flags=read-only ```
--- drivers/media/usb/uvc/uvc_ctrl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_ctrl.c +8 -1
@@ -1734,7 +1734,13 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev,else ret =uvc_query_ctrl (dev,UVC_GET_INFO , ctrl->entity->id, dev->intfnum, info->selector, data,1 ); -if (!ret) + +if (!ret) { + info->flags &= ~(UVC_CTRL_FLAG_GET_CUR | +UVC_CTRL_FLAG_SET_CUR | +UVC_CTRL_FLAG_AUTO_UPDATE | +UVC_CTRL_FLAG_ASYNCHRONOUS ); + info->flags |= (data[0 ] &UVC_CONTROL_CAP_GET ?UVC_CTRL_FLAG_GET_CUR :0 ) | (data[0] & UVC_CONTROL_CAP_SET ?
@@ -1743,6 +1749,7 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, UVC_CTRL_FLAG_AUTO_UPDATE : 0) | (data[0 ] &UVC_CONTROL_CAP_ASYNCHRONOUS ?UVC_CTRL_FLAG_ASYNCHRONOUS :0 ); + }kfree (data);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/259 media: renesas: vsp1: Fix _irqsave and _irq mix
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit 57edbbcf5258c378a9b9d0c80d33b03a010b22c8 ]
The histogram support mixes _irqsave and _irq, causing the following smatch warning:
drivers/media/platform/renesas/vsp1/vsp1_histo.c:153 histo_stop_streaming()
warn: mixing irqsave and irq
The histo_stop_streaming() calls spin_lock_irqsave() followed by wait_event_lock_irq(). The former hints that interrupts may be disabled by the caller, while the latter reenables interrupts unconditionally. This doesn't cause any real bug, as the function is always called with interrupts enabled, but the pattern is still incorrect.
Fix the problem by using spin_lock_irq() instead of spin_lock_irqsave() in histo_stop_streaming(). While at it, switch to spin_lock_irq() and spin_lock() as appropriate elsewhere.
--- drivers/media/platform/vsp1/vsp1_histo.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/media/platform/vsp1/vsp1_histo.c +8 -12
@@ -36,9 +36,8 @@ struct vsp1_histogram_buffer * vsp1_histogram_buffer_get(struct vsp1_histogram *histo) {struct vsp1_histogram_buffer *buf =NULL ; -unsigned long flags; -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock (&histo->irqlock);if (list_empty (&histo->irqqueue)) goto done;
@@ -49,7 +48,7 @@ vsp1_histogram_buffer_get(struct vsp1_histogram *histo) histo->readout = true; done: -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock (&histo->irqlock);return buf; }
@@ -58,7 +57,6 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo, size_t size) {struct vsp1_pipeline *pipe = histo->entity.pipe; -unsigned long flags;/* * The pipeline pointer is guaranteed to be valid as this function is
@@ -70,10 +68,10 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo,vb2_set_plane_payload (&buf->buf.vb2_buf,0 , size);vb2_buffer_done (&buf->buf.vb2_buf,VB2_BUF_STATE_DONE ); -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock (&histo->irqlock); histo->readout = false;wake_up (&histo->wait_queue); -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock (&histo->irqlock); }/* -----------------------------------------------------------------------------
@@ -124,11 +122,10 @@ static void histo_buffer_queue(struct vb2_buffer *vb)struct vb2_v4l2_buffer *vbuf =to_vb2_v4l2_buffer (vb);struct vsp1_histogram *histo =vb2_get_drv_priv (vb->vb2_queue);struct vsp1_histogram_buffer *buf =to_vsp1_histogram_buffer (vbuf); -unsigned long flags; -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock_irq (&histo->irqlock);list_add_tail (&buf->queue, &histo->irqqueue); -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock_irq (&histo->irqlock); }static int histo_start_streaming (struct vb2_queue *vq,unsigned int count)
@@ -140,9 +137,8 @@ static void histo_stop_streaming(struct vb2_queue *vq) {struct vsp1_histogram *histo =vb2_get_drv_priv (vq);struct vsp1_histogram_buffer *buffer; -unsigned long flags; -spin_lock_irqsave (&histo->irqlock, flags); +spin_lock_irq (&histo->irqlock);/* Remove all buffers from the IRQ queue. */ list_for_each_entry (buffer, &histo->irqqueue, queue)
@@ -152,7 +148,7 @@ static void histo_stop_streaming(struct vb2_queue *vq)/* Wait for the buffer being read out (if any) to complete. */ wait_event_lock_irq (histo->wait_queue, !histo->readout, histo->irqlock); -spin_unlock_irqrestore (&histo->irqlock, flags); +spin_unlock_irq (&histo->irqlock); }static const struct vb2_ops histo_video_queue_qops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/259 media: renesas: vsp1: Store RPF partition configuration per RPF instance
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
[ Upstream commit a213bc09b1025c771ee722ee341af1d84375db8a ]
The vsp1_partition structure stores the RPF partition configuration in a single field for all RPF instances, while each RPF can have its own configuration. Fix it by storing the configuration separately for each RPF instance.
--- drivers/media/platform/vsp1/vsp1_pipe.h | 2 +- drivers/media/platform/vsp1/vsp1_rpf.c | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/media/platform/vsp1/vsp1_pipe.h +1 -1
@@ -73,7 +73,7 @@ struct vsp1_partition_window {* @wpf: The WPF partition window configuration */ struct vsp1_partition { -struct vsp1_partition_window rpf; +struct vsp1_partition_window rpf[VSP1_MAX_RPF ];struct vsp1_partition_window uds_sink;struct vsp1_partition_window uds_source;struct vsp1_partition_window sru;
drivers/media/platform/vsp1/vsp1_rpf.c +5 -3
@@ -271,8 +271,8 @@ static void rpf_configure_partition(struct vsp1_entity *entity,* 'width' need to be adjusted. */ if (pipe->partitions >1 ) { - crop.width = pipe->partition->rpf.width; - crop.left += pipe->partition->rpf.left; + crop.width = pipe->partition->rpf[rpf->entity.index].width; + crop.left += pipe->partition->rpf[rpf->entity.index].left; }if (pipe->interlaced) {
@@ -327,7 +327,9 @@ static void rpf_partition(struct vsp1_entity *entity,unsigned int partition_idx, struct vsp1_partition_window *window) { - partition->rpf = *window; + struct vsp1_rwpf *rpf = to_rwpf(&entity->subdev); + + partition->rpf[rpf->entity.index] = *window; } static const struct vsp1_entity_operations rpf_entity_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/259 leds: trigger: Unregister sysfs attributes before calling deactivate()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit c0dc9adf9474ecb7106e60e5472577375aedaed3 ]
Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate() callback and freed by the deactivate() callback.
Calling device_remove_groups() after calling deactivate() leaves a window where the sysfs attributes show/store functions could be called after deactivation and then operate on the just freed trigger-data.
Move the device_remove_groups() call to before deactivate() to close this race window.
This also makes the deactivation path properly do things in reverse order of the activation path which calls the activate() callback before calling device_add_groups().
--- drivers/leds/led-triggers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/leds/led-triggers.c +1 -1
@@ -121,9 +121,9 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig) flags);cancel_work_sync (&led_cdev->set_brightness_work);led_stop_software_blink (led_cdev); +device_remove_groups (led_cdev->dev, led_cdev->trigger->groups);if (led_cdev->trigger->deactivate) led_cdev->trigger->deactivate (led_cdev); -device_remove_groups (led_cdev->dev, led_cdev->trigger->groups); led_cdev->trigger =NULL ; led_cdev->trigger_data =NULL ; led_cdev->activated = false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/259 perf report: Fix condition in sort__sym_cmp()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit cb39d05e67dc24985ff9f5150e71040fa4d60ab8 ]
It's expected that both hist entries are in the same hists when comparing two. But the current code in the function checks one without dso sort key and other with the key. This would make the condition true in any case.
I guess the intention of the original commit was to add '!' for the right side too. But as it should be the same, let's just remove it.
--- tools/perf/util/sort.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/sort.c +1 -1
@@ -269,7 +269,7 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)* comparing symbol address alone is not enough since it's a * relative address within a dso. */ -if (!hists__has (left->hists, dso) ||hists__has (right->hists, dso)) { +if (!hists__has (left->hists, dso)) { ret =sort__dso_cmp (left, right);if (ret !=0 )return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/259 drm/etnaviv: fix DMA direction handling for cached RW buffers
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <[email protected]>
[ Upstream commit 58979ad6330a70450ed78837be3095107d022ea9 ]
The dma sync operation needs to be done with DMA_BIDIRECTIONAL when the BO is prepared for both read and write operations.
--- drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/etnaviv/etnaviv_gem.c +4 -2
@@ -363,9 +363,11 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj)static inline enum dma_data_direction etnaviv_op_to_dma_dir (u32 op) { -if (op &ETNA_PREP_READ ) + op &=ETNA_PREP_READ |ETNA_PREP_WRITE ; + +if (op ==ETNA_PREP_READ )return DMA_FROM_DEVICE ; -else if (op &ETNA_PREP_WRITE ) +else if (op ==ETNA_PREP_WRITE )return DMA_TO_DEVICE ;else return DMA_BIDIRECTIONAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/259 drm/qxl: Add check for drm_cvt_mode
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 7bd09a2db0f617377027a2bb0b9179e6959edff3 ]
Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference.
--- drivers/gpu/drm/qxl/qxl_display.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/qxl/qxl_display.c +3 -0
@@ -230,6 +230,9 @@ static int qxl_add_mode(struct drm_connector *connector,return 0 ; mode =drm_cvt_mode (dev, width, height,60 , false, false, false); +if (!mode) +return 0 ; +if (preferred) mode->type |=DRM_MODE_TYPE_PREFERRED ; mode->hdisplay = width;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/259 mfd: omap-usb-tll: Use struct_size to allocate tll
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
[ Upstream commit 40176714c818b0b6a2ca8213cdb7654fbd49b742 ]
Commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") changed the memory allocation of 'tll' to consolidate it into a single allocation, introducing an incorrect size calculation.
In particular, the allocation for the array of pointers was converted into a single-pointer allocation.
The memory allocation used to occur in two steps:
tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL); tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch,
GFP_KERNEL);
And it turned that into the following allocation:
tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]),
GFP_KERNEL);
sizeof(tll->ch_clk[nch]) returns the size of a single pointer instead of the expected nch pointers.
This bug went unnoticed because the allocation size was small enough to fit within the minimum size of a memory allocation for this particular case [1].
The complete allocation can still be done at once with the struct_size macro, which comes in handy for structures with a trailing flexible array.
Fix the memory allocation to obtain the original size again.
--- drivers/mfd/omap-usb-tll.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/mfd/omap-usb-tll.c +1 -2
@@ -235,8 +235,7 @@ static int usbtll_omap_probe(struct platform_device *pdev)break ; } - tll =devm_kzalloc (dev,sizeof (*tll) +sizeof (tll->ch_clk[nch]), -GFP_KERNEL ); + tll =devm_kzalloc (dev,struct_size (tll, ch_clk, nch),GFP_KERNEL );if (!tll) {pm_runtime_put_sync (dev);pm_runtime_disable (dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/259 SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
[ Upstream commit 6258cf25d5e3155c3219ab5a79b970eef7996356 ]
Prior to the commit identified below, call_transmit_status() would handle -EPERM and other errors related to an unreachable server by falling through to call_status() which added a 3-second delay and handled the failure as a timeout.
Since that commit, call_transmit_status() falls through to handle_bind(). For UDP this moves straight on to handle_connect() and handle_transmit() so we immediately retransmit - and likely get the same error.
This results in an indefinite loop in __rpc_execute() which triggers a soft-lockup warning.
For the errors that indicate an unreachable server, call_transmit_status() should fall back to call_status() as it did before. This cannot cause the thundering herd that the previous patch was avoiding, as the call_status() will insert a delay.
--- net/sunrpc/clnt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sunrpc/clnt.c +2 -1
@@ -2236,12 +2236,13 @@ call_transmit_status(struct rpc_task *task) task->tk_action = call_transmit; task->tk_status =0 ;break ; -case -ECONNREFUSED :case -EHOSTDOWN :case -ENETDOWN :case -EHOSTUNREACH :case -ENETUNREACH :case -EPERM : +break ; +case -ECONNREFUSED :if (RPC_IS_SOFTCONN (task)) {if (!task->tk_msg.rpc_proc->p_proc) trace_xprt_ping(task->tk_xprt,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/259 ext4: avoid writing unitialized memory to disk in EA inodes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 65121eff3e4c8c90f8126debf3c369228691c591 ]
If the extended attribute size is not a multiple of block size, the last block in the EA inode will have uninitialized tail which will get written to disk. We will never expose the data to userspace but still this is not a good practice so just zero out the tail of the block as it isn't going to cause a noticeable performance overhead.
--- fs/ext4/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/xattr.c +6 -0
@@ -1396,6 +1396,12 @@ static int ext4_xattr_inode_write(handle_t *handle, struct inode *ea_inode, goto out;memcpy (bh->b_data, buf, csize); +/* +* Zero out block tail to avoid writing uninitialized memory +* to disk. +*/ +if (csize < blocksize) +memset (bh->b_data + csize,0 , blocksize - csize);set_buffer_uptodate (bh);ext4_handle_dirty_metadata (handle, ea_inode, bh);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/259 sparc64: Fix incorrect function signature and add prototype for prom_cif_init
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Larsson <[email protected]>
[ Upstream commit a6c3ea1ec96307dbfbb2f16d96c674c5cc80f445 ]
Remove the unused cif_stack argument and add a protype in oplib_64.h Commit ef3e035c3a9b ("sparc64: Fix register corruption in top-most kernel stack frame during boot.") removed the cif_stack argument to prom_cif init in the declaration at the caller site and the usage of it within prom_cif_init, but not in the function signature of the function itself.
This also fixes the following warning:arch/sparc/prom/p1275.c:52:6: warning: no previous prototype for ‘prom_cif_init’
--- arch/sparc/include/asm/oplib_64.h | 1 + arch/sparc/prom/init_64.c | 3 --- arch/sparc/prom/p1275.c | 2 +- 3 files changed, 2 insertions(+), 4 deletions(-)
arch/sparc/include/asm/oplib_64.h +1 -0
@@ -247,6 +247,7 @@ void prom_sun4v_guest_soft_state(void);int prom_ihandle2path (int handle,char *buffer,int bufsize);/* Client interface level routines. */ +void prom_cif_init (void *cif_handler);void p1275_cmd_direct (unsigned long *);#endif /* !(__SPARC64_OPLIB_H) */
arch/sparc/prom/init_64.c +0 -3
@@ -26,9 +26,6 @@ phandle prom_chosen_node;* routines in the prom library. * It gets passed the pointer to the PROM vector. */ - -extern void prom_cif_init (void *); -void __init prom_init (void *cif_handler) {phandle node;
arch/sparc/prom/p1275.c +1 -1
@@ -49,7 +49,7 @@ void p1275_cmd_direct(unsigned long *args)local_irq_restore (flags); } -void prom_cif_init (void *cif_handler,void *cif_stack) +void prom_cif_init (void *cif_handler) { p1275buf.prom_cif_handler = (void (*)(long *))cif_handler; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/259 SUNRPC: Fixup gss_status tracepoint error output
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
[ Upstream commit b9fae9f06d84ffab0f3f9118f3a96bbcdc528bf6 ]
The GSS routine errors are values, not flags.
--- include/trace/events/rpcgss.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/trace/events/rpcgss.h +1 -1
@@ -42,7 +42,7 @@ TRACE_DEFINE_ENUM(GSS_S_UNSEQ_TOKEN);TRACE_DEFINE_ENUM (GSS_S_GAP_TOKEN );#define show_gss_status (x) \ - __print_flags(x, "|", \ + __print_symbolic(x, \ { GSS_S_BAD_MECH, "GSS_S_BAD_MECH" }, \ { GSS_S_BAD_NAME, "GSS_S_BAD_NAME" }, \ { GSS_S_BAD_NAMETYPE, "GSS_S_BAD_NAMETYPE" }, \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/259 PCI: Fix resource double counting on remove & rescan
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 903534fa7d30214d8ba840ab1cd9e917e0c88e41 ]
pbus_size_mem() keeps the size of the optional resources in children_add_size. When calculating the PCI bridge window size, calculate_memsize() lower bounds size by old_size before adding children_add_size and performing the window size alignment. This results in double counting for the resources in children_add_size because old_size may be based on the previous size of the bridge window after it has already included children_add_size (that is, size1 in pbus_size_mem() from an earlier invocation of that function).
As a result, on repeated remove of the bus & rescan cycles the resource size keeps increasing when children_add_size is non-zero as can be seen from this extract:
iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB iomem1: 20000000000-200001fffff : PCI Bus 0000:03 # 2MiB iomem2: 20000000000-200002fffff : PCI Bus 0000:03 # 3MiB iomem3: 20000000000-200003fffff : PCI Bus 0000:03 # 4MiB iomem4: 20000000000-200004fffff : PCI Bus 0000:03 # 5MiB
Solve the double counting by moving old_size check later in calculate_memsize() so that children_add_size is already accounted for.
After the patch, the bridge window retains its size as expected:
iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB iomem1: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB iomem2: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB
--- drivers/pci/setup-bus.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/pci/setup-bus.c +2 -4
@@ -818,11 +818,9 @@ static resource_size_t calculate_memsize(resource_size_t size, size = min_size;if (old_size ==1 ) old_size =0 ; -if (size < old_size) - size = old_size; - size =ALIGN (max (size, add_size) + children_add_size, align); -return size; + size =max (size, add_size) + children_add_size; +return ALIGN (max (size, old_size), align); } resource_size_t __weak pcibios_window_alignment(struct pci_bus *bus,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/259 Input: qt1050 - handle CHIP_ID reading error
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Lalaev <[email protected]>
[ Upstream commit 866a5c7e2781cf1b019072288f1f5c64186dcb63 ]
If the device is missing, we get the following error:
qt1050 3-0041: ID -1340767592 not supported
Let's handle this situation and print more informative error when reading of CHIP_ID fails:
qt1050 3-0041: Failed to read chip ID: -6
--- drivers/input/keyboard/qt1050.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/input/keyboard/qt1050.c +6 -1
@@ -226,7 +226,12 @@ static bool qt1050_identify(struct qt1050_priv *ts)int err;/* Read Chip ID */ -regmap_read (ts->regmap,QT1050_CHIP_ID , &val); + err =regmap_read (ts->regmap,QT1050_CHIP_ID , &val); +if (err) { +dev_err (&ts->client->dev,"Failed to read chip ID: %d\n" , err); +return false; + } +if (val !=QT1050_CHIP_ID_VER ) {dev_err (&ts->client->dev,"ID %d not supported\n" , val);return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/259 RDMA/mlx4: Fix truncated output warning in mad.c
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 0d2e6992fc956e3308cd5376c18567def4cb3967 ]
Increase size of the name array to avoid truncated output warning.
drivers/infiniband/hw/mlx4/mad.c: In function ‘mlx4_ib_alloc_demux_ctx’:drivers/infiniband/hw/mlx4/mad.c:2197:47: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 4 [-Werror=format-truncation=]
2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port);
| ^~drivers/infiniband/hw/mlx4/mad.c:2197:38: note: directive argument in the range [-2147483645, 2147483647]
2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port);
| ^~~~~~~~~~~~
drivers/infiniband/hw/mlx4/mad.c:2197:9: note: ‘snprintf’ output between
10 and 20 bytes into a destination of size 12
2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/infiniband/hw/mlx4/mad.c:2205:48: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 3 [-Werror=format-truncation=]
2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
| ^~drivers/infiniband/hw/mlx4/mad.c:2205:38: note: directive argument in the range [-2147483645, 2147483647]
2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
| ^~~~~~~~~~~~~
drivers/infiniband/hw/mlx4/mad.c:2205:9: note: ‘snprintf’ output between
11 and 21 bytes into a destination of size 12
2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/infiniband/hw/mlx4/mad.c:2213:48: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 3 [-Werror=format-truncation=]
2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port);
| ^~drivers/infiniband/hw/mlx4/mad.c:2213:38: note: directive argument in the range [-2147483645, 2147483647]
2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port);
| ^~~~~~~~~~~~~
drivers/infiniband/hw/mlx4/mad.c:2213:9: note: ‘snprintf’ output between
11 and 21 bytes into a destination of size 12
2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:244: drivers/infiniband/hw/mlx4/mad.o] Error 1
--- drivers/infiniband/hw/mlx4/mad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx4/mad.c +1 -1
@@ -2167,7 +2167,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,struct mlx4_ib_demux_ctx *ctx, int port) { - char name[12]; + char name[21];int ret =0 ;int i;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/259 RDMA/mlx4: Fix truncated output warning in alias_GUID.c
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 5953e0647cec703ef436ead37fed48943507b433 ]
drivers/infiniband/hw/mlx4/alias_GUID.c: In function ‘mlx4_ib_init_alias_guid_service’:drivers/infiniband/hw/mlx4/alias_GUID.c:878:74: error: ‘%d’ directive
output may be truncated writing between 1 and 11 bytes into a region of
size 5 [-Werror=format-truncation=]
878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i);
| ^~drivers/infiniband/hw/mlx4/alias_GUID.c:878:63: note: directive argument in the range [-2147483641, 2147483646]
878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i);
| ^~~~~~~~~~~~~~drivers/infiniband/hw/mlx4/alias_GUID.c:878:17: note: ‘snprintf’ output
between 12 and 22 bytes into a destination of size 15
878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
--- drivers/infiniband/hw/mlx4/alias_GUID.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mlx4/alias_GUID.c +1 -1
@@ -832,7 +832,7 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev *dev)int mlx4_ib_init_alias_guid_service (struct mlx4_ib_dev *dev) { -char alias_wq_name[15 ]; +char alias_wq_name[22 ];int ret =0 ;int i, j;union ib_gid gid;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/259 RDMA/rxe: Dont set BTH_ACK_MASK for UC or UD QPs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honggang LI <[email protected]>
[ Upstream commit 4adcaf969d77d3d3aa3871bbadc196258a38aec6 ]
BTH_ACK_MASK bit is used to indicate that an acknowledge (for this packet) should be scheduled by the responder. Both UC and UD QPs are unacknowledged, so don't set BTH_ACK_MASK for UC or UD QPs.
