6.13.11-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 421/499 staging: gpib: ni_usb console messaging cleanup
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
[ Upstream commit 18ce5b5d9167bffce02550a85c7c3316a05ea598 ]
Enable module name to be printed in pr_xxx and dev_xxx Use DRV_NAME defined as KBUILD_MODNAME instead of hard coded string "ni_usb_gpib" in usb_driver struct.
Remove __func__ parameter from pr_err and dev_err.
Remove __func__ parameter from dev_dbg as this can be enabled by dynamic debug.
Remove commented printk's and dev_err's.
Remove kmalloc failed messages.
Remove buffer over run bug dev_err message as this just checks for a bug in the driver which does not exist.
Remove read/write length too long messages and return -EINVAL
Change dev_info to dev_dbg where possible.
Move attach message to the end of attach function.
Remove buffer overrun message. Use actual array indeces instead of i and i++ to make code clear and check redundnant.
Remove module init and exit pr_info's.
Stable-dep-of: a239c6e91b66 ("staging: gpib: Fix Oops after disconnect in ni_usb")
--- drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 425 ++++++++++------------ 1 file changed, 189 insertions(+), 236 deletions(-)
drivers/staging/gpib/ni_usb/ni_usb_gpib.c +189 -236
@@ -5,6 +5,10 @@* copyright : (C) 2004 by Frank Mori Hess ***************************************************************************/ +#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +#define dev_fmt pr_fmt +#define DRV_NAME KBUILD_MODNAME +#include <linux/kernel.h> #include <linux/module.h> #include <linux/slab.h>
@@ -75,7 +79,7 @@ static unsigned short ni_usb_timeout_code(unsigned int usec)*/ else if (usec <= 1000000000) return 0x02; -pr_err ("%s: bug? usec is greater than 1e9\n" , __func__); +pr_err ("bug? usec is greater than 1e9\n" );return 0xf0 ; }
@@ -83,8 +87,6 @@ static void ni_usb_bulk_complete(struct urb *urb) {struct ni_usb_urb_ctx *context = urb->context; -// printk("debug: %s: status=0x%x, error_count=%i, actual_length=%i\n", __func__, -// urb->status, urb->error_count, urb->actual_length); complete (&context->complete); }
@@ -137,8 +139,8 @@ static int ni_usb_nonblocking_send_bulk_msg(struct ni_usb_priv *ni_priv, void *ddel_timer_sync (&ni_priv->bulk_timer);usb_free_urb (ni_priv->bulk_urb); ni_priv->bulk_urb =NULL ; -dev_err (&usb_dev->dev,"%s: failed to submit bulk out urb, retval=%i\n" , - __func__, retval); +dev_err (&usb_dev->dev,"failed to submit bulk out urb, retval=%i\n" , + retval);mutex_unlock (&ni_priv->bulk_transfer_lock);return retval; }
@@ -146,7 +148,7 @@ static int ni_usb_nonblocking_send_bulk_msg(struct ni_usb_priv *ni_priv, void *dwait_for_completion (&context->complete);// wait for ni_usb_bulk_complete if (context->timed_out) {usb_kill_urb (ni_priv->bulk_urb); -dev_err (&usb_dev->dev,"%s: killed urb due to timeout\n" , __func__); +dev_err (&usb_dev->dev,"killed urb due to timeout\n" ); retval = -ETIMEDOUT ; }else { retval = ni_priv->bulk_urb->status;
@@ -218,14 +220,12 @@ static int ni_usb_nonblocking_receive_bulk_msg(struct ni_usb_priv *ni_priv,if (timeout_msecs)mod_timer (&ni_priv->bulk_timer, jiffies +msecs_to_jiffies (timeout_msecs)); -//printk("%s: submitting urb\n", __func__); retval =usb_submit_urb (ni_priv->bulk_urb,GFP_KERNEL );if (retval) {del_timer_sync (&ni_priv->bulk_timer);usb_free_urb (ni_priv->bulk_urb); ni_priv->bulk_urb =NULL ; -dev_err (&usb_dev->dev,"%s: failed to submit bulk out urb, retval=%i\n" , - __func__, retval); +dev_err (&usb_dev->dev,"failed to submit bulk in urb, retval=%i\n" , retval);mutex_unlock (&ni_priv->bulk_transfer_lock);return retval; }
@@ -250,7 +250,7 @@ static int ni_usb_nonblocking_receive_bulk_msg(struct ni_usb_priv *ni_priv, }if (context->timed_out) {usb_kill_urb (ni_priv->bulk_urb); -dev_err (&usb_dev->dev,"%s: killed urb due to timeout\n" , __func__); +dev_err (&usb_dev->dev,"killed urb due to timeout\n" ); retval = -ETIMEDOUT ; }else {if (ni_priv->bulk_urb->status)
@@ -330,14 +330,14 @@ static void ni_usb_soft_update_status(gpib_board_t *board, unsigned int ni_usb_i ni_priv->monitored_ibsta_bits &= ~ni_usb_ibsta; need_monitoring_bits &= ~ni_priv->monitored_ibsta_bits;/* mm - monitored set */ spin_unlock_irqrestore (&board->spinlock, flags); -dev_dbg (&usb_dev->dev,"%s: need_monitoring_bits=0x%x\n" , __func__, need_monitoring_bits); +dev_dbg (&usb_dev->dev,"need_monitoring_bits=0x%x\n" , need_monitoring_bits);if (need_monitoring_bits & ~ni_usb_ibsta)ni_usb_set_interrupt_monitor (board, ni_usb_ibsta_monitor_mask);else if (need_monitoring_bits & ni_usb_ibsta)wake_up_interruptible (&board->wait); -dev_dbg (&usb_dev->dev,"%s: ni_usb_ibsta=0x%x\n" , __func__, ni_usb_ibsta); +dev_dbg (&usb_dev->dev,"ibsta=0x%x\n" , ni_usb_ibsta); }static int ni_usb_parse_status_block (const u8 *buffer,struct ni_usb_status_block *status)
@@ -371,7 +371,7 @@ static int ni_usb_parse_register_read_block(const u8 *raw_data, unsigned int *reint k;if (raw_data[i++] !=NIUSB_REGISTER_READ_DATA_START_ID ) { -pr_err ("%s: parse error: wrong start id\n" , __func__); +pr_err ("parse error: wrong start id\n" ); unexpected =1 ; }for (k =0 ; k < results_per_chunk && j < num_results; ++k)
@@ -380,18 +380,18 @@ static int ni_usb_parse_register_read_block(const u8 *raw_data, unsigned int *rewhile (i %4 ) i++;if (raw_data[i++] !=NIUSB_REGISTER_READ_DATA_END_ID ) { -pr_err ("%s: parse error: wrong end id\n" , __func__); +pr_err ("parse error: wrong end id\n" ); unexpected =1 ; }if (raw_data[i++] % results_per_chunk != num_results % results_per_chunk) { -pr_err ("%s: parse error: wrong count=%i for NIUSB_REGISTER_READ_DATA_END\n" , - __func__, (int )raw_data[i -1 ]); +pr_err ("parse error: wrong count=%i for NIUSB_REGISTER_READ_DATA_END\n" , + (int )raw_data[i -1 ]); unexpected =1 ; }while (i %4 ) {if (raw_data[i++] !=0 ) { -pr_err ("%s: unexpected data: raw_data[%i]=0x%x, expected 0\n" , - __func__, i -1 , (int )raw_data[i -1 ]); +pr_err ("unexpected data: raw_data[%i]=0x%x, expected 0\n" , + i -1 , (int )raw_data[i -1 ]); unexpected =1 ; } }
@@ -408,9 +408,8 @@ static int ni_usb_parse_termination_block(const u8 *buffer) buffer[i++] != 0x0 || buffer[i++] != 0x0 || buffer[i++] != 0x0) { -pr_err ("%s: received unexpected termination block\n" , __func__); -pr_err (" expected: 0x%x 0x%x 0x%x 0x%x\n" , -NIUSB_TERM_ID ,0x0 ,0x0 ,0x0 ); +pr_err ("received unexpected termination block\n" ); +pr_err (" expected: 0x%x 0x%x 0x%x 0x%x\n" ,NIUSB_TERM_ID ,0x0 ,0x0 ,0x0 );pr_err (" received: 0x%x 0x%x 0x%x 0x%x\n" , buffer[i -4 ], buffer[i -3 ], buffer[i -2 ], buffer[i -1 ]); }
@@ -438,12 +437,12 @@ static int parse_board_ibrd_readback(const u8 *raw_data, struct ni_usb_status_bl }else if (raw_data[i] ==NIUSB_IBRD_EXTENDED_DATA_ID ) { data_block_length = ibrd_extended_data_block_length;if (raw_data[++i] !=0 ) { -pr_err ("%s: unexpected data: raw_data[%i]=0x%x, expected 0\n" , - __func__, i, (int )raw_data[i]); +pr_err ("unexpected data: raw_data[%i]=0x%x, expected 0\n" , + i, (int )raw_data[i]); unexpected =1 ; } }else { -pr_err ("%s: logic bug!\n" , __func__); +pr_err ("Unexpected NIUSB_IBRD ID\n" );return -EINVAL ; } ++i;
@@ -457,7 +456,7 @@ static int parse_board_ibrd_readback(const u8 *raw_data, struct ni_usb_status_bl } i +=ni_usb_parse_status_block (&raw_data[i], status);if (status->id !=NIUSB_IBRD_STATUS_ID ) { -pr_err ("%s: bug: status->id=%i, != ibrd_status_id\n" , __func__, status->id); +pr_err ("bug: status->id=%i, != ibrd_status_id\n" , status->id);return -EIO ; } adr1_bits = raw_data[i++];
@@ -468,29 +467,28 @@ static int parse_board_ibrd_readback(const u8 *raw_data, struct ni_usb_status_bl *actual_bytes_read =0 ; }if (*actual_bytes_read > j) -pr_err ("%s: bug: discarded data. actual_bytes_read=%i, j=%i\n" , - __func__, *actual_bytes_read, j); +pr_err ("bug: discarded data. actual_bytes_read=%i, j=%i\n" , *actual_bytes_read, j);for (k =0 ; k <2 ; k++)if (raw_data[i++] !=0 ) { -pr_err ("%s: unexpected data: raw_data[%i]=0x%x, expected 0\n" , - __func__, i -1 , (int )raw_data[i -1 ]); +pr_err ("unexpected data: raw_data[%i]=0x%x, expected 0\n" , + i -1 , (int )raw_data[i -1 ]); unexpected =1 ; } i +=ni_usb_parse_status_block (&raw_data[i], ®ister_write_status);if (register_write_status.id !=NIUSB_REG_WRITE_ID ) { -pr_err ("%s: unexpected data: register write status id=0x%x, expected 0x%x\n" , - __func__, register_write_status.id,NIUSB_REG_WRITE_ID ); +pr_err ("unexpected data: register write status id=0x%x, expected 0x%x\n" , + register_write_status.id,NIUSB_REG_WRITE_ID ); unexpected =1 ; }if (raw_data[i++] !=2 ) { -pr_err ("%s: unexpected data: register write count=%i, expected 2\n" , - __func__, (int )raw_data[i -1 ]); +pr_err ("unexpected data: register write count=%i, expected 2\n" , + (int )raw_data[i -1 ]); unexpected =1 ; }for (k =0 ; k <3 ; k++)if (raw_data[i++] !=0 ) { -pr_err ("%s: unexpected data: raw_data[%i]=0x%x, expected 0\n" , - __func__, i -1 , (int )raw_data[i -1 ]); +pr_err ("unexpected data: raw_data[%i]=0x%x, expected 0\n" , + i -1 , (int )raw_data[i -1 ]); unexpected =1 ; } i +=ni_usb_parse_termination_block (&raw_data[i]);
@@ -530,18 +528,14 @@ static int ni_usb_write_registers(struct ni_usb_priv *ni_priv, out_data_length = num_writes * bytes_per_write +0x10 ; out_data =kmalloc (out_data_length,GFP_KERNEL ); -if (!out_data) { -dev_err (&usb_dev->dev,"%s: kmalloc failed\n" , __func__); +if (!out_data)return -ENOMEM ; - } i +=ni_usb_bulk_register_write_header (&out_data[i], num_writes);for (j =0 ; j < num_writes; j++) i +=ni_usb_bulk_register_write (&out_data[i], writes[j]);while (i %4 ) out_data[i++] =0x00 ; i +=ni_usb_bulk_termination (&out_data[i]); -if (i > out_data_length) -dev_err (&usb_dev->dev,"%s: bug! buffer overrun\n" , __func__);mutex_lock (&ni_priv->addressed_transfer_lock);
@@ -549,22 +543,21 @@ static int ni_usb_write_registers(struct ni_usb_priv *ni_priv,kfree (out_data);if (retval) {mutex_unlock (&ni_priv->addressed_transfer_lock); -dev_err (&usb_dev->dev,"%s: ni_usb_send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , - __func__, retval, bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , + retval, bytes_written, i);return retval; } in_data =kmalloc (in_data_length,GFP_KERNEL );if (!in_data) {mutex_unlock (&ni_priv->addressed_transfer_lock); -dev_err (&usb_dev->dev,"%s: kmalloc failed\n" , __func__);return -ENOMEM ; } retval =ni_usb_receive_bulk_msg (ni_priv, in_data, in_data_length, &bytes_read,1000 ,0 );if (retval || bytes_read !=16 ) {mutex_unlock (&ni_priv->addressed_transfer_lock); -dev_err (&usb_dev->dev,"%s: ni_usb_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);ni_usb_dump_raw_block (in_data, bytes_read);kfree (in_data);return retval;
@@ -576,18 +569,16 @@ static int ni_usb_write_registers(struct ni_usb_priv *ni_priv,//FIXME parse extra 09 status bits and termination kfree (in_data);if (status.id !=NIUSB_REG_WRITE_ID ) { -dev_err (&usb_dev->dev,"%s: parse error, id=0x%x != NIUSB_REG_WRITE_ID\n" , - __func__, status.id); +dev_err (&usb_dev->dev,"parse error, id=0x%x != NIUSB_REG_WRITE_ID\n" , status.id);return -EIO ; }if (status.error_code) { -dev_err (&usb_dev->dev,"%s: nonzero error code 0x%x\n" , - __func__, status.error_code); +dev_err (&usb_dev->dev,"nonzero error code 0x%x\n" , status.error_code);return -EIO ; }if (reg_writes_completed != num_writes) { -dev_err (&usb_dev->dev,"%s: reg_writes_completed=%i, num_writes=%i\n" , - __func__, reg_writes_completed, num_writes); +dev_err (&usb_dev->dev,"reg_writes_completed=%i, num_writes=%i\n" , + reg_writes_completed, num_writes);return -EIO ; }if (ibsta)
@@ -614,10 +605,8 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length,struct ni_usb_register reg; *bytes_read =0 ; -if (length > max_read_length) { - length = max_read_length; -dev_err (&usb_dev->dev,"%s: read length too long\n" , __func__); - } +if (length > max_read_length) +return -EINVAL ; out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)return -ENOMEM ;
@@ -649,8 +638,8 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length,if (retval || usb_bytes_written != i) {if (retval ==0 ) retval = -EIO ; -dev_err (&usb_dev->dev,"%s: ni_usb_send_bulk_msg returned %i, usb_bytes_written=%i, i=%i\n" , - __func__, retval, usb_bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, usb_bytes_written=%i, i=%i\n" , + retval, usb_bytes_written, i);mutex_unlock (&ni_priv->addressed_transfer_lock);return retval; }
@@ -668,8 +657,8 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length,if (retval == -ERESTARTSYS ) { }else if (retval) { -dev_err (&usb_dev->dev,"%s: ni_usb_receive_bulk_msg returned %i, usb_bytes_read=%i\n" , - __func__, retval, usb_bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, usb_bytes_read=%i\n" , + retval, usb_bytes_read);kfree (in_data);return retval; }
@@ -677,14 +666,14 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length,if (parse_retval != usb_bytes_read) {if (parse_retval >=0 ) parse_retval = -EIO ; -dev_err (&usb_dev->dev,"%s: retval=%i usb_bytes_read=%i\n" , - __func__, parse_retval, usb_bytes_read); +dev_err (&usb_dev->dev,"retval=%i usb_bytes_read=%i\n" , + parse_retval, usb_bytes_read);kfree (in_data);return parse_retval; }if (actual_length != length - status.count) { -dev_err (&usb_dev->dev,"%s: actual_length=%i expected=%li\n" , - __func__, actual_length, (long )(length - status.count)); +dev_err (&usb_dev->dev,"actual_length=%i expected=%li\n" , + actual_length, (long )(length - status.count));ni_usb_dump_raw_block (in_data, usb_bytes_read); }kfree (in_data);
@@ -699,7 +688,7 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length,break ;case NIUSB_ATN_STATE_ERROR : retval = -EIO ; -dev_err (&usb_dev->dev,"%s: read when ATN set\n" , __func__); +dev_err (&usb_dev->dev,"read when ATN set\n" );break ;case NIUSB_ADDRESSING_ERROR : retval = -EIO ;
@@ -708,12 +697,11 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length, retval = -ETIMEDOUT ;break ;case NIUSB_EOSMODE_ERROR : -dev_err (&usb_dev->dev,"%s: driver bug, we should have been able to avoid NIUSB_EOSMODE_ERROR.\n" , - __func__); +dev_err (&usb_dev->dev,"driver bug, we should have been able to avoid NIUSB_EOSMODE_ERROR.\n" ); retval = -EINVAL ;break ;default : -dev_err (&usb_dev->dev,"%s: unknown error code=%i\n" , __func__, status.error_code); +dev_err (&usb_dev->dev,"unknown error code=%i\n" , status.error_code); retval = -EIO ;break ; }
@@ -742,11 +730,8 @@ static int ni_usb_write(gpib_board_t *board, uint8_t *buffer, size_t length,static const int max_write_length =0xffff ; *bytes_written =0 ; -if (length > max_write_length) { - length = max_write_length; - send_eoi =0 ; -dev_err (&usb_dev->dev,"%s: write length too long\n" , __func__); - } +if (length > max_write_length) +return -EINVAL ; out_data_length = length +0x10 ; out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)
@@ -777,8 +762,8 @@ static int ni_usb_write(gpib_board_t *board, uint8_t *buffer, size_t length,kfree (out_data);if (retval || usb_bytes_written != i) {mutex_unlock (&ni_priv->addressed_transfer_lock); -dev_err (&usb_dev->dev,"%s: ni_usb_send_bulk_msg returned %i, usb_bytes_written=%i, i=%i\n" , - __func__, retval, usb_bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, usb_bytes_written=%i, i=%i\n" , + retval, usb_bytes_written, i);return retval; }
@@ -791,8 +776,8 @@ static int ni_usb_write(gpib_board_t *board, uint8_t *buffer, size_t length,mutex_unlock (&ni_priv->addressed_transfer_lock);if ((retval && retval != -ERESTARTSYS ) || usb_bytes_read !=12 ) { -dev_err (&usb_dev->dev,"%s: ni_usb_receive_bulk_msg returned %i, usb_bytes_read=%i\n" , - __func__, retval, usb_bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, usb_bytes_read=%i\n" , + retval, usb_bytes_read);kfree (in_data);return retval; }
@@ -808,8 +793,8 @@ static int ni_usb_write(gpib_board_t *board, uint8_t *buffer, size_t length,*/ break ;case NIUSB_ADDRESSING_ERROR : -dev_err (&usb_dev->dev,"%s: Addressing error retval %d error code=%i\n" , - __func__, retval, status.error_code); +dev_err (&usb_dev->dev,"Addressing error retval %d error code=%i\n" , + retval, status.error_code); retval = -ENXIO ;break ;case NIUSB_NO_LISTENER_ERROR :
@@ -819,8 +804,7 @@ static int ni_usb_write(gpib_board_t *board, uint8_t *buffer, size_t length, retval = -ETIMEDOUT ;break ;default : -dev_err (&usb_dev->dev,"%s: unknown error code=%i\n" , - __func__, status.error_code); +dev_err (&usb_dev->dev,"unknown error code=%i\n" , status.error_code); retval = -EPIPE ;break ; }
@@ -871,8 +855,8 @@ static int ni_usb_command_chunk(gpib_board_t *board, uint8_t *buffer, size_t lenkfree (out_data);if (retval || bytes_written != i) {mutex_unlock (&ni_priv->addressed_transfer_lock); -dev_err (&usb_dev->dev,"%s: ni_usb_send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , - __func__, retval, bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , + retval, bytes_written, i);return retval; }
@@ -888,8 +872,8 @@ static int ni_usb_command_chunk(gpib_board_t *board, uint8_t *buffer, size_t lenmutex_unlock (&ni_priv->addressed_transfer_lock);if ((retval && retval != -ERESTARTSYS ) || bytes_read !=12 ) { -dev_err (&usb_dev->dev,"%s: ni_usb_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);kfree (in_data);return retval; }
@@ -907,12 +891,12 @@ static int ni_usb_command_chunk(gpib_board_t *board, uint8_t *buffer, size_t lencase NIUSB_NO_BUS_ERROR :return -ENOTCONN ;case NIUSB_EOSMODE_ERROR : -dev_err (&usb_dev->dev,"%s: got eosmode error. Driver bug?\n" , __func__); +dev_err (&usb_dev->dev,"got eosmode error. Driver bug?\n" );return -EIO ;case NIUSB_TIMEOUT_ERROR :return -ETIMEDOUT ;default : -dev_err (&usb_dev->dev,"%s: unknown error code=%i\n" , __func__, status.error_code); +dev_err (&usb_dev->dev,"unknown error code=%i\n" , status.error_code);return -EIO ; }ni_usb_soft_update_status (board, status.ibsta,0 );
@@ -966,15 +950,14 @@ static int ni_usb_take_control(gpib_board_t *board, int synchronous)kfree (out_data);if (retval || bytes_written != i) {mutex_unlock (&ni_priv->addressed_transfer_lock); -dev_err (&usb_dev->dev,"%s: ni_usb_send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , - __func__, retval, bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , + retval, bytes_written, i);return retval; } in_data =kmalloc (in_data_length,GFP_KERNEL );if (!in_data) {mutex_unlock (&ni_priv->addressed_transfer_lock); -dev_err (&usb_dev->dev,"%s: kmalloc failed\n" , __func__);return -ENOMEM ; } retval =ni_usb_receive_bulk_msg (ni_priv, in_data, in_data_length, &bytes_read,1000 ,1 );
@@ -984,8 +967,8 @@ static int ni_usb_take_control(gpib_board_t *board, int synchronous)if ((retval && retval != -ERESTARTSYS ) || bytes_read !=12 ) {if (retval ==0 ) retval = -EIO ; -dev_err (&usb_dev->dev,"%s: ni_usb_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);kfree (in_data);return retval; }
@@ -1023,15 +1006,14 @@ static int ni_usb_go_to_standby(gpib_board_t *board)kfree (out_data);if (retval || bytes_written != i) {mutex_unlock (&ni_priv->addressed_transfer_lock); -dev_err (&usb_dev->dev,"%s: ni_usb_send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , - __func__, retval, bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , + retval, bytes_written, i);return retval; } in_data =kmalloc (in_data_length,GFP_KERNEL );if (!in_data) {mutex_unlock (&ni_priv->addressed_transfer_lock); -dev_err (&usb_dev->dev,"%s: kmalloc failed\n" , __func__);return -ENOMEM ; } retval =ni_usb_receive_bulk_msg (ni_priv, in_data, in_data_length, &bytes_read,1000 ,0 );
@@ -1039,16 +1021,15 @@ static int ni_usb_go_to_standby(gpib_board_t *board)mutex_unlock (&ni_priv->addressed_transfer_lock);if (retval || bytes_read !=12 ) { -dev_err (&usb_dev->dev,"%s: ni_usb_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);kfree (in_data);return retval; }ni_usb_parse_status_block (in_data, &status);kfree (in_data);if (status.id !=NIUSB_IBGTS_ID ) -dev_err (&usb_dev->dev,"%s: bug: status.id 0x%x != INUSB_IBGTS_ID\n" , - __func__, status.id); +dev_err (&usb_dev->dev,"bug: status.id 0x%x != INUSB_IBGTS_ID\n" , status.id);ni_usb_soft_update_status (board, status.ibsta,0 );return 0 ; }
@@ -1091,7 +1072,7 @@ static void ni_usb_request_system_control(gpib_board_t *board, int request_contr } retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return ;// retval; }if (!request_control)
@@ -1117,10 +1098,8 @@ static void ni_usb_interface_clear(gpib_board_t *board, int assert)if (assert ==0 )return ; out_data =kmalloc (out_data_length,GFP_KERNEL ); -if (!out_data) { -dev_err (&usb_dev->dev,"%s: kmalloc failed\n" , __func__); +if (!out_data)return ; - } out_data[i++] =NIUSB_IBSIC_ID ; out_data[i++] =0x0 ; out_data[i++] =0x0 ;
@@ -1129,8 +1108,8 @@ static void ni_usb_interface_clear(gpib_board_t *board, int assert) retval =ni_usb_send_bulk_msg (ni_priv, out_data, i, &bytes_written,1000 );kfree (out_data);if (retval || bytes_written != i) { -dev_err (&usb_dev->dev,"%s: ni_usb_send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , - __func__, retval, bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , + retval, bytes_written, i);return ; } in_data =kmalloc (in_data_length,GFP_KERNEL );
@@ -1139,8 +1118,8 @@ static void ni_usb_interface_clear(gpib_board_t *board, int assert) retval =ni_usb_receive_bulk_msg (ni_priv, in_data, in_data_length, &bytes_read,1000 ,0 );if (retval || bytes_read !=12 ) { -dev_err (&usb_dev->dev,"%s: ni_usb_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);kfree (in_data);return ; }
@@ -1165,7 +1144,7 @@ static void ni_usb_remote_enable(gpib_board_t *board, int enable) reg.value =AUX_CREN ; retval =ni_usb_write_registers (ni_priv, ®,1 , &ibsta);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return ;//retval; } ni_priv->ren_state = enable;
@@ -1205,7 +1184,6 @@ static unsigned int ni_usb_update_status(gpib_board_t *board, unsigned int clearu8 *buffer;struct ni_usb_status_block status; -//printk("%s: receive control pipe is %i\n", __func__, pipe); buffer =kmalloc (buffer_length,GFP_KERNEL );if (!buffer)return board->status;
@@ -1214,7 +1192,7 @@ static unsigned int ni_usb_update_status(gpib_board_t *board, unsigned int clearUSB_TYPE_VENDOR |USB_RECIP_DEVICE , 0x200, 0x0, buffer, buffer_length, 1000);if (retval != buffer_length) { -dev_err (&usb_dev->dev,"%s: usb_control_msg returned %i\n" , __func__, retval); +dev_err (&usb_dev->dev,"usb_control_msg returned %i\n" , retval);kfree (buffer);return board->status; }
@@ -1233,7 +1211,6 @@ static void ni_usb_stop(struct ni_usb_priv *ni_priv)u8 *buffer;struct ni_usb_status_block status; -//printk("%s: receive control pipe is %i\n", __func__, pipe); buffer =kmalloc (buffer_length,GFP_KERNEL );if (!buffer)return ;
@@ -1242,7 +1219,7 @@ static void ni_usb_stop(struct ni_usb_priv *ni_priv)USB_TYPE_VENDOR |USB_RECIP_DEVICE , 0x0, 0x0, buffer, buffer_length, 1000);if (retval != buffer_length) { -dev_err (&usb_dev->dev,"%s: usb_control_msg returned %i\n" , __func__, retval); +dev_err (&usb_dev->dev,"usb_control_msg returned %i\n" , retval);kfree (buffer);return ; }
@@ -1269,7 +1246,7 @@ static int ni_usb_primary_address(gpib_board_t *board, unsigned int address) i++; retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return retval; }ni_usb_soft_update_status (board, ibsta,0 );
@@ -1317,7 +1294,7 @@ static int ni_usb_secondary_address(gpib_board_t *board, unsigned int address, i i +=ni_usb_write_sad (writes, address, enable); retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return retval; }ni_usb_soft_update_status (board, ibsta,0 );
@@ -1351,8 +1328,8 @@ static int ni_usb_parallel_poll(gpib_board_t *board, uint8_t *result)kfree (out_data);if (retval || bytes_written != i) { -dev_err (&usb_dev->dev,"%s: ni_usb_send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , - __func__, retval, bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , + retval, bytes_written, i);return retval; } in_data =kmalloc (in_data_length,GFP_KERNEL );
@@ -1364,8 +1341,8 @@ static int ni_usb_parallel_poll(gpib_board_t *board, uint8_t *result) &bytes_read, 1000, 1);if (retval && retval != -ERESTARTSYS ) { -dev_err (&usb_dev->dev,"%s: ni_usb_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);kfree (in_data);return retval; }
@@ -1391,7 +1368,7 @@ static void ni_usb_parallel_poll_configure(gpib_board_t *board, uint8_t config) i++; retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return ;// retval; }ni_usb_soft_update_status (board, ibsta,0 );
@@ -1416,7 +1393,7 @@ static void ni_usb_parallel_poll_response(gpib_board_t *board, int ist) i++; retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return ;// retval; }ni_usb_soft_update_status (board, ibsta,0 );
@@ -1438,7 +1415,7 @@ static void ni_usb_serial_poll_response(gpib_board_t *board, u8 status) i++; retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return ;// retval; }ni_usb_soft_update_status (board, ibsta,0 );
@@ -1465,7 +1442,7 @@ static void ni_usb_return_to_local(gpib_board_t *board) i++; retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return ;// retval; }ni_usb_soft_update_status (board, ibsta,0 );
@@ -1507,15 +1484,14 @@ static int ni_usb_line_status(const gpib_board_t *board)if (retval || bytes_written != i) {mutex_unlock (&ni_priv->addressed_transfer_lock);if (retval != -EAGAIN ) -dev_err (&usb_dev->dev,"%s: ni_usb_send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , - __func__, retval, bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , + retval, bytes_written, i);return retval; } in_data =kmalloc (in_data_length,GFP_KERNEL );if (!in_data) {mutex_unlock (&ni_priv->addressed_transfer_lock); -dev_err (&usb_dev->dev,"%s: kmalloc failed\n" , __func__);return -ENOMEM ; } retval = ni_usb_nonblocking_receive_bulk_msg(ni_priv, in_data, in_data_length,
@@ -1525,8 +1501,8 @@ static int ni_usb_line_status(const gpib_board_t *board)if (retval) {if (retval != -EAGAIN ) -dev_err (&usb_dev->dev,"%s: ni_usb_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);kfree (in_data);return retval; }
@@ -1602,7 +1578,7 @@ static unsigned int ni_usb_t1_delay(gpib_board_t *board, unsigned int nano_sec) i =ni_usb_setup_t1_delay (writes, nano_sec, &actual_ns); retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return -1 ;//FIXME should change return type to int for error reporting } board->t1_nano_sec = actual_ns;
@@ -1734,7 +1710,7 @@ static int ni_usb_setup_init(gpib_board_t *board, struct ni_usb_register *writes writes[i].value =AUX_CPPF ; i++;if (i >NUM_INIT_WRITES ) { -dev_err (&usb_dev->dev,"%s: bug!, buffer overrun, i=%i\n" , __func__, i); +dev_err (&usb_dev->dev,"bug!, buffer overrun, i=%i\n" , i);return 0 ; }return i;
@@ -1760,7 +1736,7 @@ static int ni_usb_init(gpib_board_t *board)return -EFAULT ;kfree (writes);if (retval) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return retval; }ni_usb_soft_update_status (board, ibsta,0 );
@@ -1776,9 +1752,6 @@ static void ni_usb_interrupt_complete(struct urb *urb)struct ni_usb_status_block status;unsigned long flags; -// printk("debug: %s: status=0x%x, error_count=%i, actual_length=%i\n", __func__, -// urb->status, urb->error_count, urb->actual_length); -switch (urb->status) {/* success */ case 0 :
@@ -1791,23 +1764,21 @@ static void ni_usb_interrupt_complete(struct urb *urb)default :/* other error, resubmit */ retval =usb_submit_urb (ni_priv->interrupt_urb,GFP_ATOMIC );if (retval) -dev_err (&usb_dev->dev,"%s: failed to resubmit interrupt urb\n" , __func__); +dev_err (&usb_dev->dev,"failed to resubmit interrupt urb\n" );return ; }ni_usb_parse_status_block (urb->transfer_buffer, &status); -// printk("debug: ibsta=0x%x\n", status.ibsta); spin_lock_irqsave (&board->spinlock, flags); ni_priv->monitored_ibsta_bits &= ~status.ibsta; -// printk("debug: monitored_ibsta_bits=0x%x\n", ni_priv->monitored_ibsta_bits); spin_unlock_irqrestore (&board->spinlock, flags);wake_up_interruptible (&board->wait); retval =usb_submit_urb (ni_priv->interrupt_urb,GFP_ATOMIC );if (retval) -dev_err (&usb_dev->dev,"%s: failed to resubmit interrupt urb\n" , __func__); +dev_err (&usb_dev->dev,"failed to resubmit interrupt urb\n" ); }static int ni_usb_set_interrupt_monitor (gpib_board_t *board,unsigned int monitored_bits)
@@ -1819,22 +1790,20 @@ static int ni_usb_set_interrupt_monitor(gpib_board_t *board, unsigned int monitou8 *buffer;struct ni_usb_status_block status;unsigned long flags; -//printk("%s: receive control pipe is %i\n", __func__, pipe); + buffer =kmalloc (buffer_length,GFP_KERNEL );if (!buffer)return -ENOMEM ;spin_lock_irqsave (&board->spinlock, flags); ni_priv->monitored_ibsta_bits = ni_usb_ibsta_monitor_mask & monitored_bits; -// dev_err(&usb_dev->dev, "debug: %s: monitored_ibsta_bits=0x%x\n", -// __func__, ni_priv->monitored_ibsta_bits); spin_unlock_irqrestore (&board->spinlock, flags); retval =ni_usb_receive_control_msg (ni_priv,NI_USB_WAIT_REQUEST ,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE ,0x300 , ni_usb_ibsta_monitor_mask & monitored_bits, buffer, buffer_length,1000 );if (retval != buffer_length) { -dev_err (&usb_dev->dev,"%s: usb_control_msg returned %i\n" , __func__, retval); +dev_err (&usb_dev->dev,"usb_control_msg returned %i\n" , retval);kfree (buffer);return -1 ; }
@@ -1870,8 +1839,7 @@ static int ni_usb_setup_urbs(gpib_board_t *board) retval =usb_submit_urb (ni_priv->interrupt_urb,GFP_KERNEL );mutex_unlock (&ni_priv->interrupt_transfer_lock);if (retval) { -dev_err (&usb_dev->dev,"%s: failed to submit first interrupt urb, retval=%i\n" , - __func__, retval); +dev_err (&usb_dev->dev,"failed to submit first interrupt urb, retval=%i\n" , retval);return retval; }return 0 ;
@@ -1902,7 +1870,6 @@ static int ni_usb_b_read_serial_number(struct ni_usb_priv *ni_priv)int j;unsigned int serial_number; -// printk("%s: %s\n", __func__); in_data =kmalloc (in_data_length,GFP_KERNEL );if (!in_data)return -ENOMEM ;
@@ -1922,20 +1889,19 @@ static int ni_usb_b_read_serial_number(struct ni_usb_priv *ni_priv) i +=ni_usb_bulk_termination (&out_data[i]); retval =ni_usb_send_bulk_msg (ni_priv, out_data, out_data_length, &bytes_written,1000 );if (retval) { -dev_err (&usb_dev->dev,"%s: ni_usb_send_bulk_msg returned %i, bytes_written=%i, i=%li\n" , - __func__, +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%li\n" , retval, bytes_written, (long )out_data_length); goto serial_out; } retval =ni_usb_receive_bulk_msg (ni_priv, in_data, in_data_length, &bytes_read,1000 ,0 );if (retval) { -dev_err (&usb_dev->dev,"%s: ni_usb_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);ni_usb_dump_raw_block (in_data, bytes_read); goto serial_out; }if (ARRAY_SIZE (results) < num_reads) { -dev_err (&usb_dev->dev,"Setup bug\n" ); +dev_err (&usb_dev->dev,"serial number eetup bug\n" ); retval = -EINVAL ; goto serial_out; }
@@ -1943,7 +1909,7 @@ static int ni_usb_b_read_serial_number(struct ni_usb_priv *ni_priv) serial_number =0 ;for (j =0 ; j < num_reads; ++j) serial_number |= (results[j] &0xff ) << (8 * j); -dev_info (&usb_dev->dev,"%s: board serial number is 0x%x\n" , __func__, serial_number); +dev_dbg (&usb_dev->dev,"board serial number is 0x%x\n" , serial_number); retval =0 ; serial_out:kfree (in_data);
@@ -1971,22 +1937,22 @@ static int ni_usb_hs_wait_for_ready(struct ni_usb_priv *ni_priv)USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , 0x0, 0x0, buffer, buffer_size, 1000);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: usb_control_msg request 0x%x returned %i\n" , - __func__,NI_USB_SERIAL_NUMBER_REQUEST , retval); +dev_err (&usb_dev->dev,"usb_control_msg request 0x%x returned %i\n" , +NI_USB_SERIAL_NUMBER_REQUEST , retval); goto ready_out; } j =0 ;if (buffer[j] !=NI_USB_SERIAL_NUMBER_REQUEST ) { -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x%x\n" , - __func__, j, (int )buffer[j],NI_USB_SERIAL_NUMBER_REQUEST ); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x%x\n" , + j, (int )buffer[j],NI_USB_SERIAL_NUMBER_REQUEST ); unexpected =1 ; }if (unexpected)ni_usb_dump_raw_block (buffer, retval);// NI-USB-HS+ pads the serial with 0x0 to make 16 bytes if (retval !=5 && retval !=16 ) { -dev_err (&usb_dev->dev,"%s: received unexpected number of bytes = %i, expected 5 or 16\n" , - __func__, retval); +dev_err (&usb_dev->dev,"received unexpected number of bytes = %i, expected 5 or 16\n" , + retval);ni_usb_dump_raw_block (buffer, retval); } serial_number =0 ;
@@ -1994,7 +1960,7 @@ static int ni_usb_hs_wait_for_ready(struct ni_usb_priv *ni_priv) serial_number |= (buffer[++j] <<8 ); serial_number |= (buffer[++j] <<16 ); serial_number |= (buffer[++j] <<24 ); -dev_info (&usb_dev->dev,"%s: board serial number is 0x%x\n" , __func__, serial_number); +dev_dbg (&usb_dev->dev,"board serial number is 0x%x\n" , serial_number);for (i =0 ; i < timeout; ++i) {int ready =0 ;
@@ -2002,26 +1968,26 @@ static int ni_usb_hs_wait_for_ready(struct ni_usb_priv *ni_priv)USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , 0x0, 0x0, buffer, buffer_size, 100);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: usb_control_msg request 0x%x returned %i\n" , - __func__,NI_USB_POLL_READY_REQUEST , retval); +dev_err (&usb_dev->dev,"usb_control_msg request 0x%x returned %i\n" , +NI_USB_POLL_READY_REQUEST , retval); goto ready_out; } j =0 ; unexpected =0 ;if (buffer[j] !=NI_USB_POLL_READY_REQUEST ) {// [0] -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x%x\n" , - __func__, j, (int )buffer[j],NI_USB_POLL_READY_REQUEST ); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x%x\n" , + j, (int )buffer[j],NI_USB_POLL_READY_REQUEST ); unexpected =1 ; } ++j;if (buffer[j] !=0x1 && buffer[j] !=0x0 ) {// [1] HS+ sends 0x0 -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x1 or 0x0\n" , - __func__, j, (int )buffer[j]); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x1 or 0x0\n" , + j, (int )buffer[j]); unexpected =1 ; }if (buffer[++j] !=0x0 ) {// [2] -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x%x\n" , - __func__, j, (int )buffer[j],0x0 ); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x%x\n" , + j, (int )buffer[j],0x0 ); unexpected =1 ; } ++j;
