6.1.113-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 414/798 ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
[ Upstream commit 47d7d3fd72afc7dcd548806291793ee6f3848215 ]
In most Linux distribution kernels, the SND is set to m, in such a case, when booting the kernel on i.MX8MP EVK board, there is a warning calltrace like below:
Call trace: snd_card_init+0x484/0x4cc [snd] snd_card_new+0x70/0xa8 [snd] snd_soc_bind_card+0x310/0xbd0 [snd_soc_core] snd_soc_register_card+0xf0/0x108 [snd_soc_core] devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core]
That is because the card.owner is not set, a warning calltrace is raised in the snd_card_init() due to it.
--- sound/soc/fsl/imx-card.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/fsl/imx-card.c +1 -0
@@ -731,6 +731,7 @@ static int imx_card_probe(struct platform_device *pdev) data->plat_data = plat_data; data->card.dev = &pdev->dev; + data->card.owner =THIS_MODULE ;dev_set_drvdata (&pdev->dev, &data->card);snd_soc_card_set_drvdata (&data->card, data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 415/798 ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b3ebb007060f89d5a45c9b99f06a55e36a1945b5 ]
We received a regression report for System76 Pangolin (pang14) due to the recent fix for Tuxedo Sirius devices to support the top speaker. The reason was the conflicting PCI SSID, as often seen.
As a workaround, now the codec SSID is checked and the quirk is applied conditionally only to Sirius devices.
--- sound/pci/hda/patch_conexant.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
sound/pci/hda/patch_conexant.c +19 -5
@@ -820,6 +820,23 @@ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = { {} }; +/* pincfg quirk for Tuxedo Sirius; +* unfortunately the (PCI) SSID conflicts with System76 Pangolin pang14, +* which has incompatible pin setup, so we check the codec SSID (luckily +* different one!) and conditionally apply the quirk here +*/ +static void cxt_fixup_sirius_top_speaker (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +/* ignore for incorrectly picked-up pang14 */ +if (codec->core.subsystem_id ==0x278212b3 ) +return ; +/* set up the top speaker pin */ +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) +snd_hda_codec_set_pincfg (codec,0x1d ,0x82170111 ); +} +static const struct hda_fixup cxt_fixups[] = { [CXT_PINCFG_LENOVO_X200 ] = { .type =HDA_FIXUP_PINS ,
@@ -980,11 +997,8 @@ static const struct hda_fixup cxt_fixups[] = { .v.pins = cxt_pincfg_sws_js201d, }, [CXT_PINCFG_TOP_SPEAKER] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl []) { - {0x1d ,0x82170111 }, - { } - }, + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_sirius_top_speaker, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 416/798 f2fs: Require FMODE_WRITE for atomic write ioctls
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 4f5a100f87f32cb65d4bb1ad282a08c92f6f591e upstream.
The F2FS ioctls for starting and committing atomic writes check for inode_owner_or_capable(), but this does not give LSMs like SELinux or Landlock an opportunity to deny the write access - if the caller's FSUID matches the inode's UID, inode_owner_or_capable() immediately returns true.
There are scenarios where LSMs want to deny a process the ability to write particular files, even files that the FSUID of the process owns; but this can currently partially be bypassed using atomic write ioctls in two ways:
- F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can truncate an inode to size 0
- F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert changes another process concurrently made to a file
Fix it by requiring FMODE_WRITE for these operations, just like for F2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these ioctls when intending to write into the file, that seems unlikely to break anything.
--- fs/f2fs/file.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/f2fs/file.c +9 -0
@@ -2108,6 +2108,9 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)loff_t isize;int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (mnt_userns, inode))return -EACCES ;
@@ -2209,6 +2212,9 @@ static int f2fs_ioc_commit_atomic_write(struct file *filp)struct user_namespace *mnt_userns =file_mnt_user_ns (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (mnt_userns, inode))return -EACCES ;
@@ -2241,6 +2247,9 @@ static int f2fs_ioc_abort_atomic_write(struct file *filp)struct user_namespace *mnt_userns =file_mnt_user_ns (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (mnt_userns, inode))return -EACCES ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 417/798 wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit 3f66f26703093886db81f0610b97a6794511917c ]
In 'ath9k_get_et_stats()', promote TX stats counters to 'u64' to avoid possible integer overflow. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/ath/ath9k/debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +2 -2
@@ -1365,11 +1365,11 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,struct ath_softc *sc = hw->priv;int i =0 ; - data[i++] = (sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_pkts_all + + data[i++] = ((u64 )sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BK )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VI )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VO )].tx_pkts_all); - data[i++] = (sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_bytes_all + + data[i++] = ((u64 )sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BK )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VI )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VO )].tx_bytes_all);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 418/798 wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 94745807f3ebd379f23865e6dab196f220664179 ]
Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call.
The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +2 -4
@@ -718,8 +718,7 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb) } resubmit: -skb_reset_tail_pointer (skb); -skb_trim (skb,0 ); +__skb_set_length (skb,0 );usb_anchor_urb (urb, &hif_dev->rx_submitted); ret =usb_submit_urb (urb,GFP_ATOMIC );
@@ -756,8 +755,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)case -ESHUTDOWN : goto free_skb;default : -skb_reset_tail_pointer (skb); -skb_trim (skb,0 ); +__skb_set_length (skb,0 ); goto resubmit; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 419/798 ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 62fdaf9e8056e9a9e6fe63aa9c816ec2122d60c6 ]
In ice_sched_add_root_node() and ice_sched_add_node() there are calls to devm_kcalloc() in order to allocate memory for array of pointers to 'ice_sched_node' structure. But incorrect types are used as sizeof() arguments in these calls (structures instead of pointers) which leads to over allocation of memory.
Adjust over allocation of memory by correcting types in devm_kcalloc() sizeof() arguments.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/intel/ice/ice_sched.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/intel/ice/ice_sched.c +2 -4
@@ -28,9 +28,8 @@ ice_sched_add_root_node(struct ice_port_info *pi,if (!root)return -ENOMEM ; -/* coverity[suspicious_sizeof] */ root->children =devm_kcalloc (ice_hw_to_dev (hw), hw->max_children[0 ], -sizeof (*root),GFP_KERNEL ); +sizeof (*root->children),GFP_KERNEL );if (!root->children) {devm_kfree (ice_hw_to_dev (hw), root);return -ENOMEM ;
@@ -181,10 +180,9 @@ ice_sched_add_node(struct ice_port_info *pi, u8 layer,if (!node)return -ENOMEM ;if (hw->max_children[layer]) { -/* coverity[suspicious_sizeof] */ node->children =devm_kcalloc (ice_hw_to_dev (hw), hw->max_children[layer], -sizeof (*node),GFP_KERNEL ); +sizeof (*node->children),GFP_KERNEL );if (!node->children) {devm_kfree (ice_hw_to_dev (hw), node);return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 420/798 wifi: iwlwifi: mvm: Fix a race in scan abort flow
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <[email protected]>
[ Upstream commit 87c1c28a9aa149489e1667f5754fc24f4973d2d0 ]
When the upper layer requests to cancel an ongoing scan, a race is possible in which by the time the driver starts to handle the upper layers scan cancel flow, the FW already completed handling the scan request and the driver received the scan complete notification but still did not handle the notification. In such a case the FW will simply ignore the scan abort request coming from the driver, no notification would arrive from the FW and the entire abort flow would be considered a failure.
To better handle this, check the status code returned by the FW for the scan abort command. In case the status indicates that no scan was aborted, complete the scan abort flow with success, i.e., the scan was aborted, as the flow is expected to consume the scan complete notification.
--- .../net/wireless/intel/iwlwifi/fw/api/scan.h | 13 ++++++ drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 42 +++++++++++++++---- 2 files changed, 47 insertions(+), 8 deletions(-)
drivers/net/wireless/intel/iwlwifi/fw/api/scan.h +13 -0
@@ -1111,6 +1111,19 @@ struct iwl_umac_scan_abort {__le32 flags; } __packed;/* SCAN_ABORT_CMD_UMAC_API_S_VER_1 */ +/** +* enum iwl_umac_scan_abort_status +* +* @IWL_UMAC_SCAN_ABORT_STATUS_SUCCESS: scan was successfully aborted +* @IWL_UMAC_SCAN_ABORT_STATUS_IN_PROGRESS: scan abort is in progress +* @IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND: nothing to abort +*/ +enum iwl_umac_scan_abort_status { +IWL_UMAC_SCAN_ABORT_STATUS_SUCCESS =0 , +IWL_UMAC_SCAN_ABORT_STATUS_IN_PROGRESS , +IWL_UMAC_SCAN_ABORT_STATUS_NOT_FOUND , +}; +/** * struct iwl_umac_scan_complete * @uid: scan id, &enum iwl_umac_scan_uid_offsets
drivers/net/wireless/intel/iwlwifi/mvm/scan.c +34 -8
83 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 421/798 wifi: cfg80211: Set correct chandef when starting CAC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Issam Hamdi <[email protected]>
[ Upstream commit 20361712880396e44ce80aaeec2d93d182035651 ]
When starting CAC in a mode other than AP mode, it return a "WARNING: CPU: 0 PID: 63 at cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]" caused by the chandef.chan being null at the end of CAC.
Solution: Ensure the channel definition is set for the different modes when starting CAC to avoid getting a NULL 'chan' at the end of CAC.
Call Trace: ? show_regs.part.0+0x14/0x16 ? __warn+0x67/0xc0 ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211] ? report_bug+0xa7/0x130 ? exc_overflow+0x30/0x30 ? handle_bug+0x27/0x50 ? exc_invalid_op+0x18/0x60 ? handle_exception+0xf6/0xf6 ? exc_overflow+0x30/0x30 ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211] ? exc_overflow+0x30/0x30 ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211] ? regulatory_propagate_dfs_state.cold+0x1b/0x4c [cfg80211] ? cfg80211_propagate_cac_done_wk+0x1a/0x30 [cfg80211] ? process_one_work+0x165/0x280 ? worker_thread+0x120/0x3f0 ? kthread+0xc2/0xf0 ? process_one_work+0x280/0x280 ? kthread_complete_and_exit+0x20/0x20 ? ret_from_fork+0x19/0x24
--- net/wireless/nl80211.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
net/wireless/nl80211.c +14 -1
@@ -9834,7 +9834,20 @@ static int nl80211_start_radar_detection(struct sk_buff *skb, err =rdev_start_radar_detection (rdev, dev, &chandef, cac_time_ms);if (!err) { - wdev->links[0 ].ap.chandef = chandef; +switch (wdev->iftype) { +case NL80211_IFTYPE_AP : +case NL80211_IFTYPE_P2P_GO : + wdev->links[0 ].ap.chandef = chandef; +break ; +case NL80211_IFTYPE_ADHOC : + wdev->u.ibss.chandef = chandef; +break ; +case NL80211_IFTYPE_MESH_POINT : + wdev->u.mesh.chandef = chandef; +break ; +default : +break ; + } wdev->cac_started = true; wdev->cac_start_time = jiffies; wdev->cac_time_ms = cac_time_ms;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 422/798 net/xen-netback: prevent UAF in xenvif_flush_hash()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 ]
During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free.
Therefore, to solve this, you need to change it to list_for_each_entry_safe.
--- drivers/net/xen-netback/hash.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/xen-netback/hash.c +2 -3
@@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data,static void xenvif_flush_hash (struct xenvif *vif) { -struct xenvif_hash_cache_entry *entry; +struct xenvif_hash_cache_entry *entry, *n;unsigned long flags;if (xenvif_hash_cache_size ==0 )
@@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif)spin_lock_irqsave (&vif->hash.cache.lock, flags); -list_for_each_entry_rcu (entry, &vif->hash.cache.list, link, -lockdep_is_held (&vif->hash.cache.lock)) { +list_for_each_entry_safe (entry, n, &vif->hash.cache.list, link) {list_del_rcu (&entry->link); vif->hash.cache.count--;kfree_rcu (entry, rcu);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 423/798 net: hisilicon: hip04: fix OF node leak in probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 17555297dbd5bccc93a01516117547e26a61caf1 ]
Driver is leaking OF node reference fromof_parse_phandle_with_fixed_args() in probe().
--- drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hip04_eth.c +1 -0
@@ -947,6 +947,7 @@ static int hip04_mac_probe(struct platform_device *pdev) priv->tx_coalesce_timer.function = tx_done; priv->map =syscon_node_to_regmap (arg.np); +of_node_put (arg.np);if (IS_ERR (priv->map)) {dev_warn (d,"no syscon hisilicon,hip04-ppe\n" ); ret =PTR_ERR (priv->map);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 424/798 net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5680cf8d34e1552df987e2f4bb1bff0b2a8c8b11 ]
Driver is leaking OF node reference from of_parse_phandle_with_fixed_args() in hns_mac_get_info().
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +1 -0
@@ -933,6 +933,7 @@ static int hns_mac_get_info(struct hns_mac_cb *mac_cb) mac_cb->cpld_ctrl =NULL ; }else { syscon =syscon_node_to_regmap (cpld_args.np); +of_node_put (cpld_args.np);if (IS_ERR_OR_NULL (syscon)) {dev_dbg (mac_cb->dev,"no cpld-syscon found!\n" ); mac_cb->cpld_ctrl =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 425/798 net: hisilicon: hns_mdio: fix OF node leak in probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit e62beddc45f487b9969821fad3a0913d9bc18a2f ]
Driver is leaking OF node reference fromof_parse_phandle_with_fixed_args() in probe().
--- drivers/net/ethernet/hisilicon/hns_mdio.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hns_mdio.c +1 -0
@@ -497,6 +497,7 @@ static int hns_mdio_probe(struct platform_device *pdev)MDIO_SC_RESET_ST ; } } +of_node_put (reg_args.np); }else {dev_warn (&pdev->dev,"find syscon ret = %#x\n" , ret); mdio_dev->subctrl_vbase =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 426/798 ACPI: PAD: fix crash in exit_round_robin()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seiji Nishikawa <[email protected]>
[ Upstream commit 0a2ed70a549e61c5181bad5db418d223b68ae932 ]
The kernel occasionally crashes in cpumask_clear_cpu(), which is called within exit_round_robin(), because when executing clear_bit(nr, addr) with nr set to 0xffffffff, the address calculation may cause misalignment within the memory, leading to access to an invalid memory address.
----------
BUG: unable to handle kernel paging request at ffffffffe0740618
...
CPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G OE X --------- - - 4.18.0-425.19.2.el8_7.x86_64 #1
...
RIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]
Code: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31
RSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202
RAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246
RBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8
R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e
R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e
FS: 0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
? acpi_pad_add+0x120/0x120 [acpi_pad]
kthread+0x10b/0x130
? set_kthread_struct+0x50/0x50
ret_from_fork+0x1f/0x40
...CR2: ffffffffe0740618
crash> dis -lr ffffffffc0726923
...
/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 1140xffffffffc0726918 <power_saving_thread+776>: mov %r12d,%r12d/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 3250xffffffffc072691b <power_saving_thread+779>: mov -0x3f8d7de0(,%r12,4),%eax/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 800xffffffffc0726923 <power_saving_thread+787>: lock btr %rax,0x19cf4(%rip) # 0xffffffffc0740620 <pad_busy_cpus_bits>
crash> px tsk_in_cpu[14]
$66 = 0xffffffff
crash> px 0xffffffffc072692c+0x19cf4
$99 = 0xffffffffc0740620
crash> sym 0xffffffffc0740620 ffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]
crash> px pad_busy_cpus_bits[0]
$42 = 0xfffc0
----------
To fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling cpumask_clear_cpu() in exit_round_robin(), just as it is done in round_robin_cpu().
--- drivers/acpi/acpi_pad.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/acpi/acpi_pad.c +4 -2
@@ -130,8 +130,10 @@ static void exit_round_robin(unsigned int tsk_index) {struct cpumask *pad_busy_cpus =to_cpumask (pad_busy_cpus_bits); -cpumask_clear_cpu (tsk_in_cpu[tsk_index], pad_busy_cpus); - tsk_in_cpu[tsk_index] =-1 ; +if (tsk_in_cpu[tsk_index] !=-1 ) { +cpumask_clear_cpu (tsk_in_cpu[tsk_index], pad_busy_cpus); + tsk_in_cpu[tsk_index] =-1 ; + } }static unsigned int idle_pct =5 ;/* percentage */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 427/798 ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 5accb265f7a1b23e52b0ec42313d1e12895552f4 ]
ACPICA commit 2802af722bbde7bf1a7ac68df68e179e2555d361
If acpi_ps_get_next_namepath() fails, the previously allocated union acpi_parse_object needs to be freed before returning the status code.
The issue was first being reported on the Linux ACPI mailing list:
--- drivers/acpi/acpica/psargs.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/acpica/psargs.c +8 -0
@@ -820,6 +820,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,acpi_ps_get_next_namepath (walk_state, parser_state, arg,ACPI_NOT_METHOD_CALL ); +if (ACPI_FAILURE (status)) { +acpi_ps_free_op (arg); +return_ACPI_STATUS (status); + } }else {/* Single complex argument, nothing returned */
@@ -854,6 +858,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,acpi_ps_get_next_namepath (walk_state, parser_state, arg,ACPI_POSSIBLE_METHOD_CALL ); +if (ACPI_FAILURE (status)) { +acpi_ps_free_op (arg); +return_ACPI_STATUS (status); + }if (arg->common.aml_opcode ==AML_INT_METHODCALL_OP ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 428/798 ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit e6169a8ffee8a012badd8c703716e761ce851b15 ]
ACPICA commit 1280045754264841b119a5ede96cd005bc09b5a7
If acpi_ps_get_next_field() fails, the previously created field list needs to be properly disposed before returning the status code.
--- drivers/acpi/acpica/psargs.c | 39 ++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+)
drivers/acpi/acpica/psargs.c +39 -0
@@ -25,6 +25,8 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state);static union acpi_parse_object *acpi_ps_get_next_field (struct acpi_parse_state *parser_state); +static void acpi_ps_free_field_list (union acpi_parse_object *start); +/******************************************************************************* * * FUNCTION: acpi_ps_get_next_package_length
@@ -683,6 +685,39 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_statereturn_PTR (field); } +/******************************************************************************* +* +* FUNCTION: acpi_ps_free_field_list +* +* PARAMETERS: start - First Op in field list +* +* RETURN: None. +* +* DESCRIPTION: Free all Op objects inside a field list. +* +******************************************************************************/ + +static void acpi_ps_free_field_list (union acpi_parse_object *start) +{ +union acpi_parse_object *cur = start; +union acpi_parse_object *next; +union acpi_parse_object *arg; + +while (cur) { + next = cur->common.next; + +/* AML_INT_CONNECTION_OP can have a single argument */ + + arg =acpi_ps_get_arg (cur,0 ); +if (arg) { +acpi_ps_free_op (arg); + } + +acpi_ps_free_op (cur); + cur = next; + } +} +/******************************************************************************* * * FUNCTION: acpi_ps_get_next_arg
@@ -751,6 +786,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,while (parser_state->aml < parser_state->pkg_end) { field =acpi_ps_get_next_field (parser_state);if (!field) { +if (arg) { +acpi_ps_free_field_list (arg); + } +return_ACPI_STATUS (AE_NO_MEMORY ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 429/798 wifi: mt76: mt7915: disable tx worker during tx BA session enable/disable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 256cbd26fbafb30ba3314339106e5c594e9bd5f9 ]
Avoids firmware race condition.
--- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +7 -3
@@ -661,13 +661,17 @@ int mt7915_mcu_add_tx_ba(struct mt7915_dev *dev, {struct mt7915_sta *msta = (struct mt7915_sta *)params->sta->drv_priv;struct mt7915_vif *mvif = msta->vif; +int ret; +mt76_worker_disable (&dev->mt76.tx_worker);if (enable && !params->amsdu) msta->wcid.amsdu = false; + ret =mt76_connac_mcu_sta_ba (&dev->mt76, &mvif->mt76, params, +MCU_EXT_CMD (STA_REC_UPDATE ), + enable, true); +mt76_worker_enable (&dev->mt76.tx_worker); -return mt76_connac_mcu_sta_ba (&dev->mt76, &mvif->mt76, params, -MCU_EXT_CMD (STA_REC_UPDATE ), - enable, true); +return ret; } int mt7915_mcu_add_rx_ba(struct mt7915_dev *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 430/798 net: sched: consistently use rcu_replace_pointer() in taprio_change()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit d5c4546062fd6f5dbce575c7ea52ad66d1968678 ]
According to Vinicius (and carefully looking through the whole
https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa
once again), txtime branch of 'taprio_change()' is not going to race against 'advance_sched()'. But using 'rcu_replace_pointer()' in the former may be a good idea as well.
--- net/sched/sch_taprio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sched/sch_taprio.c +3 -1
@@ -1668,7 +1668,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, goto unlock; } -rcu_assign_pointer (q->admin_sched, new_admin); +/* Not going to race against advance_sched(), but still */ + admin =rcu_replace_pointer (q->admin_sched, new_admin, +lockdep_rtnl_is_held ());if (admin)call_rcu (&admin->rcu, taprio_free_sched_cb); }else {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 431/798 Bluetooth: btusb: Add Realtek RTL8852C support ID 0x0489:0xe122
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hilda Wu <[email protected]>
[ Upstream commit bdf9557f70e7512bb2f754abf90d9e9958745316 ]
Add the support ID (0x0489, 0xe122) to usb_device_id table for Realtek RTL8852C.
The device info from /sys/kernel/debug/usb/devices as below.
T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e122 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -531,6 +531,8 @@ static const struct usb_device_id blacklist_table[] = { BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, /* Realtek 8852BE Bluetooth devices */ { USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 432/798 ACPI: video: Add force_vendor quirk for Panasonic Toughbook CF-18
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit eb7b0f12e13ba99e64e3a690c2166895ed63b437 ]
The Panasonic Toughbook CF-18 advertises both native and vendor backlight control interfaces. But only the vendor one actually works.
acpi_video_get_backlight_type() will pick the non working native backlight by default, add a quirk to select the working vendor backlight instead.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -258,6 +258,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "PCG-FRV35"), }, }, + { + .callback = video_detect_force_vendor, + /* Panasonic Toughbook CF-18 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Matsushita Electric Industrial"), + DMI_MATCH(DMI_PRODUCT_NAME, "CF-18"), + }, + },/* * Toshiba models with Transflective display, these need to use
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 433/798 blk_iocost: fix more out of bound shifts
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Ovsepian <[email protected]>
[ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ]
Recently running UBSAN caught few out of bound shifts in the ioc_forgive_debts() function:
UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <IRQ> dump_stack_lvl+0xca/0x130 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 ? __lock_acquire+0x6441/0x7c10 ioc_timer_fn+0x6cec/0x7750 ? blk_iocost_init+0x720/0x720 ? call_timer_fn+0x5d/0x470 call_timer_fn+0xfa/0x470 ? blk_iocost_init+0x720/0x720 __run_timer_base+0x519/0x700
...
Actual impact of this issue was not identified but I propose to fix the undefined behaviour.
The proposed fix to prevent those out of bound shifts consist of precalculating exponent before using it the shift operations by taking min value from the actual exponent and maximum possible number of bits.
--- block/blk-iocost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
block/blk-iocost.c +5 -3
@@ -2057,7 +2057,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, struct ioc_now *now) {struct ioc_gq *iocg; -u64 dur, usage_pct, nr_cycles; +u64 dur, usage_pct, nr_cycles, nr_cycles_shift;/* if no debtor, reset the cycle */ if (!nr_debtors) {
@@ -2119,10 +2119,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, old_debt = iocg->abs_vdebt; old_delay = iocg->delay; + nr_cycles_shift =min_t (u64, nr_cycles,BITS_PER_LONG -1 );if (iocg->abs_vdebt) - iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?:1 ; + iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?:1 ; +if (iocg->delay) - iocg->delay = iocg->delay >> nr_cycles ?:1 ; + iocg->delay = iocg->delay >> nr_cycles_shift ?:1 ;iocg_kick_waitq (iocg, true, now);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 434/798 nvme-pci: qdepth 1 quirk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 83bdfcbdbe5d901c5fa432decf12e1725a840a56 ]
Another device has been reported to be unreliable if we have more than one outstanding command. In this new case, data corruption may occur. Since we have two devices now needing this quirky behavior, make a generic quirk flag.
The same Apple quirk is clearly not "temporary", so update the comment while moving it.
--- drivers/nvme/host/nvme.h | 5 +++++ drivers/nvme/host/pci.c | 18 +++++++++--------- 2 files changed, 14 insertions(+), 9 deletions(-)
drivers/nvme/host/nvme.h +5 -0
@@ -86,6 +86,11 @@ enum nvme_quirks {*/ NVME_QUIRK_NO_DEEPEST_PS = (1 <<5 ), +/* +* Problems seen with concurrent commands +*/ + NVME_QUIRK_QDEPTH_ONE = (1 << 6), +/* * Set MEDIUM priority on SQ creation */
drivers/nvme/host/pci.c +9 -9
@@ -2621,15 +2621,8 @@ static int nvme_pci_enable(struct nvme_dev *dev)else dev->io_sqes =NVME_NVM_IOSQES ; -/* -* Temporary fix for the Apple controller found in the MacBook8,1 and -* some MacBook7,1 to avoid controller resets and data loss. -*/ -if (pdev->vendor ==PCI_VENDOR_ID_APPLE && pdev->device ==0x2001 ) { +if (dev->ctrl.quirks &NVME_QUIRK_QDEPTH_ONE ) { dev->q_depth =2 ; -dev_warn (dev->ctrl.device,"detected Apple NVMe controller, " -"set queue depth=%u to work around controller resets\n" , - dev->q_depth); }else if (pdev->vendor ==PCI_VENDOR_ID_SAMSUNG && (pdev->device ==0xa821 || pdev->device ==0xa822 ) &&NVME_CAP_MQES (dev->ctrl.cap) ==0 ) {
@@ -3491,6 +3484,8 @@ static const struct pci_device_id nvme_id_table[] = { NVME_QUIRK_BOGUS_NID, }, { PCI_VDEVICE(REDHAT, 0x0010), /* Qemu emulated controller */ .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1217, 0x8760), /* O2 Micro 64GB Steam Deck */ + .driver_data = NVME_QUIRK_QDEPTH_ONE }, { PCI_DEVICE(0x126f, 0x2262), /* Silicon Motion generic */ .driver_data = NVME_QUIRK_NO_DEEPEST_PS | NVME_QUIRK_BOGUS_NID, },
@@ -3617,7 +3612,12 @@ static const struct pci_device_id nvme_id_table[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0xcd02), .driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, }, { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001), - .driver_data = NVME_QUIRK_SINGLE_VECTOR }, +/* +* Fix for the Apple controller found in the MacBook8,1 and +* some MacBook7,1 to avoid controller resets and data loss. +*/ + .driver_data = NVME_QUIRK_SINGLE_VECTOR | + NVME_QUIRK_QDEPTH_ONE }, { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) }, { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005), .driver_data = NVME_QUIRK_SINGLE_VECTOR |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 435/798 wifi: ath11k: fix array out-of-bound access in SoC stats
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthikeyan Periyasamy <[email protected]>
[ Upstream commit 69f253e46af98af17e3efa3e5dfa72fcb7d1983d ]
Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/dp_rx.c +1 -1
@@ -2699,7 +2699,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id,if (unlikely (push_reason !=HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION )) {dev_kfree_skb_any (msdu); - ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++; + ab->soc_stats.hal_reo_error[ring_id]++;continue ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 436/798 wifi: rtw88: select WANT_DEV_COREDUMP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zong-Zhe Yang <[email protected]>
[ Upstream commit 7e989b0c1e33210c07340bf5228aa83ea52515b5 ]
We have invoked device coredump when fw crash.
Should select WANT_DEV_COREDUMP by ourselves.
--- drivers/net/wireless/realtek/rtw88/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/realtek/rtw88/Kconfig +1 -0
@@ -12,6 +12,7 @@ if RTW88 config RTW88_CORE tristate + select WANT_DEV_COREDUMP config RTW88_PCI tristate
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 437/798 ACPI: EC: Do not release locks during operation region accesses
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <[email protected]>
[ Upstream commit dc171114926ec390ab90f46534545420ec03e458 ]
It is not particularly useful to release locks (the EC mutex and the ACPI global lock, if present) and re-acquire them immediately thereafter during EC address space accesses in acpi_ec_space_handler().
First, releasing them for a while before grabbing them again does not really help anyone because there may not be enough time for another thread to acquire them.
Second, if another thread successfully acquires them and carries out a new EC write or read in the middle if an operation region access in progress, it may confuse the EC firmware, especially after the burst mode has been enabled.
Finally, manipulating the locks after writing or reading every single byte of data is overhead that it is better to avoid.
Accordingly, modify the code to carry out EC address space accesses entirely without releasing the locks.
--- drivers/acpi/ec.c | 55 +++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 49 insertions(+), 6 deletions(-)
drivers/acpi/ec.c +49 -6
@@ -797,6 +797,9 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,unsigned long tmp;int ret =0 ; +if (t->rdata) +memset (t->rdata,0 , t->rlen); +/* start transaction */ spin_lock_irqsave (&ec->lock, tmp);/* Enable GPE for command processing (IBF=0/OBF=1) */
@@ -833,8 +836,6 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata))return -EINVAL ; -if (t->rdata) -memset (t->rdata,0 , t->rlen);mutex_lock (&ec->mutex);if (ec->global_lock) {
@@ -861,7 +862,7 @@ static int acpi_ec_burst_enable(struct acpi_ec *ec) .wdata = NULL, .rdata = &d, .wlen = 0, .rlen = 1}; -return acpi_ec_transaction (ec, &t); +return acpi_ec_transaction_unlocked (ec, &t); }static int acpi_ec_burst_disable (struct acpi_ec *ec)
@@ -871,7 +872,7 @@ static int acpi_ec_burst_disable(struct acpi_ec *ec) .wlen = 0, .rlen = 0};return (acpi_ec_read_status (ec) &ACPI_EC_FLAG_BURST ) ? -acpi_ec_transaction (ec, &t) :0 ; +acpi_ec_transaction_unlocked (ec, &t) :0 ; }static int acpi_ec_read (struct acpi_ec *ec,u8 address,u8 *data)
@@ -887,6 +888,19 @@ static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 *data)return result; } +static int acpi_ec_read_unlocked (struct acpi_ec *ec,u8 address,u8 *data) +{ +int result; +u8 d; +struct transaction t = {.command =ACPI_EC_COMMAND_READ , + .wdata = &address, .rdata = &d, + .wlen =1 , .rlen =1 }; + + result =acpi_ec_transaction_unlocked (ec, &t); + *data = d; +return result; +} +static int acpi_ec_write (struct acpi_ec *ec,u8 address,u8 data) {u8 wdata[2 ] = { address, data };
@@ -897,6 +911,16 @@ static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)return acpi_ec_transaction (ec, &t); } +static int acpi_ec_write_unlocked (struct acpi_ec *ec,u8 address,u8 data) +{ +u8 wdata[2 ] = { address, data }; +struct transaction t = {.command =ACPI_EC_COMMAND_WRITE , + .wdata = wdata, .rdata =NULL , + .wlen =2 , .rlen =0 }; + +return acpi_ec_transaction_unlocked (ec, &t); +} +int ec_read (u8 addr,u8 *val) {int err;
@@ -1304,6 +1328,7 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,struct acpi_ec *ec = handler_context;int result =0 , i, bytes = bits /8 ;u8 *value = (u8 *)value64; +u32 glk;if ((address >0xFF ) || !value || !handler_context)return AE_BAD_PARAMETER ;
@@ -1311,13 +1336,25 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,if (function !=ACPI_READ && function !=ACPI_WRITE )return AE_BAD_PARAMETER ; +mutex_lock (&ec->mutex); + +if (ec->global_lock) { +acpi_status status; + + status =acpi_acquire_global_lock (ACPI_EC_UDELAY_GLK , &glk); +if (ACPI_FAILURE (status)) { + result = -ENODEV ; + goto unlock; + } + } +if (ec->busy_polling || bits >8 )acpi_ec_burst_enable (ec);for (i =0 ; i < bytes; ++i, ++address, ++value) { result = (function ==ACPI_READ ) ? -acpi_ec_read (ec, address, value) : -acpi_ec_write (ec, address, *value); +acpi_ec_read_unlocked (ec, address, value) : +acpi_ec_write_unlocked (ec, address, *value);if (result <0 )break ; }
@@ -1325,6 +1362,12 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,if (ec->busy_polling || bits >8 )acpi_ec_burst_disable (ec); +if (ec->global_lock) +acpi_release_global_lock (glk); + +unlock: +mutex_unlock (&ec->mutex); +switch (result) {case -EINVAL :return AE_BAD_PARAMETER ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 438/798 ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <[email protected]>
[ Upstream commit a5242874488eba2b9062985bf13743c029821330 ]
ACPICA commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0
ACPI_ALLOCATE_ZEROED() may fail, elements might be NULL and will cause NULL pointer dereference later.