--- drivers/infiniband/sw/rxe/rxe_req.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/infiniband/sw/rxe/rxe_req.c +4 -3
@@ -390,7 +390,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,int solicited;u16 pkey;u32 qp_num; -int ack_req; +int ack_req =0 ;/* length from start of bth to end of icrc */ paylen = rxe_opcode[opcode].length + payload + pad +RXE_ICRC_SIZE ;
@@ -426,8 +426,9 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp, qp_num = (pkt->mask &RXE_DETH_MASK ) ? ibwr->wr.ud.remote_qpn : qp->attr.dest_qp_num; - ack_req = ((pkt->mask &RXE_END_MASK ) || - (qp->req.noack_pkts++ >RXE_MAX_PKT_PER_ACK )); +if (qp_type (qp) !=IB_QPT_UD &&qp_type (qp) !=IB_QPT_UC ) + ack_req = ((pkt->mask &RXE_END_MASK ) || + (qp->req.noack_pkts++ >RXE_MAX_PKT_PER_ACK ));if (ack_req) qp->req.noack_pkts =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/259 ASoC: max98088: Check for clk_prepare_enable() error
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit 1a70579723fde3624a72dfea6e79e55be6e36659 ]
clk_prepare_enable() may fail, so we should better check its return value and propagate it in the case of error.
--- sound/soc/codecs/max98088.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/codecs/max98088.c +7 -3
@@ -1317,6 +1317,7 @@ static int max98088_set_bias_level(struct snd_soc_component *component, enum snd_soc_bias_level level) {struct max98088_priv *max98088 =snd_soc_component_get_drvdata (component); +int ret;switch (level) {case SND_SOC_BIAS_ON :
@@ -1332,10 +1333,13 @@ static int max98088_set_bias_level(struct snd_soc_component *component,*/ if (!IS_ERR (max98088->mclk)) {if (snd_soc_component_get_bias_level (component) == -SND_SOC_BIAS_ON ) +SND_SOC_BIAS_ON ) {clk_disable_unprepare (max98088->mclk); -else -clk_prepare_enable (max98088->mclk); + }else { + ret =clk_prepare_enable (max98088->mclk); +if (ret) +return ret; + } }break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/259 mtd: make mtd_test.c a separate module
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit a5cf054d325e6f362e82fe6d124a1871a4af8174 ]
This file gets linked into nine different modules, which causes a warning:
scripts/Makefile.build:236: drivers/mtd/tests/Makefile: mtd_test.o is added to multiple modules: mtd_nandbiterrs mtd_oobtest mtd_pagetest mtd_readtest mtd_speedtest mtd_stresstest mtd_subpagetest mtd_torturetest
Make it a separate module instead.
--- drivers/mtd/tests/Makefile | 34 +++++++++++++++++----------------- drivers/mtd/tests/mtd_test.c | 9 +++++++++ 2 files changed, 26 insertions(+), 17 deletions(-)
drivers/mtd/tests/Makefile +17 -17
@@ -1,19 +1,19 @@ # SPDX-License-Identifier: GPL-2.0 -obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o -obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o -obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o -obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o -obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o -obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o -obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o -obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o -obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o +obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o mtd_test.o +obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o mtd_test.o -mtd_oobtest-objs := oobtest.o mtd_test.o -mtd_pagetest-objs := pagetest.o mtd_test.o -mtd_readtest-objs := readtest.o mtd_test.o -mtd_speedtest-objs := speedtest.o mtd_test.o -mtd_stresstest-objs := stresstest.o mtd_test.o -mtd_subpagetest-objs := subpagetest.o mtd_test.o -mtd_torturetest-objs := torturetest.o mtd_test.o -mtd_nandbiterrs-objs := nandbiterrs.o mtd_test.o +mtd_oobtest-objs := oobtest.o +mtd_pagetest-objs := pagetest.o +mtd_readtest-objs := readtest.o +mtd_speedtest-objs := speedtest.o +mtd_stresstest-objs := stresstest.o +mtd_subpagetest-objs := subpagetest.o +mtd_torturetest-objs := torturetest.o +mtd_nandbiterrs-objs := nandbiterrs.o
drivers/mtd/tests/mtd_test.c +9 -0
@@ -25,6 +25,7 @@ int mtdtest_erase_eraseblock(struct mtd_info *mtd, unsigned int ebnum)return 0 ; } +EXPORT_SYMBOL_GPL (mtdtest_erase_eraseblock);static int is_block_bad (struct mtd_info *mtd,unsigned int ebnum) {
@@ -57,6 +58,7 @@ int mtdtest_scan_for_bad_eraseblocks(struct mtd_info *mtd, unsigned char *bbt,return 0 ; } +EXPORT_SYMBOL_GPL (mtdtest_scan_for_bad_eraseblocks);int mtdtest_erase_good_eraseblocks (struct mtd_info *mtd,unsigned char *bbt,unsigned int eb,int ebcnt)
@@ -75,6 +77,7 @@ int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt,return 0 ; } +EXPORT_SYMBOL_GPL (mtdtest_erase_good_eraseblocks);int mtdtest_read (struct mtd_info *mtd,loff_t addr,size_t size,void *buf) {
@@ -92,6 +95,7 @@ int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf)return err; } +EXPORT_SYMBOL_GPL (mtdtest_read);int mtdtest_write (struct mtd_info *mtd,loff_t addr,size_t size,const void *buf)
@@ -107,3 +111,8 @@ int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size,return err; } +EXPORT_SYMBOL_GPL (mtdtest_write); + +MODULE_LICENSE ("GPL" ); +MODULE_DESCRIPTION ("MTD function test helpers" ); +MODULE_AUTHOR ("Akinobu Mita" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/259 RDMA/device: Return error earlier if port in not valid
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit 917918f57a7b139c043e78c502876f2c286f4f0a ]
There is no need to allocate port data if port provided is not valid.
--- drivers/infiniband/core/device.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/infiniband/core/device.c +3 -3
@@ -2125,6 +2125,9 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev,unsigned long flags;int ret; +if (!rdma_is_port_valid (ib_dev, port)) +return -EINVAL ; +/* * Drivers wish to call this before ib_register_driver, so we have to * setup the port data early.
@@ -2133,9 +2136,6 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev,if (ret)return ret; -if (!rdma_is_port_valid (ib_dev, port)) -return -EINVAL ; - pdata = &ib_dev->port_data[port];spin_lock_irqsave (&pdata->netdev_lock, flags); old_ndev = rcu_dereference_protected(
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/259 Input: elan_i2c - do not leave interrupt disabled on suspend failure
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
[ Upstream commit 5f82c1e04721e7cd98e604eb4e58f0724d8e5a65 ]
Make sure interrupts are not left disabled when we fail to suspend the touch controller.
--- drivers/input/mouse/elan_i2c_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/mouse/elan_i2c_core.c +2 -0
@@ -1295,6 +1295,8 @@ static int __maybe_unused elan_suspend(struct device *dev) } err: +if (ret) +enable_irq (client->irq);mutex_unlock (&data->sysfs_mutex);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/259 MIPS: Octeron: remove source file executable bit
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
[ Upstream commit 89c7f5078935872cf47a713a645affb5037be694 ]
This does not matter the least, but there is no other .[ch] file in the repo that is executable, so clean this up.
--- arch/mips/pci/pcie-octeon.c | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 arch/mips/pci/pcie-octeon.c
arch/mips/pci/pcie-octeon.c +0 -0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/259 powerpc/xmon: Fix disassembly CPU feature checks
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 14196e47c5ffe32af7ed5a51c9e421c5ea5bccce ]
In the xmon disassembly code there are several CPU feature checks to determine what dialects should be passed to the disassembler. The dialect controls which instructions the disassembler will recognise.
Unfortunately the checks are incorrect, because instead of passing a single CPU feature they are passing a mask of feature bits.
For example the code:
if (cpu_has_feature(CPU_FTRS_POWER5))
dialect |= PPC_OPCODE_POWER5;Is trying to check if the system is running on a Power5 CPU. But CPU_FTRS_POWER5 is a mask of *all* the feature bits that are enabled on a Power5.
In practice the test will always return true for any 64-bit CPU, because at least one bit in the mask will be present in the CPU_FTRS_ALWAYS mask.
Similarly for all the other checks against CPU_FTRS_xx masks.
Rather than trying to match the disassembly behaviour exactly to the current CPU, just differentiate between 32-bit and 64-bit, and Altivec, VSX and HTM.
That will cause some instructions to be shown in disassembly even on a CPU that doesn't support them, but that's OK, objdump -d output has the same behaviour, and if anything it's less confusing than some instructions not being disassembled.
--- arch/powerpc/xmon/ppc-dis.c | 33 +++++++++++---------------------- 1 file changed, 11 insertions(+), 22 deletions(-)
arch/powerpc/xmon/ppc-dis.c +11 -22
@@ -122,32 +122,21 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr)bool insn_is_short;ppc_cpu_t dialect; - dialect =PPC_OPCODE_PPC |PPC_OPCODE_COMMON - |PPC_OPCODE_64 |PPC_OPCODE_POWER4 |PPC_OPCODE_ALTIVEC ; + dialect =PPC_OPCODE_PPC |PPC_OPCODE_COMMON ; -if (cpu_has_feature (CPU_FTRS_POWER5 )) - dialect |=PPC_OPCODE_POWER5 ; +if (IS_ENABLED (CONFIG_PPC64 )) + dialect |=PPC_OPCODE_64 |PPC_OPCODE_POWER4 |PPC_OPCODE_CELL | +PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 |PPC_OPCODE_POWER8 | +PPC_OPCODE_POWER9 ; -if (cpu_has_feature (CPU_FTRS_CELL )) - dialect |= (PPC_OPCODE_CELL |PPC_OPCODE_ALTIVEC ); +if (cpu_has_feature (CPU_FTR_TM )) + dialect |=PPC_OPCODE_HTM ; -if (cpu_has_feature (CPU_FTRS_POWER6 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_ALTIVEC ); +if (cpu_has_feature (CPU_FTR_ALTIVEC )) + dialect |=PPC_OPCODE_ALTIVEC |PPC_OPCODE_ALTIVEC2 ; -if (cpu_has_feature (CPU_FTRS_POWER7 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 - |PPC_OPCODE_ALTIVEC |PPC_OPCODE_VSX ); - -if (cpu_has_feature (CPU_FTRS_POWER8 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 - |PPC_OPCODE_POWER8 |PPC_OPCODE_HTM - |PPC_OPCODE_ALTIVEC |PPC_OPCODE_ALTIVEC2 |PPC_OPCODE_VSX ); - -if (cpu_has_feature (CPU_FTRS_POWER9 )) - dialect |= (PPC_OPCODE_POWER5 |PPC_OPCODE_POWER6 |PPC_OPCODE_POWER7 - |PPC_OPCODE_POWER8 |PPC_OPCODE_POWER9 |PPC_OPCODE_HTM - |PPC_OPCODE_ALTIVEC |PPC_OPCODE_ALTIVEC2 - |PPC_OPCODE_VSX |PPC_OPCODE_VSX3 ); +if (cpu_has_feature (CPU_FTR_VSX )) + dialect |=PPC_OPCODE_VSX |PPC_OPCODE_VSX3 ;/* Get the major opcode of the insn. */ opcode =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/259 macintosh/therm_windtunnel: fix module unload.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Bowler <[email protected]>
[ Upstream commit fd748e177194ebcbbaf98df75152a30e08230cc6 ]
The of_device_unregister call in therm_windtunnel's module_exit procedure does not fully reverse the effects of of_platform_device_create in the module_init prodedure. Once you unload this module, it is impossible to load it ever again since only the first of_platform_device_create call on the fan node succeeds.
This driver predates first git commit, and it turns out back then of_platform_device_create worked differently than it does today. So this is actually an old regression.
The appropriate function to undo of_platform_device_create now appears to be of_platform_device_destroy, and switching to use this makes it possible to unload and load the module as expected.
--- drivers/macintosh/therm_windtunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/macintosh/therm_windtunnel.c +1 -1
@@ -549,7 +549,7 @@ g4fan_exit( void )platform_driver_unregister ( &therm_of_driver );if ( x.of_dev ) -of_device_unregister ( x.of_dev ); +of_platform_device_destroy (&x.of_dev->dev,NULL ); }module_init (g4fan_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/259 bnxt_re: Fix imm_data endianness
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Wang <[email protected]>
[ Upstream commit 95b087f87b780daafad1dbb2c84e81b729d5d33f ]
When map a device between servers with MLX and BCM RoCE nics, RTRS server complain about unknown imm type, and can't map the device,
After more debug, it seems bnxt_re wrongly handle the imm_data, this patch fixed the compat issue with MLX for us.
In off list discussion, Selvin confirmed HW is working in little endian format and all data needs to be converted to LE while providing.
This patch fix the endianness for imm_data
--- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++---- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +4 -4
@@ -2271,7 +2271,7 @@ static int bnxt_re_build_send_wqe(struct bnxt_re_qp *qp,break ;case IB_WR_SEND_WITH_IMM : wqe->type =BNXT_QPLIB_SWQE_TYPE_SEND_WITH_IMM ; - wqe->send.imm_data = wr->ex.imm_data; + wqe->send.imm_data =be32_to_cpu (wr->ex.imm_data);break ;case IB_WR_SEND_WITH_INV : wqe->type =BNXT_QPLIB_SWQE_TYPE_SEND_WITH_INV ;
@@ -2301,7 +2301,7 @@ static int bnxt_re_build_rdma_wqe(const struct ib_send_wr *wr,break ;case IB_WR_RDMA_WRITE_WITH_IMM : wqe->type =BNXT_QPLIB_SWQE_TYPE_RDMA_WRITE_WITH_IMM ; - wqe->rdma.imm_data = wr->ex.imm_data; + wqe->rdma.imm_data =be32_to_cpu (wr->ex.imm_data);break ;case IB_WR_RDMA_READ : wqe->type =BNXT_QPLIB_SWQE_TYPE_RDMA_READ ;
@@ -3250,7 +3250,7 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp, wc->byte_len = orig_cqe->length; wc->qp = &gsi_qp->ib_qp; - wc->ex.imm_data = orig_cqe->immdata; + wc->ex.imm_data =cpu_to_be32 (le32_to_cpu (orig_cqe->immdata)); wc->src_qp = orig_cqe->src_qp;memcpy (wc->smac, orig_cqe->smac,ETH_ALEN );if (bnxt_re_is_vlan_pkt (orig_cqe, &vlan_id, &sl)) {
@@ -3391,7 +3391,7 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)continue ; } wc->qp = &qp->ib_qp; - wc->ex.imm_data = cqe->immdata; + wc->ex.imm_data =cpu_to_be32 (le32_to_cpu (cqe->immdata)); wc->src_qp = cqe->src_qp;memcpy (wc->smac, cqe->smac,ETH_ALEN ); wc->port_num =1 ;
drivers/infiniband/hw/bnxt_re/qplib_fp.h +3 -3
@@ -145,7 +145,7 @@ struct bnxt_qplib_swqe {/* Send, with imm, inval key */ struct {union { -__be32 imm_data; +u32 imm_data;u32 inv_key; };u32 q_key;
@@ -163,7 +163,7 @@ struct bnxt_qplib_swqe {/* RDMA write, with imm, read */ struct {union { -__be32 imm_data; +u32 imm_data;u32 inv_key; };u64 remote_va;
@@ -350,7 +350,7 @@ struct bnxt_qplib_cqe {u16 cfa_meta;u64 wr_id;union { -__be32 immdata; +__le32 immdata;u32 invrkey; };u64 qp_handle;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/259 netfilter: ctnetlink: use helper function to calculate expect ID
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 782161895eb4ac45cf7cfa8db375bd4766cb8299 ]
Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace.
--- net/netfilter/nf_conntrack_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_netlink.c +2 -1
@@ -3129,7 +3129,8 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl,if (cda[CTA_EXPECT_ID ]) {__be32 id =nla_get_be32 (cda[CTA_EXPECT_ID ]); -if (ntohl (id) != (u32 )(unsigned long )exp) { + +if (id !=nf_expect_get_id (exp)) {nf_ct_expect_put (exp);return -ENOENT ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/259 pinctrl: core: fix possible memory leak when pinctrl_enable() fails
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit ae1cf4759972c5fe665ee4c5e0c29de66fe3cf4a ]
In devm_pinctrl_register(), if pinctrl_enable() fails in pinctrl_register(), the "pctldev" has not been added to dev resources, so devm_pinctrl_dev_release() can not be called, it leads memory leak.
Introduce pinctrl_uninit_controller(), call it in the error path to free memory.
--- drivers/pinctrl/core.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/pinctrl/core.c +11 -1
@@ -2017,6 +2017,14 @@ pinctrl_init_controller(struct pinctrl_desc *pctldesc, struct device *dev,return ERR_PTR (ret); } +static void pinctrl_uninit_controller (struct pinctrl_dev *pctldev,struct pinctrl_desc *pctldesc) +{ +pinctrl_free_pindescs (pctldev, pctldesc->pins, + pctldesc->npins); +mutex_destroy (&pctldev->mutex); +kfree (pctldev); +} +static int pinctrl_claim_hogs (struct pinctrl_dev *pctldev) { pctldev->p =create_pinctrl (pctldev->dev, pctldev);
@@ -2097,8 +2105,10 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc,return pctldev; error =pinctrl_enable (pctldev); -if (error) +if (error) { +pinctrl_uninit_controller (pctldev, pctldesc);return ERR_PTR (error); + }return pctldev;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/259 pinctrl: single: fix possible memory leak when pinctrl_enable() fails
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit 8f773bfbdd428819328a2d185976cfc6ae811cd3 ]
This driver calls pinctrl_register_and_init() which is not devm_ managed, it will leads memory leak if pinctrl_enable() fails. Replace it with devm_pinctrl_register_and_init(). And call pcs_free_resources() if pinctrl_enable() fails.
--- drivers/pinctrl/pinctrl-single.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/pinctrl/pinctrl-single.c +4 -3
@@ -1311,7 +1311,6 @@ static void pcs_irq_free(struct pcs_device *pcs)static void pcs_free_resources (struct pcs_device *pcs) {pcs_irq_free (pcs); -pinctrl_unregister (pcs->pctl);#if IS_BUILTIN (CONFIG_PINCTRL_SINGLE )if (pcs->missing_nr_pinctrl_cells)
@@ -1864,7 +1863,7 @@ static int pcs_probe(struct platform_device *pdev)if (ret <0 ) goto free; - ret =pinctrl_register_and_init (&pcs->desc, pcs->dev, pcs, &pcs->pctl); + ret =devm_pinctrl_register_and_init (pcs->dev, &pcs->desc, pcs, &pcs->pctl);if (ret) {dev_err (pcs->dev,"could not register single pinctrl driver\n" ); goto free;
@@ -1897,8 +1896,10 @@ static int pcs_probe(struct platform_device *pdev)dev_info (pcs->dev,"%i pins, size %u\n" , pcs->desc.npins, pcs->size); -return pinctrl_enable (pcs->pctl); +if (pinctrl_enable (pcs->pctl)) + goto free; +return 0 ; free:pcs_free_resources (pcs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/259 pinctrl: ti: ti-iodelay: Drop if block with always false condition
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit 88b3f108502bc45e6ebd005702add46759f3f45a ]
ti_iodelay_remove() is only called after ti_iodelay_probe() completed successfully. In this case platform_set_drvdata() was called with a non-NULL argument and so platform_get_drvdata() won't return NULL.
Simplify by removing the if block with the always false condition.
Stable-dep-of: 9b401f4a7170 ("pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails")
--- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 3 --- 1 file changed, 3 deletions(-)
drivers/pinctrl/ti/pinctrl-ti-iodelay.c +0 -3
@@ -906,9 +906,6 @@ static int ti_iodelay_remove(struct platform_device *pdev) {struct ti_iodelay_device *iod =platform_get_drvdata (pdev); -if (!iod) -return 0 ; -if (iod->pctl)pinctrl_unregister (iod->pctl);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/259 pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit 9b401f4a7170125365160c9af267a41ff6b39001 ]
This driver calls pinctrl_register_and_init() which is not devm_ managed, it will leads memory leak if pinctrl_enable() fails. Replace it with devm_pinctrl_register_and_init(). And add missing of_node_put() in the error path.
--- drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/pinctrl/ti/pinctrl-ti-iodelay.c +6 -5
@@ -881,7 +881,7 @@ static int ti_iodelay_probe(struct platform_device *pdev) iod->desc.name =dev_name (dev); iod->desc.owner =THIS_MODULE ; - ret =pinctrl_register_and_init (&iod->desc, dev, iod, &iod->pctl); + ret =devm_pinctrl_register_and_init (dev, &iod->desc, iod, &iod->pctl);if (ret) {dev_err (dev,"Failed to register pinctrl\n" ); goto exit_out;
@@ -889,7 +889,11 @@ static int ti_iodelay_probe(struct platform_device *pdev)platform_set_drvdata (pdev, iod); -return pinctrl_enable (iod->pctl); + ret =pinctrl_enable (iod->pctl); +if (ret) + goto exit_out; + +return 0 ; exit_out:of_node_put (np);
@@ -906,9 +910,6 @@ static int ti_iodelay_remove(struct platform_device *pdev) {struct ti_iodelay_device *iod =platform_get_drvdata (pdev); -if (iod->pctl) -pinctrl_unregister (iod->pctl); -ti_iodelay_pinconf_deinit_dev (iod);/* Expect other allocations to be freed by devm */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/259 pinctrl: freescale: mxs: Fix refcount of child
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 7f500f2011c0bbb6e1cacab74b4c99222e60248e ]
of_get_next_child() will increase refcount of the returned node, need use of_node_put() on it when done.