@@ -2029,22 +1995,22 @@ static int ni_usb_hs_wait_for_ready(struct ni_usb_priv *ni_priv)// NI-USB-HS+ sends 0x0 if (buffer[j] !=0x1 && buffer[j] !=0x8 && buffer[j] !=0x7 && buffer[j] !=0x0 ) {// [3] -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x0, 0x1, 0x7 or 0x8\n" , - __func__, j, (int )buffer[j]); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x0, 0x1, 0x7 or 0x8\n" , + j, (int )buffer[j]); unexpected =1 ; } ++j;// NI-USB-HS+ sends 0 here if (buffer[j] !=0x30 && buffer[j] !=0x0 ) {// [4] -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x0 or 0x30\n" , - __func__, j, (int )buffer[j]); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x0 or 0x30\n" , + j, (int )buffer[j]); unexpected =1 ; } ++j;// MC usb-488 (and sometimes NI-USB-HS?) and NI-USB-HS+ sends 0x0 here if (buffer[j] !=0x1 && buffer[j] !=0x0 ) {// [5] -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x1 or 0x0\n" , - __func__, j, (int )buffer[j]); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x1 or 0x0\n" , + j, (int )buffer[j]); unexpected =1 ; }if (buffer[++j] !=0x0 ) {// [6]
@@ -2052,8 +2018,8 @@ static int ni_usb_hs_wait_for_ready(struct ni_usb_priv *ni_priv)// NI-USB-HS+ sends 0xf here if (buffer[j] !=0x2 && buffer[j] !=0xe && buffer[j] !=0xf && buffer[j] !=0x16 ) { -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x2, 0xe, 0xf or 0x16\n" , - __func__, j, (int )buffer[j]); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x2, 0xe, 0xf or 0x16\n" , + j, (int )buffer[j]); unexpected =1 ; } }
@@ -2062,30 +2028,30 @@ static int ni_usb_hs_wait_for_ready(struct ni_usb_priv *ni_priv)// MC usb-488 sends 0x5 here; MC usb-488A sends 0x6 here if (buffer[j] !=0x3 && buffer[j] !=0x5 && buffer[j] !=0x6 && buffer[j] !=0x8 ) { -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x3 or 0x5, 0x6 or 0x08\n" , - __func__, j, (int )buffer[j]); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x3 or 0x5, 0x6 or 0x08\n" , + j, (int )buffer[j]); unexpected =1 ; } } ++j;if (buffer[j] !=0x0 && buffer[j] !=0x2 ) {// [8] MC usb-488 sends 0x2 here -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x0 or 0x2\n" , - __func__, j, (int )buffer[j]); +dev_err (&usb_dev->dev," unexpected data: buffer[%i]=0x%x, expected 0x0 or 0x2\n" , + j, (int )buffer[j]); unexpected =1 ; } ++j;// MC usb-488A and NI-USB-HS sends 0x3 here; NI-USB-HS+ sends 0x30 here if (buffer[j] !=0x0 && buffer[j] !=0x3 && buffer[j] !=0x30 ) {// [9] -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x0, 0x3 or 0x30\n" , - __func__, j, (int )buffer[j]); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x0, 0x3 or 0x30\n" , + j, (int )buffer[j]); unexpected =1 ; }if (buffer[++j] !=0x0 ) { ready =1 ;if (buffer[j] !=0x96 && buffer[j] !=0x7 && buffer[j] !=0x6e ) {// [10] MC usb-488 sends 0x7 here -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[%i]=0x%x, expected 0x96, 0x07 or 0x6e\n" , - __func__, j, (int )buffer[j]); +dev_err (&usb_dev->dev,"unexpected data: buffer[%i]=0x%x, expected 0x96, 0x07 or 0x6e\n" , + j, (int )buffer[j]); unexpected =1 ; } }
@@ -2095,7 +2061,6 @@ static int ni_usb_hs_wait_for_ready(struct ni_usb_priv *ni_priv)break ; retval =msleep_interruptible (msec_sleep_duration);if (retval) { -dev_err (&usb_dev->dev,"ni_usb_gpib: msleep interrupted\n" ); retval = -ERESTARTSYS ; goto ready_out; }
@@ -2104,7 +2069,7 @@ static int ni_usb_hs_wait_for_ready(struct ni_usb_priv *ni_priv) ready_out:kfree (buffer); -dev_dbg (&usb_dev->dev,"%s: exit retval=%d\n" , __func__, retval); +dev_dbg (&usb_dev->dev,"exit retval=%d\n" , retval);return retval; }
@@ -2132,14 +2097,14 @@ static int ni_usb_hs_plus_extra_init(struct ni_usb_priv *ni_priv)USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , 0x0, 0x0, buffer, transfer_size, 1000);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: usb_control_msg request 0x%x returned %i\n" , - __func__, NI_USB_HS_PLUS_0x48_REQUEST, retval); +dev_err (&usb_dev->dev,"usb_control_msg request 0x%x returned %i\n" , + NI_USB_HS_PLUS_0x48_REQUEST, retval);break ; }// expected response data: 48 f3 30 00 00 00 00 00 00 00 00 00 00 00 00 00 if (buffer[0 ] != NI_USB_HS_PLUS_0x48_REQUEST) -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[0]=0x%x, expected 0x%x\n" , - __func__, (int )buffer[0 ], NI_USB_HS_PLUS_0x48_REQUEST); +dev_err (&usb_dev->dev,"unexpected data: buffer[0]=0x%x, expected 0x%x\n" , + (int )buffer[0 ], NI_USB_HS_PLUS_0x48_REQUEST); transfer_size =2 ;
@@ -2147,14 +2112,14 @@ static int ni_usb_hs_plus_extra_init(struct ni_usb_priv *ni_priv)USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_DEVICE , 0x1, 0x0, buffer, transfer_size, 1000);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: usb_control_msg request 0x%x returned %i\n" , - __func__,NI_USB_HS_PLUS_LED_REQUEST , retval); +dev_err (&usb_dev->dev,"usb_control_msg request 0x%x returned %i\n" , +NI_USB_HS_PLUS_LED_REQUEST , retval);break ; }// expected response data: 4b 00 if (buffer[0 ] !=NI_USB_HS_PLUS_LED_REQUEST ) -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[0]=0x%x, expected 0x%x\n" , - __func__, (int )buffer[0 ],NI_USB_HS_PLUS_LED_REQUEST ); +dev_err (&usb_dev->dev,"unexpected data: buffer[0]=0x%x, expected 0x%x\n" , + (int )buffer[0 ],NI_USB_HS_PLUS_LED_REQUEST ); transfer_size =9 ;
@@ -2163,15 +2128,14 @@ static int ni_usb_hs_plus_extra_init(struct ni_usb_priv *ni_priv)USB_RECIP_INTERFACE , 0x0, 0x1, buffer, transfer_size, 1000);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: usb_control_msg request 0x%x returned %i\n" , - __func__, NI_USB_HS_PLUS_0xf8_REQUEST, retval); +dev_err (&usb_dev->dev,"usb_control_msg request 0x%x returned %i\n" , + NI_USB_HS_PLUS_0xf8_REQUEST, retval);break ; }// expected response data: f8 01 00 00 00 01 00 00 00 if (buffer[0 ] != NI_USB_HS_PLUS_0xf8_REQUEST) -dev_err (&usb_dev->dev,"%s: unexpected data: buffer[0]=0x%x, expected 0x%x\n" , - __func__, (int )buffer[0 ], NI_USB_HS_PLUS_0xf8_REQUEST); - +dev_err (&usb_dev->dev,"unexpected data: buffer[0]=0x%x, expected 0x%x\n" , + (int )buffer[0 ], NI_USB_HS_PLUS_0xf8_REQUEST); }while (0 );// cleanup
@@ -2190,7 +2154,7 @@ static inline int ni_usb_device_match(struct usb_interface *interface,static int ni_usb_attach (gpib_board_t *board,const gpib_board_config_t *config) {int retval; -int i; +int i, index;struct ni_usb_priv *ni_priv;int product_id;struct usb_device *usb_dev;
@@ -2209,19 +2173,17 @@ static int ni_usb_attach(gpib_board_t *board, const gpib_board_config_t *config) ni_priv->bus_interface = ni_usb_driver_interfaces[i];usb_set_intfdata (ni_usb_driver_interfaces[i], board); usb_dev =interface_to_usbdev (ni_priv->bus_interface); -dev_info (&usb_dev->dev, -"bus %d dev num %d attached to gpib minor %d, NI usb interface %i\n" , - usb_dev->bus->busnum, usb_dev->devnum, board->minor, i); + index = i;break ; } }if (i ==MAX_NUM_NI_USB_INTERFACES ) {mutex_unlock (&ni_usb_hotplug_lock); -pr_err ("No supported NI usb gpib adapters found, have you loaded its firmware?\n" ); +dev_err (board->gpib_dev,"No supported adapters found, have you loaded its firmware?\n" );return -ENODEV ; }if (usb_reset_configuration (interface_to_usbdev (ni_priv->bus_interface))) -dev_err (&usb_dev->dev,"ni_usb_gpib: usb_reset_configuration() failed.\n" ); +dev_err (&usb_dev->dev,"usb_reset_configuration() failed.\n" ); product_id =le16_to_cpu (usb_dev->descriptor.idProduct); ni_priv->product_id = product_id;
@@ -2294,7 +2256,9 @@ static int ni_usb_attach(gpib_board_t *board, const gpib_board_config_t *config) }mutex_unlock (&ni_usb_hotplug_lock); -dev_info (&usb_dev->dev,"%s: attached\n" , __func__); +dev_info (&usb_dev->dev, +"bus %d dev num %d attached to gpib%d, intf %i\n" , + usb_dev->bus->busnum, usb_dev->devnum, board->minor, index);return retval; }
@@ -2302,27 +2266,19 @@ static int ni_usb_shutdown_hardware(struct ni_usb_priv *ni_priv) {struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface);int retval; -int i =0 ;struct ni_usb_register writes[2 ];static const int writes_length =ARRAY_SIZE (writes);unsigned int ibsta; -// printk("%s: %s\n", __func__); - writes[i].device =NIUSB_SUBDEV_TNT4882 ; - writes[i].address =nec7210_to_tnt4882_offset (AUXMR ); - writes[i].value =AUX_CR ; - i++; - writes[i].device =NIUSB_SUBDEV_UNKNOWN3 ; - writes[i].address =0x10 ; - writes[i].value =0x0 ; - i++; -if (i > writes_length) { -dev_err (&usb_dev->dev,"%s: bug!, buffer overrun, i=%i\n" , __func__, i); -return -EINVAL ; - } - retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta); + writes[0 ].device =NIUSB_SUBDEV_TNT4882 ; + writes[0 ].address =nec7210_to_tnt4882_offset (AUXMR ); + writes[0 ].value =AUX_CR ; + writes[1 ].device =NIUSB_SUBDEV_UNKNOWN3 ; + writes[1 ].address =0x10 ; + writes[1 ].value =0x0 ; + retval =ni_usb_write_registers (ni_priv, writes, writes_length, &ibsta);if (retval) { -dev_err (&usb_dev->dev,"%s: register write failed, retval=%i\n" , __func__, retval); +dev_err (&usb_dev->dev,"register write failed, retval=%i\n" , retval);return retval; }return 0 ;
@@ -2411,7 +2367,7 @@ static int ni_usb_driver_probe(struct usb_interface *interface, const struct usbif (i ==MAX_NUM_NI_USB_INTERFACES ) {usb_put_dev (usb_dev);mutex_unlock (&ni_usb_hotplug_lock); -dev_err (&usb_dev->dev,"%s: ni_usb_driver_interfaces[] full\n" , __func__); +dev_err (&usb_dev->dev,"ni_usb_driver_interfaces[] full\n" );return -1 ; } path =kmalloc (path_length,GFP_KERNEL );
@@ -2421,7 +2377,7 @@ static int ni_usb_driver_probe(struct usb_interface *interface, const struct usbreturn -ENOMEM ; }usb_make_path (usb_dev, path, path_length); -dev_info (&usb_dev->dev,"ni_usb_gpib: probe succeeded for path: %s\n" , path); +dev_info (&usb_dev->dev,"probe succeeded for path: %s\n" , path);kfree (path);mutex_unlock (&ni_usb_hotplug_lock);return 0 ;
@@ -2456,8 +2412,7 @@ static void ni_usb_driver_disconnect(struct usb_interface *interface) } }if (i ==MAX_NUM_NI_USB_INTERFACES ) -dev_err (&usb_dev->dev,"%s: unable to find interface in ni_usb_driver_interfaces[]? bug?\n" , - __func__); +dev_err (&usb_dev->dev,"unable to find interface bug?\n" );usb_put_dev (usb_dev);mutex_unlock (&ni_usb_hotplug_lock); }
@@ -2496,9 +2451,9 @@ static int ni_usb_driver_suspend(struct usb_interface *interface, pm_message_t mni_usb_cleanup_urbs (ni_priv);mutex_unlock (&ni_priv->interrupt_transfer_lock); } -dev_info (&usb_dev->dev, -"bus %d dev num %d gpib minor %d, ni usb interface %i suspended\n" , - usb_dev->bus->busnum, usb_dev->devnum, board->minor, i); +dev_dbg (&usb_dev->dev, +"bus %d dev num %d gpib%d, interface %i suspended\n" , + usb_dev->bus->busnum, usb_dev->devnum, board->minor, i); }mutex_unlock (&ni_usb_hotplug_lock);
@@ -2533,15 +2488,15 @@ static int ni_usb_driver_resume(struct usb_interface *interface)mutex_lock (&ni_priv->interrupt_transfer_lock); retval =usb_submit_urb (ni_priv->interrupt_urb,GFP_KERNEL );if (retval) { -dev_err (&usb_dev->dev,"%s: failed to resubmit interrupt urb, retval=%i\n" , - __func__, retval); +dev_err (&usb_dev->dev,"resume failed to resubmit interrupt urb, retval=%i\n" , + retval);mutex_unlock (&ni_priv->interrupt_transfer_lock);mutex_unlock (&ni_usb_hotplug_lock);return retval; }mutex_unlock (&ni_priv->interrupt_transfer_lock); }else { -dev_err (&usb_dev->dev,"%s: bug! int urb not set up\n" , __func__); +dev_err (&usb_dev->dev,"bug! resume int urb not set up\n" );mutex_unlock (&ni_usb_hotplug_lock);return -EINVAL ; }
@@ -2598,9 +2553,9 @@ static int ni_usb_driver_resume(struct usb_interface *interface)if (ni_priv->ren_state)ni_usb_remote_enable (board,1 ); -dev_info (&usb_dev->dev, -"bus %d dev num %d gpib minor %d, ni usb interface %i resumed\n" , - usb_dev->bus->busnum, usb_dev->devnum, board->minor, i); +dev_dbg (&usb_dev->dev, +"bus %d dev num %d gpib%d, interface %i resumed\n" , + usb_dev->bus->busnum, usb_dev->devnum, board->minor, i); }mutex_unlock (&ni_usb_hotplug_lock);
@@ -2608,7 +2563,7 @@ static int ni_usb_driver_resume(struct usb_interface *interface) }static struct usb_driver ni_usb_bus_driver = { - .name ="ni_usb_gpib" , + .name =DRV_NAME , .probe = ni_usb_driver_probe, .disconnect = ni_usb_driver_disconnect, .suspend = ni_usb_driver_suspend,
@@ -2621,19 +2576,18 @@ static int __init ni_usb_init_module(void)int i;int ret; -pr_info ("ni_usb_gpib driver loading\n" );for (i =0 ; i <MAX_NUM_NI_USB_INTERFACES ; i++) ni_usb_driver_interfaces[i] =NULL ; ret =usb_register (&ni_usb_bus_driver);if (ret) { -pr_err ("ni_usb_gpib: usb_register failed: error = %d\n" , ret); +pr_err ("usb_register failed: error = %d\n" , ret);return ret; } ret =gpib_register_driver (&ni_usb_gpib_interface,THIS_MODULE );if (ret) { -pr_err ("ni_usb_gpib: gpib_register_driver failed: error = %d\n" , ret); +pr_err ("gpib_register_driver failed: error = %d\n" , ret);return ret; }
@@ -2642,7 +2596,6 @@ static int __init ni_usb_init_module(void) static void __exit ni_usb_exit_module(void) { -pr_info ("ni_usb_gpib driver unloading\n" );gpib_unregister_driver (&ni_usb_gpib_interface);usb_deregister (&ni_usb_bus_driver); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 422/499 staging: gpib: Fix Oops after disconnect in ni_usb
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
[ Upstream commit a239c6e91b665f1837cf57b97fe638ef1baf2e78 ]
If the usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the bus_interface is set to NULL on disconnect.
This problem was introduced by setting usb_dev from the bus_interface for dev_xxx messages.
Previously bus_interface was checked for NULL only in the the functions directly calling usb_fill_bulk_urb or usb_control_msg.
Check for valid bus_interface on all interface entry points and return -ENODEV if it is NULL.
--- drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 93 ++++++++++++++++++----- 1 file changed, 73 insertions(+), 20 deletions(-)
drivers/staging/gpib/ni_usb/ni_usb_gpib.c +73 -20
@@ -592,7 +592,7 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length, {int retval, parse_retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;u8 *out_data, *in_data;static const int out_data_length =0x20 ;int in_data_length;
@@ -605,8 +605,11 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length,struct ni_usb_register reg; *bytes_read =0 ; +if (!ni_priv->bus_interface) +return -ENODEV ;if (length > max_read_length)return -EINVAL ; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)return -ENOMEM ;
@@ -719,7 +722,7 @@ static int ni_usb_write(gpib_board_t *board, uint8_t *buffer, size_t length, {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;u8 *out_data, *in_data;int out_data_length;static const int in_data_length =0x10 ;
@@ -729,9 +732,11 @@ static int ni_usb_write(gpib_board_t *board, uint8_t *buffer, size_t length,struct ni_usb_status_block status;static const int max_write_length =0xffff ; - *bytes_written =0 ; +if (!ni_priv->bus_interface) +return -ENODEV ;if (length > max_write_length)return -EINVAL ; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); out_data_length = length +0x10 ; out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)
@@ -818,7 +823,7 @@ static int ni_usb_command_chunk(gpib_board_t *board, uint8_t *buffer, size_t len {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;u8 *out_data, *in_data;int out_data_length;static const int in_data_length =0x10 ;
@@ -830,8 +835,11 @@ static int ni_usb_command_chunk(gpib_board_t *board, uint8_t *buffer, size_t lenstatic const int max_command_length =0x10 ; *command_bytes_written =0 ; +if (!ni_priv->bus_interface) +return -ENODEV ;if (length > max_command_length) length = max_command_length; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); out_data_length = length +0x10 ; out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)
@@ -924,7 +932,7 @@ static int ni_usb_take_control(gpib_board_t *board, int synchronous) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;u8 *out_data, *in_data;static const int out_data_length =0x10 ;static const int in_data_length =0x10 ;
@@ -932,6 +940,9 @@ static int ni_usb_take_control(gpib_board_t *board, int synchronous)int i =0 ;struct ni_usb_status_block status; +if (!ni_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)return -ENOMEM ;
@@ -982,7 +993,7 @@ static int ni_usb_go_to_standby(gpib_board_t *board) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;u8 *out_data, *in_data;static const int out_data_length =0x10 ;static const int in_data_length =0x20 ;
@@ -990,6 +1001,9 @@ static int ni_usb_go_to_standby(gpib_board_t *board)int i =0 ;struct ni_usb_status_block status; +if (!ni_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)return -ENOMEM ;
@@ -1038,11 +1052,14 @@ static void ni_usb_request_system_control(gpib_board_t *board, int request_contr {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;int i =0 ;struct ni_usb_register writes[4 ];unsigned int ibsta; +if (!ni_priv->bus_interface) +return ;// -ENODEV; + usb_dev =interface_to_usbdev (ni_priv->bus_interface);if (request_control) { writes[i].device =NIUSB_SUBDEV_TNT4882 ; writes[i].address =CMDR ;
@@ -1086,7 +1103,7 @@ static void ni_usb_interface_clear(gpib_board_t *board, int assert) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;u8 *out_data, *in_data;static const int out_data_length =0x10 ;static const int in_data_length =0x10 ;
@@ -1094,7 +1111,10 @@ static void ni_usb_interface_clear(gpib_board_t *board, int assert)int i =0 ;struct ni_usb_status_block status; -// FIXME: we are going to pulse when assert is true, and ignore otherwise +if (!ni_priv->bus_interface) +return ;// -ENODEV; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); +// FIXME: we are going to pulse when assert is true, and ignore otherwise if (assert ==0 )return ; out_data =kmalloc (out_data_length,GFP_KERNEL );
@@ -1132,10 +1152,13 @@ static void ni_usb_remote_enable(gpib_board_t *board, int enable) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;struct ni_usb_register reg;unsigned int ibsta; +if (!ni_priv->bus_interface) +return ;// -ENODEV; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); reg.device =NIUSB_SUBDEV_TNT4882 ; reg.address =nec7210_to_tnt4882_offset (AUXMR );if (enable)
@@ -1179,11 +1202,14 @@ static unsigned int ni_usb_update_status(gpib_board_t *board, unsigned int clear {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;static const int buffer_length =8 ;u8 *buffer;struct ni_usb_status_block status; +if (!ni_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); buffer =kmalloc (buffer_length,GFP_KERNEL );if (!buffer)return board->status;
@@ -1231,11 +1257,14 @@ static int ni_usb_primary_address(gpib_board_t *board, unsigned int address) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;int i =0 ;struct ni_usb_register writes[2 ];unsigned int ibsta; +if (!ni_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); writes[i].device =NIUSB_SUBDEV_TNT4882 ; writes[i].address =nec7210_to_tnt4882_offset (ADR ); writes[i].value = address;
@@ -1286,11 +1315,14 @@ static int ni_usb_secondary_address(gpib_board_t *board, unsigned int address, i {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;int i =0 ;struct ni_usb_register writes[3 ];unsigned int ibsta; +if (!ni_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); i +=ni_usb_write_sad (writes, address, enable); retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta);if (retval <0 ) {
@@ -1305,7 +1337,7 @@ static int ni_usb_parallel_poll(gpib_board_t *board, uint8_t *result) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;u8 *out_data, *in_data;static const int out_data_length =0x10 ;static const int in_data_length =0x20 ;
@@ -1314,6 +1346,9 @@ static int ni_usb_parallel_poll(gpib_board_t *board, uint8_t *result)int j =0 ;struct ni_usb_status_block status; +if (!ni_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)return -ENOMEM ;
@@ -1357,11 +1392,14 @@ static void ni_usb_parallel_poll_configure(gpib_board_t *board, uint8_t config) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;int i =0 ;struct ni_usb_register writes[1 ];unsigned int ibsta; +if (!ni_priv->bus_interface) +return ;// -ENODEV; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); writes[i].device =NIUSB_SUBDEV_TNT4882 ; writes[i].address =nec7210_to_tnt4882_offset (AUXMR ); writes[i].value =PPR | config;
@@ -1379,11 +1417,14 @@ static void ni_usb_parallel_poll_response(gpib_board_t *board, int ist) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;int i =0 ;struct ni_usb_register writes[1 ];unsigned int ibsta; +if (!ni_priv->bus_interface) +return ;// -ENODEV; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); writes[i].device =NIUSB_SUBDEV_TNT4882 ; writes[i].address =nec7210_to_tnt4882_offset (AUXMR );if (ist)
@@ -1404,11 +1445,14 @@ static void ni_usb_serial_poll_response(gpib_board_t *board, u8 status) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;int i =0 ;struct ni_usb_register writes[1 ];unsigned int ibsta; +if (!ni_priv->bus_interface) +return ;// -ENODEV; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); writes[i].device =NIUSB_SUBDEV_TNT4882 ; writes[i].address =nec7210_to_tnt4882_offset (SPMR ); writes[i].value = status;
@@ -1431,11 +1475,14 @@ static void ni_usb_return_to_local(gpib_board_t *board) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;int i =0 ;struct ni_usb_register writes[1 ];unsigned int ibsta; +if (!ni_priv->bus_interface) +return ;// -ENODEV; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); writes[i].device =NIUSB_SUBDEV_TNT4882 ; writes[i].address =nec7210_to_tnt4882_offset (AUXMR ); writes[i].value =AUX_RTL ;
@@ -1453,7 +1500,7 @@ static int ni_usb_line_status(const gpib_board_t *board) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;u8 *out_data, *in_data;static const int out_data_length =0x20 ;static const int in_data_length =0x20 ;
@@ -1463,6 +1510,9 @@ static int ni_usb_line_status(const gpib_board_t *board)int line_status = ValidALL;// NI windows driver reads 0xd(HSSEL), 0xc (ARD0), 0x1f (BSR) +if (!ni_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)return -ENOMEM ;
@@ -1569,12 +1619,15 @@ static unsigned int ni_usb_t1_delay(gpib_board_t *board, unsigned int nano_sec) {int retval;struct ni_usb_priv *ni_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (ni_priv->bus_interface); +struct usb_device *usb_dev;struct ni_usb_register writes[3 ];unsigned int ibsta;unsigned int actual_ns;int i; +if (!ni_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (ni_priv->bus_interface); i =ni_usb_setup_t1_delay (writes, nano_sec, &actual_ns); retval =ni_usb_write_registers (ni_priv, writes, i, &ibsta);if (retval <0 ) {
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 423/499 staging: gpib: agilent_82357a: Handle gpib_register_driver() errors
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nihar Chaithanya <[email protected]>
[ Upstream commit 9e43ebc613e2adb9b9e900e11a4099e104b61f2d ]
The usb_register() function can fail and returns an error value which is not returned. The function gpib_register_driver() can also fail which can result in semi-registered module.
In case gpib_register_driver() fails unregister the previous usb driver registering function. Return the error value if gpib_register_driver() or usb_register() functions fail. Add pr_err when registering driver fails also indicating the error value.
Stable-dep-of: 8491e73a5223 ("staging: gpib: Fix Oops after disconnect in agilent usb")
--- .../staging/gpib/agilent_82357a/agilent_82357a.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/staging/gpib/agilent_82357a/agilent_82357a.c +14 -2
@@ -1691,12 +1691,24 @@ static struct usb_driver agilent_82357a_bus_driver = {static int __init agilent_82357a_init_module (void ) {int i; +int ret;pr_info ("agilent_82357a_gpib driver loading" );for (i =0 ; i <MAX_NUM_82357A_INTERFACES ; ++i) agilent_82357a_driver_interfaces[i] =NULL ; -usb_register (&agilent_82357a_bus_driver); -gpib_register_driver (&agilent_82357a_gpib_interface,THIS_MODULE ); + + ret =usb_register (&agilent_82357a_bus_driver); +if (ret) { +pr_err ("agilent_82357a: usb_register failed: error = %d\n" , ret); +return ret; + } + + ret =gpib_register_driver (&agilent_82357a_gpib_interface,THIS_MODULE ); +if (ret) { +pr_err ("agilent_82357a: gpib_register_driver failed: error = %d\n" , ret); +usb_deregister (&agilent_82357a_bus_driver); +return ret; + }return 0 ; }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 424/499 staging: gpib: Add missing mutex unlock in agilent usb driver
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
[ Upstream commit 55eb3c3a6388420afda1374b353717de32ae9573 ]
When no matching product id was found in the attach function the driver returned without unlocking the agilent_82357a_hotplug_lock mutex.
Add the unlock call.
This was detected by smatch:
smatch warnings:drivers/staging/gpib/agilent_82357a/agilent_82357a.c:1381 agilent_82357a_attach() warn: inconsistent returns 'global &agilent_82357a_hotplug_lock'.
Stable-dep-of: 8491e73a5223 ("staging: gpib: Fix Oops after disconnect in agilent usb")
--- drivers/staging/gpib/agilent_82357a/agilent_82357a.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/gpib/agilent_82357a/agilent_82357a.c +1 -0
@@ -1365,6 +1365,7 @@ static int agilent_82357a_attach(gpib_board_t *board, const gpib_board_config_tbreak ;default :dev_err (&usb_dev->dev,"bug, unhandled product_id in switch?\n" ); +mutex_unlock (&agilent_82357a_hotplug_lock);return -EIO ; }#ifdef RESET_USB_CONFIG
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 425/499 staging: gpib: Fix NULL pointer dereference in detach
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
[ Upstream commit 6a6c153537f093c3bc79ea9633f3954d3450d0ba ]
When the detach function is called after a failed attach the usb_dev initialization can cause a NULL pointer dereference. This happens when the usb device is not found in the attach procedure.
Remove the usb_dev variable and initialization and change the dev in the dev_info message from the usb_dev to the gpib_dev.
Stable-dep-of: 8491e73a5223 ("staging: gpib: Fix Oops after disconnect in agilent usb")
--- drivers/staging/gpib/agilent_82357a/agilent_82357a.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/staging/gpib/agilent_82357a/agilent_82357a.c +1 -3
@@ -1442,12 +1442,10 @@ static int agilent_82357a_go_idle(gpib_board_t *board)static void agilent_82357a_detach (gpib_board_t *board) {struct agilent_82357a_priv *a_priv; -struct usb_device *usb_dev;mutex_lock (&agilent_82357a_hotplug_lock); a_priv = board->private_data; - usb_dev =interface_to_usbdev (a_priv->bus_interface);if (a_priv) {if (a_priv->bus_interface) {agilent_82357a_go_idle (board);
@@ -1459,7 +1457,7 @@ static void agilent_82357a_detach(gpib_board_t *board)agilent_82357a_cleanup_urbs (a_priv);agilent_82357a_free_private (a_priv); } -dev_info (&usb_dev->dev,"%s: detached\n" , __func__); +dev_info (board->gpib_dev,"%s: detached\n" , __func__);mutex_unlock (&agilent_82357a_hotplug_lock); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 426/499 staging: gpib: Agilent usb code cleanup
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
[ Upstream commit 579b6f18c5ca162af040f44684cc55f7da182236 ]
Remove useless #ifdef RESET_USB_CONFIG code.
Change kalloc / memset to kzalloc
The attach function was not freeing the private data on error returns. Separate the releasing of urbs and private data and add a common error exit for attach failure.
Set the board private data pointer to NULL after freeing the private data.
Reduce console spam by emitting only one attach message.
Change last pr_err in attach to dev_err
Stable-dep-of: 8491e73a5223 ("staging: gpib: Fix Oops after disconnect in agilent usb")
--- .../gpib/agilent_82357a/agilent_82357a.c | 84 ++++++++----------- 1 file changed, 36 insertions(+), 48 deletions(-)
drivers/staging/gpib/agilent_82357a/agilent_82357a.c +36 -48
@@ -1146,25 +1146,6 @@ static int agilent_82357a_setup_urbs(gpib_board_t *board)return retval; } -#ifdef RESET_USB_CONFIG -static int agilent_82357a_reset_usb_configuration (gpib_board_t *board) -{ -struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); -struct usb_device *usb_dev; -int retval; - -if (!a_priv->bus_interface) -return -ENODEV ; - usb_dev =interface_to_usbdev (a_priv->bus_interface); - retval =usb_reset_configuration (usb_dev); -if (retval) -dev_err (&usb_dev->dev,"%s: usb_reset_configuration() returned %i\n" , - __func__, retval); -return retval; -} -#endif -static void agilent_82357a_cleanup_urbs (struct agilent_82357a_priv *a_priv) {if (a_priv && a_priv->bus_interface) {
@@ -1175,15 +1156,23 @@ static void agilent_82357a_cleanup_urbs(struct agilent_82357a_priv *a_priv) } }; +static void agilent_82357a_release_urbs (struct agilent_82357a_priv *a_priv) +{ +if (a_priv) { +usb_free_urb (a_priv->interrupt_urb); + a_priv->interrupt_urb =NULL ; +kfree (a_priv->interrupt_buffer); + } +} +static int agilent_82357a_allocate_private (gpib_board_t *board) {struct agilent_82357a_priv *a_priv; - board->private_data =kmalloc (sizeof (struct agilent_82357a_priv ),GFP_KERNEL ); + board->private_data =kzalloc (sizeof (struct agilent_82357a_priv ),GFP_KERNEL );if (!board->private_data)return -ENOMEM ; a_priv = board->private_data; -memset (a_priv,0 ,sizeof (struct agilent_82357a_priv ));mutex_init (&a_priv->bulk_transfer_lock);mutex_init (&a_priv->bulk_alloc_lock);mutex_init (&a_priv->control_alloc_lock);
@@ -1191,11 +1180,11 @@ static int agilent_82357a_allocate_private(gpib_board_t *board)return 0 ; } -static void agilent_82357a_free_private (struct agilent_82357a_priv *a_priv) +static void agilent_82357a_free_private (gpib_board_t *board) { -usb_free_urb (a_priv->interrupt_urb); -kfree (a_priv->interrupt_buffer); -kfree (a_priv); +kfree (board->private_data); + board->private_data =NULL ; + }static int agilent_82357a_init (gpib_board_t *board)
@@ -1342,16 +1331,14 @@ static int agilent_82357a_attach(gpib_board_t *board, const gpib_board_config_t a_priv->bus_interface = agilent_82357a_driver_interfaces[i];usb_set_intfdata (agilent_82357a_driver_interfaces[i], board); usb_dev =interface_to_usbdev (a_priv->bus_interface); -dev_info (&usb_dev->dev, -"bus %d dev num %d attached to gpib minor %d, agilent usb interface %i\n" , - usb_dev->bus->busnum, usb_dev->devnum, board->minor, i);break ; } }if (i ==MAX_NUM_82357A_INTERFACES ) { -mutex_unlock (&agilent_82357a_hotplug_lock); -pr_err ("No Agilent 82357 gpib adapters found, have you loaded its firmware?\n" ); -return -ENODEV ; +dev_err (board->gpib_dev, +"No Agilent 82357 gpib adapters found, have you loaded its firmware?\n" ); + retval = -ENODEV ; + goto attach_fail; } product_id =le16_to_cpu (interface_to_usbdev (a_priv->bus_interface)->descriptor.idProduct);switch (product_id) {
@@ -1365,21 +1352,13 @@ static int agilent_82357a_attach(gpib_board_t *board, const gpib_board_config_tbreak ;default :dev_err (&usb_dev->dev,"bug, unhandled product_id in switch?\n" ); -mutex_unlock (&agilent_82357a_hotplug_lock); -return -EIO ; - } -#ifdef RESET_USB_CONFIG - retval =agilent_82357a_reset_usb_configuration (board); -if (retval <0 ) { -mutex_unlock (&agilent_82357a_hotplug_lock); -return retval; + retval = -EIO ; + goto attach_fail; } -#endif + retval =agilent_82357a_setup_urbs (board); -if (retval <0 ) { -mutex_unlock (&agilent_82357a_hotplug_lock); -return retval; - } +if (retval <0 ) + goto attach_fail;timer_setup (&a_priv->bulk_timer, agilent_82357a_timeout_handler,0 );
@@ -1388,11 +1367,19 @@ static int agilent_82357a_attach(gpib_board_t *board, const gpib_board_config_t retval =agilent_82357a_init (board);if (retval <0 ) { -mutex_unlock (&agilent_82357a_hotplug_lock); -return retval; +agilent_82357a_cleanup_urbs (a_priv); +agilent_82357a_release_urbs (a_priv); + goto attach_fail; } -dev_info (&usb_dev->dev,"%s: attached\n" , __func__); +dev_info (&usb_dev->dev, +"bus %d dev num %d attached to gpib minor %d, agilent usb interface %i\n" , + usb_dev->bus->busnum, usb_dev->devnum, board->minor, i); +mutex_unlock (&agilent_82357a_hotplug_lock); +return retval; + +attach_fail: +agilent_82357a_free_private (board);mutex_unlock (&agilent_82357a_hotplug_lock);return retval; }
@@ -1455,7 +1442,8 @@ static void agilent_82357a_detach(gpib_board_t *board)mutex_lock (&a_priv->bulk_alloc_lock);mutex_lock (&a_priv->interrupt_alloc_lock);agilent_82357a_cleanup_urbs (a_priv); -agilent_82357a_free_private (a_priv); +agilent_82357a_release_urbs (a_priv); +agilent_82357a_free_private (board); }dev_info (board->gpib_dev,"%s: detached\n" , __func__);mutex_unlock (&agilent_82357a_hotplug_lock);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 427/499 staging: gpib: agilent usb console messaging cleanup
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
[ Upstream commit 50a6ed0494bc082227c38f427b40731bca9bdf15 ]
Enable module name to be printed in pr_xxx and dev_xxx Use DRV_NAME defined as KBUILD_MODNAME instead of hard coded string in usb_driver struct.
Remove __func__ parameter in dev_dbg messages as this can be enabled with dynamic debug.
Remove __func__ parameter in dev_err messages as they are not needed. The module name is sufficient.
Change pr_info to dev_dbg where needed and remove the rest where possible.
Remove test and error messages for buffer over run in write and read_registers as these are just trying to catch bugs in the driver.
Remove agilent_82357a string prefix in error messages.
Return -EIO for too many reads in read_registers instead of continuing after printing an error message.
Change pr_warn to dev_warn.
Remove warning on calls for unsupported functionality.
Remove test and message for buffer overflow in agilent_82357_init and agilent_82357a_go_idle which are just checking for a driver bug. Use actual indeces in the array instead of i and then incrementing i so that the code is clear and there is no need to check for overflow or print a message.