--- drivers/acpi/acpica/dbconvert.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/acpica/dbconvert.c +2 -0
@@ -174,6 +174,8 @@ acpi_status acpi_db_convert_to_package(char *string, union acpi_object *object) elements =ACPI_ALLOCATE_ZEROED (DB_DEFAULT_PKG_ELEMENTS *sizeof (union acpi_object )); +if (!elements) +return (AE_NO_MEMORY ); this = string;for (i =0 ; i < (DB_DEFAULT_PKG_ELEMENTS -1 ); i++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 439/798 tipc: guard against string buffer overrun
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 6555a2a9212be6983d2319d65276484f7c5f431a ]
Smatch reports that copying media_name and if_name to name_parts may overwrite the destination.
.../bearer.c:166 bearer_name_validate() error: strcpy() 'media_name' too large for 'name_parts->media_name' (32 vs 16) .../bearer.c:167 bearer_name_validate() error: strcpy() 'if_name' too large for 'name_parts->if_name' (1010102 vs 16)
This does seem to be the case so guard against this possibility by using strscpy() and failing if truncation occurs.
Introduced by commit b97bf3fd8f6a ("[TIPC] Initial merge")
Compile tested only.
--- net/tipc/bearer.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/tipc/bearer.c +6 -2
@@ -163,8 +163,12 @@ static int bearer_name_validate(const char *name,/* return bearer name components, if necessary */ if (name_parts) { -strcpy (name_parts->media_name, media_name); -strcpy (name_parts->if_name, if_name); +if (strscpy (name_parts->media_name, media_name, +TIPC_MAX_MEDIA_NAME ) <0 ) +return 0 ; +if (strscpy (name_parts->if_name, if_name, +TIPC_MAX_IF_NAME ) <0 ) +return 0 ; }return 1 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 440/798 net: mvpp2: Increase size of queue_name buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 91d516d4de48532d967a77967834e00c8c53dfe6 ]
Increase size of queue_name buffer from 30 to 31 to accommodate the largest string written to it. This avoids truncation in the possibly unlikely case where the string is name is the maximum size.
Flagged by gcc-14:
.../mvpp2_main.c: In function 'mvpp2_probe':
.../mvpp2_main.c:7636:32: warning: 'snprintf' output may be truncated before the last format character [-Wformat-truncation=]
7636 | "stats-wq-%s%s", netdev_name(priv->port_list[0]->dev),
| ^
.../mvpp2_main.c:7635:9: note: 'snprintf' output between 10 and 31 bytes into a destination of size 30
7635 | snprintf(priv->queue_name, sizeof(priv->queue_name),
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
7636 | "stats-wq-%s%s", netdev_name(priv->port_list[0]->dev),
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
7637 | priv->port_count > 1 ? "+" : "");
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Introduced by commit 118d6298f6f0 ("net: mvpp2: add ethtool GOP statistics"). I am not flagging this as a bug as I am not aware that it is one.
Compile tested only.
--- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2.h +1 -1
@@ -1088,7 +1088,7 @@ struct mvpp2 {unsigned int max_port_rxqs;/* Workqueue to gather hardware statistics */ -char queue_name[30 ]; +char queue_name[31 ];struct workqueue_struct *stats_queue;/* Debugfs root entry */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 441/798 bnxt_en: Extend maximum length of version string by 1 byte
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit ffff7ee843c351ce71d6e0d52f0f20bea35e18c9 ]
This corrects an out-by-one error in the maximum length of the package version string. The size argument of snprintf includes space for the trailing '\0' byte, so there is no need to allow extra space for it by reducing the value of the size argument by 1.
Found by inspection.
Compile tested only.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +1 -1
@@ -2980,7 +2980,7 @@ static void bnxt_get_pkgver(struct net_device *dev)if (!bnxt_get_pkginfo (dev, buf,sizeof (buf))) { len =strlen (bp->fw_ver_str); -snprintf (bp->fw_ver_str + len,FW_VER_STR_LEN - len -1 , +snprintf (bp->fw_ver_str + len,FW_VER_STR_LEN - len,"/pkg %s" , buf); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 442/798 ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit e3af3d3c5b26c33a7950e34e137584f6056c4319 ]
dev->ip_ptr could be NULL if we set an invalid MTU.
Even then, if we issue ioctl(SIOCSIFADDR) for a new IPv4 address, devinet_ioctl() allocates struct in_ifaddr and fails later in inet_set_ifa() because in_dev is NULL.
Let's move the check earlier.
--- net/ipv4/devinet.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/ipv4/devinet.c +2 -4
@@ -567,10 +567,6 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)ASSERT_RTNL (); -if (!in_dev) { -inet_free_ifa (ifa); -return -ENOBUFS ; - }ipv4_devconf_setall (in_dev);neigh_parms_data_state_setall (in_dev->arp_parms);if (ifa->ifa_dev != in_dev) {
@@ -1153,6 +1149,8 @@ int devinet_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr)if (!ifa) { ret = -ENOBUFS ; +if (!in_dev) +break ; ifa =inet_alloc_ifa ();if (!ifa)break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 443/798 wifi: rtw89: correct base HT rate mask for firmware
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit 45742881f9eee2a4daeb6008e648a460dd3742cd ]
Coverity reported that u8 rx_mask << 24 will become signed 32 bits, which casting to unsigned 64 bits will do sign extension. For example, putting 0x80000000 (signed 32 bits) to a u64 variable will become 0xFFFFFFFF_80000000.
The real case we meet is:
rx_mask[0...3] = ff ff 00 00
ra_mask = 0xffffffff_ff0ff000
After this fix:
rx_mask[0...3] = ff ff 00 00
ra_mask = 0x00000000_ff0ff000
Fortunately driver does bitwise-AND with incorrect ra_mask and supported rates (1ss and 2ss rate only) afterward, so the final rate mask of original code is still correct.
Addresses-Coverity-ID: 1504762 ("Unintended sign extension")
--- drivers/net/wireless/realtek/rtw89/phy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw89/phy.c +2 -2
@@ -281,8 +281,8 @@ static void rtw89_phy_ra_sta_update(struct rtw89_dev *rtwdev, csi_mode =RTW89_RA_RPT_MODE_HT ; ra_mask |= ((u64 )sta->deflink.ht_cap.mcs.rx_mask[3 ] <<48 ) | ((u64 )sta->deflink.ht_cap.mcs.rx_mask[2 ] <<36 ) | - (sta->deflink.ht_cap.mcs.rx_mask[1 ] <<24 ) | - (sta->deflink.ht_cap.mcs.rx_mask[0 ] <<12 ); + ((u64 )sta->deflink.ht_cap.mcs.rx_mask[1 ] <<24 ) | + ((u64 )sta->deflink.ht_cap.mcs.rx_mask[0 ] <<12 ); high_rate_masks = rtw89_ra_mask_ht_rates;if (sta->deflink.ht_cap.cap &IEEE80211_HT_CAP_RX_STBC ) stbc_en =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 444/798 ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 8fed54758cd248cd311a2b5c1e180abef1866237 ]
The NETLINK_FIB_LOOKUP netlink family can be used to perform a FIB lookup according to user provided parameters and communicate the result back to user space.
However, unlike other users of the FIB lookup API, the upper DSCP bits and the ECN bits of the DS field are not masked, which can result in the wrong result being returned.
Solve this by masking the upper DSCP bits and the ECN bits using IPTOS_RT_MASK.
The structure that communicates the request and the response is not exported to user space, so it is unlikely that this netlink family is actually in use [1].
[1] https://lore.kernel.org/netdev/ZpqpB8vJU%2FQ6LSqa@debian/
--- net/ipv4/fib_frontend.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/fib_frontend.c +1 -1
@@ -1343,7 +1343,7 @@ static void nl_fib_lookup(struct net *net, struct fib_result_nl *frn)struct flowi4 fl4 = { .flowi4_mark = frn->fl_mark, .daddr = frn->fl_addr, - .flowi4_tos = frn->fl_tos, + .flowi4_tos = frn->fl_tos &IPTOS_RT_MASK , .flowi4_scope = frn->fl_scope, };struct fib_table *tb;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 445/798 net: atlantic: Avoid warning about potential string truncation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 5874e0c9f25661c2faefe4809907166defae3d7f ]
W=1 builds with GCC 14.2.0 warn that:
.../aq_ethtool.c:278:59: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 6 [-Wformat-truncation=]
278 | snprintf(tc_string, 8, "TC%d ", tc);
| ^~.../aq_ethtool.c:278:56: note: directive argument in the range [-2147483641, 254]
278 | snprintf(tc_string, 8, "TC%d ", tc);
| ^~~~~~~.../aq_ethtool.c:278:33: note: ‘snprintf’ output between 5 and 15 bytes into a destination of size 8
278 | snprintf(tc_string, 8, "TC%d ", tc);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~tc is always in the range 0 - cfg->tcs. And as cfg->tcs is a u8, the range is 0 - 255. Further, on inspecting the code, it seems that cfg->tcs will never be more than AQ_CFG_TCS_MAX (8), so the range is actually 0 - 8.
So, it seems that the condition that GCC flags will not occur. But, nonetheless, it would be nice if it didn't emit the warning.
It seems that this can be achieved by changing the format specifier from %d to %u, in which case I believe GCC recognises an upper bound on the range of tc of 0 - 255. After some experimentation I think this is due to the combination of the use of %u and the type of cfg->tcs (u8).
Empirically, updating the type of the tc variable to unsigned int has the same effect.
As both of these changes seem to make sense in relation to what the code is actually doing - iterating over unsigned values - do both.
Compile tested only.
--- drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c +2 -2
@@ -265,7 +265,7 @@ static void aq_ethtool_get_strings(struct net_device *ndev,const int rx_stat_cnt =ARRAY_SIZE (aq_ethtool_queue_rx_stat_names);const int tx_stat_cnt =ARRAY_SIZE (aq_ethtool_queue_tx_stat_names);char tc_string[8 ]; -int tc; +unsigned int tc;memset (tc_string,0 ,sizeof (tc_string)); memcpy(p, aq_ethtool_stat_names,
@@ -274,7 +274,7 @@ static void aq_ethtool_get_strings(struct net_device *ndev,for (tc =0 ; tc < cfg->tcs; tc++) {if (cfg->is_qos) -snprintf (tc_string,8 ,"TC%d " , tc); +snprintf (tc_string,8 ,"TC%u " , tc);for (i =0 ; i < cfg->vecs; i++) {for (si =0 ; si < rx_stat_cnt; si++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 446/798 crypto: simd - Do not call crypto_alloc_tfm during registration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 3c44d31cb34ce4eb8311a2e73634d57702948230 ]
Algorithm registration is usually carried out during module init, where as little work as possible should be carried out. The SIMD code violated this rule by allocating a tfm, this then triggers a full test of the algorithm which may dead-lock in certain cases.
SIMD is only allocating the tfm to get at the alg object, which is in fact already available as it is what we are registering. Use that directly and remove the crypto_alloc_tfm call.
Also remove some obsolete and unused SIMD API.
--- arch/arm/crypto/aes-ce-glue.c | 2 +- arch/arm/crypto/aes-neonbs-glue.c | 2 +- crypto/simd.c | 76 ++++++------------------------- include/crypto/internal/simd.h | 12 +---- 4 files changed, 19 insertions(+), 73 deletions(-)
arch/arm/crypto/aes-ce-glue.c +1 -1
@@ -711,7 +711,7 @@ static int __init aes_init(void) algname = aes_algs[i].base.cra_name +2 ; drvname = aes_algs[i].base.cra_driver_name +2 ; basename = aes_algs[i].base.cra_driver_name; - simd =simd_skcipher_create_compat (algname, drvname, basename); + simd =simd_skcipher_create_compat (aes_algs + i, algname, drvname, basename); err =PTR_ERR (simd);if (IS_ERR (simd)) goto unregister_simds;
arch/arm/crypto/aes-neonbs-glue.c +1 -1
@@ -539,7 +539,7 @@ static int __init aes_init(void) algname = aes_algs[i].base.cra_name +2 ; drvname = aes_algs[i].base.cra_driver_name +2 ; basename = aes_algs[i].base.cra_driver_name; - simd =simd_skcipher_create_compat (algname, drvname, basename); + simd =simd_skcipher_create_compat (aes_algs + i, algname, drvname, basename); err =PTR_ERR (simd);if (IS_ERR (simd)) goto unregister_simds;
crypto/simd.c +15 -61
149 lines not on this page · raw message
include/crypto/internal/simd.h +2 -10
@@ -14,11 +14,10 @@struct simd_skcipher_alg ;struct skcipher_alg ; -struct simd_skcipher_alg *simd_skcipher_create_compat (const char *algname, +struct simd_skcipher_alg *simd_skcipher_create_compat (struct skcipher_alg *ialg, +const char *algname,const char *drvname,const char *basename); -struct simd_skcipher_alg *simd_skcipher_create (const char *algname, -const char *basename);void simd_skcipher_free (struct simd_skcipher_alg *alg); int simd_register_skciphers_compat(struct skcipher_alg *algs, int count,
@@ -32,13 +31,6 @@ void simd_unregister_skciphers(struct skcipher_alg *algs, int count,struct simd_aead_alg ;struct aead_alg ; -struct simd_aead_alg *simd_aead_create_compat (const char *algname, -const char *drvname, -const char *basename); -struct simd_aead_alg *simd_aead_create (const char *algname, -const char *basename); -void simd_aead_free (struct simd_aead_alg *alg); -int simd_register_aeads_compat (struct aead_alg *algs,int count,struct simd_aead_alg **simd_algs);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 447/798 tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
[ Upstream commit 0d9e5df4a257afc3a471a82961ace9a22b88295a ]
We found that one close-wait socket was reset by the other side due to a new connection reusing the same port which is beyond our expectation, so we have to investigate the underlying reason.
The following experiment is conducted in the test environment. We limit the port range from 40000 to 40010 and delay the time to close() after receiving a fin from the active close side, which can help us easily reproduce like what happened in production.
Here are three connections captured by tcpdump:
127.0.0.1.40002 > 127.0.0.1.9999: Flags [S], seq 2965525191 127.0.0.1.9999 > 127.0.0.1.40002: Flags [S.], seq 2769915070 127.0.0.1.40002 > 127.0.0.1.9999: Flags [.], ack 1 127.0.0.1.40002 > 127.0.0.1.9999: Flags [F.], seq 1, ack 1 // a few seconds later, within 60 seconds 127.0.0.1.40002 > 127.0.0.1.9999: Flags [S], seq 2965590730 127.0.0.1.9999 > 127.0.0.1.40002: Flags [.], ack 2 127.0.0.1.40002 > 127.0.0.1.9999: Flags [R], seq 2965525193 // later, very quickly
127.0.0.1.40002 > 127.0.0.1.9999: Flags [S], seq 2965590730 127.0.0.1.9999 > 127.0.0.1.40002: Flags [S.], seq 3120990805 127.0.0.1.40002 > 127.0.0.1.9999: Flags [.], ack 1
As we can see, the first flow is reset because:
1) client starts a new connection, I mean, the second one
2) client tries to find a suitable port which is a timewait socket (its state is timewait, substate is fin_wait2)
3) client occupies that timewait port to send a SYN
4) server finds a corresponding close-wait socket in ehash table, then replies with a challenge ack
5) client sends an RST to terminate this old close-wait socket.
I don't think the port selection algo can choose a FIN_WAIT2 socket when we turn on tcp_tw_reuse because on the server side there remain unread data. In some cases, if one side haven't call close() yet, we should not consider it as expendable and treat it at will.
Even though, sometimes, the server isn't able to call close() as soon as possible like what we expect, it can not be terminated easily, especially due to a second unrelated connection happening.
After this patch, we can see the expected failure if we start a connection when all the ports are occupied in fin_wait2 state:
"Ncat: Cannot assign requested address."
--- net/ipv4/tcp_ipv4.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/tcp_ipv4.c +3 -0
@@ -115,6 +115,9 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)const struct tcp_timewait_sock *tcptw =tcp_twsk (sktw);struct tcp_sock *tp =tcp_sk (sk); +if (tw->tw_substate ==TCP_FIN_WAIT2 ) + reuse =0 ; +if (reuse ==2 ) {/* Still does not detect *everything* that goes through * lo, since we require a loopback src or dst address
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 448/798 wifi: mac80211: fix RCU list iterations
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit ac35180032fbc5d80b29af00ba4881815ceefcb6 ]
There are a number of places where RCU list iteration is used, but that aren't (always) called with RCU held. Use just list_for_each_entry() in most, and annotate iface iteration with the required locks.
--- net/mac80211/chan.c | 4 +++- net/mac80211/mlme.c | 2 +- net/mac80211/scan.c | 2 +- net/mac80211/util.c | 4 +++- 4 files changed, 8 insertions(+), 4 deletions(-)
net/mac80211/chan.c +3 -1
@@ -245,7 +245,9 @@ ieee80211_get_max_required_bw(struct ieee80211_sub_if_data *sdata,enum nl80211_chan_width max_bw =NL80211_CHAN_WIDTH_20_NOHT ;struct sta_info *sta; -list_for_each_entry_rcu (sta, &sdata->local->sta_list, list) { +lockdep_assert_wiphy (sdata->local->hw.wiphy); + +list_for_each_entry (sta, &sdata->local->sta_list, list) {if (sdata != sta->sdata && !(sta->sdata->bss && sta->sdata->bss == sdata->bss))continue ;
net/mac80211/mlme.c +1 -1
@@ -660,7 +660,7 @@ static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,bool disable_mu_mimo = false;struct ieee80211_sub_if_data *other; -list_for_each_entry_rcu (other, &local->interfaces, list) { +list_for_each_entry (other, &local->interfaces, list) {if (other->vif.bss_conf.mu_mimo_owner) { disable_mu_mimo = true;break ;
net/mac80211/scan.c +1 -1
@@ -500,7 +500,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)* the scan was in progress; if there was none this will * just be a no-op for the particular interface. */ -list_for_each_entry_rcu (sdata, &local->interfaces, list) { +list_for_each_entry (sdata, &local->interfaces, list) {if (ieee80211_sdata_running (sdata))ieee80211_queue_work (&sdata->local->hw, &sdata->work); }
net/mac80211/util.c +3 -1
@@ -767,7 +767,9 @@ static void __iterate_interfaces(struct ieee80211_local *local,struct ieee80211_sub_if_data *sdata;bool active_only = iter_flags &IEEE80211_IFACE_ITER_ACTIVE ; -list_for_each_entry_rcu (sdata, &local->interfaces, list) { +list_for_each_entry_rcu (sdata, &local->interfaces, list, +lockdep_is_held (&local->iflist_mtx) || +lockdep_is_held (&local->hw.wiphy->mtx)) {switch (sdata->vif.type) {case NL80211_IFTYPE_MONITOR :if (!(sdata->u.mntr.flags &MONITOR_FLAG_ACTIVE ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 449/798 ACPICA: iasl: handle empty connection_node
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandrs Vinarskis <[email protected]>
[ Upstream commit a0a2459b79414584af6c46dd8c6f866d8f1aa421 ]
ACPICA commit 6c551e2c9487067d4b085333e7fe97e965a11625
--- drivers/acpi/acpica/exprep.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/acpica/exprep.c +3 -0
@@ -437,6 +437,9 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info)if (info->connection_node) { second_desc = info->connection_node->object; +if (second_desc ==NULL ) { +break ; + }if (!(second_desc->common.flags &AOPOBJ_DATA_VALID )) { status =acpi_ds_get_buffer_arguments (second_desc);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 450/798 proc: add config & param to block forcing mem writes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Ratiu <[email protected]>
[ Upstream commit 41e8149c8892ed1962bd15350b3c3e6e90cba7f4 ]
This adds a Kconfig option and boot param to allow removing the FOLL_FORCE flag from /proc/pid/mem write calls because it can be abused.
The traditional forcing behavior is kept as default because it can break GDB and some other use cases.
Previously we tried a more sophisticated approach allowing distributions to fine-tune /proc/pid/mem behavior, however that got NAK-ed by Linus [1], who prefers this simpler approach with semantics also easier to understand for users.
--- .../admin-guide/kernel-parameters.txt | 10 +++ fs/proc/base.c | 61 ++++++++++++++++++- security/Kconfig | 32 ++++++++++ 3 files changed, 102 insertions(+), 1 deletion(-)
Documentation/admin-guide/kernel-parameters.txt +10 -0
@@ -4540,6 +4540,16 @@ printk.time= Show timing data prefixed to each printk message line Format: <bool> (1/Y/y=enable, 0/N/n=disable) + proc_mem.force_override= [KNL] + Format: {always | ptrace | never} + Traditionally /proc/pid/mem allows memory permissions to be + overridden without restrictions. This option may be set to + restrict that. Can be one of: + - 'always': traditional behavior always allows mem overrides. + - 'ptrace': only allow mem overrides for active ptracers. + - 'never': never allow mem overrides. + If not specified, default is the CONFIG_PROC_MEM_* choice. + processor.max_cstate= [HW,ACPI] Limit processor to maximum C-state max_cstate=9 overrides any DMI blacklist limit.
fs/proc/base.c +60 -1
85 lines not on this page · raw message
security/Kconfig +32 -0
@@ -19,6 +19,38 @@ config SECURITY_DMESG_RESTRICT If you are unsure how to answer this question, answer N. +choice + prompt "Allow /proc/pid/mem access override" + default PROC_MEM_ALWAYS_FORCE + help + Traditionally /proc/pid/mem allows users to override memory + permissions for users like ptrace, assuming they have ptrace + capability. + + This allows people to limit that - either never override, or + require actual active ptrace attachment. + + Defaults to the traditional behavior (for now) + +config PROC_MEM_ALWAYS_FORCE + bool "Traditional /proc/pid/mem behavior" + help + This allows /proc/pid/mem accesses to override memory mapping + permissions if you have ptrace access rights. + +config PROC_MEM_FORCE_PTRACE + bool "Require active ptrace() use for access override" + help + This allows /proc/pid/mem accesses to override memory mapping + permissions for active ptracers like gdb. + +config PROC_MEM_NO_FORCE + bool "Never" + help + Never override memory mapping permissions + +endchoice + config SECURITY bool "Enable different security models" depends on SYSFS
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 451/798 wifi: mt76: mt7915: hold dev->mt76.mutex while disabling tx worker
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <[email protected]>
[ Upstream commit 8f7152f10cb434f954aeff85ca1be9cd4d01912b ]
Prevent racing against other functions disabling the same worker
--- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7915/mac.c +3 -1
@@ -1409,12 +1409,14 @@ void mt7915_mac_reset_work(struct work_struct *work)set_bit (MT76_RESET , &phy2->mt76->state);cancel_delayed_work_sync (&phy2->mt76->mac_work); } + +mutex_lock (&dev->mt76.mutex); +mt76_worker_disable (&dev->mt76.tx_worker);mt76_for_each_q_rx (&dev->mt76, i)napi_disable (&dev->mt76.napi[i]);napi_disable (&dev->mt76.tx_napi); -mutex_lock (&dev->mt76.mutex);mt76_wr (dev,MT_MCU_INT_EVENT ,MT_MCU_INT_EVENT_DMA_STOPPED );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 452/798 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 498365e52bebcbc36a93279fe7e9d6aec8479cee ]
Replace one-element array with a flexible-array member in struct host_cmd_ds_802_11_scan_ext.
With this, fix the following warning:
elo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------
elo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1) elo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]
--- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/scan.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/mwifiex/fw.h +1 -1
@@ -1586,7 +1586,7 @@ struct host_cmd_ds_802_11_scan_rsp {struct host_cmd_ds_802_11_scan_ext {u32 reserved; -u8 tlv_buffer[1 ]; +u8 tlv_buffer[]; } __packed;struct mwifiex_ie_types_bss_mode {
drivers/net/wireless/marvell/mwifiex/scan.c +1 -2
@@ -2548,8 +2548,7 @@ int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv, ext_scan_resp = &resp->params.ext_scan; tlv = (void *)ext_scan_resp->tlv_buffer; - buf_left =le16_to_cpu (resp->size) - (sizeof (*ext_scan_resp) +S_DS_GEN - -1 ); + buf_left =le16_to_cpu (resp->size) - (sizeof (*ext_scan_resp) +S_DS_GEN );while (buf_left >=sizeof (struct mwifiex_ie_types_header )) { type =le16_to_cpu (tlv->type);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 453/798 nfp: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit daaba19d357f0900b303a530ced96c78086267ea ]
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/netronome/nfp/nfp_net_common.c +2 -3
@@ -818,14 +818,13 @@ nfp_net_prepare_vector(struct nfp_net *nn, struct nfp_net_r_vector *r_vec,snprintf (r_vec->name,sizeof (r_vec->name),"%s-rxtx-%d" ,nfp_net_name (nn), idx); - err =request_irq (r_vec->irq_vector, r_vec->handler,0 , r_vec->name, - r_vec); + err =request_irq (r_vec->irq_vector, r_vec->handler,IRQF_NO_AUTOEN , + r_vec->name, r_vec);if (err) {nfp_net_napi_del (&nn->dp, r_vec);nn_err (nn,"Error requesting IRQ %d\n" , r_vec->irq_vector);return err; } -disable_irq (r_vec->irq_vector);irq_set_affinity_hint (r_vec->irq_vector, &r_vec->affinity_mask);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 454/798 ALSA: usb-audio: Add input value sanity checks for standard types
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 901e85677ec0bb9a69fb9eab1feafe0c4eb7d07e ]
For an invalid input value that is out of the given range, currently USB-audio driver corrects the value silently and accepts without errors. This is no wrong behavior, per se, but the recent kselftest rather wants to have an error in such a case, hence a different behavior is expected now.
This patch adds a sanity check at each control put for the standard mixer types and returns an error if an invalid value is given.
Note that this covers only the standard mixer types. The mixer quirks that have own control callbacks would need different coverage.
--- sound/usb/mixer.c | 35 +++++++++++++++++++++++++++-------- sound/usb/mixer.h | 1 + 2 files changed, 28 insertions(+), 8 deletions(-)
sound/usb/mixer.c +27 -8
@@ -1377,6 +1377,19 @@ static int get_min_max_with_quirks(struct usb_mixer_elem_info *cval,#define get_min_max (cval, def) get_min_max_with_quirks(cval, def, NULL) +/* get the max value advertised via control API */ +static int get_max_exposed (struct usb_mixer_elem_info *cval) +{ +if (!cval->max_exposed) { +if (cval->res) + cval->max_exposed = +DIV_ROUND_UP (cval->max - cval->min, cval->res); +else + cval->max_exposed = cval->max - cval->min; + } +return cval->max_exposed; +} +/* get a feature/mixer unit info */ static int mixer_ctl_feature_info (struct snd_kcontrol *kcontrol,struct snd_ctl_elem_info *uinfo)
@@ -1389,11 +1402,8 @@ static int mixer_ctl_feature_info(struct snd_kcontrol *kcontrol,else uinfo->type =SNDRV_CTL_ELEM_TYPE_INTEGER ; uinfo->count = cval->channels; -if (cval->val_type ==USB_MIXER_BOOLEAN || - cval->val_type ==USB_MIXER_INV_BOOLEAN ) { - uinfo->value.integer.min =0 ; - uinfo->value.integer.max =1 ; - }else { +if (cval->val_type !=USB_MIXER_BOOLEAN && + cval->val_type !=USB_MIXER_INV_BOOLEAN ) {if (!cval->initialized) {get_min_max_with_quirks (cval,0 , kcontrol);if (cval->initialized && cval->dBmin >= cval->dBmax) {
@@ -1405,10 +1415,10 @@ static int mixer_ctl_feature_info(struct snd_kcontrol *kcontrol, &kcontrol->id); } } - uinfo->value.integer.min =0 ; - uinfo->value.integer.max = -DIV_ROUND_UP (cval->max - cval->min, cval->res); } + + uinfo->value.integer.min =0 ; + uinfo->value.integer.max =get_max_exposed (cval);return 0 ; }
@@ -1449,6 +1459,7 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) {struct usb_mixer_elem_info *cval = kcontrol->private_data; +int max_val =get_max_exposed (cval);int c, cnt, val, oval, err;int changed =0 ;
@@ -1461,6 +1472,8 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol,if (err <0 )return filter_error (cval, err); val = ucontrol->value.integer.value[cnt]; +if (val <0 || val > max_val) +return -EINVAL ; val =get_abs_value (cval, val);if (oval != val) {snd_usb_set_cur_mix_value (cval, c +1 , cnt, val);
@@ -1474,6 +1487,8 @@ static int mixer_ctl_feature_put(struct snd_kcontrol *kcontrol,if (err <0 )return filter_error (cval, err); val = ucontrol->value.integer.value[0 ]; +if (val <0 || val > max_val) +return -EINVAL ; val =get_abs_value (cval, val);if (val != oval) {snd_usb_set_cur_mix_value (cval,0 ,0 , val);
@@ -2339,6 +2354,8 @@ static int mixer_ctl_procunit_put(struct snd_kcontrol *kcontrol,if (err <0 )return filter_error (cval, err); val = ucontrol->value.integer.value[0 ]; +if (val <0 || val >get_max_exposed (cval)) +return -EINVAL ; val =get_abs_value (cval, val);if (val != oval) {set_cur_ctl_value (cval, cval->control <<8 , val);
@@ -2701,6 +2718,8 @@ static int mixer_ctl_selector_put(struct snd_kcontrol *kcontrol,if (err <0 )return filter_error (cval, err); val = ucontrol->value.enumerated.item[0 ]; +if (val <0 || val >= cval->max)/* here cval->max = # elements */ +return -EINVAL ; val =get_abs_value (cval, val);if (val != oval) {set_cur_ctl_value (cval, cval->control <<8 , val);
sound/usb/mixer.h +1 -0
@@ -88,6 +88,7 @@ struct usb_mixer_elem_info {int channels;int val_type;int min, max, res; +int max_exposed;/* control API exposes the value in 0..max_exposed */ int dBmin, dBmax;int cached;int cache_val[MAX_CHANNELS ];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 455/798 x86/ioapic: Handle allocation failures gracefully
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 830802a0fea8fb39d3dc9fb7d6b5581e1343eb1f ]
Breno observed panics when using failslab under certain conditions during runtime:
can not alloc irq_pin_list (-1,0,20)
Kernel panic - not syncing: IO-APIC: failed to add irq-pin. Can not proceed panic+0x4e9/0x590 mp_irqdomain_alloc+0x9ab/0xa80 irq_domain_alloc_irqs_locked+0x25d/0x8d0 __irq_domain_alloc_irqs+0x80/0x110 mp_map_pin_to_irq+0x645/0x890 acpi_register_gsi_ioapic+0xe6/0x150 hpet_open+0x313/0x480
That's a pointless panic which is a leftover of the historic IO/APIC code which panic'ed during early boot when the interrupt allocation failed.