Per current implementation, 'child' will be override by for_each_child_of_node(np, child), so use of_get_child_count to avoid refcount leakage.
--- drivers/pinctrl/freescale/pinctrl-mxs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/freescale/pinctrl-mxs.c +2 -2
@@ -405,8 +405,8 @@ static int mxs_pinctrl_probe_dt(struct platform_device *pdev,int ret;u32 val; - child =of_get_next_child (np,NULL ); -if (!child) { + val =of_get_child_count (np); +if (val ==0 ) {dev_err (&pdev->dev,"no group is defined\n" );return -ENOENT ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/259 fs/nilfs2: remove some unused macros to tame gcc
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Shi <[email protected]>
[ Upstream commit e7920b3e9d9f5470d5ff7d883e72a47addc0a137 ]
There some macros are unused and cause gcc warning. Remove them.
fs/nilfs2/segment.c:137:0: warning: macro "nilfs_cnt32_gt" is not used [-Wunused-macros] fs/nilfs2/segment.c:144:0: warning: macro "nilfs_cnt32_le" is not used [-Wunused-macros] fs/nilfs2/segment.c:143:0: warning: macro "nilfs_cnt32_lt" is not used [-Wunused-macros]
Stable-dep-of: 0f3819e8c483 ("nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro")
--- fs/nilfs2/segment.c | 5 ----- 1 file changed, 5 deletions(-)
fs/nilfs2/segment.c +0 -5
@@ -134,14 +134,9 @@ static void nilfs_segctor_do_flush(struct nilfs_sc_info *, int);static void nilfs_segctor_do_immediate_flush (struct nilfs_sc_info *);static void nilfs_dispose_list (struct the_nilfs *,struct list_head *,int ); -#define nilfs_cnt32_gt (a, b) \ - (typecheck(__u32, a) && typecheck(__u32, b) && \ - ((__s32)(b) - (__s32)(a) < 0))#define nilfs_cnt32_ge (a, b) \ (typecheck(__u32, a) && typecheck(__u32, b) && \ ((__s32)(a) - (__s32)(b) >= 0)) -#define nilfs_cnt32_lt (a, b) nilfs_cnt32_gt(b, a) -#define nilfs_cnt32_le (a, b) nilfs_cnt32_ge(b, a)static int nilfs_prepare_segment_lock (struct super_block *sb,struct nilfs_transaction_info *ti)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/259 nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit 0f3819e8c483771a59cf9d3190cd68a7a990083c ]
According to the C standard 3.4.3p3, the result of signed integer overflow is undefined. The macro nilfs_cnt32_ge(), which compares two sequence numbers, uses signed integer subtraction that can overflow, and therefore the result of the calculation may differ from what is expected due to undefined behavior in different environments.
Similar to an earlier change to the jiffies-related comparison macros in commit 5a581b367b5d ("jiffies: Avoid undefined behavior from signed overflow"), avoid this potential issue by changing the definition of the macro to perform the subtraction as unsigned integers, then cast the result to a signed integer for comparison.
--- fs/nilfs2/segment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nilfs2/segment.c +1 -1
@@ -136,7 +136,7 @@ static void nilfs_dispose_list(struct the_nilfs *, struct list_head *, int);#define nilfs_cnt32_ge (a, b) \ (typecheck(__u32, a) && typecheck(__u32, b) && \ - ((__s32)(a) - (__s32)(b) >= 0)) + ((__s32)((a) - (b)) >= 0))static int nilfs_prepare_segment_lock (struct super_block *sb,struct nilfs_transaction_info *ti)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/259 rtc: interface: Add RTC offset to alarm after fix-up
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <[email protected]>
[ Upstream commit 463927a8902a9f22c3633960119410f57d4c8920 ]
rtc_add_offset() is called by __rtc_read_time() and __rtc_read_alarm() to add the RTC's offset to the raw read-outs from the device drivers. However, in the latter case, a fix-up algorithm is run if the RTC device does not report a full struct rtc_time alarm value. In that case, the offset was forgot to be added.
--- drivers/rtc/interface.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/rtc/interface.c +5 -4
@@ -274,10 +274,9 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)return err;/* full-function RTCs won't have such missing fields */ -if (rtc_valid_tm (&alarm->time) ==0 ) { -rtc_add_offset (rtc, &alarm->time); -return 0 ; - } + err =rtc_valid_tm (&alarm->time); +if (!err) + goto done;/* get the "after" timestamp, to detect wrapped fields */ err =rtc_read_time (rtc, &now);
@@ -379,6 +378,8 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)if (err)dev_warn (&rtc->dev,"invalid alarm value: %ptR\n" , &alarm->time); +else +rtc_add_offset (rtc, &alarm->time);return err; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/259 tick/broadcast: Make takeover of broadcast hrtimer reliable
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Liao <[email protected]>
commit f7d43dd206e7e18c182f200e67a8db8c209907fa upstream.
Running the LTP hotplug stress test on a aarch64 machine results in rcu_sched stall warnings when the broadcast hrtimer was owned by the un-plugged CPU. The issue is the following:
CPU1 (owns the broadcast hrtimer) CPU2
tick_broadcast_enter() // shutdown local timer device broadcast_shutdown_local() ... tick_broadcast_exit() clockevents_switch_state(dev, CLOCK_EVT_STATE_ONESHOT) // timer device is not programmed cpumask_set_cpu(cpu, tick_broadcast_force_mask) initiates offlining of CPU1
take_cpu_down()
/*
* CPU1 shuts down and does not
* send broadcast IPI anymore
*/
takedown_cpu() hotplug_cpu__broadcast_tick_pull() // move broadcast hrtimer to this CPU clockevents_program_event() bc_set_next() hrtimer_start() /* * timer device is not programmed * because only the first expiring * timer will trigger clockevent * device reprogramming */
What happens is that CPU2 exits broadcast mode with force bit set, then the local timer device is not reprogrammed and CPU2 expects to receive the expired event by the broadcast IPI. But this does not happen because CPU1 is offlined by CPU2. CPU switches the clockevent device to ONESHOT state, but does not reprogram the device.
The subsequent reprogramming of the hrtimer broadcast device does not program the clockevent device of CPU2 either because the pending expiry time is already in the past and the CPU expects the event to be delivered. As a consequence all CPUs which wait for a broadcast event to be delivered are stuck forever.
Fix this issue by reprogramming the local timer device if the broadcast force bit of the CPU is set so that the broadcast hrtimer is delivered.
[ tglx: Massage comment and change log. Add Fixes tag ]
--- kernel/time/tick-broadcast.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
kernel/time/tick-broadcast.c +23 -0
@@ -944,6 +944,7 @@ void tick_broadcast_switch_to_oneshot(vo#ifdef CONFIG_HOTPLUG_CPU void hotplug_cpu__broadcast_tick_pull (int deadcpu) { +struct tick_device *td =this_cpu_ptr (&tick_cpu_device);struct clock_event_device *bc;unsigned long flags;
@@ -951,6 +952,28 @@ void hotplug_cpu__broadcast_tick_pull(in bc = tick_broadcast_device.evtdev;if (bc &&broadcast_needs_cpu (bc, deadcpu)) { +/* +* If the broadcast force bit of the current CPU is set, +* then the current CPU has not yet reprogrammed the local +* timer device to avoid a ping-pong race. See +* ___tick_broadcast_oneshot_control(). +* +* If the broadcast device is hrtimer based then +* programming the broadcast event below does not have any +* effect because the local clockevent device is not +* running and not programmed because the broadcast event +* is not earlier than the pending event of the local clock +* event device. As a consequence all CPUs waiting for a +* broadcast event are stuck forever. +* +* Detect this condition and reprogram the cpu local timer +* device to avoid the starvation. +*/ +if (tick_check_broadcast_expired ()) { +cpumask_clear_cpu (smp_processor_id (), tick_broadcast_force_mask); +tick_program_event (td->evtdev->next_event,1 ); + } +/* This moves the broadcast assignment to this CPU: */ clockevents_program_event (bc, bc->next_event,1 ); }
Greg Kroah-Hartman
maintainerPATCH 90/259 net: netconsole: Disable target before netpoll cleanup
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
commit 97d9fba9a812cada5484667a46e14a4c976ca330 upstream.
Currently, netconsole cleans up the netpoll structure before disabling the target. This approach can lead to race conditions, as message senders (write_ext_msg() and write_msg()) check if the target is enabled before using netpoll. The sender can validate that the target is enabled, but, the netpoll might be de-allocated already, causing undesired behaviours.
This patch reverses the order of operations:
1. Disable the target
2. Clean up the netpoll structure
This change eliminates the potential race condition, ensuring that no messages are sent through a partially cleaned-up netpoll structure.
--- drivers/net/netconsole.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/netconsole.c +1 -1
@@ -715,6 +715,7 @@ restart:/* rtnl_lock already held * we might sleep in __netpoll_cleanup() */ + nt->enabled = false;spin_unlock_irqrestore (&target_list_lock, flags);__netpoll_cleanup (&nt->np);
@@ -722,7 +723,6 @@ restart:spin_lock_irqsave (&target_list_lock, flags);dev_put (nt->np.dev); nt->np.dev =NULL ; - nt->enabled = false; stopped = true;netconsole_target_put (nt); goto restart;
Greg Kroah-Hartman
maintainerPATCH 91/259 af_packet: Handle outgoing VLAN packets without hardware offloading
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengen Du <[email protected]>
commit 79eecf631c14e7f4057186570ac20e2cfac3802e upstream.
The issue initially stems from libpcap. The ethertype will be overwritten as the VLAN TPID if the network interface lacks hardware VLAN offloading. In the outbound packet path, if hardware VLAN offloading is unavailable, the VLAN tag is inserted into the payload but then cleared from the sk_buff struct. Consequently, this can lead to a false negative when checking for the presence of a VLAN tag, causing the packet sniffing outcome to lack VLAN tag information (i.e., TCI-TPID). As a result, the packet capturing tool may be unable to parse packets as expected.
The TCI-TPID is missing because the prb_fill_vlan_info() function does not modify the tp_vlan_tci/tp_vlan_tpid values, as the information is in the payload and not in the sk_buff struct. The skb_vlan_tag_present() function only checks vlan_all in the sk_buff struct. In cooked mode, the L2 header is stripped, preventing the packet capturing tool from determining the correct TCI-TPID value. Additionally, the protocol in SLL is incorrect, which means the packet capturing tool cannot parse the L3 header correctly.
--- net/packet/af_packet.c | 86 +++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 84 insertions(+), 2 deletions(-)
net/packet/af_packet.c +84 -2
@@ -492,6 +492,61 @@ static void *packet_current_frame(structreturn packet_lookup_frame (po, rb, rb->head, status); } +static u16 vlan_get_tci (struct sk_buff *skb,struct net_device *dev) +{ +u8 *skb_orig_data = skb->data; +int skb_orig_len = skb->len; +struct vlan_hdr vhdr, *vh; +unsigned int header_len; + +if (!dev) +return 0 ; + +/* In the SOCK_DGRAM scenario, skb data starts at the network +* protocol, which is after the VLAN headers. The outer VLAN +* header is at the hard_header_len offset in non-variable +* length link layer headers. If it's a VLAN device, the +* min_header_len should be used to exclude the VLAN header +* size. +*/ +if (dev->min_header_len == dev->hard_header_len) + header_len = dev->hard_header_len; +else if (is_vlan_dev (dev)) + header_len = dev->min_header_len; +else +return 0 ; + +skb_push (skb, skb->data -skb_mac_header (skb)); + vh =skb_header_pointer (skb, header_len,sizeof (vhdr), &vhdr); +if (skb_orig_data != skb->data) { + skb->data = skb_orig_data; + skb->len = skb_orig_len; + } +if (unlikely (!vh)) +return 0 ; + +return ntohs (vh->h_vlan_TCI); +} + +static __be16 vlan_get_protocol_dgram (struct sk_buff *skb) +{ +__be16 proto = skb->protocol; + +if (unlikely (eth_type_vlan (proto))) { +u8 *skb_orig_data = skb->data; +int skb_orig_len = skb->len; + +skb_push (skb, skb->data -skb_mac_header (skb)); + proto =__vlan_get_protocol (skb, proto,NULL ); +if (skb_orig_data != skb->data) { + skb->data = skb_orig_data; + skb->len = skb_orig_len; + } + } + +return proto; +} +static void prb_del_retire_blk_timer (struct tpacket_kbdq_core *pkc) {del_timer_sync (&pkc->retire_blk_timer);
@@ -967,10 +1022,16 @@ static void prb_clear_rxhash(struct tpacstatic void prb_fill_vlan_info (struct tpacket_kbdq_core *pkc,struct tpacket3_hdr *ppd) { + struct packet_sock *po = container_of(pkc, struct packet_sock, rx_ring.prb_bdqc); +if (skb_vlan_tag_present (pkc->skb)) { ppd->hv1.tp_vlan_tci =skb_vlan_tag_get (pkc->skb); ppd->hv1.tp_vlan_tpid =ntohs (pkc->skb->vlan_proto); ppd->tp_status =TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; + }else if (unlikely (po->sk.sk_type ==SOCK_DGRAM &ð_type_vlan (pkc->skb->protocol))) { + ppd->hv1.tp_vlan_tci =vlan_get_tci (pkc->skb, pkc->skb->dev); + ppd->hv1.tp_vlan_tpid =ntohs (pkc->skb->protocol); + ppd->tp_status =TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; }else { ppd->hv1.tp_vlan_tci =0 ; ppd->hv1.tp_vlan_tpid =0 ;
@@ -2364,6 +2425,10 @@ static int tpacket_rcv(struct sk_buff *s h.h2->tp_vlan_tci =skb_vlan_tag_get (skb); h.h2->tp_vlan_tpid =ntohs (skb->vlan_proto); status |=TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; + }else if (unlikely (sk->sk_type ==SOCK_DGRAM &ð_type_vlan (skb->protocol))) { + h.h2->tp_vlan_tci =vlan_get_tci (skb, skb->dev); + h.h2->tp_vlan_tpid =ntohs (skb->protocol); + status |=TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; }else { h.h2->tp_vlan_tci =0 ; h.h2->tp_vlan_tpid =0 ;
@@ -2393,7 +2458,8 @@ static int tpacket_rcv(struct sk_buff *s sll->sll_halen =dev_parse_header (skb, sll->sll_addr); sll->sll_family =AF_PACKET ; sll->sll_hatype = dev->type; - sll->sll_protocol = skb->protocol; + sll->sll_protocol = (sk->sk_type ==SOCK_DGRAM ) ? +vlan_get_protocol_dgram (skb) : skb->protocol; sll->sll_pkttype = skb->pkt_type;if (unlikely (packet_sock_flag (po,PACKET_SOCK_ORIGDEV ))) sll->sll_ifindex = orig_dev->ifindex;
@@ -3422,7 +3488,8 @@ static int packet_recvmsg(struct socket/* Original length was stored in sockaddr_ll fields */ origlen =PACKET_SKB_CB (skb)->sa.origlen; sll->sll_family =AF_PACKET ; - sll->sll_protocol = skb->protocol; + sll->sll_protocol = (sock->type ==SOCK_DGRAM ) ? +vlan_get_protocol_dgram (skb) : skb->protocol; }sock_recv_ts_and_drops (msg, sk, skb);
@@ -3477,6 +3544,21 @@ static int packet_recvmsg(struct socket aux.tp_vlan_tci =skb_vlan_tag_get (skb); aux.tp_vlan_tpid =ntohs (skb->vlan_proto); aux.tp_status |=TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; + }else if (unlikely (sock->type ==SOCK_DGRAM &ð_type_vlan (skb->protocol))) { +struct sockaddr_ll *sll = &PACKET_SKB_CB (skb)->sa.ll; +struct net_device *dev; + +rcu_read_lock (); + dev =dev_get_by_index_rcu (sock_net (sk), sll->sll_ifindex); +if (dev) { + aux.tp_vlan_tci =vlan_get_tci (skb, dev); + aux.tp_vlan_tpid =ntohs (skb->protocol); + aux.tp_status |=TP_STATUS_VLAN_VALID |TP_STATUS_VLAN_TPID_VALID ; + }else { + aux.tp_vlan_tci =0 ; + aux.tp_vlan_tpid =0 ; + } +rcu_read_unlock (); }else { aux.tp_vlan_tci =0 ; aux.tp_vlan_tpid =0 ;
Greg Kroah-Hartman
maintainerPATCH 92/259 ipv6: take care of scope when choosing the src addr
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dichtel <[email protected]>
commit abb9a68d2c64dd9b128ae1f2e635e4d805e7ce64 upstream.
When the source address is selected, the scope must be checked. For example, if a loopback address is assigned to the vrf device, it must not be chosen for packets sent outside.
--- net/ipv6/addrconf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/addrconf.c +2 -1
@@ -1829,7 +1829,8 @@ int ipv6_dev_get_saddr(struct net *net, master, &dst, scores, hiscore_idx); -if (scores[hiscore_idx].ifa) +if (scores[hiscore_idx].ifa && + scores[hiscore_idx].scopedist >=0 ) goto out; }
Greg Kroah-Hartman
maintainerPATCH 93/259 char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <[email protected]>
commit 5d8e2971e817bb64225fc0b6327a78752f58a9aa upstream.
In tpm_bios_measurements_open(), get_device() is called on the device embedded in struct tpm_chip. In the error path, however, put_device() is not called. This results in a reference count leak, which prevents the device from being properly released. This commit makes sure to call put_device() when the seq_open() call fails.
--- drivers/char/tpm/eventlog/common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/char/tpm/eventlog/common.c +2 -0
@@ -47,6 +47,8 @@ static int tpm_bios_measurements_open(stif (!err) { seq = file->private_data; seq->private = chip; + }else { +put_device (&chip->dev); }return err;
Greg Kroah-Hartman
maintainerPATCH 94/259 media: venus: fix use after free in vdec_close
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dikshita Agarwal <[email protected]>
commit a0157b5aa34eb43ec4c5510f9c260bbb03be937e upstream.
There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst.
Fix it by cancelling the work in vdec_close.
--- drivers/media/platform/qcom/venus/vdec.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/platform/qcom/venus/vdec.c +1 -0
@@ -1400,6 +1400,7 @@ static int vdec_close(struct file *file) {struct venus_inst *inst =to_inst (file); +cancel_work_sync (&inst->delayed_process_work);v4l2_m2m_ctx_release (inst->m2m_ctx);v4l2_m2m_release (inst->m2m_dev);vdec_ctrl_deinit (inst);
Greg Kroah-Hartman
maintainerPATCH 95/259 hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 26a2ed107929a855155429b11e1293b83e6b2a8b upstream.
Syzbot reports uninitialized value access issue as below:
loop0: detected capacity change from 0 to 64
=====================================================
BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [inline] link_path_walk+0x817/0x1480 fs/namei.c:2332 path_lookupat+0xd9/0x6f0 fs/namei.c:2485 filename_lookup+0x22e/0x740 fs/namei.c:2515 user_path_at_empty+0x8b/0x390 fs/namei.c:2924 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3689 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x66b/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline] BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 hfs_ext_read_extent fs/hfs/extent.c:196 [inline] hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271 hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39 filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426 do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553 do_read_cache_page mm/filemap.c:3595 [inline] read_cache_page+0xfb/0x2f0 mm/filemap.c:3604 read_mapping_page include/linux/pagemap.h:755 [inline] hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78 hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204 hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406 mount_bdev+0x628/0x920 fs/super.c:1359 hfs_mount+0xcd/0xe0 fs/hfs/super.c:456 legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610 vfs_get_tree+0xdc/0x5d0 fs/super.c:1489 do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145 path_mount+0xf98/0x26a0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674 __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at:
__alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3018 [inline] hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165 alloc_inode+0x83/0x440 fs/inode.c:260 new_inode_pseudo fs/inode.c:1005 [inline] new_inode+0x38/0x4f0 fs/inode.c:1031 hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186 hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228 vfs_mkdir+0x49a/0x700 fs/namei.c:4126 do_mkdirat+0x529/0x810 fs/namei.c:4149 __do_sys_mkdirat fs/namei.c:4164 [inline] __se_sys_mkdirat fs/namei.c:4162 [inline] __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
It missed to initialize .tz_secondswest, .cached_start and .cached_blocks fields in struct hfs_inode_info after hfs_alloc_inode(), fix it.
--- fs/hfs/inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/hfs/inode.c +3 -0
@@ -199,6 +199,7 @@ struct inode *hfs_new_inode(struct inodeHFS_I (inode)->flags =0 ;HFS_I (inode)->rsrc_inode =NULL ;HFS_I (inode)->fs_blocks =0 ; +HFS_I (inode)->tz_secondswest = sys_tz.tz_minuteswest *60 ;if (S_ISDIR (mode)) { inode->i_size =2 ;HFS_SB (sb)->folder_count++;
@@ -274,6 +275,8 @@ void hfs_inode_read_fork(struct inode *ifor (count =0 , i =0 ; i <3 ; i++) count +=be16_to_cpu (ext[i].count);HFS_I (inode)->first_blocks = count; +HFS_I (inode)->cached_start =0 ; +HFS_I (inode)->cached_blocks =0 ; inode->i_size =HFS_I (inode)->phys_size = log_size;HFS_I (inode)->fs_blocks = (log_size + sb->s_blocksize -1 ) >> sb->s_blocksize_bits;
Greg Kroah-Hartman
maintainerPATCH 96/259 drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit cb520c3f366c77e8d69e4e2e2781a8ce48d98e79 upstream.