Stable-dep-of: 8491e73a5223 ("staging: gpib: Fix Oops after disconnect in agilent usb")
--- .../gpib/agilent_82357a/agilent_82357a.c | 359 +++++++----------- 1 file changed, 143 insertions(+), 216 deletions(-)
drivers/staging/gpib/agilent_82357a/agilent_82357a.c +143 -216
@@ -7,6 +7,10 @@#define _GNU_SOURCE +#define pr_fmt (fmt) KBUILD_MODNAME ": " fmt +#define dev_fmt pr_fmt +#define DRV_NAME KBUILD_MODNAME +#include <linux/kernel.h> #include <linux/module.h> #include <linux/slab.h>
@@ -79,14 +83,12 @@ static int agilent_82357a_send_bulk_msg(struct agilent_82357a_priv *a_priv, void retval =usb_submit_urb (a_priv->bulk_urb,GFP_KERNEL );if (retval) { -dev_err (&usb_dev->dev,"%s: failed to submit bulk out urb, retval=%i\n" , - __func__, retval); +dev_err (&usb_dev->dev,"failed to submit bulk out urb, retval=%i\n" , retval);mutex_unlock (&a_priv->bulk_alloc_lock); goto cleanup; }mutex_unlock (&a_priv->bulk_alloc_lock);if (down_interruptible (&context->complete)) { -dev_err (&usb_dev->dev,"%s: interrupted\n" , __func__); retval = -ERESTARTSYS ; goto cleanup; }
@@ -149,14 +151,12 @@ static int agilent_82357a_receive_bulk_msg(struct agilent_82357a_priv *a_priv, v retval =usb_submit_urb (a_priv->bulk_urb,GFP_KERNEL );if (retval) { -dev_err (&usb_dev->dev,"%s: failed to submit bulk out urb, retval=%i\n" , - __func__, retval); +dev_err (&usb_dev->dev,"failed to submit bulk in urb, retval=%i\n" , retval);mutex_unlock (&a_priv->bulk_alloc_lock); goto cleanup; }mutex_unlock (&a_priv->bulk_alloc_lock);if (down_interruptible (&context->complete)) { -dev_err (&usb_dev->dev,"%s: interrupted\n" , __func__); retval = -ERESTARTSYS ; goto cleanup; }
@@ -205,7 +205,6 @@ static int agilent_82357a_receive_control_msg(struct agilent_82357a_priv *a_privstatic void agilent_82357a_dump_raw_block (const u8 *raw_data,int length) { -pr_info ("hex block dump\n" );print_hex_dump (KERN_INFO ,"" ,DUMP_PREFIX_NONE ,8 ,1 , raw_data, length, true); }
@@ -225,7 +224,7 @@ static int agilent_82357a_write_registers(struct agilent_82357a_priv *a_priv,static const int max_writes =31 ;if (num_writes > max_writes) { -dev_err (&usb_dev->dev,"%s: bug! num_writes=%i too large\n" , __func__, num_writes); +dev_err (&usb_dev->dev,"bug! num_writes=%i too large\n" , num_writes);return -EIO ; } out_data_length = num_writes * bytes_per_write + header_length;
@@ -239,8 +238,7 @@ static int agilent_82357a_write_registers(struct agilent_82357a_priv *a_priv, out_data[i++] = writes[j].address; out_data[i++] = writes[j].value; } -if (i > out_data_length) -dev_err (&usb_dev->dev,"%s: bug! buffer overrun\n" , __func__); + retval =mutex_lock_interruptible (&a_priv->bulk_transfer_lock);if (retval) {kfree (out_data);
@@ -249,8 +247,8 @@ static int agilent_82357a_write_registers(struct agilent_82357a_priv *a_priv, retval =agilent_82357a_send_bulk_msg (a_priv, out_data, i, &bytes_written,1000 );kfree (out_data);if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , - __func__, retval, bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , + retval, bytes_written, i);mutex_unlock (&a_priv->bulk_transfer_lock);return retval; }
@@ -265,20 +263,19 @@ static int agilent_82357a_write_registers(struct agilent_82357a_priv *a_priv,mutex_unlock (&a_priv->bulk_transfer_lock);if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);agilent_82357a_dump_raw_block (in_data, bytes_read);kfree (in_data);return -EIO ; }if (in_data[0 ] != (0xff & ~DATA_PIPE_CMD_WR_REGS )) { -dev_err (&usb_dev->dev,"%s: error, bulk command=0x%x != ~DATA_PIPE_CMD_WR_REGS\n" , - __func__, in_data[0 ]); +dev_err (&usb_dev->dev,"bulk command=0x%x != ~DATA_PIPE_CMD_WR_REGS\n" , in_data[0 ]);return -EIO ; }if (in_data[1 ]) { -dev_err (&usb_dev->dev,"%s: nonzero error code 0x%x in DATA_PIPE_CMD_WR_REGS response\n" , - __func__, in_data[1 ]); +dev_err (&usb_dev->dev,"nonzero error code 0x%x in DATA_PIPE_CMD_WR_REGS response\n" , + in_data[1 ]);return -EIO ; }kfree (in_data);
@@ -299,9 +296,10 @@ static int agilent_82357a_read_registers(struct agilent_82357a_priv *a_priv,static const int header_length =2 ;static const int max_reads =62 ; -if (num_reads > max_reads) -dev_err (&usb_dev->dev,"%s: bug! num_reads=%i too large\n" , __func__, num_reads); - +if (num_reads > max_reads) { +dev_err (&usb_dev->dev,"bug! num_reads=%i too large\n" , num_reads); +return -EIO ; + } out_data_length = num_reads + header_length; out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)
@@ -311,8 +309,7 @@ static int agilent_82357a_read_registers(struct agilent_82357a_priv *a_priv, out_data[i++] = num_reads;for (j =0 ; j < num_reads; j++) out_data[i++] = reads[j].address; -if (i > out_data_length) -dev_err (&usb_dev->dev,"%s: bug! buffer overrun\n" , __func__); +if (blocking) { retval =mutex_lock_interruptible (&a_priv->bulk_transfer_lock);if (retval) {
@@ -329,8 +326,8 @@ static int agilent_82357a_read_registers(struct agilent_82357a_priv *a_priv, retval =agilent_82357a_send_bulk_msg (a_priv, out_data, i, &bytes_written,1000 );kfree (out_data);if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , - __func__, retval, bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , + retval, bytes_written, i);mutex_unlock (&a_priv->bulk_transfer_lock);return retval; }
@@ -345,21 +342,20 @@ static int agilent_82357a_read_registers(struct agilent_82357a_priv *a_priv,mutex_unlock (&a_priv->bulk_transfer_lock);if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);agilent_82357a_dump_raw_block (in_data, bytes_read);kfree (in_data);return -EIO ; } i =0 ;if (in_data[i++] != (0xff & ~DATA_PIPE_CMD_RD_REGS )) { -dev_err (&usb_dev->dev,"%s: error, bulk command=0x%x != ~DATA_PIPE_CMD_RD_REGS\n" , - __func__, in_data[0 ]); +dev_err (&usb_dev->dev,"bulk command=0x%x != ~DATA_PIPE_CMD_RD_REGS\n" , in_data[0 ]);return -EIO ; }if (in_data[i++]) { -dev_err (&usb_dev->dev,"%s: nonzero error code 0x%x in DATA_PIPE_CMD_RD_REGS response\n" , - __func__, in_data[1 ]); +dev_err (&usb_dev->dev,"nonzero error code 0x%x in DATA_PIPE_CMD_RD_REGS response\n" , + in_data[1 ]);return -EIO ; }for (j =0 ; j < num_reads; j++)
@@ -390,14 +386,13 @@ static int agilent_82357a_abort(struct agilent_82357a_priv *a_priv, int flush) wIndex, status_data, status_data_len, 100);if (receive_control_retval <0 ) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_receive_control_msg() returned %i\n" , - __func__, receive_control_retval); +dev_err (&usb_dev->dev,"82357a_receive_control_msg() returned %i\n" , + receive_control_retval); retval = -EIO ; goto cleanup; }if (status_data[0 ] != (~XFER_ABORT &0xff )) { -dev_err (&usb_dev->dev,"%s: error, major code=0x%x != ~XFER_ABORT\n" , - __func__, status_data[0 ]); +dev_err (&usb_dev->dev,"major code=0x%x != ~XFER_ABORT\n" , status_data[0 ]); retval = -EIO ; goto cleanup; }
@@ -413,8 +408,7 @@ static int agilent_82357a_abort(struct agilent_82357a_priv *a_priv, int flush) fallthrough;case UGP_ERR_FLUSHING_ALREADY :default : -dev_err (&usb_dev->dev,"%s: abort returned error code=0x%x\n" , - __func__, status_data[1 ]); +dev_err (&usb_dev->dev,"abort returned error code=0x%x\n" , status_data[1 ]); retval = -EIO ;break ; }
@@ -469,8 +463,8 @@ static int agilent_82357a_read(gpib_board_t *board, uint8_t *buffer, size_t leng retval =agilent_82357a_send_bulk_msg (a_priv, out_data, i, &bytes_written, msec_timeout);kfree (out_data);if (retval || bytes_written != i) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , - __func__, retval, bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, bytes_written=%i, i=%i\n" , + retval, bytes_written, i);mutex_unlock (&a_priv->bulk_transfer_lock);if (retval <0 )return retval;
@@ -501,19 +495,19 @@ static int agilent_82357a_read(gpib_board_t *board, uint8_t *buffer, size_t leng &extra_bytes_read, 100); bytes_read += extra_bytes_read;if (extra_bytes_retval) { -dev_err (&usb_dev->dev,"%s: extra_bytes_retval=%i, bytes_read=%i\n" , - __func__, extra_bytes_retval, bytes_read); +dev_err (&usb_dev->dev,"extra_bytes_retval=%i, bytes_read=%i\n" , + extra_bytes_retval, bytes_read);agilent_82357a_abort (a_priv,0 ); } }else if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_receive_bulk_msg returned %i, bytes_read=%i\n" , - __func__, retval, bytes_read); +dev_err (&usb_dev->dev,"receive_bulk_msg returned %i, bytes_read=%i\n" , + retval, bytes_read);agilent_82357a_abort (a_priv,0 ); }mutex_unlock (&a_priv->bulk_transfer_lock);if (bytes_read > length +1 ) { bytes_read = length +1 ; -pr_warn ("%s: bytes_read > length? truncating" , __func__); +dev_warn (&usb_dev->dev,"bytes_read > length? truncating" ); }if (bytes_read >=1 ) {
@@ -584,8 +578,8 @@ static ssize_t agilent_82357a_generic_write(gpib_board_t *board, uint8_t *bufferkfree (out_data);if (retval || raw_bytes_written != i) {agilent_82357a_abort (a_priv,0 ); -dev_err (&usb_dev->dev,"%s: agilent_82357a_send_bulk_msg returned %i, raw_bytes_written=%i, i=%i\n" , - __func__, retval, raw_bytes_written, i); +dev_err (&usb_dev->dev,"send_bulk_msg returned %i, raw_bytes_written=%i, i=%i\n" , + retval, raw_bytes_written, i);mutex_unlock (&a_priv->bulk_transfer_lock);if (retval <0 )return retval;
@@ -597,7 +591,7 @@ static ssize_t agilent_82357a_generic_write(gpib_board_t *board, uint8_t *buffer &a_priv->interrupt_flags) || test_bit(TIMO_NUM, &board->status));if (retval) { -dev_err (&usb_dev->dev,"%s: wait write complete interrupted\n" , __func__); +dev_dbg (&usb_dev->dev,"wait write complete interrupted\n" );agilent_82357a_abort (a_priv,0 );mutex_unlock (&a_priv->bulk_transfer_lock);return -ERESTARTSYS ;
@@ -614,8 +608,7 @@ static ssize_t agilent_82357a_generic_write(gpib_board_t *board, uint8_t *buffer read_reg.address =BSR ; retval =agilent_82357a_read_registers (a_priv, &read_reg,1 ,1 );if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_read_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"read_registers() returned error\n" );return -ETIMEDOUT ; }
@@ -632,8 +625,7 @@ static ssize_t agilent_82357a_generic_write(gpib_board_t *board, uint8_t *buffer read_reg.address =ADSR ; retval =agilent_82357a_read_registers (a_priv, &read_reg,1 ,1 );if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_read_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"read_registers() returned error\n" );return -ETIMEDOUT ; } adsr = read_reg.value;
@@ -659,8 +651,7 @@ static ssize_t agilent_82357a_generic_write(gpib_board_t *board, uint8_t *buffer 100);mutex_unlock (&a_priv->bulk_transfer_lock);if (retval <0 ) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_receive_control_msg() returned %i\n" , - __func__, retval); +dev_err (&usb_dev->dev,"receive_control_msg() returned %i\n" , retval);kfree (status_data);return -EIO ; }
@@ -699,8 +690,7 @@ int agilent_82357a_take_control_internal(gpib_board_t *board, int synchronous) write.value =AUX_TCA ; retval =agilent_82357a_write_registers (a_priv, &write,1 );if (retval) -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" );return retval; }
@@ -741,8 +731,7 @@ static int agilent_82357a_go_to_standby(gpib_board_t *board) write.value =AUX_GTS ; retval =agilent_82357a_write_registers (a_priv, &write,1 );if (retval) -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" );return 0 ; }
@@ -771,8 +760,7 @@ static void agilent_82357a_request_system_control(gpib_board_t *board, int reque ++i; retval =agilent_82357a_write_registers (a_priv, writes, i);if (retval) -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" );return ;// retval; }
@@ -791,8 +779,7 @@ static void agilent_82357a_interface_clear(gpib_board_t *board, int assert) } retval =agilent_82357a_write_registers (a_priv, &write,1 );if (retval) -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" ); }static void agilent_82357a_remote_enable (gpib_board_t *board,int enable)
@@ -808,8 +795,7 @@ static void agilent_82357a_remote_enable(gpib_board_t *board, int enable) write.value |=AUX_CS ; retval =agilent_82357a_write_registers (a_priv, &write,1 );if (retval) -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" ); a_priv->ren_state = enable;return ;// 0; }
@@ -818,10 +804,9 @@ static int agilent_82357a_enable_eos(gpib_board_t *board, uint8_t eos_byte, int {struct agilent_82357a_priv *a_priv = board->private_data; -if (compare_8_bits ==0 ) { -pr_warn ("%s: hardware only supports 8-bit EOS compare" , __func__); +if (compare_8_bits ==0 )return -EOPNOTSUPP ; - } + a_priv->eos_char = eos_byte; a_priv->eos_mode =REOS |BIN ;return 0 ;
@@ -850,8 +835,7 @@ static unsigned int agilent_82357a_update_status(gpib_board_t *board, unsigned i retval =agilent_82357a_read_registers (a_priv, &address_status,1 ,0 );if (retval) {if (retval != -EAGAIN ) -dev_err (&usb_dev->dev,"%s: agilent_82357a_read_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"read_registers() returned error\n" );return board->status; }// check for remote/local
@@ -883,8 +867,7 @@ static unsigned int agilent_82357a_update_status(gpib_board_t *board, unsigned i retval =agilent_82357a_read_registers (a_priv, &bus_status,1 ,0 );if (retval) {if (retval != -EAGAIN ) -dev_err (&usb_dev->dev,"%s: agilent_82357a_read_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"read_registers() returned error\n" );return board->status; }if (bus_status.value &BSR_SRQ_BIT )
@@ -907,8 +890,7 @@ static int agilent_82357a_primary_address(gpib_board_t *board, unsigned int addr write.value = address &ADDRESS_MASK ; retval =agilent_82357a_write_registers (a_priv, &write,1 );if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" );return retval; }return retval;
@@ -917,8 +899,8 @@ static int agilent_82357a_primary_address(gpib_board_t *board, unsigned int addrstatic int agilent_82357a_secondary_address (gpib_board_t *board,unsigned int address,int enable) {if (enable) -pr_warn ("%s: warning: assigning a secondary address not supported\n" , __func__); -return -EOPNOTSUPP ; +return -EOPNOTSUPP ; +return 0 ; }static int agilent_82357a_parallel_poll (gpib_board_t *board,uint8_t *result)
@@ -936,16 +918,14 @@ static int agilent_82357a_parallel_poll(gpib_board_t *board, uint8_t *result) writes[1 ].value = a_priv->hw_control_bits & ~NOT_PARALLEL_POLL ; retval =agilent_82357a_write_registers (a_priv, writes,2 );if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" );return retval; }udelay (2 );//silly, since usb write will take way longer read.address =CPTR ; retval =agilent_82357a_read_registers (a_priv, &read,1 ,1 );if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_read_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"read_registers() returned error\n" );return retval; } *result = read.value;
@@ -956,8 +936,7 @@ static int agilent_82357a_parallel_poll(gpib_board_t *board, uint8_t *result) writes[1 ].value =AUX_RPP ; retval =agilent_82357a_write_registers (a_priv, writes,2 );if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" );return retval; }return 0 ;
@@ -1005,8 +984,7 @@ static int agilent_82357a_line_status(const gpib_board_t *board) retval =agilent_82357a_read_registers (a_priv, &bus_status,1 ,0 );if (retval) {if (retval != -EAGAIN ) -dev_err (&usb_dev->dev,"%s: agilent_82357a_read_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"read_registers() returned error\n" );return retval; }if (bus_status.value &BSR_REN_BIT )
@@ -1055,8 +1033,7 @@ static unsigned int agilent_82357a_t1_delay(gpib_board_t *board, unsigned int na write.value =nanosec_to_fast_talker_bits (&nanosec); retval =agilent_82357a_write_registers (a_priv, &write,1 );if (retval) -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" );return nanosec; }
@@ -1081,7 +1058,7 @@ static void agilent_82357a_interrupt_complete(struct urb *urb)default :/* other error, resubmit */ retval =usb_submit_urb (a_priv->interrupt_urb,GFP_ATOMIC );if (retval) -dev_err (&usb_dev->dev,"%s: failed to resubmit interrupt urb\n" , __func__); +dev_err (&usb_dev->dev,"failed to resubmit interrupt urb\n" );return ; }
@@ -1097,7 +1074,7 @@ static void agilent_82357a_interrupt_complete(struct urb *urb) retval =usb_submit_urb (a_priv->interrupt_urb,GFP_ATOMIC );if (retval) -dev_err (&usb_dev->dev,"%s: failed to resubmit interrupt urb\n" , __func__); +dev_err (&usb_dev->dev,"failed to resubmit interrupt urb\n" ); }static int agilent_82357a_setup_urbs (gpib_board_t *board)
@@ -1133,8 +1110,7 @@ static int agilent_82357a_setup_urbs(gpib_board_t *board)if (retval) {usb_free_urb (a_priv->interrupt_urb); a_priv->interrupt_urb =NULL ; -dev_err (&usb_dev->dev,"%s: failed to submit first interrupt urb, retval=%i\n" , - __func__, retval); +dev_err (&usb_dev->dev,"failed to submit first interrupt urb, retval=%i\n" , retval); goto setup_exit; }mutex_unlock (&a_priv->interrupt_alloc_lock);
@@ -1184,108 +1160,78 @@ static void agilent_82357a_free_private(gpib_board_t *board) {kfree (board->private_data); board->private_data =NULL ; - } +#define INIT_NUM_REG_WRITES 18static int agilent_82357a_init (gpib_board_t *board) {struct agilent_82357a_priv *a_priv = board->private_data;struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface);struct agilent_82357a_register_pairlet hw_control; -struct agilent_82357a_register_pairlet writes[0x20 ]; +struct agilent_82357a_register_pairlet writes[INIT_NUM_REG_WRITES ];int retval; -int i;unsigned int nanosec; - i =0 ; - writes[i].address =LED_CONTROL ; - writes[i].value =FAIL_LED_ON ; - ++i; - writes[i].address =RESET_TO_POWERUP ; - writes[i].value =RESET_SPACEBALL ; - ++i; - retval =agilent_82357a_write_registers (a_priv, writes, i); + writes[0 ].address =LED_CONTROL ; + writes[0 ].value =FAIL_LED_ON ; + writes[1 ].address =RESET_TO_POWERUP ; + writes[1 ].value =RESET_SPACEBALL ; + retval =agilent_82357a_write_registers (a_priv, writes,2 );if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" );return -EIO ; }set_current_state (TASK_INTERRUPTIBLE );if (schedule_timeout (usec_to_jiffies (2000 )))return -ERESTARTSYS ; - i =0 ; - writes[i].address =AUXCR ; - writes[i].value =AUX_NBAF ; - ++i; - writes[i].address =AUXCR ; - writes[i].value =AUX_HLDE ; - ++i; - writes[i].address =AUXCR ; - writes[i].value =AUX_TON ; - ++i; - writes[i].address =AUXCR ; - writes[i].value =AUX_LON ; - ++i; - writes[i].address =AUXCR ; - writes[i].value =AUX_RSV2 ; - ++i; - writes[i].address =AUXCR ; - writes[i].value =AUX_INVAL ; - ++i; - writes[i].address =AUXCR ; - writes[i].value =AUX_RPP ; - ++i; - writes[i].address =AUXCR ; - writes[i].value =AUX_STDL ; - ++i; - writes[i].address =AUXCR ; - writes[i].value =AUX_VSTDL ; - ++i; - writes[i].address =FAST_TALKER_T1 ; + writes[0 ].address =AUXCR ; + writes[0 ].value =AUX_NBAF ; + writes[1 ].address =AUXCR ; + writes[1 ].value =AUX_HLDE ; + writes[2 ].address =AUXCR ; + writes[2 ].value =AUX_TON ; + writes[3 ].address =AUXCR ; + writes[3 ].value =AUX_LON ; + writes[4 ].address =AUXCR ; + writes[4 ].value =AUX_RSV2 ; + writes[5 ].address =AUXCR ; + writes[5 ].value =AUX_INVAL ; + writes[6 ].address =AUXCR ; + writes[6 ].value =AUX_RPP ; + writes[7 ].address =AUXCR ; + writes[7 ].value =AUX_STDL ; + writes[8 ].address =AUXCR ; + writes[8 ].value =AUX_VSTDL ; + writes[9 ].address =FAST_TALKER_T1 ; nanosec = board->t1_nano_sec; - writes[i].value =nanosec_to_fast_talker_bits (&nanosec); + writes[9 ].value =nanosec_to_fast_talker_bits (&nanosec); board->t1_nano_sec = nanosec; - ++i; - writes[i].address =ADR ; - writes[i].value = board->pad &ADDRESS_MASK ; - ++i; - writes[i].address =PPR ; - writes[i].value =0 ; - ++i; - writes[i].address =SPMR ; - writes[i].value =0 ; - ++i; - writes[i].address =PROTOCOL_CONTROL ; - writes[i].value =WRITE_COMPLETE_INTERRUPT_EN ; - ++i; - writes[i].address =IMR0 ; - writes[i].value =HR_BOIE |HR_BIIE ; - ++i; - writes[i].address =IMR1 ; - writes[i].value =HR_SRQIE ; - ++i; + writes[10 ].address =ADR ; + writes[10 ].value = board->pad &ADDRESS_MASK ; + writes[11 ].address =PPR ; + writes[11 ].value =0 ; + writes[12 ].address =SPMR ; + writes[12 ].value =0 ; + writes[13 ].address =PROTOCOL_CONTROL ; + writes[13 ].value =WRITE_COMPLETE_INTERRUPT_EN ; + writes[14 ].address =IMR0 ; + writes[14 ].value =HR_BOIE |HR_BIIE ; + writes[15 ].address =IMR1 ; + writes[15 ].value =HR_SRQIE ;// turn off reset state - writes[i].address =AUXCR ; - writes[i].value =AUX_CHIP_RESET ; - ++i; - writes[i].address =LED_CONTROL ; - writes[i].value =FIRMWARE_LED_CONTROL ; - ++i; -if (i >ARRAY_SIZE (writes)) { -dev_err (&usb_dev->dev,"%s: bug! writes[] overflow\n" , __func__); -return -EFAULT ; - } - retval =agilent_82357a_write_registers (a_priv, writes, i); + writes[16 ].address =AUXCR ; + writes[16 ].value =AUX_CHIP_RESET ; + writes[17 ].address =LED_CONTROL ; + writes[17 ].value =FIRMWARE_LED_CONTROL ; + retval =agilent_82357a_write_registers (a_priv, writes,INIT_NUM_REG_WRITES );if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" );return -EIO ; } hw_control.address =HW_CONTROL ; retval =agilent_82357a_read_registers (a_priv, &hw_control,1 ,1 );if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_read_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"read_registers() returned error\n" );return -EIO ; } a_priv->hw_control_bits = (hw_control.value & ~0x7 ) |NOT_TI_RESET |NOT_PARALLEL_POLL ;
@@ -1336,7 +1282,7 @@ static int agilent_82357a_attach(gpib_board_t *board, const gpib_board_config_t }if (i ==MAX_NUM_82357A_INTERFACES ) {dev_err (board->gpib_dev, -"No Agilent 82357 gpib adapters found, have you loaded its firmware?\n" ); +"No supported adapters found, have you loaded its firmware?\n" ); retval = -ENODEV ; goto attach_fail; }
@@ -1372,8 +1318,7 @@ static int agilent_82357a_attach(gpib_board_t *board, const gpib_board_config_t goto attach_fail; } -dev_info (&usb_dev->dev, -"bus %d dev num %d attached to gpib minor %d, agilent usb interface %i\n" , +dev_info (&usb_dev->dev,"bus %d dev num %d attached to gpib%d, interface %i\n" , usb_dev->bus->busnum, usb_dev->devnum, board->minor, i);mutex_unlock (&agilent_82357a_hotplug_lock);return retval;
@@ -1390,37 +1335,24 @@ static int agilent_82357a_go_idle(gpib_board_t *board)struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface);struct agilent_82357a_register_pairlet writes[0x20 ];int retval; -int i; - i =0 ;// turn on tms9914 reset state - writes[i].address =AUXCR ; - writes[i].value =AUX_CS |AUX_CHIP_RESET ; - ++i; + writes[0 ].address =AUXCR ; + writes[0 ].value =AUX_CS |AUX_CHIP_RESET ; a_priv->hw_control_bits &= ~NOT_TI_RESET ; - writes[i].address =HW_CONTROL ; - writes[i].value = a_priv->hw_control_bits; - ++i; - writes[i].address =PROTOCOL_CONTROL ; - writes[i].value =0 ; - ++i; - writes[i].address =IMR0 ; - writes[i].value =0 ; - ++i; - writes[i].address =IMR1 ; - writes[i].value =0 ; - ++i; - writes[i].address =LED_CONTROL ; - writes[i].value =0 ; - ++i; -if (i >ARRAY_SIZE (writes)) { -dev_err (&usb_dev->dev,"%s: bug! writes[] overflow\n" , __func__); -return -EFAULT ; - } - retval =agilent_82357a_write_registers (a_priv, writes, i); + writes[1 ].address =HW_CONTROL ; + writes[1 ].value = a_priv->hw_control_bits; + writes[2 ].address =PROTOCOL_CONTROL ; + writes[2 ].value =0 ; + writes[3 ].address =IMR0 ; + writes[3 ].value =0 ; + writes[4 ].address =IMR1 ; + writes[4 ].value =0 ; + writes[5 ].address =LED_CONTROL ; + writes[5 ].value =0 ; + retval =agilent_82357a_write_registers (a_priv, writes,6 );if (retval) { -dev_err (&usb_dev->dev,"%s: agilent_82357a_write_registers() returned error\n" , - __func__); +dev_err (&usb_dev->dev,"write_registers() returned error\n" );return -EIO ; }return 0 ;
@@ -1445,7 +1377,6 @@ static void agilent_82357a_detach(gpib_board_t *board)agilent_82357a_release_urbs (a_priv);agilent_82357a_free_private (board); } -dev_info (board->gpib_dev,"%s: detached\n" , __func__);mutex_unlock (&agilent_82357a_hotplug_lock); }
@@ -1510,8 +1441,7 @@ static int agilent_82357a_driver_probe(struct usb_interface *interface,if (i ==MAX_NUM_82357A_INTERFACES ) {usb_put_dev (usb_dev);mutex_unlock (&agilent_82357a_hotplug_lock); -dev_err (&usb_dev->dev,"%s: out of space in agilent_82357a_driver_interfaces[]\n" , - __func__); +dev_err (&usb_dev->dev,"out of space in agilent_82357a_driver_interfaces[]\n" );return -1 ; } path =kmalloc (path_length,GFP_KERNEL );
@@ -1552,13 +1482,12 @@ static void agilent_82357a_driver_disconnect(struct usb_interface *interface)mutex_unlock (&a_priv->control_alloc_lock); } } -dev_dbg (&usb_dev->dev,"nulled agilent_82357a_driver_interfaces[%i]\n" , i); agilent_82357a_driver_interfaces[i] =NULL ;break ; } }if (i ==MAX_NUM_82357A_INTERFACES ) -dev_err (&usb_dev->dev,"unable to find interface in agilent_82357a_driver_interfaces[]? bug?\n" ); +dev_err (&usb_dev->dev,"unable to find interface - bug?\n" );usb_put_dev (usb_dev);mutex_unlock (&agilent_82357a_hotplug_lock);
@@ -1583,18 +1512,18 @@ static int agilent_82357a_driver_suspend(struct usb_interface *interface, pm_mesagilent_82357a_abort (a_priv,0 ); retval =agilent_82357a_go_idle (board);if (retval) { -dev_err (&usb_dev->dev,"%s: failed to go idle, retval=%i\n" , - __func__, retval); +dev_err (&usb_dev->dev,"failed to go idle, retval=%i\n" , + retval);mutex_unlock (&agilent_82357a_hotplug_lock);return retval; }mutex_lock (&a_priv->interrupt_alloc_lock);agilent_82357a_cleanup_urbs (a_priv);mutex_unlock (&a_priv->interrupt_alloc_lock); -dev_info (&usb_dev->dev, -"bus %d dev num %d gpib minor %d, agilent usb interface %i suspended\n" , - usb_dev->bus->busnum, usb_dev->devnum, - board->minor, i); +dev_dbg (&usb_dev->dev, +"bus %d dev num %d gpib %d, interface %i suspended\n" , + usb_dev->bus->busnum, usb_dev->devnum, + board->minor, i); } }break ;
@@ -1631,8 +1560,8 @@ static int agilent_82357a_driver_resume(struct usb_interface *interface)mutex_lock (&a_priv->interrupt_alloc_lock); retval =usb_submit_urb (a_priv->interrupt_urb,GFP_KERNEL );if (retval) { -dev_err (&usb_dev->dev,"%s: failed to resubmit interrupt urb, retval=%i\n" , - __func__, retval); +dev_err (&usb_dev->dev,"failed to resubmit interrupt urb in resume, retval=%i\n" , + retval);mutex_unlock (&a_priv->interrupt_alloc_lock);mutex_unlock (&agilent_82357a_hotplug_lock);return retval;
@@ -1655,9 +1584,9 @@ static int agilent_82357a_driver_resume(struct usb_interface *interface)// assert/unassert REN agilent_82357a_remote_enable (board, a_priv->ren_state); -dev_info (&usb_dev->dev, -"bus %d dev num %d gpib minor %d, agilent usb interface %i resumed\n" , - usb_dev->bus->busnum, usb_dev->devnum, board->minor, i); +dev_dbg (&usb_dev->dev, +"bus %d dev num %d gpib%d, interface %i resumed\n" , + usb_dev->bus->busnum, usb_dev->devnum, board->minor, i); } resume_exit:
@@ -1667,7 +1596,7 @@ static int agilent_82357a_driver_resume(struct usb_interface *interface) }static struct usb_driver agilent_82357a_bus_driver = { - .name ="agilent_82357a_gpib" , + .name =DRV_NAME , .probe = agilent_82357a_driver_probe, .disconnect = agilent_82357a_driver_disconnect, .suspend = agilent_82357a_driver_suspend,
@@ -1680,19 +1609,18 @@ static int __init agilent_82357a_init_module(void)int i;int ret; -pr_info ("agilent_82357a_gpib driver loading" );for (i =0 ; i <MAX_NUM_82357A_INTERFACES ; ++i) agilent_82357a_driver_interfaces[i] =NULL ; ret =usb_register (&agilent_82357a_bus_driver);if (ret) { -pr_err ("agilent_82357a: usb_register failed: error = %d\n" , ret); +pr_err ("usb_register failed: error = %d\n" , ret);return ret; } ret =gpib_register_driver (&agilent_82357a_gpib_interface,THIS_MODULE );if (ret) { -pr_err ("agilent_82357a: gpib_register_driver failed: error = %d\n" , ret); +pr_err ("gpib_register_driver failed: error = %d\n" , ret);usb_deregister (&agilent_82357a_bus_driver);return ret; }
@@ -1702,7 +1630,6 @@ static int __init agilent_82357a_init_module(void) static void __exit agilent_82357a_exit_module(void) { -pr_info ("agilent_82357a_gpib driver unloading" );gpib_unregister_driver (&agilent_82357a_gpib_interface);usb_deregister (&agilent_82357a_bus_driver); }
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 428/499 staging: gpib: Fix Oops after disconnect in agilent usb
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Penkler <[email protected]>
[ Upstream commit 8491e73a5223acb0a4b4d78c3f8b96aa9c5e774d ]
If the agilent usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the bus_interface is set to NULL on disconnect.
This problem was introduced by setting usb_dev from the bus_interface for dev_xxx messages.
Previously bus_interface was checked for NULL only in the functions directly calling usb_fill_bulk_urb or usb_control_msg.
Check for valid bus_interface on all interface entry points and return -ENODEV if it is NULL.
--- .../gpib/agilent_82357a/agilent_82357a.c | 65 ++++++++++++++++--- 1 file changed, 55 insertions(+), 10 deletions(-)
drivers/staging/gpib/agilent_82357a/agilent_82357a.c +55 -10
@@ -427,7 +427,7 @@ static int agilent_82357a_read(gpib_board_t *board, uint8_t *buffer, size_t leng {int retval;struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); +struct usb_device *usb_dev;u8 *out_data, *in_data;int out_data_length, in_data_length;int bytes_written, bytes_read;
@@ -438,6 +438,10 @@ static int agilent_82357a_read(gpib_board_t *board, uint8_t *buffer, size_t leng *nbytes =0 ; *end =0 ; + +if (!a_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (a_priv->bus_interface); out_data_length =0x9 ; out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)
@@ -534,7 +538,7 @@ static ssize_t agilent_82357a_generic_write(gpib_board_t *board, uint8_t *buffer {int retval;struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); +struct usb_device *usb_dev;u8 *out_data =NULL ;u8 *status_data =NULL ;int out_data_length;
@@ -545,6 +549,10 @@ static ssize_t agilent_82357a_generic_write(gpib_board_t *board, uint8_t *bufferstruct agilent_82357a_register_pairlet read_reg; *bytes_written =0 ; +if (!a_priv->bus_interface) +return -ENODEV ; + + usb_dev =interface_to_usbdev (a_priv->bus_interface); out_data_length = length +0x8 ; out_data =kmalloc (out_data_length,GFP_KERNEL );if (!out_data)
@@ -697,9 +705,13 @@ int agilent_82357a_take_control_internal(gpib_board_t *board, int synchronous)static int agilent_82357a_take_control (gpib_board_t *board,int synchronous) { +struct agilent_82357a_priv *a_priv = board->private_data;const int timeout =10 ;int i; +if (!a_priv->bus_interface) +return -ENODEV ; +/* It looks like the 9914 does not handle tcs properly. * See comment above tms9914_take_control_workaround() in * drivers/gpib/tms9914/tms9914_aux.c
@@ -723,10 +735,14 @@ static int agilent_82357a_take_control(gpib_board_t *board, int synchronous)static int agilent_82357a_go_to_standby (gpib_board_t *board) {struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); +struct usb_device *usb_dev;struct agilent_82357a_register_pairlet write;int retval; +if (!a_priv->bus_interface) +return -ENODEV ; + + usb_dev =interface_to_usbdev (a_priv->bus_interface); write.address =AUXCR ; write.value =AUX_GTS ; retval =agilent_82357a_write_registers (a_priv, &write,1 );
@@ -739,11 +755,15 @@ static int agilent_82357a_go_to_standby(gpib_board_t *board)static void agilent_82357a_request_system_control (gpib_board_t *board,int request_control) {struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); +struct usb_device *usb_dev;struct agilent_82357a_register_pairlet writes[2 ];int retval;int i =0 ; +if (!a_priv->bus_interface) +return ;// -ENODEV; + + usb_dev =interface_to_usbdev (a_priv->bus_interface);/* 82357B needs bit to be set in 9914 AUXCR register */ writes[i].address =AUXCR ;if (request_control) {
@@ -767,10 +787,14 @@ static void agilent_82357a_request_system_control(gpib_board_t *board, int requestatic void agilent_82357a_interface_clear (gpib_board_t *board,int assert) {struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); +struct usb_device *usb_dev;struct agilent_82357a_register_pairlet write;int retval; +if (!a_priv->bus_interface) +return ;// -ENODEV; + + usb_dev =interface_to_usbdev (a_priv->bus_interface); write.address =AUXCR ; write.value =AUX_SIC ;if (assert) {
@@ -785,10 +809,14 @@ static void agilent_82357a_interface_clear(gpib_board_t *board, int assert)static void agilent_82357a_remote_enable (gpib_board_t *board,int enable) {struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); +struct usb_device *usb_dev;struct agilent_82357a_register_pairlet write;int retval; +if (!a_priv->bus_interface) +return ;//-ENODEV; + + usb_dev =interface_to_usbdev (a_priv->bus_interface); write.address =AUXCR ; write.value =AUX_SRE ;if (enable)
@@ -804,6 +832,8 @@ static int agilent_82357a_enable_eos(gpib_board_t *board, uint8_t eos_byte, int {struct agilent_82357a_priv *a_priv = board->private_data; +if (!a_priv->bus_interface) +return -ENODEV ;if (compare_8_bits ==0 )return -EOPNOTSUPP ;
@@ -822,10 +852,13 @@ static void agilent_82357a_disable_eos(gpib_board_t *board)static unsigned int agilent_82357a_update_status (gpib_board_t *board,unsigned int clear_mask) {struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); +struct usb_device *usb_dev;struct agilent_82357a_register_pairlet address_status, bus_status;int retval; +if (!a_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (a_priv->bus_interface); board->status &= ~clear_mask;if (a_priv->is_cic)set_bit (CIC_NUM , &board->status);
@@ -885,6 +918,9 @@ static int agilent_82357a_primary_address(gpib_board_t *board, unsigned int addrstruct agilent_82357a_register_pairlet write;int retval; +if (!a_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (a_priv->bus_interface);// put primary address in address0 write.address =ADR ; write.value = address &ADDRESS_MASK ;
@@ -906,11 +942,14 @@ static int agilent_82357a_secondary_address(gpib_board_t *board, unsigned int adstatic int agilent_82357a_parallel_poll (gpib_board_t *board,uint8_t *result) {struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); +struct usb_device *usb_dev;struct agilent_82357a_register_pairlet writes[2 ];struct agilent_82357a_register_pairlet read;int retval; +if (!a_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (a_priv->bus_interface);// execute parallel poll writes[0 ].address =AUXCR ; writes[0 ].value =AUX_CS |AUX_RPP ;
@@ -975,11 +1014,14 @@ static void agilent_82357a_return_to_local(gpib_board_t *board)static int agilent_82357a_line_status (const gpib_board_t *board) {struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); +struct usb_device *usb_dev;struct agilent_82357a_register_pairlet bus_status;int retval;int status = ValidALL; +if (!a_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (a_priv->bus_interface); bus_status.address =BSR ; retval =agilent_82357a_read_registers (a_priv, &bus_status,1 ,0 );if (retval) {
@@ -1025,10 +1067,13 @@ static unsigned short nanosec_to_fast_talker_bits(unsigned int *nanosec)static unsigned int agilent_82357a_t1_delay (gpib_board_t *board,unsigned int nanosec) {struct agilent_82357a_priv *a_priv = board->private_data; -struct usb_device *usb_dev =interface_to_usbdev (a_priv->bus_interface); +struct usb_device *usb_dev;struct agilent_82357a_register_pairlet write;int retval; +if (!a_priv->bus_interface) +return -ENODEV ; + usb_dev =interface_to_usbdev (a_priv->bus_interface); write.address =FAST_TALKER_T1 ; write.value =nanosec_to_fast_talker_bits (&nanosec); retval =agilent_82357a_write_registers (a_priv, &write,1 );
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 429/499 tty: serial: fsl_lpuart: Use u32 and u8 for register variables
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Sun <[email protected]>
[ Upstream commit b6a8f6ab2c53e5ea3c7f2a3978db378a89bb7595 ]
Use u32 and u8 rather than unsigned long or unsigned char for register variables for clarity and consistency.
