4.14.233-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.14.233-rc1 review
This is the start of the stable review cycle for the 4.14.233 release. There are 323 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 22 May 2021 09:20:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.233-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.233-rc1
Eric Dumazet <[email protected]>
ipv6: remove extra dev_hold() for fallback tunnels
Christophe JAILLET <[email protected]>
xhci: Do not use GFP_KERNEL in (potentially) atomic context
Eric Dumazet <[email protected]>
ip6_tunnel: sit: proper dev_{hold|put} in ndo_[un]init methods
Eric Dumazet <[email protected]>
sit: proper dev_{hold|put} in ndo_[un]init methods
Tomas Melin <[email protected]>
serial: 8250: fix potential deadlock in rs485-mode
Zqiang <[email protected]>
lib: stackdepot: turn depot_lock spinlock to raw_spinlock
yangerkun <[email protected]>
block: reexpand iov_iter after read/write
Hui Wang <[email protected]>
ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP
Hans de Goede <[email protected]>
gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055
Jeff Layton <[email protected]>
ceph: fix fscache invalidation
Johannes Berg <[email protected]>
um: Mark all kernel symbols as local
Hans de Goede <[email protected]>
Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state
Hans de Goede <[email protected]>
Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices
Feilong Lin <[email protected]>
ACPI / hotplug / PCI: Fix reference count leak in enable_slot()
louis.wang <[email protected]>
ARM: 9066/1: ftrace: pause/unpause function graph tracer in cpu_suspend()
Arnd Bergmann <[email protected]>
PCI: thunder: Fix compile testing
Ard Biesheuvel <[email protected]>
ARM: 9058/1: cache-v7: refactor v7_invalidate_l1 to avoid clobbering r5/r6
Arnd Bergmann <[email protected]>
isdn: capi: fix mismatched prototypes
Kaixu Xia <[email protected]>
cxgb4: Fix the -Wmisleading-indentation warning
Arnd Bergmann <[email protected]>
usb: sl811-hcd: improve misleading indentation
Arnd Bergmann <[email protected]>
kgdb: fix gcc-11 warning on indentation
Arnd Bergmann <[email protected]>
x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes
Paweł Chmiel <[email protected]>
clk: exynos7: Mark aclk_fsys1_200 as critical
Jonathon Reinhart <[email protected]>
netfilter: conntrack: Make global sysctls readonly in non-init netns
Greg Kroah-Hartman <[email protected]>
kobject_uevent: remove warning in init_uevent_argv()
Andrew Boyer <[email protected]>
RDMA/i40iw: Avoid panic when reading back the IRQ affinity hint
Lukasz Luba <[email protected]>
thermal/core/fair share: Lock the thermal zone while looping over instances
Maciej W. Rozycki <[email protected]>
MIPS: Avoid handcoded DIVU in `__div64_32' altogether
Maciej W. Rozycki <[email protected]>
MIPS: Avoid DIVU in `__div64_32' is result would be zero
Maciej W. Rozycki <[email protected]>
MIPS: Reinstate platform `__div64_32' handler
Maciej W. Rozycki <[email protected]>
FDDI: defxx: Make MMIO the configuration default except for EISA
Thomas Gleixner <[email protected]>
KVM: x86: Cancel pvclock_gtod_work on module removal
Colin Ian King <[email protected]>
iio: tsl2583: Fix division by a zero lux_val
Dmitry Osipenko <[email protected]>
iio: gyro: mpu3050: Fix reported temperature value
Chunfeng Yun <[email protected]>
usb: core: hub: fix race condition about TRSMRCY of resume
Phil Elwell <[email protected]>
usb: dwc2: Fix gadget DMA unmap direction
Maximilian Luz <[email protected]>
usb: xhci: Increase timeout for HC halt
Marcel Hamer <[email protected]>
usb: dwc3: omap: improve extcon initialization
Bart Van Assche <[email protected]>
blk-mq: Swap two calls in blk_mq_exit_queue()
Christophe JAILLET <[email protected]>
ACPI: scan: Fix a memory leak in an error handling path
Christophe JAILLET <[email protected]>
usb: fotg210-hcd: Fix an error message
Dinghao Liu <[email protected]>
iio: proximity: pulsedlight: Fix rumtime PM imbalance on error
Kai-Heng Feng <[email protected]>
drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected
Axel Rasmussen <[email protected]>
userfaultfd: release page in error path to avoid BUG_ON
Phillip Lougher <[email protected]>
squashfs: fix divide error in calculate_skip()
Michael Ellerman <[email protected]>
powerpc/64s: Fix crashes when toggling entry flush barrier
Michael Ellerman <[email protected]>
powerpc/64s: Fix crashes when toggling stf barrier
Vineet Gupta <[email protected]>
ARC: entry: fix off-by-one error in syscall number validation
Eric Dumazet <[email protected]>
netfilter: nftables: avoid overflows in nft_hash_buckets()
Jia-Ju Bai <[email protected]>
kernel: kexec_file: fix error return code of kexec_calculate_store_digests()
Maciej Żenczykowski <[email protected]>
net: fix nla_strcmp to handle more then one trailing null character
Miaohe Lin <[email protected]>
ksm: fix potential missing rmap_item for stable_node
Miaohe Lin <[email protected]>
mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts()
Miaohe Lin <[email protected]>
khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate()
Kees Cook <[email protected]>
drm/radeon: Fix off-by-one power_state index heap overwrite
Xin Long <[email protected]>
sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
Nobuhiro Iwamatsu <[email protected]>
rtc: ds1307: Fix wday settings for rx8130
Olga Kornievskaia <[email protected]>
NFSv4.2 fix handling of sr_eof in SEEK's reply
Nikola Livic <[email protected]>
pNFS/flexfiles: fix incorrect size check in decode_nfs_fh()
Trond Myklebust <[email protected]>
NFS: Deal correctly with attribute generation counter overflow
Trond Myklebust <[email protected]>
NFSv4.2: Always flush out writes in nfs42_proc_fallocate()
Jia-Ju Bai <[email protected]>
rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()
Zhen Lei <[email protected]>
ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook
Dmitry Baryshkov <[email protected]>
PCI: Release OF node in pci_scan_device()'s error path
Colin Ian King <[email protected]>
f2fs: fix a redundant call to f2fs_balance_fs if an error occurs
David Ward <[email protected]>
ASoC: rt286: Make RT286_SET_GPIO_* readable and writable
Felix Fietkau <[email protected]>
net: ethernet: mtk_eth_soc: fix RX VLAN offload
Alexey Kardashevskiy <[email protected]>
powerpc/iommu: Annotate nested lock for lockdep
Gustavo A. R. Silva <[email protected]>
wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join
Gustavo A. R. Silva <[email protected]>
wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt
Michael Ellerman <[email protected]>
powerpc/pseries: Stop calling printk in rtas_stop_self()
Yaqi Chen <[email protected]>
samples/bpf: Fix broken tracex1 due to kprobe argument change
David Ward <[email protected]>
ASoC: rt286: Generalize support for ALC3263 codec
Srikar Dronamraju <[email protected]>
powerpc/smp: Set numa node before updating mask
Gustavo A. R. Silva <[email protected]>
sctp: Fix out-of-bounds warning in sctp_process_asconf_param()
Mihai Moldovan <[email protected]>
kconfig: nconf: stop endless search loops
Yonghong Song <[email protected]>
selftests: Set CC to clang in lib.mk if LLVM is set
Miklos Szeredi <[email protected]>
cuse: prevent clone
Krzysztof Kozlowski <[email protected]>
pinctrl: samsung: use 'int' for register masks in Exynos
Emmanuel Grumbach <[email protected]>
mac80211: clear the beacon's CRC after channel switch
Eric Dumazet <[email protected]>
ip6_vti: proper dev_{hold|put} in ndo_[un]init methods
Archie Pusaka <[email protected]>
Bluetooth: check for zapped sk before connecting
Tetsuo Handa <[email protected]>
Bluetooth: initialize skb_queue_head at l2cap_chan_create()
Archie Pusaka <[email protected]>
Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default
Tong Zhang <[email protected]>
ALSA: rme9652: don't disable if not enabled
Tong Zhang <[email protected]>
ALSA: hdspm: don't disable if not enabled
Tong Zhang <[email protected]>
ALSA: hdsp: don't disable if not enabled
Jonathan McDowell <[email protected]>
net: stmmac: Set FIFO sizes for ipq806x
Hoang Le <[email protected]>
tipc: convert dest node's address to network order
Alexander Aring <[email protected]>
fs: dlm: fix debugfs dump
Zhen Lei <[email protected]>
tpm: fix error return code in tpm2_get_cc_attrs_tbl()
Quentin Perret <[email protected]>
Revert "fdt: Properly handle "no-map" field in the memory region"
Quentin Perret <[email protected]>
Revert "of/fdt: Make sure no-map does not remove already reserved regions"
Xin Long <[email protected]>
sctp: delay auto_asconf init until binding the first addr
Xin Long <[email protected]>
Revert "net/sctp: fix race condition in sctp_destroy_sock"
Arnd Bergmann <[email protected]>
smp: Fix smp_call_function_single_async prototype
Dan Carpenter <[email protected]>
kfifo: fix ternary sign extension bugs
Lv Yunlong <[email protected]>
net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
Lv Yunlong <[email protected]>
net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
Christophe Leroy <[email protected]>
powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add')
Toke Høiland-Jørgensen <[email protected]>
ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
Colin Ian King <[email protected]>
net: davinci_emac: Fix incorrect masking of tx and rx error channel
Sindhu Devale <[email protected]>
RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
Stefano Garzarella <[email protected]>
vsock/vmci: log once the failed queue pair allocation
Lv Yunlong <[email protected]>
mwl8k: Fix a double Free in mwl8k_probe_hw
Sergey Shtylyov <[email protected]>
i2c: sh7760: fix IRQ error path
Ping-Ke Shih <[email protected]>
rtlwifi: 8821ae: upgrade PHY and RF parameters
Tyrel Datwyler <[email protected]>
powerpc/pseries: extract host bridge from pci_bus prior to bus removal
Ilya Lipnitskiy <[email protected]>
MIPS: pci-legacy: stop using of_pci_range_to_resource
Sergey Shtylyov <[email protected]>
i2c: sh7760: add IRQ check
Sergey Shtylyov <[email protected]>
i2c: jz4780: add IRQ check
Sergey Shtylyov <[email protected]>
i2c: emev2: add IRQ check
Sergey Shtylyov <[email protected]>
i2c: cadence: add IRQ check
Colin Ian King <[email protected]>
net: thunderx: Fix unintentional sign extension issue
Wang Wensheng <[email protected]>
IB/hfi1: Fix error return code in parse_platform_config()
Colin Ian King <[email protected]>
mt7601u: fix always true expression
Johannes Berg <[email protected]>
mac80211: bail out if cipher schemes are invalid
Randy Dunlap <[email protected]>
powerpc: iommu: fix build when neither PCI or IBMVIO is set
Athira Rajeev <[email protected]>
powerpc/perf: Fix PMU constraint check for EBB events
Colin Ian King <[email protected]>
liquidio: Fix unintented sign extension of a left shift of a u16
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls
Dan Carpenter <[email protected]>
nfc: pn533: prevent potential memory corruption
Andrew Scull <[email protected]>
bug: Remove redundant condition check in report_bug
Jia Zhou <[email protected]>
ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
Chen Huang <[email protected]>
powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration
Nathan Chancellor <[email protected]>
powerpc/prom: Mark identical_pvr_fixup as __init
Xie He <[email protected]>
net: lapbether: Prevent racing when checking whether the netif is running
Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars
Maxim Mikityanskiy <[email protected]>
HID: plantronics: Workaround for double volume key presses
Nathan Chancellor <[email protected]>
x86/events/amd/iommu: Fix sysfs type mismatch
Dan Carpenter <[email protected]>
HSI: core: fix resource leaks in hsi_add_client_from_dt()
Fabrice Gasnier <[email protected]>
mfd: stm32-timers: Avoid clearing auto reload register
Sergey Shtylyov <[email protected]>
scsi: sni_53c710: Add IRQ check
Sergey Shtylyov <[email protected]>
scsi: sun3x_esp: Add IRQ check
Sergey Shtylyov <[email protected]>
scsi: jazz_esp: Add IRQ check
Colin Ian King <[email protected]>
clk: uniphier: Fix potential infinite loop
Jason Gunthorpe <[email protected]>
vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
Sergey Shtylyov <[email protected]>
ata: libahci_platform: fix IRQ check
Sergey Shtylyov <[email protected]>
sata_mv: add IRQ checks
Sergey Shtylyov <[email protected]>
pata_ipx4xx_cf: fix IRQ check
Sergey Shtylyov <[email protected]>
pata_arasan_cf: fix IRQ check
Masami Hiramatsu <[email protected]>
x86/kprobes: Fix to check non boostable prefixes correctly
Colin Ian King <[email protected]>
media: m88rs6000t: avoid potential out-of-bounds reads on arrays
Yang Yingliang <[email protected]>
media: omap4iss: return error code when omap4iss_get() failed
Colin Ian King <[email protected]>
media: vivid: fix assignment of dev->fbuf_out_flags
Tetsuo Handa <[email protected]>
ttyprintk: Add TTY hangup callback.