In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.
--- drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/gma500/cdv_intel_lvds.c +3 -0
@@ -391,6 +391,9 @@ static int cdv_intel_lvds_get_modes(struif (mode_dev->panel_fixed_mode !=NULL ) {struct drm_display_mode *mode =drm_mode_duplicate (dev, mode_dev->panel_fixed_mode); +if (!mode) +return 0 ; +drm_mode_probed_add (connector, mode);return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 97/259 drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
commit 2df7aac81070987b0f052985856aa325a38debf6 upstream.
In psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.
--- drivers/gpu/drm/gma500/psb_intel_lvds.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/gma500/psb_intel_lvds.c +3 -0
@@ -506,6 +506,9 @@ static int psb_intel_lvds_get_modes(struif (mode_dev->panel_fixed_mode !=NULL ) {struct drm_display_mode *mode =drm_mode_duplicate (dev, mode_dev->panel_fixed_mode); +if (!mode) +return 0 ; +drm_mode_probed_add (connector, mode);return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 98/259 drm/amd/display: Check for NULL pointer
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sung Joon Kim <[email protected]>
commit 4ab68e168ae1695f7c04fae98930740aaf7c50fa upstream.
[why & how]
Need to make sure plane_state is initialized
before accessing its members.
--- drivers/gpu/drm/amd/display/dc/core/dc_surface.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_surface.c +2 -1
@@ -165,7 +165,8 @@ const struct dc_plane_status *dc_plane_gif (pipe_ctx->plane_state != plane_state)continue ; - pipe_ctx->plane_state->status.is_flip_pending = false; +if (pipe_ctx->plane_state) + pipe_ctx->plane_state->status.is_flip_pending = false;break ; }
Greg Kroah-Hartman
maintainerPATCH 99/259 udf: Avoid using corrupted block bitmap buffer
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit a90d4471146de21745980cba51ce88e7926bcc4f upstream.
When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the next allocation from the same bitmap will notice the bitmap buffer is already loaded and tries to allocate from the bitmap with mixed results (depending on the exact nature of the bitmap corruption). Fix the problem by using BH_verified bit to indicate whether the bitmap is valid or not.
--- fs/udf/balloc.c | 15 +++++++++++++-- fs/udf/super.c | 3 ++- 2 files changed, 15 insertions(+), 3 deletions(-)
fs/udf/balloc.c +13 -2
@@ -68,8 +68,12 @@ static int read_block_bitmap(struct supe }for (i =0 ; i < count; i++) -if (udf_test_bit (i + off, bh->b_data)) +if (udf_test_bit (i + off, bh->b_data)) { + bitmap->s_block_bitmap[bitmap_nr] = +ERR_PTR (-EFSCORRUPTED ); +brelse (bh);return -EFSCORRUPTED ; + }return 0 ; }
@@ -85,8 +89,15 @@ static int __load_block_bitmap(struct su block_group, nr_groups); } -if (bitmap->s_block_bitmap[block_group]) +if (bitmap->s_block_bitmap[block_group]) { +/* +* The bitmap failed verification in the past. No point in +* trying again. +*/ +if (IS_ERR (bitmap->s_block_bitmap[block_group])) +return PTR_ERR (bitmap->s_block_bitmap[block_group]);return block_group; + } retval =read_block_bitmap (sb, bitmap, block_group, block_group);if (retval <0 )
fs/udf/super.c +2 -1
@@ -266,7 +266,8 @@ static void udf_sb_free_bitmap(struct udint nr_groups = bitmap->s_nr_groups;for (i =0 ; i < nr_groups; i++) -brelse (bitmap->s_block_bitmap[i]); +if (!IS_ERR_OR_NULL (bitmap->s_block_bitmap[i])) +brelse (bitmap->s_block_bitmap[i]);kvfree (bitmap); }
Greg Kroah-Hartman
maintainerPATCH 100/259 m68k: amiga: Turn off Warp1260 interrupts during boot
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Pisati <[email protected]>
commit 1d8491d3e726984343dd8c3cdbe2f2b47cfdd928 upstream.
On an Amiga 1200 equipped with a Warp1260 accelerator, an interrupt storm coming from the accelerator board causes the machine to crash in local_irq_enable() or auto_irq_enable(). Disabling interrupts for the Warp1260 in amiga_parse_bootinfo() fixes the problem.
--- arch/m68k/amiga/config.c | 9 +++++++++ include/uapi/linux/zorro_ids.h | 3 +++ 2 files changed, 12 insertions(+)
arch/m68k/amiga/config.c +9 -0
@@ -180,6 +180,15 @@ int __init amiga_parse_bootinfo(const st dev->slotsize =be16_to_cpu (cd->cd_SlotSize); dev->boardaddr =be32_to_cpu (cd->cd_BoardAddr); dev->boardsize =be32_to_cpu (cd->cd_BoardSize); + +/* CS-LAB Warp 1260 workaround */ +if (be16_to_cpu (dev->rom.er_Manufacturer) ==ZORRO_MANUF (ZORRO_PROD_CSLAB_WARP_1260 ) && + dev->rom.er_Product ==ZORRO_PROD (ZORRO_PROD_CSLAB_WARP_1260 )) { + +/* turn off all interrupts */ +pr_info ("Warp 1260 card detected: applying interrupt storm workaround\n" ); + *(uint32_t *)(dev->boardaddr +0x1000 ) =0xfff ; + } }else pr_warn ("amiga_parse_bootinfo: too many AutoConfig devices\n" );#endif /* CONFIG_ZORRO */
include/uapi/linux/zorro_ids.h +3 -0
@@ -449,6 +449,9 @@#define ZORRO_PROD_VMC_ISDN_BLASTER_Z2 ZORRO_ID(VMC, 0x01, 0)#define ZORRO_PROD_VMC_HYPERCOM_4 ZORRO_ID(VMC, 0x02, 0) +#define ZORRO_MANUF_CSLAB 0x1400 +#define ZORRO_PROD_CSLAB_WARP_1260 ZORRO_ID(CSLAB, 0x65, 0) +#define ZORRO_MANUF_INFORMATION 0x157C#define ZORRO_PROD_INFORMATION_ISDN_ENGINE_I ZORRO_ID(INFORMATION, 0x64, 0)
Greg Kroah-Hartman
maintainerPATCH 101/259 ext4: check dot and dotdot of dx_root before making dir indexed
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit 50ea741def587a64e08879ce6c6a30131f7111e7 upstream.
Syzbot reports a issue as follows:
============================================
BUG: unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D 23ffee067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0 Call Trace: <TASK> make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451 ext4_rename fs/ext4/namei.c:3936 [inline] ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214
[...]
============================================
The immediate cause of this problem is that there is only one valid dentry for the block to be split during do_split, so split==0 results in out of bounds accesses to the map triggering the issue.
do_split
unsigned split
dx_make_map
count = 1
split = count/2 = 0;
continued = hash2 == map[split - 1].hash;
---> map[4294967295]The maximum length of a filename is 255 and the minimum block size is 1024, so it is always guaranteed that the number of entries is greater than or equal to 2 when do_split() is called.
But syzbot's crafted image has no dot and dotdot in dir, and the dentry distribution in dirblock is as follows:
bus dentry1 hole dentry2 free
|xx--|xx-------------|...............|xx-------------|...............| 0 12 (8+248)=256 268 256 524 (8+256)=264 788 236 1024
So when renaming dentry1 increases its name_len length by 1, neither hole nor free is sufficient to hold the new dentry, and make_indexed_dir() is called.
In make_indexed_dir() it is assumed that the first two entries of the dirblock must be dot and dotdot, so bus and dentry1 are left in dx_root because they are treated as dot and dotdot, and only dentry2 is moved to the new leaf block. That's why count is equal to 1.
Therefore add the ext4_check_dx_root() helper function to add more sanity checks to dot and dotdot before starting the conversion to avoid the above issue.
--- fs/ext4/namei.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 51 insertions(+), 5 deletions(-)
fs/ext4/namei.c +51 -5
@@ -2086,6 +2086,52 @@ static int add_dirent_to_buf(handle_t *hreturn 0 ; } +static bool ext4_check_dx_root (struct inode *dir,struct dx_root *root) +{ +struct fake_dirent *fde; +const char *error_msg; +unsigned int rlen; +unsigned int blocksize = dir->i_sb->s_blocksize; +char *blockend = (char *)root + dir->i_sb->s_blocksize; + + fde = &root->dot; +if (unlikely (fde->name_len !=1 )) { + error_msg ="invalid name_len for '.'" ; + goto corrupted; + } +if (unlikely (strncmp (root->dot_name,"." , fde->name_len))) { + error_msg ="invalid name for '.'" ; + goto corrupted; + } + rlen =ext4_rec_len_from_disk (fde->rec_len, blocksize); +if (unlikely ((char *)fde + rlen >= blockend)) { + error_msg ="invalid rec_len for '.'" ; + goto corrupted; + } + + fde = &root->dotdot; +if (unlikely (fde->name_len !=2 )) { + error_msg ="invalid name_len for '..'" ; + goto corrupted; + } +if (unlikely (strncmp (root->dotdot_name,".." , fde->name_len))) { + error_msg ="invalid name for '..'" ; + goto corrupted; + } + rlen =ext4_rec_len_from_disk (fde->rec_len, blocksize); +if (unlikely ((char *)fde + rlen >= blockend)) { + error_msg ="invalid rec_len for '..'" ; + goto corrupted; + } + +return true; + +corrupted: +EXT4_ERROR_INODE (dir,"Corrupt dir, %s, running e2fsck is recommended" , + error_msg); +return false; +} +/* * This converts a one block unindexed directory to a 3 block indexed * directory, and adds the dentry to the indexed directory.
@@ -2119,17 +2165,17 @@ static int make_indexed_dir(handle_t *habrelse (bh);return retval; } + root = (struct dx_root *) bh->b_data; +if (!ext4_check_dx_root (dir, root)) { +brelse (bh); +return -EFSCORRUPTED ; + }/* The 0th block becomes the root, move the dirents out */ fde = &root->dotdot; de = (struct ext4_dir_entry_2 *)((char *)fde +ext4_rec_len_from_disk (fde->rec_len, blocksize)); -if ((char *) de >= (((char *) root) + blocksize)) { -EXT4_ERROR_INODE (dir,"invalid rec_len for '..'" ); -brelse (bh); -return -EFSCORRUPTED ; - } len = ((char *) root) + (blocksize - csum_size) - (char *) de;/* Allocate new block for the 0th block's dirents */
Greg Kroah-Hartman
maintainerPATCH 102/259 ext4: make sure the first directory block is not a hole
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6 upstream.
The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow.
ext4_mknod
...
ext4_add_entry
// Read block 0
ext4_read_dirblock(dir, block, DIRENT)
bh = ext4_bread(NULL, inode, block, 0)
if (!bh && (type == INDEX || type == DIRENT_HTREE))
// The first directory block is a hole
// But type == DIRENT, so no error is reported.After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash.
Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad.
--- fs/ext4/namei.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
fs/ext4/namei.c +6 -11
@@ -135,10 +135,11 @@ static struct buffer_head *__ext4_read_dreturn bh; } -if (!bh && (type ==INDEX || type ==DIRENT_HTREE )) { +/* The first directory block must not be a hole. */ +if (!bh && (type ==INDEX || type ==DIRENT_HTREE || block ==0 )) {ext4_error_inode (inode, func, line, block, -"Directory hole found for htree %s block" , - (type ==INDEX ) ?"index" :"leaf" ); +"Directory hole found for htree %s block %u" , + (type ==INDEX ) ?"index" :"leaf" , block);return ERR_PTR (-EFSCORRUPTED ); }if (!bh)
@@ -2945,10 +2946,7 @@ bool ext4_empty_dir(struct inode *inode)EXT4_ERROR_INODE (inode,"invalid size" );return true; } -/* The first directory block must not be a hole, -* so treat it as DIRENT_HTREE -*/ - bh =ext4_read_dirblock (inode,0 ,DIRENT_HTREE ); + bh =ext4_read_dirblock (inode,0 ,EITHER );if (IS_ERR (bh))return true;
@@ -3542,10 +3540,7 @@ static struct buffer_head *ext4_get_firsstruct ext4_dir_entry_2 *de;unsigned int offset; -/* The first directory block must not be a hole, so -* treat it as DIRENT_HTREE -*/ - bh =ext4_read_dirblock (inode,0 ,DIRENT_HTREE ); + bh =ext4_read_dirblock (inode,0 ,EITHER );if (IS_ERR (bh)) { *retval =PTR_ERR (bh);return NULL ;
Greg Kroah-Hartman
maintainerPATCH 103/259 wifi: mwifiex: Fix interface type change
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Beims <[email protected]>
commit a17b9f590f6ec2b9f1b12b1db3bf1d181de6b272 upstream.
When changing the interface type we also need to update the bss_num, the driver private data is searched based on a unique (bss_type, bss_num) tuple, therefore every time bss_type changes, bss_num must also change.
This fixes for example an issue in which, after the mode changed, a wireless scan on the changed interface would not finish, leading to repeated -EBUSY messages to userspace when other scan requests were sent.
--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/marvell/mwifiex/cfg80211.c +2 -0
@@ -934,6 +934,8 @@ mwifiex_init_new_priv_params(struct mwifreturn -EOPNOTSUPP ; } + priv->bss_num =mwifiex_get_unused_bss_num (adapter, priv->bss_type); +spin_lock_irqsave (&adapter->main_proc_lock, flags); adapter->main_locked = false;spin_unlock_irqrestore (&adapter->main_proc_lock, flags);
Greg Kroah-Hartman
maintainerPATCH 104/259 leds: ss4200: Convert PCIBIOS_* return codes to errnos
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
commit ce068e83976140badb19c7f1307926b4b562fac4 upstream.
ich7_lpc_probe() uses pci_read_config_dword() that returns PCIBIOS_* codes. The error handling code assumes incorrectly it's a normal errno and checks for < 0. The return code is returned from the probe function as is but probe functions should return normal errnos.
Remove < 0 from the check and convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal errno before returning it.
--- drivers/leds/leds-ss4200.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/leds/leds-ss4200.c +5 -2
@@ -356,8 +356,10 @@ static int ich7_lpc_probe(struct pci_dev nas_gpio_pci_dev = dev; status =pci_read_config_dword (dev,PMBASE , &g_pm_io_base); -if (status) +if (status) { + status =pcibios_err_to_errno (status); goto out; + } g_pm_io_base &=0x00000ff80 ; status =pci_read_config_dword (dev,GPIO_CTRL , &gc);
@@ -369,8 +371,9 @@ static int ich7_lpc_probe(struct pci_dev } status =pci_read_config_dword (dev,GPIO_BASE , &nas_gpio_io_base); -if (0 > status) { +if (status) {dev_info (&dev->dev,"Unable to read GPIOBASE.\n" ); + status =pcibios_err_to_errno (status); goto out; }dev_dbg (&dev->dev,": GPIOBASE = 0x%08x\n" , nas_gpio_io_base);
Greg Kroah-Hartman
maintainerPATCH 105/259 tools/memory-model: Fix bug in lock.cat
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 4c830eef806679dc243e191f962c488dd9d00708 upstream.
Andrea reported that the following innocuous litmus test:
C T
{}
P0(spinlock_t *x)
{
int r0;
spin_lock(x);
spin_unlock(x);
r0 = spin_is_locked(x);
}gives rise to a nonsensical empty result with no executions:
$ herd7 -conf linux-kernel.cfg T.litmus Test T Required States 0 Ok Witnesses Positive: 0 Negative: 0 Condition forall (true) Observation T Never 0 0 Time T 0.00 Hash=6fa204e139ddddf2cb6fa963bad117c0
The problem is caused by a bug in the lock.cat part of the LKMM. Its computation of the rf relation for RU (read-unlocked) events is faulty; it implicitly assumes that every RU event must read from either a UL (unlock) event in another thread or from the lock's initial state. Neither is true in the litmus test above, so the computation yields no possible executions.
The lock.cat code tries to make up for this deficiency by allowing RU events outside of critical sections to read from the last po-previous UL event. But it does this incorrectly, trying to keep these rfi links separate from the rfe links that might also be needed, and passing only the latter to herd7's cross() macro.
The problem is fixed by merging the two sets of possible rf links for RU events and using them all in the call to cross().
--- tools/memory-model/lock.cat | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
tools/memory-model/lock.cat +10 -10
@@ -102,19 +102,19 @@ let rf-lf = rfe-lf | rfi-lf * within one of the lock's critical sections returns False. *) -(* rfi for RU events: an RU may read from the last po-previous UL *) -let rfi-ru = ([UL] ; po-loc ; [RU]) \ ([UL] ; po-loc ; [LKW] ; po-loc) - -(* rfe for RU events: an RU may read from an external UL or the initial write *) -let all-possible-rfe-ru = - let possible-rfe-ru r = +(* + * rf for RU events: an RU may read from an external UL or the initial write, + * or from the last po-previous UL + *) +let all-possible-rf-ru = + let possible-rf-ru r = let pair-to-relation p = p ++ 0 - in map pair-to-relation (((UL | IW) * {r}) & loc & ext) - in map possible-rfe-ru RU + in map pair-to-relation ((((UL | IW) * {r}) & loc & ext) | + (((UL * {r}) & po-loc) \ ([UL] ; po-loc ; [LKW] ; po-loc))) + in map possible-rf-ru RU (* Generate all rf relations for RU events *) -with rfe-ru from cross(all-possible-rfe-ru) -let rf-ru = rfe-ru | rfi-ru +with rf-ru from cross(all-possible-rf-ru) (* Final rf relation *) let rf = rf | rf-lf | rf-ru
Greg Kroah-Hartman
maintainerPATCH 106/259 hwrng: amd - Convert PCIBIOS_* return codes to errnos
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
commit 14cba6ace79627a57fb9058582b03f0ed3832390 upstream.
amd_rng_mod_init() uses pci_read_config_dword() that returns PCIBIOS_* codes. The return code is then returned as is but amd_rng_mod_init() is a module_init() function that should return normal errnos.
Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal errno before returning it.
--- drivers/char/hw_random/amd-rng.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/char/hw_random/amd-rng.c +3 -1
@@ -142,8 +142,10 @@ static int __init mod_init(void) found: err =pci_read_config_dword (pdev,0x58 , &pmbase); -if (err) +if (err) { + err =pcibios_err_to_errno (err); goto put_dev; + } pmbase &=0x0000FF00 ;if (pmbase ==0 ) {
Greg Kroah-Hartman
maintainerPATCH 107/259 PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Liu <[email protected]>
commit fea93a3e5d5e6a09eb153866d2ce60ea3287a70d upstream.
The intent of the code snippet is to always return 0 for both PCI_INTERRUPT_LINE and PCI_INTERRUPT_PIN.
The check misses PCI_INTERRUPT_PIN. This patch fixes that.
This is discovered by this call in VFIO:
pci_read_config_byte(vdev->pdev, PCI_INTERRUPT_PIN, &pin);
The old code does not set *val to 0 because it misses the check for PCI_INTERRUPT_PIN. Garbage is returned in that case.
--- drivers/pci/controller/pci-hyperv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/pci-hyperv.c +2 -2
@@ -682,8 +682,8 @@ static void _hv_pcifront_read_config(str PCI_CAPABILITY_LIST) {/* ROM BARs are unimplemented */ *val =0 ; - } else if (where >= PCI_INTERRUPT_LINE && where + size <= - PCI_INTERRUPT_PIN) { + } else if ((where >= PCI_INTERRUPT_LINE && where + size <= PCI_INTERRUPT_PIN) || + (where >= PCI_INTERRUPT_PIN && where + size <= PCI_MIN_GNT)) {/* * Interrupt Line and Interrupt PIN are hard-wired to zero * because this front-end only supports message-signaled
Greg Kroah-Hartman
maintainerPATCH 108/259 binder: fix hang of unregistered readers
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 31643d84b8c3d9c846aa0e20bc033e46c68c7e7d upstream.
With the introduction of binder_available_for_proc_work_ilocked() in commit 1b77e9dcc3da ("ANDROID: binder: remove proc waitqueue") a binder thread can only "wait_for_proc_work" after its thread->looper has been marked as BINDER_LOOPER_STATE_{ENTERED|REGISTERED}.
This means an unregistered reader risks waiting indefinitely for work since it never gets added to the proc->waiting_threads. If there are no further references to its waitqueue either the task will hang. The same applies to readers using the (e)poll interface.
I couldn't find the rationale behind this restriction. So this patch restores the previous behavior of allowing unregistered threads to "wait_for_proc_work". Note that an error message for this scenario, which had previously become unreachable, is now re-enabled.
--- drivers/android/binder.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/android/binder.c +1 -3
@@ -932,9 +932,7 @@ static bool binder_has_work(struct bindestatic bool binder_available_for_proc_work_ilocked (struct binder_thread *thread) {return !thread->transaction_stack && -binder_worklist_empty_ilocked (&thread->todo) && - (thread->looper & (BINDER_LOOPER_STATE_ENTERED | -BINDER_LOOPER_STATE_REGISTERED )); +binder_worklist_empty_ilocked (&thread->todo); } static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,
Greg Kroah-Hartman
maintainerPATCH 109/259 scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saurav Kashyap <[email protected]>
commit ce2065c4cc4f05635413f63f6dc038d7d4842e31 upstream.