Stable-dep-of: e98ab45ec518 ("tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register")
--- drivers/tty/serial/fsl_lpuart.c | 93 ++++++++++++++++----------------- 1 file changed, 46 insertions(+), 47 deletions(-)
drivers/tty/serial/fsl_lpuart.c +46 -47
@@ -441,7 +441,7 @@ static unsigned int lpuart_get_baud_clk_rate(struct lpuart_port *sport)static void lpuart_stop_tx (struct uart_port *port) { -unsigned char temp; +u8 temp; temp =readb (port->membase +UARTCR2 ); temp &= ~(UARTCR2_TIE |UARTCR2_TCIE );
@@ -450,7 +450,7 @@ static void lpuart_stop_tx(struct uart_port *port)static void lpuart32_stop_tx (struct uart_port *port) { -unsigned long temp; +u32 temp; temp =lpuart32_read (port,UARTCTRL ); temp &= ~(UARTCTRL_TIE |UARTCTRL_TCIE );
@@ -459,7 +459,7 @@ static void lpuart32_stop_tx(struct uart_port *port)static void lpuart_stop_rx (struct uart_port *port) { -unsigned char temp; +u8 temp; temp =readb (port->membase +UARTCR2 );writeb (temp & ~UARTCR2_RE , port->membase +UARTCR2 );
@@ -467,7 +467,7 @@ static void lpuart_stop_rx(struct uart_port *port)static void lpuart32_stop_rx (struct uart_port *port) { -unsigned long temp; +u32 temp; temp =lpuart32_read (port,UARTCTRL );lpuart32_write (port, temp & ~UARTCTRL_RE ,UARTCTRL );
@@ -642,7 +642,7 @@ static int lpuart_poll_init(struct uart_port *port)struct lpuart_port *sport =container_of (port, struct lpuart_port, port);unsigned long flags; -unsigned char temp; +u8 temp; sport->port.fifosize =0 ;
@@ -752,7 +752,7 @@ static inline void lpuart_transmit_buffer(struct lpuart_port *sport)static inline void lpuart32_transmit_buffer (struct lpuart_port *sport) {struct tty_port *tport = &sport->port.state->port; -unsigned long txcnt; +u32 txcnt;unsigned char c;if (sport->port.x_char) {
@@ -789,7 +789,7 @@ static void lpuart_start_tx(struct uart_port *port) {struct lpuart_port *sport =container_of (port, struct lpuart_port, port); -unsigned char temp; +u8 temp; temp =readb (port->membase +UARTCR2 );writeb (temp |UARTCR2_TIE , port->membase +UARTCR2 );
@@ -806,7 +806,7 @@ static void lpuart_start_tx(struct uart_port *port)static void lpuart32_start_tx (struct uart_port *port) { struct lpuart_port *sport = container_of(port, struct lpuart_port, port); -unsigned long temp; +u32 temp;if (sport->lpuart_dma_tx_use) {if (!lpuart_stopped_or_empty (port))
@@ -839,8 +839,8 @@ static unsigned int lpuart_tx_empty(struct uart_port *port) {struct lpuart_port *sport =container_of (port, struct lpuart_port, port); -unsigned char sr1 =readb (port->membase +UARTSR1 ); -unsigned char sfifo =readb (port->membase +UARTSFIFO ); +u8 sr1 =readb (port->membase +UARTSR1 ); +u8 sfifo =readb (port->membase +UARTSFIFO );if (sport->dma_tx_in_progress)return 0 ;
@@ -855,9 +855,9 @@ static unsigned int lpuart32_tx_empty(struct uart_port *port) {struct lpuart_port *sport =container_of (port, struct lpuart_port, port); -unsigned long stat =lpuart32_read (port,UARTSTAT ); -unsigned long sfifo =lpuart32_read (port,UARTFIFO ); -unsigned long ctrl =lpuart32_read (port,UARTCTRL ); +u32 stat =lpuart32_read (port,UARTSTAT ); +u32 sfifo =lpuart32_read (port,UARTFIFO ); +u32 ctrl =lpuart32_read (port,UARTCTRL );if (sport->dma_tx_in_progress)return 0 ;
@@ -884,7 +884,7 @@ static void lpuart_rxint(struct lpuart_port *sport) {unsigned int flg, ignored =0 , overrun =0 ;struct tty_port *port = &sport->port.state->port; -unsigned char rx, sr; +u8 rx, sr;uart_port_lock (&sport->port);
@@ -961,7 +961,7 @@ static void lpuart32_rxint(struct lpuart_port *sport) {unsigned int flg, ignored =0 ;struct tty_port *port = &sport->port.state->port; -unsigned long rx, sr; +u32 rx, sr;bool is_break;uart_port_lock (&sport->port);
@@ -1039,7 +1039,7 @@ static void lpuart32_rxint(struct lpuart_port *sport)static irqreturn_t lpuart_int (int irq,void *dev_id) {struct lpuart_port *sport = dev_id; -unsigned char sts; +u8 sts; sts =readb (sport->port.membase +UARTSR1 );
@@ -1113,7 +1113,7 @@ static void lpuart_copy_rx_to_tty(struct lpuart_port *sport)int count, copied;if (lpuart_is_32 (sport)) { -unsigned long sr =lpuart32_read (&sport->port,UARTSTAT ); +u32 sr =lpuart32_read (&sport->port,UARTSTAT );if (sr & (UARTSTAT_PE |UARTSTAT_FE )) {/* Clear the error flags */
@@ -1125,10 +1125,10 @@ static void lpuart_copy_rx_to_tty(struct lpuart_port *sport) sport->port.icount.frame++; } }else { -unsigned char sr =readb (sport->port.membase +UARTSR1 ); +u8 sr =readb (sport->port.membase +UARTSR1 );if (sr & (UARTSR1_PE |UARTSR1_FE )) { -unsigned char cr2; +u8 cr2;/* Disable receiver during this operation... */ cr2 =readb (sport->port.membase +UARTCR2 );
@@ -1279,7 +1279,7 @@ static void lpuart32_dma_idleint(struct lpuart_port *sport)static irqreturn_t lpuart32_int (int irq,void *dev_id) {struct lpuart_port *sport = dev_id; -unsigned long sts, rxcount; +u32 sts, rxcount; sts =lpuart32_read (&sport->port,UARTSTAT ); rxcount =lpuart32_read (&sport->port,UARTWATER );
@@ -1411,12 +1411,12 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)dma_async_issue_pending (chan);if (lpuart_is_32 (sport)) { -unsigned long temp =lpuart32_read (&sport->port,UARTBAUD ); +u32 temp =lpuart32_read (&sport->port,UARTBAUD );lpuart32_write (&sport->port, temp |UARTBAUD_RDMAE ,UARTBAUD );if (sport->dma_idle_int) { -unsigned long ctrl =lpuart32_read (&sport->port,UARTCTRL ); +u32 ctrl =lpuart32_read (&sport->port,UARTCTRL );lpuart32_write (&sport->port, ctrl |UARTCTRL_ILIE ,UARTCTRL ); }
@@ -1482,7 +1482,7 @@ static int lpuart32_config_rs485(struct uart_port *port, struct ktermios *termiostruct lpuart_port *sport =container_of (port, struct lpuart_port, port); -unsigned long modem =lpuart32_read (&sport->port,UARTMODIR ) +u32 modem =lpuart32_read (&sport->port,UARTMODIR ) & ~(UARTMODIR_TXRTSPOL |UARTMODIR_TXRTSE );u32 ctrl;
@@ -1577,7 +1577,7 @@ static void lpuart32_set_mctrl(struct uart_port *port, unsigned int mctrl)static void lpuart_break_ctl (struct uart_port *port,int break_state) { -unsigned char temp; +u8 temp; temp =readb (port->membase +UARTCR2 ) & ~UARTCR2_SBK ;
@@ -1589,7 +1589,7 @@ static void lpuart_break_ctl(struct uart_port *port, int break_state)static void lpuart32_break_ctl (struct uart_port *port,int break_state) { -unsigned long temp; +u32 temp; temp =lpuart32_read (port,UARTCTRL );
@@ -1623,8 +1623,7 @@ static void lpuart32_break_ctl(struct uart_port *port, int break_state)static void lpuart_setup_watermark (struct lpuart_port *sport) { -unsigned char val, cr2; -unsigned char cr2_saved; +u8 val, cr2, cr2_saved; cr2 =readb (sport->port.membase +UARTCR2 ); cr2_saved = cr2;
@@ -1657,7 +1656,7 @@ static void lpuart_setup_watermark(struct lpuart_port *sport)static void lpuart_setup_watermark_enable (struct lpuart_port *sport) { -unsigned char cr2; +u8 cr2;lpuart_setup_watermark (sport);
@@ -1668,8 +1667,7 @@ static void lpuart_setup_watermark_enable(struct lpuart_port *sport)static void lpuart32_setup_watermark (struct lpuart_port *sport) { -unsigned long val, ctrl; -unsigned long ctrl_saved; +u32 val, ctrl, ctrl_saved; ctrl =lpuart32_read (&sport->port,UARTCTRL ); ctrl_saved = ctrl;
@@ -1778,7 +1776,7 @@ static void lpuart_tx_dma_startup(struct lpuart_port *sport)static void lpuart_rx_dma_startup (struct lpuart_port *sport) {int ret; -unsigned char cr3; +u8 cr3;if (uart_console (&sport->port)) goto err;
@@ -1828,7 +1826,7 @@ static void lpuart_hw_setup(struct lpuart_port *sport)static int lpuart_startup (struct uart_port *port) { struct lpuart_port *sport = container_of(port, struct lpuart_port, port); -unsigned char temp; +u8 temp;/* determine FIFO size and enable FIFO mode */ temp =readb (sport->port.membase +UARTPFIFO );
@@ -1848,7 +1846,7 @@ static int lpuart_startup(struct uart_port *port)static void lpuart32_hw_disable (struct lpuart_port *sport) { -unsigned long temp; +u32 temp; temp =lpuart32_read (&sport->port,UARTCTRL ); temp &= ~(UARTCTRL_RIE | UARTCTRL_ILIE | UARTCTRL_RE |
@@ -1858,7 +1856,7 @@ static void lpuart32_hw_disable(struct lpuart_port *sport)static void lpuart32_configure (struct lpuart_port *sport) { -unsigned long temp; +u32 temp; temp =lpuart32_read (&sport->port,UARTCTRL );if (!sport->lpuart_dma_rx_use)
@@ -1888,7 +1886,7 @@ static void lpuart32_hw_setup(struct lpuart_port *sport)static int lpuart32_startup (struct uart_port *port) { struct lpuart_port *sport = container_of(port, struct lpuart_port, port); -unsigned long temp; +u32 temp;/* determine FIFO size */ temp =lpuart32_read (&sport->port,UARTFIFO );
@@ -1942,7 +1940,7 @@ static void lpuart_dma_shutdown(struct lpuart_port *sport)static void lpuart_shutdown (struct uart_port *port) { struct lpuart_port *sport = container_of(port, struct lpuart_port, port); -unsigned char temp; +u8 temp;unsigned long flags;uart_port_lock_irqsave (port, &flags);
@@ -1962,7 +1960,7 @@ static void lpuart32_shutdown(struct uart_port *port) {struct lpuart_port *sport = container_of(port, struct lpuart_port, port); -unsigned long temp; +u32 temp;unsigned long flags;uart_port_lock_irqsave (port, &flags);
@@ -1993,7 +1991,7 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios, { struct lpuart_port *sport = container_of(port, struct lpuart_port, port);unsigned long flags; -unsigned char cr1, old_cr1, old_cr2, cr3, cr4, bdh, modem; +u8 cr1, old_cr1, old_cr2, cr3, cr4, bdh, modem;unsigned int baud;unsigned int old_csize = old ? old->c_cflag &CSIZE :CS8 ;unsigned int sbr, brfa;
@@ -2231,7 +2229,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, { struct lpuart_port *sport = container_of(port, struct lpuart_port, port);unsigned long flags; -unsigned long ctrl, old_ctrl, bd, modem; +u32 ctrl, old_ctrl, bd, modem;unsigned int baud;unsigned int old_csize = old ? old->c_cflag &CSIZE :CS8 ;
@@ -2498,7 +2496,7 @@ static void lpuart_console_write(struct console *co, const char *s, unsigned int count) { struct lpuart_port *sport = lpuart_ports[co->index]; -unsigned char old_cr2, cr2; +u8 old_cr2, cr2;unsigned long flags;int locked =1 ;
@@ -2528,7 +2526,7 @@ static void lpuart32_console_write(struct console *co, const char *s, unsigned int count) { struct lpuart_port *sport = lpuart_ports[co->index]; -unsigned long old_cr, cr; +u32 old_cr, cr;unsigned long flags;int locked =1 ;
@@ -2562,7 +2560,7 @@ static void __init lpuart_console_get_options(struct lpuart_port *sport, int *baud, int *parity, int *bits) { - unsigned char cr, bdh, bdl, brfa; + u8 cr, bdh, bdl, brfa;unsigned int sbr, uartclk, baud_raw; cr =readb (sport->port.membase +UARTCR2 );
@@ -2611,7 +2609,7 @@ static void __init lpuart32_console_get_options(struct lpuart_port *sport, int *baud, int *parity, int *bits) { - unsigned long cr, bd; + u32 cr, bd;unsigned int sbr, uartclk, baud_raw; cr =lpuart32_read (&sport->port,UARTCTRL );
@@ -2817,7 +2815,7 @@ static int lpuart_global_reset(struct lpuart_port *sport) {struct uart_port *port = &sport->port;void __iomem *global_addr; -unsigned long ctrl, bd; +u32 ctrl, bd;unsigned int val =0 ;int ret;
@@ -3023,7 +3021,7 @@ static int lpuart_runtime_resume(struct device *dev)static void serial_lpuart_enable_wakeup (struct lpuart_port *sport,bool on) { -unsigned int val, baud; +u32 val, baud;if (lpuart_is_32 (sport)) { val =lpuart32_read (&sport->port,UARTCTRL );
@@ -3088,7 +3086,7 @@ static int lpuart_suspend_noirq(struct device *dev)static int lpuart_resume_noirq (struct device *dev) {struct lpuart_port *sport =dev_get_drvdata (dev); -unsigned int val; +u32 val;pinctrl_pm_select_default_state (dev);
@@ -3108,7 +3106,8 @@ static int lpuart_resume_noirq(struct device *dev)static int lpuart_suspend (struct device *dev) {struct lpuart_port *sport =dev_get_drvdata (dev); -unsigned long temp, flags; +u32 temp; +unsigned long flags;uart_suspend_port (&lpuart_reg, &sport->port);
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 430/499 tty: serial: fsl_lpuart: use port struct directly to simply code
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Sun <[email protected]>
[ Upstream commit 3cc16ae096f164ae0c6b98416c25a01db5f3a529 ]
Most lpuart functions have the parameter struct uart_port *port, but still use the &sport->port to get the uart_port instead of use it directly, let's simply the code logic, directly use this struct instead of covert it from struct sport.
Stable-dep-of: e98ab45ec518 ("tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register")
--- drivers/tty/serial/fsl_lpuart.c | 213 +++++++++++++++----------------- 1 file changed, 102 insertions(+), 111 deletions(-)
drivers/tty/serial/fsl_lpuart.c +102 -111
@@ -581,7 +581,7 @@ static int lpuart_dma_tx_request(struct uart_port *port) ret =dmaengine_slave_config (sport->dma_tx_chan, &dma_tx_sconfig);if (ret) { -dev_err (sport->port.dev, +dev_err (port->dev,"DMA slave config failed, err = %d\n" , ret);return ret; }
@@ -611,13 +611,13 @@ static void lpuart_flush_buffer(struct uart_port *port) }if (lpuart_is_32 (sport)) { - val =lpuart32_read (&sport->port,UARTFIFO ); + val =lpuart32_read (port,UARTFIFO ); val |=UARTFIFO_TXFLUSH |UARTFIFO_RXFLUSH ; -lpuart32_write (&sport->port, val,UARTFIFO ); +lpuart32_write (port, val,UARTFIFO ); }else { - val =readb (sport->port.membase +UARTCFIFO ); + val =readb (port->membase +UARTCFIFO ); val |=UARTCFIFO_TXFLUSH |UARTCFIFO_RXFLUSH ; -writeb (val, sport->port.membase +UARTCFIFO ); +writeb (val, port->membase +UARTCFIFO ); } }
@@ -639,38 +639,36 @@ static void lpuart32_wait_bit_set(struct uart_port *port, unsigned int offset,static int lpuart_poll_init (struct uart_port *port) { -struct lpuart_port *sport =container_of (port, - struct lpuart_port, port);unsigned long flags;u8 temp; - sport->port.fifosize =0 ; + port->fifosize =0 ; -uart_port_lock_irqsave (&sport->port, &flags); +uart_port_lock_irqsave (port, &flags);/* Disable Rx & Tx */ -writeb (0 , sport->port.membase +UARTCR2 ); +writeb (0 , port->membase +UARTCR2 ); - temp =readb (sport->port.membase +UARTPFIFO ); + temp =readb (port->membase +UARTPFIFO );/* Enable Rx and Tx FIFO */ writeb (temp |UARTPFIFO_RXFE |UARTPFIFO_TXFE , - sport->port.membase +UARTPFIFO ); + port->membase +UARTPFIFO );/* flush Tx and Rx FIFO */ writeb (UARTCFIFO_TXFLUSH |UARTCFIFO_RXFLUSH , - sport->port.membase +UARTCFIFO ); + port->membase +UARTCFIFO );/* explicitly clear RDRF */ -if (readb (sport->port.membase +UARTSR1 ) &UARTSR1_RDRF ) { -readb (sport->port.membase +UARTDR ); -writeb (UARTSFIFO_RXUF , sport->port.membase +UARTSFIFO ); +if (readb (port->membase +UARTSR1 ) &UARTSR1_RDRF ) { +readb (port->membase +UARTDR ); +writeb (UARTSFIFO_RXUF , port->membase +UARTSFIFO ); } -writeb (0 , sport->port.membase +UARTTWFIFO ); -writeb (1 , sport->port.membase +UARTRWFIFO ); +writeb (0 , port->membase +UARTTWFIFO ); +writeb (1 , port->membase +UARTRWFIFO );/* Enable Rx and Tx */ -writeb (UARTCR2_RE |UARTCR2_TE , sport->port.membase +UARTCR2 ); -uart_port_unlock_irqrestore (&sport->port, flags); +writeb (UARTCR2_RE |UARTCR2_TE , port->membase +UARTCR2 ); +uart_port_unlock_irqrestore (port, flags);return 0 ; }
@@ -693,33 +691,32 @@ static int lpuart_poll_get_char(struct uart_port *port)static int lpuart32_poll_init (struct uart_port *port) {unsigned long flags; - struct lpuart_port *sport = container_of(port, struct lpuart_port, port);u32 temp; - sport->port.fifosize =0 ; + port->fifosize =0 ; -uart_port_lock_irqsave (&sport->port, &flags); +uart_port_lock_irqsave (port, &flags);/* Disable Rx & Tx */ -lpuart32_write (&sport->port,0 ,UARTCTRL ); +lpuart32_write (port,0 ,UARTCTRL ); - temp =lpuart32_read (&sport->port,UARTFIFO ); + temp =lpuart32_read (port,UARTFIFO );/* Enable Rx and Tx FIFO */ -lpuart32_write (&sport->port, temp |UARTFIFO_RXFE |UARTFIFO_TXFE ,UARTFIFO ); +lpuart32_write (port, temp |UARTFIFO_RXFE |UARTFIFO_TXFE ,UARTFIFO );/* flush Tx and Rx FIFO */ -lpuart32_write (&sport->port,UARTFIFO_TXFLUSH |UARTFIFO_RXFLUSH ,UARTFIFO ); +lpuart32_write (port,UARTFIFO_TXFLUSH |UARTFIFO_RXFLUSH ,UARTFIFO );/* explicitly clear RDRF */ -if (lpuart32_read (&sport->port,UARTSTAT ) &UARTSTAT_RDRF ) { -lpuart32_read (&sport->port,UARTDATA ); -lpuart32_write (&sport->port,UARTFIFO_RXUF ,UARTFIFO ); +if (lpuart32_read (port,UARTSTAT ) &UARTSTAT_RDRF ) { +lpuart32_read (port,UARTDATA ); +lpuart32_write (port,UARTFIFO_RXUF ,UARTFIFO ); }/* Enable Rx and Tx */ -lpuart32_write (&sport->port,UARTCTRL_RE |UARTCTRL_TE ,UARTCTRL ); -uart_port_unlock_irqrestore (&sport->port, flags); +lpuart32_write (port,UARTCTRL_RE |UARTCTRL_TE ,UARTCTRL ); +uart_port_unlock_irqrestore (port, flags);return 0 ; }
@@ -1449,12 +1446,9 @@ static void lpuart_dma_rx_free(struct uart_port *port)static int lpuart_config_rs485 (struct uart_port *port,struct ktermios *termios,struct serial_rs485 *rs485) { -struct lpuart_port *sport =container_of (port, - struct lpuart_port, port); - -u8 modem =readb (sport->port.membase +UARTMODEM ) & +u8 modem =readb (port->membase +UARTMODEM ) & ~(UARTMODEM_TXRTSPOL |UARTMODEM_TXRTSE ); -writeb (modem, sport->port.membase +UARTMODEM ); +writeb (modem, port->membase +UARTMODEM );if (rs485->flags &SER_RS485_ENABLED ) {/* Enable auto RS-485 RTS mode */
@@ -1472,32 +1466,29 @@ static int lpuart_config_rs485(struct uart_port *port, struct ktermios *termios, modem &= ~UARTMODEM_TXRTSPOL ; } -writeb (modem, sport->port.membase +UARTMODEM ); +writeb (modem, port->membase +UARTMODEM );return 0 ; }static int lpuart32_config_rs485 (struct uart_port *port,struct ktermios *termios,struct serial_rs485 *rs485) { -struct lpuart_port *sport =container_of (port, - struct lpuart_port, port); - -u32 modem =lpuart32_read (&sport->port,UARTMODIR ) +u32 modem =lpuart32_read (port,UARTMODIR ) & ~(UARTMODIR_TXRTSPOL |UARTMODIR_TXRTSE );u32 ctrl;/* TXRTSE and TXRTSPOL only can be changed when transmitter is disabled. */ - ctrl =lpuart32_read (&sport->port,UARTCTRL ); + ctrl =lpuart32_read (port,UARTCTRL );if (ctrl &UARTCTRL_TE ) {/* wait for the transmit engine to complete */ -lpuart32_wait_bit_set (&sport->port,UARTSTAT ,UARTSTAT_TC ); -lpuart32_write (&sport->port, ctrl & ~UARTCTRL_TE ,UARTCTRL ); +lpuart32_wait_bit_set (port,UARTSTAT ,UARTSTAT_TC ); +lpuart32_write (port, ctrl & ~UARTCTRL_TE ,UARTCTRL ); -while (lpuart32_read (&sport->port,UARTCTRL ) &UARTCTRL_TE ) +while (lpuart32_read (port,UARTCTRL ) &UARTCTRL_TE )cpu_relax (); } -lpuart32_write (&sport->port, modem,UARTMODIR ); +lpuart32_write (port, modem,UARTMODIR );if (rs485->flags &SER_RS485_ENABLED ) {/* Enable auto RS-485 RTS mode */
@@ -1515,10 +1506,10 @@ static int lpuart32_config_rs485(struct uart_port *port, struct ktermios *termio modem &= ~UARTMODIR_TXRTSPOL ; } -lpuart32_write (&sport->port, modem,UARTMODIR ); +lpuart32_write (port, modem,UARTMODIR );if (ctrl &UARTCTRL_TE ) -lpuart32_write (&sport->port, ctrl,UARTCTRL ); +lpuart32_write (port, ctrl,UARTCTRL );return 0 ; }
@@ -1829,11 +1820,11 @@ static int lpuart_startup(struct uart_port *port)u8 temp;/* determine FIFO size and enable FIFO mode */ - temp =readb (sport->port.membase +UARTPFIFO ); + temp =readb (port->membase +UARTPFIFO ); sport->txfifo_size =UARTFIFO_DEPTH ((temp >>UARTPFIFO_TXSIZE_OFF ) &UARTPFIFO_FIFOSIZE_MASK ); - sport->port.fifosize = sport->txfifo_size; + port->fifosize = sport->txfifo_size; sport->rxfifo_size =UARTFIFO_DEPTH ((temp >>UARTPFIFO_RXSIZE_OFF ) &UARTPFIFO_FIFOSIZE_MASK );
@@ -1889,11 +1880,11 @@ static int lpuart32_startup(struct uart_port *port)u32 temp;/* determine FIFO size */ - temp =lpuart32_read (&sport->port,UARTFIFO ); + temp =lpuart32_read (port,UARTFIFO ); sport->txfifo_size =UARTFIFO_DEPTH ((temp >>UARTFIFO_TXSIZE_OFF ) &UARTFIFO_FIFOSIZE_MASK ); - sport->port.fifosize = sport->txfifo_size; + port->fifosize = sport->txfifo_size; sport->rxfifo_size =UARTFIFO_DEPTH ((temp >>UARTFIFO_RXSIZE_OFF ) &UARTFIFO_FIFOSIZE_MASK );
@@ -1906,7 +1897,7 @@ static int lpuart32_startup(struct uart_port *port)if (is_layerscape_lpuart (sport)) { sport->rxfifo_size =16 ; sport->txfifo_size =16 ; - sport->port.fifosize = sport->txfifo_size; + port->fifosize = sport->txfifo_size; }lpuart_request_dma (sport);
@@ -1966,8 +1957,8 @@ static void lpuart32_shutdown(struct uart_port *port)uart_port_lock_irqsave (port, &flags);/* clear status */ - temp =lpuart32_read (&sport->port,UARTSTAT ); -lpuart32_write (&sport->port, temp,UARTSTAT ); + temp =lpuart32_read (port,UARTSTAT ); +lpuart32_write (port, temp,UARTSTAT );/* disable Rx/Tx DMA */ temp =lpuart32_read (port,UARTBAUD );
@@ -1996,12 +1987,12 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,unsigned int old_csize = old ? old->c_cflag &CSIZE :CS8 ;unsigned int sbr, brfa; - cr1 = old_cr1 =readb (sport->port.membase +UARTCR1 ); - old_cr2 =readb (sport->port.membase +UARTCR2 ); - cr3 =readb (sport->port.membase +UARTCR3 ); - cr4 =readb (sport->port.membase +UARTCR4 ); - bdh =readb (sport->port.membase +UARTBDH ); - modem =readb (sport->port.membase +UARTMODEM ); + cr1 = old_cr1 =readb (port->membase +UARTCR1 ); + old_cr2 =readb (port->membase +UARTCR2 ); + cr3 =readb (port->membase +UARTCR3 ); + cr4 =readb (port->membase +UARTCR4 ); + bdh =readb (port->membase +UARTBDH ); + modem =readb (port->membase +UARTMODEM );/* * only support CS8 and CS7, and for CS7 must enable PE. * supported mode:
@@ -2033,7 +2024,7 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,* When auto RS-485 RTS mode is enabled, * hardware flow control need to be disabled. */ -if (sport->port.rs485.flags &SER_RS485_ENABLED ) +if (port->rs485.flags &SER_RS485_ENABLED ) termios->c_cflag &= ~CRTSCTS ;if (termios->c_cflag &CRTSCTS )
@@ -2074,59 +2065,59 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,* Need to update the Ring buffer length according to the selected * baud rate and restart Rx DMA path. * -* Since timer function acqures sport->port.lock, need to stop before +* Since timer function acqures port->lock, need to stop before * acquring same lock because otherwise del_timer_sync() can deadlock. */ if (old && sport->lpuart_dma_rx_use) -lpuart_dma_rx_free (&sport->port); +lpuart_dma_rx_free (port); -uart_port_lock_irqsave (&sport->port, &flags); +uart_port_lock_irqsave (port, &flags); - sport->port.read_status_mask =0 ; + port->read_status_mask =0 ;if (termios->c_iflag &INPCK ) - sport->port.read_status_mask |=UARTSR1_FE |UARTSR1_PE ; + port->read_status_mask |=UARTSR1_FE |UARTSR1_PE ;if (termios->c_iflag & (IGNBRK |BRKINT |PARMRK )) - sport->port.read_status_mask |=UARTSR1_FE ; + port->read_status_mask |=UARTSR1_FE ;/* characters to ignore */ - sport->port.ignore_status_mask =0 ; + port->ignore_status_mask =0 ;if (termios->c_iflag &IGNPAR ) - sport->port.ignore_status_mask |=UARTSR1_PE ; + port->ignore_status_mask |=UARTSR1_PE ;if (termios->c_iflag &IGNBRK ) { - sport->port.ignore_status_mask |=UARTSR1_FE ; + port->ignore_status_mask |=UARTSR1_FE ;/* * if we're ignoring parity and break indicators, * ignore overruns too (for real raw support). */ if (termios->c_iflag &IGNPAR ) - sport->port.ignore_status_mask |=UARTSR1_OR ; + port->ignore_status_mask |=UARTSR1_OR ; }/* update the per-port timeout */ uart_update_timeout (port, termios->c_cflag, baud);/* wait transmit engin complete */ -lpuart_wait_bit_set (&sport->port,UARTSR1 ,UARTSR1_TC ); +lpuart_wait_bit_set (port,UARTSR1 ,UARTSR1_TC );/* disable transmit and receive */ writeb (old_cr2 & ~(UARTCR2_TE |UARTCR2_RE ), - sport->port.membase +UARTCR2 ); + port->membase +UARTCR2 ); - sbr = sport->port.uartclk / (16 * baud); - brfa = ((sport->port.uartclk - (16 * sbr * baud)) *2 ) / baud; + sbr = port->uartclk / (16 * baud); + brfa = ((port->uartclk - (16 * sbr * baud)) *2 ) / baud; bdh &= ~UARTBDH_SBR_MASK ; bdh |= (sbr >>8 ) &0x1F ; cr4 &= ~UARTCR4_BRFA_MASK ; brfa &=UARTCR4_BRFA_MASK ; -writeb (cr4 | brfa, sport->port.membase +UARTCR4 ); -writeb (bdh, sport->port.membase +UARTBDH ); -writeb (sbr &0xFF , sport->port.membase +UARTBDL ); -writeb (cr3, sport->port.membase +UARTCR3 ); -writeb (cr1, sport->port.membase +UARTCR1 ); -writeb (modem, sport->port.membase +UARTMODEM ); +writeb (cr4 | brfa, port->membase +UARTCR4 ); +writeb (bdh, port->membase +UARTBDH ); +writeb (sbr &0xFF , port->membase +UARTBDL ); +writeb (cr3, port->membase +UARTCR3 ); +writeb (cr1, port->membase +UARTCR1 ); +writeb (modem, port->membase +UARTMODEM );/* restore control register */ -writeb (old_cr2, sport->port.membase +UARTCR2 ); +writeb (old_cr2, port->membase +UARTCR2 );if (old && sport->lpuart_dma_rx_use) {if (!lpuart_start_rx_dma (sport))
@@ -2135,7 +2126,7 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios, sport->lpuart_dma_rx_use = false; } -uart_port_unlock_irqrestore (&sport->port, flags); +uart_port_unlock_irqrestore (port, flags); } static void __lpuart32_serial_setbrg(struct uart_port *port,
@@ -2233,9 +2224,9 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,unsigned int baud;unsigned int old_csize = old ? old->c_cflag &CSIZE :CS8 ; - ctrl = old_ctrl =lpuart32_read (&sport->port,UARTCTRL ); - bd =lpuart32_read (&sport->port,UARTBAUD ); - modem =lpuart32_read (&sport->port,UARTMODIR ); + ctrl = old_ctrl =lpuart32_read (port,UARTCTRL ); + bd =lpuart32_read (port,UARTBAUD ); + modem =lpuart32_read (port,UARTMODIR ); sport->is_cs7 = false;/* * only support CS8 and CS7
@@ -2269,7 +2260,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,* When auto RS-485 RTS mode is enabled, * hardware flow control need to be disabled. */ -if (sport->port.rs485.flags &SER_RS485_ENABLED ) +if (port->rs485.flags &SER_RS485_ENABLED ) termios->c_cflag &= ~CRTSCTS ;if (termios->c_cflag &CRTSCTS )
@@ -2319,32 +2310,32 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,* Need to update the Ring buffer length according to the selected * baud rate and restart Rx DMA path. * -* Since timer function acqures sport->port.lock, need to stop before +* Since timer function acqures port->lock, need to stop before * acquring same lock because otherwise del_timer_sync() can deadlock. */ if (old && sport->lpuart_dma_rx_use) -lpuart_dma_rx_free (&sport->port); +lpuart_dma_rx_free (port); -uart_port_lock_irqsave (&sport->port, &flags); +uart_port_lock_irqsave (port, &flags); - sport->port.read_status_mask =0 ; + port->read_status_mask =0 ;if (termios->c_iflag &INPCK ) - sport->port.read_status_mask |=UARTSTAT_FE |UARTSTAT_PE ; + port->read_status_mask |=UARTSTAT_FE |UARTSTAT_PE ;if (termios->c_iflag & (IGNBRK |BRKINT |PARMRK )) - sport->port.read_status_mask |=UARTSTAT_FE ; + port->read_status_mask |=UARTSTAT_FE ;/* characters to ignore */ - sport->port.ignore_status_mask =0 ; + port->ignore_status_mask =0 ;if (termios->c_iflag &IGNPAR ) - sport->port.ignore_status_mask |=UARTSTAT_PE ; + port->ignore_status_mask |=UARTSTAT_PE ;if (termios->c_iflag &IGNBRK ) { - sport->port.ignore_status_mask |=UARTSTAT_FE ; + port->ignore_status_mask |=UARTSTAT_FE ;/* * if we're ignoring parity and break indicators, * ignore overruns too (for real raw support). */ if (termios->c_iflag &IGNPAR ) - sport->port.ignore_status_mask |=UARTSTAT_OR ; + port->ignore_status_mask |=UARTSTAT_OR ; }/* update the per-port timeout */
@@ -2356,22 +2347,22 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,* asserted. */ if (!(old_ctrl &UARTCTRL_SBK )) { -lpuart32_write (&sport->port,0 ,UARTMODIR ); -lpuart32_wait_bit_set (&sport->port,UARTSTAT ,UARTSTAT_TC ); +lpuart32_write (port,0 ,UARTMODIR ); +lpuart32_wait_bit_set (port,UARTSTAT ,UARTSTAT_TC ); }/* disable transmit and receive */ -lpuart32_write (&sport->port, old_ctrl & ~(UARTCTRL_TE |UARTCTRL_RE ), +lpuart32_write (port, old_ctrl & ~(UARTCTRL_TE |UARTCTRL_RE ),UARTCTRL ); -lpuart32_write (&sport->port, bd,UARTBAUD ); +lpuart32_write (port, bd,UARTBAUD );lpuart32_serial_setbrg (sport, baud);/* disable CTS before enabling UARTCTRL_TE to avoid pending idle preamble */ -lpuart32_write (&sport->port, modem & ~UARTMODIR_TXCTSE ,UARTMODIR ); +lpuart32_write (port, modem & ~UARTMODIR_TXCTSE ,UARTMODIR );/* restore control register */ -lpuart32_write (&sport->port, ctrl,UARTCTRL ); +lpuart32_write (port, ctrl,UARTCTRL );/* re-enable the CTS if needed */ -lpuart32_write (&sport->port, modem,UARTMODIR ); +lpuart32_write (port, modem,UARTMODIR );if ((ctrl & (UARTCTRL_PE |UARTCTRL_M )) ==UARTCTRL_PE ) sport->is_cs7 = true;
@@ -2383,7 +2374,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, sport->lpuart_dma_rx_use = false; } -uart_port_unlock_irqrestore (&sport->port, flags); +uart_port_unlock_irqrestore (port, flags); }static const char *lpuart_type (struct uart_port *port)
@@ -2821,7 +2812,7 @@ static int lpuart_global_reset(struct lpuart_port *sport) ret =clk_prepare_enable (sport->ipg_clk);if (ret) { -dev_err (sport->port.dev,"failed to enable uart ipg clk: %d\n" , ret); +dev_err (port->dev,"failed to enable uart ipg clk: %d\n" , ret);return ret; }
@@ -2832,10 +2823,10 @@ static int lpuart_global_reset(struct lpuart_port *sport)*/ ctrl =lpuart32_read (port,UARTCTRL );if (ctrl &UARTCTRL_TE ) { - bd =lpuart32_read (&sport->port,UARTBAUD ); + bd =lpuart32_read (port,UARTBAUD );if (read_poll_timeout (lpuart32_tx_empty, val, val,1 ,100000 , false, port)) { -dev_warn (sport->port.dev, +dev_warn (port->dev,"timeout waiting for transmit engine to complete\n" );clk_disable_unprepare (sport->ipg_clk);return 0 ;
@@ -3187,7 +3178,7 @@ static void lpuart_console_fixup(struct lpuart_port *sport)* in VLLS mode, or restore console setting here. */ if (is_imx7ulp_lpuart (sport) &&lpuart_uport_is_active (sport) && - console_suspend_enabled &&uart_console (&sport->port)) { + console_suspend_enabled &&uart_console (uport)) {mutex_lock (&port->mutex);memset (&termios,0 ,sizeof (struct ktermios ));
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 431/499 tty: serial: lpuart: only disable CTS instead of overwriting the whole UARTMODIR register
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Sun <[email protected]>
[ Upstream commit e98ab45ec5182605d2e00114cba3bbf46b0ea27f ]
No need to overwrite the whole UARTMODIR register before waiting the transmit engine complete, actually our target here is only to disable CTS flow control to avoid the dirty data in TX FIFO may block the transmit engine complete.
Also delete the following duplicate CTS disable configuration.
--- drivers/tty/serial/fsl_lpuart.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/tty/serial/fsl_lpuart.c +7 -5
@@ -2341,15 +2341,19 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,/* update the per-port timeout */ uart_update_timeout (port, termios->c_cflag, baud); +/* +* disable CTS to ensure the transmit engine is not blocked by the flow +* control when there is dirty data in TX FIFO +*/ +lpuart32_write (port, modem & ~UARTMODIR_TXCTSE ,UARTMODIR ); +/* * LPUART Transmission Complete Flag may never be set while queuing a break * character, so skip waiting for transmission complete when UARTCTRL_SBK is * asserted. */ -if (!(old_ctrl &UARTCTRL_SBK )) { -lpuart32_write (port,0 ,UARTMODIR ); +if (!(old_ctrl &UARTCTRL_SBK ))lpuart32_wait_bit_set (port,UARTSTAT ,UARTSTAT_TC ); - }/* disable transmit and receive */ lpuart32_write(port, old_ctrl & ~(UARTCTRL_TE | UARTCTRL_RE),
@@ -2357,8 +2361,6 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,lpuart32_write (port, bd,UARTBAUD );lpuart32_serial_setbrg (sport, baud); -/* disable CTS before enabling UARTCTRL_TE to avoid pending idle preamble */ -lpuart32_write (port, modem & ~UARTMODIR_TXCTSE ,UARTMODIR );/* restore control register */ lpuart32_write (port, ctrl,UARTCTRL );/* re-enable the CTS if needed */
Signature · 1 line
2.39.5
Greg Kroah-Hartman
maintainerPATCH 432/499 wifi: mac80211: Fix sparse warning for monitor_sdata
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Wetzel <[email protected]>
commit 861d0445e72e9e33797f2ceef882c74decb16a87 upstream.
Use rcu_access_pointer() to avoid sparse warning in drv_remove_interface().
--- net/mac80211/driver-ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/driver-ops.c +1 -1
@@ -121,7 +121,7 @@ void drv_remove_interface(struct ieee802* The virtual monitor interface doesn't get a debugfs * entry, so it's exempt here. */ -if (sdata != local->monitor_sdata) +if (sdata !=rcu_access_pointer (local->monitor_sdata))ieee80211_debugfs_recreate_netdev (sdata, sdata->vif.valid_links);
Greg Kroah-Hartman
maintainerPATCH 433/499 usbnet:fix NPE during rx_complete
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ying Lu <[email protected]>
commit 51de3600093429e3b712e5f091d767babc5dd6df upstream.
Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this check.
This inconsistency creates a race condition where:
A URB request may succeed, but the corresponding SKB data fails to be queued.
Subsequent processes:
(e.g., rx_complete → defer_bh → __skb_unlink(skb, list)) attempt to access skb->next, triggering a NULL pointer dereference (Kernel Panic).
--- drivers/net/usb/usbnet.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/usb/usbnet.c +3 -3
@@ -530,7 +530,8 @@ static int rx_submit (struct usbnet *devnetif_device_present (dev->net) &&test_bit (EVENT_DEV_OPEN , &dev->flags) && !test_bit (EVENT_RX_HALT , &dev->flags) && - !test_bit (EVENT_DEV_ASLEEP, &dev->flags)) { + !test_bit (EVENT_DEV_ASLEEP , &dev->flags) && + !usbnet_going_away(dev)) { switch (retval = usb_submit_urb (urb, GFP_ATOMIC)) {case -EPIPE :usbnet_defer_kevent (dev,EVENT_RX_HALT );
@@ -551,8 +552,7 @@ static int rx_submit (struct usbnet *devtasklet_schedule (&dev->bh);break ;case 0 : -if (!usbnet_going_away (dev)) -__usbnet_queue_skb (&dev->rxq, skb, rx_start); +__usbnet_queue_skb (&dev->rxq, skb, rx_start); } }else {netif_dbg (dev, ifdown, dev->net,"rx: stopped\n" );
Greg Kroah-Hartman
maintainerPATCH 434/499 rust: Fix enabling Rust and building with GCC for LoongArch
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Rui <[email protected]>
commit 13c23cb4ed09466d73f1beae8956810b95add6ef upstream.
This patch fixes a build issue on LoongArch when Rust is enabled and compiled with GCC by explicitly setting the bindgen target and skipping C flags that Clang doesn't support.
--- rust/Makefile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
rust/Makefile +3 -1
@@ -230,7 +230,8 @@ bindgen_skip_c_flags := -mno-fp-ret-in-3 -mfunction-return=thunk-extern -mrecord-mcount -mabi=lp64 \ -mindirect-branch-cs-prefix -mstack-protector-guard% -mtraceback=no \ -mno-pointers-to-nested-functions -mno-string \ - -mno-strict-align -mstrict-align \ + -mno-strict-align -mstrict-align -mdirect-extern-access \ + -mexplicit-relocs -mno-check-zero-division \ -fconserve-stack -falign-jumps=% -falign-loops=% \ -femit-struct-debug-baseonly -fno-ipa-cp-clone -fno-ipa-sra \ -fno-partial-inlining -fplugin-arg-arm_ssp_per_task_plugin-% \
@@ -244,6 +245,7 @@ bindgen_skip_c_flags := -mno-fp-ret-in-3 # Derived from `scripts/Makefile.clang`. BINDGEN_TARGET_x86 := x86_64-linux-gnu BINDGEN_TARGET_arm64 := aarch64-linux-gnu +BINDGEN_TARGET_loongarch := loongarch64-linux-gnusf BINDGEN_TARGET := $(BINDGEN_TARGET_$(SRCARCH)) # All warnings are inhibited since GCC builds are very experimental,
Greg Kroah-Hartman
maintainerPATCH 435/499 LoongArch: Increase ARCH_DMA_MINALIGN up to 16
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit 4103cfe9dcb88010ae4911d3ff417457d1b6a720 upstream.