The only place which might justify panic is the PIT/HPET timer_check() code which tries to figure out whether the timer interrupt is delivered through the IO/APIC. But that code does not require to handle interrupt allocation failures. If the interrupt cannot be allocated then timer delivery fails and it either panics due to that or falls back to legacy mode.
Cure this by removing the panic wrapper around __add_pin_to_irq_node() and making mp_irqdomain_alloc() aware of the failure condition and handle it as any other failure in this function gracefully.
--- arch/x86/kernel/apic/io_apic.c | 46 ++++++++++++++++------------------ 1 file changed, 22 insertions(+), 24 deletions(-)
arch/x86/kernel/apic/io_apic.c +22 -24
@@ -351,27 +351,26 @@ static void ioapic_mask_entry(int apic, int pin)* shared ISA-space IRQs, so we have to support them. We are super * fast in the common case, and fast for shared ISA-space IRQs. */ -static int __add_pin_to_irq_node (struct mp_chip_data *data, -int node,int apic,int pin) +static bool add_pin_to_irq_node (struct mp_chip_data *data,int node,int apic,int pin) {struct irq_pin_list *entry; -/* don't allow duplicates */ -for_each_irq_pin (entry, data->irq_2_pin) +/* Don't allow duplicates */ +for_each_irq_pin (entry, data->irq_2_pin) {if (entry->apic == apic && entry->pin == pin) -return 0 ; +return true; + } entry =kzalloc_node (sizeof (struct irq_pin_list ),GFP_ATOMIC , node);if (!entry) { -pr_err ("can not alloc irq_pin_list (%d,%d,%d)\n" , - node, apic, pin); -return -ENOMEM ; +pr_err ("Cannot allocate irq_pin_list (%d,%d,%d)\n" , node, apic, pin); +return false; } + entry->apic = apic; entry->pin = pin;list_add_tail (&entry->list, &data->irq_2_pin); - -return 0 ; +return true; }static void __remove_pin_from_irq (struct mp_chip_data *data,int apic,int pin)
@@ -386,13 +385,6 @@ static void __remove_pin_from_irq(struct mp_chip_data *data, int apic, int pin) } } -static void add_pin_to_irq_node (struct mp_chip_data *data, -int node,int apic,int pin) -{ -if (__add_pin_to_irq_node (data, node, apic, pin)) -panic ("IO-APIC: failed to add irq-pin. Can not proceed\n" ); -} -/* * Reroute an IRQ to a different pin. */
@@ -1001,8 +993,7 @@ static int alloc_isa_irq_from_domain(struct irq_domain *domain,if (irq_data && irq_data->parent_data) {if (!mp_check_pin_attr (irq, info))return -EBUSY ; -if (__add_pin_to_irq_node (irq_data->chip_data, node, ioapic, - info->ioapic.pin)) +if (!add_pin_to_irq_node (irq_data->chip_data, node, ioapic, info->ioapic.pin))return -ENOMEM ; }else { info->flags |=X86_IRQ_ALLOC_LEGACY ;
@@ -3038,10 +3029,8 @@ int mp_irqdomain_alloc(struct irq_domain *domain, unsigned int virq,return -ENOMEM ; ret =irq_domain_alloc_irqs_parent (domain, virq, nr_irqs, info); -if (ret <0 ) { -kfree (data); -return ret; - } +if (ret <0 ) + goto free_data;INIT_LIST_HEAD (&data->irq_2_pin); irq_data->hwirq = info->ioapic.pin;
@@ -3050,7 +3039,10 @@ int mp_irqdomain_alloc(struct irq_domain *domain, unsigned int virq, irq_data->chip_data = data;mp_irqdomain_get_attr (mp_pin_to_gsi (ioapic, pin), data, info); -add_pin_to_irq_node (data,ioapic_alloc_attr_node (info), ioapic, pin); +if (!add_pin_to_irq_node (data,ioapic_alloc_attr_node (info), ioapic, pin)) { + ret = -ENOMEM ; + goto free_irqs; + }mp_preconfigure_entry (data);mp_register_handler (virq, data->is_level);
@@ -3065,6 +3057,12 @@ int mp_irqdomain_alloc(struct irq_domain *domain, unsigned int virq, ioapic,mpc_ioapic_id (ioapic), pin, virq, data->is_level, data->active_low);return 0 ; + +free_irqs: +irq_domain_free_irqs_parent (domain, virq, nr_irqs); +free_data: +kfree (data); +return ret; } void mp_irqdomain_free(struct irq_domain *domain, unsigned int virq,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 456/798 ALSA: usb-audio: Define macros for quirk table entries
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 0c3ad39b791c2ecf718afcaca30e5ceafa939d5c ]
Many entries in the USB-audio quirk tables have relatively complex expressions. For improving the readability, introduce a few macros. Those are applied in the following patch.
--- sound/usb/quirks-table.h | 77 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+)
sound/usb/quirks-table.h +77 -0
@@ -35,6 +35,83 @@ .bInterfaceClass = USB_CLASS_AUDIO, \ .bInterfaceSubClass =USB_SUBCLASS_AUDIOCONTROL +/* Quirk .driver_info, followed by the definition of the quirk entry; +* put like QUIRK_DRIVER_INFO { ... } in each entry of the quirk table + */ +#define QUIRK_DRIVER_INFO \ + .driver_info = (unsigned long)&(const struct snd_usb_audio_quirk) + +/* +* Macros for quirk data entries +*/ + +/* Quirk data entry for ignoring the interface */ +#define QUIRK_DATA_IGNORE (_ifno) \ + .ifnum = (_ifno), .type = QUIRK_IGNORE_INTERFACE +/* Quirk data entry for a standard audio interface */ +#define QUIRK_DATA_STANDARD_AUDIO (_ifno) \ + .ifnum = (_ifno), .type = QUIRK_AUDIO_STANDARD_INTERFACE +/* Quirk data entry for a standard MIDI interface */ +#define QUIRK_DATA_STANDARD_MIDI (_ifno) \ + .ifnum = (_ifno), .type = QUIRK_MIDI_STANDARD_INTERFACE +/* Quirk data entry for a standard mixer interface */ +#define QUIRK_DATA_STANDARD_MIXER (_ifno) \ + .ifnum = (_ifno), .type = QUIRK_AUDIO_STANDARD_MIXER + +/* Quirk data entry for Yamaha MIDI */ +#define QUIRK_DATA_MIDI_YAMAHA (_ifno) \ + .ifnum = (_ifno), .type = QUIRK_MIDI_YAMAHA +/* Quirk data entry for Edirol UAxx */ +#define QUIRK_DATA_EDIROL_UAXX (_ifno) \ + .ifnum = (_ifno), .type = QUIRK_AUDIO_EDIROL_UAXX +/* Quirk data entry for raw bytes interface */ +#define QUIRK_DATA_RAW_BYTES (_ifno) \ + .ifnum = (_ifno), .type = QUIRK_MIDI_RAW_BYTES + +/* Quirk composite array terminator */ +#define QUIRK_COMPOSITE_END { .ifnum = -1 } + +/* Quirk data entry for composite quirks; +* followed by the quirk array that is terminated with QUIRK_COMPOSITE_END +* e.g. QUIRK_DATA_COMPOSITE { { quirk1 }, { quirk2 },..., QUIRK_COMPOSITE_END } +*/ +#define QUIRK_DATA_COMPOSITE \ + .ifnum = QUIRK_ANY_INTERFACE, \ + .type = QUIRK_COMPOSITE, \ + .data = &(const struct snd_usb_audio_quirk[]) + +/* Quirk data entry for a fixed audio endpoint; +* followed by audioformat definition +* e.g. QUIRK_DATA_AUDIOFORMAT(n) { .formats = xxx, ... } +*/ +#define QUIRK_DATA_AUDIOFORMAT (_ifno) \ + .ifnum = (_ifno), \ + .type = QUIRK_AUDIO_FIXED_ENDPOINT, \ + .data = &(const struct audioformat) + +/* Quirk data entry for a fixed MIDI endpoint; +* followed by snd_usb_midi_endpoint_info definition +* e.g. QUIRK_DATA_MIDI_FIXED_ENDPOINT(n) { .out_cables = x, .in_cables = y } +*/ +#define QUIRK_DATA_MIDI_FIXED_ENDPOINT (_ifno) \ + .ifnum = (_ifno), \ + .type = QUIRK_MIDI_FIXED_ENDPOINT, \ + .data = &(const struct snd_usb_midi_endpoint_info) +/* Quirk data entry for a MIDIMAN MIDI endpoint */ +#define QUIRK_DATA_MIDI_MIDIMAN (_ifno) \ + .ifnum = (_ifno), \ + .type = QUIRK_MIDI_MIDIMAN, \ + .data = &(const struct snd_usb_midi_endpoint_info) +/* Quirk data entry for a EMAGIC MIDI endpoint */ +#define QUIRK_DATA_MIDI_EMAGIC (_ifno) \ + .ifnum = (_ifno), \ + .type = QUIRK_MIDI_EMAGIC, \ + .data = &(const struct snd_usb_midi_endpoint_info) + +/* +* Here we go... the quirk table definition begins: +*/ +/* FTDI devices */ { USB_DEVICE(0x0403, 0xb8d8),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 457/798 ALSA: usb-audio: Replace complex quirk lines with macros
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit d79e13f8e8abb5cd3a2a0f9fc9bc3fc750c5b06f ]
Apply the newly introduced macros for reduce the complex expressions and cast in the quirk table definitions. It results in a significant code reduction, too.
There should be no functional changes.
--- sound/usb/quirks-table.h | 2210 ++++++++++---------------------------- 1 file changed, 593 insertions(+), 1617 deletions(-)
sound/usb/quirks-table.h +593 -1617
@@ -115,7 +115,7 @@/* FTDI devices */ {USB_DEVICE (0x0403 ,0xb8d8 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "STARR LABS", */ /* .product_name = "Starr Labs MIDI USB device", */ .ifnum = 0,
@@ -126,10 +126,8 @@ {/* Creative BT-D1 */ USB_DEVICE (0x041e ,0x0005 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 2, .iface = 1,
@@ -164,18 +162,11 @@*/ {USB_AUDIO_DEVICE (0x041e ,0x4095 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(2) }, { - .ifnum =3 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(3) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 2, .fmt_bits = 16,
@@ -191,9 +182,7 @@ .rate_table = (unsigned int[]) { 48000 }, }, }, - { - .ifnum = -1 - }, +QUIRK_COMPOSITE_END }, }, },
@@ -205,31 +194,18 @@*/ {USB_DEVICE (0x0424 ,0xb832 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Standard Microsystems Corp." , .product_name = "HP Wireless Audio", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE {/* Mixer */ - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE , - }, + { QUIRK_DATA_IGNORE(0) },/* Playback */ - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE , - }, + { QUIRK_DATA_IGNORE(1) },/* Capture */ - { - .ifnum =2 , - .type =QUIRK_IGNORE_INTERFACE , - }, + { QUIRK_DATA_IGNORE(2) },/* HID Device, .ifnum = 3 */ - { - .ifnum =-1 , - } + QUIRK_COMPOSITE_END } } },
@@ -252,20 +228,18 @@#define YAMAHA_DEVICE (id, name) { \ USB_DEVICE(0x0499, id), \ - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { \ + QUIRK_DRIVER_INFO { \ .vendor_name = "Yamaha", \ .product_name = name, \ - .ifnum = QUIRK_ANY_INTERFACE, \ - .type = QUIRK_MIDI_YAMAHA \ + QUIRK_DATA_MIDI_YAMAHA(QUIRK_ANY_INTERFACE) \ } \ }#define YAMAHA_INTERFACE (id, intf, name) { \ USB_DEVICE_VENDOR_SPEC(0x0499, id), \ - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { \ + QUIRK_DRIVER_INFO { \ .vendor_name = "Yamaha", \ .product_name = name, \ - .ifnum = intf, \ - .type = QUIRK_MIDI_YAMAHA \ + QUIRK_DATA_MIDI_YAMAHA(intf) \ } \ } YAMAHA_DEVICE(0x1000, "UX256"),
@@ -353,135 +327,67 @@ YAMAHA_DEVICE(0x105d, NULL), YAMAHA_DEVICE(0x1718, "P-125"), { USB_DEVICE(0x0499, 0x1503), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { /* .vendor_name = "Yamaha", */ /* .product_name = "MOX6/MOX8", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_YAMAHA - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END } } }, { USB_DEVICE(0x0499, 0x1507), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { /* .vendor_name = "Yamaha", */ /* .product_name = "THR10", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_YAMAHA - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END } } }, { USB_DEVICE(0x0499, 0x1509), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { /* .vendor_name = "Yamaha", */ /* .product_name = "Steinberg UR22", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_YAMAHA - }, - { - .ifnum =4 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + { QUIRK_DATA_IGNORE(4) }, + QUIRK_COMPOSITE_END } } }, { USB_DEVICE(0x0499, 0x150a), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { /* .vendor_name = "Yamaha", */ /* .product_name = "THR5A", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_YAMAHA - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END } } }, { USB_DEVICE(0x0499, 0x150c), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { /* .vendor_name = "Yamaha", */ /* .product_name = "THR10C", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_YAMAHA - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END } } },
@@ -515,7 +421,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), USB_DEVICE_ID_MATCH_INT_CLASS, .idVendor = 0x0499, .bInterfaceClass =USB_CLASS_VENDOR_SPEC , - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { .ifnum =QUIRK_ANY_INTERFACE , .type = QUIRK_AUTODETECT }
@@ -526,16 +432,12 @@ YAMAHA_DEVICE(0x7010, "UB99"),*/ {USB_DEVICE (0x0582 ,0x0000 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "UA-100", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { { - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 4, .iface = 0,
@@ -550,9 +452,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 1, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 2, .iface = 1,
@@ -567,106 +467,66 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_MIDI_FIXED_ENDPOINT, - .data = & (const struct snd_usb_midi_endpoint_info) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables = 0x0007, .in_cables = 0x0007 } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0002 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-4", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x000f , .in_cables = 0x000f } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0003 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "SC-8850", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x003f , .in_cables = 0x003f } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0004 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "U-8", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0005 , .in_cables = 0x0005 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -674,152 +534,92 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Has ID 0x0099 when not in "Advanced Driver" mode. * The UM-2EX has only one input, but we cannot detect this. */ USB_DEVICE (0x0582 ,0x0005 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-2", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0003 , .in_cables = 0x0003 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0007 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "SC-8820", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0013 , .in_cables = 0x0013 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0008 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "PC-300", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {/* has ID 0x009d when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0009 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-1", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x000b ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "SK-500", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0013 , .in_cables = 0x0013 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -827,31 +627,19 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* thanks to Emiliano Grilli <[email protected]> * for helping researching this data */ USB_DEVICE (0x0582 ,0x000c ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "SC-D70", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0007 , .in_cables = 0x0007 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -865,35 +653,23 @@ YAMAHA_DEVICE(0x7010, "UB99"),* the 96kHz sample rate. */ USB_DEVICE (0x0582 ,0x0010 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-5", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x0013 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0012 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "XV-5050", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -902,12 +678,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0015 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0014 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-880", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x01ff , .in_cables = 0x01ff }
@@ -916,74 +690,48 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0017 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0016 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "SD-90", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x000f , .in_cables = 0x000f } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {/* has ID 0x001c when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x001b ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "MMP-2", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {/* has ID 0x001e when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x001d ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "V-SYNTH", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -992,12 +740,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0024 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0023 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-550", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x003f , .in_cables = 0x003f }
@@ -1010,20 +756,13 @@ YAMAHA_DEVICE(0x7010, "UB99"),* and no MIDI. */ USB_DEVICE (0x0582 ,0x0025 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-20", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 2, .iface = 1,
@@ -1038,9 +777,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 2, .iface = 2,
@@ -1055,28 +792,22 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 3, - .type = QUIRK_MIDI_FIXED_ENDPOINT, - .data = & (const struct snd_usb_midi_endpoint_info) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } }, {/* has ID 0x0028 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0027 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "SD-20", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0003 , .in_cables = 0x0007 }
@@ -1085,12 +816,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x002a when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0029 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "SD-80", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x000f , .in_cables = 0x000f }
@@ -1103,39 +832,24 @@ YAMAHA_DEVICE(0x7010, "UB99"),* but offers only 16-bit PCM and no MIDI. */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x002b ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-700", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =3 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_EDIROL_UAXX(1) }, + { QUIRK_DATA_EDIROL_UAXX(2) }, + { QUIRK_DATA_EDIROL_UAXX(3) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x002e when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x002d ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "XV-2020", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1144,12 +858,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0030 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x002f ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "VariOS", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0007 , .in_cables = 0x0007 }
@@ -1158,12 +870,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0034 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0033 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "PCR", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0003 , .in_cables = 0x0007 }
@@ -1175,12 +885,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),* later revisions use IDs 0x0054 and 0x00a2. */ USB_DEVICE (0x0582 ,0x0037 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "Digital Piano", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1193,39 +901,24 @@ YAMAHA_DEVICE(0x7010, "UB99"),* and no MIDI. */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x003b ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="BOSS" , .product_name = "GS-10", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_STANDARD_MIDI(3) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x0041 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0040 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "GI-20", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1234,12 +927,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0043 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0042 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "RS-70", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1248,36 +939,24 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0049 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0047 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "EDIROL", */ /* .product_name = "UR-80", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE {/* in the 96 kHz modes, only interface 1 is there */ - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x004a when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0048 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "EDIROL", */ /* .product_name = "UR-80", */ - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables = 0x0003, .in_cables = 0x0007 }
@@ -1286,35 +965,23 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x004e when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x004c ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "PCR-A", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x004f when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x004d ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "PCR-A", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0003 , .in_cables = 0x0007 }
@@ -1326,76 +993,52 @@ YAMAHA_DEVICE(0x7010, "UB99"),* is standard compliant, but has only 16-bit PCM. */ USB_DEVICE (0x0582 ,0x0050 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-3FX", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0052 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-1SX", - .ifnum =0 , - .type =QUIRK_MIDI_STANDARD_INTERFACE + QUIRK_DATA_STANDARD_MIDI(0) } }, {USB_DEVICE (0x0582 ,0x0060 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "EXR Series", - .ifnum =0 , - .type =QUIRK_MIDI_STANDARD_INTERFACE +QUIRK_DATA_STANDARD_MIDI (0 ) } }, {/* has ID 0x0066 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0064 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "EDIROL", */ /* .product_name = "PCR-1", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x0067 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0065 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "EDIROL", */ /* .product_name = "PCR-1", */ - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables = 0x0001, .in_cables =0x0003 }
@@ -1404,12 +1047,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x006e when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x006d ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "FANTOM-X", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1422,39 +1063,24 @@ YAMAHA_DEVICE(0x7010, "UB99"),* offers only 16-bit PCM at 44.1 kHz and no MIDI. */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x0074 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-25", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_EDIROL_UAXX(0) }, + { QUIRK_DATA_EDIROL_UAXX(1) }, + { QUIRK_DATA_EDIROL_UAXX(2) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x0076 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0075 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="BOSS" , .product_name = "DR-880", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1463,12 +1089,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x007b when not in "Advanced Driver" mode */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x007a ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" ,/* "RD" or "RD-700SX"? */ - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0003 , .in_cables = 0x0003 }
@@ -1477,12 +1101,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0081 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0080 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "G-70", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1491,12 +1113,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x008c when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x008b ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "PC-50", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1508,56 +1128,31 @@ YAMAHA_DEVICE(0x7010, "UB99"),* is standard compliant, but has only 16-bit PCM and no MIDI. */ USB_DEVICE (0x0582 ,0x00a3 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-4FX", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_EDIROL_UAXX(0) }, + { QUIRK_DATA_EDIROL_UAXX(1) }, + { QUIRK_DATA_EDIROL_UAXX(2) }, + QUIRK_COMPOSITE_END } } }, {/* Edirol M-16DX */ USB_DEVICE (0x0582 ,0x00c4 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -1567,37 +1162,22 @@ YAMAHA_DEVICE(0x7010, "UB99"),* offers only 16-bit PCM at 44.1 kHz and no MIDI. */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x00e6 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-25EX", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_EDIROL_UAXX(0) }, + { QUIRK_DATA_EDIROL_UAXX(1) }, + { QUIRK_DATA_EDIROL_UAXX(2) }, + QUIRK_COMPOSITE_END } } }, {/* Edirol UM-3G */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x0108 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables = 0x0007, .in_cables =0x0007 }
@@ -1606,45 +1186,29 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* BOSS ME-25 */ USB_DEVICE (0x0582 ,0x0113 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {/* only 44.1 kHz works at the moment */ USB_DEVICE (0x0582 ,0x0120 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "Roland", */ /* .product_name = "OCTO-CAPTURE", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { { - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S32_LE, .channels = 10, .iface = 0,
@@ -1660,9 +1224,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 1, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S32_LE, .channels = 12, .iface = 1,
@@ -1678,40 +1240,26 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_MIDI_FIXED_ENDPOINT, - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum = 3, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = 4, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = -1 - } + { QUIRK_DATA_IGNORE(3) }, + { QUIRK_DATA_IGNORE(4) }, + QUIRK_COMPOSITE_END } } }, {/* only 44.1 kHz works at the moment */ USB_DEVICE (0x0582 ,0x012f ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "Roland", */ /* .product_name = "QUAD-CAPTURE", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { { - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S32_LE, .channels = 4, .iface = 0,
@@ -1727,9 +1275,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 1, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S32_LE, .channels = 6, .iface = 1,
@@ -1745,54 +1291,32 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_MIDI_FIXED_ENDPOINT, - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum = 3, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = 4, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = -1 - } + { QUIRK_DATA_IGNORE(3) }, + { QUIRK_DATA_IGNORE(4) }, + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0159 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "Roland", */ /* .product_name = "UA-22", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -1800,19 +1324,19 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* UA101 and co are supported by another driver */ {USB_DEVICE (0x0582 ,0x0044 ),/* UA-1000 high speed */ - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .ifnum =QUIRK_NODEV_INTERFACE }, }, {USB_DEVICE (0x0582 ,0x007d ),/* UA-101 high speed */ - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { .ifnum =QUIRK_NODEV_INTERFACE }, }, {USB_DEVICE (0x0582 ,0x008d ),/* UA-101 full speed */ - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { .ifnum =QUIRK_NODEV_INTERFACE }, },
@@ -1823,7 +1347,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), USB_DEVICE_ID_MATCH_INT_CLASS, .idVendor = 0x0582, .bInterfaceClass =USB_CLASS_VENDOR_SPEC , - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { .ifnum =QUIRK_ANY_INTERFACE , .type = QUIRK_AUTODETECT }
@@ -1838,12 +1362,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),* compliant USB MIDI ports for external MIDI and controls. */ USB_DEVICE_VENDOR_SPEC (0x06f8 ,0xb000 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Hercules" , .product_name = "DJ Console (WE)", - .ifnum =4 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(4) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1853,12 +1375,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Midiman/M-Audio devices */ {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1002 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 2x2", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x0003 , .in_cables = 0x0003 }
@@ -1866,12 +1386,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1011 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 1x1", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1879,12 +1397,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1015 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "Keystation", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1892,12 +1408,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1021 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 4x4", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x000f , .in_cables = 0x000f }
@@ -1910,12 +1424,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),* Thanks to Olaf Giesbrecht <[email protected]> */ USB_DEVICE_VER (0x0763 ,0x1031 ,0x0100 ,0x0109 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 8x8", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x01ff , .in_cables = 0x01ff }
@@ -1923,12 +1435,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1033 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 8x8", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x01ff , .in_cables = 0x01ff }
@@ -1936,12 +1446,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1041 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 2x4", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x000f , .in_cables = 0x0003 }
@@ -1949,76 +1457,41 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2001 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "Quattro", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE {/* * Interfaces 0-2 are "Windows-compatible", 16-bit only, * and share endpoints with the other interfaces. * Ignore them. The other interfaces can do 24 bits, * but captured samples are big-endian (see usbaudio.c). */ - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =4 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =5 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =6 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =7 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =8 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =9 , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, + { QUIRK_DATA_IGNORE(2) }, + { QUIRK_DATA_IGNORE(3) }, + { QUIRK_DATA_STANDARD_AUDIO(4) }, + { QUIRK_DATA_STANDARD_AUDIO(5) }, + { QUIRK_DATA_IGNORE(6) }, + { QUIRK_DATA_STANDARD_AUDIO(7) }, + { QUIRK_DATA_STANDARD_AUDIO(8) }, + { + QUIRK_DATA_MIDI_MIDIMAN(9) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } +QUIRK_COMPOSITE_END } } }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2003 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "AudioPhile", - .ifnum =6 , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(6) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -2026,12 +1499,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2008 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "Ozone", - .ifnum =3 , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(3) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -2039,93 +1510,45 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, { USB_DEVICE_VENDOR_SPEC(0x0763, 0x200d), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name = "M-Audio", .product_name = "OmniStudio", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =4 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =5 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =6 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =7 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =8 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =9 , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, + { QUIRK_DATA_IGNORE(2) }, + { QUIRK_DATA_IGNORE(3) }, + { QUIRK_DATA_STANDARD_AUDIO(4) }, + { QUIRK_DATA_STANDARD_AUDIO(5) }, + { QUIRK_DATA_IGNORE(6) }, + { QUIRK_DATA_STANDARD_AUDIO(7) }, + { QUIRK_DATA_STANDARD_AUDIO(8) }, + { + QUIRK_DATA_MIDI_MIDIMAN(9) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, { USB_DEVICE(0x0763, 0x2019), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { /* .vendor_name = "M-Audio", */ /* .product_name = "Ozone Academic", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(3) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -2135,21 +1558,14 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2030 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "M-Audio", */ /* .product_name = "Fast Track C400", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(1) }, /* Playback */ { - .ifnum =2 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 6, .iface = 2,
@@ -2173,9 +1589,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), },/* Capture */ { - .ifnum = 3, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(3) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 4, .iface = 3,
@@ -2197,30 +1611,21 @@ YAMAHA_DEVICE(0x7010, "UB99"), .clock = 0x80, } }, -/* MIDI */ - { - .ifnum = -1 /* Interface = 4 */ - } +/* MIDI: Interface = 4*/ + QUIRK_COMPOSITE_END } } }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2031 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "M-Audio", */ /* .product_name = "Fast Track C600", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(1) }, /* Playback */ { - .ifnum =2 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 2,
@@ -2244,9 +1649,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), },/* Capture */ { - .ifnum = 3, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(3) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 6, .iface = 3,
@@ -2268,29 +1671,20 @@ YAMAHA_DEVICE(0x7010, "UB99"), .clock = 0x80, } }, -/* MIDI */ - { - .ifnum = -1 /* Interface = 4 */ - } +/* MIDI: Interface = 4 */ + QUIRK_COMPOSITE_END } } }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2080 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "M-Audio", */ /* .product_name = "Fast Track Ultra", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(0) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 1,
@@ -2312,9 +1706,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 2,
@@ -2336,28 +1728,19 @@ YAMAHA_DEVICE(0x7010, "UB99"), } },/* interface 3 (MIDI) is standard compliant */ - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2081 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "M-Audio", */ /* .product_name = "Fast Track Ultra 8R", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(0) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 1,
@@ -2379,9 +1762,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 2,
@@ -2403,9 +1784,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } },/* interface 3 (MIDI) is standard compliant */ - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },
@@ -2413,21 +1792,19 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Casio devices */ {USB_DEVICE (0x07cf ,0x6801 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Casio" , .product_name = "PL-40R", - .ifnum =0 , - .type =QUIRK_MIDI_YAMAHA + QUIRK_DATA_MIDI_YAMAHA(0) } }, {/* this ID is used by several devices without a product ID */ USB_DEVICE (0x07cf ,0x6802 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Casio" , .product_name = "Keyboard", - .ifnum =0 , - .type =QUIRK_MIDI_YAMAHA +QUIRK_DATA_MIDI_YAMAHA (0 ) } },
@@ -2440,23 +1817,13 @@ YAMAHA_DEVICE(0x7010, "UB99"), .idVendor = 0x07fd, .idProduct = 0x0001, .bDeviceSubClass = 2, - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name = "MOTU", .product_name = "Fastlane", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_MIDI_RAW_BYTES - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_RAW_BYTES(0) }, + { QUIRK_DATA_IGNORE(1) }, + QUIRK_COMPOSITE_END } } },
@@ -2464,12 +1831,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Emagic devices */ {USB_DEVICE (0x086a ,0x0001 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Emagic" , .product_name = "Unitor8", - .ifnum =2 , - .type =QUIRK_MIDI_EMAGIC , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_EMAGIC(2) { .out_cables =0x80ff , .in_cables = 0x80ff }
@@ -2477,12 +1842,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE (0x086a ,0x0002 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Emagic" ,/* .product_name = "AMT8", */ - .ifnum =2 , - .type =QUIRK_MIDI_EMAGIC , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_EMAGIC(2) { .out_cables =0x80ff , .in_cables = 0x80ff }
@@ -2490,12 +1853,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE (0x086a ,0x0003 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Emagic" ,/* .product_name = "MT4", */ - .ifnum =2 , - .type =QUIRK_MIDI_EMAGIC , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_EMAGIC(2) { .out_cables =0x800f , .in_cables = 0x8003 }
@@ -2505,38 +1866,35 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* KORG devices */ {USB_DEVICE_VENDOR_SPEC (0x0944 ,0x0200 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="KORG, Inc." ,/* .product_name = "PANDORA PX5D", */ - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE , + QUIRK_DATA_STANDARD_MIDI(3) } }, {USB_DEVICE_VENDOR_SPEC (0x0944 ,0x0201 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="KORG, Inc." ,/* .product_name = "ToneLab ST", */ - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE , +QUIRK_DATA_STANDARD_MIDI (3 ) } }, {USB_DEVICE_VENDOR_SPEC (0x0944 ,0x0204 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="KORG, Inc." ,/* .product_name = "ToneLab EX", */ - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE , +QUIRK_DATA_STANDARD_MIDI (3 ) } },/* AKAI devices */ {USB_DEVICE (0x09e8 ,0x0062 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="AKAI" , .product_name = "MPD16", .ifnum = 0,
@@ -2547,21 +1905,11 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* Akai MPC Element */ USB_DEVICE (0x09e8 ,0x0021 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_MIDI_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_STANDARD_MIDI(1) }, + QUIRK_COMPOSITE_END } } },
@@ -2570,66 +1918,36 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* Steinberg MI2 */ USB_DEVICE_VENDOR_SPEC (0x0a4e ,0x2040 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, { - .ifnum =3 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = &(const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {/* Steinberg MI4 */ USB_DEVICE_VENDOR_SPEC (0x0a4e ,0x4040 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, { - .ifnum =3 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = &(const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -2637,34 +1955,31 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* TerraTec devices */ {USB_DEVICE_VENDOR_SPEC (0x0ccd ,0x0012 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="TerraTec" , .product_name = "PHASE 26", - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE + QUIRK_DATA_STANDARD_MIDI(3) } }, {USB_DEVICE_VENDOR_SPEC (0x0ccd ,0x0013 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="TerraTec" , .product_name = "PHASE 26", - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE +QUIRK_DATA_STANDARD_MIDI (3 ) } }, {USB_DEVICE_VENDOR_SPEC (0x0ccd ,0x0014 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="TerraTec" , .product_name = "PHASE 26", - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE +QUIRK_DATA_STANDARD_MIDI (3 ) } }, {USB_DEVICE (0x0ccd ,0x0035 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Miditech" , .product_name = "Play'n Roll", .ifnum = 0,
@@ -2679,7 +1994,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Novation EMS devices */ {USB_DEVICE_VENDOR_SPEC (0x1235 ,0x0001 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Novation" , .product_name = "ReMOTE Audio/XStation", .ifnum = 4,
@@ -2688,7 +2003,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x1235 ,0x0002 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Novation" , .product_name = "Speedio", .ifnum = 3,
@@ -2697,38 +2012,29 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE (0x1235 ,0x000a ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "Novation", */ /* .product_name = "Nocturn", */ - .ifnum =0 , - .type =QUIRK_MIDI_RAW_BYTES + QUIRK_DATA_RAW_BYTES(0) } }, {USB_DEVICE (0x1235 ,0x000e ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "Novation", */ /* .product_name = "Launchpad", */ - .ifnum =0 , - .type =QUIRK_MIDI_RAW_BYTES + QUIRK_DATA_RAW_BYTES(0) } }, {USB_DEVICE (0x1235 ,0x0010 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Focusrite" , .product_name = "Saffire 6 USB", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(0) }, { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, - { - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 4, .iface = 0,
@@ -2755,9 +2061,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 0, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 2, .iface = 0,
@@ -2779,28 +2083,19 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = 1, - .type = QUIRK_MIDI_RAW_BYTES - }, - { - .ifnum = -1 - } + { QUIRK_DATA_RAW_BYTES(1) }, + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x1235 ,0x0018 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Novation" , .product_name = "Twitch", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { { - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 4, .iface = 0,
@@ -2819,19 +2114,14 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = 1, - .type = QUIRK_MIDI_RAW_BYTES - }, - { - .ifnum = -1 - } + { QUIRK_DATA_RAW_BYTES(1) }, + QUIRK_COMPOSITE_END } } }, {USB_DEVICE_VENDOR_SPEC (0x1235 ,0x4661 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Novation" , .product_name = "ReMOTE25", .ifnum = 0,
@@ -2843,25 +2133,16 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* VirusTI Desktop */ USB_DEVICE_VENDOR_SPEC (0x133e ,0x0815 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { { - .ifnum =3 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = &(const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) { .out_cables = 0x0003, .in_cables = 0x0003 } }, - { - .ifnum =4 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =-1 - } + { QUIRK_DATA_IGNORE(4) }, + QUIRK_COMPOSITE_END } } },
@@ -2889,7 +2170,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* QinHeng devices */ {USB_DEVICE (0x1a86 ,0x752d ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="QinHeng" , .product_name = "CH345", .ifnum = 1,
@@ -2903,7 +2184,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Miditech devices */ {USB_DEVICE (0x4752 ,0x0011 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Miditech" , .product_name = "Midistart-2", .ifnum = 0,
@@ -2915,7 +2196,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* this ID used by both Miditech MidiStudio-2 and CME UF-x */ USB_DEVICE (0x7104 ,0x2202 ), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { .ifnum =0 , .type = QUIRK_MIDI_CME }
@@ -2925,20 +2206,13 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* Thanks to Clemens Ladisch <[email protected]> */ USB_DEVICE (0x0dba ,0x1000 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Digidesign" , .product_name = "MBox", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []){ - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DATA_COMPOSITE{ + { QUIRK_DATA_STANDARD_MIXER(0) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3BE, .channels = 2, .iface = 1,
@@ -2959,9 +2233,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 1, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3BE, .channels = 2, .iface = 1,
@@ -2982,9 +2254,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },
@@ -2992,24 +2262,14 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* DIGIDESIGN MBOX 2 */ {USB_DEVICE (0x0dba ,0x3000 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Digidesign" , .product_name = "Mbox 2", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =2 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats =SNDRV_PCM_FMTBIT_S24_3BE , .channels = 2, .iface = 2,
@@ -3027,15 +2287,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, + { QUIRK_DATA_IGNORE(3) }, { - .ifnum = 3, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = 4, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { - .formats =SNDRV_PCM_FMTBIT_S24_3BE , + QUIRK_DATA_AUDIOFORMAT(4) { + .formats = SNDRV_PCM_FMTBIT_S24_3BE, .channels = 2, .iface = 4, .altsetting = 2,
@@ -3052,14 +2307,9 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, + { QUIRK_DATA_IGNORE(5) }, { - .ifnum = 5, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = 6, - .type = QUIRK_MIDI_MIDIMAN, - .data = &(const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(6) { .out_ep = 0x02, .out_cables = 0x0001, .in_ep = 0x81,
@@ -3067,33 +2317,21 @@ YAMAHA_DEVICE(0x7010, "UB99"), .in_cables = 0x0001 } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },/* DIGIDESIGN MBOX 3 */ {USB_DEVICE (0x0dba ,0x5000 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Digidesign" , .product_name = "Mbox 3", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats =SNDRV_PCM_FMTBIT_S24_3LE , .channels = 4, .iface = 2,
@@ -3113,9 +2351,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 3, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(3) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 4, .iface = 3,
@@ -3136,36 +2372,25 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 4, - .type = QUIRK_MIDI_FIXED_ENDPOINT, - .data = &(const struct snd_usb_midi_endpoint_info) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(4) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } }, {/* Tascam US122 MKII - playback-only support */ USB_DEVICE_VENDOR_SPEC (0x0644 ,0x8021 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="TASCAM" , .product_name = "US122 MKII", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 2, .iface = 1,
@@ -3186,9 +2411,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },
@@ -3196,20 +2419,13 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Denon DN-X1600 */ {USB_AUDIO_DEVICE (0x154e ,0x500e ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Denon" , .product_name = "DN-X1600", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []){ + QUIRK_DATA_COMPOSITE{ + { QUIRK_DATA_IGNORE(0) }, { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE , - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 1,
@@ -3230,9 +2446,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 2,
@@ -3252,13 +2466,8 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = 4, - .type = QUIRK_MIDI_STANDARD_INTERFACE, - }, - { - .ifnum = -1 - } + { QUIRK_DATA_STANDARD_MIDI(4) }, + QUIRK_COMPOSITE_END } } },
@@ -3267,17 +2476,13 @@ YAMAHA_DEVICE(0x7010, "UB99"), { USB_DEVICE(0x045e, 0x0283), .bInterfaceClass =USB_CLASS_PER_INTERFACE , - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Microsoft" , .product_name = "XboxLive Headset/Xbox Communicator", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { {/* playback */ - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 1, .iface = 0,
@@ -3293,9 +2498,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {/* capture */ - .ifnum = 1, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 1, .iface = 1,
@@ -3309,9 +2512,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), .rate_max = 16000 } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },
@@ -3320,18 +2521,11 @@ YAMAHA_DEVICE(0x7010, "UB99"), {USB_DEVICE (0x200c ,0x100b ), .bInterfaceClass = USB_CLASS_PER_INTERFACE, - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(0) }, { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 4, .iface = 1,
@@ -3350,9 +2544,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },
@@ -3365,28 +2557,12 @@ YAMAHA_DEVICE(0x7010, "UB99"),* enabled in create_standard_audio_quirk(). */ USB_DEVICE (0x1686 ,0x00dd ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { -/* Playback */ - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE , - }, - { -/* Capture */ - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE , - }, - { -/* Midi */ - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE - }, - { - .ifnum =-1 - }, + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, /* Playback */ + { QUIRK_DATA_STANDARD_AUDIO(2) }, /* Capture */ + { QUIRK_DATA_STANDARD_MIDI(3) }, /* Midi */ + QUIRK_COMPOSITE_END } } },
@@ -3400,18 +2576,16 @@ YAMAHA_DEVICE(0x7010, "UB99"), USB_DEVICE_ID_MATCH_INT_SUBCLASS,
Lines of this file are not shown. View the raw message.