Firmware only supports single DSDs in ELS Pass-through IOCB (0x53h), sg cnt is decided by the SCSI ML. User is not aware of the cause of an acutal error.
Return the appropriate return code that will be decoded by API and application and proper error message will be displayed to user.
--- drivers/scsi/qla2xxx/qla_bsg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_bsg.c +1 -1
@@ -297,7 +297,7 @@ qla2x00_process_els(struct bsg_job *bsg_"request_sg_cnt=%x reply_sg_cnt=%x.\n" , bsg_job->request_payload.sg_cnt, bsg_job->reply_payload.sg_cnt); - rval = -EPERM ; + rval = -ENOBUFS ; goto done; }
Greg Kroah-Hartman
maintainerPATCH 110/259 f2fs: fix to dont dirty inode for readonly filesystem
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 192b8fb8d1c8ca3c87366ebbef599fa80bb626b8 upstream.
syzbot reports f2fs bug as below:
kernel BUG at fs/f2fs/inode.c:933!
RIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933 Call Trace: evict+0x2a4/0x620 fs/inode.c:664 dispose_list fs/inode.c:697 [inline] evict_inodes+0x5f8/0x690 fs/inode.c:747 generic_shutdown_super+0x9d/0x2c0 fs/super.c:675 kill_block_super+0x44/0x90 fs/super.c:1667 kill_f2fs_super+0x303/0x3b0 fs/f2fs/super.c:4894 deactivate_locked_super+0xc1/0x130 fs/super.c:484 cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256 task_work_run+0x24a/0x300 kernel/task_work.c:180 ptrace_notify+0x2cd/0x380 kernel/signal.c:2399 ptrace_report_syscall include/linux/ptrace.h:411 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline] syscall_exit_work kernel/entry/common.c:251 [inline] syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296 do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88 entry_SYSCALL_64_after_hwframe+0x63/0x6b
The root cause is:
- do_sys_open
- f2fs_lookup
- __f2fs_find_entry
- f2fs_i_depth_write
- f2fs_mark_inode_dirty_sync
- f2fs_dirty_inode
- set_inode_flag(inode, FI_DIRTY_INODE)
- umount
- kill_f2fs_super
- kill_block_super
- generic_shutdown_super
- sync_filesystem
: sb is readonly, skip sync_filesystem()
- evict_inodes
- iput
- f2fs_evict_inode
- f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE)) : trigger kernel panic
When we try to repair i_current_depth in readonly filesystem, let's skip dirty inode to avoid panic in later f2fs_evict_inode().
--- fs/f2fs/inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/f2fs/inode.c +3 -0
@@ -23,6 +23,9 @@ void f2fs_mark_inode_dirty_sync(struct iif (is_inode_flag_set (inode,FI_NEW_INODE ))return ; +if (f2fs_readonly (F2FS_I_SB (inode)->sb)) +return ; +if (f2fs_inode_dirtied (inode, sync))return ;
Greg Kroah-Hartman
maintainerPATCH 111/259 clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bastien Curutchet <[email protected]>
commit a83b22754e351f13fb46596c85f667dc33da71ec upstream.
The flag attribute of the struct clk_init_data isn't initialized before the devm_clk_hw_register() call. This can lead to unexpected behavior during registration.
Initialize the entire clk_init_data to zero at declaration.
--- drivers/clk/davinci/da8xx-cfgchip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/davinci/da8xx-cfgchip.c +2 -2
@@ -505,7 +505,7 @@ da8xx_cfgchip_register_usb0_clk48(structconst char *const parent_names[] = {"usb_refclkin" ,"pll0_auxclk" };struct clk *fck_clk;struct da8xx_usb0_clk48 *usb0; -struct clk_init_data init; +struct clk_init_data init = {};int ret; fck_clk =devm_clk_get (dev,"fck" );
@@ -579,7 +579,7 @@ da8xx_cfgchip_register_usb1_clk48(struct {const char *const parent_names[] = {"usb0_clk48" ,"usb_refclkin" };struct da8xx_usb1_clk48 *usb1; -struct clk_init_data init; +struct clk_init_data init = {};int ret; usb1 =devm_kzalloc (dev,sizeof (*usb1),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 112/259 ubi: eba: properly rollback inside self_check_eba
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
commit 745d9f4a31defec731119ee8aad8ba9f2536dd9a upstream.
In case of a memory allocation failure in the volumes loop we can only process the already allocated scan_eba and fm_eba array elements on the error path - others are still uninitialized.
Found by Linux Verification Center (linuxtesting.org).
--- drivers/mtd/ubi/eba.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mtd/ubi/eba.c +2 -1
@@ -1560,6 +1560,7 @@ int self_check_eba(struct ubi_device *ub GFP_KERNEL);if (!fm_eba[i]) { ret = -ENOMEM ; +kfree (scan_eba[i]); goto out_free; }
@@ -1595,7 +1596,7 @@ int self_check_eba(struct ubi_device *ub } out_free: -for (i =0 ; i < num_volumes; i++) { +while (--i >=0 ) {if (!ubi->volumes[i])continue ;
Greg Kroah-Hartman
maintainerPATCH 113/259 decompress_bunzip2: fix rare decompression failure
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ross Lagerwall <[email protected]>
commit bf6acd5d16057d7accbbb1bf7dc6d8c56eeb4ecc upstream.
The decompression code parses a huffman tree and counts the number of symbols for a given bit length. In rare cases, there may be >= 256 symbols with a given bit length, causing the unsigned char to overflow. This causes a decompression failure later when the code tries and fails to find the bit length for a given symbol.
Since the maximum number of symbols is 258, use unsigned short instead.
--- lib/decompress_bunzip2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/decompress_bunzip2.c +2 -1
@@ -232,7 +232,8 @@ static int INIT get_next_block(struct buRUNB) */ symCount = symTotal+2 ;for (j =0 ; j < groupCount; j++) { -unsigned char length[MAX_SYMBOLS ], temp[MAX_HUFCODE_BITS +1 ]; +unsigned char length[MAX_SYMBOLS ]; +unsigned short temp[MAX_HUFCODE_BITS +1 ];int minLen, maxLen, pp;/* Read Huffman code lengths for each symbol. They're stored in a way similar to mtf; record a starting
Greg Kroah-Hartman
maintainerPATCH 114/259 kobject_uevent: Fix OOB access within zap_modalias_env()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <[email protected]>
commit dd6e9894b451e7c85cceb8e9dc5432679a70e7dc upstream.
zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove.
--- lib/kobject_uevent.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
lib/kobject_uevent.c +16 -1
@@ -432,8 +432,23 @@ static void zap_modalias_env(struct kobj len =strlen (env->envp[i]) +1 ;if (i != env->envp_idx -1 ) { +/* @env->envp[] contains pointers to @env->buf[] +* with @env->buflen chars, and we are removing +* variable MODALIAS here pointed by @env->envp[i] +* with length @len as shown below: +* +* 0 @env->buf[] @env->buflen +* --------------------------------------------- +* ^ ^ ^ ^ +* | |-> @len <-| target block | +* @env->envp[0] @env->envp[i] @env->envp[i + 1] +* +* so the "target block" indicated above is moved +* backward by @len, and its right size is +* @env->buflen - (@env->envp[i + 1] - @env->envp[0]). +*/ memmove (env->envp[i], env->envp[i +1 ], - env->buflen - len); + env->buflen - (env->envp[i +1 ] - env->envp[0 ]));for (j = i; j < env->envp_idx -1 ; j++) env->envp[j] = env->envp[j +1 ] - len;
Greg Kroah-Hartman
maintainerPATCH 115/259 rtc: cmos: Fix return value of nvmem callbacks
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joy Chakraborty <[email protected]>
commit 1c184baccf0d5e2ef4cc1562261d0e48508a1c2b upstream.
Read/write callbacks registered with nvmem core expect 0 to be returned on success and a negative value to be returned on failure.
cmos_nvram_read()/cmos_nvram_write() currently return the number of bytes read or written, fix to return 0 on success and -EIO incase number of bytes requested was not read or written.
--- drivers/rtc/rtc-cmos.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/rtc/rtc-cmos.c +4 -6
@@ -597,11 +597,10 @@ static int cmos_nvram_read(void *priv, u size_t count) {unsigned char *buf = val; -int retval; off +=NVRAM_OFFSET ;spin_lock_irq (&rtc_lock); -for (retval =0 ; count; count--, off++, retval++) { +for (; count; count--, off++) {if (off <128 ) *buf++ =CMOS_READ (off);else if (can_bank2)
@@ -611,7 +610,7 @@ static int cmos_nvram_read(void *priv, u }spin_unlock_irq (&rtc_lock); -return retval; +return count ? -EIO :0 ; } static int cmos_nvram_write(void *priv, unsigned int off, void *val,
@@ -619,7 +618,6 @@ static int cmos_nvram_write(void *priv, {struct cmos_rtc *cmos = priv;unsigned char *buf = val; -int retval;/* NOTE: on at least PCs and Ataris, the boot firmware uses a * checksum on part of the NVRAM data. That's currently ignored
@@ -628,7 +626,7 @@ static int cmos_nvram_write(void *priv,*/ off +=NVRAM_OFFSET ;spin_lock_irq (&rtc_lock); -for (retval =0 ; count; count--, off++, retval++) { +for (; count; count--, off++) {/* don't trash RTC registers */ if (off == cmos->day_alrm || off == cmos->mon_alrm
@@ -643,7 +641,7 @@ static int cmos_nvram_write(void *priv, }spin_unlock_irq (&rtc_lock); -return retval; +return count ? -EIO :0 ; }/*----------------------------------------------------------------*/
Greg Kroah-Hartman
maintainerPATCH 116/259 scsi: qla2xxx: During vport delete send async logout explicitly
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Rangankar <[email protected]>
commit 76f480d7c717368f29a3870f7d64471ce0ff8fb2 upstream.
During vport delete, it is observed that during unload we hit a crash because of stale entries in outstanding command array. For all these stale I/O entries, eh_abort was issued and aborted (fast_fail_io = 2009h) but I/Os could not complete while vport delete is in process of deleting.
BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI Workqueue: qla2xxx_wq qla_do_work [qla2xxx] RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0 RSP: 0018:ffffa1e1e150fc68 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000001 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8ce208a7a0d0 RBP: ffff8ce208a7a0d0 R08: 0000000000000000 R09: ffff8ce378aac9c8 R10: ffff8ce378aac8a0 R11: ffffa1e1e150f9d8 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8ce378aac9c8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8d217f000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000001c CR3: 0000002089acc000 CR4: 0000000000350ee0 Call Trace: <TASK> qla2xxx_qpair_sp_free_dma+0x417/0x4e0 ? qla2xxx_qpair_sp_compl+0x10d/0x1a0 ? qla2x00_status_entry+0x768/0x2830 ? newidle_balance+0x2f0/0x430 ? dequeue_entity+0x100/0x3c0 ? qla24xx_process_response_queue+0x6a1/0x19e0 ? __schedule+0x2d5/0x1140 ? qla_do_work+0x47/0x60 ? process_one_work+0x267/0x440 ? process_one_work+0x440/0x440 ? worker_thread+0x2d/0x3d0 ? process_one_work+0x440/0x440 ? kthread+0x156/0x180 ? set_kthread_struct+0x50/0x50 ? ret_from_fork+0x22/0x30 </TASK>
Send out async logout explicitly for all the ports during vport delete.
--- drivers/scsi/qla2xxx/qla_mid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_mid.c +1 -1
@@ -165,7 +165,7 @@ qla24xx_disable_vp(scsi_qla_host_t *vha)atomic_set (&vha->loop_state,LOOP_DOWN );atomic_set (&vha->loop_down_timer,LOOP_DOWN_TIME );list_for_each_entry (fcport, &vha->vp_fcports, list) - fcport->logout_on_delete =0 ; + fcport->logout_on_delete =1 ;qla2x00_mark_all_devices_lost (vha,0 );
Greg Kroah-Hartman
maintainerPATCH 117/259 scsi: qla2xxx: Fix for possible memory corruption
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shreyas Deodhar <[email protected]>
commit c03d740152f78e86945a75b2ad541bf972fab92a upstream.
Init Control Block is dereferenced incorrectly. Correctly dereference ICB
--- drivers/scsi/qla2xxx/qla_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_os.c +1 -1
@@ -4436,7 +4436,7 @@ static void qla2x00_number_of_exch(scsi_qla_host_t *vha, u32 *ret_cnt, u16 max_cnt) {u32 temp; -struct init_cb_81xx *icb = (struct init_cb_81xx *)&vha->hw->init_cb; +struct init_cb_81xx *icb = (struct init_cb_81xx *)vha->hw->init_cb; *ret_cnt =FW_DEF_EXCHANGES_CNT ;if (max_cnt > vha->hw->max_exchg)
Greg Kroah-Hartman
maintainerPATCH 118/259 scsi: qla2xxx: Complete command early within lock
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shreyas Deodhar <[email protected]>
commit 4475afa2646d3fec176fc4d011d3879b26cb26e3 upstream.
A crash was observed while performing NPIV and FW reset,
BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 1 PREEMPT_RT SMP NOPTI RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0 RSP: 0018:ffffc90026f47b88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000002 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8881041130d0 RBP: ffff8881041130d0 R08: 0000000000000000 R09: 0000000000000034 R10: ffffc90026f47c48 R11: 0000000000000031 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8881565e4a20 R15: 0000000000000000 FS: 00007f4c69ed3d00(0000) GS:ffff889faac80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000001c CR3: 0000000288a50002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die_body+0x1a/0x60 ? page_fault_oops+0x16f/0x4a0 ? do_user_addr_fault+0x174/0x7f0 ? exc_page_fault+0x69/0x1a0 ? asm_exc_page_fault+0x22/0x30 ? dma_direct_unmap_sg+0x51/0x1e0 ? preempt_count_sub+0x96/0xe0 qla2xxx_qpair_sp_free_dma+0x29f/0x3b0 [qla2xxx] qla2xxx_qpair_sp_compl+0x60/0x80 [qla2xxx] __qla2x00_abort_all_cmds+0xa2/0x450 [qla2xxx]
The command completion was done early while aborting the commands in driver unload path but outside lock to avoid the WARN_ON condition of performing dma_free_attr within the lock. However this caused race condition while command completion via multiple paths causing system crash.
Hence complete the command early in unload path but within the lock to avoid race condition.
--- drivers/scsi/qla2xxx/qla_os.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/scsi/qla2xxx/qla_os.c +0 -5
@@ -1743,14 +1743,9 @@ __qla2x00_abort_all_cmds(struct qla_qpaifor (cnt =1 ; cnt < req->num_outstanding_cmds; cnt++) { sp = req->outstanding_cmds[cnt];if (sp) { -/* -* perform lockless completion during driver unload -*/ if (qla2x00_chip_is_down (vha)) { req->outstanding_cmds[cnt] =NULL ; -spin_unlock_irqrestore (qp->qp_lock_ptr, flags); sp->done (sp, res); -spin_lock_irqsave (qp->qp_lock_ptr, flags);continue ; }
Greg Kroah-Hartman
maintainerPATCH 119/259 scsi: qla2xxx: validate nvme_local_port correctly
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <[email protected]>
commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 upstream.
The driver load failed with error message,
qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef
and with a kernel crash,
BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx]
Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port.
--- drivers/scsi/qla2xxx/qla_nvme.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_nvme.c +4 -1
@@ -28,7 +28,10 @@ int qla_nvme_register_remote(struct scsireturn 0 ; } -if (!vha->nvme_local_port &&qla_nvme_register_hba (vha)) +if (qla_nvme_register_hba (vha)) +return 0 ; + +if (!vha->nvme_local_port)return 0 ; if (!(fcport->nvme_prli_service_param &
Greg Kroah-Hartman
maintainerPATCH 120/259 perf/x86/intel/pt: Fix topa_entry base length
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Cavenati <[email protected]>
commit 5638bd722a44bbe97c1a7b3fae5b9efddb3e70ff upstream.
topa_entry->base needs to store a pfn. It obviously needs to be large enough to store the largest possible x86 pfn which is MAXPHYADDR-PAGE_SIZE (52-12). So it is 4 bits too small.
Increase the size of topa_entry->base from 36 bits to 40 bits.
Note, systems where physical addresses can be 256TiB or more are affected.
[ Adrian: Amend commit message as suggested by Dave Hansen ]
--- arch/x86/events/intel/pt.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/events/intel/pt.h +2 -2
@@ -33,8 +33,8 @@ struct topa_entry { u64 rsvd2 : 1; u64 size : 4; u64 rsvd3 : 2; - u64 base : 36; - u64 rsvd4 : 16; + u64 base : 40; + u64 rsvd4 : 12; };/* TSC to Core Crystal Clock Ratio */
Greg Kroah-Hartman
maintainerPATCH 121/259 perf/x86/intel/pt: Fix a topa_entry base address calculation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit ad97196379d0b8cb24ef3d5006978a6554e6467f upstream.
topa_entry->base is a bit-field. Bit-fields are not promoted to a 64-bit type, even if the underlying type is 64-bit, and so, if necessary, must be cast to a larger type when calculations are done.
Fix a topa_entry->base address calculation by adding a cast.
Without the cast, the address was limited to 36-bits i.e. 64GiB.
The address calculation is used on systems that do not support Multiple Entry ToPA (only Broadwell), and affects physical addresses on or above 64GiB. Instead of writing to the correct address, the address comprising the first 36 bits would be written to.
Intel PT snapshot and sampling modes are not affected.
--- arch/x86/events/intel/pt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/events/intel/pt.c +1 -1
@@ -827,7 +827,7 @@ static void pt_update_head(struct pt *pt*/ static void *pt_buffer_region (struct pt_buffer *buf) { -return phys_to_virt (TOPA_ENTRY (buf->cur, buf->cur_idx)->base <<TOPA_SHIFT ); +return phys_to_virt ((phys_addr_t )TOPA_ENTRY (buf->cur, buf->cur_idx)->base <<TOPA_SHIFT ); }/**
Greg Kroah-Hartman
maintainerPATCH 122/259 rtc: isl1208: Fix return value of nvmem callbacks
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joy Chakraborty <[email protected]>
commit 70f1ae5f0e7f44edf842444044615da7b59838c1 upstream.
Read/write callbacks registered with nvmem core expect 0 to be returned on success and a negative value to be returned on failure.
isl1208_nvmem_read()/isl1208_nvmem_write() currently return the number of bytes read/written on success, fix to return 0 on success and negative on failure.
--- drivers/rtc/rtc-isl1208.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/rtc/rtc-isl1208.c +4 -7
@@ -743,14 +743,13 @@ static int isl1208_nvmem_read(void *priv {struct isl1208_state *isl1208 = priv;struct i2c_client *client =to_i2c_client (isl1208->rtc->dev.parent); -int ret;/* nvmem sanitizes offset/count for us, but count==0 is possible */ if (!count)return count; - ret =isl1208_i2c_read_regs (client,ISL1208_REG_USR1 + off, buf, + +return isl1208_i2c_read_regs (client,ISL1208_REG_USR1 + off, buf, count); -return ret ==0 ? count : ret; } static int isl1208_nvmem_write(void *priv, unsigned int off, void *buf,
@@ -758,15 +757,13 @@ static int isl1208_nvmem_write(void *pri {struct isl1208_state *isl1208 = priv;struct i2c_client *client =to_i2c_client (isl1208->rtc->dev.parent); -int ret;/* nvmem sanitizes off/count for us, but count==0 is possible */ if (!count)return count; - ret =isl1208_i2c_set_regs (client,ISL1208_REG_USR1 + off, buf, - count); -return ret ==0 ? count : ret; +return isl1208_i2c_set_regs (client,ISL1208_REG_USR1 + off, buf, + count); }static const struct nvmem_config isl1208_nvmem_config = {
Greg Kroah-Hartman
maintainerPATCH 123/259 watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
commit f944ffcbc2e1c759764850261670586ddf3bdabb upstream.
For systems on which the performance counter can expire early due to turbo modes the watchdog handler has a safety net in place which validates that since the last watchdog event there has at least 4/5th of the watchdog period elapsed.
This works reliably only after the first watchdog event because the per CPU variable which holds the timestamp of the last event is never initialized.
So a first spurious event will validate against a timestamp of 0 which results in a delta which is likely to be way over the 4/5 threshold of the period. As this might happen before the first watchdog hrtimer event increments the watchdog counter, this can lead to false positives.
Fix this by initializing the timestamp before enabling the hardware event. Reset the rearm counter as well, as that might be non zero after the watchdog was disabled and reenabled.
--- kernel/watchdog_hld.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
kernel/watchdog_hld.c +8 -3
@@ -91,11 +91,15 @@ static bool watchdog_check_timestamp(voi__this_cpu_write (last_timestamp, now);return true; } -#else -static inline bool watchdog_check_timestamp (void ) + +static void watchdog_init_timestamp (void ) { -return true; +__this_cpu_write (nmi_rearmed,0 ); +__this_cpu_write (last_timestamp,ktime_get_mono_fast_ns ()); } +#else +static inline bool watchdog_check_timestamp (void ) {return true; } +static inline void watchdog_init_timestamp (void ) { }#endif static struct perf_event_attr wd_hw_attr = {
@@ -196,6 +200,7 @@ void hardlockup_detector_perf_enable(voiif (!atomic_fetch_inc (&watchdog_cpus))pr_info ("Enabled. Permanently consumes one hw-PMU counter.\n" ); +watchdog_init_timestamp ();perf_event_enable (this_cpu_read (watchdog_ev)); }
Greg Kroah-Hartman
maintainerPATCH 124/259 platform: mips: cpu_hwmon: Disable driver on unsupported hardware
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <[email protected]>
commit f4d430db17b4ef4e9c3c352a04b2fe3c93011978 upstream.
cpu_hwmon is unsupported on CPUs without loongson_chiptemp register and csr.