ARCH_DMA_MINALIGN is 1 by default, but some LoongArch-specific devices (such as APBDMA) require 16 bytes alignment. When the data buffer length is too small, the hardware may make an error writing cacheline. Thus, it is dangerous to allocate a small memory buffer for DMA. It's always safe to define ARCH_DMA_MINALIGN as L1_CACHE_BYTES but unnecessary (kmalloc() need small memory objects). Therefore, just increase it to 16.
--- arch/loongarch/include/asm/cache.h | 2 ++ 1 file changed, 2 insertions(+)
arch/loongarch/include/asm/cache.h +2 -0
@@ -8,6 +8,8 @@#define L1_CACHE_SHIFT CONFIG_L1_CACHE_SHIFT#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT) +#define ARCH_DMA_MINALIGN (16) +#define __read_mostly __section(".data..read_mostly")#endif /* _ASM_CACHE_H */
Greg Kroah-Hartman
maintainerPATCH 436/499 LoongArch: Increase MAX_IO_PICS up to 8
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
commit ec105cadff5d8c0a029a3dc1084cae46cf3f799d upstream.
Begin with Loongson-3C6000, the number of PCI host can be as many as 8 for multi-chip machines, and this number should be the same for I/O interrupt controllers. To support these machines we also increase the MAX_IO_PICS up to 8.
--- arch/loongarch/include/asm/irq.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/include/asm/irq.h +1 -1
@@ -53,7 +53,7 @@ void spurious_interrupt(void);#define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtracevoid arch_trigger_cpumask_backtrace (const struct cpumask *mask,int exclude_cpu); -#define MAX_IO_PICS 2 +#define MAX_IO_PICS 8#define NR_IRQS (64 + NR_VECTORS * (NR_CPUS + MAX_IO_PICS))struct acpi_vector_group {
Greg Kroah-Hartman
maintainerPATCH 437/499 LoongArch: BPF: Fix off-by-one error in build_prologue()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <[email protected]>
commit 7e2586991e36663c9bc48c828b83eab180ad30a9 upstream.
Vincent reported that running BPF progs with tailcalls on LoongArch causes kernel hard lockup. Debugging the issues shows that the JITed image missing a jirl instruction at the end of the epilogue.
There are two passes in JIT compiling, the first pass set the flags and the second pass generates JIT code based on those flags. With BPF progs mixing bpf2bpf and tailcalls, build_prologue() generates N insns in the first pass and then generates N+1 insns in the second pass. This makes epilogue_offset off by one and we will jump to some unexpected insn and cause lockup. Fix this by inserting a nop insn.
--- arch/loongarch/net/bpf_jit.c | 2 ++ arch/loongarch/net/bpf_jit.h | 5 +++++ 2 files changed, 7 insertions(+)
arch/loongarch/net/bpf_jit.c +2 -0
@@ -142,6 +142,8 @@ static void build_prologue(struct jit_ct*/ if (seen_tail_call (ctx) &&seen_call (ctx))move_reg (ctx,TCC_SAVED ,REG_TCC ); +else +emit_insn (ctx, nop); ctx->stack_size = stack_adjust; }
arch/loongarch/net/bpf_jit.h +5 -0
@@ -27,6 +27,11 @@ struct jit_data {struct jit_ctx ctx; }; +static inline void emit_nop (union loongarch_instruction *insn) +{ + insn->word =INSN_NOP ; +} +#define emit_insn (ctx, func, ...) \ do { \ if (ctx->image != NULL) { \
Greg Kroah-Hartman
maintainerPATCH 438/499 LoongArch: BPF: Dont override subprogs return value
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <[email protected]>
commit 60f3caff1492e5b8616b9578c4bedb5c0a88ed14 upstream.
The verifier test calls: div by 0 in subprog triggers a panic at the ld.bu instruction. The ld.bu insn is trying to load byte from memory address returned by the subprog. The subprog actually set the correct address at the a5 register (dedicated register for BPF return values). But at commit 73c359d1d356 ("LoongArch: BPF: Sign-extend return values") we also sign extended a5 to the a0 register (return value in LoongArch). For function call insn, we later propagate the a0 register back to a5 register. This is right for native calls but wrong for bpf2bpf calls which expect zero-extended return value in a5 register. So only move a0 to a5 for native calls (i.e. non-BPF_PSEUDO_CALL).
--- arch/loongarch/net/bpf_jit.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/loongarch/net/bpf_jit.c +4 -1
@@ -907,7 +907,10 @@ static int build_insn(const struct bpf_imove_addr (ctx, t1, func_addr);emit_insn (ctx, jirl,LOONGARCH_GPR_RA , t1,0 ); -move_reg (ctx, regmap[BPF_REG_0 ],LOONGARCH_GPR_A0 ); + +if (insn->src_reg !=BPF_PSEUDO_CALL ) +move_reg (ctx, regmap[BPF_REG_0 ],LOONGARCH_GPR_A0 ); +break ;/* tail call */
Greg Kroah-Hartman
maintainerPATCH 439/499 LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hengqi Chen <[email protected]>
commit 52266f1015a8b5aabec7d127f83d105f702b388e upstream.
Vincent reported that running XDP synproxy program on LoongArch results in the following error:
JIT doesn't support bpf-to-bpf calls
With dmesg:
multi-func JIT bug 1391 != 1390
The root cause is that verifier will refill the imm with the correct addresses of bpf_calls for BPF_PSEUDO_FUNC instructions and then run the last pass of JIT. So we generate different JIT code for the same instruction in two passes (one for placeholder and the other for the real address). Let's use move_addr() instead.
See commit 64f50f6575721ef0 ("LoongArch, bpf: Use 4 instructions for function address in JIT") for a similar fix.
--- arch/loongarch/net/bpf_jit.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/loongarch/net/bpf_jit.c +4 -1
@@ -935,7 +935,10 @@ static int build_insn(const struct bpf_i {const u64 imm64 = (u64)(insn +1 )->imm <<32 | (u32 )insn->imm; -move_imm (ctx, dst, imm64, is32); +if (bpf_pseudo_func (insn)) +move_addr (ctx, dst, imm64); +else +move_imm (ctx, dst, imm64, is32);return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 440/499 x86/hyperv: Fix check of return value from snp_set_vmsa()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianyu Lan <[email protected]>
commit e792d843aa3c9d039074cdce728d5803262e57a7 upstream.
snp_set_vmsa() returns 0 as success result and so fix it.
Message-ID: <[email protected]>
--- arch/x86/hyperv/ivm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/hyperv/ivm.c +1 -1
@@ -339,7 +339,7 @@ int hv_snp_boot_ap(u32 cpu, unsigned lon vmsa->sev_features = sev_status >>2 ; ret =snp_set_vmsa (vmsa, true); -if (!ret) { +if (ret) {pr_err ("RMPADJUST(%llx) failed: %llx\n" , (u64 )vmsa, ret);free_page ((u64 )vmsa);return ret;
Greg Kroah-Hartman
maintainerPATCH 441/499 KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 74c1807f6c4feddb3c3cb1056c54531d4adbaea6 upstream.
KVM_CAP_SYNC_REGS does not make sense for VMs with protected guest state, since the register values cannot actually be written. Return 0 when using the VM-level KVM_CHECK_EXTENSION ioctl, and accordingly return -EINVAL from KVM_RUN if the valid/dirty fields are nonzero.
However, on exit from KVM_RUN userspace could have placed a nonzero value into kvm_run->kvm_valid_regs, so check guest_state_protected again and skip store_regs() in that case.
Message-ID: <[email protected]>
--- arch/x86/kvm/x86.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
arch/x86/kvm/x86.c +11 -4
@@ -4573,6 +4573,11 @@ static bool kvm_is_vm_type_supported(unsreturn type <32 && (kvm_caps.supported_vm_types &BIT (type)); } +static inline u32 kvm_sync_valid_fields (struct kvm *kvm) +{ +return kvm && kvm->arch.has_protected_state ?0 :KVM_SYNC_X86_VALID_FIELDS ; +} +int kvm_vm_ioctl_check_extension (struct kvm *kvm,long ext) {int r =0 ;
@@ -4681,7 +4686,7 @@ int kvm_vm_ioctl_check_extension(structbreak ;#endif case KVM_CAP_SYNC_REGS : - r =KVM_SYNC_X86_VALID_FIELDS ; + r =kvm_sync_valid_fields (kvm);break ;case KVM_CAP_ADJUST_CLOCK : r =KVM_CLOCK_VALID_FLAGS ;
@@ -11466,6 +11471,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v {struct kvm_queued_exception *ex = &vcpu->arch.exception;struct kvm_run *kvm_run = vcpu->run; +u32 sync_valid_fields;int r; r =kvm_mmu_post_init_vm (vcpu->kvm);
@@ -11511,8 +11517,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v goto out; } -if ((kvm_run->kvm_valid_regs & ~KVM_SYNC_X86_VALID_FIELDS ) || - (kvm_run->kvm_dirty_regs & ~KVM_SYNC_X86_VALID_FIELDS )) { + sync_valid_fields =kvm_sync_valid_fields (vcpu->kvm); +if ((kvm_run->kvm_valid_regs & ~sync_valid_fields) || + (kvm_run->kvm_dirty_regs & ~sync_valid_fields)) { r = -EINVAL ; goto out; }
@@ -11570,7 +11577,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v out:kvm_put_guest_fpu (vcpu); -if (kvm_run->kvm_valid_regs) +if (kvm_run->kvm_valid_regs &&likely (!vcpu->arch.guest_state_protected))store_regs (vcpu);post_kvm_run_save (vcpu);kvm_vcpu_srcu_read_unlock (vcpu);
Greg Kroah-Hartman
maintainerPATCH 442/499 x86/microcode/AMD: Fix __apply_microcode_amd()s return value
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Ostrovsky <[email protected]>
commit 31ab12df723543047c3fc19cb8f8c4498ec6267f upstream.
When verify_sha256_digest() fails, __apply_microcode_amd() should propagate the failure by returning false (and not -1 which is promoted to true).
--- arch/x86/kernel/cpu/microcode/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/microcode/amd.c +1 -1
@@ -600,7 +600,7 @@ static bool __apply_microcode_amd(structunsigned long p_addr = (unsigned long )&mc->hdr.data_code;if (!verify_sha256_digest (mc->hdr.patch_id, *cur_rev, (const u8 *)p_addr, psize)) -return -1 ; +return false;native_wrmsrl (MSR_AMD64_PATCH_LOADER , p_addr);
Greg Kroah-Hartman
maintainerPATCH 443/499 x86/mce: use is_copy_from_user() to determine copy-from-user context
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
commit 1a15bb8303b6b104e78028b6c68f76a0d4562134 upstream.
Patch series "mm/hwpoison: Fix regressions in memory failure handling", v4.
## 1. What am I trying to do:
This patchset resolves two critical regressions related to memory failure handling that have appeared in the upstream kernel since version 5.17, as compared to 5.10 LTS.
- copyin case: poison found in user page while kernel copying from user space
- instr case: poison found while instruction fetching in user space
## 2. What is the expected outcome and why
- For copyin case:
Kernel can recover from poison found where kernel is doing get_user() or copy_from_user() if those places get an error return and the kernel return -EFAULT to the process instead of crashing. More specifily, MCE handler checks the fixup handler type to decide whether an in kernel #MC can be recovered. When EX_TYPE_UACCESS is found, the PC jumps to recovery code specified in _ASM_EXTABLE_FAULT() and return a -EFAULT to user space.
- For instr case:
If a poison found while instruction fetching in user space, full recovery is possible. User process takes #PF, Linux allocates a new page and fills by reading from storage.
## 3. What actually happens and why
- For copyin case: kernel panic since v5.17
Commit 4c132d1d844a ("x86/futex: Remove .fixup usage") introduced a new extable fixup type, EX_TYPE_EFAULT_REG, and later patches updated the extable fixup type for copy-from-user operations, changing it from EX_TYPE_UACCESS to EX_TYPE_EFAULT_REG. It breaks previous EX_TYPE_UACCESS handling when posion found in get_user() or copy_from_user().
- For instr case: user process is killed by a SIGBUS signal due to #CMCI and #MCE race
When an uncorrected memory error is consumed there is a race between the CMCI from the memory controller reporting an uncorrected error with a UCNA signature, and the core reporting and SRAR signature machine check when the data is about to be consumed.
### Background: why *UN*corrected errors tied to *C*MCI in Intel platform [1]
Prior to Icelake memory controllers reported patrol scrub events that detected a previously unseen uncorrected error in memory by signaling a broadcast machine check with an SRAO (Software Recoverable Action Optional) signature in the machine check bank. This was overkill because it's not an urgent problem that no core is on the verge of consuming that bad data. It's also found that multi SRAO UCE may cause nested MCE interrupts and finally become an IERR.
Hence, Intel downgrades the machine check bank signature of patrol scrub from SRAO to UCNA (Uncorrected, No Action required), and signal changed to #CMCI. Just to add to the confusion, Linux does take an action (in uc_decode_notifier()) to try to offline the page despite the UC*NA* signature name.
### Background: why #CMCI and #MCE race when poison is consuming in
Intel platform [1]
Having decided that CMCI/UCNA is the best action for patrol scrub errors, the memory controller uses it for reads too. But the memory controller is executing asynchronously from the core, and can't tell the difference between a "real" read and a speculative read. So it will do CMCI/UCNA if an error is found in any read.
Thus:
1) Core is clever and thinks address A is needed soon, issues a speculative read.
2) Core finds it is going to use address A soon after sending the read request
3) The CMCI from the memory controller is in a race with MCE from the core that will soon try to retire the load from address A.
Quite often (because speculation has got better) the CMCI from the memory controller is delivered before the core is committed to the instruction reading address A, so the interrupt is taken, and Linux offlines the page (marking it as poison).
## Why user process is killed for instr case
Commit 046545a661af ("mm/hwpoison: fix error page recovered but reported "not recovered"") tries to fix noise message "Memory error not recovered" and skips duplicate SIGBUSs due to the race. But it also introduced a bug that kill_accessing_process() return -EHWPOISON for instr case, as result, kill_me_maybe() send a SIGBUS to user process.
# 4. The fix, in my opinion, should be:
- For copyin case:
The key point is whether the error context is in a read from user memory. We do not care about the ex-type if we know its a MOV reading from userspace.
is_copy_from_user() return true when both of the following two checks are true:
- the current instruction is copy
- source address is user memory
If copy_user is true, we set
m->kflags |= MCE_IN_KERNEL_COPYIN | MCE_IN_KERNEL_RECOV;
Then do_machine_check() will try fixup_exception() first.
- For instr case: let kill_accessing_process() return 0 to prevent a SIGBUS.
- For patch 3:
The return value of memory_failure() is quite important while discussed instr case regression with Tony and Miaohe for patch 2, so add comment about the return value.
This patch (of 3):
Commit 4c132d1d844a ("x86/futex: Remove .fixup usage") introduced a new extable fixup type, EX_TYPE_EFAULT_REG, and commit 4c132d1d844a ("x86/futex: Remove .fixup usage") updated the extable fixup type for copy-from-user operations, changing it from EX_TYPE_UACCESS to EX_TYPE_EFAULT_REG. The error context for copy-from-user operations no longer functions as an in-kernel recovery context. Consequently, the error context for copy-from-user operations no longer functions as an in-kernel recovery context, resulting in kernel panics with the message:
"Machine check: Data load in unrecoverable area of kernel."
To address this, it is crucial to identify if an error context involves a read operation from user memory. The function is_copy_from_user() can be utilized to determine:
- the current operation is copy
- when reading user memory
When these conditions are met, is_copy_from_user() will return true, confirming that it is indeed a direct copy from user memory. This check is essential for correctly handling the context of errors in these operations without relying on the extable fixup types that previously allowed for in-kernel recovery.
So, use is_copy_from_user() to determine if a context is copy user directly.
--- arch/x86/kernel/cpu/mce/severity.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
arch/x86/kernel/cpu/mce/severity.c +5 -6
@@ -300,13 +300,12 @@ static noinstr int error_context(struct copy_user =is_copy_from_user (regs);instrumentation_end (); -switch (fixup_type) { -case EX_TYPE_UACCESS : -if (!copy_user) -return IN_KERNEL ; - m->kflags |=MCE_IN_KERNEL_COPYIN ; - fallthrough; +if (copy_user) { + m->kflags |=MCE_IN_KERNEL_COPYIN |MCE_IN_KERNEL_RECOV ; +return IN_KERNEL_RECOV ; + } +switch (fixup_type) {case EX_TYPE_FAULT_MCE_SAFE :case EX_TYPE_DEFAULT_MCE_SAFE : m->kflags |=MCE_IN_KERNEL_RECOV ;
Greg Kroah-Hartman
maintainerPATCH 444/499 x86/tdx: Fix arch_safe_halt() execution for TDX VMs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishal Annapurve <[email protected]>
commit 9f98a4f4e7216dbe366010b4cdcab6b220f229c4 upstream.
Direct HLT instruction execution causes #VEs for TDX VMs which is routed to hypervisor via TDCALL. If HLT is executed in STI-shadow, resulting #VE handler will enable interrupts before TDCALL is routed to hypervisor leading to missed wakeup events, as current TDX spec doesn't expose interruptibility state information to allow #VE handler to selectively enable interrupts.
Commit bfe6ed0c6727 ("x86/tdx: Add HLT support for TDX guests") prevented the idle routines from executing HLT instruction in STI-shadow. But it missed the paravirt routine which can be reached via this path as an example:
kvm_wait() =>
safe_halt() =>
raw_safe_halt() =>
arch_safe_halt() =>
irq.safe_halt() =>
pv_native_safe_halt()To reliably handle arch_safe_halt() for TDX VMs, introduce explicit dependency on CONFIG_PARAVIRT and override paravirt halt()/safe_halt() routines with TDX-safe versions that execute direct TDCALL and needed interrupt flag updates. Executing direct TDCALL brings in additional benefit of avoiding HLT related #VEs altogether.
As tested by Ryan Afranji:
"Tested with the specjbb2015 benchmark. It has heavy lock contention which leads
to many halt calls. TDX VMs suffered a poor score before this patchset.
Verified the major performance improvement with this patchset applied."
--- arch/x86/Kconfig | 1 + arch/x86/coco/tdx/tdx.c | 26 +++++++++++++++++++++++++- arch/x86/include/asm/tdx.h | 4 ++-- arch/x86/kernel/process.c | 2 +- 4 files changed, 29 insertions(+), 4 deletions(-)
arch/x86/Kconfig +1 -0
@@ -897,6 +897,7 @@ config INTEL_TDX_GUEST depends on X86_64 && CPU_SUP_INTEL depends on X86_X2APIC depends on EFI_STUB + depends on PARAVIRT select ARCH_HAS_CC_PLATFORM select X86_MEM_ENCRYPT select X86_MCE
arch/x86/coco/tdx/tdx.c +25 -1
@@ -14,6 +14,7 @@#include <asm/ia32.h> #include <asm/insn.h> #include <asm/insn-eval.h> +#include <asm/paravirt_types.h> #include <asm/pgtable.h> #include <asm/set_memory.h> #include <asm/traps.h>
@@ -386,7 +387,7 @@ static int handle_halt(struct ve_info *vreturn ve_instr_len (ve); } -void __cpuidle tdx_safe_halt(void) +void __cpuidle tdx_halt(void) {const bool irq_disabled = false;
@@ -397,6 +398,16 @@ void __cpuidle tdx_safe_halt(void)WARN_ONCE (1 ,"HLT instruction emulation failed\n" ); } +static void __cpuidle tdx_safe_halt(void) +{ +tdx_halt (); +/* +* "__cpuidle" section doesn't support instrumentation, so stick +* with raw_* variant that avoids tracing hooks. +*/ +raw_local_irq_enable (); +} +static int read_msr (struct pt_regs *regs,struct ve_info *ve) {struct tdx_module_args args = {
@@ -1084,6 +1095,19 @@ void __init tdx_early_init(void) x86_platform.guest.enc_kexec_finish = tdx_kexec_finish;/* +* Avoid "sti;hlt" execution in TDX guests as HLT induces a #VE that +* will enable interrupts before HLT TDCALL invocation if executed +* in STI-shadow, possibly resulting in missed wakeup events. +* +* Modify all possible HLT execution paths to use TDX specific routines +* that directly execute TDCALL and toggle the interrupt state as +* needed after TDCALL completion. This also reduces HLT related #VEs +* in addition to having a reliable halt logic execution. +*/ + pv_ops.irq.safe_halt = tdx_safe_halt; + pv_ops.irq.halt = tdx_halt; + +/* * TDX intercepts the RDMSR to read the X2APIC ID in the parallel * bringup low level code. That raises #VE which cannot be handled * there.
arch/x86/include/asm/tdx.h +2 -2
@@ -58,7 +58,7 @@ void tdx_get_ve_info(struct ve_info *ve)bool tdx_handle_virt_exception (struct pt_regs *regs,struct ve_info *ve); -void tdx_safe_halt (void ); +void tdx_halt (void );bool tdx_early_handle_ve (struct pt_regs *regs);
@@ -69,7 +69,7 @@ u64 tdx_hcall_get_quote(u8 *buf, size_t#else static inline void tdx_early_init (void ) { }; -static inline void tdx_safe_halt (void ) { }; +static inline void tdx_halt (void ) { };static inline bool tdx_early_handle_ve (struct pt_regs *regs) {return false; }
arch/x86/kernel/process.c +1 -1
@@ -938,7 +938,7 @@ void __init select_idle_routine(void)static_call_update (x86_idle, mwait_idle); }else if (cpu_feature_enabled (X86_FEATURE_TDX_GUEST )) {pr_info ("using TDX aware idle routine\n" ); -static_call_update (x86_idle, tdx_safe_halt); +static_call_update (x86_idle, tdx_halt); }else {static_call_update (x86_idle, default_idle); }
Re: [PATCH 6.13 444/499] x86/tdx: Fix arch_safe_halt() execution for TDX VMs
Quoted 55 lines · Greg Kroah-Hartman
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishal Annapurve <[email protected]>
commit
9f98a4f4e7216dbe366010b4cdcab6b220f229c4upstream.Direct HLT instruction execution causes #VEs for TDX VMs which is routed to hypervisor via TDCALL. If HLT is executed in STI-shadow, resulting #VE handler will enable interrupts before TDCALL is routed to hypervisor leading to missed wakeup events, as current TDX spec doesn't expose interruptibility state information to allow #VE handler to selectively enable interrupts.
Commit
bfe6ed0c6727("x86/tdx: Add HLT support for TDX guests") prevented the idle routines from executing HLT instruction in STI-shadow. But it missed the paravirt routine which can be reached via this path as an example:kvm_wait() => safe_halt() => raw_safe_halt() => arch_safe_halt() => irq.safe_halt() => pv_native_safe_halt()To reliably handle
arch_safe_halt()for TDX VMs, introduce explicit dependency onCONFIG_PARAVIRTand override paravirt halt()/safe_halt() routines with TDX-safe versions that execute direct TDCALL and needed interrupt flag updates. Executing direct TDCALL brings in additional benefit of avoiding HLT related #VEs altogether.As tested by Ryan Afranji:
"Tested with the specjbb2015 benchmark. It has heavy lock contention which leads
to many halt calls. TDX VMs suffered a poor score before this patchset.Verified the major performance improvement with this patchset applied."
Fixes bfe6ed0c6727 ("x86/tdx: Add HLT support for TDX guests")Signed-off-by Vishal Annapurve <[email protected]>Signed-off-by Ingo Molnar <[email protected]>Reviewed-by Kirill A. Shutemov <[email protected]>Tested-by Ryan Afranji <[email protected]>Cc Andy Lutomirski <[email protected]>Cc Brian Gerst <[email protected]>Cc Juergen Gross <[email protected]>Cc H. Peter Anvin <[email protected]>Cc Linus Torvalds <[email protected]>Cc Josh Poimboeuf <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 7 lines
--- arch/x86/Kconfig | 1 + arch/x86/coco/tdx/tdx.c | 26 +++++++++++++++++++++++++- arch/x86/include/asm/tdx.h | 4 ++-- arch/x86/kernel/process.c | 2 +- 4 files changed, 29 insertions(+), 4 deletions(-)
Hi Greg,
This patch depends on commit 22cc5ca5de52 ("x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT"). I will respond to the other thread with a patch for commit 22cc5ca5de52 after resolving conflicts.
Regards,
Vishal
Greg Kroah-Hartman
maintainerRe: [PATCH 6.13 444/499] x86/tdx: Fix arch_safe_halt() execution for TDX VMs
Quoted 65 lines · Vishal Annapurve
Quoted 55 lines · Greg Kroah-Hartman
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishal Annapurve <[email protected]>
commit
9f98a4f4e7216dbe366010b4cdcab6b220f229c4upstream.Direct HLT instruction execution causes #VEs for TDX VMs which is routed to hypervisor via TDCALL. If HLT is executed in STI-shadow, resulting #VE handler will enable interrupts before TDCALL is routed to hypervisor leading to missed wakeup events, as current TDX spec doesn't expose interruptibility state information to allow #VE handler to selectively enable interrupts.
Commit
bfe6ed0c6727("x86/tdx: Add HLT support for TDX guests") prevented the idle routines from executing HLT instruction in STI-shadow. But it missed the paravirt routine which can be reached via this path as an example:kvm_wait() => safe_halt() => raw_safe_halt() => arch_safe_halt() => irq.safe_halt() => pv_native_safe_halt()To reliably handle
arch_safe_halt()for TDX VMs, introduce explicit dependency onCONFIG_PARAVIRTand override paravirt halt()/safe_halt() routines with TDX-safe versions that execute direct TDCALL and needed interrupt flag updates. Executing direct TDCALL brings in additional benefit of avoiding HLT related #VEs altogether.As tested by Ryan Afranji:
"Tested with the specjbb2015 benchmark. It has heavy lock contention which leads
to many halt calls. TDX VMs suffered a poor score before this patchset.Verified the major performance improvement with this patchset applied."
Fixes bfe6ed0c6727 ("x86/tdx: Add HLT support for TDX guests")Signed-off-by Vishal Annapurve <[email protected]>Signed-off-by Ingo Molnar <[email protected]>Reviewed-by Kirill A. Shutemov <[email protected]>Tested-by Ryan Afranji <[email protected]>Cc Andy Lutomirski <[email protected]>Cc Brian Gerst <[email protected]>Cc Juergen Gross <[email protected]>Cc H. Peter Anvin <[email protected]>Cc Linus Torvalds <[email protected]>Cc Josh Poimboeuf <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>Quoted 7 lines
--- arch/x86/Kconfig | 1 + arch/x86/coco/tdx/tdx.c | 26 +++++++++++++++++++++++++- arch/x86/include/asm/tdx.h | 4 ++-- arch/x86/kernel/process.c | 2 +- 4 files changed, 29 insertions(+), 4 deletions(-)
Quoted 5 lines
Hi Greg,
This patch depends on commit
22cc5ca5de52("x86/paravirt: Move halt paravirt calls underCONFIG_PARAVIRT"). I will respond to the other thread with a patch for commit22cc5ca5de52after resolving conflicts.
That commit is already in this series, do I need to add it again? :)
thanks,
greg k-h
Re: [PATCH 6.13 444/499] x86/tdx: Fix arch_safe_halt() execution for TDX VMs
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
Quoted 5 lines · Vishal Annapurve
Hi Greg,
This patch depends on commit
22cc5ca5de52("x86/paravirt: Move halt paravirt calls underCONFIG_PARAVIRT"). I will respond to the other thread with a patch for commit22cc5ca5de52after resolving conflicts.That commit is already in this series, do I need to add it again? :)
Is it? I don't see it in the stable review on lore and it does not look like it made it into 6.13.11 final because the build errors if CONFIG_PARAVIRT_XXL is disabled (for example, allmodconfig with CONFIG_XEN_PV disabled):
arch/x86/coco/tdx/tdx.c: In function 'tdx_early_init':
arch/x86/coco/tdx/tdx.c:1107:19: error: 'struct pv_irq_ops' has no member named 'safe_halt'
1107 | pv_ops.irq.safe_halt = tdx_safe_halt;
| ^
arch/x86/coco/tdx/tdx.c:1108:19: error: 'struct pv_irq_ops' has no member named 'halt'
1108 | pv_ops.irq.halt = tdx_halt;
| ^
This was initially reported downstream by Marcus:
https://github.com/ClangBuiltLinux/linux/issues/2081
Cheers,
Nathan
Greg Kroah-Hartman
maintainerRe: [PATCH 6.13 444/499] x86/tdx: Fix arch_safe_halt() execution for TDX VMs
Quoted 25 lines · Nathan Chancellor
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
Quoted 5 lines · Vishal Annapurve
Hi Greg,
This patch depends on commit
22cc5ca5de52("x86/paravirt: Move halt paravirt calls underCONFIG_PARAVIRT"). I will respond to the other thread with a patch for commit22cc5ca5de52after resolving conflicts.That commit is already in this series, do I need to add it again? :)
Is it? I don't see it in the stable review on lore and it does not look like it made it into 6.13.11 final because the build errors if
CONFIG_PARAVIRT_XXLis disabled (for example, allmodconfig withCONFIG_XEN_PVdisabled):
arch/x86/coco/tdx/tdx.c: In function 'tdx_early_init':
arch/x86/coco/tdx/tdx.c:1107:19: error: 'structpv_irq_ops' has no member named 'safe_halt'
1107 | pv_ops.irq.safe_halt =tdx_safe_halt;
| ^
arch/x86/coco/tdx/tdx.c:1108:19: error: 'structpv_irq_ops' has no member named 'halt'
1108 | pv_ops.irq.halt =tdx_halt;
| ^
Quoted 2 lines
This was initially reported downstream by Marcus:
https://github.com/ClangBuiltLinux/linux/issues/2081
Now queued up, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 445/499 ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 2fa87c71d2adb4b82c105f9191e6120340feff00 upstream.
Depending on the secureboot signature on EFI\BOOT\BOOTX86.EFI the Lenovo Yoga Tab 3 UEFI will switch its OSID ACPI variable between 1 (Windows) and 4 (Android(GMIN)).
In Windows mode a GPIO event handler gets installed for GPO1 pin 5, causing Linux' x86-android-tables code which deals with the general brokenness of this device's ACPI tables to fail to probe with:
[ 17.853705] x86_android_tablets: error -16 getting GPIO INT33FF:01 5 [ 17.859623] x86_android_tablets x86_android_tablets: probe with driver
which renders sound, the touchscreen, charging-management, battery-monitoring and more non functional.
Add ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS to the existing quirks for this device to fix this.
--- drivers/acpi/x86/utils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/acpi/x86/utils.c +2 -1
@@ -374,7 +374,8 @@ static const struct dmi_system_id acpi_q DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"), }, .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | - ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), +ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | + ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), }, {/* Medion Lifetab S10346 */
Greg Kroah-Hartman
maintainerPATCH 446/499 platform/x86: thinkpad_acpi: disable ACPI fan access for T495* and E560
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Christian Dumitrescu <[email protected]>
commit 2b9f84e7dc863afd63357b867cea246aeedda036 upstream.
T495, T495s, and E560 laptops have the FANG+FANW ACPI methods (therefore fang_handle and fanw_handle are not NULL) but they do not actually work, which results in a "No such device or address" error. The DSDT table code for the FANG+FANW methods doesn't seem to do anything special regarding the fan being secondary. The bug was introduced in commit 57d0557dfa49 ("platform/x86: thinkpad_acpi: Add Thinkpad Edge E531 fan support"), which added a new fan control method via the FANG+FANW ACPI methods.
Add a quirk for T495, T495s, and E560 to avoid the FANG+FANW methods. Fan access and control is restored after forcing the legacy non-ACPI fan control method by setting both fang_handle and fanw_handle to NULL.
--- drivers/platform/x86/thinkpad_acpi.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/platform/x86/thinkpad_acpi.c +11 -0
@@ -8795,6 +8795,7 @@ static const struct attribute_group fan_#define TPACPI_FAN_NS 0x0010/* For EC with non-Standard register addresses */ #define TPACPI_FAN_DECRPM 0x0020/* For ECFW's with RPM in register as decimal */ #define TPACPI_FAN_TPR 0x0040/* Fan speed is in Ticks Per Revolution */ +#define TPACPI_FAN_NOACPI 0x0080/* Don't use ACPI methods even if detected */ static const struct tpacpi_quirk fan_quirk_table[]__initconst = {TPACPI_QEC_IBM ('1' ,'Y' ,TPACPI_FAN_Q1 ),
@@ -8825,6 +8826,9 @@ static const struct tpacpi_quirk fan_quiTPACPI_Q_LNV3 ('N' ,'1' ,'O' ,TPACPI_FAN_NOFAN ),/* X1 Tablet (2nd gen) */ TPACPI_Q_LNV3 ('R' ,'0' ,'Q' ,TPACPI_FAN_DECRPM ),/* L480 */ TPACPI_Q_LNV ('8' ,'F' ,TPACPI_FAN_TPR ),/* ThinkPad x120e */ +TPACPI_Q_LNV3 ('R' ,'0' ,'0' ,TPACPI_FAN_NOACPI ),/* E560 */ +TPACPI_Q_LNV3 ('R' ,'1' ,'2' ,TPACPI_FAN_NOACPI ),/* T495 */ + TPACPI_Q_LNV3('R', '1', '3', TPACPI_FAN_NOACPI),/* T495s */ };static int __init fan_init (struct ibm_init_struct *iibm)
@@ -8876,6 +8880,13 @@ static int __init fan_init(struct ibm_in tp_features.fan_ctrl_status_undef =1 ; } +if (quirks &TPACPI_FAN_NOACPI ) { +/* E560, T495, T495s */ +pr_info ("Ignoring buggy ACPI fan access method\n" ); + fang_handle =NULL ; + fanw_handle =NULL ; + } +if (gfan_handle) {/* 570, 600e/x, 770e, 770x */ fan_status_access_mode =TPACPI_FAN_RD_ACPI_GFAN ;
Greg Kroah-Hartman
maintainerPATCH 447/499 platform/x86: ISST: Correct command storage data length
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
commit 9462e74c5c983cce34019bfb27f734552bebe59f upstream.
After resume/online turbo limit ratio (TRL) is restored partially if the admin explicitly changed TRL from user space.
A hash table is used to store SST mail box and MSR settings when modified to restore those settings after resume or online. This uses a struct isst_cmd field "data" to store these settings. This is a 64 bit field. But isst_store_new_cmd() is only assigning as u32. This results in truncation of 32 bits.
Change the argument to u64 from u32.
--- drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/intel/speed_select_if/isst_if_common.c +1 -1
@@ -84,7 +84,7 @@ static DECLARE_HASHTABLE(isst_hash, 8);static DEFINE_MUTEX (isst_hash_lock);static int isst_store_new_cmd (int cmd,u32 cpu,int mbox_cmd_type,u32 param, -u32 data) +u64 data) {struct isst_cmd *sst_cmd;
Greg Kroah-Hartman
maintainerPATCH 448/499 ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Elfring <[email protected]>
commit 4279e72cab31dd3eb8c89591eb9d2affa90ab6aa upstream.
The function call “dmaengine_unmap_put(unmap)” was used in an if branch. The same call was immediately triggered by a subsequent goto statement. Thus avoid such a call repetition.
This issue was detected by using the Coccinelle software.
--- drivers/ntb/test/ntb_perf.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/ntb/test/ntb_perf.c +1 -3
@@ -839,10 +839,8 @@ static int perf_copy_chunk(struct perf_tdma_set_unmap (tx, unmap); ret =dma_submit_error (dmaengine_submit (tx)); -if (ret) { -dmaengine_unmap_put (unmap); +if (ret) goto err_free_resource; - }dmaengine_unmap_put (unmap);
Greg Kroah-Hartman
maintainerPATCH 449/499 perf/x86/intel: Apply static call for drain_pebs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra (Intel) <[email protected]>
commit 314dfe10576912e1d786b13c5d4eee8c51b63caa upstream.
The x86_pmu_drain_pebs static call was introduced in commit 7c9903c9bf71 ("x86/perf, static_call: Optimize x86_pmu methods"), but it's not really used to replace the old method.
Apply the static call for drain_pebs.
--- arch/x86/events/intel/core.c | 2 +- arch/x86/events/intel/ds.c | 2 +- arch/x86/events/perf_event.h | 1 + 3 files changed, 3 insertions(+), 2 deletions(-)
arch/x86/events/intel/core.c +1 -1
@@ -3067,7 +3067,7 @@ static int handle_pmi_common(struct pt_r handled++;x86_pmu_handle_guest_pebs (regs, &data); - x86_pmu.drain_pebs (regs, &data); +static_call (x86_pmu_drain_pebs)(regs, &data); status &= intel_ctrl |GLOBAL_STATUS_TRACE_TOPAPMI ;/*
arch/x86/events/intel/ds.c +1 -1
@@ -957,7 +957,7 @@ static inline void intel_pmu_drain_pebs_ {struct perf_sample_data data; - x86_pmu.drain_pebs (NULL , &data); +static_call (x86_pmu_drain_pebs)(NULL , &data); }/*
arch/x86/events/perf_event.h +1 -0
@@ -1106,6 +1106,7 @@ extern struct x86_pmu x86_pmu __read_mosDECLARE_STATIC_CALL (x86_pmu_set_period, *x86_pmu.set_period);DECLARE_STATIC_CALL (x86_pmu_update, *x86_pmu.update); +DECLARE_STATIC_CALL (x86_pmu_drain_pebs, *x86_pmu.drain_pebs); static __always_inline struct x86_perf_task_context_opt *task_context_opt(void *ctx) {
Greg Kroah-Hartman
maintainerPATCH 450/499 perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kan Liang <[email protected]>
commit f9bdf1f953392c9edd69a7f884f78c0390127029 upstream.
The WARN_ON(this_cpu_read(cpu_hw_events.enabled)) in the intel_pmu_save_and_restart_reload() is triggered, when sampling read topdown events.
In a NMI handler, the cpu_hw_events.enabled is set and used to indicate the status of core PMU. The generic pmu->pmu_disable_count, updated in the perf_pmu_disable/enable pair, is not touched.
However, the perf_pmu_disable/enable pair is invoked when sampling read in a NMI handler. The cpuc->enabled is mistakenly set by the perf_pmu_enable().
Avoid disabling PMU if the core PMU is already disabled. Merge the logic together.
--- arch/x86/events/intel/core.c | 41 +++++++++++++++++++++++------------------ arch/x86/events/intel/ds.c | 11 +---------- arch/x86/events/perf_event.h | 2 +- 3 files changed, 25 insertions(+), 29 deletions(-)
arch/x86/events/intel/core.c +23 -18
@@ -2779,28 +2779,33 @@ static u64 icl_update_topdown_event(struDEFINE_STATIC_CALL (intel_pmu_update_topdown_event, x86_perf_event_update); -static void intel_pmu_read_topdown_event (struct perf_event *event) +static void intel_pmu_read_event (struct perf_event *event) { -struct cpu_hw_events *cpuc =this_cpu_ptr (&cpu_hw_events); +if (event->hw.flags & (PERF_X86_EVENT_AUTO_RELOAD |PERF_X86_EVENT_TOPDOWN )) { +struct cpu_hw_events *cpuc =this_cpu_ptr (&cpu_hw_events); +bool pmu_enabled = cpuc->enabled; + +/* Only need to call update_topdown_event() once for group read. */ +if (is_metric_event (event) && (cpuc->txn_flags &PERF_PMU_TXN_READ )) +return ; + + cpuc->enabled =0 ; +if (pmu_enabled) +intel_pmu_disable_all (); + +if (is_topdown_event (event)) +static_call (intel_pmu_update_topdown_event)(event); +else +intel_pmu_drain_pebs_buffer (); + + cpuc->enabled = pmu_enabled; +if (pmu_enabled) +intel_pmu_enable_all (0 ); -/* Only need to call update_topdown_event() once for group read. */ -if ((cpuc->txn_flags &PERF_PMU_TXN_READ ) && - !is_slots_event (event))return ; + } -perf_pmu_disable (event->pmu); -static_call (intel_pmu_update_topdown_event)(event); -perf_pmu_enable (event->pmu); -} - -static void intel_pmu_read_event (struct perf_event *event) -{ -if (event->hw.flags &PERF_X86_EVENT_AUTO_RELOAD ) -intel_pmu_auto_reload_read (event); -else if (is_topdown_count (event)) -intel_pmu_read_topdown_event (event); -else -x86_perf_event_update (event); +x86_perf_event_update (event); }static void intel_pmu_enable_fixed (struct perf_event *event)
arch/x86/events/intel/ds.c +1 -10
@@ -953,7 +953,7 @@ unlock:return 1 ; } -static inline void intel_pmu_drain_pebs_buffer (void ) +void intel_pmu_drain_pebs_buffer (void ) {struct perf_sample_data data;
@@ -2100,15 +2100,6 @@ get_next_pebs_record_by_bit(void *base,return NULL ; } -void intel_pmu_auto_reload_read (struct perf_event *event) -{ -WARN_ON (!(event->hw.flags &PERF_X86_EVENT_AUTO_RELOAD )); - -perf_pmu_disable (event->pmu); -intel_pmu_drain_pebs_buffer (); -perf_pmu_enable (event->pmu); -} -/* * Special variant of intel_pmu_save_and_restart() for auto-reload. */
arch/x86/events/perf_event.h +1 -1
@@ -1643,7 +1643,7 @@ void intel_pmu_pebs_disable_all(void);void intel_pmu_pebs_sched_task (struct perf_event_pmu_context *pmu_ctx,bool sched_in); -void intel_pmu_auto_reload_read (struct perf_event *event); +void intel_pmu_drain_pebs_buffer (void );void intel_pmu_store_pebs_lbrs (struct lbr_entry *lbr);
Greg Kroah-Hartman
maintainerPATCH 451/499 uprobes/x86: Harden uretprobe syscall trampoline check
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
commit fa6192adc32f4fdfe5b74edd5b210e12afd6ecc0 upstream.