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Increase wait time for VMbus unload
Ingo Molnar <[email protected]>
x86/platform/uv: Fix !KEXEC build failure
Steffen Dirkwinkel <[email protected]>
platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table
He Ying <[email protected]>
firmware: qcom-scm: Fix QCOM_SCM configuration
Johan Hovold <[email protected]>
tty: fix return value for unsupported ioctls
Johan Hovold <[email protected]>
tty: actually undefine superseded ASYNC flags
Johan Hovold <[email protected]>
USB: cdc-acm: fix unprivileged TIOCCSERIAL
Colin Ian King <[email protected]>
usb: gadget: r8a66597: Add missing null check on return from platform_get_resource
Lv Yunlong <[email protected]>
crypto: qat - Fix a double free in adf_create_ring
Nathan Chancellor <[email protected]>
ACPI: CPPC: Replace cppc_attr with kobj_attribute
Bjorn Andersson <[email protected]>
soc: qcom: mdt_loader: Detect truncated read of segments
Bjorn Andersson <[email protected]>
soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
William A. Kennington III <[email protected]>
spi: Fix use-after-free with devm_spi_alloc_*
Johan Hovold <[email protected]>
staging: greybus: uart: fix unprivileged TIOCCSERIAL
Colin Ian King <[email protected]>
staging: rtl8192u: Fix potential infinite loop
Lv Yunlong <[email protected]>
mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
Yang Yingliang <[email protected]>
USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR()
Giovanni Cabiddu <[email protected]>
crypto: qat - fix error path in adf_isr_resource_alloc()
Geert Uytterhoeven <[email protected]>
phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally
Pan Bian <[email protected]>
bus: qcom: Put child node before return
Michael Walle <[email protected]>
mtd: require write permissions for locking and badblock ioctls
Fabian Vogt <[email protected]>
fotg210-udc: Complete OUT requests on short packets
Fabian Vogt <[email protected]>
fotg210-udc: Don't DMA more than the buffer can take
Fabian Vogt <[email protected]>
fotg210-udc: Mask GRP2 interrupts we don't handle
Fabian Vogt <[email protected]>
fotg210-udc: Remove a dubious condition leading to fotg210_done
Fabian Vogt <[email protected]>
fotg210-udc: Fix EP0 IN requests bigger than two packets
Fabian Vogt <[email protected]>
fotg210-udc: Fix DMA on EP0 for length > max packet size
Tong Zhang <[email protected]>
crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
Tong Zhang <[email protected]>
crypto: qat - don't release uninitialized resources
Andy Shevchenko <[email protected]>
usb: gadget: pch_udc: Check for DMA mapping error
Andy Shevchenko <[email protected]>
usb: gadget: pch_udc: Check if driver is present before calling ->setup()
Andy Shevchenko <[email protected]>
usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
Otavio Pontes <[email protected]>
x86/microcode: Check for offline CPUs before requesting new microcode
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS
Erwan Le Ray <[email protected]>
serial: stm32: fix tx_empty condition
Erwan Le Ray <[email protected]>
serial: stm32: fix incorrect characters on console
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct PMIC interrupt trigger level on Snow
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family
Colin Ian King <[email protected]>
memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
Andy Shevchenko <[email protected]>
usb: gadget: pch_udc: Revert d3cb25a12138 completely
Claudio Imbrenda <[email protected]>
KVM: s390: split kvm_s390_real_to_abs
Heiko Carstens <[email protected]>
KVM: s390: fix guarded storage control register handling
Claudio Imbrenda <[email protected]>
KVM: s390: split kvm_s390_logical_to_effective
Sean Christopherson <[email protected]>
x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries
Colin Ian King <[email protected]>
drm/radeon: fix copy of uninitialized variable back to userspace
Johannes Berg <[email protected]>
cfg80211: scan: drop entry from hidden_list on overflow
Dan Carpenter <[email protected]>
ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
Zhao Heming <[email protected]>
md: md_open returns -EBUSY when entering racing area
Christoph Hellwig <[email protected]>
md: factor out a mddev_find_locked helper from mddev_find
Christoph Hellwig <[email protected]>
md: split mddev_find
Heming Zhao <[email protected]>
md-cluster: fix use-after-free issue when removing rdev
Steven Rostedt (VMware) <[email protected]>
tracing: Restructure trace_clock_global() to never block
Tetsuo Handa <[email protected]>
misc: vmw_vmci: explicitly initialize vmci_datagram payload
Tetsuo Handa <[email protected]>
misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct
Hans de Goede <[email protected]>
misc: lis3lv02d: Fix false-positive WARN on various HP models
Maciej W. Rozycki <[email protected]>
FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR
Ilya Lipnitskiy <[email protected]>
MIPS: pci-rt2880: fix slot 0 configuration
Or Cohen <[email protected]>
net/nfc: fix use-after-free llcp_sock_bind/connect
Lin Ma <[email protected]>
bluetooth: eliminate the potential race condition when removing the HCI controller
Taehee Yoo <[email protected]>
hsr: use netdev_err() instead of WARN_ONCE()
Archie Pusaka <[email protected]>
Bluetooth: verify AMP hci_chan before amp_destroy
Christoph Hellwig <[email protected]>
modules: inherit TAINT_PROPRIETARY_MODULE
Christoph Hellwig <[email protected]>
modules: return licensing information from find_symbol
Christoph Hellwig <[email protected]>
modules: rename the licence field in struct symsearch to license
Christoph Hellwig <[email protected]>
modules: unexport __module_address
Christoph Hellwig <[email protected]>
modules: unexport __module_text_address
Christoph Hellwig <[email protected]>
modules: mark each_symbol_section static
Christoph Hellwig <[email protected]>
modules: mark find_symbol static
Christoph Hellwig <[email protected]>
modules: mark ref_module static
Benjamin Block <[email protected]>
dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails
Joe Thornber <[email protected]>
dm space map common: fix division bug in sm_ll_find_free_block()
Joe Thornber <[email protected]>
dm persistent data: packed struct should have an aligned() attribute too
Steven Rostedt (VMware) <[email protected]>
tracing: Map all PIDs to command lines
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Fix START_TRANSFER link state check
Dean Anderson <[email protected]>
usb: gadget/function/f_fs string table fix for multiple languages
Hemant Kumar <[email protected]>
usb: gadget: Fix double free of device descriptor pointers
Anirudh Rayabharam <[email protected]>
usb: gadget: dummy_hcd: fix gpf in gadget_setup
Peilin Ye <[email protected]>
media: dvbdev: Fix memory leak in dvb_media_device_free()
Fengnan Chang <[email protected]>
ext4: fix error code in ext4_commit_super
Zhang Yi <[email protected]>
ext4: fix check to prevent false positive report of incorrect used inodes
Steven Rostedt (VMware) <[email protected]>
ftrace: Handle commands when closing set_ftrace_filter file
Chen Jun <[email protected]>
posix-timers: Preserve return value in clock_adjtime32()
Thomas Gleixner <[email protected]>
Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op")
Yang Yang <[email protected]>
jffs2: check the validity of dstlen in jffs2_zlib_compress()
Linus Torvalds <[email protected]>
Fix misc new gcc warnings
Arnd Bergmann <[email protected]>
security: commoncap: fix -Wstringop-overread warning
Paul Clements <[email protected]>
md/raid1: properly indicate failure when ending a failed write request
Alexander Shishkin <[email protected]>
intel_th: pci: Add Alder Lake-M support
Tony Ambardar <[email protected]>
powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h
Mahesh Salgaonkar <[email protected]>
powerpc/eeh: Fix EEH handling for hugepages in ioremap space.
lizhe <[email protected]>
jffs2: Fix kasan slab-out-of-bounds problem
Trond Myklebust <[email protected]>
NFSv4: Don't discard segments marked for return in _pnfs_return_layout()
Marc Zyngier <[email protected]>
ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure
Davide Caratti <[email protected]>
openvswitch: fix stack OOB read while fragmenting IPv4 packets
Bill Wendling <[email protected]>
arm64/vdso: Discard .note.gnu.property sections in vDSO
Filipe Manana <[email protected]>
btrfs: fix race when picking most recent mod log operation for an old root
Lv Yunlong <[email protected]>
ALSA: sb: Fix two use after free in snd_sb_qsound_build
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Re-order CX5066 quirk table entries
Lv Yunlong <[email protected]>
ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer
Bart Van Assche <[email protected]>
scsi: libfc: Fix a format specifier
James Smart <[email protected]>
scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic
James Smart <[email protected]>
scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response
Guchun Chen <[email protected]>
drm/amdgpu: fix NULL pointer dereference
Marijn Suijten <[email protected]>
drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal
Hans Verkuil <[email protected]>
media: gscpa/stv06xx: fix memory leak
Pavel Skripkin <[email protected]>
media: dvb-usb: fix memory leak in dvb_usb_adapter_init
Yang Yingliang <[email protected]>
media: i2c: adv7842: fix possible use-after-free in adv7842_remove()
Yang Yingliang <[email protected]>
media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove()
Yang Yingliang <[email protected]>
media: adv7604: fix possible use-after-free in adv76xx_remove()
Yang Yingliang <[email protected]>
power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove()
Yang Yingliang <[email protected]>
power: supply: generic-adc-battery: fix possible use-after-free in gab_remove()
Colin Ian King <[email protected]>
clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return
Hans Verkuil <[email protected]>
media: vivid: update EDID
Muhammad Usama Anjum <[email protected]>
media: em28xx: fix memory leak
Ewan D. Milne <[email protected]>
scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix use after free in bsg
Bart Van Assche <[email protected]>
scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats()
shaoyunl <[email protected]>
drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f
dongjian <[email protected]>
power: supply: Use IRQF_ONESHOT
Hans Verkuil <[email protected]>
media: gspca/sq905.c: fix uninitialized variable
Daniel Niv <[email protected]>
media: media/saa7164: fix saa7164_encoder_register() memory leak bugs
Hans de Goede <[email protected]>
extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged
Matthias Schiffer <[email protected]>
power: supply: bq27xxx: fix power_avg for newer ICs
Sean Young <[email protected]>
media: ite-cir: check for receive overflow
Chaitanya Kulkarni <[email protected]>
scsi: target: pscsi: Fix warning in pscsi_complete_cmd()
James Smart <[email protected]>
scsi: lpfc: Fix pt2pt connection does not recover after LOGO
James Smart <[email protected]>
scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe
Josef Bacik <[email protected]>
btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s
Yang Yingliang <[email protected]>
phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()
Pavel Machek <[email protected]>
intel_th: Consistency and off-by-one fix
Wei Yongjun <[email protected]>
spi: omap-100k: Fix reference leak to master
Wei Yongjun <[email protected]>
spi: dln2: Fix reference leak to master
Robin Murphy <[email protected]>
perf/arm_pmu_platform: Fix error handling
Jerome Forissier <[email protected]>
tee: optee: do not check memref size on return from Secure World