--- drivers/platform/mips/cpu_hwmon.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/mips/cpu_hwmon.c +3 -0
@@ -166,6 +166,9 @@ static int __init loongson_hwmon_init(vo goto fail_hwmon_device_register; } +if (!csr_temp_enable && !loongson_chiptemp[0 ]) +return -ENODEV ; + nr_packages = loongson_sysconf.nr_cpus / loongson_sysconf.cores_per_package;
Greg Kroah-Hartman
maintainerPATCH 125/259 RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit aee2424246f9f1dadc33faa78990c1e2eb7826e4 upstream.
iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows:
conn_id->cm_id.iw = cm_id;
cm_id->context = conn_id;
cm_id->cm_handler = cma_iw_handler;rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished.
--- drivers/infiniband/core/iwcm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/infiniband/core/iwcm.c +7 -4
@@ -370,8 +370,10 @@ EXPORT_SYMBOL(iw_cm_disconnect);* * Clean up all resources associated with the connection and release * the initial reference taken by iw_create_cm_id. +* +* Returns true if and only if the last cm_id_priv reference has been dropped. */ -static void destroy_cm_id (struct iw_cm_id *cm_id) +static bool destroy_cm_id (struct iw_cm_id *cm_id) {struct iwcm_id_private *cm_id_priv;struct ib_qp *qp;
@@ -441,7 +443,7 @@ static void destroy_cm_id(struct iw_cm_iiwpm_remove_mapping (&cm_id->local_addr,RDMA_NL_IWCM ); } - (void )iwcm_deref_id (cm_id_priv); +return iwcm_deref_id (cm_id_priv); }/*
@@ -452,7 +454,8 @@ static void destroy_cm_id(struct iw_cm_i*/ void iw_destroy_cm_id (struct iw_cm_id *cm_id) { -destroy_cm_id (cm_id); +if (!destroy_cm_id (cm_id)) +flush_workqueue (iwcm_wq); }EXPORT_SYMBOL (iw_destroy_cm_id);
@@ -1036,7 +1039,7 @@ static void cm_work_handler(struct work_if (!test_bit (IWCM_F_DROP_EVENTS , &cm_id_priv->flags)) { ret =process_event (cm_id_priv, &levent);if (ret) -destroy_cm_id (&cm_id_priv->id); +WARN_ON_ONCE (destroy_cm_id (&cm_id_priv->id)); }else pr_debug ("dropping event %d\n" , levent.event);if (iwcm_deref_id (cm_id_priv))
Greg Kroah-Hartman
maintainerPATCH 126/259 selftests/sigaltstack: Fix ppc64 GCC build
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit 17c743b9da9e0d073ff19fd5313f521744514939 upstream.
Building the sigaltstack test with GCC on 64-bit powerpc errors with:
gcc -Wall sas.c -o /home/michael/linux/.build/kselftest/sigaltstack/sas
In file included from sas.c:23:
current_stack_pointer.h:22:2: error: #error "implement current_stack_pointer equivalent"
22 | #error "implement current_stack_pointer equivalent"
| ^~~~~
sas.c: In function ‘my_usr1’:
sas.c:50:13: error: ‘sp’ undeclared (first use in this function); did you mean ‘p’?
50 | if (sp < (unsigned long)sstack ||
| ^~This happens because GCC doesn't define __ppc__ for 64-bit builds, only 32-bit builds. Instead use __powerpc__ to detect powerpc builds, which is defined by clang and GCC for 64-bit and 32-bit builds.
--- tools/testing/selftests/sigaltstack/current_stack_pointer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/sigaltstack/current_stack_pointer.h +1 -1
@@ -8,7 +8,7 @@ register unsigned long sp asm("sp"); registerunsigned long sp asm("esp" );#elif __loongarch64 registerunsigned long sp asm("$sp" ); -#elif __ppc__ +#elif __powerpc__ registerunsigned long sp asm("r1" );#elif __s390x__ registerunsigned long sp asm("%15" );
Greg Kroah-Hartman
maintainerPATCH 127/259 rbd: dont assume rbd_is_lock_owner() for exclusive mappings
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit 3ceccb14f5576e02b81cc8b105ab81f224bd87f6 upstream.
Expanding on the previous commit, assuming that rbd_is_lock_owner() always returns true (i.e. that we are either in RBD_LOCK_STATE_LOCKED or RBD_LOCK_STATE_QUIESCING) if the mapping is exclusive is wrong too. In case ceph_cls_set_cookie() fails, the lock would be temporarily released even if the mapping is exclusive, meaning that we can end up even in RBD_LOCK_STATE_UNLOCKED.
IOW, exclusive mappings are really "just" about disabling automatic lock transitions (as documented in the man page), not about grabbing the lock and holding on to it whatever it takes.
--- drivers/block/rbd.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/block/rbd.c +0 -5
@@ -6618,11 +6618,6 @@ static int rbd_add_acquire_lock(struct rreturn ret; } -/* -* The lock may have been released by now, unless automatic lock -* transitions are disabled. -*/ -rbd_assert (!rbd_dev->opts->exclusive ||rbd_is_lock_owner (rbd_dev));return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 128/259 drm/panfrost: Mark simple_ondemand governor as softdep
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <[email protected]>
commit 80f4e62730a91572b7fdc657f7bb747e107ae308 upstream.
Panfrost DRM driver uses devfreq to perform DVFS, while using simple_ondemand devfreq governor by default. This causes driver initialization to fail on boot when simple_ondemand governor isn't built into the kernel statically, as a result of the missing module dependency and, consequently, the required governor module not being included in the initial ramdisk. Thus, let's mark simple_ondemand governor as a softdep for Panfrost, to have its kernel module included in the initial ramdisk.
This is a rather longstanding issue that has forced distributions to build devfreq governors statically into their kernels, [1][2] or has forced users to introduce some unnecessary workarounds. [3]
For future reference, not having support for the simple_ondemand governor in the initial ramdisk produces errors in the kernel log similar to these below, which were taken from a Pine64 RockPro64:
panfrost ff9a0000.gpu: [drm:panfrost_devfreq_init [panfrost]] *ERROR* Couldn't initialize GPU devfreq panfrost ff9a0000.gpu: Fatal error during GPU init
panfrost: probe of ff9a0000.gpu failed with error -22
Having simple_ondemand marked as a softdep for Panfrost may not resolve this issue for all Linux distributions. In particular, it will remain unresolved for the distributions whose utilities for the initial ramdisk generation do not handle the available softdep information [4] properly yet. However, some Linux distributions already handle softdeps properly while generating their initial ramdisks, [5] and this is a prerequisite step in the right direction for the distributions that don't handle them properly yet.
[1] https://gitlab.manjaro.org/manjaro-arm/packages/core/linux/-/blob/linux61/config?ref_type=heads#L8180
[2] https://salsa.debian.org/kernel-team/linux/-/merge_requests/1066
[3] https://forum.pine64.org/showthread.php?tid=15458
[4] https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/commit/?id=49d8e0b59052999de577ab732b719cfbeb89504d
[5] https://github.com/archlinux/mkinitcpio/commit/97ac4d37aae084a050be512f6d8f4489054668ad
--- drivers/gpu/drm/panfrost/panfrost_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/panfrost/panfrost_drv.c +1 -0
@@ -692,3 +692,4 @@ module_platform_driver(panfrost_driver);MODULE_AUTHOR ("Panfrost Project Developers" );MODULE_DESCRIPTION ("Panfrost DRM Driver" );MODULE_LICENSE ("GPL v2" ); +MODULE_SOFTDEP ("pre: governor_simpleondemand" );
Greg Kroah-Hartman
maintainerPATCH 129/259 rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit f5c466a0fdb2d9f3650d2e3911b0735f17ba00cf upstream.
... to RBD_LOCK_STATE_QUIESCING and quiescing_wait to recognize that this state and the associated completion are backing rbd_quiesce_lock(), which isn't specific to releasing the lock.
While exclusive lock does get quiesced before it's released, it also gets quiesced before an attempt to update the cookie is made and there the lock is not released as long as ceph_cls_set_cookie() succeeds.
--- drivers/block/rbd.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/block/rbd.c +10 -10
@@ -366,7 +366,7 @@ enum rbd_watch_state {enum rbd_lock_state {RBD_LOCK_STATE_UNLOCKED ,RBD_LOCK_STATE_LOCKED , -RBD_LOCK_STATE_RELEASING , +RBD_LOCK_STATE_QUIESCING , };/* WatchNotify::ClientId */
@@ -427,7 +427,7 @@ struct rbd_device {struct list_head running_list;struct completion acquire_wait;int acquire_err; -struct completion releasing_wait; +struct completion quiescing_wait;spinlock_t object_map_lock;u8 *object_map;
@@ -519,7 +519,7 @@ static bool __rbd_is_lock_owner(struct rlockdep_assert_held (&rbd_dev->lock_rwsem);return rbd_dev->lock_state ==RBD_LOCK_STATE_LOCKED || - rbd_dev->lock_state ==RBD_LOCK_STATE_RELEASING ; + rbd_dev->lock_state ==RBD_LOCK_STATE_QUIESCING ; }static bool rbd_is_lock_owner (struct rbd_device *rbd_dev)
@@ -3609,12 +3609,12 @@ static void rbd_lock_del_request(structspin_lock (&rbd_dev->lock_lists_lock);if (!list_empty (&img_req->lock_item)) {list_del_init (&img_req->lock_item); - need_wakeup = (rbd_dev->lock_state ==RBD_LOCK_STATE_RELEASING && + need_wakeup = (rbd_dev->lock_state ==RBD_LOCK_STATE_QUIESCING &&list_empty (&rbd_dev->running_list)); }spin_unlock (&rbd_dev->lock_lists_lock);if (need_wakeup) -complete (&rbd_dev->releasing_wait); +complete (&rbd_dev->quiescing_wait); }static int rbd_img_exclusive_lock (struct rbd_img_request *img_req)
@@ -4281,16 +4281,16 @@ static bool rbd_quiesce_lock(struct rbd_/* * Ensure that all in-flight IO is flushed. */ - rbd_dev->lock_state =RBD_LOCK_STATE_RELEASING ; -rbd_assert (!completion_done (&rbd_dev->releasing_wait)); + rbd_dev->lock_state =RBD_LOCK_STATE_QUIESCING ; +rbd_assert (!completion_done (&rbd_dev->quiescing_wait));if (list_empty (&rbd_dev->running_list))return true;up_write (&rbd_dev->lock_rwsem); -wait_for_completion (&rbd_dev->releasing_wait); +wait_for_completion (&rbd_dev->quiescing_wait);down_write (&rbd_dev->lock_rwsem); -if (rbd_dev->lock_state !=RBD_LOCK_STATE_RELEASING ) +if (rbd_dev->lock_state !=RBD_LOCK_STATE_QUIESCING )return false;rbd_assert (list_empty (&rbd_dev->running_list));
@@ -5556,7 +5556,7 @@ static struct rbd_device *__rbd_dev_creaINIT_LIST_HEAD (&rbd_dev->acquiring_list);INIT_LIST_HEAD (&rbd_dev->running_list);init_completion (&rbd_dev->acquire_wait); -init_completion (&rbd_dev->releasing_wait); +init_completion (&rbd_dev->quiescing_wait);spin_lock_init (&rbd_dev->object_map_lock);
Greg Kroah-Hartman
maintainerPATCH 130/259 rbd: dont assume RBD_LOCK_STATE_LOCKED for exclusive mappings
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit 2237ceb71f89837ac47c5dce2aaa2c2b3a337a3c upstream.
Every time a watch is reestablished after getting lost, we need to update the cookie which involves quiescing exclusive lock. For this, we transition from RBD_LOCK_STATE_LOCKED to RBD_LOCK_STATE_QUIESCING roughly for the duration of rbd_reacquire_lock() call. If the mapping is exclusive and I/O happens to arrive in this time window, it's failed with EROFS (later translated to EIO) based on the wrong assumption in rbd_img_exclusive_lock() -- "lock got released?" check there stopped making sense with commit a2b1da09793d ("rbd: lock should be quiesced on reacquire").
To make it worse, any such I/O is added to the acquiring list before EROFS is returned and this sets up for violating rbd_lock_del_request() precondition that the request is either on the running list or not on any list at all -- see commit ded080c86b3f ("rbd: don't move requests to the running list on errors"). rbd_lock_del_request() ends up processing these requests as if they were on the running list which screws up quiescing_wait completion counter and ultimately leads to
rbd_assert(!completion_done(&rbd_dev->quiescing_wait));
being triggered on the next watch error.
--- drivers/block/rbd.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/block/rbd.c +5 -5
@@ -3608,6 +3608,7 @@ static void rbd_lock_del_request(structlockdep_assert_held (&rbd_dev->lock_rwsem);spin_lock (&rbd_dev->lock_lists_lock);if (!list_empty (&img_req->lock_item)) { +rbd_assert (!list_empty (&rbd_dev->running_list));list_del_init (&img_req->lock_item); need_wakeup = (rbd_dev->lock_state ==RBD_LOCK_STATE_QUIESCING &&list_empty (&rbd_dev->running_list));
@@ -3627,11 +3628,6 @@ static int rbd_img_exclusive_lock(structif (rbd_lock_add_request (img_req))return 1 ; -if (rbd_dev->opts->exclusive) { -WARN_ON (1 );/* lock got released? */ -return -EROFS ; - } -/* * Note the use of mod_delayed_work() in rbd_acquire_lock() * and cancel_delayed_work() in wake_lock_waiters().
@@ -4701,6 +4697,10 @@ static void rbd_reacquire_lock(struct rbrbd_warn (rbd_dev,"failed to update lock cookie: %d" , ret); +if (rbd_dev->opts->exclusive) +rbd_warn (rbd_dev, +"temporarily releasing lock on exclusive mapping" ); +/* * Lock cookie cannot be updated on older OSDs, so do * a manual release and queue an acquire.
Greg Kroah-Hartman
maintainerPATCH 131/259 Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hilda Wu <[email protected]>
commit 295ef07a9dae6182ad4b689aa8c6a7dbba21474c upstream.
Add the support ID 0489:e125 to usb_device_id table for Realtek RTL8852B chip.
The device info from /sys/kernel/debug/usb/devices as below.
T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=03 Dev#= 5 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e125 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -370,6 +370,8 @@ static const struct usb_device_id blackl BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3571), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH },/* Realtek Bluetooth devices */ { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
Greg Kroah-Hartman
maintainerPATCH 132/259 Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <[email protected]>
commit 473a89b4ed7fd52a419340f7c540d5c8fc96fc75 upstream.
Add the support ID(0x13d3, 0x3591) to usb_device_id table for Realtek RTL8852BE.
The device table is as follows:
T: Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 5 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3591 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -370,6 +370,8 @@ static const struct usb_device_id blackl BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3571), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3591), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH },
Greg Kroah-Hartman
maintainerPATCH 133/259 nilfs2: handle inconsistent state in nilfs_btnode_create_block()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
commit 4811f7af6090e8f5a398fbdd766f903ef6c0d787 upstream.
Syzbot reported that a buffer state inconsistency was detected in nilfs_btnode_create_block(), triggering a kernel bug.
It is not appropriate to treat this inconsistency as a bug; it can occur if the argument block address (the buffer index of the newly created block) is a virtual block number and has been reallocated due to corruption of the bitmap used to manage its allocation state.
So, modify nilfs_btnode_create_block() and its callers to treat it as a possible filesystem error, rather than triggering a kernel bug.
--- fs/nilfs2/btnode.c | 25 ++++++++++++++++++++----- fs/nilfs2/btree.c | 4 ++-- 2 files changed, 22 insertions(+), 7 deletions(-)
fs/nilfs2/btnode.c +20 -5
@@ -51,12 +51,21 @@ nilfs_btnode_create_block(struct address bh =nilfs_grab_buffer (inode, btnc, blocknr,BIT (BH_NILFS_Node));if (unlikely (!bh)) -return NULL ; +return ERR_PTR (-ENOMEM );if (unlikely (buffer_mapped (bh) ||buffer_uptodate (bh) ||buffer_dirty (bh))) { -brelse (bh); -BUG (); +/* +* The block buffer at the specified new address was already +* in use. This can happen if it is a virtual block number +* and has been reallocated due to corruption of the bitmap +* used to manage its allocation state (if not, the buffer +* clearing of an abandoned b-tree node is missing somewhere). +*/ +nilfs_error (inode->i_sb, +"state inconsistency probably due to duplicate use of b-tree node block address %llu (ino=%lu)" , + (unsigned long long )blocknr, inode->i_ino); + goto failed; }memset (bh->b_data,0 ,i_blocksize (inode)); bh->b_bdev = inode->i_sb->s_bdev;
@@ -67,6 +76,12 @@ nilfs_btnode_create_block(struct addressunlock_page (bh->b_page);put_page (bh->b_page);return bh; + +failed: +unlock_page (bh->b_page); +put_page (bh->b_page); +brelse (bh); +return ERR_PTR (-EIO ); } int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
@@ -217,8 +232,8 @@ retry: } nbh =nilfs_btnode_create_block (btnc, newkey); -if (!nbh) -return -ENOMEM ; +if (IS_ERR (nbh)) +return PTR_ERR (nbh);BUG_ON (nbh == obh); ctxt->newbh = nbh;
fs/nilfs2/btree.c +2 -2
@@ -63,8 +63,8 @@ static int nilfs_btree_get_new_block(construct buffer_head *bh; bh =nilfs_btnode_create_block (btnc, ptr); -if (!bh) -return -ENOMEM ; +if (IS_ERR (bh)) +return PTR_ERR (bh);set_buffer_nilfs_volatile (bh); *bhp = bh;
Greg Kroah-Hartman
maintainerPATCH 134/259 kdb: address -Wformat-security warnings
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 70867efacf4370b6c7cdfc7a5b11300e9ef7de64 ]
When -Wformat-security is not disabled, using a string pointer as a format causes a warning:
kernel/debug/kdb/kdb_io.c: In function 'kdb_read':kernel/debug/kdb/kdb_io.c:365:36: error: format not a string literal and no format arguments [-Werror=format-security]
365 | kdb_printf(kdb_prompt_str);
| ^~~~~~~~~~~~~~
kernel/debug/kdb/kdb_io.c: In function 'kdb_getstr':
kernel/debug/kdb/kdb_io.c:456:20: error: format not a string literal and no format arguments [-Werror=format-security]
456 | kdb_printf(kdb_prompt_str);
| ^~~~~~~~~~~~~~Use an explcit "%s" format instead.
--- kernel/debug/kdb/kdb_io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/debug/kdb/kdb_io.c +2 -2
@@ -368,7 +368,7 @@ static char *kdb_read(char *buffer, size_t bufsize)if (i >= dtab_count)kdb_printf ("..." );kdb_printf ("\n" ); -kdb_printf (kdb_prompt_str); +kdb_printf ("%s" , kdb_prompt_str);kdb_printf ("%s" , buffer);if (cp != lastchar)kdb_position_cursor (kdb_prompt_str, buffer, cp);
@@ -460,7 +460,7 @@ char *kdb_getstr(char *buffer, size_t bufsize, const char *prompt) {if (prompt && kdb_prompt_str != prompt)strscpy (kdb_prompt_str, prompt,CMD_BUFLEN ); -kdb_printf (kdb_prompt_str); +kdb_printf ("%s" , kdb_prompt_str); kdb_nextline =1 ;/* Prompt and input resets line number */ return kdb_read (buffer, bufsize); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/259 kdb: Use the passed prompt in kdb_position_cursor()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit e2e821095949cde46256034975a90f88626a2a73 ]
The function kdb_position_cursor() takes in a "prompt" parameter but never uses it. This doesn't _really_ matter since all current callers of the function pass the same value and it's a global variable, but it's a bit ugly. Let's clean it up.
Found by code inspection. This patch is expected to functionally be a no-op.
--- kernel/debug/kdb/kdb_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/debug/kdb/kdb_io.c +1 -1
@@ -192,7 +192,7 @@ static int kdb_read_get_key(char *buffer, size_t bufsize)*/ static void kdb_position_cursor (char *prompt,char *buffer,char *cp) { -kdb_printf ("\r%s" , kdb_prompt_str); +kdb_printf ("\r%s" , prompt);if (cp > buffer)kdb_printf ("%.*s" , (int )(cp - buffer), buffer); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/259 jfs: Fix array-index-out-of-bounds in diFree
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit f73f969b2eb39ad8056f6c7f3a295fa2f85e313a ]
--- fs/jfs/jfs_imap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/jfs/jfs_imap.c +4 -1
@@ -292,7 +292,7 @@ int diSync(struct inode *ipimap)int diRead (struct inode *ip) {struct jfs_sb_info *sbi =JFS_SBI (ip->i_sb); -int iagno, ino, extno, rc; +int iagno, ino, extno, rc, agno;struct inode *ipimap;struct dinode *dp;struct iag *iagp;
@@ -341,8 +341,11 @@ int diRead(struct inode *ip)/* get the ag for the iag */ agstart =le64_to_cpu (iagp->agstart); + agno =BLKTOAG (agstart,JFS_SBI (ip->i_sb));release_metapage (mp); +if (agno >=MAXAG || agno <0 ) +return -EIO ; rel_inode = (ino & (INOSPERPAGE -1 )); pageno = blkno >> sbi->l2nbperpage;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/259 um: time-travel: fix time-travel-start option
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 7d0a8a490aa3a2a82de8826aaf1dfa38575cb77a ]
We need to have the = as part of the option so that the value can be parsed properly. Also document that it must be given in nanoseconds, not seconds.