The rest of this diff is not shown. View the raw message.
Signature · 1 line
2.43.0
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 458/798 ALSA: usb-audio: Add logitech Audio profile quirk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Pius <[email protected]>
[ Upstream commit a51c925c11d7b855167e64b63eb4378e5adfc11d ]
Specify shortnames for the following Logitech Devices: Rally bar, Rally bar mini, Tap, MeetUp and Huddle.
--- sound/usb/card.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/usb/card.c +6 -0
@@ -382,6 +382,12 @@ static const struct usb_audio_device_nam/* Creative/Toshiba Multimedia Center SB-0500 */ DEVICE_NAME (0x041e ,0x3048 ,"Toshiba" ,"SB-0500" ), +/* Logitech Audio Devices */ +DEVICE_NAME (0x046d ,0x0867 ,"Logitech, Inc." ,"Logi-MeetUp" ), +DEVICE_NAME (0x046d ,0x0874 ,"Logitech, Inc." ,"Logi-Tap-Audio" ), +DEVICE_NAME (0x046d ,0x087c ,"Logitech, Inc." ,"Logi-Huddle" ), +DEVICE_NAME (0x046d ,0x0898 ,"Logitech, Inc." ,"Logi-RB-Audio" ), +DEVICE_NAME (0x046d ,0x08d2 ,"Logitech, Inc." ,"Logi-RBM-Audio" ),DEVICE_NAME (0x046d ,0x0990 ,"Logitech, Inc." ,"QuickCam Pro 9000" ), DEVICE_NAME(0x05e1, 0x0408, "Syntek", "STK1160"),
Greg Kroah-Hartman
maintainerPATCH 459/798 ASoC: codecs: wsa883x: Handle reading version failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 2fbf16992e5aa14acf0441320033a01a32309ded ]
If reading version and variant from registers fails (which is unlikely but possible, because it is a read over bus), the driver will proceed and perform device configuration based on uninitialized stack variables. Handle it a bit better - bail out without doing any init and failing the update status Soundwire callback.
--- sound/soc/codecs/wsa883x.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
sound/soc/codecs/wsa883x.c +11 -5
@@ -1002,15 +1002,19 @@ static const struct reg_sequence reg_init[] = { {WSA883X_GMAMP_SUP1, 0xE2}, }; -static void wsa883x_init (struct wsa883x_priv *wsa883x) +static int wsa883x_init (struct wsa883x_priv *wsa883x) {struct regmap *regmap = wsa883x->regmap; -int variant, version; +int variant, version, ret; -regmap_read (regmap,WSA883X_OTP_REG_0 , &variant); + ret =regmap_read (regmap,WSA883X_OTP_REG_0 , &variant); +if (ret) +return ret; wsa883x->variant = variant &WSA883X_ID_MASK ; -regmap_read (regmap,WSA883X_CHIP_ID0 , &version); + ret =regmap_read (regmap,WSA883X_CHIP_ID0 , &version); +if (ret) +return ret; wsa883x->version = version;switch (wsa883x->variant) {
@@ -1045,6 +1049,8 @@ static void wsa883x_init(struct wsa883x_priv *wsa883x)WSA883X_DRE_OFFSET_MASK , wsa883x->comp_offset); } + +return 0 ; } static int wsa883x_update_status(struct sdw_slave *slave,
@@ -1053,7 +1059,7 @@ static int wsa883x_update_status(struct sdw_slave *slave,struct wsa883x_priv *wsa883x =dev_get_drvdata (&slave->dev);if (status ==SDW_SLAVE_ATTACHED && slave->dev_num >0 ) -wsa883x_init (wsa883x); +return wsa883x_init (wsa883x);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 460/798 tools/x86/kcpuid: Protect against faulty "max subleaf" values
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed S. Darwish <[email protected]>
[ Upstream commit cf96ab1a966b87b09fdd9e8cc8357d2d00776a3a ]
Protect against the kcpuid code parsing faulty max subleaf numbers through a min() expression. Thus, ensuring that max_subleaf will always be ≤ MAX_SUBLEAF_NUM.
Use "u32" for the subleaf numbers since kcpuid is compiled with -Wextra, which includes signed/unsigned comparisons warnings.
--- tools/arch/x86/kcpuid/kcpuid.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
tools/arch/x86/kcpuid/kcpuid.c +5 -7
@@ -7,7 +7,8 @@#include <string.h> #include <getopt.h> -#define ARRAY_SIZE (x) (sizeof(x) / sizeof((x)[0])) +#define ARRAY_SIZE (x) (sizeof(x) / sizeof((x)[0])) +#define min (a, b) (((a) < (b)) ? (a) : (b))typedef unsigned int u32 ;typedef unsigned long long u64 ;
@@ -203,12 +204,9 @@ static void raw_dump_range(struct cpuid_range *range)#define MAX_SUBLEAF_NUM 32struct cpuid_range *setup_cpuid_range (u32 input_eax) { -u32 max_func, idx_func; -int subleaf; +u32 max_func, idx_func, subleaf, max_subleaf; +u32 eax, ebx, ecx, edx, f = input_eax;struct cpuid_range *range; -u32 eax, ebx, ecx, edx; -u32 f = input_eax; -int max_subleaf;bool allzero; eax = input_eax;
@@ -254,7 +252,7 @@ struct cpuid_range *setup_cpuid_range(u32 input_eax)* others have to be tried (0xf) */ if (f ==0x7 || f ==0x14 || f ==0x17 || f ==0x18 ) - max_subleaf = (eax &0xff ) +1 ; + max_subleaf =min ((eax &0xff ) +1 , max_subleaf);if (f ==0xb ) max_subleaf =2 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 461/798 x86/kexec: Add EFI config table identity mapping for kexec kernel
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Liu <[email protected]>
[ Upstream commit 5760929f6545c651682de3c2c6c6786816b17bb1 ]
A kexec kernel boot failure is sometimes observed on AMD CPUs due to an unmapped EFI config table array. This can be seen when "nogbpages" is on the kernel command line, and has been observed as a full BIOS reboot rather than a successful kexec.
This was also the cause of reported regressions attributed to Commit 7143c5f4cf20 ("x86/mm/ident_map: Use gbpages only where full GB page should be mapped.") which was subsequently reverted.
To avoid this page fault, explicitly include the EFI config table array in the kexec identity map.
Further explanation:
The following 2 commits caused the EFI config table array to be accessed when enabling sev at kernel startup.
commit ec1c66af3a30 ("x86/compressed/64: Detect/setup SEV/SME features
earlier during boot")
commit c01fce9cef84 ("x86/compressed: Add SEV-SNP feature
detection/setup")
This is in the code that examines whether SEV should be enabled or not, so it can even affect systems that are not SEV capable.
This may result in a page fault if the EFI config table array's address is unmapped. Since the page fault occurs before the new kernel establishes its own identity map and page fault routines, it is unrecoverable and kexec fails.
Most often, this problem is not seen because the EFI config table array gets included in the map by the luck of being placed at a memory address close enough to other memory areas that *are* included in the map created by kexec.
Both the "nogbpages" command line option and the "use gpbages only where full GB page should be mapped" change greatly reduce the chance of being included in the map by luck, which is why the problem appears.
--- arch/x86/kernel/machine_kexec_64.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
arch/x86/kernel/machine_kexec_64.c +27 -0
@@ -28,6 +28,7 @@#include <asm/setup.h> #include <asm/set_memory.h> #include <asm/cpu.h> +#include <asm/efi.h> #ifdef CONFIG_ACPI /*
@@ -90,6 +91,8 @@ map_efi_systab(struct x86_mapping_info *info, pgd_t *level4p) {#ifdef CONFIG_EFI unsigned long mstart, mend; +void *kaddr; +int ret;if (!efi_enabled (EFI_BOOT ))return 0 ;
@@ -105,6 +108,30 @@ map_efi_systab(struct x86_mapping_info *info, pgd_t *level4p)if (!mstart)return 0 ; + ret =kernel_ident_mapping_init (info, level4p, mstart, mend); +if (ret) +return ret; + + kaddr =memremap (mstart, mend - mstart,MEMREMAP_WB ); +if (!kaddr) { +pr_err ("Could not map UEFI system table\n" ); +return -ENOMEM ; + } + + mstart = efi_config_table; + +if (efi_enabled (EFI_64BIT )) { +efi_system_table_64_t *stbl = (efi_system_table_64_t *)kaddr; + + mend = mstart +sizeof (efi_config_table_64_t) * stbl->nr_tables; + }else { +efi_system_table_32_t *stbl = (efi_system_table_32_t *)kaddr; + + mend = mstart +sizeof (efi_config_table_32_t) * stbl->nr_tables; + } + +memunmap (kaddr); +return kernel_ident_mapping_init (info, level4p, mstart, mend);#endif return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 462/798 ALSA: asihpi: Fix potential OOB array access
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7b986c7430a6bb68d523dac7bfc74cbd5b44ef96 ]
ASIHPI driver stores some values in the static array upon a response from the driver, and its index depends on the firmware. We shouldn't trust it blindly.
This patch adds a sanity check of the array index to fit in the array size.
--- sound/pci/asihpi/hpimsgx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/asihpi/hpimsgx.c +1 -1
@@ -708,7 +708,7 @@ static u16 HPIMSGX__init(struct hpi_message *phm, phr->error =HPI_ERROR_PROCESSING_MESSAGE ;return phr->error; } -if (hr.error ==0 ) { +if (hr.error ==0 && hr.u.s.adapter_index <HPI_MAX_ADAPTERS ) {/* the adapter was created successfully save the mapping for future use */ hpi_entry_points[hr.u.s.adapter_index] = entry_point_func;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 463/798 ALSA: hdsp: Break infinite MIDI input flush loop
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit c01f3815453e2d5f699ccd8c8c1f93a5b8669e59 ]
The current MIDI input flush on HDSP and HDSPM drivers relies on the hardware reporting the right value. If the hardware doesn't give the proper value but returns -1, it may be stuck at an infinite loop.
Add a counter and break if the loop is unexpectedly too long.
--- sound/pci/rme9652/hdsp.c | 6 ++++-- sound/pci/rme9652/hdspm.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-)
sound/pci/rme9652/hdsp.c +4 -2
@@ -1298,8 +1298,10 @@ static int snd_hdsp_midi_output_possible (struct hdsp *hdsp, int id)static void snd_hdsp_flush_midi_input (struct hdsp *hdsp,int id) { -while (snd_hdsp_midi_input_available (hdsp, id)) -snd_hdsp_midi_read_byte (hdsp, id); +int count =256 ; + +while (snd_hdsp_midi_input_available (hdsp, id) && --count) +snd_hdsp_midi_read_byte (hdsp, id); }static int snd_hdsp_midi_output_write (struct hdsp_midi *hmidi)
sound/pci/rme9652/hdspm.c +4 -2
@@ -1838,8 +1838,10 @@ static inline int snd_hdspm_midi_output_possible (struct hdspm *hdspm, int id)static void snd_hdspm_flush_midi_input (struct hdspm *hdspm,int id) { -while (snd_hdspm_midi_input_available (hdspm, id)) -snd_hdspm_midi_read_byte (hdspm, id); +int count =256 ; + +while (snd_hdspm_midi_input_available (hdspm, id) && --count) +snd_hdspm_midi_read_byte (hdspm, id); }static int snd_hdspm_midi_output_write (struct hdspm_midi *hmidi)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 464/798 selftests/nolibc: avoid passing NULL to printf("%s")
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit f1a58f61d88642ae1e6e97e9d72d73bc70a93cb8 ]
Clang on higher optimization levels detects that NULL is passed to printf("%s") and warns about it.
While printf() from nolibc gracefully handles that NULL, it is undefined behavior as per POSIX, so the warning is reasonable. Avoid the warning by transforming NULL into a non-NULL placeholder.
--- tools/testing/selftests/nolibc/nolibc-test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/nolibc/nolibc-test.c +2 -2
@@ -353,7 +353,7 @@ static int expect_strzr(const char *expr, int llen) {int ret =0 ; - llen +=printf (" = <%s> " , expr); + llen +=printf (" = <%s> " , expr ? expr :"(null)" );if (expr) { ret =1 ; llen +=pad_spc (llen,40 ,"[FAIL]\n" );
@@ -371,7 +371,7 @@ static int expect_strnz(const char *expr, int llen) {int ret =0 ; - llen +=printf (" = <%s> " , expr); + llen +=printf (" = <%s> " , expr ? expr :"(null)" );if (!expr) { ret =1 ; llen +=pad_spc (llen,40 ,"[FAIL]\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 465/798 x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit d19d638b1e6cf746263ef60b7d0dee0204d8216a ]
Modern (fortified) memcpy() prefers to avoid writing (or reading) beyond the end of the addressed destination (or source) struct member:
In function ‘fortify_memcpy_chk’,
inlined from ‘syscall_get_arguments’ at ./arch/x86/include/asm/syscall.h:85:2,
inlined from ‘populate_seccomp_data’ at kernel/seccomp.c:258:2,
inlined from ‘__seccomp_filter’ at kernel/seccomp.c:1231:3:./include/linux/fortify-string.h:580:25: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
580 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~As already done for x86_64 and compat mode, do not use memcpy() to extract syscall arguments from struct pt_regs but rather just perform direct assignments. Binary output differences are negligible, and actually ends up using less stack space:
- sub $0x84,%esp + sub $0x6c,%esp
and less text size:
text data bss dec hex filename
10794 252 0 11046 2b26 gcc-32b/kernel/seccomp.o.stock 10714 252 0 10966 2ad6 gcc-32b/kernel/seccomp.o.after
--- arch/x86/include/asm/syscall.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/include/asm/syscall.h +6 -1
@@ -82,7 +82,12 @@ static inline void syscall_get_arguments(struct task_struct *task,struct pt_regs *regs, unsigned long *args) { - memcpy(args, ®s->bx, 6 * sizeof(args[0])); + args[0 ] = regs->bx; + args[1 ] = regs->cx; + args[2 ] = regs->dx; + args[3 ] = regs->si; + args[4 ] = regs->di; + args[5 ] = regs->bp; }static inline int syscall_get_arch (struct task_struct *task)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 466/798 fbdev: pxafb: Fix possible use after free in pxafb_task()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixin Wang <[email protected]>
[ Upstream commit 4a6921095eb04a900e0000da83d9475eb958e61e ]
In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work.
If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| pxafb_task
pxafb_remove |
unregister_framebuffer(info) |
do_unregister_framebuffer(fb_info) |
put_fb_info(fb_info) |
// free fbi->fb | set_ctrlr_state(fbi, state)
| __pxafb_lcd_power(fbi, 0)
| fbi->lcd_power(on, &fbi->fb.var)
| //use fbi->fbFix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove.
Note that only root user can remove the driver at runtime.
--- drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/fbdev/pxafb.c +1 -0
@@ -2408,6 +2408,7 @@ static int pxafb_remove(struct platform_device *dev) info = &fbi->fb;pxafb_overlay_exit (fbi); +cancel_work_sync (&fbi->task);unregister_framebuffer (info);pxafb_disable_controller (fbi);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 467/798 rcuscale: Provide clear error when async specified without primitives
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit 11377947b5861fa59bf77c827e1dd7c081842cc9 ]
Currently, if the rcuscale module's async module parameter is specified for RCU implementations that do not have async primitives such as RCU Tasks Rude (which now lacks a call_rcu_tasks_rude() function), there will be a series of splats due to calls to a NULL pointer. This commit therefore warns of this situation, but switches to non-async testing.
--- kernel/rcu/rcuscale.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/rcu/rcuscale.c +2 -2
@@ -449,7 +449,7 @@ rcu_scale_writer(void *arg)udelay (writer_holdoff); wdp = &wdpp[i]; *wdp =ktime_get_mono_fast_ns (); -if (gp_async) { +if (gp_async && !WARN_ON_ONCE (!cur_ops->async)) { retry:if (!rhp) rhp =kmalloc (sizeof (*rhp),GFP_KERNEL );
@@ -505,7 +505,7 @@ rcu_scale_writer(void *arg) i++;rcu_scale_wait_shutdown (); }while (!torture_must_stop ()); -if (gp_async) { +if (gp_async && cur_ops->async) { cur_ops->gp_barrier (); } writer_n_durations[me] = i_max +1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 468/798 iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Gonzalez <[email protected]>
[ Upstream commit 3a8990b8a778219327c5f8ecf10b5d81377b925a ]
On qcom msm8998, writing to the last context bank of lpass_q6_smmu (base address 0x05100000) produces a system freeze & reboot.
The hardware/hypervisor reports 13 context banks for the LPASS SMMU on msm8998, but only the first 12 are accessible... Override the number of context banks
[ 2.546101] arm-smmu 5100000.iommu: probing hardware configuration... [ 2.552439] arm-smmu 5100000.iommu: SMMUv2 with: [ 2.558945] arm-smmu 5100000.iommu: stage 1 translation [ 2.563627] arm-smmu 5100000.iommu: address translation ops [ 2.568923] arm-smmu 5100000.iommu: non-coherent table walk [ 2.574566] arm-smmu 5100000.iommu: (IDR0.CTTW overridden by FW configuration) [ 2.580220] arm-smmu 5100000.iommu: stream matching with 12 register groups [ 2.587263] arm-smmu 5100000.iommu: 13 context banks (0 stage-2 only) [ 2.614447] arm-smmu 5100000.iommu: Supported page sizes: 0x63315000 [ 2.621358] arm-smmu 5100000.iommu: Stage-1: 36-bit VA -> 36-bit IPA [ 2.627772] arm-smmu 5100000.iommu: preserved 0 boot mappings
Specifically, the crashes occur here:
qsmmu->bypass_cbndx = smmu->num_context_banks - 1; arm_smmu_cb_write(smmu, qsmmu->bypass_cbndx, ARM_SMMU_CB_SCTLR, 0);
and here:
arm_smmu_write_context_bank(smmu, i); arm_smmu_cb_write(smmu, i, ARM_SMMU_CB_FSR, ARM_SMMU_CB_FSR_FAULT);
It is likely that FW reserves the last context bank for its own use, thus a simple work-around is: DON'T USE IT in Linux.
If we decrease the number of context banks, last one will be "hidden".
--- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +7 -0
@@ -273,6 +273,13 @@ static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu)u32 smr;int i; +/* +* MSM8998 LPASS SMMU reports 13 context banks, but accessing +* the last context bank crashes the system. +*/ +if (of_device_is_compatible (smmu->dev->of_node,"qcom,msm8998-smmu-v2" ) && smmu->num_context_banks ==13 ) + smmu->num_context_banks =12 ; +/* * Some platforms support more than the Arm SMMU architected maximum of * 128 stream matching groups. For unknown reasons, the additional
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 469/798 power: reset: brcmstb: Do not go into infinite loop if reset fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit cf8c39b00e982fa506b16f9d76657838c09150cb ]
There may be other backup reset methods available, do not halt here so that other reset methods can be tried.
--- drivers/power/reset/brcmstb-reboot.c | 3 --- 1 file changed, 3 deletions(-)
drivers/power/reset/brcmstb-reboot.c +0 -3
@@ -62,9 +62,6 @@ static int brcmstb_restart_handler(struct notifier_block *this,return NOTIFY_DONE ; } -while (1 ) - ; -return NOTIFY_DONE ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 470/798 iommu/vt-d: Always reserve a domain ID for identity setup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
[ Upstream commit 2c13012e09190174614fd6901857a1b8c199e17d ]
We will use a global static identity domain. Reserve a static domain ID for it.
--- drivers/iommu/intel/iommu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iommu/intel/iommu.c +3 -3
@@ -1697,10 +1697,10 @@ static int iommu_init_domains(struct intel_iommu *iommu)* entry for first-level or pass-through translation modes should * be programmed with a domain id different from those used for * second-level or nested translation. We reserve a domain id for -* this purpose. +* this purpose. This domain id is also used for identity domain +* in legacy mode. */ -if (sm_supported (iommu)) -set_bit (FLPT_DEFAULT_DID , iommu->domain_ids); +set_bit (FLPT_DEFAULT_DID , iommu->domain_ids);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 471/798 iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjay K Kumar <[email protected]>
[ Upstream commit 3cf74230c139f208b7fb313ae0054386eee31a81 ]
If qi_submit_sync() is invoked with 0 invalidation descriptors (for instance, for DMA draining purposes), we can run into a bug where a submitting thread fails to detect the completion of invalidation_wait. Subsequently, this led to a soft lockup. Currently, there is no impact by this bug on the existing users because no callers are submitting invalidations with 0 descriptors. This fix will enable future users (such as DMA drain) calling qi_submit_sync() with 0 count.
Suppose thread T1 invokes qi_submit_sync() with non-zero descriptors, while concurrently, thread T2 calls qi_submit_sync() with zero descriptors. Both threads then enter a while loop, waiting for their respective descriptors to complete. T1 detects its completion (i.e., T1's invalidation_wait status changes to QI_DONE by HW) and proceeds to call reclaim_free_desc() to reclaim all descriptors, potentially including adjacent ones of other threads that are also marked as QI_DONE.
During this time, while T2 is waiting to acquire the qi->q_lock, the IOMMU hardware may complete the invalidation for T2, setting its status to QI_DONE. However, if T1's execution of reclaim_free_desc() frees T2's invalidation_wait descriptor and changes its status to QI_FREE, T2 will not observe the QI_DONE status for its invalidation_wait and will indefinitely remain stuck.
This soft lockup does not occur when only non-zero descriptors are submitted.In such cases, invalidation descriptors are interspersed among wait descriptors with the status QI_IN_USE, acting as barriers. These barriers prevent the reclaim code from mistakenly freeing descriptors belonging to other submitters.
Considered the following example timeline:
T1 T2 ======================================== ID1 WD1 while(WD1!=QI_DONE) unlock lock WD1=QI_DONE* WD2 while(WD2!=QI_DONE) unlock lock WD1==QI_DONE? ID1=QI_DONE WD2=DONE* reclaim() ID1=FREE WD1=FREE WD2=FREE unlock soft lockup! T2 never sees QI_DONE in WD2
Where:
ID = invalidation descriptor
WD = wait descriptor
* Written by hardware
The root of the problem is that the descriptor status QI_DONE flag is used for two conflicting purposes:
1. signal a descriptor is ready for reclaim (to be freed)
2. signal by the hardware that a wait descriptor is complete
The solution (in this patch) is state separation by using QI_FREE flag for #1.
Once a thread's invalidation descriptors are complete, their status would be set to QI_FREE. The reclaim_free_desc() function would then only free descriptors marked as QI_FREE instead of those marked as QI_DONE. This change ensures that T2 (from the previous example) will correctly observe the completion of its invalidation_wait (marked as QI_DONE).