John Millikin <[email protected]>
x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS)
Rafael J. Wysocki <[email protected]>
PCI: PM: Do not read power state in pci_enable_device_flags()
Thinh Nguyen <[email protected]>
usb: xhci: Fix port minor revision
Wesley Cheng <[email protected]>
usb: dwc3: gadget: Ignore EP queue requests during bus reset
Ruslan Bilovol <[email protected]>
usb: gadget: f_uac1: validate input parameters
Pawel Laszczak <[email protected]>
usb: gadget: uvc: add bInterval checking for HS mode
Ard Biesheuvel <[email protected]>
crypto: api - check for ERR pointers in crypto_destroy_tfm()
karthik alapati <[email protected]>
staging: wimax/i2400m: fix byte-order issue
Phillip Potter <[email protected]>
fbdev: zero-fill colormap in fbcmap.c
Alexander Shishkin <[email protected]>
intel_th: pci: Add Rocket Lake CPU support
Filipe Manana <[email protected]>
btrfs: fix metadata extent leak after failure to create subvolume
Paul Aurich <[email protected]>
cifs: Return correct error code from smb2_get_enc_key
Seunghui Lee <[email protected]>
mmc: core: Set read only for SD cards with permanent write protect bit
DooHyun Hwang <[email protected]>
mmc: core: Do a power cycle when the CMD11 fails
Avri Altman <[email protected]>
mmc: block: Update ext_csd.cache_ctrl if it was written
Tudor Ambarus <[email protected]>
spi: spi-ti-qspi: Free DMA resources
Jeffrey Mitchell <[email protected]>
ecryptfs: fix kernel panic with null dev_name
Chunfeng Yun <[email protected]>
arm64: dts: mt8173: fix property typo of 'phys' in dsi node
Mark Langsdorf <[email protected]>
ACPI: custom_method: fix a possible memory leak
Mark Langsdorf <[email protected]>
ACPI: custom_method: fix potential use-after-free issue
Vasily Gorbik <[email protected]>
s390/disassembler: increase ebpf disasm buffer size
Mark Pearson <[email protected]>
platform/x86: thinkpad_acpi: Correct thermal sensor allocation
Chris Chiu <[email protected]>
USB: Add reset-resume quirk for WD19's Realtek Hub
Kai-Heng Feng <[email protected]>
USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet
Takashi Iwai <[email protected]>
ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX
Jiri Kosina <[email protected]>
iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
Daniel Borkmann <[email protected]>
bpf: Fix masking negation logic upon negative dst register
Romain Naour <[email protected]>
mips: Do not include hi and lo in clobber list for R6
Matt Redfearn <[email protected]>
MIPS: cpu-features.h: Replace __mips_isa_rev with MIPS_ISA_REV
Matt Redfearn <[email protected]>
MIPS: Introduce isa-rev.h to define MIPS_ISA_REV
Jiri Kosina <[email protected]>
iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd()
Phillip Potter <[email protected]>
net: usb: ax88179_178a: initialize local variables before use
Frank van der Linden <[email protected]>
bpf: fix up selftests after backports were fixed
Samuel Mendoza-Jonas <[email protected]>
bpf: Fix backport of "bpf: restrict unknown scalars of mixed signed bounds for unprivileged"
Rafael J. Wysocki <[email protected]>
ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade()
Rafael J. Wysocki <[email protected]>
ACPI: tables: x86: Reserve memory occupied by ACPI tables
Shuah Khan <[email protected]>
usbip: vudc synchronize sysfs code paths
-------------
Diffstat:
Makefile | 4 +- arch/arc/kernel/entry.S | 4 +- arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 2 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 2 +- arch/arm/boot/dts/exynos5250-snow-common.dtsi | 2 +- arch/arm/kernel/hw_breakpoint.c | 2 +- arch/arm/kernel/suspend.c | 19 +- arch/arm/mm/cache-v7.S | 51 ++- arch/arm64/boot/dts/mediatek/mt8173.dtsi | 2 +- arch/arm64/kernel/vdso/vdso.lds.S | 8 +- arch/mips/include/asm/cpu-features.h | 5 +- arch/mips/include/asm/div64.h | 55 ++- arch/mips/include/asm/isa-rev.h | 24 + arch/mips/pci/pci-legacy.c | 9 +- arch/mips/pci/pci-rt2880.c | 37 +- arch/mips/vdso/gettimeofday.c | 14 +- arch/powerpc/Kconfig | 2 +- arch/powerpc/Kconfig.debug | 1 + arch/powerpc/include/uapi/asm/errno.h | 1 + arch/powerpc/kernel/eeh.c | 11 +- arch/powerpc/kernel/iommu.c | 4 +- arch/powerpc/kernel/prom.c | 2 +- arch/powerpc/kernel/smp.c | 6 +- arch/powerpc/lib/feature-fixups.c | 35 +- arch/powerpc/perf/isa207-common.c | 4 +- arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +- arch/powerpc/platforms/pseries/hotplug-cpu.c | 3 - arch/powerpc/platforms/pseries/pci_dlpar.c | 4 +- arch/s390/kernel/dis.c | 2 +- arch/s390/kvm/gaccess.h | 54 ++- arch/s390/kvm/kvm-s390.c | 4 +- arch/um/kernel/dyn.lds.S | 6 + arch/um/kernel/uml.lds.S | 6 + arch/x86/Kconfig | 1 + arch/x86/Makefile | 1 + arch/x86/entry/vdso/vma.c | 2 +- arch/x86/events/amd/iommu.c | 6 +- arch/x86/kernel/acpi/boot.c | 25 +- arch/x86/kernel/cpu/microcode/core.c | 8 +- arch/x86/kernel/kprobes/core.c | 17 +- arch/x86/kernel/setup.c | 7 +- arch/x86/kvm/x86.c | 1 + arch/x86/lib/msr-smp.c | 4 +- block/blk-mq.c | 6 +- crypto/api.c | 2 +- drivers/acpi/arm64/gtdt.c | 10 +- drivers/acpi/cppc_acpi.c | 14 +- drivers/acpi/custom_method.c | 4 +- drivers/acpi/scan.c | 1 + drivers/acpi/tables.c | 42 +- drivers/ata/libahci_platform.c | 4 +- drivers/ata/pata_arasan_cf.c | 15 +- drivers/ata/pata_ixp4xx_cf.c | 6 +- drivers/ata/sata_mv.c | 4 + drivers/bus/qcom-ebi2.c | 4 +- drivers/char/tpm/tpm2-cmd.c | 1 + drivers/char/ttyprintk.c | 11 + drivers/clk/samsung/clk-exynos7.c | 7 +- drivers/clk/socfpga/clk-gate-a10.c | 1 + drivers/clk/uniphier/clk-uniphier-mux.c | 4 +- drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 +- drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 +- drivers/crypto/qat/qat_common/adf_isr.c | 29 +- drivers/crypto/qat/qat_common/adf_transport.c | 1 + drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +- drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 +- drivers/extcon/extcon-arizona.c | 17 +- drivers/firmware/Kconfig | 1 + drivers/gpio/gpiolib-acpi.c | 14 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- drivers/gpu/drm/i915/intel_pm.c | 2 +- drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c | 10 +- drivers/gpu/drm/radeon/radeon.h | 1 + drivers/gpu/drm/radeon/radeon_atombios.c | 6 +- drivers/gpu/drm/radeon/radeon_kms.c | 1 + drivers/gpu/drm/radeon/radeon_pm.c | 8 + drivers/gpu/drm/radeon/si_dpm.c | 3 + drivers/hid/hid-ids.h | 1 + drivers/hid/hid-plantronics.c | 60 ++- drivers/hsi/hsi_core.c | 3 +- drivers/hv/channel_mgmt.c | 30 +- drivers/hwtracing/intel_th/gth.c | 4 +- drivers/hwtracing/intel_th/pci.c | 10 + drivers/i2c/busses/i2c-cadence.c | 5 +- drivers/i2c/busses/i2c-emev2.c | 5 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/i2c/busses/i2c-sh7760.c | 5 +- drivers/iio/gyro/mpu3050-core.c | 13 +- drivers/iio/light/tsl2583.c | 8 + drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 1 + drivers/infiniband/hw/hfi1/firmware.c | 1 + drivers/infiniband/hw/i40iw/i40iw.h | 1 + drivers/infiniband/hw/i40iw/i40iw_main.c | 7 +- drivers/infiniband/hw/i40iw/i40iw_pble.c | 6 +- drivers/input/touchscreen/elants_i2c.c | 44 +- drivers/input/touchscreen/silead.c | 44 +- drivers/isdn/capi/kcapi.c | 4 +- drivers/md/dm-rq.c | 2 + drivers/md/md.c | 67 ++- drivers/md/persistent-data/dm-btree-internal.h | 4 +- drivers/md/persistent-data/dm-space-map-common.c | 2 + drivers/md/persistent-data/dm-space-map-common.h | 8 +- drivers/md/raid1.c | 2 + drivers/media/dvb-core/dvbdev.c | 1 + drivers/media/i2c/adv7511-v4l2.c | 2 +- drivers/media/i2c/adv7604.c | 2 +- drivers/media/i2c/adv7842.c | 2 +- drivers/media/pci/saa7164/saa7164-encoder.c | 20 +- drivers/media/platform/vivid/vivid-core.c | 6 +- drivers/media/platform/vivid/vivid-vid-out.c | 2 +- drivers/media/rc/ite-cir.c | 8 +- drivers/media/tuners/m88rs6000t.c | 6 +- drivers/media/usb/dvb-usb/dvb-usb-init.c | 20 +- drivers/media/usb/dvb-usb/dvb-usb.h | 2 +- drivers/media/usb/em28xx/em28xx-dvb.c | 1 + drivers/media/usb/gspca/gspca.c | 2 + drivers/media/usb/gspca/gspca.h | 1 + drivers/media/usb/gspca/sq905.c | 2 +- drivers/media/usb/gspca/stv06xx/stv06xx.c | 9 + drivers/memory/omap-gpmc.c | 7 +- drivers/mfd/stm32-timers.c | 7 +- drivers/misc/kgdbts.c | 26 +- drivers/misc/lis3lv02d/lis3lv02d.c | 21 +- drivers/misc/vmw_vmci/vmci_doorbell.c | 2 +- drivers/misc/vmw_vmci/vmci_guest.c | 2 +- drivers/mmc/core/block.c | 12 + drivers/mmc/core/core.c | 2 +- drivers/mmc/core/sd.c | 6 + drivers/mtd/mtdchar.c | 8 +- drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 2 +- .../net/ethernet/cavium/liquidio/cn23xx_pf_regs.h | 2 +- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 + drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +- .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 + drivers/net/ethernet/ti/davinci_emac.c | 4 +- drivers/net/fddi/Kconfig | 15 +- drivers/net/fddi/defxx.c | 47 +- drivers/net/usb/ax88179_178a.c | 4 +- drivers/net/wan/lapbether.c | 32 +- drivers/net/wimax/i2400m/op-rfkill.c | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +- drivers/net/wireless/ath/ath9k/hw.c | 2 +- drivers/net/wireless/intel/ipw2x00/libipw_wx.c | 6 +- drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 7 +- drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 7 +- drivers/net/wireless/marvell/mwl8k.c | 1 + drivers/net/wireless/mediatek/mt7601u/eeprom.c | 2 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/table.c | 500 +++++++++++++++------ drivers/net/wireless/wl3501.h | 47 +- drivers/net/wireless/wl3501_cs.c | 54 +-- drivers/nfc/pn533/pn533.c | 3 + drivers/of/fdt.c | 12 +- drivers/pci/host/pci-thunder-ecam.c | 2 +- drivers/pci/host/pci-thunder-pem.c | 13 +- drivers/pci/hotplug/acpiphp_glue.c | 1 + drivers/pci/pci.c | 16 +- drivers/pci/pci.h | 6 + drivers/pci/probe.c | 1 + drivers/perf/arm_pmu_platform.c | 2 +- drivers/phy/marvell/Kconfig | 4 +- drivers/phy/ti/phy-twl4030-usb.c | 2 +- drivers/pinctrl/samsung/pinctrl-exynos.c | 10 +- drivers/platform/x86/pmc_atom.c | 28 +- drivers/platform/x86/thinkpad_acpi.c | 31 +- drivers/power/supply/bq27xxx_battery.c | 51 ++- drivers/power/supply/generic-adc-battery.c | 2 +- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/pm2301_charger.c | 2 +- drivers/power/supply/s3c_adc_battery.c | 2 +- drivers/power/supply/tps65090-charger.c | 2 +- drivers/power/supply/tps65217_charger.c | 2 +- drivers/rpmsg/qcom_glink_native.c | 1 + drivers/rtc/rtc-ds1307.c | 12 +- drivers/scsi/device_handler/scsi_dh_alua.c | 5 +- drivers/scsi/jazz_esp.c | 4 +- drivers/scsi/libfc/fc_lport.c | 2 +- drivers/scsi/lpfc/lpfc_crtn.h | 3 - drivers/scsi/lpfc/lpfc_hw4.h | 174 +------ drivers/scsi/lpfc/lpfc_init.c | 103 +---- drivers/scsi/lpfc/lpfc_mbox.c | 36 -- drivers/scsi/lpfc/lpfc_nportdisc.c | 11 +- drivers/scsi/lpfc/lpfc_nvmet.c | 1 - drivers/scsi/lpfc/lpfc_sli.c | 1 - drivers/scsi/qla2xxx/qla_attr.c | 8 +- drivers/scsi/qla2xxx/qla_bsg.c | 3 +- drivers/scsi/sni_53c710.c | 5 +- drivers/scsi/sun3x_esp.c | 4 +- drivers/soc/qcom/mdt_loader.c | 17 + drivers/spi/spi-dln2.c | 2 +- drivers/spi/spi-omap-100k.c | 6 +- drivers/spi/spi-ti-qspi.c | 20 +- drivers/spi/spi.c | 9 +- drivers/staging/greybus/uart.c | 2 - drivers/staging/media/omap4iss/iss.c | 4 +- drivers/staging/rtl8192u/r8192U_core.c | 2 +- drivers/staging/typec/tcpci.c | 21 +- drivers/target/target_core_pscsi.c | 3 +- drivers/tee/optee/core.c | 10 - drivers/thermal/fair_share.c | 4 + drivers/tty/serial/8250/8250_port.c | 3 - drivers/tty/serial/stm32-usart.c | 17 +- drivers/tty/serial/stm32-usart.h | 3 - drivers/tty/tty_io.c | 8 +- drivers/usb/class/cdc-acm.c | 2 - drivers/usb/core/hub.c | 6 +- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc2/core.h | 2 + drivers/usb/dwc2/gadget.c | 3 +- drivers/usb/dwc3/dwc3-omap.c | 5 + drivers/usb/dwc3/gadget.c | 22 +- drivers/usb/gadget/config.c | 4 + drivers/usb/gadget/function/f_fs.c | 3 +- drivers/usb/gadget/function/f_uac1.c | 43 ++ drivers/usb/gadget/function/f_uvc.c | 7 +- drivers/usb/gadget/udc/dummy_hcd.c | 23 +- drivers/usb/gadget/udc/fotg210-udc.c | 26 +- drivers/usb/gadget/udc/pch_udc.c | 49 +- drivers/usb/gadget/udc/r8a66597-udc.c | 2 + drivers/usb/gadget/udc/snps_udc_plat.c | 4 +- drivers/usb/host/fotg210-hcd.c | 4 +- drivers/usb/host/sl811-hcd.c | 9 +- drivers/usb/host/xhci-ext-caps.h | 5 +- drivers/usb/host/xhci-mem.c | 9 + drivers/usb/host/xhci.c | 6 +- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_sysfs.c | 5 + drivers/vfio/mdev/mdev_sysfs.c | 2 +- drivers/video/fbdev/core/fbcmap.c | 8 +- fs/block_dev.c | 20 +- fs/btrfs/ctree.c | 20 + fs/btrfs/ioctl.c | 18 +- fs/btrfs/relocation.c | 6 +- fs/ceph/caps.c | 1 + fs/ceph/inode.c | 1 + fs/cifs/smb2ops.c | 2 +- fs/dlm/debug_fs.c | 1 + fs/ecryptfs/main.c | 6 + fs/ext4/ialloc.c | 48 +- fs/ext4/super.c | 6 +- fs/f2fs/inline.c | 3 +- fs/fuse/cuse.c | 2 + fs/jffs2/compr_rtime.c | 3 + fs/jffs2/scan.c | 2 +- fs/nfs/flexfilelayout/flexfilelayout.c | 2 +- fs/nfs/inode.c | 8 +- fs/nfs/nfs42proc.c | 21 +- fs/nfs/pnfs.c | 2 +- fs/squashfs/file.c | 6 +- include/crypto/acompress.h | 2 + include/crypto/aead.h | 2 + include/crypto/akcipher.h | 2 + include/crypto/hash.h | 4 + include/crypto/kpp.h | 2 + include/crypto/rng.h | 2 + include/crypto/skcipher.h | 2 + include/linux/acpi.h | 9 +- include/linux/hid.h | 2 + include/linux/module.h | 26 +- include/linux/power/bq27xxx_battery.h | 1 - include/linux/smp.h | 2 +- include/linux/spi/spi.h | 3 + include/linux/tty_driver.h | 2 +- include/net/bluetooth/hci_core.h | 1 + include/scsi/libfcoe.h | 2 +- include/uapi/linux/tty_flags.h | 4 +- kernel/bpf/verifier.c | 26 +- kernel/futex.c | 3 +- kernel/kexec_file.c | 4 +- kernel/module.c | 61 ++- kernel/smp.c | 10 +- kernel/time/posix-timers.c | 4 +- kernel/trace/ftrace.c | 5 +- kernel/trace/trace.c | 41 +- kernel/trace/trace_clock.c | 44 +- kernel/up.c | 2 +- lib/bug.c | 33 +- lib/kobject_uevent.c | 9 +- lib/nlattr.c | 2 +- lib/stackdepot.c | 6 +- mm/hugetlb.c | 11 +- mm/khugepaged.c | 18 +- mm/ksm.c | 1 + mm/shmem.c | 12 +- net/bluetooth/hci_event.c | 3 +- net/bluetooth/hci_request.c | 12 +- net/bluetooth/l2cap_core.c | 4 + net/bluetooth/l2cap_sock.c | 8 + net/hsr/hsr_framereg.c | 3 +- net/ipv6/ip6_gre.c | 3 - net/ipv6/ip6_tunnel.c | 3 +- net/ipv6/ip6_vti.c | 3 +- net/ipv6/sit.c | 5 +- net/mac80211/main.c | 7 +- net/mac80211/mlme.c | 5 + net/netfilter/nf_conntrack_standalone.c | 5 +- net/netfilter/nft_set_hash.c | 10 +- net/nfc/digital_dep.c | 2 + net/nfc/llcp_sock.c | 4 + net/openvswitch/actions.c | 8 +- net/sctp/sm_make_chunk.c | 2 +- net/sctp/sm_statefuns.c | 3 +- net/sctp/socket.c | 38 +- net/tipc/netlink_compat.c | 2 +- net/vmw_vsock/vmci_transport.c | 3 +- net/wireless/scan.c | 2 + samples/bpf/tracex1_kern.c | 4 +- samples/kfifo/bytestream-example.c | 8 +- samples/kfifo/inttype-example.c | 8 +- samples/kfifo/record-example.c | 8 +- scripts/kconfig/nconf.c | 2 +- security/commoncap.c | 2 +- sound/core/init.c | 2 - sound/isa/sb/emu8000.c | 4 +- sound/isa/sb/sb16_csp.c | 8 +- sound/pci/hda/hda_generic.c | 16 +- sound/pci/hda/patch_conexant.c | 14 +- sound/pci/hda/patch_realtek.c | 21 +- sound/pci/rme9652/hdsp.c | 3 +- sound/pci/rme9652/hdspm.c | 3 +- sound/pci/rme9652/rme9652.c | 3 +- sound/soc/codecs/rt286.c | 23 +- sound/usb/card.c | 14 +- sound/usb/quirks-table.h | 10 + sound/usb/quirks.c | 16 +- sound/usb/usbaudio.h | 2 + tools/perf/util/symbol_fprintf.c | 2 +- tools/testing/selftests/bpf/test_verifier.c | 12 + tools/testing/selftests/lib.mk | 4 + 332 files changed, 2394 insertions(+), 1411 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/323 usbip: vudc synchronize sysfs code paths
From: Shuah Khan <[email protected]>
commit bd8b82042269a95db48074b8bb400678dbac1815 upstream.
Fuzzing uncovered race condition between sysfs code paths in usbip drivers. Device connect/disconnect code paths initiated through sysfs interface are prone to races if disconnect happens during connect and vice versa.
Use sysfs_lock to protect sysfs paths in vudc.
--- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_sysfs.c | 5 +++++ 2 files changed, 6 insertions(+)
drivers/usb/usbip/vudc_dev.c +1 -0
@@ -586,6 +586,7 @@ static int init_vudc_hw(struct vudc *udcinit_waitqueue_head (&udc->tx_waitq);spin_lock_init (&ud->lock); +mutex_init (&ud->sysfs_lock); ud->status =SDEV_ST_AVAILABLE ; ud->side =USBIP_VUDC ;
drivers/usb/usbip/vudc_sysfs.c +5 -0
@@ -125,6 +125,7 @@ static ssize_t store_sockfd(struct devicdev_err (dev,"no device" );return -ENODEV ; } +mutex_lock (&udc->ud.sysfs_lock);spin_lock_irqsave (&udc->lock, flags);/* Don't export what we don't have */ if (!udc->driver || !udc->pullup) {
@@ -200,6 +201,8 @@ static ssize_t store_sockfd(struct devicwake_up_process (udc->ud.tcp_rx);wake_up_process (udc->ud.tcp_tx); + +mutex_unlock (&udc->ud.sysfs_lock);return count; }else {
@@ -220,6 +223,7 @@ static ssize_t store_sockfd(struct devic }spin_unlock_irqrestore (&udc->lock, flags); +mutex_unlock (&udc->ud.sysfs_lock);return count;
@@ -229,6 +233,7 @@ unlock_ud:spin_unlock_irq (&udc->ud.lock); unlock:spin_unlock_irqrestore (&udc->lock, flags); +mutex_unlock (&udc->ud.sysfs_lock);return ret; }
Greg Kroah-Hartman
maintainerPATCH 2/323 ACPI: tables: x86: Reserve memory occupied by ACPI tables
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit 1a1c130ab7575498eed5bcf7220037ae09cd1f8a upstream.
The following problem has been reported by George Kennedy:
Since commit 7fef431be9c9 ("mm/page_alloc: place pages to tail in __free_pages_core()") the following use after free occurs intermittently when ACPI tables are accessed.
BUG: KASAN: use-after-free in ibft_init+0x134/0xc49 Read of size 4 at addr ffff8880be453004 by task swapper/0/1 CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1-7a7fd0d #1 Call Trace: dump_stack+0xf6/0x158 print_address_description.constprop.9+0x41/0x60 kasan_report.cold.14+0x7b/0xd4 __asan_report_load_n_noabort+0xf/0x20 ibft_init+0x134/0xc49 do_one_initcall+0xc4/0x3e0 kernel_init_freeable+0x5af/0x66b kernel_init+0x16/0x1d0 ret_from_fork+0x22/0x30
ACPI tables mapped via kmap() do not have their mapped pages reserved and the pages can be "stolen" by the buddy allocator.
Apparently, on the affected system, the ACPI table in question is not located in "reserved" memory, like ACPI NVS or ACPI Data, that will not be used by the buddy allocator, so the memory occupied by that table has to be explicitly reserved to prevent the buddy allocator from using it.
In order to address this problem, rearrange the initialization of the ACPI tables on x86 to locate the initial tables earlier and reserve the memory occupied by them.
The other architectures using ACPI should not be affected by this change.
--- arch/x86/kernel/acpi/boot.c | 25 ++++++++++++------------- arch/x86/kernel/setup.c | 8 +++----- drivers/acpi/tables.c | 42 +++++++++++++++++++++++++++++++++++++++--- include/linux/acpi.h | 9 ++++++++- 4 files changed, 62 insertions(+), 22 deletions(-)
arch/x86/kernel/acpi/boot.c +12 -13
@@ -1553,10 +1553,18 @@ void __init acpi_boot_table_init(void)/* * Initialize the ACPI boot-time table parser. */ -if (acpi_table_init ()) { +if (acpi_locate_initial_tables ())disable_acpi (); -return ; - } +else +acpi_reserve_initial_tables (); +} + +int __init early_acpi_boot_init (void ) +{ +if (acpi_disabled) +return 1 ; + +acpi_table_init_complete ();acpi_table_parse (ACPI_SIG_BOOT , acpi_parse_sbf);
@@ -1569,18 +1577,9 @@ void __init acpi_boot_table_init(void) }else { printk(KERN_WARNING PREFIX "Disabling ACPI support\n");disable_acpi (); -return ; +return 1 ; } } -} - -int __init early_acpi_boot_init (void ) -{ -/* -* If acpi_disabled, bail out -*/ -if (acpi_disabled) -return 1 ;/* * Process the Multiple APIC Description Table (MADT), if present
arch/x86/kernel/setup.c +3 -5
@@ -1129,6 +1129,9 @@ void __init setup_arch(char **cmdline_p)cleanup_highmap (); +/* Look for ACPI tables and reserve memory occupied by them. */ +acpi_boot_table_init (); +memblock_set_current_limit (ISA_END_ADDRESS );e820__memblock_setup ();
@@ -1218,11 +1221,6 @@ void __init setup_arch(char **cmdline_p)early_platform_quirks (); -/* -* Parse the ACPI tables for possible boot-time SMP configuration. -*/ -acpi_boot_table_init (); -early_acpi_boot_init ();initmem_init ();
drivers/acpi/tables.c +39 -3
62 lines not on this page · raw message
include/linux/acpi.h +8 -1
@@ -228,10 +228,14 @@ void __iomem *__acpi_map_table(unsignedvoid __acpi_unmap_table (void __iomem *map,unsigned long size);int early_acpi_boot_init (void );int acpi_boot_init (void ); +void acpi_boot_table_prepare (void );void acpi_boot_table_init (void );int acpi_mps_check (void );int acpi_numa_init (void ); +int acpi_locate_initial_tables (void ); +void acpi_reserve_initial_tables (void ); +void acpi_table_init_complete (void );int acpi_table_init (void );int acpi_table_parse (char *id,acpi_tbl_table_handler handler); int __init acpi_table_parse_entries(char *id, unsigned long table_size,
@@ -714,9 +718,12 @@ static inline int acpi_boot_init(void)return 0 ; } +static inline void acpi_boot_table_prepare (void ) +{ +} +static inline void acpi_boot_table_init (void ) { -return ; }static inline int acpi_mps_check (void )
Greg Kroah-Hartman
maintainerPATCH 3/323 ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit 6998a8800d73116187aad542391ce3b2dd0f9e30 upstream.
Commit 1a1c130ab757 ("ACPI: tables: x86: Reserve memory occupied by ACPI tables") attempted to address an issue with reserving the memory occupied by ACPI tables, but it broke the initrd-based table override mechanism relied on by multiple users.
To restore the initrd-based ACPI table override functionality, move the acpi_boot_table_init() invocation in setup_arch() on x86 after the acpi_table_upgrade() one.
--- arch/x86/kernel/setup.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/kernel/setup.c +2 -3
@@ -1129,9 +1129,6 @@ void __init setup_arch(char **cmdline_p)cleanup_highmap (); -/* Look for ACPI tables and reserve memory occupied by them. */ -acpi_boot_table_init (); -memblock_set_current_limit (ISA_END_ADDRESS );e820__memblock_setup ();
@@ -1214,6 +1211,8 @@ void __init setup_arch(char **cmdline_p)reserve_initrd ();acpi_table_upgrade (); +/* Look for ACPI tables and reserve memory occupied by them. */ +acpi_boot_table_init ();vsmp_init ();
Greg Kroah-Hartman
maintainerPATCH 4/323 bpf: Fix backport of "bpf: restrict unknown scalars of mixed signed bounds for unprivileged"
In reply to Greg Kroah-HartmanFrom: Samuel Mendoza-Jonas <[email protected]>
The 4.14 backport of 9d7eceede ("bpf: restrict unknown scalars of mixed signed bounds for unprivileged") adds the PTR_TO_MAP_VALUE check to the wrong location in adjust_ptr_min_max_vals(), most likely because 4.14 doesn't include the commit that updates the if-statement to a switch-statement (aad2eeaf4 "bpf: Simplify ptr_min_max_vals adjustment").
Move the check to the proper location in adjust_ptr_min_max_vals().
--- kernel/bpf/verifier.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
kernel/bpf/verifier.c +7 -7
@@ -2204,6 +2204,13 @@ static int adjust_ptr_min_max_vals(struc dst);return -EACCES ; } +if (ptr_reg->type ==PTR_TO_MAP_VALUE ) { +if (!env->allow_ptr_leaks && !known && (smin_val <0 ) != (smax_val <0 )) { +verbose ("R%d has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root\n" , + off_reg == dst_reg ? dst : src); +return -EACCES ; + } + }/* In case of 'scalar += pointer', dst_reg inherits pointer type and id. * The id may be overwritten later if we create a new variable offset.