Jann reported a possible issue when trampoline_check_ip returns address near the bottom of the address space that is allowed to call into the syscall if uretprobes are not set up:
Though the mmap minimum address restrictions will typically prevent creating mappings there, let's make sure uretprobe syscall checks for that.
--- arch/x86/kernel/uprobes.c | 14 +++++++++----- include/linux/uprobes.h | 2 ++ kernel/events/uprobes.c | 2 +- 3 files changed, 12 insertions(+), 6 deletions(-)
arch/x86/kernel/uprobes.c +9 -5
@@ -357,19 +357,23 @@ void *arch_uprobe_trampoline(unsigned loreturn &insn; } -static unsigned long trampoline_check_ip (void ) +static unsigned long trampoline_check_ip (unsigned long tramp) { -unsigned long tramp =uprobe_get_trampoline_vaddr (); -return tramp + (uretprobe_syscall_check - uretprobe_trampoline_entry); }SYSCALL_DEFINE0 (uretprobe) {struct pt_regs *regs =task_pt_regs (current); -unsigned long err, ip, sp, r11_cx_ax[3 ]; +unsigned long err, ip, sp, r11_cx_ax[3 ], tramp; + +/* If there's no trampoline, we are called from wrong place. */ + tramp =uprobe_get_trampoline_vaddr (); +if (unlikely (tramp ==UPROBE_NO_TRAMPOLINE_VADDR )) + goto sigill; -if (regs->ip !=trampoline_check_ip ()) +/* Make sure the ip matches the only allowed sys_uretprobe caller. */ +if (unlikely (regs->ip !=trampoline_check_ip (tramp))) goto sigill; err =copy_from_user (r11_cx_ax, (void __user *)regs->sp,sizeof (r11_cx_ax));
include/linux/uprobes.h +2 -0
@@ -38,6 +38,8 @@ struct page;#define MAX_URETPROBE_DEPTH 64 +#define UPROBE_NO_TRAMPOLINE_VADDR (~0UL) +struct uprobe_consumer {/* * handler() can return UPROBE_HANDLER_REMOVE to signal the need to
kernel/events/uprobes.c +1 -1
@@ -2118,8 +2118,8 @@ void uprobe_copy_process(struct task_str*/ unsigned long uprobe_get_trampoline_vaddr (void ) { +unsigned long trampoline_vaddr =UPROBE_NO_TRAMPOLINE_VADDR ;struct xol_area *area; -unsigned long trampoline_vaddr =-1 ;/* Pairs with xol_add_vma() smp_store_release() */ area =READ_ONCE (current->mm->uprobes_state.xol_area);/* ^^^ */
Greg Kroah-Hartman
maintainerPATCH 452/499 x86/Kconfig: Add cmpxchg8b support back to Geode CPUs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 6ac43f2be982ea54b75206dccd33f4cf81bfdc39 upstream.
An older cleanup of mine inadvertently removed geode-gx1 and geode-lx from the list of CPUs that are known to support a working cmpxchg8b.
--- arch/x86/Kconfig.cpu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/Kconfig.cpu +1 -1
@@ -368,7 +368,7 @@ config X86_HAVE_PAE config X86_CMPXCHG64 def_bool y - depends on X86_HAVE_PAE || M586TSC || M586MMX || MK6 || MK7 + depends on X86_HAVE_PAE || M586TSC || M586MMX || MK6 || MK7 || MGEODEGX1 || MGEODE_LX # this should be set for all -march=.. options where the compiler # generates cmov.
Greg Kroah-Hartman
maintainerPATCH 453/499 x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guilherme G. Piccoli <[email protected]>
commit d90c9de9de2f1712df56de6e4f7d6982d358cabe upstream.
TSC could be reset in deep ACPI sleep states, even with invariant TSC.
That's the reason we have sched_clock() save/restore functions, to deal with this situation. But what happens is that such functions are guarded with a check for the stability of sched_clock - if not considered stable, the save/restore routines aren't executed.
On top of that, we have a clear comment in native_sched_clock() saying that *even* with TSC unstable, we continue using TSC for sched_clock due to its speed.
In other words, if we have a situation of TSC getting detected as unstable, it marks the sched_clock as unstable as well, so subsequent S3 sleep cycles could bring bogus sched_clock values due to the lack of the save/restore mechanism, causing warnings like this:
[22.954918] ------------[ cut here ]------------ [22.954923] Delta way too big! 18446743750843854390 ts=18446744072977390405 before=322133536015 after=322133536015 write stamp=18446744072977390405 [22.954923] If you just came from a suspend/resume, [22.954923] please switch to the trace global clock: [22.954923] echo global > /sys/kernel/tracing/trace_clock [22.954923] or add trace_clock=global to the kernel command line [22.954937] WARNING: CPU: 2 PID: 5728 at kernel/trace/ring_buffer.c:2890 rb_add_timestamp+0x193/0x1c0
Notice that the above was reproduced even with "trace_clock=global".
The fix for that is to _always_ save/restore the sched_clock on suspend cycle _if TSC is used_ as sched_clock - only if we fallback to jiffies the sched_clock_stable() check becomes relevant to save/restore the sched_clock.
--- arch/x86/kernel/tsc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/tsc.c +2 -2
@@ -957,7 +957,7 @@ static unsigned long long cyc2ns_suspendvoid tsc_save_sched_clock_state (void ) { -if (!sched_clock_stable ()) +if (!static_branch_likely (&__use_tsc) && !sched_clock_stable ())return ; cyc2ns_suspend =sched_clock ();
@@ -977,7 +977,7 @@ void tsc_restore_sched_clock_state(void)unsigned long flags;int cpu; -if (!sched_clock_stable ()) +if (!static_branch_likely (&__use_tsc) && !sched_clock_stable ())return ;local_irq_save (flags);
Greg Kroah-Hartman
maintainerPATCH 454/499 x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 3ef938c3503563bfc2ac15083557f880d29c2e64 upstream.
On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table:
collapse_pte_mapped_thp
pmdp_collapse_flush
flush_tlb_range
The arm64 version of flush_tlb_range() has a comment describing that it can be used for page table removal, and does not use any last-level invalidation optimizations. Fix the X86 version by making it behave the same way.
Currently, X86 only uses this information for the following two purposes, which I think means the issue doesn't have much impact:
- In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be IPI'd to avoid issues with speculative page table walks.
- In Hyper-V TLB paravirtualization, again for lazy TLB stuff.
The patch "x86/mm: only invalidate final translations with INVLPGB" which is currently under review (see
<https://lore.kernel.org/all/[email protected]/>)
would probably be making the impact of this a lot worse.
--- arch/x86/include/asm/tlbflush.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/tlbflush.h +1 -1
@@ -242,7 +242,7 @@ void flush_tlb_multi(const struct cpumasflush_tlb_mm_range ((vma)->vm_mm, start, end, \ ((vma)->vm_flags &VM_HUGETLB ) \ ?huge_page_shift (hstate_vma (vma)) \ - : PAGE_SHIFT, false) + : PAGE_SHIFT, true)extern void flush_tlb_all (void ); extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
Greg Kroah-Hartman
maintainerPATCH 455/499 wifi: mt76: mt7925: remove unused acpi function for clc
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Yen Hsieh <[email protected]>
commit b4ea6fdfc08375aae59c7e7059653b9877171fe4 upstream.
The code for handling ACPI configuration in CLC was copied from the mt7921 driver but is not utilized in the mt7925 implementation. So removes the unused functionality to clean up the codebase.
--- drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +0 -1
@@ -3117,7 +3117,6 @@ __mt7925_mcu_set_clc(struct mt792x_dev * .idx = idx, .env = env_cap, - .acpi_conf = mt792x_acpi_get_flags(&dev->phy), };int ret, valid_cnt =0 ;u8 i, *pos;
Greg Kroah-Hartman
maintainerPATCH 456/499 acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
commit 2ff0e408db36c21ed3fa5e3c1e0e687c82cf132f upstream.
Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the argument is equal to NVDIMM_BUS_FAMILY_NFIT == 0. Function acpi_nfit_ctl() first verifies that a user-provided value call_pkg->nd_family of type u64 is not equal to 0. Then the value is converted to int, and only after that is compared to NVDIMM_BUS_FAMILY_MAX. This can lead to passing an invalid argument to acpi_nfit_ctl(), if call_pkg->nd_family is non-zero, while the lower 32 bits are zero.
Furthermore, it is best to return EINVAL immediately upon seeing the invalid user input. The WARNING is insufficient to prevent further undefined behavior based on other invalid user input.
All checks of the input value should be applied to the original variable call_pkg->nd_family.
[iweiny: update commit message]
--- drivers/acpi/nfit/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/nfit/core.c +1 -1
@@ -485,7 +485,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc cmd_mask = nd_desc->cmd_mask;if (cmd ==ND_CMD_CALL && call_pkg->nd_family) { family = call_pkg->nd_family; -if (family >NVDIMM_BUS_FAMILY_MAX || +if (call_pkg->nd_family >NVDIMM_BUS_FAMILY_MAX || !test_bit (family, &nd_desc->bus_family_mask))return -EINVAL ; family = array_index_nospec(family,
Greg Kroah-Hartman
maintainerPATCH 457/499 ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Menzel <[email protected]>
commit 2da31ea2a085cd189857f2db0f7b78d0162db87a upstream.
Like the ASUS Vivobook X1504VAP and Vivobook X1704VAP, the ASUS Vivobook 14 X1404VAP has its keyboard IRQ (1) described as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh breaking the keyboard.
$ sudo dmidecode
[…]
System Information
Manufacturer: ASUSTeK COMPUTER INC.
Product Name: ASUS Vivobook 14 X1404VAP_X1404VA
[…]
$ grep -A 30 PS2K dsdt.dsl | grep IRQ -A 1
IRQ (Level, ActiveLow, Exclusive, )
{1}Add the X1404VAP to the irq1_level_low_skip_override[] quirk table to fix this.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -441,6 +441,13 @@ static const struct dmi_system_id irq1_l }, }, { +/* Asus Vivobook X1404VAP */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), + DMI_MATCH(DMI_BOARD_NAME, "X1404VAP"), + }, + }, + {/* Asus Vivobook X1504VAP */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
Greg Kroah-Hartman
maintainerPATCH 458/499 ACPI: video: Handle fetching EDID as ACPI_TYPE_PACKAGE
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <[email protected]>
commit ebca08fef88febdb0a898cefa7c99b9e25b3a984 upstream.
The _DDC method should return a buffer, or an integer in case of an error. But some Lenovo laptops incorrectly return EDID as buffer in ACPI package.
Calling _DDC generates this ACPI Warning:
ACPI Warning: \_SB.PCI0.GP17.VGA.LCD._DDC: Return type mismatch - \
found Package, expected Integer/Buffer (20240827/nspredef-254)
Use the first element of the package to get the EDID buffer.
The DSDT:
Name (AUOP, Package (0x01)
{
Buffer (0x80)
{
...
}
})...
Method (_DDC, 1, NotSerialized) // _DDC: Display Data Current
{
If ((PAID == AUID))
{
Return (AUOP) /* \_SB_.PCI0.GP17.VGA_.LCD_.AUOP */
}
ElseIf ((PAID == IVID))
{
Return (IVOP) /* \_SB_.PCI0.GP17.VGA_.LCD_.IVOP */
}
ElseIf ((PAID == BOID))
{
Return (BOEP) /* \_SB_.PCI0.GP17.VGA_.LCD_.BOEP */
}
ElseIf ((PAID == SAID))
{
Return (SUNG) /* \_SB_.PCI0.GP17.VGA_.LCD_.SUNG */
}
Return (Zero)
}--- drivers/acpi/acpi_video.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/acpi/acpi_video.c +8 -1
@@ -648,6 +648,13 @@ acpi_video_device_EDID(struct acpi_video obj = buffer.pointer; +/* +* Some buggy implementations incorrectly return the EDID buffer in an ACPI package. +* In this case, extract the buffer from the package. +*/ +if (obj && obj->type ==ACPI_TYPE_PACKAGE && obj->package.count ==1 ) + obj = &obj->package.elements[0 ]; +if (obj && obj->type ==ACPI_TYPE_BUFFER ) { *edid =kmemdup (obj->buffer.pointer, obj->buffer.length,GFP_KERNEL ); ret = *edid ? obj->buffer.length : -ENOMEM ;
@@ -657,7 +664,7 @@ acpi_video_device_EDID(struct acpi_video ret = -EFAULT ; } -kfree (obj); +kfree (buffer.pointer);return ret; }
Greg Kroah-Hartman
maintainerPATCH 459/499 ARM: 9444/1: add KEEP() keyword to ARM_VECTORS
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Eggers <[email protected]>
commit c3d944a367c0d9e4e125c7006e52f352e75776dc upstream.
Without this, the vectors are removed if LD_DEAD_CODE_DATA_ELIMINATION is enabled. At startup, the CPU (silently) hangs in the undefined instruction exception as soon as the first timer interrupt arrives.
On my setup, the system also boots fine without the 2nd and 3rd KEEP() statements, so I cannot tell whether these are actually required.
[nathan: Use OVERLAY_KEEP() to avoid breaking old ld.lld versions]
--- arch/arm/include/asm/vmlinux.lds.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/include/asm/vmlinux.lds.h +3 -3
@@ -125,13 +125,13 @@ __vectors_lma = .; \ OVERLAY 0xffff0000 : NOCROSSREFS AT(__vectors_lma) { \ .vectors { \ - *(.vectors) \ + OVERLAY_KEEP(*(.vectors)) \ } \ .vectors.bhb.loop8 { \ - *(.vectors.bhb.loop8) \ + OVERLAY_KEEP(*(.vectors.bhb.loop8)) \ } \ .vectors.bhb.bpiall { \ - *(.vectors.bhb.bpiall) \ + OVERLAY_KEEP(*(.vectors.bhb.bpiall)) \ } \ } \ ARM_LMA(__vectors, .vectors); \
Greg Kroah-Hartman
maintainerPATCH 460/499 media: omap3isp: Handle ARM dma_iommu_mapping
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <[email protected]>
commit 6bc076eec6f85f778f33a8242b438e1bd9fcdd59 upstream.
It's no longer practical for the OMAP IOMMU driver to trick arm_setup_iommu_dma_ops() into ignoring its presence, so let's use the same tactic as other IOMMU API users on 32-bit ARM and explicitly kick the arch code's dma_iommu_mapping out of the way to avoid problems.
--- drivers/media/platform/ti/omap3isp/isp.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/media/platform/ti/omap3isp/isp.c +7 -0
@@ -1961,6 +1961,13 @@ static int isp_attach_iommu(struct isp_dstruct dma_iommu_mapping *mapping;int ret; +/* We always want to replace any default mapping from the arch code */ + mapping =to_dma_iommu_mapping (isp->dev); +if (mapping) { +arm_iommu_detach_device (isp->dev); +arm_iommu_release_mapping (mapping); + } +/* * Create the ARM mapping, used by the ARM DMA mapping core to allocate * VAs. This will allocate a corresponding IOMMU domain.
Greg Kroah-Hartman
maintainerPATCH 461/499 Remove unnecessary firmware version check for gc v9_4_2
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Candice Li <[email protected]>
commit 5b3c08ae9ed324743f5f7286940d45caeb656e6e upstream.
GC v9_4_2 uses a new versioning scheme for CP firmware, making the warning ("CP firmware version too old, please update!") irrelevant.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +1 -0
@@ -1269,6 +1269,7 @@ static void gfx_v9_0_check_fw_write_wait adev->gfx.mec_fw_write_wait = false; if ((amdgpu_ip_version(adev, GC_HWIP, 0) != IP_VERSION(9, 4, 1)) && + (amdgpu_ip_version(adev, GC_HWIP, 0) != IP_VERSION(9, 4, 2)) && ((adev->gfx.mec_fw_version < 0x000001a5) || (adev->gfx.mec_feature_version < 46) || (adev->gfx.pfp_fw_version < 0x000000b7) ||
Greg Kroah-Hartman
maintainerPATCH 462/499 mmc: omap: Fix memory leak in mmc_omap_new_slot
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <[email protected]>
commit 3834a759afb817e23a7a2f09c2c9911b0ce5c588 upstream.
Add err_free_host label to properly pair mmc_alloc_host() with mmc_free_host() in GPIO error paths. The allocated host memory was leaked when GPIO lookups failed.
--- drivers/mmc/host/omap.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/mmc/host/omap.c +13 -6
@@ -1272,19 +1272,25 @@ static int mmc_omap_new_slot(struct mmc_/* Check for some optional GPIO controls */ slot->vsd =devm_gpiod_get_index_optional (host->dev,"vsd" , id,GPIOD_OUT_LOW ); -if (IS_ERR (slot->vsd)) -return dev_err_probe (host->dev,PTR_ERR (slot->vsd), +if (IS_ERR (slot->vsd)) { + r =dev_err_probe (host->dev,PTR_ERR (slot->vsd),"error looking up VSD GPIO\n" ); + goto err_free_host; + } slot->vio =devm_gpiod_get_index_optional (host->dev,"vio" , id,GPIOD_OUT_LOW ); -if (IS_ERR (slot->vio)) -return dev_err_probe (host->dev,PTR_ERR (slot->vio), +if (IS_ERR (slot->vio)) { + r =dev_err_probe (host->dev,PTR_ERR (slot->vio),"error looking up VIO GPIO\n" ); + goto err_free_host; + } slot->cover =devm_gpiod_get_index_optional (host->dev,"cover" , id,GPIOD_IN ); -if (IS_ERR (slot->cover)) -return dev_err_probe (host->dev,PTR_ERR (slot->cover), +if (IS_ERR (slot->cover)) { + r =dev_err_probe (host->dev,PTR_ERR (slot->cover),"error looking up cover switch GPIO\n" ); + goto err_free_host; + } host->slots[id] = slot;
@@ -1344,6 +1350,7 @@ err_remove_slot_name:device_remove_file (&mmc->class_dev, &dev_attr_slot_name); err_remove_host:mmc_remove_host (mmc); +err_free_host:mmc_free_host (mmc);return r; }
Greg Kroah-Hartman
maintainerPATCH 463/499 mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karel Balej <[email protected]>
commit a41fcca4b342811b473bbaa4b44f1d34d87fcce6 upstream.
Set the MMC_CAP_NEED_RSP_BUSY capability for the sdhci-pxav3 host to prevent conversion of R1B responses to R1. Without this, the eMMC card in the samsung,coreprimevelte smartphone using the Marvell PXA1908 SoC with this mmc host doesn't probe with the ETIMEDOUT error originating in __mmc_poll_for_busy.
Note that the other issues reported for this phone and host, namely floods of "Tuning failed, falling back to fixed sampling clock" dmesg messages for the eMMC and unstable SDIO are not mitigated by this change.
--- drivers/mmc/host/sdhci-pxav3.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/sdhci-pxav3.c +1 -0
@@ -399,6 +399,7 @@ static int sdhci_pxav3_probe(struct platif (!IS_ERR (pxa->clk_core))clk_prepare_enable (pxa->clk_core); + host->mmc->caps |=MMC_CAP_NEED_RSP_BUSY ;/* enable 1/8V DDR capable */ host->mmc->caps |=MMC_CAP_1_8V_DDR ;
Greg Kroah-Hartman
maintainerPATCH 464/499 mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulf Hansson <[email protected]>
commit 49d162635151d0dd04935070d7cf67137ab863aa upstream.
We have received reports about cards can become corrupt related to the aggressive PM support. Let's make a partial revert of the change that enabled the feature.
--- drivers/mmc/host/sdhci-omap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci-omap.c +2 -2
@@ -1339,8 +1339,8 @@ static int sdhci_omap_probe(struct platf/* R1B responses is required to properly manage HW busy detection. */ mmc->caps |=MMC_CAP_NEED_RSP_BUSY ; -/* Allow card power off and runtime PM for eMMC/SD card devices */ - mmc->caps |=MMC_CAP_POWER_OFF_CARD |MMC_CAP_AGGRESSIVE_PM ; +/* Enable SDIO card power off. */ + mmc->caps |=MMC_CAP_POWER_OFF_CARD ; ret =sdhci_setup_host (host);if (ret)
Greg Kroah-Hartman
maintainerPATCH 465/499 KVM: SVM: Dont change target vCPU state on AP Creation VMGEXIT error
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <[email protected]>
commit d26638bfcdfc5c8c4e085dc3f5976a0443abab3c upstream.
If KVM rejects an AP Creation event, leave the target vCPU state as-is. Nothing in the GHCB suggests the hypervisor is *allowed* to muck with vCPU state on failure, let alone required to do so. Furthermore, kicking only in the !ON_INIT case leads to divergent behavior, and even the "kick" case is non-deterministic.
E.g. if an ON_INIT request fails, the guest can successfully retry if the fixed AP Creation request is made prior to sending INIT. And if a !ON_INIT fails, the guest can successfully retry if the fixed AP Creation request is handled before the target vCPU processes KVM's KVM_REQ_UPDATE_PROTECTED_GUEST_STATE.
--- arch/x86/kvm/svm/sev.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
arch/x86/kvm/svm/sev.c +6 -7
@@ -3945,16 +3945,12 @@ static int sev_snp_ap_creation(struct vc/* * The target vCPU is valid, so the vCPU will be kicked unless the -* request is for CREATE_ON_INIT. For any errors at this stage, the -* kick will place the vCPU in an non-runnable state. +* request is for CREATE_ON_INIT. */ kick = true;mutex_lock (&target_svm->sev_es.snp_vmsa_mutex); - target_svm->sev_es.snp_vmsa_gpa =INVALID_PAGE ; - target_svm->sev_es.snp_ap_waiting_for_reset = true; -/* Interrupt injection mode shouldn't change for AP creation */ if (request <SVM_VMGEXIT_AP_DESTROY ) {u64 sev_features;
@@ -4000,20 +3996,23 @@ static int sev_snp_ap_creation(struct vc target_svm->sev_es.snp_vmsa_gpa = svm->vmcb->control.exit_info_2;break ;case SVM_VMGEXIT_AP_DESTROY : + target_svm->sev_es.snp_vmsa_gpa =INVALID_PAGE ;break ;default :vcpu_unimpl (vcpu,"vmgexit: invalid AP creation request [%#x] from guest\n" , request); ret = -EINVAL ; -break ; + goto out; } -out: + target_svm->sev_es.snp_ap_waiting_for_reset = true; +if (kick) {kvm_make_request (KVM_REQ_UPDATE_PROTECTED_GUEST_STATE , target_vcpu);kvm_vcpu_kick (target_vcpu); } +out:mutex_unlock (&target_svm->sev_es.snp_vmsa_mutex);return ret;
Greg Kroah-Hartman
maintainerPATCH 466/499 ksmbd: add bounds check for durable handle context
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit 542027e123fc0bfd61dd59e21ae0ee4ef2101b29 upstream.
Add missing bounds check for durable handle context.
--- fs/smb/server/smb2pdu.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
fs/smb/server/smb2pdu.c +21 -0
@@ -2703,6 +2703,13 @@ static int parse_durable_handle_context( goto out; } +if (le16_to_cpu (context->DataOffset) + +le32_to_cpu (context->DataLength) < +sizeof (struct create_durable_reconn_v2_req )) { + err = -EINVAL ; + goto out; + } + recon_v2 = (struct create_durable_reconn_v2_req *)context; persistent_id = recon_v2->Fid.PersistentFileId; dh_info->fp =ksmbd_lookup_durable_fd (persistent_id);
@@ -2736,6 +2743,13 @@ static int parse_durable_handle_context( goto out; } +if (le16_to_cpu (context->DataOffset) + +le32_to_cpu (context->DataLength) < +sizeof (struct create_durable_reconn_req )) { + err = -EINVAL ; + goto out; + } + recon = (struct create_durable_reconn_req *)context; persistent_id = recon->Data.Fid.PersistentFileId; dh_info->fp =ksmbd_lookup_durable_fd (persistent_id);
@@ -2760,6 +2774,13 @@ static int parse_durable_handle_context( err = -EINVAL ; goto out; } + +if (le16_to_cpu (context->DataOffset) + +le32_to_cpu (context->DataLength) < +sizeof (struct create_durable_req_v2 )) { + err = -EINVAL ; + goto out; + } durable_v2_blob = (struct create_durable_req_v2 *)context;
Greg Kroah-Hartman
maintainerPATCH 467/499 ksmbd: add bounds check for create lease context
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <[email protected]>
commit bab703ed8472aa9d109c5f8c1863921533363dae upstream.
Add missing bounds check for create lease context.
--- fs/smb/server/oplock.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/smb/server/oplock.c +8 -0
@@ -1505,6 +1505,10 @@ struct lease_ctx_info *parse_lease_stateif (sizeof (struct lease_context_v2 ) ==le32_to_cpu (cc->DataLength)) {struct create_lease_v2 *lc = (struct create_lease_v2 *)cc; +if (le16_to_cpu (cc->DataOffset) +le32_to_cpu (cc->DataLength) < +sizeof (struct create_lease_v2 ) -4 ) +return NULL ; +memcpy (lreq->lease_key, lc->lcontext.LeaseKey,SMB2_LEASE_KEY_SIZE ); lreq->req_state = lc->lcontext.LeaseState; lreq->flags = lc->lcontext.LeaseFlags;
@@ -1517,6 +1521,10 @@ struct lease_ctx_info *parse_lease_state }else {struct create_lease *lc = (struct create_lease *)cc; +if (le16_to_cpu (cc->DataOffset) +le32_to_cpu (cc->DataLength) < +sizeof (struct create_lease )) +return NULL ; +memcpy (lreq->lease_key, lc->lcontext.LeaseKey,SMB2_LEASE_KEY_SIZE ); lreq->req_state = lc->lcontext.LeaseState; lreq->flags = lc->lcontext.LeaseFlags;
Greg Kroah-Hartman
maintainerPATCH 468/499 ksmbd: fix use-after-free in ksmbd_sessions_deregister()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit 15a9605f8d69dc85005b1a00c31a050b8625e1aa upstream.
In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel. session that is freed through the global session table can be accessed again through ->sessions of connection.
--- fs/smb/server/mgmt/user_session.c | 3 +++ 1 file changed, 3 insertions(+)
fs/smb/server/mgmt/user_session.c +3 -0
@@ -230,6 +230,9 @@ void ksmbd_sessions_deregister(struct ksif (!ksmbd_chann_del (conn, sess) &&xa_empty (&sess->ksmbd_chann_list)) {hash_del (&sess->hlist); +down_write (&conn->session_lock); +xa_erase (&conn->sessions, sess->id); +up_write (&conn->session_lock);ksmbd_session_destroy (sess); } }
Greg Kroah-Hartman
maintainerPATCH 469/499 ksmbd: fix session use-after-free in multichannel connection
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit fa4cdb8cbca7d6cb6aa13e4d8d83d1103f6345db upstream.
There is a race condition between session setup and ksmbd_sessions_deregister. The session can be freed before the connection is added to channel list of session.
This patch check reference count of session before freeing it.
--- fs/smb/server/auth.c | 4 ++-- fs/smb/server/mgmt/user_session.c | 14 ++++++++------ fs/smb/server/smb2pdu.c | 7 ++++--- 3 files changed, 14 insertions(+), 11 deletions(-)
fs/smb/server/auth.c +2 -2
@@ -1016,9 +1016,9 @@ static int ksmbd_get_encryption_key(stru ses_enc_key = enc ? sess->smb3encryptionkey : sess->smb3decryptionkey; -if (enc) -ksmbd_user_session_get (sess);memcpy (key, ses_enc_key,SMB3_ENC_DEC_KEY_SIZE ); +if (!enc) +ksmbd_user_session_put (sess);return 0 ; }
fs/smb/server/mgmt/user_session.c +8 -6
@@ -181,7 +181,7 @@ static void ksmbd_expire_session(structdown_write (&sessions_table_lock);down_write (&conn->session_lock);xa_for_each (&conn->sessions, id, sess) { -if (atomic_read (&sess->refcnt) ==0 && +if (atomic_read (&sess->refcnt) <=1 && (sess->state !=SMB2_SESSION_VALID ||time_after (jiffies, sess->last_active +SMB2_SESSION_TIMEOUT ))) {
@@ -233,7 +233,8 @@ void ksmbd_sessions_deregister(struct ksdown_write (&conn->session_lock);xa_erase (&conn->sessions, sess->id);up_write (&conn->session_lock); -ksmbd_session_destroy (sess); +if (atomic_dec_and_test (&sess->refcnt)) +ksmbd_session_destroy (sess); } } }
@@ -252,7 +253,8 @@ void ksmbd_sessions_deregister(struct ksif (xa_empty (&sess->ksmbd_chann_list)) {xa_erase (&conn->sessions, sess->id);hash_del (&sess->hlist); -ksmbd_session_destroy (sess); +if (atomic_dec_and_test (&sess->refcnt)) +ksmbd_session_destroy (sess); } }up_write (&conn->session_lock);
@@ -328,8 +330,8 @@ void ksmbd_user_session_put(struct ksmbdif (atomic_read (&sess->refcnt) <=0 )WARN_ON (1 ); -else -atomic_dec (&sess->refcnt); +else if (atomic_dec_and_test (&sess->refcnt)) +ksmbd_session_destroy (sess); } struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn,
@@ -436,7 +438,7 @@ static struct ksmbd_session *__session_cxa_init (&sess->rpc_handle_list); sess->sequence_number =1 ;rwlock_init (&sess->tree_conns_lock); -atomic_set (&sess->refcnt,1 ); +atomic_set (&sess->refcnt,2 ); ret =__init_smb2_session (sess);if (ret)
fs/smb/server/smb2pdu.c +4 -3
@@ -2234,13 +2234,14 @@ int smb2_session_logoff(struct ksmbd_worreturn -ENOENT ; } -ksmbd_destroy_file_table (&sess->file_table);down_write (&conn->session_lock); sess->state =SMB2_SESSION_EXPIRED ;up_write (&conn->session_lock); -ksmbd_free_user (sess->user); - sess->user =NULL ; +if (sess->user) { +ksmbd_free_user (sess->user); + sess->user =NULL ; + }ksmbd_all_conn_set_status (sess_id,KSMBD_SESS_NEED_NEGOTIATE ); rsp->StructureSize =cpu_to_le16 (4 );
Greg Kroah-Hartman
maintainerPATCH 470/499 ksmbd: fix overflow in dacloffset bounds check
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <[email protected]>
commit beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42 upstream.
The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smb_check_perm_dacl() and smb_inherit_dacl().
This could result in out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer.
This patch converts dacloffset to unsigned int and uses check_add_overflow() to validate access to the DACL.
--- fs/smb/server/smbacl.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
fs/smb/server/smbacl.c +12 -4
@@ -1026,7 +1026,9 @@ int smb_inherit_dacl(struct ksmbd_conn *struct dentry *parent = path->dentry->d_parent;struct mnt_idmap *idmap =mnt_idmap (path->mnt);int inherited_flags =0 , flags =0 , i, nt_size =0 , pdacl_size; -int rc =0 , dacloffset, pntsd_type, pntsd_size, acl_len, aces_size; +int rc =0 , pntsd_type, pntsd_size, acl_len, aces_size; +unsigned int dacloffset; +size_t dacl_struct_end;u16 num_aces, ace_cnt =0 ;char *aces_base;bool is_dir =S_ISDIR (d_inode (path->dentry)->i_mode);
@@ -1035,8 +1037,11 @@ int smb_inherit_dacl(struct ksmbd_conn * parent, &parent_pntsd);if (pntsd_size <=0 )return -ENOENT ; + dacloffset =le32_to_cpu (parent_pntsd->dacloffset); -if (!dacloffset || (dacloffset +sizeof (struct smb_acl ) > pntsd_size)) { +if (!dacloffset || +check_add_overflow (dacloffset,sizeof (struct smb_acl ), &dacl_struct_end) || + dacl_struct_end > (size_t )pntsd_size) { rc = -EINVAL ; goto free_parent_pntsd; }
@@ -1240,7 +1245,9 @@ int smb_check_perm_dacl(struct ksmbd_construct smb_ntsd *pntsd =NULL ;struct smb_acl *pdacl;struct posix_acl *posix_acls; -int rc =0 , pntsd_size, acl_size, aces_size, pdacl_size, dacl_offset; +int rc =0 , pntsd_size, acl_size, aces_size, pdacl_size; +unsigned int dacl_offset; +size_t dacl_struct_end;struct smb_sid sid;int granted =le32_to_cpu (*pdaccess & ~FILE_MAXIMAL_ACCESS_LE );struct smb_ace *ace;
@@ -1259,7 +1266,8 @@ int smb_check_perm_dacl(struct ksmbd_con dacl_offset =le32_to_cpu (pntsd->dacloffset);if (!dacl_offset || - (dacl_offset +sizeof (struct smb_acl ) > pntsd_size)) +check_add_overflow (dacl_offset,sizeof (struct smb_acl ), &dacl_struct_end) || + dacl_struct_end > (size_t )pntsd_size) goto err_out; pdacl = (struct smb_acl *)((char *)pntsd +le32_to_cpu (pntsd->dacloffset));
Greg Kroah-Hartman
maintainerPATCH 471/499 ksmbd: validate zero num_subauth before sub_auth is accessed
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <[email protected]>
commit bf21e29d78cd2c2371023953d9c82dfef82ebb36 upstream.
Access psid->sub_auth[psid->num_subauth - 1] without checking if num_subauth is non-zero leads to an out-of-bounds read. This patch adds a validation step to ensure num_subauth != 0 before sub_auth is accessed.
--- fs/smb/server/smbacl.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/smb/server/smbacl.c +5 -0
@@ -270,6 +270,11 @@ static int sid_to_id(struct mnt_idmap *ireturn -EIO ; } +if (psid->num_subauth ==0 ) { +pr_err ("%s: zero subauthorities!\n" , __func__); +return -EIO ; + } +if (sidtype ==SIDOWNER ) {kuid_t uid;uid_t id;
Greg Kroah-Hartman
maintainerPATCH 472/499 ksmbd: fix null pointer dereference in alloc_preauth_hash()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
commit c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780 upstream.
The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated.
This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete.
--- fs/smb/server/connection.h | 11 +++++++++++ fs/smb/server/mgmt/user_session.c | 4 ++-- fs/smb/server/smb2pdu.c | 14 +++++++++++--- 3 files changed, 24 insertions(+), 5 deletions(-)
fs/smb/server/connection.h +11 -0
@@ -27,6 +27,7 @@ enum {KSMBD_SESS_EXITING ,KSMBD_SESS_NEED_RECONNECT ,KSMBD_SESS_NEED_NEGOTIATE , +KSMBD_SESS_NEED_SETUP , KSMBD_SESS_RELEASING };
@@ -187,6 +188,11 @@ static inline bool ksmbd_conn_need_negotreturn READ_ONCE (conn->status) ==KSMBD_SESS_NEED_NEGOTIATE ; } +static inline bool ksmbd_conn_need_setup (struct ksmbd_conn *conn) +{ +return READ_ONCE (conn->status) ==KSMBD_SESS_NEED_SETUP ; +} +static inline bool ksmbd_conn_need_reconnect (struct ksmbd_conn *conn) {return READ_ONCE (conn->status) ==KSMBD_SESS_NEED_RECONNECT ;
@@ -217,6 +223,11 @@ static inline void ksmbd_conn_set_need_nWRITE_ONCE (conn->status,KSMBD_SESS_NEED_NEGOTIATE ); } +static inline void ksmbd_conn_set_need_setup (struct ksmbd_conn *conn) +{ +WRITE_ONCE (conn->status,KSMBD_SESS_NEED_SETUP ); +} +static inline void ksmbd_conn_set_need_reconnect (struct ksmbd_conn *conn) {WRITE_ONCE (conn->status,KSMBD_SESS_NEED_RECONNECT );
fs/smb/server/mgmt/user_session.c +2 -2
@@ -374,13 +374,13 @@ void destroy_previous_session(struct ksmksmbd_all_conn_set_status (id,KSMBD_SESS_NEED_RECONNECT ); err =ksmbd_conn_wait_idle_sess_id (conn, id);if (err) { -ksmbd_all_conn_set_status (id,KSMBD_SESS_NEED_NEGOTIATE ); +ksmbd_all_conn_set_status (id,KSMBD_SESS_NEED_SETUP ); goto out; }ksmbd_destroy_file_table (&prev_sess->file_table); prev_sess->state =SMB2_SESSION_EXPIRED ; -ksmbd_all_conn_set_status (id,KSMBD_SESS_NEED_NEGOTIATE ); +ksmbd_all_conn_set_status (id,KSMBD_SESS_NEED_SETUP );ksmbd_launch_ksmbd_durable_scavenger (); out:up_write (&conn->session_lock);
fs/smb/server/smb2pdu.c +11 -3
@@ -1248,7 +1248,7 @@ int smb2_handle_negotiate(struct ksmbd_w } conn->srv_sec_mode =le16_to_cpu (rsp->SecurityMode); -ksmbd_conn_set_need_negotiate (conn); +ksmbd_conn_set_need_setup (conn); err_out:ksmbd_conn_unlock (conn);
@@ -1270,6 +1270,9 @@ static int alloc_preauth_hash(struct ksmif (sess->Preauth_HashValue)return 0 ; +if (!conn->preauth_info) +return -ENOMEM ; + sess->Preauth_HashValue =kmemdup (conn->preauth_info->Preauth_HashValue,PREAUTH_HASHVALUE_SIZE ,KSMBD_DEFAULT_GFP );if (!sess->Preauth_HashValue)
@@ -1673,6 +1676,11 @@ int smb2_sess_setup(struct ksmbd_work *wksmbd_debug (SMB ,"Received smb2 session setup request\n" ); +if (!ksmbd_conn_need_setup (conn) && !ksmbd_conn_good (conn)) { + work->send_no_response =1 ; +return rc; + } +WORK_BUFFERS (work, req, rsp); rsp->StructureSize =cpu_to_le16 (9 );
@@ -1908,7 +1916,7 @@ out_err:if (try_delay) {ksmbd_conn_set_need_reconnect (conn);ssleep (5 ); -ksmbd_conn_set_need_negotiate (conn); +ksmbd_conn_set_need_setup (conn); } }smb2_set_err_rsp (work);
@@ -2242,7 +2250,7 @@ int smb2_session_logoff(struct ksmbd_worksmbd_free_user (sess->user); sess->user =NULL ; } -ksmbd_all_conn_set_status (sess_id,KSMBD_SESS_NEED_NEGOTIATE ); +ksmbd_all_conn_set_status (sess_id,KSMBD_SESS_NEED_SETUP ); rsp->StructureSize =cpu_to_le16 (4 ); err =ksmbd_iov_pin_rsp (work, rsp,sizeof (struct smb2_logoff_rsp ));
Greg Kroah-Hartman
maintainerPATCH 473/499 exfat: fix random stack corruption after get_block
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungjong Seo <[email protected]>
commit 1bb7ff4204b6d4927e982cd256286c09ed4fd8ca upstream.