--- drivers/iommu/intel/dmar.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/iommu/intel/dmar.c +11 -5
@@ -1182,9 +1182,7 @@ static void free_iommu(struct intel_iommu *iommu)*/ static inline void reclaim_free_desc (struct q_inval *qi) { -while (qi->desc_status[qi->free_tail] ==QI_DONE || - qi->desc_status[qi->free_tail] ==QI_ABORT ) { - qi->desc_status[qi->free_tail] =QI_FREE ; +while (qi->desc_status[qi->free_tail] ==QI_FREE && qi->free_tail != qi->free_head) { qi->free_tail = (qi->free_tail +1 ) %QI_LENGTH ; qi->free_cnt++; }
@@ -1419,8 +1417,16 @@ int qi_submit_sync(struct intel_iommu *iommu, struct qi_desc *desc,raw_spin_lock (&qi->q_lock); } -for (i =0 ; i < count; i++) - qi->desc_status[(index + i) %QI_LENGTH ] =QI_DONE ; +/* +* The reclaim code can free descriptors from multiple submissions +* starting from the tail of the queue. When count == 0, the +* status of the standalone wait descriptor at the tail of the queue +* must be set to QI_FREE to allow the reclaim code to proceed. +* It is also possible that descriptors from one of the previous +* submissions has to be reclaimed by a subsequent submission. +*/ +for (i =0 ; i <= count; i++) + qi->desc_status[(index + i) %QI_LENGTH ] =QI_FREE ;reclaim_free_desc (qi);raw_spin_unlock_irqrestore (&qi->q_lock, flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 472/798 drm/stm: Avoid use-after-free issues with crtc and plane
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Katya Orlova <[email protected]>
[ Upstream commit 19dd9780b7ac673be95bf6fd6892a184c9db611f ]
ltdc_load() calls functions drm_crtc_init_with_planes(), drm_universal_plane_init() and drm_encoder_init(). These functions should not be called with parameters allocated with devm_kzalloc() to avoid use-after-free issues [1].
Use allocations managed by the DRM framework.
Found by Linux Verification Center (linuxtesting.org).
[1]
https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/
--- drivers/gpu/drm/stm/drv.c | 3 +- drivers/gpu/drm/stm/ltdc.c | 73 ++++++++++---------------------------- 2 files changed, 20 insertions(+), 56 deletions(-)
drivers/gpu/drm/stm/drv.c +2 -1
@@ -24,6 +24,7 @@#include <drm/drm_module.h> #include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> +#include <drm/drm_managed.h> #include "ltdc.h"
@@ -74,7 +75,7 @@ static int drv_load(struct drm_device *ddev)DRM_DEBUG ("%s\n" , __func__); - ldev =devm_kzalloc (ddev->dev,sizeof (*ldev),GFP_KERNEL ); + ldev =drmm_kzalloc (ddev,sizeof (*ldev),GFP_KERNEL );if (!ldev)return -ENOMEM ;
drivers/gpu/drm/stm/ltdc.c +18 -55
177 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 473/798 drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Eric Pelloux-Prayer <[email protected]>
[ Upstream commit fec5f8e8c6bcf83ed7a392801d7b44c5ecfc1e82 ]
Before this commit, only submits with both a BO_HANDLES chunk and a 'bo_list_handle' would be rejected (by amdgpu_cs_parser_bos).
But if UMD sent multiple BO_HANDLES, what would happen is:
* only the last one would be really used
* all the others would leak memory as amdgpu_cs_p1_bo_handles would overwrite the previous p->bo_list value
This commit rejects submissions with multiple BO_HANDLES chunks to match the implementation of the parser.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +4 -0
@@ -257,6 +257,10 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,if (size <sizeof (struct drm_amdgpu_bo_list_in )) goto free_partial_kdata; +/* Only a single BO list is allowed to simplify handling. */ +if (p->bo_list) + ret = -EINVAL ; + ret =amdgpu_cs_p1_bo_handles (p, p->chunks[i].kdata);if (ret) goto free_partial_kdata;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 474/798 drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 66d71a72539e173a9b00ca0b1852cbaa5f5bf1ad ]
This commit addresses a null pointer dereference issue in the commit_planes_for_stream function at line 4140. The issue could occur when top_pipe_to_program is null.
The fix adds a check to ensure top_pipe_to_program is not null before accessing its stream_res. This prevents a null pointer dereference.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program' could be null (see line 3906)
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +2 -1
@@ -3727,7 +3727,8 @@ static void commit_planes_for_stream(struct dc *dc, }if ((update_type !=UPDATE_TYPE_FAST ) && stream->update_flags.bits.dsc_changed) -if (top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) { +if (top_pipe_to_program && + top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) { top_pipe_to_program->stream_res.tg->funcs->wait_for_state ( top_pipe_to_program->stream_res.tg,CRTC_STATE_VACTIVE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 475/798 ata: pata_serverworks: Do not use the term blacklist
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 858048568c9e3887d8b19e101ee72f129d65cb15 ]
Let's not use the term blacklist in the function serverworks_osb4_filter() documentation comment and rather simply refer to what that function looks at: the list of devices with groken UDMA5.
While at it, also constify the values of the csb_bad_ata100 array.
Of note is that all of this should probably be handled using libata quirk mechanism but it is unclear if these UDMA5 quirks are specific to this controller only.
--- drivers/ata/pata_serverworks.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/ata/pata_serverworks.c +9 -7
@@ -46,10 +46,11 @@#define SVWKS_CSB5_REVISION_NEW 0x92/* min PCI_REVISION_ID for UDMA5 (A2.0) */ #define SVWKS_CSB6_REVISION 0xa0/* min PCI_REVISION_ID for UDMA4 (A1.0) */ -/* Seagate Barracuda ATA IV Family drives in UDMA mode 5 -* can overrun their FIFOs when used with the CSB5 */ - -static const char *csb_bad_ata100[] = { +/* +* Seagate Barracuda ATA IV Family drives in UDMA mode 5 +* can overrun their FIFOs when used with the CSB5. +*/ +static const char *const csb_bad_ata100[] = {"ST320011A" ,"ST340016A" ,"ST360021A" ,
@@ -163,10 +164,11 @@ static unsigned int serverworks_osb4_filter(struct ata_device *adev, unsigned in* @adev: ATA device * @mask: Mask of proposed modes * -* Check the blacklist and disable UDMA5 if matched +* Check the list of devices with broken UDMA5 and +* disable UDMA5 if matched. */ - -static unsigned int serverworks_csb_filter (struct ata_device *adev,unsigned int mask) +static unsigned int serverworks_csb_filter (struct ata_device *adev, +unsigned int mask) {const char *p;char model_num[ATA_ID_PROD_LEN +1 ];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 476/798 ata: sata_sil: Rename sil_blacklist to sil_quirks
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 93b0f9e11ce511353c65b7f924cf5f95bd9c3aba ]
Rename the array sil_blacklist to sil_quirks as this name is more neutral and is also consistent with how this driver define quirks with the SIL_QUIRK_XXX flags.
--- drivers/ata/sata_sil.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/ata/sata_sil.c +6 -6
@@ -128,7 +128,7 @@ static const struct pci_device_id sil_pci_tbl[] = {static const struct sil_drivelist {const char *product;unsigned int quirk; -} sil_blacklist [] = { +} sil_quirks[] = { {"ST320012AS" ,SIL_QUIRK_MOD15WRITE }, {"ST330013AS" ,SIL_QUIRK_MOD15WRITE }, {"ST340017AS" ,SIL_QUIRK_MOD15WRITE },
@@ -600,8 +600,8 @@ static void sil_thaw(struct ata_port *ap)* list, and apply the fixups to only the specific * devices/hosts/firmwares that need it. * -* 20040111 - Seagate drives affected by the Mod15Write bug are blacklisted -* The Maxtor quirk is in the blacklist, but I'm keeping the original +* 20040111 - Seagate drives affected by the Mod15Write bug are quirked +* The Maxtor quirk is in sil_quirks, but I'm keeping the original * pessimistic fix for the following reasons... * - There seems to be less info on it, only one device gleaned off the * Windows driver, maybe only one is affected. More info would be greatly
@@ -620,9 +620,9 @@ static void sil_dev_config(struct ata_device *dev)ata_id_c_string (dev->id, model_num,ATA_ID_PROD ,sizeof (model_num)); -for (n =0 ; sil_blacklist[n].product; n++) -if (!strcmp (sil_blacklist[n].product, model_num)) { - quirks = sil_blacklist[n].quirk; +for (n =0 ; sil_quirks[n].product; n++) +if (!strcmp (sil_quirks[n].product, model_num)) { + quirks = sil_quirks[n].quirk;break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 477/798 drm/amd/display: Handle null stream_status in planes_changed_for_existing_stream
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 8141f21b941710ecebe49220b69822cab3abd23d ]
This commit adds a null check for 'stream_status' in the function 'planes_changed_for_existing_stream'. Previously, the code assumed 'stream_status' could be null, but did not handle the case where it was actually null. This could lead to a null pointer dereference.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream() error: we previously assumed 'stream_status' could be null (see line 3774)
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +3 -1
@@ -2634,8 +2634,10 @@ static bool planes_changed_for_existing_stream(struct dc_state *context, } } -if (!stream_status) +if (!stream_status) {ASSERT (0 ); +return false; + }for (i =0 ; i < set_count; i++)if (set[i].stream == stream)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 478/798 drm/amd/display: Check null pointers before using dc->clk_mgr
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 95d9e0803e51d5a24276b7643b244c7477daf463 ]
[WHY & HOW]dc->clk_mgr is null checked previously in the same function, indicating it might be null.
Passing "dc" to "dc->hwss.apply_idle_power_optimizations", which dereferences null "dc->clk_mgr". (The function pointer resolves to "dcn35_apply_idle_power_optimizations".)
This fixes 1 FORWARD_NULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +2 -1
@@ -4516,7 +4516,8 @@ void dc_allow_idle_optimizations(struct dc *dc, bool allow)if (allow == dc->idle_optimizations_allowed)return ; -if (dc->hwss.apply_idle_power_optimizations && dc->hwss.apply_idle_power_optimizations (dc, allow)) +if (dc->hwss.apply_idle_power_optimizations && dc->clk_mgr !=NULL && + dc->hwss.apply_idle_power_optimizations (dc, allow)) dc->idle_optimizations_allowed = allow; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 479/798 drm/amd/display: Add null check for afb in amdgpu_dm_plane_handle_cursor_update (v2)
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit cd9e9e0852d501f169aa3bb34e4b413d2eb48c37 ]
This commit adds a null check for the 'afb' variable in the amdgpu_dm_plane_handle_cursor_update function. Previously, 'afb' was assumed to be null, but was used later in the code without a null check. This could potentially lead to a null pointer dereference.
Changes since v1:
- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)
Fixes the below:drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1298 amdgpu_dm_plane_handle_cursor_update() error: we previously assumed 'afb' could be null (see line 1252)
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +2 -1
@@ -1281,7 +1281,8 @@ void handle_cursor_update(struct drm_plane *plane, adev->dm.dc->caps.color.dpp.gamma_corr) attributes.attribute_flags.bits.ENABLE_CURSOR_DEGAMMA =1 ; - attributes.pitch = afb->base.pitches[0 ] / afb->base.format->cpp[0 ]; +if (afb) + attributes.pitch = afb->base.pitches[0 ] / afb->base.format->cpp[0 ];if (crtc_state->stream) {mutex_lock (&adev->dm.dc_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 480/798 jfs: UBSAN: shift-out-of-bounds in dbFindBits
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remington Brasga <[email protected]>
[ Upstream commit b0b2fc815e514221f01384f39fbfbff65d897e1c ]
Fix issue with UBSAN throwing shift-out-of-bounds warning.
--- fs/jfs/jfs_dmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jfs/jfs_dmap.c +1 -1
@@ -3022,7 +3022,7 @@ static int dbFindBits(u32 word, int l2nb)/* scan the word for nb free bits at nb alignments. */ -for (bitno =0 ; mask !=0 ; bitno += nb, mask >>= nb) { +for (bitno =0 ; mask !=0 ; bitno += nb, mask = (mask >> nb)) {if ((mask & word) == mask)break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 481/798 jfs: Fix uaf in dbFreeBits
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234 ]
[syzbot reported]
==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752 Read of size 8 at addr ffff8880229254b0 by task syz-executor357/5216 CPU: 0 UID: 0 PID: 5216 Comm: syz-executor357 Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 __mutex_lock_common kernel/locking/mutex.c:587 [inline] __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752 dbFreeBits+0x7ea/0xd90 fs/jfs/jfs_dmap.c:2390 dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline] dbFree+0x35b/0x680 fs/jfs/jfs_dmap.c:409 dbDiscardAG+0x8a9/0xa20 fs/jfs/jfs_dmap.c:1650 jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100 jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 Freed by task 5218: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kfree+0x149/0x360 mm/slub.c:4594 dbUnmount+0x11d/0x190 fs/jfs/jfs_dmap.c:278 jfs_mount_rw+0x4ac/0x6a0 fs/jfs/jfs_mount.c:247 jfs_remount+0x3d1/0x6b0 fs/jfs/super.c:454 reconfigure_super+0x445/0x880 fs/super.c:1083 vfs_cmd_reconfigure fs/fsopen.c:263 [inline] vfs_fsconfig_locked fs/fsopen.c:292 [inline] __do_sys_fsconfig fs/fsopen.c:473 [inline] __se_sys_fsconfig+0xb6e/0xf80 fs/fsopen.c:345 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
[Analysis]
There are two paths (dbUnmount and jfs_ioc_trim) that generate race condition when accessing bmap, which leads to the occurrence of uaf.
Use the lock s_umount to synchronize them, in order to avoid uaf caused by race condition.
--- fs/jfs/jfs_discard.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/jfs/jfs_discard.c +9 -2
@@ -65,7 +65,7 @@ void jfs_issue_discard(struct inode *ip, u64 blkno, u64 nblocks)int jfs_ioc_trim (struct inode *ip,struct fstrim_range *range) {struct inode *ipbmap =JFS_SBI (ip->i_sb)->ipbmap; -struct bmap *bmp =JFS_SBI (ip->i_sb)->bmap; +struct bmap *bmp;struct super_block *sb = ipbmap->i_sb;int agno, agno_end;u64 start, end, minlen;
@@ -83,10 +83,15 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)if (minlen ==0 ) minlen =1 ; +down_read (&sb->s_umount); + bmp =JFS_SBI (ip->i_sb)->bmap; +if (minlen > bmp->db_agsize || start >= bmp->db_mapsize || - range->len < sb->s_blocksize) + range->len < sb->s_blocksize) { +up_read (&sb->s_umount);return -EINVAL ; + }if (end >= bmp->db_mapsize) end = bmp->db_mapsize -1 ;
@@ -100,6 +105,8 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) trimmed +=dbDiscardAG (ip, agno, minlen); agno++; } + +up_read (&sb->s_umount); range->len = trimmed << sb->s_blocksize_bits;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 482/798 jfs: check if leafidx greater than num leaves per dmap tree
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit d64ff0d2306713ff084d4b09f84ed1a8c75ecc32 ]
syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.
Shaggy:
Modified sanity check to apply to control pages as well as leaf pages.
--- fs/jfs/jfs_dmap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/jfs/jfs_dmap.c +4 -1
@@ -2944,9 +2944,10 @@ static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl)static int dbFindLeaf (dmtree_t *tp,int l2nb,int *leafidx,bool is_ctl) {int ti, n =0 , k, x =0 ; -int max_size; +int max_size, max_idx; max_size = is_ctl ?CTLTREESIZE :TREESIZE ; + max_idx = is_ctl ?LPERCTL :LPERDMAP ;/* first check the root of the tree to see if there is * sufficient free space.
@@ -2978,6 +2979,8 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)*/ assert (n <4 ); } +if (le32_to_cpu (tp->dmt_leafidx) >= max_idx) +return -ENOSPC ;/* set the return to the leftmost leaf describing sufficient * free space.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 483/798 scsi: smartpqi: correct stream detection
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Rajashekhara <[email protected]>
[ Upstream commit 4c76114932d1d6fad2e72823e7898a3c960cf2a7 ]
Correct stream detection by initializing the structure pqi_scsi_dev_raid_map_data to 0s.
When the OS issues SCSI READ commands, the driver erroneously considers them as SCSI WRITES. If they are identified as sequential IOs, the driver then submits those requests via the RAID path instead of the AIO path.
The 'is_write' flag might be set for SCSI READ commands also. The driver may interpret SCSI READ commands as SCSI WRITE commands, resulting in IOs being submitted through the RAID path.
Note: This does not cause data corruption.
--- drivers/scsi/smartpqi/smartpqi_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/smartpqi/smartpqi_init.c +1 -1
@@ -5902,7 +5902,7 @@ static bool pqi_is_parity_write_stream(struct pqi_ctrl_info *ctrl_info,int rc;struct pqi_scsi_dev *device;struct pqi_stream_data *pqi_stream_data; -struct pqi_scsi_dev_raid_map_data rmd; +struct pqi_scsi_dev_raid_map_data rmd = {0 };if (!ctrl_info->enable_stream_detection)return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 484/798 jfs: Fix uninit-value access of new_ea in ea_buffer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Mengmeng <[email protected]>
[ Upstream commit 2b59ffad47db1c46af25ccad157bb3b25147c35c ]
syzbot reports that lzo1x_1_do_compress is using uninit-value:
=====================================================
BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178
...
Uninit was stored to memory at:
ea_put fs/jfs/xattr.c:639 [inline]
...
Local variable ea_buf created at:
__jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934
=====================================================
The reason is ea_buf->new_ea is not initialized properly.
Fix this by using memset to empty its content at the beginning in ea_get().
--- fs/jfs/xattr.c | 2 ++ 1 file changed, 2 insertions(+)
fs/jfs/xattr.c +2 -0
@@ -434,6 +434,8 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size)int rc;int quota_allocation =0 ; +memset (&ea_buf->new_ea,0 ,sizeof (ea_buf->new_ea)); +/* When fsck.jfs clears a bad ea, it doesn't clear the size */ if (ji->ea.flag ==0 ) ea_size =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 485/798 drm/amdgpu: add raven1 gfxoff quirk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Liu <[email protected]>
[ Upstream commit 0126c0ae11e8b52ecfde9d1b174ee2f32d6c3a5d ]
Fix screen corruption with openkylin.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +2 -0
@@ -1173,6 +1173,8 @@ static const struct amdgpu_gfxoff_quirk amdgpu_gfxoff_quirk_list[] = { { 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc6 },/* Apple MacBook Pro (15-inch, 2019) Radeon Pro Vega 20 4 GB */ { 0x1002, 0x69af, 0x106b, 0x019a, 0xc0 }, +/* https://bbs.openkylin.top/t/topic/171497 */ + { 0x1002, 0x15d8, 0x19e5, 0x3e14, 0xc2 }, { 0, 0, 0, 0, 0 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 486/798 drm/amdgpu: enable gfxoff quirk on HP 705G4
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Liu <[email protected]>
[ Upstream commit 2c7795e245d993bcba2f716a8c93a5891ef910c9 ]
Enabling gfxoff quirk results in perfectly usable graphical user interface on HP 705G4 DM with R5 2400G.
Without the quirk, X server is completely unusable as every few seconds there is gpu reset due to ring gfx timeout.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +2 -0
@@ -1175,6 +1175,8 @@ static const struct amdgpu_gfxoff_quirk amdgpu_gfxoff_quirk_list[] = { { 0x1002, 0x69af, 0x106b, 0x019a, 0xc0 },/* https://bbs.openkylin.top/t/topic/171497 */ { 0x1002, 0x15d8, 0x19e5, 0x3e14, 0xc2 }, +/* HP 705G4 DM with R5 2400G */ + { 0x1002, 0x15dd, 0x103c, 0x8464, 0xd6 }, { 0, 0, 0, 0, 0 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 487/798 drm/amdkfd: Fix resource leak in criu restore queue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit aa47fe8d3595365a935921a90d00bc33ee374728 ]
To avoid memory leaks, release q_extra_data when exiting the restore queue.
v2: Correct the proto (Alex)
--- drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +1 -0
@@ -890,6 +890,7 @@ int kfd_criu_restore_queue(struct kfd_process *p,pr_debug ("Queue id %d was restored successfully\n" , queue_id);kfree (q_data); +kfree (q_extra_data);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 488/798 HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Sankar <[email protected]>
[ Upstream commit 65b72ea91a257a5f0cb5a26b01194d3dd4b85298 ]
This applies similar quirks used by previous generation device, so that Trackpoint and buttons on the touchpad works. New USB KBD PID 0x61AE for Thinkpad X12 Tab is added.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -786,6 +786,7 @@#define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3#define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5#define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe +#define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae#define USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E 0x600e#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019
drivers/hid/hid-multitouch.c +6 -0
@@ -2116,6 +2116,12 @@ static const struct hid_device_id mt_devices[] = { USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB) }, +/* Lenovo X12 TAB Gen 2 */ + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, +HID_DEVICE (BUS_USB ,HID_GROUP_MULTITOUCH_WIN_8 , +USB_VENDOR_ID_LENOVO , + USB_DEVICE_ID_LENOVO_X12_TAB2) }, + /* Logitech devices */ { .driver_data = MT_CLS_NSMU, HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 489/798 platform/x86: touchscreen_dmi: add nanote-next quirk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ckath <[email protected]>
[ Upstream commit c11619af35bae5884029bd14170c3e4b55ddf6f3 ]
Add touschscreen info for the nanote next (UMPC-03-SR).
After checking with multiple owners the DMI info really is this generic.
--- drivers/platform/x86/touchscreen_dmi.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/platform/x86/touchscreen_dmi.c +26 -0
@@ -854,6 +854,21 @@ static const struct ts_dmi_data rwc_nanote_p8_data = { .properties = rwc_nanote_p8_props, }; +static const struct property_entry rwc_nanote_next_props[] = { +PROPERTY_ENTRY_U32 ("touchscreen-min-x" ,5 ), +PROPERTY_ENTRY_U32 ("touchscreen-min-y" ,5 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1785 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,1145 ), +PROPERTY_ENTRY_BOOL ("touchscreen-inverted-y" ), +PROPERTY_ENTRY_STRING ("firmware-name" ,"gsl1680-rwc-nanote-next.fw" ), + { } +}; + +static const struct ts_dmi_data rwc_nanote_next_data = { + .acpi_name ="MSSL1680:00" , + .properties = rwc_nanote_next_props, +}; +static const struct property_entry schneider_sct101ctm_props[] = {PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1715 ),PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,1140 ),
@@ -1603,6 +1618,17 @@ const struct dmi_system_id touchscreen_dmi_table[] = {DMI_MATCH (DMI_PRODUCT_SKU ,"0001" ) }, }, + { +/* RWC NANOTE NEXT */ + .driver_data = (void *)&rwc_nanote_next_data, + .matches = { +DMI_MATCH (DMI_PRODUCT_NAME ,"To be filled by O.E.M." ), +DMI_MATCH (DMI_BOARD_NAME ,"To be filled by O.E.M." ), +DMI_MATCH (DMI_BOARD_VENDOR ,"To be filled by O.E.M." ), +/* Above matches are too generic, add bios-version match */ + DMI_MATCH(DMI_BIOS_VERSION, "S8A70R100-V005"), + }, + }, {/* Schneider SCT101CTM */ .driver_data = (void *)&schneider_sct101ctm_data,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 490/798 drm/stm: ltdc: reset plane transparency after plane disable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yannick Fertre <[email protected]>
[ Upstream commit 02fa62d41c8abff945bae5bfc3ddcf4721496aca ]
The plane's opacity should be reseted while the plane is disabled. It prevents from seeing a possible global or layer background color set earlier.
--- drivers/gpu/drm/stm/ltdc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/stm/ltdc.c +3 -0
@@ -1514,6 +1514,9 @@ static void ltdc_plane_atomic_disable(struct drm_plane *plane,/* Disable layer */ regmap_write_bits (ldev->regmap,LTDC_L1CR + lofs,LXCR_LEN |LXCR_CLUTEN |LXCR_HMEN ,0 ); +/* Reset the layer transparency to hide any related background color */ +regmap_write_bits (ldev->regmap,LTDC_L1CACR + lofs,LXCACR_CONSTA ,0x00 ); +/* Commit shadow registers = update plane at next vblank */ if (ldev->caps.plane_reg_shadow) regmap_write_bits(ldev->regmap, LTDC_L1RCR + lofs,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 491/798 drm/amd/display: Check stream before comparing them
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 35ff747c86767937ee1e0ca987545b7eed7a0810 ]
[WHAT & HOW]amdgpu_dm can pass a null stream to dc_is_stream_unchanged. It is necessary to check for null before dereferencing them.
This fixes 1 FORWARD_NULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +2 -0
@@ -1915,6 +1915,8 @@ static bool are_stream_backends_same(bool dc_is_stream_unchanged (struct dc_stream_state *old_stream,struct dc_stream_state *stream) { +if (!old_stream || !stream) +return false;if (!are_stream_backends_same (old_stream, stream))return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 492/798 drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit bc50b614d59990747dd5aeced9ec22f9258991ff ]
This commit addresses a potential index out of bounds issue in the cm3_helper_translate_curve_to_degamma_hw_format function in the DCN30 color management module. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, the function returns false to indicate an error.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:338 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:339 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:340 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c +2 -0
@@ -355,6 +355,8 @@ bool cm3_helper_translate_curve_to_degamma_hw_format( i += increment) {if (j == hw_points -1 )break ; +if (i >=TRANSFER_FUNC_POINTS ) +return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 493/798 drm/amd/display: Fix index out of bounds in degamma hardware format translation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit b7e99058eb2e86aabd7a10761e76cae33d22b49f ]
Fixes index out of bounds issue in cm_helper_translate_curve_to_degamma_hw_format function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds the function returns false to indicate an error.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +2 -0
@@ -571,6 +571,8 @@ bool cm_helper_translate_curve_to_degamma_hw_format( i += increment) {if (j == hw_points -1 )break ; +if (i >=TRANSFER_FUNC_POINTS ) +return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 494/798 drm/amd/display: Fix index out of bounds in DCN30 color transformation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit d81873f9e715b72d4f8d391c8eb243946f784dfc ]
This commit addresses a potential index out of bounds issue in the cm3_helper_translate_curve_to_hw_format function in the DCN30 color management module. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, the function returns false to indicate an error.
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c +2 -0
@@ -178,6 +178,8 @@ bool cm3_helper_translate_curve_to_hw_format( i += increment) {if (j == hw_points -1 )break ; +if (i >=TRANSFER_FUNC_POINTS ) +return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 495/798 drm/amd/display: Initialize get_bytes_per_elements default to 1
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 4067f4fa0423a89fb19a30b57231b384d77d2610 ]
Variables, used as denominators and maybe not assigned to other values, should not be 0. bytes_per_element_y & bytes_per_element_c are initialized by get_bytes_per_element() which should never return 0.
This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.
--- .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c +1 -1
@@ -78,7 +78,7 @@ static void calculate_ttu_cursor(struct display_mode_lib *mode_lib,static unsigned int get_bytes_per_element (enum source_format_class source_format,bool is_chroma) { -unsigned int ret_val =0 ; +unsigned int ret_val =1 ;if (source_format == dm_444_16) {if (!is_chroma)
drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c +1 -1
@@ -53,7 +53,7 @@ static void calculate_ttu_cursor(static unsigned int get_bytes_per_element (enum source_format_class source_format,bool is_chroma) { -unsigned int ret_val =0 ; +unsigned int ret_val =1 ;if (source_format == dm_444_16) {if (!is_chroma)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 496/798 drm/printer: Allow NULL data in devcoredump printer
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit 53369581dc0c68a5700ed51e1660f44c4b2bb524 ]
We want to determine the size of the devcoredump before writing it out. To that end, we will run the devcoredump printer with NULL data to get the size, alloc data based on the generated offset, then run the devcorecump again with a valid data pointer to print. This necessitates not writing data to the data pointer on the initial pass, when it is NULL.
v5:
- Better commit message (Jonathan)
- Add kerenl doc with examples (Jani)
--- drivers/gpu/drm/drm_print.c | 13 +++++---- include/drm/drm_print.h | 54 ++++++++++++++++++++++++++++++++++++- 2 files changed, 61 insertions(+), 6 deletions(-)
drivers/gpu/drm/drm_print.c +8 -5
@@ -100,8 +100,9 @@ void __drm_puts_coredump(struct drm_printer *p, const char *str) copy = iterator->remain;/* Copy out the bit of the string that we need */ -memcpy (iterator->data, - str + (iterator->start - iterator->offset), copy); +if (iterator->data) +memcpy (iterator->data, + str + (iterator->start - iterator->offset), copy); iterator->offset = iterator->start + copy; iterator->remain -= copy;
@@ -110,7 +111,8 @@ void __drm_puts_coredump(struct drm_printer *p, const char *str) len =min_t (ssize_t,strlen (str), iterator->remain); -memcpy (iterator->data + pos, str, len); +if (iterator->data) +memcpy (iterator->data + pos, str, len); iterator->offset += len; iterator->remain -= len;
@@ -140,8 +142,9 @@ void __drm_printfn_coredump(struct drm_printer *p, struct va_format *vaf)if ((iterator->offset >= iterator->start) && (len < iterator->remain)) {ssize_t pos = iterator->offset - iterator->start; -snprintf (((char *) iterator->data) + pos, - iterator->remain,"%pV" , vaf); +if (iterator->data) +snprintf (((char *) iterator->data) + pos, + iterator->remain,"%pV" , vaf); iterator->offset += len; iterator->remain -= len;
include/drm/drm_print.h +53 -1
66 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 497/798 perf,x86: avoid missing caller address in stack traces captured in uprobe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit cfa7f3d2c526c224a6271cc78a4a27a0de06f4f0 ]
When tracing user functions with uprobe functionality, it's common to install the probe (e.g., a BPF program) at the first instruction of the function. This is often going to be push %rbp instruction in function preamble, which means that within that function frame pointer hasn't been established yet. This leads to consistently missing an actual caller of the traced function, because perf_callchain_user() only records current IP (capturing traced function) and then following frame pointer chain (which would be caller's frame, containing the address of caller's caller).
So when we have target_1 -> target_2 -> target_3 call chain and we are tracing an entry to target_3, captured stack trace will report target_1 -> target_3 call chain, which is wrong and confusing.
This patch proposes a x86-64-specific heuristic to detect push %rbp (push %ebp on 32-bit architecture) instruction being traced. Given entire kernel implementation of user space stack trace capturing works under assumption that user space code was compiled with frame pointer register (%rbp/%ebp) preservation, it seems pretty reasonable to use this instruction as a strong indicator that this is the entry to the function. In that case, return address is still pointed to by %rsp/%esp, so we fetch it and add to stack trace before proceeding to unwind the rest using frame pointer-based logic.
We also check for endbr64 (for 64-bit modes) as another common pattern for function entry, as suggested by Josh Poimboeuf. Even if we get this wrong sometimes for uprobes attached not at the function entry, it's OK because stack trace will still be overall meaningful, just with one extra bogus entry. If we don't detect this, we end up with guaranteed to be missing caller function entry in the stack trace, which is worse overall.