@@ -2349,13 +2356,6 @@ static int adjust_ptr_min_max_vals(strucverbose ("R%d bitwise operator %s on pointer prohibited\n" , dst, bpf_alu_string[opcode >>4 ]);return -EACCES ; -case PTR_TO_MAP_VALUE : -if (!env->allow_ptr_leaks && !known && (smin_val <0 ) != (smax_val <0 )) { -verbose ("R%d has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root\n" , - off_reg == dst_reg ? dst : src); -return -EACCES ; - } -/* fall-through */ default :/* other operators (e.g. MUL,LSH) produce non-pointer results */ if (!env->allow_ptr_leaks)
Greg Kroah-Hartman
maintainerPATCH 5/323 bpf: fix up selftests after backports were fixed
In reply to Greg Kroah-HartmanFrom: Frank van der Linden <[email protected]>
After the backport of the changes to fix CVE 2019-7308, the selftests also need to be fixed up, as was done originally in mainline 80c9b2fae87b ("bpf: add various test cases to selftests").
4.14 commit 03f11a51a19 ("bpf: Fix selftests are changes for CVE 2019-7308") did that, but since there was an error in the backport, some selftests did not change output. So, add them now that this error has been fixed, and their output has actually changed as expected.
This adds the rest of the changed test outputs from 80c9b2fae87b.
--- tools/testing/selftests/bpf/test_verifier.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
tools/testing/selftests/bpf/test_verifier.c +12 -0
@@ -6207,6 +6207,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
@@ -6231,6 +6232,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
@@ -6257,6 +6259,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
@@ -6282,6 +6285,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
@@ -6330,6 +6334,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
@@ -6401,6 +6406,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
@@ -6452,6 +6458,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
@@ -6479,6 +6486,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
@@ -6505,6 +6513,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
@@ -6534,6 +6543,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R7 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
@@ -6592,6 +6602,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "unbounded min value", + .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", .result = REJECT, .result_unpriv = REJECT, },
@@ -6644,6 +6655,7 @@ static struct bpf_test tests[] = { }, .fixup_map1 = { 3 }, .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.", + .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", .result = REJECT, }, {
Greg Kroah-Hartman
maintainerPATCH 6/323 net: usb: ax88179_178a: initialize local variables before use
In reply to Greg Kroah-HartmanFrom: Phillip Potter <[email protected]>
commit bd78980be1a68d14524c51c4b4170782fada622b upstream.
Use memset to initialize local array in drivers/net/usb/ax88179_178a.c, and also set a local u16 and u32 variable to 0. Fixes a KMSAN found uninit-value bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=00371c73c72f72487c1d0bfe0cc9d00de339d5aa
--- drivers/net/usb/ax88179_178a.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/usb/ax88179_178a.c +2 -2
@@ -307,12 +307,12 @@ static int ax88179_read_cmd(struct usbneint ret;if (2 == size) { -u16 buf; +u16 buf =0 ; ret =__ax88179_read_cmd (dev, cmd, value, index, size, &buf,0 );le16_to_cpus (&buf); *((u16 *)data) = buf; }else if (4 == size) { -u32 buf; +u32 buf =0 ; ret =__ax88179_read_cmd (dev, cmd, value, index, size, &buf,0 );le32_to_cpus (&buf); *((u32 *)data) = buf;
Greg Kroah-Hartman
maintainerPATCH 7/323 iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd()
In reply to Greg Kroah-HartmanFrom: Jiri Kosina <[email protected]>
commit 2800aadc18a64c96b051bcb7da8a7df7d505db3f upstream.
It's possible for iwl_pcie_enqueue_hcmd() to be called with hard IRQs disabled (e.g. from LED core). We can't enable BHs in such a situation.
Turn the unconditional BH-enable/BH-disable code into hardirq-disable/conditional-enable.
This fixes the warning below.
WARNING: CPU: 1 PID: 1139 at kernel/softirq.c:178 __local_bh_enable_ip+0xa5/0xf0 CPU: 1 PID: 1139 Comm: NetworkManager Not tainted 5.12.0-rc1-00004-gb4ded168af79 #7 Hardware name: LENOVO 20K5S22R00/20K5S22R00, BIOS R0IET38W (1.16 ) 05/31/2017 RIP: 0010:__local_bh_enable_ip+0xa5/0xf0 Code: f7 69 e8 ee 23 14 00 fb 66 0f 1f 44 00 00 65 8b 05 f0 f4 f7 69 85 c0 74 3f 48 83 c4 08 5b c3 65 8b 05 9b fe f7 69 85 c0 75 8e <0f> 0b eb 8a 48 89 3c 24 e8 4e 20 14 00 48 8b 3c 24 eb 91 e8 13 4e RSP: 0018:ffffafd580b13298 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000201 RCX: 0000000000000000 RDX: 0000000000000003 RSI: 0000000000000201 RDI: ffffffffc1272389 RBP: ffff96517ae4c018 R08: 0000000000000001 R09: 0000000000000000 R10: ffffafd580b13178 R11: 0000000000000001 R12: ffff96517b060000 R13: 0000000000000000 R14: ffffffff80000000 R15: 0000000000000001 FS: 00007fc604ebefc0(0000) GS:ffff965267480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055fb3fef13b2 CR3: 0000000109112004 CR4: 00000000003706e0 Call Trace: ? _raw_spin_unlock_bh+0x1f/0x30 iwl_pcie_enqueue_hcmd+0x5d9/0xa00 [iwlwifi] iwl_trans_txq_send_hcmd+0x6c/0x430 [iwlwifi] iwl_trans_send_cmd+0x88/0x170 [iwlwifi] ? lock_acquire+0x277/0x3d0 iwl_mvm_send_cmd+0x32/0x80 [iwlmvm] iwl_mvm_led_set+0xc2/0xe0 [iwlmvm] ? led_trigger_event+0x46/0x70 led_trigger_event+0x46/0x70 ieee80211_do_open+0x5c5/0xa20 [mac80211] ieee80211_open+0x67/0x90 [mac80211] __dev_open+0xd4/0x150 __dev_change_flags+0x19e/0x1f0 dev_change_flags+0x23/0x60 do_setlink+0x30d/0x1230 ? lock_is_held_type+0xb4/0x120 ? __nla_validate_parse.part.7+0x57/0xcb0 ? __lock_acquire+0x2e1/0x1a50 __rtnl_newlink+0x560/0x910 ? __lock_acquire+0x2e1/0x1a50 ? __lock_acquire+0x2e1/0x1a50 ? lock_acquire+0x277/0x3d0 ? sock_def_readable+0x5/0x290 ? lock_is_held_type+0xb4/0x120 ? find_held_lock+0x2d/0x90 ? sock_def_readable+0xb3/0x290 ? lock_release+0x166/0x2a0 ? lock_is_held_type+0x90/0x120 rtnl_newlink+0x47/0x70 rtnetlink_rcv_msg+0x25c/0x470 ? netlink_deliver_tap+0x97/0x3e0 ? validate_linkmsg+0x350/0x350 netlink_rcv_skb+0x50/0x100 netlink_unicast+0x1b2/0x280 netlink_sendmsg+0x336/0x450 sock_sendmsg+0x5b/0x60 ____sys_sendmsg+0x1ed/0x250 ? copy_msghdr_from_user+0x5c/0x90 ___sys_sendmsg+0x88/0xd0 ? lock_is_held_type+0xb4/0x120 ? find_held_lock+0x2d/0x90 ? lock_release+0x166/0x2a0 ? __fget_files+0xfe/0x1d0 ? __sys_sendmsg+0x5e/0xa0 __sys_sendmsg+0x5e/0xa0 ? lockdep_hardirqs_on_prepare+0xd9/0x170 do_syscall_64+0x33/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc605c9572d Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 da ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 2e ef ff ff 48 RSP: 002b:00007fffc83789f0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000055ef468570c0 RCX: 00007fc605c9572d RDX: 0000000000000000 RSI: 00007fffc8378a30 RDI: 000000000000000c RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007fffc8378b80 R14: 00007fffc8378b7c R15: 0000000000000000 irq event stamp: 170785 hardirqs last enabled at (170783): [<ffffffff9609a8c2>] __local_bh_enable_ip+0x82/0xf0 hardirqs last disabled at (170784): [<ffffffff96a8613d>] _raw_read_lock_irqsave+0x8d/0x90 softirqs last enabled at (170782): [<ffffffffc1272389>] iwl_pcie_enqueue_hcmd+0x5d9/0xa00 [iwlwifi] softirqs last disabled at (170785): [<ffffffffc1271ec6>] iwl_pcie_enqueue_hcmd+0x116/0xa00 [iwlwifi]
--- drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/tx.c +4 -3
@@ -1473,6 +1473,7 @@ static int iwl_pcie_enqueue_hcmd(structu32 cmd_pos;const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD ];u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD ]; +unsigned long flags2; if (WARN(!trans->wide_cmd_header && group_id > IWL_ALWAYS_LONG_GROUP,
@@ -1556,10 +1557,10 @@ static int iwl_pcie_enqueue_hcmd(struct goto free_dup_buf; } -spin_lock_bh (&txq->lock); +spin_lock_irqsave (&txq->lock, flags2);if (iwl_queue_space (txq) < ((cmd->flags &CMD_ASYNC ) ?2 :1 )) { -spin_unlock_bh (&txq->lock); +spin_unlock_irqrestore (&txq->lock, flags2);IWL_ERR (trans,"No space in command queue\n" );iwl_op_mode_cmd_queue_full (trans->op_mode);
@@ -1720,7 +1721,7 @@ static int iwl_pcie_enqueue_hcmd(structspin_unlock_irqrestore (&trans_pcie->reg_lock, flags); out: -spin_unlock_bh (&txq->lock); +spin_unlock_irqrestore (&txq->lock, flags2); free_dup_buf:if (idx <0 )kfree (dup_buf);
Greg Kroah-Hartman
maintainerPATCH 8/323 MIPS: Introduce isa-rev.h to define MIPS_ISA_REV
In reply to Greg Kroah-HartmanFrom: Matt Redfearn <[email protected]>
commit 1690905240fd45cc04e873312df8574631c9f595 upstream
There are multiple instances in the kernel where we need to include or exclude particular instructions based on the ISA revision of the target processor. For MIPS32 / MIPS64, the compiler exports a __mips_isa_rev define. However, when targeting MIPS I - V, this define is absent. This leads to each use of __mips_isa_rev having to check that it is defined first. To simplify this, introduce the isa-rev.h header which always exports MIPS_ISA_REV. The name is changed so as to avoid confusion with the compiler builtin and to avoid accidentally using the builtin. MIPS_ISA_REV is defined to the compilers builtin if provided, or 0, which satisfies all current usages.
Patchwork: https://patchwork.linux-mips.org/patch/18676/
--- arch/mips/include/asm/isa-rev.h | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 arch/mips/include/asm/isa-rev.h
arch/mips/include/asm/isa-rev.h new file +24 -0
@@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* +* Copyright (C) 2018 MIPS Tech, LLC +* Author: Matt Redfearn <[email protected]> +*/ + +#ifndef __MIPS_ASM_ISA_REV_H__ +#define __MIPS_ASM_ISA_REV_H__ + +/* +* The ISA revision level. This is 0 for MIPS I to V and N for +* MIPS{32,64}rN. +*/ + +/* If the compiler has defined __mips_isa_rev, believe it. */ +#ifdef __mips_isa_rev +#define MIPS_ISA_REV __mips_isa_rev +#else +/* The compiler hasn't defined the isa rev so assume it's MIPS I - V (0) */ +#define MIPS_ISA_REV 0 +#endif + + +#endif /* __MIPS_ASM_ISA_REV_H__ */
Greg Kroah-Hartman
maintainerPATCH 9/323 MIPS: cpu-features.h: Replace __mips_isa_rev with MIPS_ISA_REV
In reply to Greg Kroah-HartmanFrom: Matt Redfearn <[email protected]>
commit 18ba210a29d08ea96025cb9d19c2eebf65846330 upstream
Remove the need to check that __mips_isa_rev is defined by using the newly added MIPS_ISA_REV.
Patchwork: https://patchwork.linux-mips.org/patch/18675/
--- arch/mips/include/asm/cpu-features.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/mips/include/asm/cpu-features.h +3 -2
@@ -11,6 +11,7 @@#include <asm/cpu.h> #include <asm/cpu-info.h> +#include <asm/isa-rev.h> #include <cpu-feature-overrides.h> /*
@@ -493,7 +494,7 @@# define cpu_has_perf (cpu_data[0].options & MIPS_CPU_PERF)#endif -#if defined(CONFIG_SMP ) && defined(__mips_isa_rev) && (__mips_isa_rev >=6 ) +#if defined(CONFIG_SMP ) && (MIPS_ISA_REV >=6 )/* * Some systems share FTLB RAMs between threads within a core (siblings in * kernel parlance). This means that FTLB entries may become invalid at almost
@@ -525,7 +526,7 @@# define cpu_has_shared_ftlb_entries \ (current_cpu_data.options & MIPS_CPU_SHARED_FTLB_ENTRIES)# endif -#endif /* SMP && __mips_isa_rev >= 6 */ +#endif /* SMP && MIPS_ISA_REV >= 6 */ #ifndef cpu_has_shared_ftlb_ram# define cpu_has_shared_ftlb_ram 0
Greg Kroah-Hartman
maintainerPATCH 10/323 mips: Do not include hi and lo in clobber list for R6
In reply to Greg Kroah-HartmanFrom: Romain Naour <[email protected]>
commit 1d7ba0165d8206ac073f7ac3b14fc0836b66eae7 upstream
Quoted 1 line
From [1]
"GCC 10 (PR 91233) won't silently allow registers that are not
architecturally available to be present in the clobber list anymore,
resulting in build failure for mips*r6 targets in form of:
....../sysdep.h:146:2: error: the register ‘lo’ cannot be clobbered in ‘asm’ for the current target
146 | __asm__ volatile ( \
| ^~~~~~~This is because base R6 ISA doesn't define hi and lo registers w/o DSP extension. This patch provides the alternative clobber list for r6 targets that won't include those registers."