When get_block is called with a buffer_head allocated on the stack, such as do_mpage_readpage, stack corruption due to buffer_head UAF may occur in the following race condition situation.
<CPU 0> <CPU 1>mpage_read_folio
<<bh on stack>>
do_mpage_readpage
exfat_get_block
bh_read
__bh_read
get_bh(bh)
submit_bh
wait_on_buffer
...
end_buffer_read_sync
__end_buffer_read_notouch
unlock_buffer
<<keep going>>
...
...
... ...
<<bh is not valid out of mpage_read_folio>>
.
.another_function
<<variable A on stack>>
put_bh(bh)
atomic_dec(bh->b_count)* stack corruption here *
This patch returns -EAGAIN if a folio does not have buffers when bh_read needs to be called. By doing this, the caller can fallback to functions like block_read_full_folio(), create a buffer_head in the folio, and then call get_block again.
Let's do not call bh_read() with on-stack buffer_head.
--- fs/exfat/inode.c | 39 +++++++++++++++++++++++++++++++++------ 1 file changed, 33 insertions(+), 6 deletions(-)
fs/exfat/inode.c +33 -6
@@ -344,7 +344,8 @@ static int exfat_get_block(struct inode* The block has been partially written, * zero the unwritten part and map the block. */ -loff_t size, off, pos; +loff_t size, pos; +void *addr; max_blocks =1 ;
@@ -355,17 +356,41 @@ static int exfat_get_block(struct inodeif (!bh_result->b_folio) goto done; +/* +* No buffer_head is allocated. +* (1) bmap: It's enough to fill bh_result without I/O. +* (2) read: The unwritten part should be filled with 0 +* If a folio does not have any buffers, +* let's returns -EAGAIN to fallback to +* per-bh IO like block_read_full_folio(). +*/ +if (!folio_buffers (bh_result->b_folio)) { + err = -EAGAIN ; + goto done; + } + pos =EXFAT_BLK_TO_B (iblock, sb); size = ei->valid_size - pos; - off = pos & (PAGE_SIZE -1 ); + addr =folio_address (bh_result->b_folio) + +offset_in_folio (bh_result->b_folio, pos); -folio_set_bh (bh_result, bh_result->b_folio, off); +/* Check if bh->b_data points to proper addr in folio */ +if (bh_result->b_data != addr) { +exfat_fs_error_ratelimit (sb, +"b_data(%p) != folio_addr(%p)" , + bh_result->b_data, addr); + err = -EINVAL ; + goto done; + } + +/* Read a block */ err =bh_read (bh_result,0 );if (err <0 ) - goto unlock_ret; + goto done; -folio_zero_segment (bh_result->b_folio, off + size, - off + sb->s_blocksize); +/* Zero unwritten part of a block */ +memset (bh_result->b_data + size,0 , + bh_result->b_size - size); }else {/* * The range has not been written, clear the mapped flag
@@ -376,6 +401,8 @@ static int exfat_get_block(struct inode } done: bh_result->b_size =EXFAT_BLK_TO_B (max_blocks, sb); +if (err <0 ) +clear_buffer_mapped (bh_result); unlock_ret:mutex_unlock (&sbi->s_lock);return err;
Greg Kroah-Hartman
maintainerPATCH 474/499 exfat: fix potential wrong error return from get_block
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungjong Seo <[email protected]>
commit 59c30e31425833385e6644ad33151420e37eabe1 upstream.
If there is no error, get_block() should return 0. However, when bh_read() returns 1, get_block() also returns 1 in the same manner.
Let's set err to 0, if there is no error from bh_read()
--- fs/exfat/inode.c | 2 ++ 1 file changed, 2 insertions(+)
fs/exfat/inode.c +2 -0
@@ -391,6 +391,8 @@ static int exfat_get_block(struct inode/* Zero unwritten part of a block */ memset (bh_result->b_data + size,0 , bh_result->b_size - size); + + err =0 ; }else {/* * The range has not been written, clear the mapped flag
Greg Kroah-Hartman
maintainerPATCH 475/499 tracing: Fix use-after-free in print_graph_function_flags during tracer switching
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <[email protected]>
commit 7f81f27b1093e4895e87b74143c59c055c3b1906 upstream.
Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script:
$ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer
The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show():
* One through 'iter->trace->print_line()';
* Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns.
Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags.
Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'.
To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers.
[1] https://lore.kernel.org/all/[email protected]/
--- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 -- kernel/trace/trace_sched_wakeup.c | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-)
kernel/trace/trace_functions_graph.c +1 -0
@@ -1511,6 +1511,7 @@ void graph_trace_close(struct trace_iterif (data) {free_percpu (data->cpu_data);kfree (data); + iter->private =NULL ; } }
kernel/trace/trace_irqsoff.c +0 -2
@@ -247,8 +247,6 @@ static void irqsoff_trace_open(struct tr {if (is_graph (iter->tr))graph_trace_open (iter); -else - iter->private =NULL ; }static void irqsoff_trace_close (struct trace_iterator *iter)
kernel/trace/trace_sched_wakeup.c +0 -2
@@ -184,8 +184,6 @@ static void wakeup_trace_open(struct tra {if (is_graph (iter->tr))graph_trace_open (iter); -else - iter->private =NULL ; }static void wakeup_trace_close (struct trace_iterator *iter)
Greg Kroah-Hartman
maintainerPATCH 476/499 tracing: Ensure module defining synth event cannot be unloaded while tracing
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Raillard <[email protected]>
commit 21581dd4e7ff6c07d0ab577e3c32b13a74b31522 upstream.
Currently, using synth_event_delete() will fail if the event is being used (tracing in progress), but that is normally done in the module exit function. At that stage, failing is problematic as returning a non-zero status means the module will become locked (impossible to unload or reload again).
Instead, ensure the module exit function does not get called in the first place by increasing the module refcnt when the event is enabled.
--- kernel/trace/trace_events_synth.c | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-)
kernel/trace/trace_events_synth.c +29 -1
@@ -859,6 +859,34 @@ static struct trace_event_fields synth_e {} }; +static int synth_event_reg (struct trace_event_call *call, +enum trace_reg type,void *data) +{ + struct synth_event *event = container_of(call, struct synth_event, call); + +switch (type) { +case TRACE_REG_REGISTER : +case TRACE_REG_PERF_REGISTER : +if (!try_module_get (event->mod)) +return -EBUSY ; +break ; +default : +break ; + } + +int ret =trace_event_reg (call, type, data); + +switch (type) { +case TRACE_REG_UNREGISTER : +case TRACE_REG_PERF_UNREGISTER : +module_put (event->mod); +break ; +default : +break ; + } +return ret; +} +static int register_synth_event (struct synth_event *event) {struct trace_event_call *call = &event->call;
@@ -888,7 +916,7 @@ static int register_synth_event(struct s goto out; } call->flags =TRACE_EVENT_FL_TRACEPOINT ; - call->class->reg = trace_event_reg; + call->class->reg = synth_event_reg; call->class->probe = trace_event_raw_event_synth; call->data = event; call->tp = event->tp;
Greg Kroah-Hartman
maintainerPATCH 477/499 tracing: Fix synth event printk format for str fields
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Raillard <[email protected]>
commit 4d38328eb442dc06aec4350fd9594ffa6488af02 upstream.
The printk format for synth event uses "%.*s" to print string fields, but then only passes the pointer part as var arg.
Replace %.*s with %s as the C string is guaranteed to be null-terminated.
The output in print fmt should never have been updated as __get_str() handles the string limit because it can access the length of the string in the string meta data that is saved in the ring buffer.
--- kernel/trace/trace_events_synth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_events_synth.c +1 -1
@@ -312,7 +312,7 @@ static const char *synth_field_fmt(charelse if (strcmp (type,"gfp_t" ) ==0 ) fmt ="%x" ;else if (synth_field_is_string (type)) - fmt ="%.*s" ; + fmt ="%s" ;else if (synth_field_is_stack (type)) fmt ="%s" ;
Greg Kroah-Hartman
maintainerPATCH 478/499 tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ran Xiaokai <[email protected]>
commit 7e6b3fcc9c5294aeafed0dbe1a09a1bc899bd0f2 upstream.
Lockdep reports this deadlock log:
osnoise: could not start sampling thread
============================================
WARNING: possible recursive locking detected
--------------------------------------------
CPU0
---- lock(cpu_hotplug_lock);
lock(cpu_hotplug_lock);
Call Trace: <TASK> print_deadlock_bug+0x282/0x3c0 __lock_acquire+0x1610/0x29a0 lock_acquire+0xcb/0x2d0 cpus_read_lock+0x49/0x120 stop_per_cpu_kthreads+0x7/0x60 start_kthread+0x103/0x120 osnoise_hotplug_workfn+0x5e/0x90 process_one_work+0x44f/0xb30 worker_thread+0x33e/0x5e0 kthread+0x206/0x3b0 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x11/0x20 </TASK>
This is the deadlock scenario:osnoise_hotplug_workfn()
guard(cpus_read_lock)(); // first lock call
start_kthread(cpu)
if (IS_ERR(kthread)) {
stop_per_cpu_kthreads(); {
cpus_read_lock(); // second lock call. Cause the AA deadlock
}
}It is not necessary to call stop_per_cpu_kthreads() which stops osnoise kthread for every other CPUs in the system if a failure occurs during hotplug of a certain CPU.
For start_per_cpu_kthreads(), if the start_kthread() call fails, this function calls stop_per_cpu_kthreads() to handle the error. Therefore, similarly, there is no need to call stop_per_cpu_kthreads() again within start_kthread().
So just remove stop_per_cpu_kthreads() from start_kthread to solve this issue.
--- kernel/trace/trace_osnoise.c | 1 - 1 file changed, 1 deletion(-)
kernel/trace/trace_osnoise.c +0 -1
@@ -2032,7 +2032,6 @@ static int start_kthread(unsigned int cpif (IS_ERR (kthread)) {pr_err (BANNER "could not start sampling thread\n" ); -stop_per_cpu_kthreads ();return -ENOMEM ; }
Greg Kroah-Hartman
maintainerPATCH 479/499 tracing: Verify event formats that have "%*p.."
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <[email protected]>
commit ea8d7647f9ddf1f81e2027ed305299797299aa03 upstream.
The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when the event triggered and that same data is freed before the event is read, then the kernel can crash by reading freed memory.
The verifier runs at boot up (or module load) and scans the print formats of the events and checks their arguments to make sure that dereferenced pointers are safe. If the format uses "%*p.." the verifier will ignore it, and that could be dangerous. Cover this case as well.
Also add to the sample code a use case of "%*pbl".
--- kernel/trace/trace_events.c | 7 +++++++ samples/trace_events/trace-events-sample.h | 8 ++++++-- 2 files changed, 13 insertions(+), 2 deletions(-)
kernel/trace/trace_events.c +7 -0
@@ -470,6 +470,7 @@ static void test_event_printk(struct tracase '%' :continue ;case 'p' : + do_pointer:/* Find dereferencing fields */ switch (fmt[i +1 ]) {case 'B' :case 'R' :case 'r' :
@@ -498,6 +499,12 @@ static void test_event_printk(struct tracontinue ;if (fmt[i + j] =='*' ) { star = true; +/* Handle %*pbl case */ +if (!j && fmt[i +1 ] =='p' ) { + arg++; + i++; + goto do_pointer; + }continue ; }if ((fmt[i + j] =='s' )) {
samples/trace_events/trace-events-sample.h +6 -2
@@ -319,7 +319,8 @@ TRACE_EVENT(foo_bar,__assign_cpumask (cpum,cpumask_bits (mask)); ), - TP_printk("foo %s %d %s %s %s %s %s %s (%s) (%s) %s", __entry->foo, __entry->bar, + TP_printk("foo %s %d %s %s %s %s %s %s (%s) (%s) %s [%d] %*pbl", + __entry->foo, __entry->bar,/* * Notice here the use of some helper functions. This includes:
@@ -370,7 +371,10 @@ TRACE_EVENT(foo_bar,__get_str (str),__get_str (lstr),__get_bitmask (cpus),__get_cpumask (cpum), - __get_str(vstr)) +__get_str (vstr), +__get_dynamic_array_len (cpus), +__get_dynamic_array_len (cpus), + __get_dynamic_array(cpus)) );/*
Greg Kroah-Hartman
maintainerPATCH 480/499 mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
commit 8977752c8056a6a094a279004a49722da15bace3 upstream.
Patch series "mm: fixes for device-exclusive entries (hmm)", v2.
Discussing the PageTail() call in make_device_exclusive_range() with Willy, I recently discovered [1] that device-exclusive handling does not properly work with THP, making the hmm-tests selftests fail if THPs are enabled on the system.
Looking into more details, I found that hugetlb is not properly fenced, and I realized that something that was bugging me for longer -- how device-exclusive entries interact with mapcounts -- completely breaks migration/swapout/split/hwpoison handling of these folios while they have device-exclusive PTEs.
The program below can be used to allocate 1 GiB worth of pages and making them device-exclusive on a kernel with CONFIG_TEST_HMM.
Once they are device-exclusive, these folios cannot get swapped out (proc$pid/smaps_rollup will always indicate 1 GiB RSS no matter how much one forces memory reclaim), and when having a memory block onlined to ZONE_MOVABLE, trying to offline it will loop forever and complain about failed migration of a page that should be movable.
# echo offline > /sys/devices/system/memory/memory136/state # echo online_movable > /sys/devices/system/memory/memory136/state # ./hmm-swap & ... wait until everything is device-exclusive # echo offline > /sys/devices/system/memory/memory136/state [ 285.193431][T14882] page: refcount:2 mapcount:0 mapping:0000000000000000 index:0x7f20671f7 pfn:0x442b6a [ 285.196618][T14882] memcg:ffff888179298000 [ 285.198085][T14882] anon flags: 0x5fff0000002091c(referenced|uptodate| dirty|active|owner_2|swapbacked|node=1|zone=3|lastcpupid=0x7ff) [ 285.201734][T14882] raw: ... [ 285.204464][T14882] raw: ... [ 285.207196][T14882] page dumped because: migration failure [ 285.209072][T14882] page_owner tracks the page as allocated [ 285.210915][T14882] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), id 14926, tgid 14926 (hmm-swap), ts 254506295376, free_ts 227402023774 [ 285.216765][T14882] post_alloc_hook+0x197/0x1b0 [ 285.218874][T14882] get_page_from_freelist+0x76e/0x3280 [ 285.220864][T14882] __alloc_frozen_pages_noprof+0x38e/0x2740 [ 285.223302][T14882] alloc_pages_mpol+0x1fc/0x540 [ 285.225130][T14882] folio_alloc_mpol_noprof+0x36/0x340 [ 285.227222][T14882] vma_alloc_folio_noprof+0xee/0x1a0 [ 285.229074][T14882] __handle_mm_fault+0x2b38/0x56a0 [ 285.230822][T14882] handle_mm_fault+0x368/0x9f0 ...
This series fixes all issues I found so far. There is no easy way to fix without a bigger rework/cleanup. I have a bunch of cleanups on top (some previous sent, some the result of the discussion in v1) that I will send out separately once this landed and I get to it.
I wish we could just use some special present PROT_NONE PTEs instead of these (non-present, non-none) fake-swap entries; but that just results in the same problem we keep having (lack of spare PTE bits), and staring at other similar fake-swap entries, that ship has sailed.
With this series, make_device_exclusive() doesn't actually belong into mm/rmap.c anymore, but I'll leave moving that for another day.
I only tested this series with the hmm-tests selftests due to lack of HW, so I'd appreciate some testing, especially if the interaction between two GPUs wanting a device-exclusive entry works as expected.
<program>
#include <stdio.h>
#include <fcntl.h>
#include <stdint.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/ioctl.h>
#include <linux/types.h>
#include <linux/ioctl.h>
#define HMM_DMIRROR_EXCLUSIVE _IOWR('H', 0x05, struct hmm_dmirror_cmd)
struct hmm_dmirror_cmd {
__u64 addr;
__u64 ptr;
__u64 npages;
__u64 cpages;
__u64 faults;
};const size_t size = 1 * 1024 * 1024 * 1024ul;
const size_t chunk_size = 2 * 1024 * 1024ul;
int main(void)
{
struct hmm_dmirror_cmd cmd;
size_t cur_size;
int fd, ret;
char *addr, *mirror;
fd = open("/dev/hmm_dmirror1", O_RDWR, 0);
if (fd < 0) {
perror("open failed\n");
exit(1);
}
addr = mmap(NULL, size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (addr == MAP_FAILED) {
perror("mmap failed\n");
exit(1);
}
madvise(addr, size, MADV_NOHUGEPAGE);
memset(addr, 1, size);
mirror = malloc(chunk_size);
for (cur_size = 0; cur_size < size; cur_size += chunk_size) {
cmd.addr = (uintptr_t)addr + cur_size;
cmd.ptr = (uintptr_t)mirror;
cmd.npages = chunk_size / getpagesize();
ret = ioctl(fd, HMM_DMIRROR_EXCLUSIVE, &cmd);
if (ret) {
perror("ioctl failed\n");
exit(1);
}
}
pause();
return 0;
}</program>
[1] https://lkml.kernel.org/r/[email protected]
This patch (of 17):
We only have two FOLL_SPLIT_PMD users. While uprobe refuses hugetlb early, make_device_exclusive_range() can end up getting called on hugetlb VMAs.
Right now, this means that with a PMD-sized hugetlb page, we can end up calling split_huge_pmd(), because pmd_trans_huge() also succeeds with hugetlb PMDs.
For example, using a modified hmm-test selftest one can trigger:
[ 207.017134][T14945] ------------[ cut here ]------------ [ 207.018614][T14945] kernel BUG at mm/page_table_check.c:87! [ 207.019716][T14945] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 207.021072][T14945] CPU: 3 UID: 0 PID: ... [ 207.023036][T14945] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 [ 207.024834][T14945] RIP: 0010:page_table_check_clear.part.0+0x488/0x510 [ 207.026128][T14945] Code: ... [ 207.029965][T14945] RSP: 0018:ffffc9000cb8f348 EFLAGS: 00010293 [ 207.031139][T14945] RAX: 0000000000000000 RBX: 00000000ffffffff RCX: ffffffff8249a0cd [ 207.032649][T14945] RDX: ffff88811e883c80 RSI: ffffffff8249a357 RDI: ffff88811e883c80 [ 207.034183][T14945] RBP: ffff888105c0a050 R08: 0000000000000005 R09: 0000000000000000 [ 207.035688][T14945] R10: 00000000ffffffff R11: 0000000000000003 R12: 0000000000000001 [ 207.037203][T14945] R13: 0000000000000200 R14: 0000000000000001 R15: dffffc0000000000 [ 207.038711][T14945] FS: 00007f2783275740(0000) GS:ffff8881f4980000(0000) knlGS:0000000000000000 [ 207.040407][T14945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 207.041660][T14945] CR2: 00007f2782c00000 CR3: 0000000132356000 CR4: 0000000000750ef0 [ 207.043196][T14945] PKRU: 55555554 [ 207.043880][T14945] Call Trace: [ 207.044506][T14945] <TASK> [ 207.045086][T14945] ? __die+0x51/0x92 [ 207.045864][T14945] ? die+0x29/0x50 [ 207.046596][T14945] ? do_trap+0x250/0x320 [ 207.047430][T14945] ? do_error_trap+0xe7/0x220 [ 207.048346][T14945] ? page_table_check_clear.part.0+0x488/0x510 [ 207.049535][T14945] ? handle_invalid_op+0x34/0x40 [ 207.050494][T14945] ? page_table_check_clear.part.0+0x488/0x510 [ 207.051681][T14945] ? exc_invalid_op+0x2e/0x50 [ 207.052589][T14945] ? asm_exc_invalid_op+0x1a/0x20 [ 207.053596][T14945] ? page_table_check_clear.part.0+0x1fd/0x510 [ 207.054790][T14945] ? page_table_check_clear.part.0+0x487/0x510 [ 207.055993][T14945] ? page_table_check_clear.part.0+0x488/0x510 [ 207.057195][T14945] ? page_table_check_clear.part.0+0x487/0x510 [ 207.058384][T14945] __page_table_check_pmd_clear+0x34b/0x5a0 [ 207.059524][T14945] ? __pfx___page_table_check_pmd_clear+0x10/0x10 [ 207.060775][T14945] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 207.061940][T14945] ? __pfx___lock_acquire+0x10/0x10 [ 207.062967][T14945] pmdp_huge_clear_flush+0x279/0x360 [ 207.064024][T14945] split_huge_pmd_locked+0x82b/0x3750
...
Before commit 9cb28da54643 ("mm/gup: handle hugetlb in the generic follow_page_mask code"), we would have ignored the flag; instead, let's simply refuse the combination completely in check_vma_flags(): the caller is likely not prepared to handle any hugetlb folios.
We'll teach make_device_exclusive_range() separately to ignore any hugetlb folios as a future-proof safety net.
--- mm/gup.c | 3 +++ 1 file changed, 3 insertions(+)
mm/gup.c +3 -0
@@ -1283,6 +1283,9 @@ static int check_vma_flags(struct vm_areif ((gup_flags &FOLL_LONGTERM ) &&vma_is_fsdax (vma))return -EOPNOTSUPP ; +if ((gup_flags &FOLL_SPLIT_PMD ) &&is_vm_hugetlb_page (vma)) +return -EOPNOTSUPP ; +if (vma_is_secretmem (vma))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 481/499 arm64: Dont call NULL in do_compat_alignment_fixup()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Angelos Oikonomopoulos <[email protected]>
commit c28f31deeacda307acfee2f18c0ad904e5123aac upstream.
do_alignment_t32_to_handler() only fixes up alignment faults for specific instructions; it returns NULL otherwise (e.g. LDREX). When that's the case, signal to the caller that it needs to proceed with the regular alignment fault handling (i.e. SIGBUS). Without this patch, the kernel panics:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000086000006
EC = 0x21: IABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=00000800164aa000
[0000000000000000] pgd=0800081fdbd22003, p4d=0800081fdbd22003, pud=08000815d51c6003, pmd=0000000000000000
Internal error: Oops: 0000000086000006 [#1] SMP
Modules linked in: cfg80211 rfkill xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter veth nvme_fa>
libcrc32c crc32c_generic raid0 multipath linear dm_mod dax raid1 md_mod xhci_pci nvme xhci_hcd nvme_core t10_pi usbcore igb crc64_rocksoft crc64 crc_t10dif crct10dif_generic crct10dif_ce crct10dif_common usb_common i2c_algo_bit i2c>
CPU: 2 PID: 3932954 Comm: WPEWebProcess Not tainted 6.1.0-31-arm64 #1 Debian 6.1.128-1
Hardware name: GIGABYTE MP32-AR1-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021
pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : 0x0
lr : do_compat_alignment_fixup+0xd8/0x3dc
sp : ffff80000f973dd0
x29: ffff80000f973dd0 x28: ffff081b42526180 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
x23: 0000000000000004 x22: 0000000000000000 x21: 0000000000000001
x20: 00000000e8551f00 x19: ffff80000f973eb0 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffaebc949bc488
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000400000 x4 : 0000fffffffffffe x3 : 0000000000000000
x2 : ffff80000f973eb0 x1 : 00000000e8551f00 x0 : 0000000000000001
Call trace:
0x0
do_alignment_fault+0x40/0x50
do_mem_abort+0x4c/0xa0
el0_da+0x48/0xf0
el0t_32_sync_handler+0x110/0x140
el0t_32_sync+0x190/0x194
Code: bad PC value
---[ end trace 0000000000000000 ]------ arch/arm64/kernel/compat_alignment.c | 2 ++ 1 file changed, 2 insertions(+)
arch/arm64/kernel/compat_alignment.c +2 -0
@@ -368,6 +368,8 @@ int do_compat_alignment_fixup(unsigned lreturn 1 ; } +if (!handler) +return 1 ; type =handler (addr, instr, regs);if (type ==TYPE_ERROR || type ==TYPE_FAULT )
Greg Kroah-Hartman
maintainerPATCH 482/499 wifi: mt76: mt7921: fix kernel panic due to null pointer dereference
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Yen Hsieh <[email protected]>
commit adc3fd2a2277b7cc0b61692463771bf9bd298036 upstream.
Address a kernel panic caused by a null pointer dereference in the mt792x_rx_get_wcid function. The issue arises because the deflink structure is not properly initialized with the sta context. This patch ensures that the deflink structure is correctly linked to the sta context, preventing the null pointer dereference.
BUG: kernel NULL pointer dereference, address: 0000000000000400 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 UID: 0 PID: 470 Comm: mt76-usb-rx phy Not tainted 6.12.13-gentoo-dist #1 Hardware name: /AMD HUDSON-M1, BIOS 4.6.4 11/15/2011 RIP: 0010:mt792x_rx_get_wcid+0x48/0x140 [mt792x_lib] RSP: 0018:ffffa147c055fd98 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff8e9ecb652000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8e9ecb652000 RBP: 0000000000000685 R08: ffff8e9ec6570000 R09: 0000000000000000 R10: ffff8e9ecd2ca000 R11: ffff8e9f22a217c0 R12: 0000000038010119 R13: 0000000080843801 R14: ffff8e9ec6570000 R15: ffff8e9ecb652000 FS: 0000000000000000(0000) GS:ffff8e9f22a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000400 CR3: 000000000d2ea000 CR4: 00000000000006f0 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? mt792x_rx_get_wcid+0x48/0x140 [mt792x_lib] mt7921_queue_rx_skb+0x1c6/0xaa0 [mt7921_common] mt76u_alloc_queues+0x784/0x810 [mt76_usb] ? __pfx___mt76_worker_fn+0x10/0x10 [mt76] __mt76_worker_fn+0x4f/0x80 [mt76] kthread+0xd2/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]---
--- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mediatek/mt76/mt7921/main.c +1 -0
@@ -805,6 +805,7 @@ int mt7921_mac_sta_add(struct mt76_dev * msta->deflink.wcid.phy_idx = mvif->bss_conf.mt76.band_idx; msta->deflink.wcid.tx_info |=MT_WCID_TX_INFO_SET ; msta->deflink.last_txs = jiffies; + msta->deflink.sta = msta; ret =mt76_connac_pm_wake (&dev->mphy, &dev->pm);if (ret)
Greg Kroah-Hartman
maintainerPATCH 483/499 ext4: dont over-report free space or inodes in statvfs
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit f87d3af7419307ae26e705a2b2db36140db367a2 upstream.
This fixes an analogus bug that was fixed in xfs in commit 4b8d867ca6e2 ("xfs: don't over-report free space or inodes in statvfs") where statfs can report misleading / incorrect information where project quota is enabled, and the free space is less than the remaining quota.
This commit will resolve a test failure in generic/762 which tests for this bug.
--- fs/ext4/super.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
fs/ext4/super.c +17 -10
@@ -6828,22 +6828,29 @@ static int ext4_statfs_project(struct su dquot->dq_dqb.dqb_bhardlimit); limit >>= sb->s_blocksize_bits; -if (limit && buf->f_blocks > limit) { +if (limit) { +uint64_t remaining =0 ; + curblock = (dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace) >> sb->s_blocksize_bits; - buf->f_blocks = limit; - buf->f_bfree = buf->f_bavail = - (buf->f_blocks > curblock) ? - (buf->f_blocks - curblock) :0 ; +if (limit > curblock) + remaining = limit - curblock; + + buf->f_blocks =min (buf->f_blocks, limit); + buf->f_bfree =min (buf->f_bfree, remaining); + buf->f_bavail =min (buf->f_bavail, remaining); } limit =min_not_zero (dquot->dq_dqb.dqb_isoftlimit, dquot->dq_dqb.dqb_ihardlimit); -if (limit && buf->f_files > limit) { - buf->f_files = limit; - buf->f_ffree = - (buf->f_files > dquot->dq_dqb.dqb_curinodes) ? - (buf->f_files - dquot->dq_dqb.dqb_curinodes) :0 ; +if (limit) { +uint64_t remaining =0 ; + +if (limit > dquot->dq_dqb.dqb_curinodes) + remaining = limit - dquot->dq_dqb.dqb_curinodes; + + buf->f_files =min (buf->f_files, limit); + buf->f_ffree =min (buf->f_ffree, remaining); }spin_unlock (&dquot->dq_dqb_lock);
Greg Kroah-Hartman
maintainerPATCH 484/499 ext4: fix OOB read when checking dotdot dir
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Acs, Jakub <[email protected]>
commit d5e206778e96e8667d3bde695ad372c296dc9353 upstream.
Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when the corrupted directory is removed).
ext4_empty_dir() assumes every ext4 directory contains at least '.' and '..' as directory entries in the first data block. It first loads the '.' dir entry, performs sanity checks by calling ext4_check_dir_entry() and then uses its rec_len member to compute the location of '..' dir entry (in ext4_next_entry). It assumes the '..' dir entry fits into the same data block.
If the rec_len of '.' is precisely one block (4KB), it slips through the sanity checks (it is considered the last directory entry in the data block) and leaves "struct ext4_dir_entry_2 *de" point exactly past the memory slot allocated to the data block. The following call to ext4_check_dir_entry() on new value of de then dereferences this pointer which results in out-of-bounds mem access.
Fix this by extending __ext4_check_dir_entry() to check for '.' dir entries that reach the end of data block. Make sure to ignore the phony dir entries for checksum (by checking name_len for non-zero).
Note: This is reported by KASAN as use-after-free in case another structure was recently freed from the slot past the bound, but it is really an OOB read.
This issue was found by syzkaller tool.
Call Trace: [ 38.594108] BUG: KASAN: slab-use-after-free in __ext4_check_dir_entry+0x67e/0x710 [ 38.594649] Read of size 2 at addr ffff88802b41a004 by task syz-executor/5375 [ 38.595158] [ 38.595288] CPU: 0 UID: 0 PID: 5375 Comm: syz-executor Not tainted 6.14.0-rc7 #1 [ 38.595298] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 38.595304] Call Trace: [ 38.595308] <TASK> [ 38.595311] dump_stack_lvl+0xa7/0xd0 [ 38.595325] print_address_description.constprop.0+0x2c/0x3f0 [ 38.595339] ? __ext4_check_dir_entry+0x67e/0x710 [ 38.595349] print_report+0xaa/0x250 [ 38.595359] ? __ext4_check_dir_entry+0x67e/0x710 [ 38.595368] ? kasan_addr_to_slab+0x9/0x90 [ 38.595378] kasan_report+0xab/0xe0 [ 38.595389] ? __ext4_check_dir_entry+0x67e/0x710 [ 38.595400] __ext4_check_dir_entry+0x67e/0x710 [ 38.595410] ext4_empty_dir+0x465/0x990 [ 38.595421] ? __pfx_ext4_empty_dir+0x10/0x10 [ 38.595432] ext4_rmdir.part.0+0x29a/0xd10 [ 38.595441] ? __dquot_initialize+0x2a7/0xbf0 [ 38.595455] ? __pfx_ext4_rmdir.part.0+0x10/0x10 [ 38.595464] ? __pfx___dquot_initialize+0x10/0x10 [ 38.595478] ? down_write+0xdb/0x140 [ 38.595487] ? __pfx_down_write+0x10/0x10 [ 38.595497] ext4_rmdir+0xee/0x140 [ 38.595506] vfs_rmdir+0x209/0x670 [ 38.595517] ? lookup_one_qstr_excl+0x3b/0x190 [ 38.595529] do_rmdir+0x363/0x3c0 [ 38.595537] ? __pfx_do_rmdir+0x10/0x10 [ 38.595544] ? strncpy_from_user+0x1ff/0x2e0 [ 38.595561] __x64_sys_unlinkat+0xf0/0x130 [ 38.595570] do_syscall_64+0x5b/0x180 [ 38.595583] entry_SYSCALL_64_after_hwframe+0x76/0x7e
--- fs/ext4/dir.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ext4/dir.c +3 -0
@@ -104,6 +104,9 @@ int __ext4_check_dir_entry(const char *felse if (unlikely (le32_to_cpu (de->inode) >le32_to_cpu (EXT4_SB (dir->i_sb)->s_es->s_inodes_count))) error_msg ="inode out of bounds" ; +else if (unlikely (next_offset == size && de->name_len ==1 && + de->name[0 ] =='.' )) + error_msg ="'.' directory cannot be the last in data block" ;else return 0 ;
Greg Kroah-Hartman
maintainerPATCH 485/499 PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 667f053b05f00a007738cd7ed6fa1901de19dc7e upstream.
When BIOS neglects to assign bus numbers to PCI bridges, the kernel attempts to correct that during PCI device enumeration. If it runs out of bus numbers, no pci_bus is allocated and the "subordinate" pointer in the bridge's pci_dev remains NULL.
The PCIe bandwidth controller erroneously does not check for a NULL subordinate pointer and dereferences it on probe.
Bandwidth control of unusable devices below the bridge is of questionable utility, so simply error out instead. This mirrors what PCIe hotplug does since commit 62e4492c3063 ("PCI: Prevent NULL dereference during pciehp probe").
The PCI core emits a message with KERN_INFO severity if it has run out of bus numbers. PCIe hotplug emits an additional message with KERN_ERR severity to inform the user that hotplug functionality is disabled at the bridge. A similar message for bandwidth control does not seem merited, given that its only purpose so far is to expose an up-to-date link speed in sysfs and throttle the link speed on certain laptops with limited Thermal Design Power. So error out silently.
User-visible messages:
pci 0000:16:02.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[...]
pci_bus 0000:45: busn_res: [bus 45-74] end is updated to 74
pci 0000:16:02.0: devices behind bridge are unusable because [bus 45-74] cannot be assigned for them [...]
pcieport 0000:16:02.0: pciehp: Hotplug bridge without secondary bus, ignoring
[...]
BUG: kernel NULL pointer dereference RIP: pcie_update_link_speed pcie_bwnotif_enable pcie_bwnotif_probe pcie_port_probe_service really_probe
--- drivers/pci/pcie/bwctrl.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pci/pcie/bwctrl.c +4 -0
@@ -294,6 +294,10 @@ static int pcie_bwnotif_probe(struct pcistruct pci_dev *port = srv->port;int ret; +/* Can happen if we run out of bus numbers during enumeration. */ +if (!port->subordinate) +return -ENODEV ; +struct pcie_bwctrl_data *data =devm_kzalloc (&srv->device,sizeof (*data),GFP_KERNEL );if (!data)
Greg Kroah-Hartman
maintainerPATCH 486/499 jfs: fix slab-out-of-bounds read in ea_get()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qasim Ijaz <[email protected]>
commit fdf480da5837c23b146c4743c18de97202fcab37 upstream.
During the "size_check" label in ea_get(), the code checks if the extended attribute list (xattr) size matches ea_size. If not, it logs "ea_get: invalid extended attribute" and calls print_hex_dump().
Here, EALIST_SIZE(ea_buf->xattr) returns 4110417968, which exceeds INT_MAX (2,147,483,647). Then ea_size is clamped:
int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr));
Although clamp_t aims to bound ea_size between 0 and 4110417968, the upper limit is treated as an int, causing an overflow above 2^31 - 1. This leads "size" to wrap around and become negative (-184549328).
The "size" is then passed to print_hex_dump() (called "len" in print_hex_dump()), it is passed as type size_t (an unsigned type), this is then stored inside a variable called "int remaining", which is then assigned to "int linelen" which is then passed to hex_dump_to_buffer(). In print_hex_dump() the for loop, iterates through 0 to len-1, where len is 18446744073525002176, calling hex_dump_to_buffer() on each iteration:
for (i = 0; i < len; i += rowsize) {
linelen = min(remaining, rowsize);
remaining -= rowsize;
hex_dump_to_buffer(ptr + i, linelen, rowsize, groupsize,
linebuf, sizeof(linebuf), ascii);
...
}The expected stopping condition (i < len) is effectively broken since len is corrupted and very large. This eventually leads to the "ptr+i" being passed to hex_dump_to_buffer() to get closer to the end of the actual bounds of "ptr", eventually an out of bounds access is done in hex_dump_to_buffer() in the following for loop:
for (j = 0; j < len; j++) {
if (linebuflen < lx + 2)
goto overflow2;
ch = ptr[j];
...
}To fix this we should validate "EALIST_SIZE(ea_buf->xattr)" before it is utilised.
--- fs/jfs/xattr.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/jfs/xattr.c +9 -4
@@ -559,11 +559,16 @@ static int ea_get(struct inode *inode, s size_check:if (EALIST_SIZE (ea_buf->xattr) != ea_size) { -int size =clamp_t (int, ea_size,0 ,EALIST_SIZE (ea_buf->xattr)); +if (unlikely (EALIST_SIZE (ea_buf->xattr) >INT_MAX )) { +printk (KERN_ERR "ea_get: extended attribute size too large: %u > INT_MAX\n" , +EALIST_SIZE (ea_buf->xattr)); + }else { +int size =clamp_t (int, ea_size,0 ,EALIST_SIZE (ea_buf->xattr)); -printk (KERN_ERR "ea_get: invalid extended attribute\n" ); -print_hex_dump (KERN_ERR ,"" ,DUMP_PREFIX_ADDRESS ,16 ,1 , - ea_buf->xattr, size,1 ); +printk (KERN_ERR "ea_get: invalid extended attribute\n" ); +print_hex_dump (KERN_ERR ,"" ,DUMP_PREFIX_ADDRESS ,16 ,1 , + ea_buf->xattr, size,1 ); + }ea_release (inode, ea_buf); rc = -EIO ; goto clean_up;
Greg Kroah-Hartman
maintainerPATCH 487/499 jfs: add index corruption check to DT_GETPAGE()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Smirnov <[email protected]>
commit a8dfb2168906944ea61acfc87846b816eeab882d upstream.
If the file system is corrupted, the header.stblindex variable may become greater than 127. Because of this, an array access out of bounds may occur:
------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:3096:10 index 237 is out of range for type 'struct dtslot[128]' CPU: 0 UID: 0 PID: 5822 Comm: syz-executor740 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_out_of_bounds+0x121/0x150 lib/ubsan.c:429 dtReadFirst+0x622/0xc50 fs/jfs/jfs_dtree.c:3096 dtReadNext fs/jfs/jfs_dtree.c:3147 [inline] jfs_readdir+0x9aa/0x3c50 fs/jfs/jfs_dtree.c:2862 wrap_directory_iterator+0x91/0xd0 fs/readdir.c:65 iterate_dir+0x571/0x800 fs/readdir.c:108 __do_sys_getdents64 fs/readdir.c:403 [inline] __se_sys_getdents64+0x1e2/0x4b0 fs/readdir.c:389 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> ---[ end trace ]---
Add a stblindex check for corruption.
--- fs/jfs/jfs_dtree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/jfs/jfs_dtree.c +2 -1
@@ -117,7 +117,8 @@ do { \if (!(RC )) { \if (((P )->header.nextindex > \ (((BN ) ==0 ) ?DTROOTMAXSLOT : (P )->header.maxslot)) || \ - ((BN ) && ((P )->header.maxslot >DTPAGEMAXSLOT ))) { \ + ((BN ) && (((P )->header.maxslot >DTPAGEMAXSLOT ) || \ + ((P )->header.stblindex >=DTPAGEMAXSLOT )))) { \BT_PUTPAGE (MP ); \jfs_error ((IP )->i_sb, \"DT_GETPAGE: dtree page corrupt\n" ); \
Greg Kroah-Hartman
maintainerPATCH 488/499 mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yosry Ahmed <[email protected]>
commit c11bcbc0a517acf69282c8225059b2a8ac5fe628 upstream.
Currently, zswap_cpu_comp_dead() calls crypto_free_acomp() while holding the per-CPU acomp_ctx mutex. crypto_free_acomp() then holds scomp_lock (through crypto_exit_scomp_ops_async()).
On the other hand, crypto_alloc_acomp_node() holds the scomp_lock (through crypto_scomp_init_tfm()), and then allocates memory. If the allocation results in reclaim, we may attempt to hold the per-CPU acomp_ctx mutex.