--- arch/x86/events/core.c | 63 +++++++++++++++++++++++++++++++++++++++++ include/linux/uprobes.h | 2 ++ kernel/events/uprobes.c | 2 ++ 3 files changed, 67 insertions(+)
arch/x86/events/core.c +63 -0
@@ -41,6 +41,8 @@#include <asm/desc.h> #include <asm/ldt.h> #include <asm/unwind.h> +#include <asm/uprobes.h> +#include <asm/ibt.h> #include "perf_event.h"
@@ -2841,6 +2843,46 @@ static unsigned long get_segment_base(unsigned int segment)return get_desc_base (desc); } +#ifdef CONFIG_UPROBES +/* +* Heuristic-based check if uprobe is installed at the function entry. +* +* Under assumption of user code being compiled with frame pointers, +* `push %rbp/%ebp` is a good indicator that we indeed are. +* +* Similarly, `endbr64` (assuming 64-bit mode) is also a common pattern. +* If we get this wrong, captured stack trace might have one extra bogus +* entry, but the rest of stack trace will still be meaningful. +*/ +static bool is_uprobe_at_func_entry (struct pt_regs *regs) +{ +struct arch_uprobe *auprobe; + +if (!current->utask) +return false; + + auprobe = current->utask->auprobe; +if (!auprobe) +return false; + +/* push %rbp/%ebp */ +if (auprobe->insn[0 ] ==0x55 ) +return true; + +/* endbr64 (64-bit only) */ +if (user_64bit_mode (regs) &&is_endbr (*(u32 *)auprobe->insn)) +return true; + +return false; +} + +#else +static bool is_uprobe_at_func_entry (struct pt_regs *regs) +{ +return false; +} +#endif /* CONFIG_UPROBES */ +#ifdef CONFIG_IA32_EMULATION #include <linux/compat.h>
@@ -2852,6 +2894,7 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *entunsigned long ss_base, cs_base;struct stack_frame_ia32 frame;const struct stack_frame_ia32 __user *fp; +u32 ret_addr;if (user_64bit_mode (regs))return 0 ;
@@ -2861,6 +2904,12 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *ent fp =compat_ptr (ss_base + regs->bp);pagefault_disable (); + +/* see perf_callchain_user() below for why we do this */ +if (is_uprobe_at_func_entry (regs) && + !get_user (ret_addr, (const u32 __user *)regs->sp)) +perf_callchain_store (entry, ret_addr); +while (entry->nr < entry->max_stack) {if (!valid_user_frame (fp,sizeof (frame)))break ;
@@ -2889,6 +2938,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs {struct stack_frame frame;const struct stack_frame __user *fp; +unsigned long ret_addr;if (perf_guest_state ()) {/* TODO: We don't support guest os callchain now */
@@ -2912,6 +2962,19 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regsreturn ;pagefault_disable (); + +/* +* If we are called from uprobe handler, and we are indeed at the very +* entry to user function (which is normally a `push %rbp` instruction, +* under assumption of application being compiled with frame pointers), +* we should read return address from *regs->sp before proceeding +* to follow frame pointers, otherwise we'll skip immediate caller +* as %rbp is not yet setup. +*/ +if (is_uprobe_at_func_entry (regs) && + !get_user (ret_addr, (const unsigned long __user *)regs->sp)) +perf_callchain_store (entry, ret_addr); +while (entry->nr < entry->max_stack) {if (!valid_user_frame (fp,sizeof (frame)))break ;
include/linux/uprobes.h +2 -0
@@ -76,6 +76,8 @@ struct uprobe_task {struct uprobe *active_uprobe;unsigned long xol_vaddr; +struct arch_uprobe *auprobe; +struct return_instance *return_instances;unsigned int depth; };
kernel/events/uprobes.c +2 -0
@@ -2075,6 +2075,7 @@ static void handler_chain(struct uprobe *uprobe, struct pt_regs *regs)bool need_prep = false;/* prepare return uprobe, when needed */ down_read (&uprobe->register_rwsem); + current->utask->auprobe = &uprobe->arch;for (uc = uprobe->consumers; uc; uc = uc->next) {int rc =0 ;
@@ -2089,6 +2090,7 @@ static void handler_chain(struct uprobe *uprobe, struct pt_regs *regs) remove &= rc; } + current->utask->auprobe =NULL ;if (need_prep && !remove)prepare_uretprobe (uprobe, regs);/* put bp at return */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 498/798 scsi: aacraid: Rearrange order of struct aac_srb_unit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 6e5860b0ad4934baee8c7a202c02033b2631bb44 ]
struct aac_srb_unit contains struct aac_srb, which contains struct sgmap, which ends in a (currently) "fake" (1-element) flexible array. Converting this to a flexible array is needed so that runtime bounds checking won't think the array is fixed size (i.e. under CONFIG_FORTIFY_SOURCE=y and/or CONFIG_UBSAN_BOUNDS=y), as other parts of aacraid use struct sgmap as a flexible array.
It is not legal to have a flexible array in the middle of a structure, so it either needs to be split up or rearranged so that it is at the end of the structure. Luckily, struct aac_srb_unit, which is exclusively consumed/updated by aac_send_safw_bmic_cmd(), does not depend on member ordering.
The values set in the on-stack struct aac_srb_unit instance "srbu" by the only two callers, aac_issue_safw_bmic_identify() and aac_get_safw_ciss_luns(), do not contain anything in srbu.srb.sgmap.sg, and they both implicitly initialize srbu.srb.sgmap.count to 0 during memset(). For example:
memset(&srbu, 0, sizeof(struct aac_srb_unit));
srbcmd = &srbu.srb;
srbcmd->flags = cpu_to_le32(SRB_DataIn);
srbcmd->cdb[0] = CISS_REPORT_PHYSICAL_LUNS;
srbcmd->cdb[1] = 2; /* extended reporting */
srbcmd->cdb[8] = (u8)(datasize >> 8);
srbcmd->cdb[9] = (u8)(datasize);
rcode = aac_send_safw_bmic_cmd(dev, &srbu, phys_luns, datasize);During aac_send_safw_bmic_cmd(), a separate srb is mapped into DMA, and has srbu.srb copied into it:
srb = fib_data(fibptr);
memcpy(srb, &srbu->srb, sizeof(struct aac_srb));Only then is srb.sgmap.count written and srb->sg populated:
srb->count = cpu_to_le32(xfer_len);
sg64 = (struct sgmap64 *)&srb->sg;
sg64->count = cpu_to_le32(1);
sg64->sg[0].addr[1] = cpu_to_le32(upper_32_bits(addr));
sg64->sg[0].addr[0] = cpu_to_le32(lower_32_bits(addr));
sg64->sg[0].count = cpu_to_le32(xfer_len);But this is happening in the DMA memory, not in srbu.srb. An attempt to copy the changes back to srbu does happen:
/*
* Copy the updated data for other dumping or other usage if
* needed
*/
memcpy(&srbu->srb, srb, sizeof(struct aac_srb));But this was never correct: the sg64 (3 u32s) overlap of srb.sg (2 u32s) always meant that srbu.srb would have held truncated information and any attempt to walk srbu.srb.sg.sg based on the value of srbu.srb.sg.count would result in attempting to parse past the end of srbu.srb.sg.sg[0] into srbu.srb_reply.
After getting a reply from hardware, the reply is copied into srbu.srb_reply:
srb_reply = (struct aac_srb_reply *)fib_data(fibptr);
memcpy(&srbu->srb_reply, srb_reply, sizeof(struct aac_srb_reply));This has always been fixed-size, so there's no issue here. It is worth noting that the two callers _never check_ srbu contents -- neither srbu.srb nor srbu.srb_reply is examined. (They depend on the mapped xfer_buf instead.)
Therefore, the ordering of members in struct aac_srb_unit does not matter, and the flexible array member can moved to the end.
(Additionally, the two memcpy()s that update srbu could be entirely removed as they are never consumed, but I left that as-is.)
--- drivers/scsi/aacraid/aacraid.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/aacraid/aacraid.h +1 -1
@@ -2029,8 +2029,8 @@ struct aac_srb_reply };struct aac_srb_unit { -struct aac_srb srb;struct aac_srb_reply srb_reply; +struct aac_srb srb; };/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 499/798 scsi: lpfc: Update PRLO handling in direct attached topology
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 1f0f7679ad8942f810b0f19ee9cf098c3502d66a ]
A kref imbalance occurs when handling an unsolicited PRLO in direct attached topology.
Rework PRLO rcv handling when in MAPPED state. Save the state that we were handling a PRLO by setting nlp_last_elscmd to ELS_CMD_PRLO. Then in the lpfc_cmpl_els_logo_acc() completion routine, manually restart discovery. By issuing the PLOGI, which nlp_gets, before nlp_put at the end of the lpfc_cmpl_els_logo_acc() routine, we are saving us from a final nlp_put. And, we are still allowing the unreg_rpi to happen.
--- drivers/scsi/lpfc/lpfc_els.c | 27 ++++++++++++++++----------- drivers/scsi/lpfc/lpfc_nportdisc.c | 22 ++++++++++++++++++++-- 2 files changed, 36 insertions(+), 13 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +16 -11
@@ -5171,9 +5171,10 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,/* ACC to LOGO completes to NPort <nlp_DID> */ lpfc_printf_vlog (vport,KERN_INFO ,LOG_ELS ,"0109 ACC to LOGO completes to NPort x%x refcnt %d " -"Data: x%x x%x x%x\n" , - ndlp->nlp_DID,kref_read (&ndlp->kref), ndlp->nlp_flag, - ndlp->nlp_state, ndlp->nlp_rpi); +"last els x%x Data: x%x x%x x%x\n" , + ndlp->nlp_DID,kref_read (&ndlp->kref), + ndlp->nlp_last_elscmd, ndlp->nlp_flag, ndlp->nlp_state, + ndlp->nlp_rpi);/* This clause allows the LOGO ACC to complete and free resources * for the Fabric Domain Controller. It does deliberately skip
@@ -5185,18 +5186,22 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, goto out;if (ndlp->nlp_state ==NLP_STE_NPR_NODE ) { -/* If PLOGI is being retried, PLOGI completion will cleanup the -* node. The NLP_NPR_2B_DISC flag needs to be retained to make -* progress on nodes discovered from last RSCN. -*/ -if ((ndlp->nlp_flag &NLP_DELAY_TMO ) && - (ndlp->nlp_last_elscmd ==ELS_CMD_PLOGI )) - goto out; -if (ndlp->nlp_flag &NLP_RPI_REGISTERED )lpfc_unreg_rpi (vport, ndlp); +/* If came from PRLO, then PRLO_ACC is done. +* Start rediscovery now. +*/ +if (ndlp->nlp_last_elscmd ==ELS_CMD_PRLO ) { +spin_lock_irq (&ndlp->lock); + ndlp->nlp_flag |=NLP_NPR_2B_DISC ; +spin_unlock_irq (&ndlp->lock); + ndlp->nlp_prev_state = ndlp->nlp_state; +lpfc_nlp_set_state (vport, ndlp,NLP_STE_PLOGI_ISSUE ); +lpfc_issue_els_plogi (vport, ndlp->nlp_DID,0 ); + } } + out:/* * The driver received a LOGO from the rport and has ACK'd it.
drivers/scsi/lpfc/lpfc_nportdisc.c +20 -2
@@ -2621,8 +2621,26 @@ lpfc_rcv_prlo_mapped_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,/* flush the target */ lpfc_sli_abort_iocb (vport, ndlp->nlp_sid,0 ,LPFC_CTX_TGT ); -/* Treat like rcv logo */ -lpfc_rcv_logo (vport, ndlp, cmdiocb,ELS_CMD_PRLO ); +/* Send PRLO_ACC */ +spin_lock_irq (&ndlp->lock); + ndlp->nlp_flag |=NLP_LOGO_ACC ; +spin_unlock_irq (&ndlp->lock); +lpfc_els_rsp_acc (vport,ELS_CMD_PRLO , cmdiocb, ndlp,NULL ); + +/* Save ELS_CMD_PRLO as the last elscmd and then set to NPR. +* lpfc_cmpl_els_logo_acc is expected to restart discovery. +*/ + ndlp->nlp_last_elscmd =ELS_CMD_PRLO ; + ndlp->nlp_prev_state = ndlp->nlp_state; + +lpfc_printf_vlog (vport,KERN_INFO ,LOG_NODE |LOG_ELS |LOG_DISCOVERY , +"3422 DID x%06x nflag x%x lastels x%x ref cnt %u\n" , + ndlp->nlp_DID, ndlp->nlp_flag, + ndlp->nlp_last_elscmd, +kref_read (&ndlp->kref)); + +lpfc_nlp_set_state (vport, ndlp,NLP_STE_NPR_NODE ); +return ndlp->nlp_state; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 500/798 drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit c0277b9d7c2ee9ee5dbc948548984f0fbb861301 ]
This resolves the unchecded return value warning reported by Coverity.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +14 -4
@@ -676,8 +676,11 @@ int amdgpu_gfx_ras_late_init(struct amdgpu_device *adev, struct ras_common_if *rint r;if (amdgpu_ras_is_supported (adev, ras_block->block)) { -if (!amdgpu_persistent_edc_harvesting_supported (adev)) -amdgpu_ras_reset_error_status (adev,AMDGPU_RAS_BLOCK__GFX ); +if (!amdgpu_persistent_edc_harvesting_supported (adev)) { + r =amdgpu_ras_reset_error_status (adev,AMDGPU_RAS_BLOCK__GFX ); +if (r) +return r; + } r =amdgpu_ras_block_late_init (adev, ras_block);if (r)
@@ -758,7 +761,10 @@ uint32_t amdgpu_kiq_rreg(struct amdgpu_device *adev, uint32_t reg)pr_err ("critical bug! too many kiq readers\n" ); goto failed_unlock; } -amdgpu_ring_alloc (ring,32 ); + r =amdgpu_ring_alloc (ring,32 ); +if (r) + goto failed_unlock; +amdgpu_ring_emit_rreg (ring, reg, reg_val_offs); r =amdgpu_fence_emit_polling (ring, &seq,MAX_KIQ_REG_WAIT );if (r)
@@ -824,7 +830,10 @@ void amdgpu_kiq_wreg(struct amdgpu_device *adev, uint32_t reg, uint32_t v) }spin_lock_irqsave (&kiq->ring_lock, flags); -amdgpu_ring_alloc (ring,32 ); + r =amdgpu_ring_alloc (ring,32 ); +if (r) + goto failed_unlock; +amdgpu_ring_emit_wreg (ring, reg, v); r =amdgpu_fence_emit_polling (ring, &seq,MAX_KIQ_REG_WAIT );if (r)
@@ -860,6 +869,7 @@ void amdgpu_kiq_wreg(struct amdgpu_device *adev, uint32_t reg, uint32_t v) failed_undo:amdgpu_ring_undo (ring); +failed_unlock:spin_unlock_irqrestore (&kiq->ring_lock, flags); failed_kiq_write:dev_err (adev->dev,"failed to write reg:%x\n" , reg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 501/798 scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 1c71065df2df693d208dd32758171c1dece66341 ]
Following an incomplete transfer in MSG IN phase, the driver would not notice the problem and would make use of invalid data. Initialize 'tmp' appropriately and bail out if no message was received. For STATUS phase, preserve the existing status code unless a new value was transferred.
--- drivers/scsi/NCR5380.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/scsi/NCR5380.c +4 -0
@@ -1807,8 +1807,11 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)return ;case PHASE_MSGIN : len =1 ; + tmp =0xff ; data = &tmp;NCR5380_transfer_pio (instance, &phase, &len, &data,0 ); +if (tmp ==0xff ) +break ; ncmd->message = tmp;switch (tmp) {
@@ -1996,6 +1999,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)break ;case PHASE_STATIN : len =1 ; + tmp = ncmd->status; data = &tmp;NCR5380_transfer_pio (instance, &phase, &len, &data,0 ); ncmd->status = tmp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 502/798 drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit c6dbab46324b1742b50dc2fb5c1fee2c28129439 ]
With -Werror:
In function ‘r100_cp_init_microcode’,
inlined from ‘r100_cp_init’ at drivers/gpu/drm/radeon/r100.c:1136:7:
include/linux/printk.h:465:44: error: ‘%s’ directive argument is null [-Werror=format-overflow=]
465 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__)
| ^
include/linux/printk.h:437:17: note: in definition of macro ‘printk_index_wrap’
437 | _p_func(_fmt, ##__VA_ARGS__); \
| ^~~~~~~
include/linux/printk.h:508:9: note: in expansion of macro ‘printk’
508 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~
drivers/gpu/drm/radeon/r100.c:1062:17: note: in expansion of macro ‘pr_err’
1062 | pr_err("radeon_cp: Failed to load firmware \"%s\"\n", fw_name);
| ^~~~~~Fix this by converting the if/else if/... construct into a proper switch() statement with a default to handle the error case.
As a bonus, the generated code is ca. 100 bytes smaller (with gcc 11.4.0 targeting arm32).
--- drivers/gpu/drm/radeon/r100.c | 70 ++++++++++++++++++++++------------- 1 file changed, 45 insertions(+), 25 deletions(-)
drivers/gpu/drm/radeon/r100.c +45 -25
@@ -1015,45 +1015,65 @@ static int r100_cp_init_microcode(struct radeon_device *rdev)DRM_DEBUG_KMS ("\n" ); -if ((rdev->family ==CHIP_R100 ) || (rdev->family ==CHIP_RV100 ) || - (rdev->family ==CHIP_RV200 ) || (rdev->family ==CHIP_RS100 ) || - (rdev->family ==CHIP_RS200 )) { +switch (rdev->family) { +case CHIP_R100 : +case CHIP_RV100 : +case CHIP_RV200 : +case CHIP_RS100 : +case CHIP_RS200 :DRM_INFO ("Loading R100 Microcode\n" ); fw_name =FIRMWARE_R100 ; - }else if ((rdev->family ==CHIP_R200 ) || - (rdev->family ==CHIP_RV250 ) || - (rdev->family ==CHIP_RV280 ) || - (rdev->family ==CHIP_RS300 )) { +break ; + +case CHIP_R200 : +case CHIP_RV250 : +case CHIP_RV280 : +case CHIP_RS300 :DRM_INFO ("Loading R200 Microcode\n" ); fw_name =FIRMWARE_R200 ; - }else if ((rdev->family ==CHIP_R300 ) || - (rdev->family ==CHIP_R350 ) || - (rdev->family ==CHIP_RV350 ) || - (rdev->family ==CHIP_RV380 ) || - (rdev->family ==CHIP_RS400 ) || - (rdev->family ==CHIP_RS480 )) { +break ; + +case CHIP_R300 : +case CHIP_R350 : +case CHIP_RV350 : +case CHIP_RV380 : +case CHIP_RS400 : +case CHIP_RS480 :DRM_INFO ("Loading R300 Microcode\n" ); fw_name =FIRMWARE_R300 ; - }else if ((rdev->family ==CHIP_R420 ) || - (rdev->family ==CHIP_R423 ) || - (rdev->family ==CHIP_RV410 )) { +break ; + +case CHIP_R420 : +case CHIP_R423 : +case CHIP_RV410 :DRM_INFO ("Loading R400 Microcode\n" ); fw_name =FIRMWARE_R420 ; - }else if ((rdev->family ==CHIP_RS690 ) || - (rdev->family ==CHIP_RS740 )) { +break ; + +case CHIP_RS690 : +case CHIP_RS740 :DRM_INFO ("Loading RS690/RS740 Microcode\n" ); fw_name =FIRMWARE_RS690 ; - }else if (rdev->family ==CHIP_RS600 ) { +break ; + +case CHIP_RS600 :DRM_INFO ("Loading RS600 Microcode\n" ); fw_name =FIRMWARE_RS600 ; - }else if ((rdev->family ==CHIP_RV515 ) || - (rdev->family ==CHIP_R520 ) || - (rdev->family ==CHIP_RV530 ) || - (rdev->family ==CHIP_R580 ) || - (rdev->family ==CHIP_RV560 ) || - (rdev->family ==CHIP_RV570 )) { +break ; + +case CHIP_RV515 : +case CHIP_R520 : +case CHIP_RV530 : +case CHIP_R580 : +case CHIP_RV560 : +case CHIP_RV570 :DRM_INFO ("Loading R500 Microcode\n" ); fw_name =FIRMWARE_R520 ; +break ; + +default : +DRM_ERROR ("Unsupported Radeon family %u\n" , rdev->family); +return -EINVAL ; } err =request_firmware (&rdev->me_fw, fw_name, rdev->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 503/798 drm/amd/pm: ensure the fw_info is not null before using it
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 186fb12e7a7b038c2710ceb2fb74068f1b5d55a4 ]
This resolves the dereference null return value warning reported by Coverity.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c +2 -0
@@ -1185,6 +1185,8 @@ static int init_overdrive_limits(struct pp_hwmgr *hwmgr, fw_info =smu_atom_get_data_table (hwmgr->adev,GetIndexIntoMasterTable (DATA , FirmwareInfo), &size, &frev, &crev); +PP_ASSERT_WITH_CODE (fw_info !=NULL , +"Missing firmware info!" , return -EINVAL );if ((fw_info->ucTableFormatRevision ==1 ) && (le16_to_cpu (fw_info->usStructureSize) >=sizeof (ATOM_FIRMWARE_INFO_V1_4 )))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 504/798 of/irq: Refer to actual buffer size in of_irq_parse_one()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 39ab331ab5d377a18fbf5a0e0b228205edfcc7f4 ]
Replace two open-coded calculations of the buffer size by invocations of sizeof() on the buffer itself, to make sure the code will always use the actual buffer size.
--- drivers/of/irq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/of/irq.c +2 -2
@@ -357,8 +357,8 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar addr =of_get_property (device,"reg" , &addr_len);/* Prevent out-of-bounds read in case of longer interrupt parent address size */ -if (addr_len > (3 *sizeof (__be32))) - addr_len =3 *sizeof (__be32); +if (addr_len >sizeof (addr_buf)) + addr_len =sizeof (addr_buf);if (addr)memcpy (addr_buf, addr, addr_len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 505/798 powerpc/pseries: Use correct data types from pseries_hp_errorlog struct
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haren Myneni <[email protected]>
[ Upstream commit b76e0d4215b6b622127ebcceaa7f603313ceaec4 ]
_be32 type is defined for some elements in pseries_hp_errorlog struct but also used them u32 after be32_to_cpu() conversion.
Example: In handle_dlpar_errorlog() hp_elog->_drc_u.drc_index = be32_to_cpu(hp_elog->_drc_u.drc_index);
And later assigned to u32 typedlpar_cpu() - u32 drc_index = hp_elog->_drc_u.drc_index;
This incorrect usage is giving the following warnings and the patch resolve these warnings with the correct assignment.
arch/powerpc/platforms/pseries/dlpar.c:398:53: sparse: sparse:
incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] drc_index @@
got restricted __be32 [usertype] drc_index @@
...arch/powerpc/platforms/pseries/dlpar.c:418:43: sparse: sparse:
incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] drc_count @@ got unsigned int [usertype] @@
v3:
- Fix warnings from using incorrect data types in pseries_hp_errorlog struct
v2:
- Remove pr_info() and TODO comments
- Update more information in the commit logs
--- arch/powerpc/platforms/pseries/dlpar.c | 17 ----------------- arch/powerpc/platforms/pseries/hotplug-cpu.c | 2 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 16 ++++++++-------- arch/powerpc/platforms/pseries/pmem.c | 2 +- 4 files changed, 10 insertions(+), 27 deletions(-)
arch/powerpc/platforms/pseries/dlpar.c +0 -17
@@ -343,23 +343,6 @@ int handle_dlpar_errorlog(struct pseries_hp_errorlog *hp_elog) {int rc; -/* pseries error logs are in BE format, convert to cpu type */ -switch (hp_elog->id_type) { -case PSERIES_HP_ELOG_ID_DRC_COUNT : - hp_elog->_drc_u.drc_count = -be32_to_cpu (hp_elog->_drc_u.drc_count); -break ; -case PSERIES_HP_ELOG_ID_DRC_INDEX : - hp_elog->_drc_u.drc_index = -be32_to_cpu (hp_elog->_drc_u.drc_index); -break ; -case PSERIES_HP_ELOG_ID_DRC_IC : - hp_elog->_drc_u.ic.count = -be32_to_cpu (hp_elog->_drc_u.ic.count); - hp_elog->_drc_u.ic.index = -be32_to_cpu (hp_elog->_drc_u.ic.index); - } -switch (hp_elog->resource) {case PSERIES_HP_ELOG_RESOURCE_MEM : rc =dlpar_memory (hp_elog);
arch/powerpc/platforms/pseries/hotplug-cpu.c +1 -1
@@ -748,7 +748,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)u32 drc_index;int rc; - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index);lock_device_hotplug ();
arch/powerpc/platforms/pseries/hotplug-memory.c +8 -8
@@ -876,16 +876,16 @@ int dlpar_memory(struct pseries_hp_errorlog *hp_elog)case PSERIES_HP_ELOG_ACTION_ADD :switch (hp_elog->id_type) {case PSERIES_HP_ELOG_ID_DRC_COUNT : - count = hp_elog->_drc_u.drc_count; + count =be32_to_cpu (hp_elog->_drc_u.drc_count); rc =dlpar_memory_add_by_count (count);break ;case PSERIES_HP_ELOG_ID_DRC_INDEX : - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index); rc =dlpar_memory_add_by_index (drc_index);break ;case PSERIES_HP_ELOG_ID_DRC_IC : - count = hp_elog->_drc_u.ic.count; - drc_index = hp_elog->_drc_u.ic.index; + count =be32_to_cpu (hp_elog->_drc_u.ic.count); + drc_index =be32_to_cpu (hp_elog->_drc_u.ic.index); rc =dlpar_memory_add_by_ic (count, drc_index);break ;default :
@@ -897,16 +897,16 @@ int dlpar_memory(struct pseries_hp_errorlog *hp_elog)case PSERIES_HP_ELOG_ACTION_REMOVE :switch (hp_elog->id_type) {case PSERIES_HP_ELOG_ID_DRC_COUNT : - count = hp_elog->_drc_u.drc_count; + count =be32_to_cpu (hp_elog->_drc_u.drc_count); rc =dlpar_memory_remove_by_count (count);break ;case PSERIES_HP_ELOG_ID_DRC_INDEX : - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index); rc =dlpar_memory_remove_by_index (drc_index);break ;case PSERIES_HP_ELOG_ID_DRC_IC : - count = hp_elog->_drc_u.ic.count; - drc_index = hp_elog->_drc_u.ic.index; + count =be32_to_cpu (hp_elog->_drc_u.ic.count); + drc_index =be32_to_cpu (hp_elog->_drc_u.ic.index); rc =dlpar_memory_remove_by_ic (count, drc_index);break ;default :
arch/powerpc/platforms/pseries/pmem.c +1 -1
@@ -121,7 +121,7 @@ int dlpar_hp_pmem(struct pseries_hp_errorlog *hp_elog)return -EINVAL ; } - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index);lock_device_hotplug ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 506/798 ext4: ext4_search_dir should return a proper error
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit cd69f8f9de280e331c9e6ff689ced0a688a9ce8f ]
ext4_search_dir currently returns -1 in case of a failure, while it returns 0 when the name is not found. In such failure cases, it should return an error code instead.
This becomes even more important when ext4_find_inline_entry returns an error code as well in the next commit.
-EFSCORRUPTED seems appropriate as such error code as these failures would be caused by unexpected record lengths and is in line with other instances of ext4_check_dir_entry failures.
In the case of ext4_dx_find_entry, the current use of ERR_BAD_DX_DIR was left as is to reduce the risk of regressions.
--- fs/ext4/namei.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/ext4/namei.c +7 -5
@@ -1526,7 +1526,7 @@ static bool ext4_match(struct inode *parent, }/* -* Returns 0 if not found, -1 on failure, and 1 on success +* Returns 0 if not found, -EFSCORRUPTED on failure, and 1 on success */ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, struct inode *dir, struct ext4_filename *fname,
@@ -1547,7 +1547,7 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,* a full check */ if (ext4_check_dir_entry (dir,NULL , de, bh, search_buf, buf_size, offset)) -return -1 ; +return -EFSCORRUPTED ; *res_dir = de;return 1 ; }
@@ -1555,7 +1555,7 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, de_len =ext4_rec_len_from_disk (de->rec_len, dir->i_sb->s_blocksize);if (de_len <=0 ) -return -1 ; +return -EFSCORRUPTED ; offset += de_len; de = (struct ext4_dir_entry_2 *) ((char *) de + de_len); }
@@ -1707,8 +1707,10 @@ static struct buffer_head *__ext4_find_entry(struct inode *dir, goto cleanup_and_exit; }else {brelse (bh); -if (i <0 ) +if (i <0 ) { + ret =ERR_PTR (i); goto cleanup_and_exit; + } } next:if (++block >= nblocks)
@@ -1803,7 +1805,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,if (retval ==1 ) goto success;brelse (bh); -if (retval ==-1 ) { +if (retval <0 ) { bh =ERR_PTR (ERR_BAD_DX_DIR ); goto errout; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 507/798 ext4: avoid use-after-free in ext4_ext_show_leaf()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 4e2524ba2ca5f54bdbb9e5153bea00421ef653f5 ]
In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows:
ext4_split_extent
path = *ppath;
ext4_split_extent_at(ppath)
path = ext4_find_extent(ppath)
ext4_split_extent_at(ppath)
// ext4_find_extent fails to free path
// but zeroout succeeds ext4_ext_show_leaf(inode, path)
eh = path[depth].p_hdr
// path use-after-free !!!
Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way.
Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.
This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality.
--- fs/ext4/extents.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
fs/ext4/extents.c +4 -5
@@ -3289,7 +3289,7 @@ static int ext4_split_extent_at(handle_t *handle, }/* -* ext4_split_extents() splits an extent and mark extent which is covered +* ext4_split_extent() splits an extent and mark extent which is covered * by @map as split_flags indicates * * It may result in splitting the extent into multiple extents (up to three)
@@ -3365,7 +3365,7 @@ static int ext4_split_extent(handle_t *handle, goto out; } -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath); out:return err ? err : allocated; }
@@ -3831,14 +3831,13 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, struct ext4_ext_path **ppath, int flags, unsigned int allocated, ext4_fsblk_t newblock) { - struct ext4_ext_path __maybe_unused *path = *ppath; int ret = 0;int err =0 ;ext_debug (inode,"logical block %llu, max_blocks %u, flags 0x%x, allocated %u\n" , (unsigned long long )map->m_lblk, map->m_len, flags, allocated); -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath);/* * When writing into unwritten space, we should not fail to
@@ -3935,7 +3934,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode,if (allocated > map->m_len) allocated = map->m_len; map->m_len = allocated; -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath); out2:return err ? err : allocated; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 508/798 ext4: fix i_data_sem unlock order in ext4_ind_migrate()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Sadovnikov <[email protected]>
[ Upstream commit cc749e61c011c255d81b192a822db650c68b313f ]
Fuzzing reports a possible deadlock in jbd2_log_wait_commit.
This issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require synchronous updates because the file descriptor is opened with O_SYNC. This can lead to the jbd2_journal_stop() function calling jbd2_might_wait_for_commit(), potentially causing a deadlock if the EXT4_IOC_MIGRATE call races with a write(2) system call.
This problem only arises when CONFIG_PROVE_LOCKING is enabled. In this case, the jbd2_might_wait_for_commit macro locks jbd2_handle in the jbd2_journal_stop function while i_data_sem is locked. This triggers lockdep because the jbd2_journal_start function might also lock the same jbd2_handle simultaneously.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Rule: add
--- fs/ext4/migrate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/migrate.c +1 -1
@@ -662,8 +662,8 @@ int ext4_ind_migrate(struct inode *inode)if (unlikely (ret2 && !ret)) ret = ret2; errout: -ext4_journal_stop (handle);up_write (&EXT4_I (inode)->i_data_sem); +ext4_journal_stop (handle); out_unlock:percpu_up_write (&sbi->s_writepages_rwsem);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 509/798 iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 7a9d43eace888a0ee6095035997bb138425844d3 ]
When direct I/O completions invalidates the page cache it holds neither the i_rwsem nor the invalidate_lock so it can be racing with iomap_write_delalloc_release. If the search for the end of the region that contains data returns the start offset we hit such a race and just need to look for the end of the newly created hole instead.