Since kernel 5.4 and mips support for generic vDSO [2], the kernel fail to build for mips r6 cpus with gcc 10 for the same reason as glibc.
[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=020b2a97bb15f807c0482f0faee2184ed05bcad8
[2] '24640f233b46 ("mips: Add support for generic vDSO")'
--- arch/mips/vdso/gettimeofday.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
arch/mips/vdso/gettimeofday.c +12 -2
@@ -18,6 +18,12 @@#include <asm/unistd.h> #include <asm/vdso.h> +#if MIPS_ISA_REV <6 +#define VDSO_SYSCALL_CLOBBERS "hi", "lo", +#else +#define VDSO_SYSCALL_CLOBBERS +#endif +#ifdef CONFIG_MIPS_CLOCK_VSYSCALL static __always_inline long gettimeofday_fallback(struct timeval *_tv,
@@ -34,7 +40,9 @@ static __always_inline long gettimeofday : "=r" (ret), "=r" (error) : "r" (tv), "r" (tz), "r" (nr) : "$1", "$3", "$8", "$9", "$10", "$11", "$12", "$13", - "$14", "$15", "$24", "$25", "hi", "lo", "memory"); +"$14" ,"$15" ,"$24" ,"$25" , +VDSO_SYSCALL_CLOBBERS + "memory");return error ? -ret : ret; }
@@ -55,7 +63,9 @@ static __always_inline long clock_gettim : "=r" (ret), "=r" (error) : "r" (clkid), "r" (ts), "r" (nr) : "$1", "$3", "$8", "$9", "$10", "$11", "$12", "$13", - "$14", "$15", "$24", "$25", "hi", "lo", "memory"); +"$14" ,"$15" ,"$24" ,"$25" , +VDSO_SYSCALL_CLOBBERS + "memory");return error ? -ret : ret; }
Greg Kroah-Hartman
maintainerPATCH 11/323 bpf: Fix masking negation logic upon negative dst register
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
commit b9b34ddbe2076ade359cd5ce7537d5ed019e9807 upstream.
The negation logic for the case where the off_reg is sitting in the dst register is not correct given then we cannot just invert the add to a sub or vice versa. As a fix, perform the final bitwise and-op unconditionally into AX from the off_reg, then move the pointer from the src to dst and finally use AX as the source for the original pointer arithmetic operation such that the inversion yields a correct result. The single non-AX mov in between is possible given constant blinding is retaining it as it's not an immediate based operation.
--- kernel/bpf/verifier.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
kernel/bpf/verifier.c +4 -8
@@ -4816,14 +4816,10 @@ static int fixup_bpf_calls(struct bpf_ve *patch++ =BPF_ALU64_REG (BPF_OR ,BPF_REG_AX , off_reg); *patch++ =BPF_ALU64_IMM (BPF_NEG ,BPF_REG_AX ,0 ); *patch++ =BPF_ALU64_IMM (BPF_ARSH ,BPF_REG_AX ,63 ); -if (issrc) { - *patch++ =BPF_ALU64_REG (BPF_AND ,BPF_REG_AX , - off_reg); - insn->src_reg =BPF_REG_AX ; - }else { - *patch++ =BPF_ALU64_REG (BPF_AND , off_reg, -BPF_REG_AX ); - } + *patch++ =BPF_ALU64_REG (BPF_AND ,BPF_REG_AX , off_reg); +if (!issrc) + *patch++ =BPF_MOV64_REG (insn->dst_reg, insn->src_reg); + insn->src_reg =BPF_REG_AX ;if (isneg) insn->code = insn->code == code_add ? code_sub : code_add;
Greg Kroah-Hartman
maintainerPATCH 12/323 iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()
In reply to Greg Kroah-HartmanFrom: Jiri Kosina <[email protected]>
commit e7020bb068d8be50a92f48e36b236a1a1ef9282e upstream.
Analogically to what we did in 2800aadc18a6 ("iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd()"), we must apply the same fix to iwl_pcie_gen2_enqueue_hcmd(), as it's being called from exactly the same contexts.
--- drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +4 -3
@@ -559,6 +559,7 @@ static int iwl_pcie_gen2_enqueue_hcmd(stconst u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD ];u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD ];struct iwl_tfh_tfd *tfd =iwl_pcie_get_tfd (trans, txq, txq->write_ptr); +unsigned long flags2;memset (tfd,0 ,sizeof (*tfd));
@@ -629,10 +630,10 @@ static int iwl_pcie_gen2_enqueue_hcmd(st goto free_dup_buf; } -spin_lock_bh (&txq->lock); +spin_lock_irqsave (&txq->lock, flags2);if (iwl_queue_space (txq) < ((cmd->flags &CMD_ASYNC ) ?2 :1 )) { -spin_unlock_bh (&txq->lock); +spin_unlock_irqrestore (&txq->lock, flags2);IWL_ERR (trans,"No space in command queue\n" );iwl_op_mode_cmd_queue_full (trans->op_mode);
@@ -773,7 +774,7 @@ static int iwl_pcie_gen2_enqueue_hcmd(stspin_unlock_irqrestore (&trans_pcie->reg_lock, flags); out: -spin_unlock_bh (&txq->lock); +spin_unlock_irqrestore (&txq->lock, flags2); free_dup_buf:if (idx <0 )kfree (dup_buf);
Greg Kroah-Hartman
maintainerPATCH 13/323 ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 64f40f9be14106e7df0098c427cb60be645bddb7 upstream.
ToneLab EX guitar pedal device requires the same quirk like ToneLab ST for supporting the MIDI.
--- sound/usb/quirks-table.h | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/usb/quirks-table.h +10 -0
@@ -2479,6 +2479,16 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, +{ + USB_DEVICE_VENDOR_SPEC(0x0944, 0x0204), + .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + .vendor_name ="KORG, Inc." , +/* .product_name = "ToneLab EX", */ + .ifnum =3 , + .type =QUIRK_MIDI_STANDARD_INTERFACE , + } +}, +/* AKAI devices */ { USB_DEVICE(0x09e8, 0x0062),
Greg Kroah-Hartman
maintainerPATCH 14/323 USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit 8f23fe35ff1e5491b4d279323a8209a31f03ae65 upstream.
This is another branded 8153 device that doesn't work well with LPM enabled:
[ 400.597506] r8152 5-1.1:1.0 enx482ae3a2a6f0: Tx status -71
So disable LPM to resolve the issue.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -264,6 +264,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x1532, 0x0116), .driver_info = USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + /* Lenovo ThinkPad USB-C Dock Gen2 Ethernet (RTL8153 GigE) */ + { USB_DEVICE(0x17ef, 0xa387), .driver_info = USB_QUIRK_NO_LPM }, + /* BUILDWIN Photo Frame */ { USB_DEVICE(0x1908, 0x1315), .driver_info = USB_QUIRK_HONOR_BNUMINTERFACES },
Greg Kroah-Hartman
maintainerPATCH 15/323 USB: Add reset-resume quirk for WD19s Realtek Hub
In reply to Greg Kroah-HartmanFrom: Chris Chiu <[email protected]>
commit ca91fd8c7643d93bfc18a6fec1a0d3972a46a18a upstream.
Realtek Hub (0bda:5487) in Dell Dock WD19 sometimes fails to work after the system resumes from suspend with remote wakeup enabled device connected:
[ 1947.640907] hub 5-2.3:1.0: hub_ext_port_status failed (err = -71) [ 1947.641208] usb 5-2.3-port5: cannot disable (err = -71) [ 1947.641401] hub 5-2.3:1.0: hub_ext_port_status failed (err = -71) [ 1947.641450] usb 5-2.3-port4: cannot reset (err = -71)
Information of this hub:
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 5 D: Ver= 2.10 Cls=09(hub ) Sub=00 Prot=02 MxPS=64 #Cfgs= 1 P: Vendor=0bda ProdID=5487 Rev= 1.47 S: Manufacturer=Dell Inc. S: Product=Dell dock C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr= 0mA I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=01 Driver=hub E: Ad=81(I) Atr=03(Int.) MxPS= 1 Ivl=256ms
I:* If#= 0 Alt= 1 #EPs= 1 Cls=09(hub ) Sub=00 Prot=02 Driver=hub
E: Ad=81(I) Atr=03(Int.) MxPS= 1 Ivl=256ms
The failure results from the ETIMEDOUT by chance when turning on the suspend feature for the specified port of the hub. The port seems to be in an unknown state so the hub_activate during resume fails the hub_port_status, then the hub will fail to work.
The quirky hub needs the reset-resume quirk to function correctly.
--- drivers/usb/core/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/core/quirks.c +1 -0
@@ -245,6 +245,7 @@ static const struct usb_device_id usb_qu/* Realtek hub in Dell WD19 (Type-C) */ { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, + { USB_DEVICE(0x0bda, 0x5487), .driver_info = USB_QUIRK_RESET_RESUME }, /* Generic RTL8153 based ethernet adapters */ { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM },
Greg Kroah-Hartman
maintainerPATCH 16/323 platform/x86: thinkpad_acpi: Correct thermal sensor allocation
In reply to Greg Kroah-HartmanFrom: Mark Pearson <[email protected]>
commit 6759e18e5cd8745a5dfc5726e4a3db5281ec1639 upstream.
On recent Thinkpad platforms it was reported that temp sensor 11 was always incorrectly displaying 66C. It turns out the reason for this is that this location in EC RAM is not a temperature sensor but is the power supply ID (offset 0xC2).
Based on feedback from the Lenovo firmware team the EC RAM version can be determined and for the current version (3) only the 0x78 to 0x7F range is used for temp sensors. I don't have any details for earlier versions so I have left the implementation unaltered there.
Note - in this block only 0x78 and 0x79 are officially designated (CPU & GPU sensors). The use of the other locations in the block will vary from platform to platform; but the existing logic to detect a sensor presence holds.
--- drivers/platform/x86/thinkpad_acpi.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-)
drivers/platform/x86/thinkpad_acpi.c +22 -9
@@ -6162,6 +6162,7 @@ enum thermal_access_mode {enum {/* TPACPI_THERMAL_TPEC_* */ TP_EC_THERMAL_TMP0 =0x78 ,/* ACPI EC regs TMP 0..7 */ TP_EC_THERMAL_TMP8 =0xC0 ,/* ACPI EC regs TMP 8..15 */ +TP_EC_FUNCREV =0xEF ,/* ACPI EC Functional revision */ TP_EC_THERMAL_TMP_NA =-128 ,/* ACPI EC sensor not available */ TPACPI_THERMAL_SENSOR_NA =-128000 ,/* Sensor not available */
@@ -6360,7 +6361,7 @@ static const struct attribute_group therstatic int __init thermal_init (struct ibm_init_struct *iibm) { -u8 t, ta1, ta2; +u8 t, ta1, ta2, ver =0 ;int i;int acpi_tmp7;int res;
@@ -6375,7 +6376,14 @@ static int __init thermal_init(struct ib* 0x78-0x7F, 0xC0-0xC7. Registers return 0x00 for * non-implemented, thermal sensors return 0x80 when * not available +* The above rule is unfortunately flawed. This has been seen with +* 0xC2 (power supply ID) causing thermal control problems. +* The EC version can be determined by offset 0xEF and at least for +* version 3 the Lenovo firmware team confirmed that registers 0xC0-0xC7 +* are not thermal registers. */ +if (!acpi_ec_read (TP_EC_FUNCREV , &ver)) +pr_warn ("Thinkpad ACPI EC unable to access EC version\n" ); ta1 = ta2 =0 ;for (i =0 ; i <8 ; i++) {
@@ -6385,11 +6393,13 @@ static int __init thermal_init(struct ib ta1 =0 ;break ; } -if (acpi_ec_read (TP_EC_THERMAL_TMP8 + i, &t)) { - ta2 |= t; - }else { - ta1 =0 ; -break ; +if (ver <3 ) { +if (acpi_ec_read (TP_EC_THERMAL_TMP8 + i, &t)) { + ta2 |= t; + }else { + ta1 =0 ; +break ; + } } }if (ta1 ==0 ) {
@@ -6402,9 +6412,12 @@ static int __init thermal_init(struct ib thermal_read_mode =TPACPI_THERMAL_NONE ; } }else { - thermal_read_mode = - (ta2 !=0 ) ? -TPACPI_THERMAL_TPEC_16 :TPACPI_THERMAL_TPEC_8 ; +if (ver >=3 ) + thermal_read_mode =TPACPI_THERMAL_TPEC_8 ; +else + thermal_read_mode = + (ta2 !=0 ) ? +TPACPI_THERMAL_TPEC_16 :TPACPI_THERMAL_TPEC_8 ; } }else if (acpi_tmp7) { if (tpacpi_is_ibm() &&
Greg Kroah-Hartman
maintainerPATCH 17/323 s390/disassembler: increase ebpf disasm buffer size
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
commit 6f3353c2d2b3eb4de52e9704cb962712033db181 upstream.
Current ebpf disassembly buffer size of 64 is too small. E.g. this line takes 65 bytes:01fffff8005822e: ec8100ed8065\tclgrj\t%r8,%r1,8,001fffff80058408\n\0
Double the buffer size like it is done for the kernel disassembly buffer.