--- arch/um/kernel/time.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/um/kernel/time.c +2 -2
@@ -256,9 +256,9 @@ int setup_time_travel_start(char *str) return 1; } -__setup ("time-travel-start" , setup_time_travel_start); +__setup ("time-travel-start=" , setup_time_travel_start);__uml_help (setup_time_travel_start, -"time-travel-start=<seconds>\n" +"time-travel-start=<nanoseconds>\n" "Configure the UML instance's wall clock to start at this value rather than\n" "the host's wall clock at the time of UML boot.\n" );#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/259 libbpf: Fix no-args func prototype BTF dumping syntax
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 189f1a976e426011e6a5588f1d3ceedf71fe2965 ]
For all these years libbpf's BTF dumper has been emitting not strictly valid syntax for function prototypes that have no input arguments.
Instead of int (*blah)() we should emit int (*blah)(void).
This is not normally a problem, but it manifests when we get kfuncs in vmlinux.h that have no input arguments. Due to compiler internal specifics, we get no BTF information for such kfuncs, if they are not declared with proper (void).
The fix is trivial. We also need to adjust a few ancient tests that happily assumed () is correct.
--- tools/lib/bpf/btf_dump.c | 8 +++++--- .../selftests/bpf/progs/btf_dump_test_case_multidim.c | 4 ++-- .../selftests/bpf/progs/btf_dump_test_case_syntax.c | 4 ++-- 3 files changed, 9 insertions(+), 7 deletions(-)
tools/lib/bpf/btf_dump.c +5 -3
@@ -1302,10 +1302,12 @@ static void btf_dump_emit_type_chain(struct btf_dump *d,* Clang for BPF target generates func_proto with no * args as a func_proto with a single void arg (e.g., * `int (*f)(void)` vs just `int (*f)()`). We are -* going to pretend there are no args for such case. +* going to emit valid empty args (void) syntax for +* such case. Similarly and conveniently, valid +* no args case can be special-cased here as well. */ -if (vlen ==1 && p->type ==0 ) { -btf_dump_printf (d,")" ); +if (vlen ==0 || (vlen ==1 && p->type ==0 )) { +btf_dump_printf (d,"void)" );return ; }
tools/testing/selftests/bpf/progs/btf_dump_test_case_multidim.c +2 -2
@@ -14,9 +14,9 @@ typedef int *ptr_arr_t[6];typedef int *ptr_multiarr_t [7 ][8 ][9 ][10 ]; -typedef int * (*fn_ptr_arr_t [11 ])(); +typedef int * (*fn_ptr_arr_t [11 ])(void ); -typedef int * (*fn_ptr_multiarr_t [12 ][13 ])(); +typedef int * (*fn_ptr_multiarr_t [12 ][13 ])(void );struct root_struct {arr_t _1;
tools/testing/selftests/bpf/progs/btf_dump_test_case_syntax.c +2 -2
@@ -67,7 +67,7 @@ typedef void (*printf_fn_t)(const char *, ...);* `int -> char *` function and returns pointer to a char. Equivalent: * typedef char * (*fn_input_t)(int); * typedef char * (*fn_output_outer_t)(fn_input_t); -* typedef const fn_output_outer_t (* fn_output_inner_t)(); +* typedef const fn_output_outer_t (* fn_output_inner_t)(void); * typedef const fn_output_inner_t fn_ptr_arr2_t[5]; */ /* ----- START-EXPECTED-OUTPUT ----- */
@@ -94,7 +94,7 @@ typedef void (* (*signal_t)(int, void (*)(int)))(int);typedef char * (*fn_ptr_arr1_t [10 ])(int **); -typedef char * (* (*const fn_ptr_arr2_t [5 ])())(char * (*)(int )); +typedef char * (* (*const fn_ptr_arr2_t [5 ])(void ))(char * (*)(int ));struct struct_w_typedefs {int_t a;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/259 dma: fix call order in dmam_free_coherent
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lance Richardson <[email protected]>
[ Upstream commit 28e8b7406d3a1f5329a03aa25a43aa28e087cb20 ]
dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation. Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and add it to the devres list.
If this happens, there will be two entries in the devres list with the same vaddr and devres_destroy() can free the wrong entry, triggering the WARN_ON() in dmam_match.
Fix by destroying the devres entry before freeing the DMA allocation.
Tested:
kokonut //net/encryption
http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03
--- kernel/dma/mapping.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/dma/mapping.c +1 -1
@@ -59,8 +59,8 @@ void dmam_free_coherent(struct device *dev, size_t size, void *vaddr, {struct dma_devres match_data = { size, vaddr, dma_handle }; -dma_free_coherent (dev, size, vaddr, dma_handle);WARN_ON (devres_destroy (dev, dmam_release, dmam_match, &match_data)); +dma_free_coherent (dev, size, vaddr, dma_handle); }EXPORT_SYMBOL (dmam_free_coherent);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/259 MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory CLEMENT <[email protected]>
[ Upstream commit a263e5f309f32301e1f3ad113293f4e68a82a646 ]
When the CM block migrated from CM2.5 to CM3.0, the address offset for the Global CSR Access Privilege register was modified. We saw this in the "MIPS64 I6500 Multiprocessing System Programmer's Guide," it is stated that "the Global CSR Access Privilege register is located at offset 0x0120" in section 5.4. It is at least the same for I6400.
This fix allows to use the VP cores in SMP mode if the reset values were modified by the bootloader.
Based on the work of Vladimir Kondratiev <[email protected]> and the feedback from Jiaxun Yang <[email protected]>.
--- arch/mips/include/asm/mips-cm.h | 4 ++++ arch/mips/kernel/smp-cps.c | 5 ++++- 2 files changed, 8 insertions(+), 1 deletion(-)
arch/mips/include/asm/mips-cm.h +4 -0
@@ -228,6 +228,10 @@ GCR_ACCESSOR_RO(32, 0x0d0, gic_status) GCR_ACCESSOR_RO(32, 0x0f0, cpc_status)#define CM_GCR_CPC_STATUS_EX BIT(0) +/* GCR_ACCESS - Controls core/IOCU access to GCRs */ +GCR_ACCESSOR_RW(32, 0x120, access_cm3) +#define CM_GCR_ACCESS_ACCESSEN GENMASK(7, 0) +/* GCR_L2_CONFIG - Indicates L2 cache configuration when Config5.L2C=1 */ GCR_ACCESSOR_RW(32, 0x130, l2_config)#define CM_GCR_L2_CONFIG_BYPASS BIT(20)
arch/mips/kernel/smp-cps.c +4 -1
@@ -229,7 +229,10 @@ static void boot_core(unsigned int core, unsigned int vpe_id)write_gcr_co_reset_ext_base (CM_GCR_Cx_RESET_EXT_BASE_UEB);/* Ensure the core can access the GCRs */ -set_gcr_access (1 << core); +if (mips_cm_revision () <CM_REV_CM3 ) +set_gcr_access (1 << core); +else +set_gcr_access_cm3 (1 << core);if (mips_cpc_present ()) {/* Reset the core */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/259 ipv4: Fix incorrect source address in Record Route option
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit cc73bbab4b1fb8a4f53a24645871dafa5f81266a ]
The Record Route IP option records the addresses of the routers that routed the packet. In the case of forwarded packets, the kernel performs a route lookup via fib_lookup() and fills in the preferred source address of the matched route.
The lookup is performed with the DS field of the forwarded packet, but using the RT_TOS() macro which only masks one of the two ECN bits. If the packet is ECT(0) or CE, the matched route might be different than the route via which the packet was forwarded as the input path masks both of the ECN bits, resulting in the wrong address being filled in the Record Route option.
Fix by masking both of the ECN bits.
--- net/ipv4/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/route.c +1 -1
@@ -1283,7 +1283,7 @@ void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)struct flowi4 fl4 = { .daddr = iph->daddr, .saddr = iph->saddr, - .flowi4_tos =RT_TOS (iph->tos), + .flowi4_tos = iph->tos &IPTOS_RT_MASK , .flowi4_oif = rt->dst.dev->ifindex, .flowi4_iif = skb->dev->ifindex, .flowi4_mark = skb->mark,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/259 net: bonding: correctly annotate RCU in bond_should_notify_peers()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 3ba359c0cd6eb5ea772125a7aededb4a2d516684 ]
RCU use in bond_should_notify_peers() looks wrong, since it does rcu_dereference(), leaves the critical section, and uses the pointer after that.
Luckily, it's called either inside a nested RCU critical section or with the RTNL held.
Annotate it with rcu_dereference_rtnl() instead, and remove the inner RCU critical section.
--- drivers/net/bonding/bond_main.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
drivers/net/bonding/bond_main.c +2 -5
@@ -784,13 +784,10 @@ static struct slave *bond_find_best_slave(struct bonding *bond)return bestslave; } +/* must be called in RCU critical section or with RTNL held */ static bool bond_should_notify_peers(struct bonding *bond) { - struct slave *slave; - - rcu_read_lock(); - slave = rcu_dereference(bond->curr_active_slave); - rcu_read_unlock(); + struct slave *slave = rcu_dereference_rtnl(bond->curr_active_slave); if (!slave || !bond->send_peer_notif || bond->send_peer_notif %
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/259 tipc: Return non-zero value from tipc_udp_addr2str() on error
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit fa96c6baef1b5385e2f0c0677b32b3839e716076 ]
tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP media address.
--- net/tipc/udp_media.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/tipc/udp_media.c +4 -1
@@ -128,8 +128,11 @@ static int tipc_udp_addr2str(struct tipc_media_addr *a, char *buf, int size)snprintf (buf, size,"%pI4:%u" , &ua->ipv4,ntohs (ua->port)); else if (ntohs(ua->proto) == ETH_P_IPV6) snprintf(buf, size, "%pI6:%u", &ua->ipv6, ntohs(ua->port)); - else + else {pr_err ("Invalid UDP media address\n" ); +return 1 ; + } +return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/259 net: nexthop: Initialize all fields in dumped nexthops
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Machata <[email protected]>
[ Upstream commit 6d745cd0e9720282cd291d36b9db528aea18add2 ]
struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage. This can be observed e.g. with strace (edited for clarity):
# ip nexthop add id 1 dev lo
# ip nexthop add id 101 group 1
# strace -e recvmsg ip nexthop get id 101
...
recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},
[{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52The fields are reserved and therefore not currently used. But as they are, they leak kernel memory, and the fact they are not just zero complicates repurposing of the fields for new ends. Initialize the full structure.
--- net/ipv4/nexthop.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/ipv4/nexthop.c +4 -3
@@ -201,9 +201,10 @@ static int nla_put_nh_group(struct sk_buff *skb, struct nh_group *nhg) p =nla_data (nla);for (i =0 ; i < nhg->num_nh; ++i) { - p->id = nhg->nh_entries[i].nh->id; - p->weight = nhg->nh_entries[i].weight -1 ; - p +=1 ; + *p++ = (struct nexthop_grp ) { + .id = nhg->nh_entries[i].nh->id, + .weight = nhg->nh_entries[i].weight -1 , + }; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/259 bpf: Fix a segment issue when downgrading gso_size
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fred Li <[email protected]>
[ Upstream commit fa5ef655615a01533035c6139248c5b33aa27028 ]
Linearize the skb when downgrading gso_size because it may trigger a BUG_ON() later when the skb is segmented as described in [1,2].
--- net/core/filter.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
net/core/filter.c +11 -4
@@ -3126,13 +3126,20 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,if (skb_is_gso (skb)) {struct skb_shared_info *shinfo =skb_shinfo (skb); -/* Due to header grow, MSS needs to be downgraded. */ -if (!(flags &BPF_F_ADJ_ROOM_FIXED_GSO )) -skb_decrease_gso_size (shinfo, len_diff); -/* Header must be checked, and gso_segs recomputed. */ shinfo->gso_type |= gso_type; shinfo->gso_segs =0 ; + +/* Due to header growth, MSS needs to be downgraded. +* There is a BUG_ON() when segmenting the frag_list with +* head_frag true, so linearize the skb after downgrading +* the MSS. +*/ +if (!(flags &BPF_F_ADJ_ROOM_FIXED_GSO )) { +skb_decrease_gso_size (shinfo, len_diff); +if (shinfo->frag_list) +return skb_linearize (skb); + } }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/259 mISDN: Fix a use after free in hfcmulti_tx()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 61ab751451f5ebd0b98e02276a44e23a10110402 ]
Don't dereference *sp after calling dev_kfree_skb(*sp).
--- drivers/isdn/hardware/mISDN/hfcmulti.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/isdn/hardware/mISDN/hfcmulti.c +4 -3
@@ -1931,7 +1931,7 @@ hfcmulti_dtmf(struct hfc_multi *hc)static void hfcmulti_tx (struct hfc_multi *hc,int ch) { -int i, ii, temp, len =0 ; +int i, ii, temp, tmp_len, len =0 ;int Zspace, z1, z2;/* must be int for calculation */ int Fspace, f1, f2;u_char *d;
@@ -2152,14 +2152,15 @@ hfcmulti_tx(struct hfc_multi *hc, int ch)HFC_wait_nodebug (hc); } + tmp_len = (*sp)->len;dev_kfree_skb (*sp);/* check for next frame */ if (bch &&get_next_bframe (bch)) { - len = (*sp)->len; + len = tmp_len; goto next_frame; }if (dch &&get_next_dframe (dch)) { - len = (*sp)->len; + len = tmp_len; goto next_frame; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/259 apparmor: Fix null pointer deref when receiving skb during sock creation
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Liang <[email protected]>
[ Upstream commit fce09ea314505a52f2436397608fa0a5d0934fb1 ]
The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SK_CTX(sk)->label is updated in apparmor_socket_post_create(), but the packet is delivered to the socket before that, causing the null pointer dereference. Drop the packet if label context is not set.
BUG: kernel NULL pointer dereference, address: 000000000000004c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020
RIP: 0010:aa_label_next_confined+0xb/0x40
Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 <8b> 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2
RSP: 0018:ffffa92940003b08 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e
RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002
R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS: 00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0
PKRU: 55555554
Call Trace:
<IRQ>
? __die+0x23/0x70
? page_fault_oops+0x171/0x4e0
? exc_page_fault+0x7f/0x180
? asm_exc_page_fault+0x26/0x30
? aa_label_next_confined+0xb/0x40
apparmor_secmark_check+0xec/0x330
security_sock_rcv_skb+0x35/0x50
sk_filter_trim_cap+0x47/0x250
sock_queue_rcv_skb_reason+0x20/0x60
raw_rcv+0x13c/0x210
raw_local_deliver+0x1f3/0x250
ip_protocol_deliver_rcu+0x4f/0x2f0
ip_local_deliver_finish+0x76/0xa0
__netif_receive_skb_one_core+0x89/0xa0
netif_receive_skb+0x119/0x170
? __netdev_alloc_skb+0x3d/0x140
vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]
__napi_poll+0x28/0x1b0
net_rx_action+0x2a4/0x380
__do_softirq+0xd1/0x2c8
__irq_exit_rcu+0xbb/0xf0
common_interrupt+0x86/0xa0
</IRQ>
<TASK>
asm_common_interrupt+0x26/0x40
RIP: 0010:apparmor_socket_post_create+0xb/0x200
Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 <55> 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48
RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286
RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748
? __pfx_apparmor_socket_post_create+0x10/0x10
security_socket_post_create+0x4b/0x80
__sock_create+0x176/0x1f0
__sys_socket+0x89/0x100
__x64_sys_socket+0x17/0x20
do_syscall_64+0x5d/0x90
? do_syscall_64+0x6c/0x90
? do_syscall_64+0x6c/0x90
? do_syscall_64+0x6c/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc--- security/apparmor/lsm.c | 7 +++++++ 1 file changed, 7 insertions(+)
security/apparmor/lsm.c +7 -0
@@ -1035,6 +1035,13 @@ static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)if (!skb->secmark)return 0 ; +/* +* If reach here before socket_post_create hook is called, in which +* case label is null, drop the packet. +*/ +if (!ctx->label) +return -EACCES ; +return apparmor_secmark_check (ctx->label,OP_RECVMSG ,AA_MAY_RECEIVE , skb->secmark, sk); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/259 powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit b4cf5fc01ce83e5c0bcf3dbb9f929428646b9098 ]
missing fdput() on one of the failure exits
--- arch/powerpc/kvm/powerpc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/kvm/powerpc.c +3 -1
@@ -1950,8 +1950,10 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,break ; r = -ENXIO ; -if (!xive_enabled ()) +if (!xive_enabled ()) { +fdput (f);break ; + } r = -EPERM ; dev =kvm_device_from_filp (f.file);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 149/259 ASoC: Intel: Convert to new X86 CPU match macros
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit d51ba9c6663d7171681be357f672503f4e2ccdc1 ]
The new macro set has a consistent namespace and uses C99 initializers instead of the grufty C89 ones.
Get rid the of the local macro wrappers for consistency.
Stable-dep-of: 9931f7d5d251 ("ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable")
--- sound/soc/intel/common/soc-intel-quirks.h | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
sound/soc/intel/common/soc-intel-quirks.h +6 -8
@@ -16,13 +16,11 @@#include <asm/intel-family.h> #include <asm/iosf_mbi.h> -#define ICPU (model) { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, } -#define SOC_INTEL_IS_CPU (soc, type) \ static inline bool soc_intel_is_##soc(void) \ { \ static const struct x86_cpu_id soc##_cpu_ids[] = { \ - ICPU(type), \ + X86_MATCH_INTEL_FAM6_MODEL(type, NULL), \ {} \ }; \ const struct x86_cpu_id *id; \
@@ -33,11 +31,11 @@ static inline bool soc_intel_is_##soc(void) \return false; \ } -SOC_INTEL_IS_CPU (byt,INTEL_FAM6_ATOM_SILVERMONT ); -SOC_INTEL_IS_CPU (cht,INTEL_FAM6_ATOM_AIRMONT ); -SOC_INTEL_IS_CPU (apl,INTEL_FAM6_ATOM_GOLDMONT ); -SOC_INTEL_IS_CPU (glk,INTEL_FAM6_ATOM_GOLDMONT_PLUS ); -SOC_INTEL_IS_CPU (cml,INTEL_FAM6_KABYLAKE_L ); +SOC_INTEL_IS_CPU (byt,ATOM_SILVERMONT ); +SOC_INTEL_IS_CPU (cht,ATOM_AIRMONT ); +SOC_INTEL_IS_CPU (apl,ATOM_GOLDMONT ); +SOC_INTEL_IS_CPU (glk,ATOM_GOLDMONT_PLUS ); +SOC_INTEL_IS_CPU (cml,KABYLAKE_L );static inline bool soc_intel_is_byt_cr (struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/259 ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit cd45c9bf8b43cd387e167cf166ae5c517f56d658 ]
The soc_intel_is_foo() helpers from sound/soc/intel/common/soc-intel-quirks.h are useful outside of the sound subsystem too.
Move these to include/linux/platform_data/x86/soc.h, so that other code can use them too.
Stable-dep-of: 9931f7d5d251 ("ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable")
--- include/linux/platform_data/x86/soc.h | 65 +++++++++++++++++++++++ sound/soc/intel/common/soc-intel-quirks.h | 51 ++---------------- 2 files changed, 68 insertions(+), 48 deletions(-) create mode 100644 include/linux/platform_data/x86/soc.h
include/linux/platform_data/x86/soc.h new file +65 -0
@@ -0,0 +1,65 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* +* Helpers for Intel SoC model detection +* +* Copyright (c) 2019, Intel Corporation. +*/ + +#ifndef __PLATFORM_DATA_X86_SOC_H +#define __PLATFORM_DATA_X86_SOC_H + +#if IS_ENABLED (CONFIG_X86 ) + +#include <asm/cpu_device_id.h> +#include <asm/intel-family.h> + +#define SOC_INTEL_IS_CPU (soc, type) \ +static inline bool soc_intel_is_##soc(void) \ +{ \ + static const struct x86_cpu_id soc##_cpu_ids[] = { \ + X86_MATCH_INTEL_FAM6_MODEL(type, NULL), \ + {} \ + }; \ + const struct x86_cpu_id *id; \ + \ + id = x86_match_cpu(soc##_cpu_ids); \ + if (id) \ + return true; \ + return false; \ +} + +SOC_INTEL_IS_CPU (byt,ATOM_SILVERMONT ); +SOC_INTEL_IS_CPU (cht,ATOM_AIRMONT ); +SOC_INTEL_IS_CPU (apl,ATOM_GOLDMONT ); +SOC_INTEL_IS_CPU (glk,ATOM_GOLDMONT_PLUS ); +SOC_INTEL_IS_CPU (cml,KABYLAKE_L ); + +#else /* IS_ENABLED(CONFIG_X86) */ + +static inline bool soc_intel_is_byt (void ) +{ +return false; +} + +static inline bool soc_intel_is_cht (void ) +{ +return false; +} + +static inline bool soc_intel_is_apl (void ) +{ +return false; +} + +static inline bool soc_intel_is_glk (void ) +{ +return false; +} + +static inline bool soc_intel_is_cml (void ) +{ +return false; +} +#endif /* IS_ENABLED(CONFIG_X86) */ + +#endif /* __PLATFORM_DATA_X86_SOC_H */
sound/soc/intel/common/soc-intel-quirks.h +3 -48
67 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 151/259 ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 9931f7d5d251882a147cc5811060097df43e79f5 ]
the Intel kbuild bot reports a link failure when IOSF_MBI is built-in but the Merrifield driver is configured as a module. The soc-intel-quirks.h is included for Merrifield platforms, but IOSF_MBI is not selected for that platform.
ld.lld: error: undefined symbol: iosf_mbi_read
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
referenced by
atom.c
sound/soc/sof/intel/atom.o:(atom_machine_select) in archive vmlinux.a
This patch forces the use of the fallback static inline when IOSF_MBI is not reachable.