--- fs/iomap/buffered-io.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/iomap/buffered-io.c +9 -1
@@ -990,7 +990,15 @@ static int iomap_write_delalloc_release(struct inode *inode, error = data_end; goto out_unlock; } -WARN_ON_ONCE (data_end <= start_byte); + +/* +* If we race with post-direct I/O invalidation of the page cache, +* there might be no data left at start_byte. +*/ +if (data_end == start_byte) +continue ; + +WARN_ON_ONCE (data_end < start_byte);WARN_ON_ONCE (data_end > scan_end_byte); error = iomap_write_delalloc_scan(inode, &punch_start_byte,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 510/798 blk-integrity: use sysfs_emit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
Upstream commit 3315e169b446249c1b61ff988d157238f4b2c5a0.
The correct way to emit data into sysfs is via sysfs_emit(), use it.
Also perform some trivial syntactic cleanups.
--- block/blk-integrity.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
block/blk-integrity.c +9 -10
@@ -248,20 +248,19 @@ static ssize_t integrity_attr_store(struct kobject *kobj,static ssize_t integrity_format_show (struct blk_integrity *bi,char *page) {if (bi->profile && bi->profile->name) -return sprintf (page,"%s\n" , bi->profile->name); -else -return sprintf (page,"none\n" ); +return sysfs_emit (page,"%s\n" , bi->profile->name); +return sysfs_emit (page,"none\n" ); }static ssize_t integrity_tag_size_show (struct blk_integrity *bi,char *page) { -return sprintf (page,"%u\n" , bi->tag_size); +return sysfs_emit (page,"%u\n" , bi->tag_size); }static ssize_t integrity_interval_show (struct blk_integrity *bi,char *page) { -return sprintf (page,"%u\n" , - bi->interval_exp ?1 << bi->interval_exp :0 ); +return sysfs_emit (page,"%u\n" , + bi->interval_exp ?1 << bi->interval_exp :0 ); } static ssize_t integrity_verify_store(struct blk_integrity *bi,
@@ -280,7 +279,7 @@ static ssize_t integrity_verify_store(struct blk_integrity *bi,static ssize_t integrity_verify_show (struct blk_integrity *bi,char *page) { -return sprintf (page,"%d\n" , (bi->flags &BLK_INTEGRITY_VERIFY ) !=0 ); +return sysfs_emit (page,"%d\n" , !!(bi->flags &BLK_INTEGRITY_VERIFY )); } static ssize_t integrity_generate_store(struct blk_integrity *bi,
@@ -299,13 +298,13 @@ static ssize_t integrity_generate_store(struct blk_integrity *bi,static ssize_t integrity_generate_show (struct blk_integrity *bi,char *page) { -return sprintf (page,"%d\n" , (bi->flags &BLK_INTEGRITY_GENERATE ) !=0 ); +return sysfs_emit (page,"%d\n" , !!(bi->flags &BLK_INTEGRITY_GENERATE )); }static ssize_t integrity_device_show (struct blk_integrity *bi,char *page) { -return sprintf (page,"%u\n" , - (bi->flags &BLK_INTEGRITY_DEVICE_CAPABLE ) !=0 ); +return sysfs_emit (page,"%u\n" , + !!(bi->flags &BLK_INTEGRITY_DEVICE_CAPABLE )); }static struct integrity_sysfs_entry integrity_format_entry = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 511/798 blk-integrity: convert to struct device_attribute
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
Upstream commit 76b8c319f02715e14abdbbbdd6508e83a1059bcc.
An upcoming patch will register the integrity attributes directly with the struct device kobject.
For this the attributes have to be implemented in terms of struct device_attribute.
--- block/blk-integrity.c | 127 +++++++++++++++++++++--------------------- 1 file changed, 62 insertions(+), 65 deletions(-)
block/blk-integrity.c +62 -65
@@ -212,21 +212,15 @@ bool blk_integrity_merge_bio(struct request_queue *q, struct request *req,return true; } -struct integrity_sysfs_entry { -struct attribute attr; -ssize_t (*show)(struct blk_integrity *,char *); -ssize_t (*store)(struct blk_integrity *,const char *,size_t ); -}; -static ssize_t integrity_attr_show (struct kobject *kobj,struct attribute *attr,char *page) { struct gendisk *disk = container_of(kobj, struct gendisk, integrity_kobj); -struct blk_integrity *bi = &disk->queue->integrity; -struct integrity_sysfs_entry *entry = - container_of(attr, struct integrity_sysfs_entry, attr); +struct device *dev =disk_to_dev (disk); +struct device_attribute *dev_attr = + container_of(attr, struct device_attribute, attr); -return entry->show (bi, page); +return dev_attr->show (dev, dev_attr, page); } static ssize_t integrity_attr_store(struct kobject *kobj,
@@ -234,38 +228,53 @@ static ssize_t integrity_attr_store(struct kobject *kobj, size_t count) { struct gendisk *disk = container_of(kobj, struct gendisk, integrity_kobj); -struct blk_integrity *bi = &disk->queue->integrity; -struct integrity_sysfs_entry *entry = - container_of(attr, struct integrity_sysfs_entry, attr); -ssize_t ret =0 ; +struct device *dev =disk_to_dev (disk); +struct device_attribute *dev_attr = + container_of(attr, struct device_attribute, attr); -if (entry->store) - ret = entry->store (bi, page, count); +if (!dev_attr->store) +return 0 ; +return dev_attr->store (dev, dev_attr, page, count); +} -return ret; +static inline struct blk_integrity *dev_to_bi (struct device *dev) +{ +return &dev_to_disk (dev)->queue->integrity; } -static ssize_t integrity_format_show (struct blk_integrity *bi,char *page) +static ssize_t format_show (struct device *dev,struct device_attribute *attr, +char *page) { +struct blk_integrity *bi =dev_to_bi (dev); +if (bi->profile && bi->profile->name)return sysfs_emit (page,"%s\n" , bi->profile->name);return sysfs_emit (page,"none\n" ); } -static ssize_t integrity_tag_size_show (struct blk_integrity *bi,char *page) +static ssize_t tag_size_show (struct device *dev,struct device_attribute *attr, +char *page) { +struct blk_integrity *bi =dev_to_bi (dev); +return sysfs_emit (page,"%u\n" , bi->tag_size); } -static ssize_t integrity_interval_show (struct blk_integrity *bi,char *page) +static ssize_t protection_interval_bytes_show (struct device *dev, +struct device_attribute *attr, +char *page) { +struct blk_integrity *bi =dev_to_bi (dev); +return sysfs_emit (page,"%u\n" , bi->interval_exp ?1 << bi->interval_exp :0 ); } -static ssize_t integrity_verify_store (struct blk_integrity *bi, -const char *page,size_t count) +static ssize_t read_verify_store (struct device *dev, +struct device_attribute *attr, +const char *page,size_t count) { +struct blk_integrity *bi =dev_to_bi (dev);char *p = (char *) page;unsigned long val =simple_strtoul (p, &p,10 );
@@ -277,14 +286,20 @@ static ssize_t integrity_verify_store(struct blk_integrity *bi,return count; } -static ssize_t integrity_verify_show (struct blk_integrity *bi,char *page) +static ssize_t read_verify_show (struct device *dev, +struct device_attribute *attr,char *page) { +struct blk_integrity *bi =dev_to_bi (dev); +return sysfs_emit (page,"%d\n" , !!(bi->flags &BLK_INTEGRITY_VERIFY )); } -static ssize_t integrity_generate_store (struct blk_integrity *bi, -const char *page,size_t count) +static ssize_t write_generate_store (struct device *dev, +struct device_attribute *attr, +const char *page,size_t count) { +struct blk_integrity *bi =dev_to_bi (dev); +char *p = (char *) page;unsigned long val =simple_strtoul (p, &p,10 );
@@ -296,57 +311,39 @@ static ssize_t integrity_generate_store(struct blk_integrity *bi,return count; } -static ssize_t integrity_generate_show (struct blk_integrity *bi,char *page) +static ssize_t write_generate_show (struct device *dev, +struct device_attribute *attr,char *page) { +struct blk_integrity *bi =dev_to_bi (dev); +return sysfs_emit (page,"%d\n" , !!(bi->flags &BLK_INTEGRITY_GENERATE )); } -static ssize_t integrity_device_show (struct blk_integrity *bi,char *page) +static ssize_t device_is_integrity_capable_show (struct device *dev, +struct device_attribute *attr, +char *page) { +struct blk_integrity *bi =dev_to_bi (dev); +return sysfs_emit (page,"%u\n" , !!(bi->flags &BLK_INTEGRITY_DEVICE_CAPABLE )); } -static struct integrity_sysfs_entry integrity_format_entry = { - .attr = { .name ="format" , .mode =0444 }, - .show = integrity_format_show, -}; - -static struct integrity_sysfs_entry integrity_tag_size_entry = { - .attr = { .name ="tag_size" , .mode =0444 }, - .show = integrity_tag_size_show, -}; - -static struct integrity_sysfs_entry integrity_interval_entry = { - .attr = { .name ="protection_interval_bytes" , .mode =0444 }, - .show = integrity_interval_show, -}; - -static struct integrity_sysfs_entry integrity_verify_entry = { - .attr = { .name ="read_verify" , .mode =0644 }, - .show = integrity_verify_show, - .store = integrity_verify_store, -}; - -static struct integrity_sysfs_entry integrity_generate_entry = { - .attr = { .name ="write_generate" , .mode =0644 }, - .show = integrity_generate_show, - .store = integrity_generate_store, -}; - -static struct integrity_sysfs_entry integrity_device_entry = { - .attr = { .name ="device_is_integrity_capable" , .mode =0444 }, - .show = integrity_device_show, -}; +static DEVICE_ATTR_RO (format); +static DEVICE_ATTR_RO (tag_size); +static DEVICE_ATTR_RO (protection_interval_bytes); +static DEVICE_ATTR_RW (read_verify); +static DEVICE_ATTR_RW (write_generate); +static DEVICE_ATTR_RO (device_is_integrity_capable);static struct attribute *integrity_attrs[] = { - &integrity_format_entry.attr, - &integrity_tag_size_entry.attr, - &integrity_interval_entry.attr, - &integrity_verify_entry.attr, - &integrity_generate_entry.attr, - &integrity_device_entry.attr, -NULL , + &dev_attr_format.attr, + &dev_attr_tag_size.attr, + &dev_attr_protection_interval_bytes.attr, + &dev_attr_read_verify.attr, + &dev_attr_write_generate.attr, + &dev_attr_device_is_integrity_capable.attr, +NULL };ATTRIBUTE_GROUPS (integrity);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 512/798 blk-integrity: register sysfs attributes on struct device
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
Upstream commit ff53cd52d9bdbf4074d2bbe9b591729997780bd3.
The "integrity" kobject only acted as a holder for static sysfs entries. It also was embedded into struct gendisk without managing it, violating assumptions of the driver core.
Instead register the sysfs entries directly onto the struct device.
Also drop the now unused member integrity_kobj from struct gendisk.
--- block/blk-integrity.c | 55 +++--------------------------------------- block/blk.h | 10 +------- block/genhd.c | 12 +++------ include/linux/blkdev.h | 3 --- 4 files changed, 8 insertions(+), 72 deletions(-)
block/blk-integrity.c +3 -52
@@ -212,31 +212,6 @@ bool blk_integrity_merge_bio(struct request_queue *q, struct request *req,return true; } -static ssize_t integrity_attr_show (struct kobject *kobj,struct attribute *attr, -char *page) -{ - struct gendisk *disk = container_of(kobj, struct gendisk, integrity_kobj); -struct device *dev =disk_to_dev (disk); -struct device_attribute *dev_attr = - container_of(attr, struct device_attribute, attr); - -return dev_attr->show (dev, dev_attr, page); -} - -static ssize_t integrity_attr_store (struct kobject *kobj, -struct attribute *attr,const char *page, -size_t count) -{ - struct gendisk *disk = container_of(kobj, struct gendisk, integrity_kobj); -struct device *dev =disk_to_dev (disk); -struct device_attribute *dev_attr = - container_of(attr, struct device_attribute, attr); - -if (!dev_attr->store) -return 0 ; -return dev_attr->store (dev, dev_attr, page, count); -} -static inline struct blk_integrity *dev_to_bi (struct device *dev) {return &dev_to_disk (dev)->queue->integrity;
@@ -345,16 +320,10 @@ static struct attribute *integrity_attrs[] = { &dev_attr_device_is_integrity_capable.attr, NULL }; -ATTRIBUTE_GROUPS (integrity); -static const struct sysfs_ops integrity_ops = { - .show = &integrity_attr_show, - .store = &integrity_attr_store, -}; - -static struct kobj_type integrity_ktype = { - .default_groups = integrity_groups, - .sysfs_ops = &integrity_ops, +const struct attribute_group blk_integrity_attr_group = { + .name ="integrity" , + .attrs = integrity_attrs, };static blk_status_t blk_integrity_nop_fn (struct blk_integrity_iter *iter)
@@ -431,21 +400,3 @@ void blk_integrity_unregister(struct gendisk *disk)memset (bi,0 ,sizeof (*bi)); }EXPORT_SYMBOL (blk_integrity_unregister); - -int blk_integrity_add (struct gendisk *disk) -{ -int ret; - - ret =kobject_init_and_add (&disk->integrity_kobj, &integrity_ktype, - &disk_to_dev (disk)->kobj,"%s" ,"integrity" ); -if (!ret) -kobject_uevent (&disk->integrity_kobj,KOBJ_ADD ); -return ret; -} - -void blk_integrity_del (struct gendisk *disk) -{ -kobject_uevent (&disk->integrity_kobj,KOBJ_REMOVE ); -kobject_del (&disk->integrity_kobj); -kobject_put (&disk->integrity_kobj); -}
block/blk.h +1 -9
@@ -212,8 +212,7 @@ static inline bool integrity_req_gap_front_merge(struct request *req, bip_next->bip_vec[0].bv_offset); } -int blk_integrity_add (struct gendisk *disk); -void blk_integrity_del (struct gendisk *); +extern const struct attribute_group blk_integrity_attr_group;#else /* CONFIG_BLK_DEV_INTEGRITY */ static inline bool blk_integrity_merge_rq (struct request_queue *rq,struct request *r1,struct request *r2)
@@ -246,13 +245,6 @@ static inline bool bio_integrity_endio(struct bio *bio)static inline void bio_integrity_free (struct bio *bio) { } -static inline int blk_integrity_add (struct gendisk *disk) -{ -return 0 ; -} -static inline void blk_integrity_del (struct gendisk *disk) -{ -}#endif /* CONFIG_BLK_DEV_INTEGRITY */ unsigned long blk_rq_timeout (unsigned long timeout);
block/genhd.c +4 -8
@@ -489,15 +489,11 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk,*/ pm_runtime_set_memalloc_noio (ddev, true); - ret =blk_integrity_add (disk); -if (ret) - goto out_del_block_link; - disk->part0->bd_holder_dir =kobject_create_and_add ("holders" , &ddev->kobj);if (!disk->part0->bd_holder_dir) { ret = -ENOMEM ; - goto out_del_integrity; + goto out_del_block_link; } disk->slave_dir =kobject_create_and_add ("slaves" , &ddev->kobj);if (!disk->slave_dir) {
@@ -564,8 +560,6 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk, disk->slave_dir =NULL ; out_put_holder_dir:kobject_put (disk->part0->bd_holder_dir); -out_del_integrity: -blk_integrity_del (disk); out_del_block_link:if (!sysfs_deprecated)sysfs_remove_link (block_depr,dev_name (ddev));
@@ -624,7 +618,6 @@ void del_gendisk(struct gendisk *disk)if (WARN_ON_ONCE (!disk_live (disk) && !(disk->flags &GENHD_FL_HIDDEN )))return ; -blk_integrity_del (disk);disk_del_events (disk);mutex_lock (&disk->open_mutex);
@@ -1160,6 +1153,9 @@ static const struct attribute_group *disk_attr_groups[] = { &disk_attr_group,#ifdef CONFIG_BLK_DEV_IO_TRACE &blk_trace_attr_group, +#endif +#ifdef CONFIG_BLK_DEV_INTEGRITY + &blk_integrity_attr_group, #endifNULL };
include/linux/blkdev.h +0 -3
@@ -163,9 +163,6 @@ struct gendisk {struct timer_rand_state *random;atomic_t sync_io;/* RAID */ struct disk_events *ev; -#ifdef CONFIG_BLK_DEV_INTEGRITY -struct kobject integrity_kobj; -#endif /* CONFIG_BLK_DEV_INTEGRITY */ #ifdef CONFIG_BLK_DEV_ZONED /*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 513/798 spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit b6e05ba0844139dde138625906015c974c86aa93 ]
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/spi/spi-imx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-imx.c +1 -1
@@ -1856,8 +1856,8 @@ static int spi_imx_probe(struct platform_device *pdev)spi_imx_sdma_exit (spi_imx); out_runtime_pm_put:pm_runtime_dont_use_autosuspend (spi_imx->dev); -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (spi_imx->dev); +pm_runtime_set_suspended (&pdev->dev);clk_disable_unprepare (spi_imx->clk_ipg); out_put_per:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 514/798 spi: s3c64xx: fix timeout counters in flush_fifo
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Dooks <[email protected]>
[ Upstream commit 68a16708d2503b6303d67abd43801e2ca40c208d ]
In the s3c64xx_flush_fifo() code, the loops counter is post-decremented in the do { } while(test && loops--) condition. This means the loops is left at the unsigned equivalent of -1 if the loop times out. The test after will never pass as if tests for loops == 0.
--- drivers/spi/spi-s3c64xx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/spi-s3c64xx.c +2 -2
@@ -219,7 +219,7 @@ static void s3c64xx_flush_fifo(struct s3c64xx_spi_driver_data *sdd) loops =msecs_to_loops (1 );do { val =readl (regs +S3C64XX_SPI_STATUS ); - }while (TX_FIFO_LVL (val, sdd) && loops--); + }while (TX_FIFO_LVL (val, sdd) && --loops);if (loops ==0 )dev_warn (&sdd->pdev->dev,"Timed out flushing TX FIFO\n" );
@@ -232,7 +232,7 @@ static void s3c64xx_flush_fifo(struct s3c64xx_spi_driver_data *sdd)readl (regs +S3C64XX_SPI_RX_DATA ); else break; - }while (loops--); + }while (--loops);if (loops ==0 )dev_warn (&sdd->pdev->dev,"Timed out flushing RX FIFO\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 515/798 selftests: breakpoints: use remaining time to check if suspend succeed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifei Liu <[email protected]>
[ Upstream commit c66be905cda24fb782b91053b196bd2e966f95b7 ]
step_after_suspend_test fails with device busy error while writing to /sys/power/state to start suspend. The test believes it failed to enter suspend state with
$ sudo ./step_after_suspend_test TAP version 13 Bail out! Failed to enter Suspend state
However, in the kernel message, I indeed see the system get suspended and then wake up later.
[611172.033108] PM: suspend entry (s2idle) [611172.044940] Filesystems sync: 0.006 seconds [611172.052254] Freezing user space processes [611172.059319] Freezing user space processes completed (elapsed 0.001 seconds) [611172.067920] OOM killer disabled. [611172.072465] Freezing remaining freezable tasks [611172.080332] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [611172.089724] printk: Suspending console(s) (use no_console_suspend to debug) [611172.117126] serial 00:03: disabled some other hardware get reconnected [611203.136277] OOM killer enabled. [611203.140637] Restarting tasks ... [611203.141135] usb 1-8.1: USB disconnect, device number 7 [611203.141755] done. [611203.155268] random: crng reseeded on system resumption [611203.162059] PM: suspend exit
After investigation, I noticed that for the code block if (write(power_state_fd, "mem", strlen("mem")) != strlen("mem"))
ksft_exit_fail_msg("Failed to enter Suspend state\n");The write will return -1 and errno is set to 16 (device busy). It should be caused by the write function is not successfully returned before the system suspend and the return value get messed when waking up. As a result, It may be better to check the time passed of those few instructions to determine whether the suspend is executed correctly for it is pretty hard to execute those few lines for 5 seconds.
The timer to wake up the system is set to expire after 5 seconds and no re-arm. If the timer remaining time is 0 second and 0 nano secomd, it means the timer expired and wake the system up. Otherwise, the system could be considered to enter the suspend state failed if there is any remaining time.
After appling this patch, the test would not fail for it believes the system does not go to suspend by mistake. It now could continue to the rest part of the test after suspend.
--- .../testing/selftests/breakpoints/step_after_suspend_test.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/testing/selftests/breakpoints/step_after_suspend_test.c +4 -1
@@ -153,7 +153,10 @@ void suspend(void)if (err <0 )ksft_exit_fail_msg ("timerfd_settime() failed\n" ); -if (write (power_state_fd,"mem" ,strlen ("mem" )) !=strlen ("mem" )) +system ("(echo mem > /sys/power/state) 2> /dev/null" ); + +timerfd_gettime (timerfd, &spec); +if (spec.it_value.tv_sec !=0 || spec.it_value.tv_nsec !=0 )ksft_exit_fail_msg ("Failed to enter Suspend state\n" );close (timerfd);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 516/798 selftests: vDSO: fix vDSO name for powerpc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 59eb856c3ed9b3552befd240c0c339f22eed3fa1 ]
Following error occurs when running vdso_test_correctness on powerpc:
~ # ./vdso_test_correctness
[WARN] failed to find vDSO
[SKIP] No vDSO, so skipping clock_gettime() tests
[SKIP] No vDSO, so skipping clock_gettime64() tests
[RUN] Testing getcpu...
[OK] CPU 0: syscall: cpu 0, node 0
On powerpc, vDSO is neither called linux-vdso.so.1 nor linux-gate.so.1 but linux-vdso32.so.1 or linux-vdso64.so.1.
Also search those two names before giving up.
--- tools/testing/selftests/vDSO/vdso_test_correctness.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/vDSO/vdso_test_correctness.c +6 -0
@@ -114,6 +114,12 @@ static void fill_function_pointers()if (!vdso) vdso =dlopen ("linux-gate.so.1" ,RTLD_LAZY |RTLD_LOCAL |RTLD_NOLOAD ); +if (!vdso) + vdso =dlopen ("linux-vdso32.so.1" , +RTLD_LAZY |RTLD_LOCAL |RTLD_NOLOAD ); +if (!vdso) + vdso =dlopen ("linux-vdso64.so.1" , +RTLD_LAZY |RTLD_LOCAL |RTLD_NOLOAD );if (!vdso) {printf ("[WARN]\tfailed to find vDSO\n" );return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 517/798 selftests: vDSO: fix vdso_config for powerpc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 7d297c419b08eafa69ce27243ee9bbecab4fcaa4 ]
Running vdso_test_correctness on powerpc64 gives the following warning:
~ # ./vdso_test_correctness
Warning: failed to find clock_gettime64 in vDSO
This is because vdso_test_correctness was built with VDSO_32BIT defined.
__powerpc__ macro is defined on both powerpc32 and powerpc64 so __powerpc64__ needs to be checked first in vdso_config.h
--- tools/testing/selftests/vDSO/vdso_config.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/vDSO/vdso_config.h +3 -3
@@ -18,13 +18,13 @@#elif defined(__aarch64__)#define VDSO_VERSION 3#define VDSO_NAMES 0 -#elif defined(__powerpc__) +#elif defined(__powerpc64__)#define VDSO_VERSION 1#define VDSO_NAMES 0 -#define VDSO_32BIT 1 -#elif defined(__powerpc64__) +#elif defined(__powerpc__)#define VDSO_VERSION 1#define VDSO_NAMES 0 +#define VDSO_32BIT 1#elif defined (__s390__)#define VDSO_VERSION 2#define VDSO_NAMES 0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 518/798 selftests: vDSO: fix vDSO symbols lookup for powerpc64
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit ba83b3239e657469709d15dcea5f9b65bf9dbf34 ]
On powerpc64, following tests fail locating vDSO functions:
~ # ./vdso_test_abi
TAP version 13
1..16
# [vDSO kselftest] VDSO_VERSION: LINUX_2.6.15 # Couldn't find __kernel_gettimeofday
ok 1 # SKIP __kernel_gettimeofday
# clock_id: CLOCK_REALTIME
# Couldn't find __kernel_clock_gettime
ok 2 # SKIP __kernel_clock_gettime CLOCK_REALTIME # Couldn't find __kernel_clock_getres
ok 3 # SKIP __kernel_clock_getres CLOCK_REALTIME
...
# Couldn't find __kernel_time
ok 16 # SKIP __kernel_time
# Totals: pass:0 fail:0 xfail:0 xpass:0 skip:16 error:0
~ # ./vdso_test_getrandom
__kernel_getrandom is missing!
~ # ./vdso_test_gettimeofday
Could not find __kernel_gettimeofday
~ # ./vdso_test_getcpu
Could not find __kernel_getcpu
On powerpc64, as shown below by readelf, vDSO functions symbols have type NOTYPE, so also accept that type when looking for symbols.
$ powerpc64-linux-gnu-readelf -a arch/powerpc/kernel/vdso/vdso64.so.dbg ELF Header: Magic: 7f 45 4c 46 02 02 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, big endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: DYN (Shared object file) Machine: PowerPC64 Version: 0x1 ...
Symbol table '.dynsym' contains 12 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND
1: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
2: 00000000000005f0 36 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
3: 0000000000000578 68 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
4: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15
5: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
6: 0000000000000614 172 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
7: 00000000000006f0 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
8: 000000000000047c 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
9: 0000000000000454 12 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
10: 00000000000004d0 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
11: 00000000000005bc 52 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15Symbol table '.symtab' contains 56 entries:
Num: Value Size Type Bind Vis Ndx Name
...
45: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15
46: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __kernel_getcpu
47: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __kernel_clock_getres
48: 00000000000005f0 36 NOTYPE GLOBAL DEFAULT 8 __kernel_get_tbfreq
49: 000000000000047c 84 NOTYPE GLOBAL DEFAULT 8 __kernel_gettimeofday
50: 0000000000000614 172 NOTYPE GLOBAL DEFAULT 8 __kernel_sync_dicache
51: 00000000000006f0 84 NOTYPE GLOBAL DEFAULT 8 __kernel_getrandom
52: 0000000000000454 12 NOTYPE GLOBAL DEFAULT 8 __kernel_sigtram[...]
53: 0000000000000578 68 NOTYPE GLOBAL DEFAULT 8 __kernel_time
54: 00000000000004d0 84 NOTYPE GLOBAL DEFAULT 8 __kernel_clock_g[...]
55: 00000000000005bc 52 NOTYPE GLOBAL DEFAULT 8 __kernel_get_sys[...]--- tools/testing/selftests/vDSO/parse_vdso.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/vDSO/parse_vdso.c +2 -1
@@ -216,7 +216,8 @@ void *vdso_sym(const char *version, const char *name)ELF (Sym) *sym = &vdso_info.symtab[chain];/* Check for a defined global or weak function w/ right name. */ -if (ELF64_ST_TYPE (sym->st_info) !=STT_FUNC ) +if (ELF64_ST_TYPE (sym->st_info) !=STT_FUNC && +ELF64_ST_TYPE (sym->st_info) !=STT_NOTYPE )continue ;if (ELF64_ST_BIND (sym->st_info) !=STB_GLOBAL &&ELF64_ST_BIND (sym->st_info) !=STB_WEAK )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 519/798 selftests/mm: fix charge_reserved_hugetlb.sh test
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit c41a701d18efe6b8aa402efab16edbaba50c9548 ]
Currently, running the charge_reserved_hugetlb.sh selftest we can sometimes observe something like:
$ ./charge_reserved_hugetlb.sh -cgroup-v2 ... write_result is 0 After write: hugetlb_usage=0 reserved_usage=10485760 killing write_to_hugetlbfs Received 2. Deleting the memory Detach failure: Invalid argument umount: /mnt/huge: target is busy.
Both cases are issues in the test.
While the unmount error seems to be racy, it will make the test fail:
$ ./run_vmtests.sh -t hugetlb ... # [FAIL] not ok 10 charge_reserved_hugetlb.sh -cgroup-v2 # exit=32
The issue is that we are not waiting for the write_to_hugetlbfs process to quit. So it might still have a hugetlbfs file open, about which umount is not happy. Fix that by making "killall" wait for the process to quit.
The other error ("Detach failure: Invalid argument") does not seem to result in a test error, but is misleading. Turns out write_to_hugetlbfs.c unconditionally tries to cleanup using shmdt(), even when we only mmap()'ed a hugetlb file. Even worse, shmaddr is never even set for the SHM case. Fix that as well.
With this change it seems to work as expected.
--- .../selftests/vm/charge_reserved_hugetlb.sh | 2 +- .../testing/selftests/vm/write_to_hugetlbfs.c | 21 +++++++++++-------- 2 files changed, 13 insertions(+), 10 deletions(-)
tools/testing/selftests/vm/charge_reserved_hugetlb.sh +1 -1
@@ -252,7 +252,7 @@ function cleanup_hugetlb_memory() { local cgroup="$1" if [[ "$(pgrep -f write_to_hugetlbfs)" != "" ]]; then echo killing write_to_hugetlbfs - killall -2 write_to_hugetlbfs + killall -2 --wait write_to_hugetlbfs wait_for_hugetlb_memory_to_get_depleted $cgroup fi set -e
tools/testing/selftests/vm/write_to_hugetlbfs.c +12 -9
@@ -28,7 +28,7 @@ enum method {/* Global variables. */ static const char *self; -static char *shmaddr; +static int *shmaddr;static int shmid;/*
@@ -47,15 +47,17 @@ void sig_handler(int signo) {printf ("Received %d.\n" , signo);if (signo ==SIGINT ) { -printf ("Deleting the memory\n" ); -if (shmdt ((const void *)shmaddr) !=0 ) { -perror ("Detach failure" ); +if (shmaddr) { +printf ("Deleting the memory\n" ); +if (shmdt ((const void *)shmaddr) !=0 ) { +perror ("Detach failure" ); +shmctl (shmid,IPC_RMID ,NULL ); +exit (4 ); + } +shmctl (shmid,IPC_RMID ,NULL ); -exit (4 ); +printf ("Done deleting the memory\n" ); } - -shmctl (shmid,IPC_RMID ,NULL ); -printf ("Done deleting the memory\n" ); }exit (2 ); }
@@ -211,7 +213,8 @@ int main(int argc, char **argv)shmctl (shmid,IPC_RMID ,NULL );exit (2 ); } -printf ("shmaddr: %p\n" , ptr); + shmaddr = ptr; +printf ("shmaddr: %p\n" , shmaddr);break ;default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 520/798 powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit c73049389e58c01e2e3bbfae900c8daeee177191 ]
When running in a non-root time namespace, the global VDSO data page is replaced by a dedicated namespace data page and the global data page is mapped next to it. Detailed explanations can be found at commit 660fd04f9317 ("lib/vdso: Prepare for time namespace support").
When it happens, __kernel_get_syscall_map and __kernel_get_tbfreq and __kernel_sync_dicache don't work anymore because they read 0 instead of the data they need.
To address that, clock_mode has to be read. When it is set to VDSO_CLOCKMODE_TIMENS, it means it is a dedicated namespace data page and the global data is located on the following page.
Add a macro called get_realdatapage which reads clock_mode and add PAGE_SIZE to the pointer provided by get_datapage macro when clock_mode is equal to VDSO_CLOCKMODE_TIMENS. Use this new macro instead of get_datapage macro except for time functions as they handle it internally.