Fixes the following KASAN finding:
UG: KASAN: stack-out-of-bounds in print_fn_code+0x34c/0x380
Write of size 1 at addr 001fff800ad5f970 by task test_progs/853
CPU: 53 PID: 853 Comm: test_progs Not tainted
5.12.0-rc7-23786-g23457d86b1f0-dirty #19
Hardware name: IBM 3906 M04 704 (LPAR)
Call Trace:
[<0000000cd8e0538a>] show_stack+0x17a/0x1668
[<0000000cd8e2a5d8>] dump_stack+0x140/0x1b8
[<0000000cd8e16e74>] print_address_description.constprop.0+0x54/0x260
[<0000000cd75a8698>] kasan_report+0xc8/0x130
[<0000000cd6e26da4>] print_fn_code+0x34c/0x380
[<0000000cd6ea0f4e>] bpf_int_jit_compile+0xe3e/0xe58
[<0000000cd72c4c88>] bpf_prog_select_runtime+0x5b8/0x9c0
[<0000000cd72d1bf8>] bpf_prog_load+0xa78/0x19c0
[<0000000cd72d7ad6>] __do_sys_bpf.part.0+0x18e/0x768
[<0000000cd6e0f392>] do_syscall+0x12a/0x220
[<0000000cd8e333f8>] __do_syscall+0x98/0xc8
[<0000000cd8e54834>] system_call+0x6c/0x94
1 lock held by test_progs/853:
#0: 0000000cd9bf7460 (report_lock){....}-{2:2}, at:
kasan_report+0x96/0x130addr 001fff800ad5f970 is located in stack of task test_progs/853 at offset 96 in frame:
print_fn_code+0x0/0x380
this frame has 1 object:
[32, 96) 'buffer'
Memory state around the buggy address:
001fff800ad5f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001fff800ad5f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>001fff800ad5f900: 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 f3 f3
^
001fff800ad5f980: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001fff800ad5fa00: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00--- arch/s390/kernel/dis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/dis.c +1 -1
@@ -2026,7 +2026,7 @@ void show_code(struct pt_regs *regs)void print_fn_code (unsigned char *code,unsigned long len) { -char buffer[64 ], *ptr; +char buffer[128 ], *ptr;int opsize, i;while (len) {
Greg Kroah-Hartman
maintainerPATCH 18/323 ACPI: custom_method: fix potential use-after-free issue
In reply to Greg Kroah-HartmanFrom: Mark Langsdorf <[email protected]>
commit e483bb9a991bdae29a0caa4b3a6d002c968f94aa upstream.
In cm_write(), buf is always freed when reaching the end of the function. If the requested count is less than table.length, the allocated buffer will be freed but subsequent calls to cm_write() will still try to access it.
Remove the unconditional kfree(buf) at the end of the function and set the buf to NULL in the -EINVAL error path to match the rest of function.
--- drivers/acpi/custom_method.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/custom_method.c +1 -1
@@ -50,6 +50,7 @@ static ssize_t cm_write(struct file *fil (*ppos + count < count) || (count > uncopied_bytes)) {kfree (buf); + buf =NULL ;return -EINVAL ; }
@@ -71,7 +72,6 @@ static ssize_t cm_write(struct file *filadd_taint (TAINT_OVERRIDDEN_ACPI_TABLE ,LOCKDEP_NOW_UNRELIABLE ); } -kfree (buf);return count; }
Greg Kroah-Hartman
maintainerPATCH 19/323 ACPI: custom_method: fix a possible memory leak
In reply to Greg Kroah-HartmanFrom: Mark Langsdorf <[email protected]>
commit 1cfd8956437f842836e8a066b40d1ec2fc01f13e upstream.
In cm_write(), if the 'buf' is allocated memory but not fully consumed, it is possible to reallocate the buffer without freeing it by passing '*ppos' as 0 on a subsequent call.
Add an explicit kfree() before kzalloc() to prevent the possible memory leak.
--- drivers/acpi/custom_method.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/acpi/custom_method.c +2 -0
@@ -37,6 +37,8 @@ static ssize_t cm_write(struct file *fil sizeof(struct acpi_table_header)))return -EFAULT ; uncopied_bytes = max_size = table.length; +/* make sure the buf is not allocated */ +kfree (buf); buf =kzalloc (max_size,GFP_KERNEL );if (!buf)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 20/323 arm64: dts: mt8173: fix property typo of phys in dsi node
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
commit e4e5d030bd779fb8321d3b8bd65406fbe0827037 upstream.
Use 'phys' instead of 'phy'.
--- arch/arm64/boot/dts/mediatek/mt8173.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/mediatek/mt8173.dtsi +1 -1
@@ -1029,7 +1029,7 @@ <&mmsys CLK_MM_DSI1_DIGITAL>, <&mipi_tx1>; clock-names = "engine", "digital", "hs"; - phy = <&mipi_tx1>; + phys = <&mipi_tx1>; phy-names = "dphy"; status = "disabled"; };
Greg Kroah-Hartman
maintainerPATCH 21/323 ecryptfs: fix kernel panic with null dev_name
In reply to Greg Kroah-HartmanFrom: Jeffrey Mitchell <[email protected]>
commit 9046625511ad8dfbc8c6c2de16b3532c43d68d48 upstream.
When mounting eCryptfs, a null "dev_name" argument to ecryptfs_mount() causes a kernel panic if the parsed options are valid. The easiest way to reproduce this is to call mount() from userspace with an existing eCryptfs mount's options and a "source" argument of 0.
Error out if "dev_name" is null in ecryptfs_mount()
--- fs/ecryptfs/main.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ecryptfs/main.c +6 -0
@@ -506,6 +506,12 @@ static struct dentry *ecryptfs_mount(str goto out; } +if (!dev_name) { + rc = -EINVAL ; + err ="Device name cannot be null" ; + goto out; + } + rc =ecryptfs_parse_options (sbi, raw_data, &check_ruid);if (rc) { err ="Error parsing options" ;
Greg Kroah-Hartman
maintainerPATCH 22/323 spi: spi-ti-qspi: Free DMA resources
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
commit 1d309cd688a76fb733f0089d36dc630327b32d59 upstream.
Release the RX channel and free the dma coherent memory when devm_spi_register_master() fails.
--- drivers/spi/spi-ti-qspi.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
drivers/spi/spi-ti-qspi.c +14 -6
@@ -643,6 +643,17 @@ static int ti_qspi_runtime_resume(structreturn 0 ; } +static void ti_qspi_dma_cleanup (struct ti_qspi *qspi) +{ +if (qspi->rx_bb_addr) +dma_free_coherent (qspi->dev,QSPI_DMA_BUFFER_SIZE , + qspi->rx_bb_addr, + qspi->rx_bb_dma_addr); + +if (qspi->rx_chan) +dma_release_channel (qspi->rx_chan); +} +static const struct of_device_id ti_qspi_match[] = { {.compatible ="ti,dra7xxx-qspi" }, {.compatible ="ti,am4372-qspi" },
@@ -794,6 +805,8 @@ no_dma:if (!ret)return 0 ; +ti_qspi_dma_cleanup (qspi); +pm_runtime_disable (&pdev->dev); free_master:spi_master_put (master);
@@ -812,12 +825,7 @@ static int ti_qspi_remove(struct platforpm_runtime_put_sync (&pdev->dev);pm_runtime_disable (&pdev->dev); -if (qspi->rx_bb_addr) -dma_free_coherent (qspi->dev,QSPI_DMA_BUFFER_SIZE , - qspi->rx_bb_addr, - qspi->rx_bb_dma_addr); -if (qspi->rx_chan) -dma_release_channel (qspi->rx_chan); +ti_qspi_dma_cleanup (qspi);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 23/323 mmc: block: Update ext_csd.cache_ctrl if it was written
In reply to Greg Kroah-HartmanFrom: Avri Altman <[email protected]>
commit aea0440ad023ab0662299326f941214b0d7480bd upstream.
The cache function can be turned ON and OFF by writing to the CACHE_CTRL byte (EXT_CSD byte [33]). However, card->ext_csd.cache_ctrl is only set on init if cache size > 0.
Fix that by explicitly setting ext_csd.cache_ctrl on ext-csd write.
--- drivers/mmc/core/block.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/mmc/core/block.c +12 -0
@@ -599,6 +599,18 @@ static int __mmc_blk_ioctl_cmd(struct mm }/* +* Make sure to update CACHE_CTRL in case it was changed. The cache +* will get turned back on if the card is re-initialized, e.g. +* suspend/resume or hw reset in recovery. +*/ +if ((MMC_EXTRACT_INDEX_FROM_ARG (cmd.arg) ==EXT_CSD_CACHE_CTRL ) && + (cmd.opcode ==MMC_SWITCH )) { +u8 value =MMC_EXTRACT_VALUE_FROM_ARG (cmd.arg) &1 ; + + card->ext_csd.cache_ctrl = value; + } + +/* * According to the SD specs, some commands require a delay after * issuing the command. */
Greg Kroah-Hartman
maintainerPATCH 24/323 mmc: core: Do a power cycle when the CMD11 fails
In reply to Greg Kroah-HartmanFrom: DooHyun Hwang <[email protected]>
commit 147186f531ae49c18b7a9091a2c40e83b3d95649 upstream.
A CMD11 is sent to the SD/SDIO card to start the voltage switch procedure into 1.8V I/O. According to the SD spec a power cycle is needed of the card, if it turns out that the CMD11 fails. Let's fix this, to allow a retry of the initialization without the voltage switch, to succeed.
Note that, whether it makes sense to also retry with the voltage switch after the power cycle is a bit more difficult to know. At this point, we treat it like the CMD11 isn't supported and therefore we skip it when retrying.
--- drivers/mmc/core/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/core/core.c +1 -1
@@ -1506,7 +1506,7 @@ int mmc_set_uhs_voltage(struct mmc_host err =mmc_wait_for_cmd (host, &cmd,0 );if (err) -return err; + goto power_cycle;if (!mmc_host_is_spi (host) && (cmd.resp[0 ] &R1_ERROR ))return -EIO ;
Greg Kroah-Hartman
maintainerPATCH 25/323 mmc: core: Set read only for SD cards with permanent write protect bit
In reply to Greg Kroah-HartmanFrom: Seunghui Lee <[email protected]>
commit 917a5336f2c27928be270226ab374ed0cbf3805d upstream.
Some of SD cards sets permanent write protection bit in their CSD register, due to lifespan or internal problem. To avoid unnecessary I/O write operations, let's parse the bits in the CSD during initialization and mark the card as read only for this case.
--- drivers/mmc/core/sd.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/mmc/core/sd.c +6 -0
@@ -138,6 +138,9 @@ static int mmc_decode_csd(struct mmc_car csd->erase_size =UNSTUFF_BITS (resp,39 ,7 ) +1 ; csd->erase_size <<= csd->write_blkbits -9 ; } + +if (UNSTUFF_BITS (resp,13 ,1 )) +mmc_card_set_readonly (card);break ;case 1 :/*
@@ -172,6 +175,9 @@ static int mmc_decode_csd(struct mmc_car csd->write_blkbits =9 ; csd->write_partial =0 ; csd->erase_size =1 ; + +if (UNSTUFF_BITS (resp,13 ,1 )) +mmc_card_set_readonly (card);break ;default : pr_err("%s: unrecognised CSD structure version %d\n",
Greg Kroah-Hartman
maintainerPATCH 26/323 cifs: Return correct error code from smb2_get_enc_key
In reply to Greg Kroah-HartmanFrom: Paul Aurich <[email protected]>
commit 83728cbf366e334301091d5b808add468ab46b27 upstream.
Avoid a warning if the error percolates back up:
[440700.376476] CIFS VFS: \\otters.example.com crypt_message: Could not get encryption key [440700.386947] ------------[ cut here ]------------ [440700.386948] err = 1 [440700.386977] WARNING: CPU: 11 PID: 2733 at /build/linux-hwe-5.4-p6lk6L/linux-hwe-5.4-5.4.0/lib/errseq.c:74 errseq_set+0x5c/0x70 ... [440700.397304] CPU: 11 PID: 2733 Comm: tar Tainted: G OE 5.4.0-70-generic #78~18.04.1-Ubuntu ... [440700.397334] Call Trace: [440700.397346] __filemap_set_wb_err+0x1a/0x70 [440700.397419] cifs_writepages+0x9c7/0xb30 [cifs] [440700.397426] do_writepages+0x4b/0xe0 [440700.397444] __filemap_fdatawrite_range+0xcb/0x100 [440700.397455] filemap_write_and_wait+0x42/0xa0 [440700.397486] cifs_setattr+0x68b/0xf30 [cifs] [440700.397493] notify_change+0x358/0x4a0 [440700.397500] utimes_common+0xe9/0x1c0 [440700.397510] do_utimes+0xc5/0x150 [440700.397520] __x64_sys_utimensat+0x88/0xd0
--- fs/cifs/smb2ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2ops.c +1 -1
@@ -2273,7 +2273,7 @@ smb2_get_enc_key(struct TCP_Server_Info }spin_unlock (&cifs_tcp_ses_lock); -return 1 ; +return -EAGAIN ; }/* * Encrypt or decrypt @rqst message. @rqst has the following format:
Greg Kroah-Hartman
maintainerPATCH 27/323 btrfs: fix metadata extent leak after failure to create subvolume
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 67addf29004c5be9fa0383c82a364bb59afc7f84 upstream.
When creating a subvolume we allocate an extent buffer for its root node after starting a transaction. We setup a root item for the subvolume that points to that extent buffer and then attempt to insert the root item into the root tree - however if that fails, due to ENOMEM for example, we do not free the extent buffer previously allocated and we do not abort the transaction (as at that point we did nothing that can not be undone).