--- sound/soc/intel/common/soc-intel-quirks.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/intel/common/soc-intel-quirks.h +1 -1
@@ -11,7 +11,7 @@#include <linux/platform_data/x86/soc.h> -#if IS_ENABLED (CONFIG_X86 ) +#if IS_REACHABLE (CONFIG_IOSF_MBI )#include <linux/dmi.h> #include <asm/iosf_mbi.h>
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/259 s390/pci: fix CPU address in MSI for directed IRQ
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Gordeev <[email protected]>
[ Upstream commit a2bd4097b3ec242f4de4924db463a9c94530e03a ]
The directed MSIs are delivered to CPUs whose address is written to the MSI message address. The current code assumes that a CPU logical number (as it is seen by the kernel) is also the CPU address.
The above assumption is not correct, as the CPU address is rather the value returned by STAP instruction. That value does not necessarily match the kernel logical CPU number.
Stable-dep-of: ab42fcb511fd ("s390/pci: Allow allocation of more than 1 MSI interrupt")
--- arch/s390/pci/pci_irq.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
arch/s390/pci/pci_irq.c +11 -3
@@ -103,9 +103,10 @@ static int zpci_set_irq_affinity(struct irq_data *data, const struct cpumask *de {struct msi_desc *entry =irq_get_msi_desc (data->irq);struct msi_msg msg = entry->msg; +int cpu_addr =smp_cpu_get_cpu_address (cpumask_first (dest)); msg.address_lo &=0xff0000ff ; - msg.address_lo |= (cpumask_first (dest) <<8 ); + msg.address_lo |= (cpu_addr <<8 );pci_write_msi_msg (data->irq, &msg);return IRQ_SET_MASK_OK ;
@@ -238,6 +239,7 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)unsigned long bit;struct msi_desc *msi;struct msi_msg msg; +int cpu_addr;int rc, irq; zdev->aisb =-1UL ;
@@ -287,9 +289,15 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type) handle_percpu_irq); msg.data = hwirq - bit;if (irq_delivery ==DIRECTED ) { +if (msi->affinity) + cpu =cpumask_first (&msi->affinity->mask); +else + cpu =0 ; + cpu_addr =smp_cpu_get_cpu_address (cpu); + msg.address_lo = zdev->msi_addr &0xff0000ff ; - msg.address_lo |= msi->affinity ? - (cpumask_first (&msi->affinity->mask) <<8 ) :0 ; + msg.address_lo |= (cpu_addr <<8 ); +for_each_possible_cpu (cpu) {airq_iv_set_data (zpci_ibv[cpu], hwirq, irq); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 153/259 s390/pci: Do not mask MSI[-X] entries on teardown
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 3998527d2e3ee2bfdf710a45b7b90968ff87babc ]
The PCI core already ensures that the MSI[-X] state is correct when MSI[-X] is disabled. For MSI the reset state is all entries unmasked and for MSI-X all vectors are masked.
S390 masks all MSI entries and masks the already masked MSI-X entries again. Remove it and let the device in the correct state.
Stable-dep-of: ab42fcb511fd ("s390/pci: Allow allocation of more than 1 MSI interrupt")
--- arch/s390/pci/pci_irq.c | 4 ---- drivers/pci/msi.c | 4 ++-- include/linux/msi.h | 2 -- 3 files changed, 2 insertions(+), 8 deletions(-)
arch/s390/pci/pci_irq.c +0 -4
@@ -341,10 +341,6 @@ void arch_teardown_msi_irqs(struct pci_dev *pdev)for_each_pci_msi_entry (msi, pdev) {if (!msi->irq)continue ; -if (msi->msi_attrib.is_msix) -__pci_msix_desc_mask_irq (msi,1 ); -else -__pci_msi_desc_mask_irq (msi,1 ,1 );irq_set_msi_desc (msi->irq,NULL );irq_free_desc (msi->irq); msi->msg.address_lo =0 ;
drivers/pci/msi.c +2 -2
@@ -170,7 +170,7 @@ static inline __attribute_const__ u32 msi_mask(unsigned x)* reliably as devices without an INTx disable bit will then generate a * level IRQ which will never be cleared. */ -void __pci_msi_desc_mask_irq (struct msi_desc *desc,u32 mask,u32 flag) +static void __pci_msi_desc_mask_irq (struct msi_desc *desc,u32 mask,u32 flag) {raw_spinlock_t *lock = &desc->dev->msi_lock;unsigned long flags;
@@ -207,7 +207,7 @@ static void __iomem *pci_msix_desc_addr(struct msi_desc *desc)* file. This saves a few milliseconds when initialising devices with lots * of MSI-X interrupts. */ -u32 __pci_msix_desc_mask_irq (struct msi_desc *desc,u32 flag) +static u32 __pci_msix_desc_mask_irq (struct msi_desc *desc,u32 flag) {u32 mask_bits = desc->masked;void __iomem *desc_addr;
include/linux/msi.h +0 -2
@@ -193,8 +193,6 @@ void free_msi_entry(struct msi_desc *entry);void __pci_read_msi_msg (struct msi_desc *entry,struct msi_msg *msg);void __pci_write_msi_msg (struct msi_desc *entry,struct msi_msg *msg); -u32 __pci_msix_desc_mask_irq (struct msi_desc *desc,u32 flag); -void __pci_msi_desc_mask_irq (struct msi_desc *desc,u32 mask,u32 flag);void pci_msi_mask_irq (struct irq_data *data);void pci_msi_unmask_irq (struct irq_data *data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 154/259 s390/pci: Rework MSI descriptor walk
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 2ca5e908d0f4cde61d9d3595e8314adca5d914a1 ]
Replace the about to vanish iterators and make use of the filtering.
Stable-dep-of: ab42fcb511fd ("s390/pci: Allow allocation of more than 1 MSI interrupt")
--- arch/s390/pci/pci_irq.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
arch/s390/pci/pci_irq.c +2 -4
@@ -273,7 +273,7 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)/* Request MSI interrupts */ hwirq = bit; -for_each_pci_msi_entry (msi, pdev) { +msi_for_each_desc (msi, &pdev->dev,MSI_DESC_NOTASSOCIATED ) { rc = -EIO ;if (hwirq - bit >= msi_vecs)break ;
@@ -338,9 +338,7 @@ void arch_teardown_msi_irqs(struct pci_dev *pdev)return ;/* Release MSI interrupts */ -for_each_pci_msi_entry (msi, pdev) { -if (!msi->irq) -continue ; +msi_for_each_desc (msi, &pdev->dev,MSI_DESC_ASSOCIATED ) {irq_set_msi_desc (msi->irq,NULL );irq_free_desc (msi->irq); msi->msg.address_lo =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 155/259 s390/pci: Refactor arch_setup_msi_irqs()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit 5fd11b96b43708f2f6e3964412c301c1bd20ec0f ]
Factor out adapter interrupt allocation from arch_setup_msi_irqs() in preparation for enabling registration of multiple MSIs. Code movement only, no change of functionality intended.
Stable-dep-of: ab42fcb511fd ("s390/pci: Allow allocation of more than 1 MSI interrupt")
--- arch/s390/pci/pci_irq.c | 54 ++++++++++++++++++++++++----------------- 1 file changed, 32 insertions(+), 22 deletions(-)
arch/s390/pci/pci_irq.c +32 -22
@@ -232,33 +232,20 @@ static void zpci_floating_irq_handler(struct airq_struct *airq, bool floating) } } -int arch_setup_msi_irqs (struct pci_dev *pdev,int nvec,int type) +static int __alloc_airq (struct zpci_dev *zdev,int msi_vecs, +unsigned long *bit) { -struct zpci_dev *zdev =to_zpci (pdev); -unsigned int hwirq, msi_vecs, cpu; -unsigned long bit; -struct msi_desc *msi; -struct msi_msg msg; -int cpu_addr; -int rc, irq; - - zdev->aisb =-1UL ; - zdev->msi_first_bit =-1U ; -if (type ==PCI_CAP_ID_MSI && nvec >1 ) -return 1 ; - msi_vecs = min_t(unsigned int, nvec, zdev->max_msi); -if (irq_delivery ==DIRECTED ) {/* Allocate cpu vector bits */ - bit =airq_iv_alloc (zpci_ibv[0 ], msi_vecs); -if (bit ==-1UL ) + *bit =airq_iv_alloc (zpci_ibv[0 ], msi_vecs); +if (*bit ==-1UL )return -EIO ; }else {/* Allocate adapter summary indicator bit */ - bit =airq_iv_alloc_bit (zpci_sbv); -if (bit ==-1UL ) + *bit =airq_iv_alloc_bit (zpci_sbv); +if (*bit ==-1UL )return -EIO ; - zdev->aisb = bit; + zdev->aisb = *bit;/* Create adapter interrupt vector */ zdev->aibv =airq_iv_create (msi_vecs,AIRQ_IV_DATA |AIRQ_IV_BITLOCK );
@@ -266,10 +253,33 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)return -ENOMEM ;/* Wire up shortcut pointer */ - zpci_ibv[bit] = zdev->aibv; + zpci_ibv[*bit] = zdev->aibv;/* Each function has its own interrupt vector */ - bit =0 ; + *bit =0 ; } +return 0 ; +} + +int arch_setup_msi_irqs (struct pci_dev *pdev,int nvec,int type) +{ +struct zpci_dev *zdev =to_zpci (pdev); +unsigned int hwirq, msi_vecs, cpu; +struct msi_desc *msi; +struct msi_msg msg; +unsigned long bit; +int cpu_addr; +int rc, irq; + + zdev->aisb =-1UL ; + zdev->msi_first_bit =-1U ; + +if (type ==PCI_CAP_ID_MSI && nvec >1 ) +return 1 ; + msi_vecs = min_t(unsigned int, nvec, zdev->max_msi); + + rc =__alloc_airq (zdev, msi_vecs, &bit); +if (rc <0 ) +return rc;/* Request MSI interrupts */ hwirq = bit;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/259 s390/pci: Allow allocation of more than 1 MSI interrupt
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerd Bayer <[email protected]>
[ Upstream commit ab42fcb511fd9d241bbab7cc3ca04e34e9fc0666 ]
On a PCI adapter that provides up to 8 MSI interrupt sources the s390 implementation of PCI interrupts rejected to accommodate them, although the underlying hardware is able to support that.
For MSI-X it is sufficient to allocate a single irq_desc per msi_desc, but for MSI multiple irq descriptors are attached to and controlled by a single msi descriptor. Add the appropriate loops to maintain multiple irq descriptors and tie/untie them to/from the appropriate AIBV bit, if a device driver allocates more than 1 MSI interrupt.
Common PCI code passes on requests to allocate a number of interrupt vectors based on the device drivers' demand and the PCI functions' capabilities. However, the root-complex of s390 systems support just a limited number of interrupt vectors per PCI function. Produce a kernel log message to inform about any architecture-specific capping that might be done.
With this change, we had a PCI adapter successfully raising interrupts to its device driver via all 8 sources.
--- arch/s390/pci/pci_irq.c | 62 ++++++++++++++++++++++++++++------------- 1 file changed, 42 insertions(+), 20 deletions(-)
arch/s390/pci/pci_irq.c +42 -20
@@ -262,8 +262,8 @@ static int __alloc_airq(struct zpci_dev *zdev, int msi_vecs,int arch_setup_msi_irqs (struct pci_dev *pdev,int nvec,int type) { +unsigned int hwirq, msi_vecs, irqs_per_msi, i, cpu;struct zpci_dev *zdev =to_zpci (pdev); -unsigned int hwirq, msi_vecs, cpu;struct msi_desc *msi;struct msi_msg msg;unsigned long bit;
@@ -273,30 +273,46 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type) zdev->aisb =-1UL ; zdev->msi_first_bit =-1U ; -if (type ==PCI_CAP_ID_MSI && nvec >1 ) -return 1 ; msi_vecs = min_t(unsigned int, nvec, zdev->max_msi); +if (msi_vecs < nvec) { +pr_info ("%s requested %d irqs, allocate system limit of %d" , +pci_name (pdev), nvec, zdev->max_msi); + } rc =__alloc_airq (zdev, msi_vecs, &bit);if (rc <0 )return rc; -/* Request MSI interrupts */ +/* +* Request MSI interrupts: +* When using MSI, nvec_used interrupt sources and their irq +* descriptors are controlled through one msi descriptor. +* Thus the outer loop over msi descriptors shall run only once, +* while two inner loops iterate over the interrupt vectors. +* When using MSI-X, each interrupt vector/irq descriptor +* is bound to exactly one msi descriptor (nvec_used is one). +* So the inner loops are executed once, while the outer iterates +* over the MSI-X descriptors. +*/ hwirq = bit;msi_for_each_desc (msi, &pdev->dev,MSI_DESC_NOTASSOCIATED ) { - rc = -EIO ;if (hwirq - bit >= msi_vecs)break ; - irq =__irq_alloc_descs (-1 ,0 ,1 ,0 ,THIS_MODULE , - (irq_delivery ==DIRECTED ) ? - msi->affinity :NULL ); + irqs_per_msi = min_t(unsigned int, msi_vecs, msi->nvec_used); + irq =__irq_alloc_descs (-1 ,0 , irqs_per_msi,0 ,THIS_MODULE , + (irq_delivery ==DIRECTED ) ? + msi->affinity :NULL );if (irq <0 )return -ENOMEM ; - rc =irq_set_msi_desc (irq, msi); -if (rc) -return rc; -irq_set_chip_and_handler (irq, &zpci_irq_chip, - handle_percpu_irq); + +for (i =0 ; i < irqs_per_msi; i++) { + rc =irq_set_msi_desc_off (irq, i, msi); +if (rc) +return rc; +irq_set_chip_and_handler (irq + i, &zpci_irq_chip, + handle_percpu_irq); + } + msg.data = hwirq - bit;if (irq_delivery ==DIRECTED ) {if (msi->affinity)
@@ -309,19 +325,22 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type) msg.address_lo |= (cpu_addr <<8 );for_each_possible_cpu (cpu) { -airq_iv_set_data (zpci_ibv[cpu], hwirq, irq); +for (i =0 ; i < irqs_per_msi; i++) +airq_iv_set_data (zpci_ibv[cpu], + hwirq + i, irq + i); } }else { msg.address_lo = zdev->msi_addr &0xffffffff ; -airq_iv_set_data (zdev->aibv, hwirq, irq); +for (i =0 ; i < irqs_per_msi; i++) +airq_iv_set_data (zdev->aibv, hwirq + i, irq + i); } msg.address_hi = zdev->msi_addr >>32 ;pci_write_msi_msg (irq, &msg); - hwirq++; + hwirq += irqs_per_msi; } zdev->msi_first_bit = bit; - zdev->msi_nr_irqs = msi_vecs; + zdev->msi_nr_irqs = hwirq - bit;if (irq_delivery ==DIRECTED ) rc =zpci_set_directed_irq (zdev);
@@ -330,13 +349,14 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)if (rc)return rc; -return (msi_vecs == nvec) ?0 : msi_vecs; +return (zdev->msi_nr_irqs == nvec) ?0 : zdev->msi_nr_irqs; }void arch_teardown_msi_irqs (struct pci_dev *pdev) {struct zpci_dev *zdev =to_zpci (pdev);struct msi_desc *msi; +unsigned int i;int rc;/* Disable interrupts */
@@ -349,8 +369,10 @@ void arch_teardown_msi_irqs(struct pci_dev *pdev)/* Release MSI interrupts */ msi_for_each_desc (msi, &pdev->dev,MSI_DESC_ASSOCIATED ) { -irq_set_msi_desc (msi->irq,NULL ); -irq_free_desc (msi->irq); +for (i =0 ; i < msi->nvec_used; i++) { +irq_set_msi_desc (msi->irq + i,NULL ); +irq_free_desc (msi->irq + i); + } msi->msg.address_lo =0 ; msi->msg.address_hi =0 ; msi->msg.data =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/259 nvme-pci: add missing condition check for existence of mapped data
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit c31fad1470389666ac7169fe43aa65bf5b7e2cfd ]
nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoid dereference.
--- drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +2 -1
@@ -938,7 +938,8 @@ static blk_status_t nvme_queue_rq(struct blk_mq_hw_ctx *hctx,nvme_submit_cmd (nvmeq, &cmnd, bd->last);return BLK_STS_OK ; out_unmap_data: -nvme_unmap_data (dev, req); +if (blk_rq_nr_phys_segments (req)) +nvme_unmap_data (dev, req); out_free_cmd:nvme_cleanup_cmd (req);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 158/259 mm: avoid overflows in dirty throttling logic
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 385d838df280eba6c8680f9777bfa0d0bfe7e8b2 ]
The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications fit into 64-bits). If limits end up being larger, we will hit overflows, possible divisions by 0 etc. Fix these problems by never allowing so large dirty limits as they have dubious practical value anyway. For dirty_bytes / dirty_background_bytes interfaces we can just refuse to set so large limits. For dirty_ratio / dirty_background_ratio it isn't so simple as the dirty limit is computed from the amount of available memory which can change due to memory hotplug etc. So when converting dirty limits from ratios to numbers of pages, we just don't allow the result to exceed UINT_MAX.
This is root-only triggerable problem which occurs when the operator sets dirty limits to >16 TB.
--- mm/page-writeback.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-)
mm/page-writeback.c +26 -4
@@ -433,13 +433,20 @@ static void domain_dirty_limits(struct dirty_throttle_control *dtc)else bg_thresh = (bg_ratio * available_memory) /PAGE_SIZE ; -if (bg_thresh >= thresh) - bg_thresh = thresh /2 ; tsk = current;if (tsk->flags &PF_LESS_THROTTLE ||rt_task (tsk)) { bg_thresh += bg_thresh /4 + global_wb_domain.dirty_limit /32 ; thresh += thresh /4 + global_wb_domain.dirty_limit /32 ; } +/* +* Dirty throttling logic assumes the limits in page units fit into +* 32-bits. This gives 16TB dirty limits max which is hopefully enough. +*/ +if (thresh >UINT_MAX ) + thresh =UINT_MAX ; +/* This makes sure bg_thresh is within 32-bits as well */ +if (bg_thresh >= thresh) + bg_thresh = thresh /2 ; dtc->thresh = thresh; dtc->bg_thresh = bg_thresh;
@@ -489,7 +496,11 @@ static unsigned long node_dirty_limit(struct pglist_data *pgdat)if (tsk->flags &PF_LESS_THROTTLE ||rt_task (tsk)) dirty += dirty /4 ; -return dirty; +/* +* Dirty throttling logic assumes the limits in page units fit into +* 32-bits. This gives 16TB dirty limits max which is hopefully enough. +*/ + return min_t(unsigned long, dirty, UINT_MAX); }/**
@@ -528,10 +539,17 @@ int dirty_background_bytes_handler(struct ctl_table *table, int write, loff_t *ppos) {int ret; +unsigned long old_bytes = dirty_background_bytes; ret =proc_doulongvec_minmax (table, write, buffer, lenp, ppos); -if (ret ==0 && write) +if (ret ==0 && write) { +if (DIV_ROUND_UP (dirty_background_bytes,PAGE_SIZE ) > +UINT_MAX ) { + dirty_background_bytes = old_bytes; +return -ERANGE ; + } dirty_background_ratio =0 ; + }return ret; }
@@ -559,6 +577,10 @@ int dirty_bytes_handler(struct ctl_table *table, int write, ret =proc_doulongvec_minmax (table, write, buffer, lenp, ppos);if (ret ==0 && write && vm_dirty_bytes != old_bytes) { +if (DIV_ROUND_UP (vm_dirty_bytes,PAGE_SIZE ) >UINT_MAX ) { + vm_dirty_bytes = old_bytes; +return -ERANGE ; + }writeback_set_ratelimit (); vm_dirty_ratio =0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 159/259 PCI: rockchip: Make ep-gpios DT property optional
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <[email protected]>
[ Upstream commit 58adbfb3ebec460e8b58875c682bafd866808e80 ]
The Rockchip PCIe controller DT binding clearly states that 'ep-gpios' is an optional property. And indeed there are boards that don't require it.
Make the driver follow the binding by using devm_gpiod_get_optional() instead of devm_gpiod_get().
Stable-dep-of: 840b7a5edf88 ("PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio")
--- drivers/pci/controller/pcie-rockchip.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/controller/pcie-rockchip.c +6 -6
@@ -84,7 +84,7 @@ int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip) } rockchip->mgmt_sticky_rst =devm_reset_control_get_exclusive (dev, -"mgmt-sticky" ); +"mgmt-sticky" );if (IS_ERR (rockchip->mgmt_sticky_rst)) {if (PTR_ERR (rockchip->mgmt_sticky_rst) != -EPROBE_DEFER )dev_err (dev,"missing mgmt-sticky reset property in node\n" );
@@ -120,11 +120,11 @@ int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip) }if (rockchip->is_rc) { - rockchip->ep_gpio =devm_gpiod_get (dev,"ep" ,GPIOD_OUT_HIGH ); -if (IS_ERR (rockchip->ep_gpio)) { -dev_err (dev,"missing ep-gpios property in node\n" ); -return PTR_ERR (rockchip->ep_gpio); - } + rockchip->ep_gpio =devm_gpiod_get_optional (dev,"ep" , +GPIOD_OUT_HIGH ); +if (IS_ERR (rockchip->ep_gpio)) +return dev_err_probe (dev,PTR_ERR (rockchip->ep_gpio), +"failed to get ep GPIO\n" ); } rockchip->aclk_pcie =devm_clk_get (dev,"aclk" );
Signature · 1 line
2.43.0