--- arch/powerpc/include/asm/vdso_datapage.h | 15 +++++++++++++++ arch/powerpc/kernel/asm-offsets.c | 2 ++ arch/powerpc/kernel/vdso/cacheflush.S | 2 +- arch/powerpc/kernel/vdso/datapage.S | 4 ++-- 4 files changed, 20 insertions(+), 3 deletions(-)
arch/powerpc/include/asm/vdso_datapage.h +15 -0
@@ -111,6 +111,21 @@ extern struct vdso_arch_data *vdso_data; addi \ptr, \ptr, (_vdso_datapage - 999b)@l .endm +#include <asm/asm-offsets.h> +#include <asm/page.h> + +.macro get_realdatapage ptr scratch + get_datapage \ptr +#ifdef CONFIG_TIME_NS + lwz \scratch, VDSO_CLOCKMODE_OFFSET(\ptr) + xoris \scratch, \scratch, VDSO_CLOCKMODE_TIMENS@h + xori \scratch, \scratch, VDSO_CLOCKMODE_TIMENS@l + cntlzw \scratch, \scratch + rlwinm \scratch, \scratch, PAGE_SHIFT - 5, 1 << PAGE_SHIFT + add \ptr, \ptr, \scratch +#endif +.endm + #endif /* __ASSEMBLY__ */ #endif /* __KERNEL__ */
arch/powerpc/kernel/asm-offsets.c +2 -0
@@ -347,6 +347,8 @@ int main(void)#else OFFSET (CFG_SYSCALL_MAP32 , vdso_arch_data, syscall_map);#endif +OFFSET (VDSO_CLOCKMODE_OFFSET , vdso_arch_data, data[0 ].clock_mode); +DEFINE (VDSO_CLOCKMODE_TIMENS ,VDSO_CLOCKMODE_TIMENS );#ifdef CONFIG_BUG DEFINE (BUG_ENTRY_SIZE ,sizeof (struct bug_entry ));
arch/powerpc/kernel/vdso/cacheflush.S +1 -1
@@ -30,7 +30,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) #ifdef CONFIG_PPC64 mflr r12 .cfi_register lr,r12 - get_datapage r10 + get_realdatapage r10, r11 mtlr r12 .cfi_restore lr #endif
arch/powerpc/kernel/vdso/datapage.S +2 -2
@@ -28,7 +28,7 @@ V_FUNCTION_BEGIN(__kernel_get_syscall_map) mflr r12 .cfi_register lr,r12 mr. r4,r3 - get_datapage r3 + get_realdatapage r3, r11 mtlr r12 #ifdef __powerpc64__ addi r3,r3,CFG_SYSCALL_MAP64
@@ -52,7 +52,7 @@ V_FUNCTION_BEGIN(__kernel_get_tbfreq) .cfi_startproc mflr r12 .cfi_register lr,r12 - get_datapage r3 + get_realdatapage r3, r11 #ifndef __powerpc64__ lwz r4,(CFG_TB_TICKS_PER_SEC + 4)(r3) #endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 521/798 selftests: vDSO: fix ELF hash table entry size for s390x
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Remus <[email protected]>
[ Upstream commit 14be4e6f35221c4731b004553ecf7cbc6dc1d2d8 ]
The vDSO self tests fail on s390x for a vDSO linked with the GNU linker ld as follows:
# ./vdso_test_gettimeofday Floating point exception (core dumped)
On s390x the ELF hash table entries are 64 bits instead of 32 bits in size (see Glibc sysdeps/unix/sysv/linux/s390/bits/elfclass.h).
--- tools/testing/selftests/vDSO/parse_vdso.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
tools/testing/selftests/vDSO/parse_vdso.c +10 -4
@@ -36,6 +36,12 @@#define ELF_BITS_XFORM (bits, x) ELF_BITS_XFORM2(bits, x)#define ELF (x) ELF_BITS_XFORM(ELF_BITS, x) +#ifdef __s390x__ +#define ELF_HASH_ENTRY ELF(Xword) +#else +#define ELF_HASH_ENTRY ELF(Word) +#endif + static struct vdso_info { bool valid;
@@ -47,8 +53,8 @@ static struct vdso_info/* Symbol table */ ELF (Sym) *symtab;const char *symstrings; -ELF (Word) *bucket, *chain; -ELF (Word) nbucket, nchain; +ELF_HASH_ENTRY *bucket, *chain; +ELF_HASH_ENTRY nbucket, nchain;/* Version table */ ELF (Versym) *versym;
@@ -115,7 +121,7 @@ void vdso_init_from_sysinfo_ehdr(uintptr_t base)/* * Fish out the useful bits of the dynamic table. */ -ELF (Word) *hash =0 ; +ELF_HASH_ENTRY *hash =0 ; vdso_info.symstrings =0 ; vdso_info.symtab =0 ; vdso_info.versym =0 ;
@@ -133,7 +139,7 @@ void vdso_init_from_sysinfo_ehdr(uintptr_t base) + vdso_info.load_offset);break ;case DT_HASH : - hash = (ELF (Word) *) + hash = (ELF_HASH_ENTRY *) ((uintptr_t )dyn[i].d_un.d_ptr + vdso_info.load_offset);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 522/798 selftests: vDSO: fix vdso_config for s390
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit a6e23fb8d3c0e3904da70beaf5d7e840a983c97f ]
Running vdso_test_correctness on s390x (aka s390 64 bit) emits a warning:
Warning: failed to find clock_gettime64 in vDSO
This is caused by the "#elif defined (__s390__)" check in vdso_config.h which the defines VDSO_32BIT.
If __s390x__ is defined also __s390__ is defined. Therefore the correct check must make sure that only __s390__ is defined.
Therefore add the missing !defined(__s390x__). Also use common __s390x__ define instead of __s390X__.
--- tools/testing/selftests/vDSO/vdso_config.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/vDSO/vdso_config.h +2 -2
@@ -25,11 +25,11 @@#define VDSO_VERSION 1#define VDSO_NAMES 0#define VDSO_32BIT 1 -#elif defined (__s390__) +#elif defined (__s390__) && !defined(__s390x__)#define VDSO_VERSION 2#define VDSO_NAMES 0#define VDSO_32BIT 1 -#elif defined (__s390X__) +#elif defined (__s390x__)#define VDSO_VERSION 2#define VDSO_NAMES 0#elif defined(__mips__)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 523/798 Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 upstream.
This reverts commit 478689b5990deb626a0b3f1ebf165979914d6be4.
The fix seems leading to regressions for other systems. Also, the way to check the presence of IOMMU via get_dma_ops() isn't reliable and it's no longer applicable for 6.12. After all, it's no right fix, so let's revert it at first.
To be noted, the PCM buffer allocation has been changed to try the continuous pages at first since 6.12, so the problem could be already addressed without this hackish workaround.
--- sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_intel.c | 10 +--------- 2 files changed, 2 insertions(+), 10 deletions(-)
sound/pci/hda/hda_controller.h +1 -1
@@ -28,7 +28,7 @@#else #define AZX_DCAPS_I915_COMPONENT 0/* NOP */ #endif -#define AZX_DCAPS_AMD_ALLOC_FIX (1 << 14)/* AMD allocation workaround */ +/* 14 unused */ #define AZX_DCAPS_CTX_WORKAROUND (1 << 15)/* X-Fi workaround */ #define AZX_DCAPS_POSFIX_LPIB (1 << 16)/* Use LPIB as default */ #define AZX_DCAPS_AMD_WORKAROUND (1 << 17)/* AMD-specific workaround */
sound/pci/hda/hda_intel.c +1 -9
@@ -40,7 +40,6 @@#ifdef CONFIG_X86 /* for snoop control */ -#include <linux/dma-map-ops.h> #include <asm/set_memory.h> #include <asm/cpufeature.h> #endif
@@ -301,7 +300,7 @@ enum {/* quirks for ATI HDMI with snoop off */ #define AZX_DCAPS_PRESET_ATI_HDMI_NS \ - (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_AMD_ALLOC_FIX) + (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF)/* quirks for AMD SB */ #define AZX_DCAPS_PRESET_AMD_SB \
@@ -1719,13 +1718,6 @@ static void azx_check_snoop_available(stif (chip->driver_caps &AZX_DCAPS_SNOOP_OFF ) snoop = false; -#ifdef CONFIG_X86 -/* check the presence of DMA ops (i.e. IOMMU), disable snoop conditionally */ -if ((chip->driver_caps &AZX_DCAPS_AMD_ALLOC_FIX ) && - !get_dma_ops (chip->card->dev)) - snoop = false; -#endif - chip->snoop = snoop;if (!snoop) {dev_info (chip->card->dev,"Force to non-snoop mode\n" );
Greg Kroah-Hartman
maintainerPATCH 524/798 platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zach Wade <[email protected]>
commit 7d59ac07ccb58f8f604f8057db63b8efcebeb3de upstream.
Attaching SST PCI device to VM causes "BUG: KASAN: slab-out-of-bounds". kasan report:
[ 19.411889] ================================================================== [ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113 [ 19.417368] [ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10 [ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022 [ 19.422687] Call Trace: [ 19.424091] <TASK> [ 19.425448] dump_stack_lvl+0x5d/0x80 [ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.428694] print_report+0x19d/0x52e [ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.433539] kasan_report+0xf0/0x170 [ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10 [ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common] [ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common] [ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360 [ 19.444797] cpuhp_invoke_callback+0x221/0xec0 [ 19.446337] cpuhp_thread_fun+0x21b/0x610 [ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10 [ 19.449354] smpboot_thread_fn+0x2e7/0x6e0 [ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 19.452405] kthread+0x29c/0x350 [ 19.453817] ? __pfx_kthread+0x10/0x10 [ 19.455253] ret_from_fork+0x31/0x70 [ 19.456685] ? __pfx_kthread+0x10/0x10 [ 19.458114] ret_from_fork_asm+0x1a/0x30 [ 19.459573] </TASK> [ 19.460853] [ 19.462055] Allocated by task 1198: [ 19.463410] kasan_save_stack+0x30/0x50 [ 19.464788] kasan_save_track+0x14/0x30 [ 19.466139] __kasan_kmalloc+0xaa/0xb0 [ 19.467465] __kmalloc+0x1cd/0x470 [ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common] [ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr] [ 19.471670] do_one_initcall+0xa4/0x380 [ 19.472903] do_init_module+0x238/0x760 [ 19.474105] load_module+0x5239/0x6f00 [ 19.475285] init_module_from_file+0xd1/0x130 [ 19.476506] idempotent_init_module+0x23b/0x650 [ 19.477725] __x64_sys_finit_module+0xbe/0x130 [ 19.476506] idempotent_init_module+0x23b/0x650 [ 19.477725] __x64_sys_finit_module+0xbe/0x130 [ 19.478920] do_syscall_64+0x82/0x160 [ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 19.481292] [ 19.482205] The buggy address belongs to the object at ffff888829e65000 which belongs to the cache kmalloc-512 of size 512 [ 19.484818] The buggy address is located 0 bytes to the right of allocated 512-byte region [ffff888829e65000, ffff888829e65200) [ 19.487447] [ 19.488328] The buggy address belongs to the physical page: [ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60 [ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [ 19.493914] page_type: 0xffffffff() [ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff [ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 [ 19.503784] page dumped because: kasan: bad access detected [ 19.505058] [ 19.505970] Memory state around the buggy address: [ 19.507172] ffff888829e65100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.508599] ffff888829e65180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.510013] >ffff888829e65200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.510014] ^ [ 19.510016] ffff888829e65280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.510018] ffff888829e65300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.515367] ==================================================================
The reason for this error is physical_package_ids assigned by VMware VMM are not continuous and have gaps. This will cause value returned by topology_physical_package_id() to be more than topology_max_packages().
Here the allocation uses topology_max_packages(). The call to topology_max_packages() returns maximum logical package ID not physical ID. Hence use topology_logical_package_id() instead of topology_physical_package_id().
--- drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/speed_select_if/isst_if_common.c +3 -1
@@ -306,7 +306,9 @@ static struct pci_dev *_isst_if_get_pci_ cpu >= nr_cpu_ids || cpu >= num_possible_cpus())return NULL ; - pkg_id =topology_physical_package_id (cpu); + pkg_id =topology_logical_package_id (cpu); +if (pkg_id >=topology_max_packages ()) +return NULL ; bus_number = isst_cpu_info[cpu].bus_info[bus_no];if (bus_number <0 )
Greg Kroah-Hartman
maintainerPATCH 525/798 i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 048bbbdbf85e5e00258dfb12f5e368f908801d7b upstream.
In case there is any sort of clock controller attached to this I2C bus controller, for example Versaclock or even an AIC32x4 I2C codec, then an I2C transfer triggered from the clock controller clk_ops .prepare callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex.
This is because the clock controller first grabs the prepare_lock mutex and then performs the prepare operation, including its I2C access. The I2C access resumes this I2C bus controller via .runtime_resume callback, which calls clk_prepare_enable(), which attempts to grab the prepare_lock mutex again and deadlocks.
Since the clock are already prepared since probe() and unprepared in remove(), use simple clk_enable()/clk_disable() calls to enable and disable the clock on runtime suspend and resume, to avoid hitting the prepare_lock mutex.
--- drivers/i2c/busses/i2c-stm32f7.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/i2c/busses/i2c-stm32f7.c +3 -3
@@ -2353,7 +2353,7 @@ static int __maybe_unused stm32f7_i2c_rustruct stm32f7_i2c_dev *i2c_dev =dev_get_drvdata (dev);if (!stm32f7_i2c_is_slave_registered (i2c_dev)) -clk_disable_unprepare (i2c_dev->clk); +clk_disable (i2c_dev->clk);return 0 ; }
@@ -2364,9 +2364,9 @@ static int __maybe_unused stm32f7_i2c_ruint ret;if (!stm32f7_i2c_is_slave_registered (i2c_dev)) { - ret =clk_prepare_enable (i2c_dev->clk); + ret =clk_enable (i2c_dev->clk);if (ret) { -dev_err (dev,"failed to prepare_enable clock\n" ); +dev_err (dev,"failed to enable clock\n" );return ret; } }
Greg Kroah-Hartman
maintainerPATCH 526/798 i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit e2c85d85a05f16af2223fcc0195ff50a7938b372 upstream.
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/i2c/busses/i2c-qcom-geni.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/i2c/busses/i2c-qcom-geni.c +1 -3
@@ -821,15 +821,13 @@ static int geni_i2c_probe(struct platforinit_completion (&gi2c->done);spin_lock_init (&gi2c->lock);platform_set_drvdata (pdev, gi2c); - ret =devm_request_irq (dev, gi2c->irq, geni_i2c_irq,0 , + ret =devm_request_irq (dev, gi2c->irq, geni_i2c_irq,IRQF_NO_AUTOEN ,dev_name (dev), gi2c);if (ret) {dev_err (dev,"Request_irq failed:%d: err:%d\n" , gi2c->irq, ret);return ret; } -/* Disable the interrupt so that the system can enter low-power mode */ -disable_irq (gi2c->irq);i2c_set_adapdata (&gi2c->adap, gi2c); gi2c->adap.dev.parent = dev; gi2c->adap.dev.of_node = dev->of_node;
Greg Kroah-Hartman
maintainerPATCH 527/798 i2c: xiic: Wait for TX empty to avoid missed TX NAKs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Hancock <[email protected]>
commit 521da1e9225450bd323db5fa5bca942b1dc485b7 upstream.
Frequently an I2C write will be followed by a read, such as a register address write followed by a read of the register value. In this driver, when the TX FIFO half empty interrupt was raised and it was determined that there was enough space in the TX FIFO to send the following read command, it would do so without waiting for the TX FIFO to actually empty.
Unfortunately it appears that in some cases this can result in a NAK that was raised by the target device on the write, such as due to an unsupported register address, being ignored and the subsequent read being done anyway. This can potentially put the I2C bus into an invalid state and/or result in invalid read data being processed.
To avoid this, once a message has been fully written to the TX FIFO, wait for the TX FIFO empty interrupt before moving on to the next message, to ensure NAKs are handled properly.
--- drivers/i2c/busses/i2c-xiic.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/i2c/busses/i2c-xiic.c +9 -10
@@ -482,14 +482,17 @@ static irqreturn_t xiic_process(int irq, goto out; } -xiic_fill_tx_fifo (i2c); - -/* current message sent and there is space in the fifo */ -if (!xiic_tx_space (i2c) &&xiic_tx_fifo_space (i2c) >=2 ) { +if (xiic_tx_space (i2c)) { +xiic_fill_tx_fifo (i2c); + }else { +/* current message fully written */ dev_dbg (i2c->adap.dev.parent,"%s end of message sent, nmsgs: %d\n" , __func__, i2c->nmsgs); -if (i2c->nmsgs >1 ) { +/* Don't move onto the next message until the TX FIFO empties, +* to ensure that a NAK is not missed. +*/ +if (i2c->nmsgs >1 && (pend &XIIC_INTR_TX_EMPTY_MASK )) { i2c->nmsgs--; i2c->tx_msg++; xfer_more =1 ;
@@ -500,11 +503,7 @@ static irqreturn_t xiic_process(int irq,"%s Got TX IRQ but no more to do...\n" , __func__); } - }else if (!xiic_tx_space (i2c) && (i2c->nmsgs ==1 )) -/* current frame is sent and is last, -* make sure to disable tx half -*/ -xiic_irq_dis (i2c,XIIC_INTR_TX_HALF_MASK ); + } }if (pend &XIIC_INTR_BNB_MASK ) {
Greg Kroah-Hartman
maintainerPATCH 528/798 media: i2c: ar0521: Use cansleep version of gpiod_set_value()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <[email protected]>
commit bee1aed819a8cda47927436685d216906ed17f62 upstream.
If we use GPIO reset from I2C port expander, we must use *_cansleep() variant of GPIO functions.
This was not done in ar0521_power_on()/ar0521_power_off() functions. Let's fix that.
------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x74/0x7c Modules linked in: CPU: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.10.0 #53 Hardware name: Diasom DS-RK3568-SOM-EVB (DT) Workqueue: events_unbound deferred_probe_work_func pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : gpiod_set_value+0x74/0x7c lr : ar0521_power_on+0xcc/0x290
sp : ffffff8001d7ab70
x29: ffffff8001d7ab70 x28: ffffff80027dcc90 x27: ffffff8003c82000
x26: ffffff8003ca9250 x25: ffffffc080a39c60 x24: ffffff8003ca9088
x23: ffffff8002402720 x22: ffffff8003ca9080 x21: ffffff8003ca9088
x20: 0000000000000000 x19: ffffff8001eb2a00 x18: ffffff80efeeac80
x17: 756d2d6332692f30 x16: 0000000000000000 x15: 0000000000000000
x14: ffffff8001d91d40 x13: 0000000000000016 x12: ffffffc080e98930
x11: ffffff8001eb2880 x10: 0000000000000890 x9 : ffffff8001d7a9f0 x8 : ffffff8001d92570 x7 : ffffff80efeeac80 x6 : 000000003fc6e780 x5 : ffffff8001d91c80 x4 : 0000000000000002 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001
Call trace: gpiod_set_value+0x74/0x7c ar0521_power_on+0xcc/0x290
...
--- drivers/media/i2c/ar0521.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/i2c/ar0521.c +3 -2
@@ -718,7 +718,8 @@ static int ar0521_power_off(struct devicclk_disable_unprepare (sensor->extclk);if (sensor->reset_gpio) -gpiod_set_value (sensor->reset_gpio,1 );/* assert RESET signal */ +/* assert RESET signal */ +gpiod_set_value_cansleep (sensor->reset_gpio,1 );for (i =ARRAY_SIZE (ar0521_supply_names) -1 ; i >=0 ; i--) {if (sensor->supplies[i])
@@ -752,7 +753,7 @@ static int ar0521_power_on(struct deviceif (sensor->reset_gpio)/* deassert RESET signal */ -gpiod_set_value (sensor->reset_gpio,0 ); +gpiod_set_value_cansleep (sensor->reset_gpio,0 );usleep_range (4500 ,5000 );/* min 45000 clocks */ for (cnt =0 ; cnt <ARRAY_SIZE (initial_regs); cnt++) {
Greg Kroah-Hartman
maintainerPATCH 529/798 firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 9c3a62c20f7fb00294a4237e287254456ba8a48b upstream.
mbox_client_to_bpmp() is not used, W=1 builds:
drivers/firmware/tegra/bpmp.c:28:1: error: unused function 'mbox_client_to_bpmp' [-Werror,-Wunused-function]
--- drivers/firmware/tegra/bpmp.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/firmware/tegra/bpmp.c +0 -6
@@ -25,12 +25,6 @@#define MSG_RING BIT(1)#define TAG_SZ 32 -static inline struct tegra_bpmp * -mbox_client_to_bpmp (struct mbox_client *client) -{ - return container_of(client, struct tegra_bpmp, mbox.client); -} -static inline const struct tegra_bpmp_ops *channel_to_ops (struct tegra_bpmp_channel *channel) {
Greg Kroah-Hartman
maintainerPATCH 530/798 spi: bcm63xx: Fix module autoloading
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 909f34f2462a99bf876f64c5c61c653213e32fce upstream.
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table.
--- drivers/spi/spi-bcm63xx.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-bcm63xx.c +1 -0
@@ -476,6 +476,7 @@ static const struct platform_device_id b { }, }; +MODULE_DEVICE_TABLE (platform, bcm63xx_spi_dev_match);static const struct of_device_id bcm63xx_spi_of_match[] = { { .compatible ="brcm,bcm6348-spi" , .data = &bcm6348_spi_reg_offsets },
Greg Kroah-Hartman
maintainerPATCH 531/798 power: supply: hwmon: Fix missing temp1_max_alarm attribute
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit e50a57d16f897e45de1112eb6478577b197fab52 upstream.
Temp channel 0 aka temp1 can have a temp1_max_alarm attribute for power_supply devices which have a POWER_SUPPLY_PROP_TEMP_ALERT_MAX property.
HWMON_T_MAX_ALARM was missing from power_supply_hwmon_info for temp channel 0, causing the hwmon temp1_max_alarm attribute to be missing from such power_supply devices.
Add this to power_supply_hwmon_info to fix this.
--- drivers/power/supply/power_supply_hwmon.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/power_supply_hwmon.c +2 -1
@@ -299,7 +299,8 @@ static const struct hwmon_channel_info *HWMON_T_INPUT |HWMON_T_MAX |HWMON_T_MIN | -HWMON_T_MIN_ALARM , +HWMON_T_MIN_ALARM | +HWMON_T_MAX_ALARM ,HWMON_T_LABEL | HWMON_T_INPUT |
Greg Kroah-Hartman
maintainerPATCH 532/798 perf/core: Fix small negative period being ignored
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Gengkun <[email protected]>
commit 62c0b1061593d7012292f781f11145b2d46f43ab upstream.
In perf_adjust_period, we will first calculate period, and then use this period to calculate delta. However, when delta is less than 0, there will be a deviation compared to when delta is greater than or equal to 0. For example, when delta is in the range of [-14,-1], the range of delta = delta + 7 is between [-7,6], so the final value of delta/8 is 0. Therefore, the impact of -1 and -2 will be ignored. This is unacceptable when the target period is very short, because we will lose a lot of samples.
Here are some tests and analyzes:
before:
# perf record -e cs -F 1000 ./a.out [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.022 MB perf.data (518 samples) ]
# perf script ... a.out 396 257.956048: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.957891: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.959730: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.961545: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.963355: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.965163: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.966973: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.968785: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.970593: 23 cs: ffffffff81f4eeec schedul> ...
after:
# perf record -e cs -F 1000 ./a.out [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.058 MB perf.data (1466 samples) ]
# perf script ... a.out 395 59.338813: 11 cs: ffffffff81f4eeec schedul> a.out 395 59.339707: 12 cs: ffffffff81f4eeec schedul> a.out 395 59.340682: 13 cs: ffffffff81f4eeec schedul> a.out 395 59.341751: 13 cs: ffffffff81f4eeec schedul> a.out 395 59.342799: 12 cs: ffffffff81f4eeec schedul> a.out 395 59.343765: 11 cs: ffffffff81f4eeec schedul> a.out 395 59.344651: 11 cs: ffffffff81f4eeec schedul> a.out 395 59.345539: 12 cs: ffffffff81f4eeec schedul> a.out 395 59.346502: 13 cs: ffffffff81f4eeec schedul> ...
test.c
int main() {
for (int i = 0; i < 20000; i++)
usleep(10);
return 0;
}# time ./a.out real 0m1.583s user 0m0.040s sys 0m0.298s
The above results were tested on x86-64 qemu with KVM enabled using test.c as test program. Ideally, we should have around 1500 samples, but the previous algorithm had only about 500, whereas the modified algorithm now has about 1400. Further more, the new version shows 1 sample per 0.001s, while the previous one is 1 sample per 0.002s.This indicates that the new algorithm is more sensitive to small negative values compared to old algorithm.
--- kernel/events/core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/events/core.c +5 -1
@@ -4067,7 +4067,11 @@ static void perf_adjust_period(struct pe period =perf_calculate_period (event, nsec, count); delta = (s64)(period - hwc->sample_period); - delta = (delta +7 ) /8 ;/* low pass filter */ +if (delta >=0 ) + delta +=7 ; +else + delta -=7 ; + delta /=8 ;/* low pass filter */ sample_period = hwc->sample_period + delta;
Greg Kroah-Hartman
maintainerPATCH 533/798 parisc: Fix itlb miss handler for 64-bit programs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 9542130937e9dc707dd7c6b7af73326437da2d50 upstream.
For an itlb miss when executing code above 4 Gb on ILP64 adjust the iasq/iaoq in the same way isr/ior was adjusted. This fixes signal delivery for the 64-bit static test program from
http://ftp.parisc-linux.org/src/64bit.tar.gz. Note that signals are handled by the signal trampoline code in the 64-bit VDSO which is mapped into high userspace memory region above 4GB for 64-bit processes.
--- arch/parisc/kernel/entry.S | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
arch/parisc/kernel/entry.S +2 -4
@@ -1038,8 +1038,7 @@ ENTRY_CFI(intr_save) /* for os_hpmc */ STREG %r16, PT_ISR(%r29) STREG %r17, PT_IOR(%r29) -#if 0 && defined(CONFIG_64BIT) - /* Revisit when we have 64-bit code above 4Gb */ +#if defined(CONFIG_64BIT) b,n intr_save2 skip_save_ior:
@@ -1047,8 +1046,7 @@ skip_save_ior: * need to adjust iasq/iaoq here in the same way we adjusted isr/ior * above. */ - extrd,u,* %r8,PSW_W_BIT,1,%r1 - cmpib,COND(=),n 1,%r1,intr_save2 + bb,COND(>=),n %r8,PSW_W_BIT,intr_save2 LDREG PT_IASQ0(%r29), %r16 LDREG PT_IAOQ0(%r29), %r17 /* adjust iasq/iaoq */
Greg Kroah-Hartman
maintainerPATCH 534/798 drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit 8b0d2f61545545ab5eef923ed6e59fc3be2385e0 upstream.
FB_DAMAGE_CLIPS is a plane property for damage handling. Its UAPI should only use UAPI types. Hence replace struct drm_rect with struct drm_mode_rect in drm_atomic_plane_set_property(). Both types are identical in practice, so there's no change in behavior.
--- drivers/gpu/drm/drm_atomic_uapi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_atomic_uapi.c +1 -1
@@ -567,7 +567,7 @@ static int drm_atomic_plane_set_property &state->fb_damage_clips, val,-1 , -sizeof (struct drm_rect ), +sizeof (struct drm_mode_rect ), &replaced);return ret; }else if (property == plane->scaling_filter_property) {
Greg Kroah-Hartman
maintainerPATCH 535/798 ALSA: core: add isascii() check to card ID generator
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <[email protected]>
commit d278a9de5e1837edbe57b2f1f95a104ff6c84846 upstream.
The card identifier should contain only safe ASCII characters. The isalnum() returns true also for characters for non-ASCII characters.
--- sound/core/init.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
sound/core/init.c +10 -4
@@ -673,13 +673,19 @@ int snd_card_free(struct snd_card *card) }EXPORT_SYMBOL (snd_card_free); +/* check, if the character is in the valid ASCII range */ +static inline bool safe_ascii_char (char c) +{ +return isascii (c) &&isalnum (c); +} +/* retrieve the last word of shortname or longname */ static const char *retrieve_id_from_card_name (const char *name) {const char *spos = name;while (*name) { -if (isspace (*name) &&isalnum (name[1 ])) +if (isspace (*name) &&safe_ascii_char (name[1 ])) spos = name +1 ; name++; }
@@ -706,12 +712,12 @@ static void copy_valid_id_string(struct {char *id = card->id; -while (*nid && !isalnum (*nid)) +while (*nid && !safe_ascii_char (*nid)) nid++;if (isdigit (*nid)) *id++ =isalpha (*src) ? *src :'D' ;while (*nid && (size_t )(id - card->id) <sizeof (card->id) -1 ) { -if (isalnum (*nid)) +if (safe_ascii_char (*nid)) *id++ = *nid; nid++; }
@@ -807,7 +813,7 @@ static ssize_t id_store(struct device *dfor (idx =0 ; idx < copy; idx++) { c = buf[idx]; -if (!isalnum (c) && c !='_' && c !='-' ) +if (!safe_ascii_char (c) && c !='_' && c !='-' )return -EINVAL ; }memcpy (buf1, buf, copy);
Greg Kroah-Hartman
maintainerPATCH 536/798 ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lianqin Hu <[email protected]>
commit 73385f3e0d8088b715ae8f3f66d533c482a376ab upstream.
Audio control requests that sets sampling frequency sometimes fail on this card. Adding delay between control messages eliminates that problem.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2179,6 +2179,8 @@ static const struct usb_audio_quirk_flag QUIRK_FLAG_GENERIC_IMPLICIT_FB),DEVICE_FLG (0x2b53 ,0x0031 ,/* Fiero SC-01 (firmware v1.1.0) */ QUIRK_FLAG_GENERIC_IMPLICIT_FB ), +DEVICE_FLG (0x2d95 ,0x8011 ,/* VIVO USB-C HEADSET */ +QUIRK_FLAG_CTL_MSG_DELAY_1M ),DEVICE_FLG (0x2d95 ,0x8021 ,/* VIVO USB-C-XE710 HEADSET */ QUIRK_FLAG_CTL_MSG_DELAY_1M ), DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */
Greg Kroah-Hartman
maintainerPATCH 537/798 ALSA: usb-audio: Add native DSD support for Luxman D-08u
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Lalinsky <[email protected]>
commit 6b0bde5d8d4078ca5feec72fd2d828f0e5cf115d upstream.
Add native DSD support for Luxman D-08u DAC, by adding the PID/VID 1852:5062. This makes DSD playback work, and also sound quality when playing PCM files is improved, crackling sounds are gone.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2121,6 +2121,8 @@ static const struct usb_audio_quirk_flag QUIRK_FLAG_DISABLE_AUTOSUSPEND),DEVICE_FLG (0x17aa ,0x104d ,/* Lenovo ThinkStation P620 Internal Speaker + Front Headset */ QUIRK_FLAG_DISABLE_AUTOSUSPEND ), +DEVICE_FLG (0x1852 ,0x5062 ,/* Luxman D-08u */ +QUIRK_FLAG_ITF_USB_DSD_DAC |QUIRK_FLAG_CTL_MSG_DELAY ),DEVICE_FLG (0x1852 ,0x5065 ,/* Luxman DA-06 */ QUIRK_FLAG_ITF_USB_DSD_DAC |QUIRK_FLAG_CTL_MSG_DELAY ), DEVICE_FLG(0x1901, 0x0191, /* GE B850V3 CP2114 audio interface */