The above dependencies can cause an ABBA deadlock. For example in the following scenario:
(1) Task A running on CPU #1:
crypto_alloc_acomp_node()
Holds scomp_lock
Enters reclaim
Reads per_cpu_ptr(pool->acomp_ctx, 1)(2) Task A is descheduled
(3) CPU #1 goes offline
zswap_cpu_comp_dead(CPU #1)
Holds per_cpu_ptr(pool->acomp_ctx, 1))
Calls crypto_free_acomp()
Waits for scomp_lock(4) Task A running on CPU #2:
Waits for per_cpu_ptr(pool->acomp_ctx, 1) // Read on CPU #1
DEADLOCKSince there is no requirement to call crypto_free_acomp() with the per-CPU acomp_ctx mutex held in zswap_cpu_comp_dead(), move it after the mutex is unlocked. Also move the acomp_request_free() and kfree() calls for consistency and to avoid any potential sublte locking dependencies in the future.
With this, only setting acomp_ctx fields to NULL occurs with the mutex held. This is similar to how zswap_cpu_comp_prepare() only initializes acomp_ctx fields with the mutex held, after performing all allocations before holding the mutex.
Opportunistically, move the NULL check on acomp_ctx so that it takes place before the mutex dereference.
--- mm/zswap.c | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-)
mm/zswap.c +22 -8
@@ -881,18 +881,32 @@ static int zswap_cpu_comp_dead(unsigned { struct zswap_pool *pool = hlist_entry(node, struct zswap_pool, node);struct crypto_acomp_ctx *acomp_ctx =per_cpu_ptr (pool->acomp_ctx, cpu); +struct acomp_req *req; +struct crypto_acomp *acomp; +u8 *buffer; + +if (IS_ERR_OR_NULL (acomp_ctx)) +return 0 ;mutex_lock (&acomp_ctx->mutex); -if (!IS_ERR_OR_NULL (acomp_ctx)) { -if (!IS_ERR_OR_NULL (acomp_ctx->req)) -acomp_request_free (acomp_ctx->req); - acomp_ctx->req =NULL ; -if (!IS_ERR_OR_NULL (acomp_ctx->acomp)) -crypto_free_acomp (acomp_ctx->acomp); -kfree (acomp_ctx->buffer); - } + req = acomp_ctx->req; + acomp = acomp_ctx->acomp; + buffer = acomp_ctx->buffer; + acomp_ctx->req =NULL ; + acomp_ctx->acomp =NULL ; + acomp_ctx->buffer =NULL ;mutex_unlock (&acomp_ctx->mutex); +/* +* Do the actual freeing after releasing the mutex to avoid subtle +* locking dependencies causing deadlocks. +*/ +if (!IS_ERR_OR_NULL (req)) +acomp_request_free (req); +if (!IS_ERR_OR_NULL (acomp)) +crypto_free_acomp (acomp); +kfree (buffer); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 489/499 exec: fix the racy usage of fs_struct->in_exec
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <[email protected]>
commit af7bb0d2ca459f15cb5ca604dab5d9af103643f0 upstream.
check_unsafe_exec() sets fs->in_exec under cred_guard_mutex, then execve() paths clear fs->in_exec lockless. This is fine if exec succeeds, but if it fails we have the following race:
T1 sets fs->in_exec = 1, fails, drops cred_guard_mutex T2 sets fs->in_exec = 1 T1 clears fs->in_exec T2 continues with fs->in_exec == 0
Change fs/exec.c to clear fs->in_exec with cred_guard_mutex held.
--- fs/exec.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
fs/exec.c +9 -6
@@ -1236,13 +1236,12 @@ int begin_new_exec(struct linux_binprm **/ bprm->point_of_no_return = true; -/* -* Make this the only thread in the thread group. -*/ +/* Make this the only thread in the thread group */ retval =de_thread (me);if (retval) goto out; - +/* see the comment in check_unsafe_exec() */ + current->fs->in_exec =0 ;/* * Cancel any io_uring activity across execve */
@@ -1504,6 +1503,8 @@ static void free_bprm(struct linux_binpr }free_arg_pages (bprm);if (bprm->cred) { +/* in case exec fails before de_thread() succeeds */ + current->fs->in_exec =0 ;mutex_unlock (¤t->signal->cred_guard_mutex);abort_creds (bprm->cred); }
@@ -1610,6 +1611,10 @@ static void check_unsafe_exec(struct lin* suid exec because the differently privileged task * will be able to manipulate the current directory, etc. * It would be nice to force an unshare instead... +* +* Otherwise we set fs->in_exec = 1 to deny clone(CLONE_FS) +* from another sub-thread until de_thread() succeeds, this +* state is protected by cred_guard_mutex we hold. */ n_fs =1 ;spin_lock (&p->fs->lock);
@@ -1868,7 +1873,6 @@ static int bprm_execve(struct linux_binpsched_mm_cid_after_execve (current);/* execve succeeded */ - current->fs->in_exec =0 ; current->in_execve =0 ;rseq_execve (current);user_events_execve (current);
@@ -1887,7 +1891,6 @@ out:force_fatal_sig (SIGSEGV );sched_mm_cid_after_execve (current); - current->fs->in_exec =0 ; current->in_execve =0 ;return retval;
Greg Kroah-Hartman
maintainerPATCH 490/499 media: vimc: skip .s_stream() for stopped entities
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 36cef585e2a31e4ddf33a004b0584a7a572246de upstream.
Syzbot reported [1] a warning prompted by a check in call_s_stream() that checks whether .s_stream() operation is warranted for unstarted or stopped subdevs.
Add a simple fix in vimc_streamer_pipeline_terminate() ensuring that entities skip a call to .s_stream() unless they have been previously properly started.
[1] Syzbot report:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 5933 at drivers/media/v4l2-core/v4l2-subdev.c:460 call_s_stream+0x2df/0x350 drivers/media/v4l2-core/v4l2-subdev.c:460 Modules linked in: CPU: 0 UID: 0 PID: 5933 Comm: syz-executor330 Not tainted 6.13.0-rc2-syzkaller-00362-g2d8308bf5b67 #0 ... Call Trace: <TASK> vimc_streamer_pipeline_terminate+0x218/0x320 drivers/media/test-drivers/vimc/vimc-streamer.c:62 vimc_streamer_pipeline_init drivers/media/test-drivers/vimc/vimc-streamer.c:101 [inline] vimc_streamer_s_stream+0x650/0x9a0 drivers/media/test-drivers/vimc/vimc-streamer.c:203 vimc_capture_start_streaming+0xa1/0x130 drivers/media/test-drivers/vimc/vimc-capture.c:256 vb2_start_streaming+0x15f/0x5a0 drivers/media/common/videobuf2/videobuf2-core.c:1789 vb2_core_streamon+0x2a7/0x450 drivers/media/common/videobuf2/videobuf2-core.c:2348 vb2_streamon drivers/media/common/videobuf2/videobuf2-v4l2.c:875 [inline] vb2_ioctl_streamon+0xf4/0x170 drivers/media/common/videobuf2/videobuf2-v4l2.c:1118 __video_do_ioctl+0xaf0/0xf00 drivers/media/v4l2-core/v4l2-ioctl.c:3122 video_usercopy+0x4d2/0x1620 drivers/media/v4l2-core/v4l2-ioctl.c:3463 v4l2_ioctl+0x1ba/0x250 drivers/media/v4l2-core/v4l2-dev.c:366 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2b85c01b19
...
--- drivers/media/test-drivers/vimc/vimc-streamer.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/media/test-drivers/vimc/vimc-streamer.c +6 -0
@@ -59,6 +59,12 @@ static void vimc_streamer_pipeline_termicontinue ; sd =media_entity_to_v4l2_subdev (ved->ent); +/* +* Do not call .s_stream() to stop an already +* stopped/unstarted subdev. +*/ +if (!v4l2_subdev_is_streaming (sd)) +continue ;v4l2_subdev_call (sd, video, s_stream,0 ); } }
Greg Kroah-Hartman
maintainerPATCH 491/499 media: streamzap: fix race between device disconnection and urb callback
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <[email protected]>
commit f656cfbc7a293a039d6a0c7100e1c846845148c1 upstream.
Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even though it is checked for NULL in the same function, which means there is a race condition. It occurs due to the incorrect order of actions in the streamzap_disconnect() function:rc_unregister_device() is called before usb_kill_urb(). The dev->raw pointer is freed and set to NULL in rc_unregister_device(), and only after that usb_kill_urb() waits for in-progress requests to finish.
If rc_unregister_device() is called while streamzap_callback() handler is not finished, this can lead to accessing freed resources. Thus rc_unregister_device() should be called after usb_kill_urb().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/media/rc/streamzap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/streamzap.c +1 -1
@@ -385,8 +385,8 @@ static void streamzap_disconnect(structif (!sz)return ; -rc_unregister_device (sz->rdev);usb_kill_urb (sz->urb_in); +rc_unregister_device (sz->rdev);usb_free_urb (sz->urb_in);usb_free_coherent (usbdev, sz->buf_in_len, sz->buf_in, sz->dma_in);
Greg Kroah-Hartman
maintainerPATCH 492/499 nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <[email protected]>
commit d1bc15b147d35b4cb7ca99a9a7d79d41ca342c13 upstream.
The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then tries to use the deleg stateid and expects to see NFS4ERR_DELEG_REVOKED, but it gets bad NFS4ERR_BAD_STATEID instead.
When a delegation is revoked, it's initially marked with SC_STATUS_REVOKED, or SC_STATUS_ADMIN_REVOKED and later, it's marked with the SC_STATUS_FREEABLE flag, which denotes that it is waiting for s FREE_STATEID call.
nfs4_lookup_stateid() accepts a statusmask that includes the status flags that a found stateid is allowed to have. Currently, that mask never includes SC_STATUS_FREEABLE, which means that revoked delegations are (almost) never found.
Add SC_STATUS_FREEABLE to the always-allowed status flags, and remove it from nfsd4_delegreturn() since it's now always implied.
--- fs/nfsd/nfs4state.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/nfsd/nfs4state.c +2 -4
@@ -6902,7 +6902,7 @@ nfsd4_lookup_stateid(struct nfsd4_compou*/ statusmask |=SC_STATUS_REVOKED ; - statusmask |=SC_STATUS_ADMIN_REVOKED ; + statusmask |=SC_STATUS_ADMIN_REVOKED |SC_STATUS_FREEABLE ;if (ZERO_STATEID (stateid) ||ONE_STATEID (stateid) ||CLOSE_STATEID (stateid))
@@ -7557,9 +7557,7 @@ nfsd4_delegreturn(struct svc_rqst *rqstpif ((status =fh_verify (rqstp, &cstate->current_fh,S_IFREG ,0 )))return status; - status =nfsd4_lookup_stateid (cstate, stateid,SC_TYPE_DELEG , -SC_STATUS_REVOKED |SC_STATUS_FREEABLE , - &s, nn); + status =nfsd4_lookup_stateid (cstate, stateid,SC_TYPE_DELEG ,SC_STATUS_REVOKED , &s, nn);if (status) goto out; dp =delegstateid (s);
Greg Kroah-Hartman
maintainerPATCH 493/499 nfsd: put dl_stid if fail to queue dl_recall
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
commit 230ca758453c63bd38e4d9f4a21db698f7abada8 upstream.
Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we increment the reference count of dl_stid.
We expect that after the corresponding work_struct is processed, the reference count of dl_stid will be decremented through the callback function nfsd4_cb_recall_release.
However, if the call to nfsd4_run_cb fails, the incremented reference count of dl_stid will not be decremented correspondingly, leading to the following nfs4_stid leak:
unreferenced object 0xffff88812067b578 (size 344):
comm "nfsd", pid 2761, jiffies 4295044002 (age 5541.241s) hex dump (first 32 bytes):
01 00 00 00 6b 6b 6b 6b b8 02 c0 e2 81 88 ff ff ....kkkk........
00 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 ad 4e ad de .kkkkkkk.....N..
backtrace:
kmem_cache_alloc+0x4b9/0x700
nfsd4_process_open1+0x34/0x300
nfsd4_open+0x2d1/0x9d0
nfsd4_proc_compound+0x7a2/0xe30
nfsd_dispatch+0x241/0x3e0
svc_process_common+0x5d3/0xcc0
svc_process+0x2a3/0x320
nfsd+0x180/0x2e0
kthread+0x199/0x1d0
ret_from_fork+0x30/0x50
ret_from_fork_asm+0x1b/0x30
unreferenced object 0xffff8881499f4d28 (size 368):
comm "nfsd", pid 2761, jiffies 4295044005 (age 5541.239s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 30 4d 9f 49 81 88 ff ff ........0M.I....
30 4d 9f 49 81 88 ff ff 20 00 00 00 01 00 00 00 0M.I.... .......
backtrace:
kmem_cache_alloc+0x4b9/0x700
nfs4_alloc_stid+0x29/0x210
alloc_init_deleg+0x92/0x2e0
nfs4_set_delegation+0x284/0xc00
nfs4_open_delegation+0x216/0x3f0
nfsd4_process_open2+0x2b3/0xee0
nfsd4_open+0x770/0x9d0
nfsd4_proc_compound+0x7a2/0xe30
nfsd_dispatch+0x241/0x3e0
svc_process_common+0x5d3/0xcc0
svc_process+0x2a3/0x320
nfsd+0x180/0x2e0
kthread+0x199/0x1d0
ret_from_fork+0x30/0x50
ret_from_fork_asm+0x1b/0x30Fix it by checking the result of nfsd4_run_cb and call nfs4_put_stid if fail to queue dl_recall.
--- fs/nfsd/nfs4state.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/nfsd/nfs4state.c +11 -1
@@ -1050,6 +1050,12 @@ static struct nfs4_ol_stateid * nfs4_allreturn openlockstateid (stid); } +/* +* As the sc_free callback of deleg, this may be called by nfs4_put_stid +* in nfsd_break_one_deleg. +* Considering nfsd_break_one_deleg is called with the flc->flc_lock held, +* this function mustn't ever sleep. +*/ static void nfs4_free_deleg (struct nfs4_stid *stid) {struct nfs4_delegation *dp =delegstateid (stid);
@@ -5290,6 +5296,7 @@ static const struct nfsd4_callback_ops nstatic void nfsd_break_one_deleg (struct nfs4_delegation *dp) { +bool queued;/* * We're assuming the state code never drops its reference * without first removing the lease. Since we're in this lease
@@ -5298,7 +5305,10 @@ static void nfsd_break_one_deleg(struct* we know it's safe to take a reference. */ refcount_inc (&dp->dl_stid.sc_count); -WARN_ON_ONCE (!nfsd4_run_cb (&dp->dl_recall)); + queued =nfsd4_run_cb (&dp->dl_recall); +WARN_ON_ONCE (!queued); +if (!queued) +nfs4_put_stid (&dp->dl_stid); }/* Called from break_lease() with flc_lock held. */
Greg Kroah-Hartman
maintainerPATCH 494/499 nfsd: fix management of listener transports
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
commit d093c90892607be505e801469d6674459e69ab89 upstream.
Currently, when no active threads are running, a root user using nfsdctl command can try to remove a particular listener from the list of previously added ones, then start the server by increasing the number of threads, it leads to the following problem:
[ 158.835354] refcount_t: addition on 0; use-after-free. [ 158.835603] WARNING: CPU: 2 PID: 9145 at lib/refcount.c:25 refcount_warn_saturate+0x160/0x1a0 [ 158.836017] Modules linked in: rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd auth_rpcgss nfs_acl lockd grace overlay isofs uinput snd_seq_dummy snd_hrtimer nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 rfkill ip_set nf_tables qrtr sunrpc vfat fat uvcvideo videobuf2_vmalloc videobuf2_memops uvc videobuf2_v4l2 videodev videobuf2_common snd_hda_codec_generic mc e1000e snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore sg loop dm_multipath dm_mod nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs libcrc32c crct10dif_ce ghash_ce vmwgfx sha2_ce sha256_arm64 sr_mod sha1_ce cdrom nvme drm_client_lib drm_ttm_helper ttm nvme_core drm_kms_helper nvme_auth drm fuse [ 158.840093] CPU: 2 UID: 0 PID: 9145 Comm: nfsd Kdump: loaded Tainted: G B W 6.13.0-rc6+ #7 [ 158.840624] Tainted: [B]=BAD_PAGE, [W]=WARN [ 158.840802] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 158.841220] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 158.841563] pc : refcount_warn_saturate+0x160/0x1a0 [ 158.841780] lr : refcount_warn_saturate+0x160/0x1a0 [ 158.842000] sp : ffff800089be7d80 [ 158.842147] x29: ffff800089be7d80 x28: ffff00008e68c148 x27: ffff00008e68c148 [ 158.842492] x26: ffff0002e3b5c000 x25: ffff600011cd1829 x24: ffff00008653c010 [ 158.842832] x23: ffff00008653c000 x22: 1fffe00011cd1829 x21: ffff00008653c028 [ 158.843175] x20: 0000000000000002 x19: ffff00008653c010 x18: 0000000000000000 [ 158.843505] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 158.843836] x14: 0000000000000000 x13: 0000000000000001 x12: ffff600050a26493 [ 158.844143] x11: 1fffe00050a26492 x10: ffff600050a26492 x9 : dfff800000000000 [ 158.844475] x8 : 00009fffaf5d9b6e x7 : ffff000285132493 x6 : 0000000000000001 [ 158.844823] x5 : ffff000285132490 x4 : ffff600050a26493 x3 : ffff8000805e72bc [ 158.845174] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000098588000 [ 158.845528] Call trace: [ 158.845658] refcount_warn_saturate+0x160/0x1a0 (P) [ 158.845894] svc_recv+0x58c/0x680 [sunrpc] [ 158.846183] nfsd+0x1fc/0x348 [nfsd] [ 158.846390] kthread+0x274/0x2f8 [ 158.846546] ret_from_fork+0x10/0x20 [ 158.846714] ---[ end trace 0000000000000000 ]---
nfsd_nl_listener_set_doit() would manipulate the list of transports of server's sv_permsocks and close the specified listener but the other list of transports (server's sp_xprts list) would not be changed leading to the problem above.
Instead, determined if the nfsdctl is trying to remove a listener, in which case, delete all the existing listener transports and re-create all-but-the-removed ones.
--- fs/nfsd/nfsctl.c | 44 +++++++++++++++++++++----------------------- 1 file changed, 21 insertions(+), 23 deletions(-)
fs/nfsd/nfsctl.c +21 -23
@@ -1959,6 +1959,7 @@ int nfsd_nl_listener_set_doit(struct sk_struct svc_serv *serv;LIST_HEAD (permsocks);struct nfsd_net *nn; +bool delete = false;int err, rem;mutex_lock (&nfsd_mutex);
@@ -2019,34 +2020,28 @@ int nfsd_nl_listener_set_doit(struct sk_ } } -/* For now, no removing old sockets while server is running */ -if (serv->sv_nrthreads && !list_empty (&permsocks)) { +/* +* If there are listener transports remaining on the permsocks list, +* it means we were asked to remove a listener. +*/ +if (!list_empty (&permsocks)) {list_splice_init (&permsocks, &serv->sv_permsocks); -spin_unlock_bh (&serv->sv_lock); - err = -EBUSY ; - goto out_unlock_mtx; + delete = true; } +spin_unlock_bh (&serv->sv_lock); -/* Close the remaining sockets on the permsocks list */ -while (!list_empty (&permsocks)) { - xprt = list_first_entry(&permsocks, struct svc_xprt, xpt_list); -list_move (&xprt->xpt_list, &serv->sv_permsocks); - -/* -* Newly-created sockets are born with the BUSY bit set. Clear -* it if there are no threads, since nothing can pick it up -* in that case. -*/ -if (!serv->sv_nrthreads) -clear_bit (XPT_BUSY , &xprt->xpt_flags); - -set_bit (XPT_CLOSE , &xprt->xpt_flags); -spin_unlock_bh (&serv->sv_lock); -svc_xprt_close (xprt); -spin_lock_bh (&serv->sv_lock); +/* Do not remove listeners while there are active threads. */ +if (serv->sv_nrthreads) { + err = -EBUSY ; + goto out_unlock_mtx; } -spin_unlock_bh (&serv->sv_lock); +/* +* Since we can't delete an arbitrary llist entry, destroy the +* remaining listeners and recreate the list. +*/ +if (delete) +svc_xprt_destroy_all (serv, net);/* walk list of addrs again, open any that still don't exist */ nlmsg_for_each_attr (attr, info->nlhdr,GENL_HDRLEN , rem) {
@@ -2073,6 +2068,9 @@ int nfsd_nl_listener_set_doit(struct sk_ xprt =svc_find_listener (serv, xcl_name, net, sa);if (xprt) { +if (delete) +WARN_ONCE (1 ,"Transport type=%s already exists\n" , + xcl_name);svc_xprt_put (xprt);continue ; }
Greg Kroah-Hartman
maintainerPATCH 495/499 NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit d7d8e3169b56e7696559a2427c922c0d55debcec upstream.
If fh_fill_pre_attrs() returns a non-zero status, the error flow takes it through out_unlock, which then overwrites the returned status code with
err = nfserrno(host_err);
--- fs/nfsd/vfs.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/nfsd/vfs.c +1 -3
@@ -2011,11 +2011,9 @@ out_nfserr:* error status. */ err = nfserr_file_open; - }else { - err =nfserrno (host_err); } out: -return err; +return err != nfs_ok ? err :nfserrno (host_err); out_unlock:inode_unlock (dirp); goto out_drop_write;
Greg Kroah-Hartman
maintainerPATCH 496/499 NFSD: Never return NFS4ERR_FILE_OPEN when removing a directory
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit 370345b4bd184a49ac68d6591801e5e3605b355a upstream.
RFC 8881 Section 18.25.4 paragraph 5 tells us that the server should return NFS4ERR_FILE_OPEN only if the target object is an opened file. This suggests that returning this status when removing a directory will confuse NFS clients.
This is a version-specific issue; nfsd_proc_remove/rmdir() and nfsd3_proc_remove/rmdir() already return nfserr_access as appropriate.
Unfortunately there is no quick way for nfsd4_remove() to determine whether the target object is a file or not, so the check is done in in nfsd_unlink() for now.
--- fs/nfsd/vfs.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
fs/nfsd/vfs.c +18 -6
@@ -1931,9 +1931,17 @@ out:return err; } -/* -* Unlink a file or directory -* N.B. After this call fhp needs an fh_put +/** +* nfsd_unlink - remove a directory entry +* @rqstp: RPC transaction context +* @fhp: the file handle of the parent directory to be modified +* @type: enforced file type of the object to be removed +* @fname: the name of directory entry to be removed +* @flen: length of @fname in octets +* +* After this call fhp needs an fh_put. +* +* Returns a generic NFS status code in network byte-order. */ __be32 nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
@@ -2007,10 +2015,14 @@ out_drop_write:fh_drop_write (fhp); out_nfserr:if (host_err == -EBUSY ) { -/* name is mounted-on. There is no perfect -* error status. +/* +* See RFC 8881 Section 18.25.4 para 4: NFSv4 REMOVE +* wants a status unique to the object type. */ - err = nfserr_file_open; +if (type !=S_IFDIR ) + err = nfserr_file_open; +else + err = nfserr_acces; } out:return err != nfs_ok ? err :nfserrno (host_err);
Greg Kroah-Hartman
maintainerPATCH 497/499 NFSD: Skip sending CB_RECALL_ANY when the backchannel isnt up
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <[email protected]>
commit 8a388c1fabeb6606e16467b23242416c0dbeffad upstream.
NFSD sends CB_RECALL_ANY to clients when the server is low on memory or that client has a large number of delegations outstanding.
We've seen cases where NFSD attempts to send CB_RECALL_ANY requests to disconnected clients, and gets confused. These calls never go anywhere if a backchannel transport to the target client isn't available. Before the server can send any backchannel operation, the client has to connect first and then do a BIND_CONN_TO_SESSION.
This patch doesn't address the root cause of the confusion, but there's no need to queue up these optional operations if they can't go anywhere.
--- fs/nfsd/nfs4state.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
fs/nfsd/nfs4state.c +12 -7
@@ -6721,14 +6721,19 @@ deleg_reaper(struct nfsd_net *nn)spin_lock (&nn->client_lock);list_for_each_safe (pos, next, &nn->client_lru) { clp = list_entry(pos, struct nfs4_client, cl_lru); -if (clp->cl_state !=NFSD4_ACTIVE || -list_empty (&clp->cl_delegations) || -atomic_read (&clp->cl_delegs_in_recall) || -test_bit (NFSD4_CLIENT_CB_RECALL_ANY , &clp->cl_flags) || - (ktime_get_boottime_seconds () - - clp->cl_ra_time <5 )) { + +if (clp->cl_state !=NFSD4_ACTIVE ) +continue ; +if (list_empty (&clp->cl_delegations)) +continue ; +if (atomic_read (&clp->cl_delegs_in_recall)) +continue ; +if (test_bit (NFSD4_CLIENT_CB_RECALL_ANY , &clp->cl_flags)) +continue ; +if (ktime_get_boottime_seconds () - clp->cl_ra_time <5 ) +continue ; +if (clp->cl_cb_state !=NFSD4_CB_UP )continue ; - }list_add (&clp->cl_ra_cblist, &cblist);/* release in nfsd4_cb_recall_any_release */
Greg Kroah-Hartman
maintainerPATCH 498/499 ASoC: cs42l43: convert to SYSTEM_SLEEP_PM_OPS
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 658fb7fe8e7f4014ea17a4da0e0c1d9bc319fa35 upstream.
The custom suspend function causes a build warning when CONFIG_PM_SLEEP is disabled:
sound/soc/codecs/cs42l43.c:2405:12: error: unused function 'cs42l43_codec_runtime_force_suspend' [-Werror,-Wunused-function]
Change SET_SYSTEM_SLEEP_PM_OPS() to the newer SYSTEM_SLEEP_PM_OPS(), to avoid this.
--- sound/soc/codecs/cs42l43.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/cs42l43.c +1 -1
@@ -2417,7 +2417,7 @@ static int cs42l43_codec_runtime_force_sstatic const struct dev_pm_ops cs42l43_codec_pm_ops = { RUNTIME_PM_OPS(NULL, cs42l43_codec_runtime_resume, NULL) -SET_SYSTEM_SLEEP_PM_OPS (cs42l43_codec_runtime_force_suspend, pm_runtime_force_resume) +SYSTEM_SLEEP_PM_OPS (cs42l43_codec_runtime_force_suspend, pm_runtime_force_resume) };static const struct platform_device_id cs42l43_codec_id_table[] = {
Greg Kroah-Hartman
maintainerPATCH 499/499 platform/x86/amd/pmf: fix cleanup in amd_pmf_init_smart_pc()
In reply to Greg Kroah-Hartman6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 5b1122fc4995f308b21d7cfc64ef9880ac834d20 upstream.
There are a few problems in this code:
First, if amd_pmf_tee_init() fails then the function returns directly instead of cleaning up. We cannot simply do a "goto error;" because the amd_pmf_tee_init() cleanup calls tee_shm_free(dev->fw_shm_pool); and amd_pmf_tee_deinit() calls it as well leading to a double free. I have re-written this code to use an unwind ladder to free the allocations.
Second, if amd_pmf_start_policy_engine() fails on every iteration though the loop then the code calls amd_pmf_tee_deinit() twice which is also a double free. Call amd_pmf_tee_deinit() inside the loop for each failed iteration. Also on that path the error codes are not necessarily negative kernel error codes. Set the error code to -EINVAL.
There is a very subtle third bug which is that if the call to input_register_device() in amd_pmf_register_input_device() fails then we call input_unregister_device() on an input device that wasn't registered. This will lead to a reference counting underflow because of the device_del(&dev->dev) in __input_unregister_device(). It's unlikely that anyone would ever hit this bug in real life.
--- drivers/platform/x86/amd/pmf/tee-if.c | 36 +++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-)
drivers/platform/x86/amd/pmf/tee-if.c +25 -11
@@ -510,18 +510,18 @@ int amd_pmf_init_smart_pc(struct amd_pmf ret =amd_pmf_set_dram_addr (dev, true);if (ret) - goto error; + goto err_cancel_work; dev->policy_base =devm_ioremap_resource (dev->dev, dev->res);if (IS_ERR (dev->policy_base)) { ret =PTR_ERR (dev->policy_base); - goto error; + goto err_free_dram_buf; } dev->policy_buf =kzalloc (dev->policy_sz,GFP_KERNEL );if (!dev->policy_buf) { ret = -ENOMEM ; - goto error; + goto err_free_dram_buf; }memcpy_fromio (dev->policy_buf, dev->policy_base, dev->policy_sz);
@@ -531,13 +531,13 @@ int amd_pmf_init_smart_pc(struct amd_pmf dev->prev_data =kzalloc (sizeof (*dev->prev_data),GFP_KERNEL );if (!dev->prev_data) { ret = -ENOMEM ; - goto error; + goto err_free_policy; }for (i =0 ; i <ARRAY_SIZE (amd_pmf_ta_uuid); i++) { ret =amd_pmf_tee_init (dev, &amd_pmf_ta_uuid[i]);if (ret) -return ret; + goto err_free_prev_data; ret =amd_pmf_start_policy_engine (dev);switch (ret) {
@@ -550,27 +550,41 @@ int amd_pmf_init_smart_pc(struct amd_pmf status = false;break ;default : - goto error; + ret = -EINVAL ; +amd_pmf_tee_deinit (dev); + goto err_free_prev_data; }if (status)break ; } -if (!status && !pb_side_load) - goto error; +if (!status && !pb_side_load) { + ret = -EINVAL ; + goto err_free_prev_data; + }if (pb_side_load)amd_pmf_open_pb (dev, dev->dbgfs_dir); ret =amd_pmf_register_input_device (dev);if (ret) - goto error; + goto err_pmf_remove_pb;return 0 ; -error: -amd_pmf_deinit_smart_pc (dev); +err_pmf_remove_pb: +if (pb_side_load && dev->esbin) +amd_pmf_remove_pb (dev); +amd_pmf_tee_deinit (dev); +err_free_prev_data: +kfree (dev->prev_data); +err_free_policy: +kfree (dev->policy_buf); +err_free_dram_buf: +kfree (dev->buf); +err_cancel_work: +cancel_delayed_work_sync (&dev->pb_work);return ret; }
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.13.11 release. There are 499 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Compiling for Fedora failed:
util/stat.c: In function ‘evsel__is_alias’:util/stat.c:565:16: error: implicit declaration of function ‘perf_pmu__name_no_suffix_match’ [-Wimplicit-function-declaration]
565 | return perf_pmu__name_no_suffix_match(evsel_a->pmu, evsel_b->pmu->name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~From a *very very* quick look I wonder if it might be due to this change, as it seems to depend on 63e287131cf0c5 ("perf pmu: Rename name matching for no suffix or wildcard variants") [v6.15-rc1]:
Quoted 2 lines
Ian Rogers <[email protected]>
perf stat: Don't merge counters purely on name
But as I said, it was just a very very quick look, so I might be totally off track there.
HTH, Ciao, Thorsten
Quoted 18 lines · Thorsten Leemhuis
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.13.11 release. There are 499 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Compiling for Fedora failed:
util/stat.c: In function ‘evsel__is_alias’:util/stat.c:565:16: error: implicit declaration of function ‘perf_pmu__name_no_suffix_match’ [-Wimplicit-function-declaration]565 | return perf_pmu__name_no_suffix_match(evsel_a->pmu, evsel_b->pmu->name); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~From a *very very* quick look I wonder if it might be due to this change, as it seems to depend on
63e287131cf0c5("perf pmu: Rename name matching for no suffix or wildcard variants") [v6.15-rc1]:
Quoted 5 lines
Quoted 2 lines
Ian Rogers <[email protected]>
perf stat: Don't merge counters purely on nameBut as I said, it was just a very very quick look, so I might be totally off track there.
Thanks Thorsten, I repeated the failure and reverting that patch fixes the build. Alternatively, cherry-picking:
``` commit 63e287131cf0c59b026053d6d63fe271604ffa7e Author: Ian Rogers <[email protected]> Date: Fri Jan 31 23:43:18 2025 -0800 perf pmu: Rename name matching for no suffix or wildcard variants Wildcard PMU naming will match a name like pmu_1 to a PMU name like pmu_10 but not to a PMU name like pmu_2 as the suffix forms part of the match. No suffix matching will match pmu_10 to either pmu_1 or pmu_2. Add or rename matching functions on PMU to make it clearer what kind of matching is being performed. Signed-off-by: Ian Rogers <[email protected]> Reviewed-by: Kan Liang <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Namhyung Kim <[email protected]> ```
Also fixes the build.
Thanks,
Ian
Quoted 1 line
HTH, Ciao, Thorsten
Greg Kroah-Hartman
maintainerQuoted 47 lines · Ian Rogers
Quoted 18 lines · Thorsten Leemhuis
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.13.11 release. There are 499 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Compiling for Fedora failed:
util/stat.c: In function ‘evsel__is_alias’:util/stat.c:565:16: error: implicit declaration of function ‘perf_pmu__name_no_suffix_match’ [-Wimplicit-function-declaration]565 | return perf_pmu__name_no_suffix_match(evsel_a->pmu, evsel_b->pmu->name); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~From a *very very* quick look I wonder if it might be due to this change, as it seems to depend on
63e287131cf0c5("perf pmu: Rename name matching for no suffix or wildcard variants") [v6.15-rc1]:Quoted 5 lines
Quoted 2 lines
Ian Rogers <[email protected]>
perf stat: Don't merge counters purely on nameBut as I said, it was just a very very quick look, so I might be totally off track there.
Thanks Thorsten, I repeated the failure and reverting that patch fixes the build. Alternatively, cherry-picking:
``` commit 63e287131cf0c59b026053d6d63fe271604ffa7e Author: Ian Rogers <[email protected]> Date: Fri Jan 31 23:43:18 2025 -0800 perf pmu: Rename name matching for no suffix or wildcard variants Wildcard PMU naming will match a name like pmu_1 to a PMU name like pmu_10 but not to a PMU name like pmu_2 as the suffix forms part of the match. No suffix matching will match pmu_10 to either pmu_1 or pmu_2. Add or rename matching functions on PMU to make it clearer what kind of matching is being performed. Signed-off-by: Ian Rogers <[email protected]> Reviewed-by: Kan Liang <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Namhyung Kim <[email protected]> ```
Quoted 1 line
Also fixes the build.
Now added to both queues, thanks.
greg k-h
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.13.11 release. There are 499 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
This fails to build an arm multi_v7_defconfig for me:
arm-linux-gnueabihf-ld:./arch/arm/kernel/vmlinux.lds:31: syntax error
and multi_v5_defconfig gives:
arm-linux-gnueabi-ld:./arch/arm/kernel/vmlinux.lds:30: syntax error
(presumably the same error)
Quoted 8 lines · Mark Brown
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.13.11 release. There are 499 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
This fails to build an arm
multi_v7_defconfigfor me:
Quoted 7 lines
arm-linux-gnueabihf-ld:./arch/arm/kernel/vmlinux.lds:31: syntax error
and
multi_v5_defconfiggives:arm-linux-gnueabi-ld:./arch/arm/kernel/vmlinux.lds:30: syntax error
(presumably the same error)
The prerequisite of commit c3d944a367c0 ("ARM: 9444/1: add KEEP() keyword to ARM_VECTORS") failed to apply to 6.12 and 6.13, I am about to sit down and send it out:
https://lore.kernel.org/2025040805-boaster-hazing-36c3@gregkh/
https://lore.kernel.org/2025040805-goal-richness-0c23@gregkh/
I don't really know how to make it clear that two separate patches need to be taken together.
Cheers,
Nathan
Greg Kroah-Hartman
maintainerQuoted 8 lines · Mark Brown
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.13.11 release. There are 499 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
This fails to build an arm
multi_v7_defconfigfor me:
Quoted 7 lines
arm-linux-gnueabihf-ld:./arch/arm/kernel/vmlinux.lds:31: syntax error
and
multi_v5_defconfiggives:arm-linux-gnueabi-ld:./arch/arm/kernel/vmlinux.lds:30: syntax error
(presumably the same error)
What is the error? "syntax error" feels odd. Any more hints? Any chance to bisect?
thanks,
greg k-h
Greg Kroah-Hartman
maintainerQuoted 11 lines · Greg Kroah-Hartman
Quoted 10 lines · Mark Brown
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.13.11 release. There are 499 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
This fails to build an arm
multi_v7_defconfigfor me:arm-linux-gnueabihf-ld:./arch/arm/kernel/vmlinux.lds:31: syntax error
Quoted 8 lines
Quoted 5 lines
and
multi_v5_defconfiggives:arm-linux-gnueabi-ld:./arch/arm/kernel/vmlinux.lds:30: syntax error
(presumably the same error)
What is the error? "syntax error" feels odd. Any more hints? Any chance to bisect?
Nevermind, got the fix now.
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.13.11 release. There are 499 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 10 Apr 2025 10:47:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.11-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.13.y
and the diffstat can be found below.thanks,
greg k-h
Regressions on arm multi_v5_defconfig and tinyconfig builds with clang-20 and gcc-13 on the stable-rc 6.13.
First seen on the 6.13.11-rc1
Bad: 6.13.11-rc1
Good: v6.13.10
* arm, build
- build/gcc-13-tinyconfig
- build/clang-20-tinyconfig
- build/clang-20-multi_v5_defconfig
Regression Analysis:
- New regression? Yes
- Reproducibility? Yes
Build regression: arm ld.lld vmlinux.lds section pattern is expected
## Build log
with clang-20
ld.lld: error: ./arch/arm/kernel/vmlinux.lds:33: section pattern is expected
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
__vectors_lma = .; OVERLAY 0xffff0000 : AT(__vectors_lma) { .vectors { OVERLAY_KEEP(*(.vectors)) } .vectors.bhb.loop8 { OVERLAY_KEEP(*(.vectors.bhb.loop8)) } .vectors.bhb.bpiall { OVERLAY_KEEP(*(.vectors.bhb.bpiall)) } } __vectors_start = LOADADDR(.vectors); __vectors_end = LOADADDR(.vectors) + SIZEOF(.vectors); __vectors_bhb_loop8_start = LOADADDR(.vectors.bhb.loop8); __vectors_bhb_loop8_end = LOADADDR(.vectors.bhb.loop8) + SIZEOF(.vectors.bhb.loop8); __vectors_bhb_bpiall_start = LOADADDR(.vectors.bhb.bpiall); __vectors_bhb_bpiall_end = LOADADDR(.vectors.bhb.bpiall) + SIZEOF(.vectors.bhb.bpiall); . = __vectors_lma + SIZEOF(.vectors) + SIZEOF(.vectors.bhb.loop8) + SIZEOF(.vectors.bhb.bpiall); __stubs_lma = .; .stubs ADDR(.vectors) + 0x1000 : AT(__stubs_lma) { *(.stubs) } __stubs_start = LOADADDR(.stubs); __stubs_end = LOADADDR(.stubs) + SIZEOF(.stubs); . = __stubs_lma + SIZEOF(.stubs); PROVIDE(vector_fiq_offset = vector_fiq - ADDR(.vectors)); ^
make[3]: *** [/builds/linux/scripts/Makefile.vmlinux:77: vmlinux] Error 1
and
With gcc-13 arm-linux-gnueabihf-ld:./arch/arm/kernel/vmlinux.lds:30: syntax error make[3]: *** [/builds/linux/scripts/Makefile.vmlinux:77: vmlinux] Error 1
## Source
* Kernel version: 6.13.11-rc1
* Git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* Git sha: f1209ffbc87a3003d66f47bd6f986d1a0d154a2f
* Git describe: v6.13.10-500-gf1209ffbc87a
* Project details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.13.y/build/v6.13.10-500-gf1209ffbc87a/
## Build
* Build log: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.13.y/build/v6.13.10-500-gf1209ffbc87a/testrun/27947363/suite/build/test/clang-20-tinyconfig/log
* Build details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.13.y/build/v6.13.10-500-gf1209ffbc87a/testrun/27947363/suite/build/test/clang-20-tinyconfig/details/
* Build history:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.13.y/build/v6.13.10-500-gf1209ffbc87a/testrun/27947363/suite/build/test/clang-20-tinyconfig/history/
* Build link: https://storage.tuxsuite.com/public/linaro/lkft/builds/2vRlYeE7ChBo7YMjumm63mifyB9/
* Kernel config:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2vRlYeE7ChBo7YMjumm63mifyB9/config
## Steps to reproduce
- tuxmake --runtime podman --target-arch arm --toolchain gcc-13
--kconfig tinyconfig
--
Linaro LKFT
https://lkft.linaro.org