This means that we effectively do not return the metadata extent back to the free space cache/tree and we leave a delayed reference for it which causes a metadata extent item to be added to the extent tree, in the next transaction commit, without having backreferences. When this happens 'btrfs check' reports the following:
$ btrfs check /dev/sdi Opening filesystem to check... Checking filesystem on /dev/sdi UUID: dce2cb9d-025f-4b05-a4bf-cee0ad3785eb [1/7] checking root items [2/7] checking extents ref mismatch on [30425088 16384] extent item 1, found 0 backref 30425088 root 256 not referenced back 0x564a91c23d70 incorrect global backref count on 30425088 found 1 wanted 0 backpointer mismatch on [30425088 16384] owner ref check failed [30425088 16384] ERROR: errors found in extent allocation tree or chunk allocation [3/7] checking free space cache [4/7] checking fs roots [5/7] checking only csums items (without verifying data) [6/7] checking root refs [7/7] checking quota groups skipped (not enabled on this FS) found 212992 bytes used, error(s) found total csum bytes: 0 total tree bytes: 131072 total fs tree bytes: 32768 total extent tree bytes: 16384 btree space waste bytes: 124669 file data blocks allocated: 65536 referenced 65536
So fix this by freeing the metadata extent if btrfs_insert_root() returns an error.
--- fs/btrfs/ioctl.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
fs/btrfs/ioctl.c +15 -3
@@ -527,8 +527,6 @@ static noinline int create_subvol(structbtrfs_set_root_otransid (root_item, trans->transid);btrfs_tree_unlock (leaf); -free_extent_buffer (leaf); - leaf =NULL ;btrfs_set_root_dirid (root_item, new_dirid);
@@ -537,8 +535,22 @@ static noinline int create_subvol(struct key.type =BTRFS_ROOT_ITEM_KEY ; ret =btrfs_insert_root (trans, fs_info->tree_root, &key, root_item); -if (ret) +if (ret) { +/* +* Since we don't abort the transaction in this case, free the +* tree block so that we don't leak space and leave the +* filesystem in an inconsistent state (an extent item in the +* extent tree without backreferences). Also no need to have +* the tree block locked since it is not in any tree at this +* point, so no other task can find it and use it. +*/ +btrfs_free_tree_block (trans, root, leaf,0 ,1 ); +free_extent_buffer (leaf); goto fail; + } + +free_extent_buffer (leaf); + leaf =NULL ; key.offset = (u64)-1 ; new_root =btrfs_read_fs_root_no_name (fs_info, &key);
Greg Kroah-Hartman
maintainerPATCH 28/323 intel_th: pci: Add Rocket Lake CPU support
In reply to Greg Kroah-HartmanFrom: Alexander Shishkin <[email protected]>
commit 9f7f2a5e01ab4ee56b6d9c0572536fe5fd56e376 upstream.
This adds support for the Trace Hub in Rocket Lake CPUs.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -248,6 +248,11 @@ static const struct pci_device_id intel_ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1bcc), .driver_data = (kernel_ulong_t)&intel_th_2x, }, + { +/* Rocket Lake CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4c19), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, { 0 }, };
Greg Kroah-Hartman
maintainerPATCH 29/323 fbdev: zero-fill colormap in fbcmap.c
In reply to Greg Kroah-HartmanFrom: Phillip Potter <[email protected]>
commit 19ab233989d0f7ab1de19a036e247afa4a0a1e9c upstream.
Use kzalloc() rather than kmalloc() for the dynamically allocated parts of the colormap in fb_alloc_cmap_gfp, to prevent a leak of random kernel data to userspace under certain circumstances.
Fixes a KMSAN-found infoleak bug reported by syzbot at:
https://syzkaller.appspot.com/bug?id=741578659feabd108ad9e06696f0c1f2e69c4b6e
--- drivers/video/fbdev/core/fbcmap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/video/fbdev/core/fbcmap.c +4 -4
@@ -101,17 +101,17 @@ int fb_alloc_cmap_gfp(struct fb_cmap *cmif (!len)return 0 ; - cmap->red =kmalloc (size, flags); + cmap->red =kzalloc (size, flags);if (!cmap->red) goto fail; - cmap->green =kmalloc (size, flags); + cmap->green =kzalloc (size, flags);if (!cmap->green) goto fail; - cmap->blue =kmalloc (size, flags); + cmap->blue =kzalloc (size, flags);if (!cmap->blue) goto fail;if (transp) { - cmap->transp =kmalloc (size, flags); + cmap->transp =kzalloc (size, flags);if (!cmap->transp) goto fail; }else {
Greg Kroah-Hartman
maintainerPATCH 30/323 staging: wimax/i2400m: fix byte-order issue
In reply to Greg Kroah-HartmanFrom: karthik alapati <[email protected]>
[ Upstream commit 0c37baae130df39b19979bba88bde2ee70a33355 ]
fix sparse byte-order warnings by converting host byte-order type to __le16 byte-order types before assigning to hdr.length
--- drivers/net/wimax/i2400m/op-rfkill.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wimax/i2400m/op-rfkill.c +1 -1
@@ -101,7 +101,7 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,if (cmd ==NULL ) goto error_alloc; cmd->hdr.type =cpu_to_le16 (I2400M_MT_CMD_RF_CONTROL ); - cmd->hdr.length =sizeof (cmd->sw_rf); + cmd->hdr.length =cpu_to_le16 (sizeof (cmd->sw_rf)); cmd->hdr.version =cpu_to_le16 (I2400M_L3L4_VERSION ); cmd->sw_rf.hdr.type =cpu_to_le16 (I2400M_TLV_RF_OPERATION ); cmd->sw_rf.hdr.length =cpu_to_le16 (sizeof (cmd->sw_rf.status));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 31/323 crypto: api - check for ERR pointers in crypto_destroy_tfm()
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
[ Upstream commit 83681f2bebb34dbb3f03fecd8f570308ab8b7c2c ]
Given that crypto_alloc_tfm() may return ERR pointers, and to avoid crashes on obscure error paths where such pointers are presented to crypto_destroy_tfm() (such as [0]), add an ERR_PTR check there before dereferencing the second argument as a struct crypto_tfm pointer.
[0] https://lore.kernel.org/linux-crypto/[email protected]/
--- crypto/api.c | 2 +- include/crypto/acompress.h | 2 ++ include/crypto/aead.h | 2 ++ include/crypto/akcipher.h | 2 ++ include/crypto/hash.h | 4 ++++ include/crypto/kpp.h | 2 ++ include/crypto/rng.h | 2 ++ include/crypto/skcipher.h | 2 ++ 8 files changed, 17 insertions(+), 1 deletion(-)
crypto/api.c +1 -1
@@ -567,7 +567,7 @@ void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm) {struct crypto_alg *alg; -if (unlikely (!mem)) +if (IS_ERR_OR_NULL (mem))return ; alg = tfm->__crt_alg;
include/crypto/acompress.h +2 -0
@@ -152,6 +152,8 @@ static inline struct crypto_acomp *crypto_acomp_reqtfm(struct acomp_req *req)* crypto_free_acomp() -- free ACOMPRESS tfm handle * * @tfm: ACOMPRESS tfm handle allocated with crypto_alloc_acomp() +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_acomp (struct crypto_acomp *tfm) {
include/crypto/aead.h +2 -0
@@ -187,6 +187,8 @@ static inline struct crypto_tfm *crypto_aead_tfm(struct crypto_aead *tfm)/** * crypto_free_aead() - zeroize and free aead handle * @tfm: cipher handle to be freed +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_aead (struct crypto_aead *tfm) {
include/crypto/akcipher.h +2 -0
@@ -174,6 +174,8 @@ static inline struct crypto_akcipher *crypto_akcipher_reqtfm(* crypto_free_akcipher() - free AKCIPHER tfm handle * * @tfm: AKCIPHER tfm handle allocated with crypto_alloc_akcipher() +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_akcipher (struct crypto_akcipher *tfm) {
include/crypto/hash.h +4 -0
@@ -253,6 +253,8 @@ static inline struct crypto_tfm *crypto_ahash_tfm(struct crypto_ahash *tfm)/** * crypto_free_ahash() - zeroize and free the ahash handle * @tfm: cipher handle to be freed +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_ahash (struct crypto_ahash *tfm) {
@@ -689,6 +691,8 @@ static inline struct crypto_tfm *crypto_shash_tfm(struct crypto_shash *tfm)/** * crypto_free_shash() - zeroize and free the message digest handle * @tfm: cipher handle to be freed +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_shash (struct crypto_shash *tfm) {
include/crypto/kpp.h +2 -0
@@ -159,6 +159,8 @@ static inline void crypto_kpp_set_flags(struct crypto_kpp *tfm, u32 flags)* crypto_free_kpp() - free KPP tfm handle * * @tfm: KPP tfm handle allocated with crypto_alloc_kpp() +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_kpp (struct crypto_kpp *tfm) {
include/crypto/rng.h +2 -0
@@ -116,6 +116,8 @@ static inline struct rng_alg *crypto_rng_alg(struct crypto_rng *tfm)/** * crypto_free_rng() - zeroize and free RNG handle * @tfm: cipher handle to be freed +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_rng (struct crypto_rng *tfm) {
include/crypto/skcipher.h +2 -0
@@ -206,6 +206,8 @@ static inline struct crypto_tfm *crypto_skcipher_tfm(/** * crypto_free_skcipher() - zeroize and free cipher handle * @tfm: cipher handle to be freed +* +* If @tfm is a NULL or error pointer, this function does nothing. */ static inline void crypto_free_skcipher (struct crypto_skcipher *tfm) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 32/323 usb: gadget: uvc: add bInterval checking for HS mode
In reply to Greg Kroah-HartmanFrom: Pawel Laszczak <[email protected]>
[ Upstream commit 26adde04acdff14a1f28d4a5dce46a8513a3038b ]
Patch adds extra checking for bInterval passed by configfs. The 5.6.4 chapter of USB Specification (rev. 2.0) say:
"A high-bandwidth endpoint must specify a period of 1x125 µs (i.e., a bInterval value of 1)."
The issue was observed during testing UVC class on CV. I treat this change as improvement because we can control bInterval by configfs.
--- drivers/usb/gadget/function/f_uvc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_uvc.c +6 -1
@@ -625,7 +625,12 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f) uvc_hs_streaming_ep.wMaxPacketSize =cpu_to_le16 (max_packet_size | ((max_packet_mult -1 ) <<11 )); - uvc_hs_streaming_ep.bInterval = opts->streaming_interval; + +/* A high-bandwidth endpoint must specify a bInterval value of 1 */ +if (max_packet_mult >1 ) + uvc_hs_streaming_ep.bInterval =1 ; +else + uvc_hs_streaming_ep.bInterval = opts->streaming_interval; uvc_ss_streaming_ep.wMaxPacketSize =cpu_to_le16 (max_packet_size); uvc_ss_streaming_ep.bInterval = opts->streaming_interval;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 33/323 usb: gadget: f_uac1: validate input parameters
In reply to Greg Kroah-HartmanFrom: Ruslan Bilovol <[email protected]>
[ Upstream commit a59c68a6a3d1b18e2494f526eb19893a34fa6ec6 ]
Currently user can configure UAC1 function with parameters that violate UAC1 spec or are not supported by UAC1 gadget implementation.
This can lead to incorrect behavior if such gadget is connected to the host - like enumeration failure or other issues depending on host's UAC1 driver implementation, bringing user to a long hours of debugging the issue.
Instead of silently accept these parameters, throw an error if they are not valid.
--- drivers/usb/gadget/function/f_uac1.c | 43 ++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+)
drivers/usb/gadget/function/f_uac1.c +43 -0
@@ -23,6 +23,9 @@#include "u_audio.h" #include "u_uac1.h" +/* UAC1 spec: 3.7.2.3 Audio Channel Cluster Format */ +#define UAC1_CHANNEL_MASK 0x0FFF +struct f_uac1 {struct g_audio g_audio;u8 ac_intf, as_in_intf, as_out_intf;
@@ -34,6 +37,11 @@ static inline struct f_uac1 *func_to_uac1(struct usb_function *f) return container_of(f, struct f_uac1, g_audio.func); } +static inline struct f_uac1_opts *g_audio_to_uac1_opts (struct g_audio *audio) +{ + return container_of(audio->func.fi, struct f_uac1_opts, func_inst); +} +/* * DESCRIPTORS ... most are static, but strings and full * configuration descriptors are built on demand.
@@ -509,11 +517,42 @@ static void f_audio_disable(struct usb_function *f)/*-------------------------------------------------------------------------*/ +static int f_audio_validate_opts (struct g_audio *audio,struct device *dev) +{ +struct f_uac1_opts *opts =g_audio_to_uac1_opts (audio); + +if (!opts->p_chmask && !opts->c_chmask) { +dev_err (dev,"Error: no playback and capture channels\n" ); +return -EINVAL ; + }else if (opts->p_chmask & ~UAC1_CHANNEL_MASK ) { +dev_err (dev,"Error: unsupported playback channels mask\n" ); +return -EINVAL ; + }else if (opts->c_chmask & ~UAC1_CHANNEL_MASK ) { +dev_err (dev,"Error: unsupported capture channels mask\n" ); +return -EINVAL ; + }else if ((opts->p_ssize <1 ) || (opts->p_ssize >4 )) { +dev_err (dev,"Error: incorrect playback sample size\n" ); +return -EINVAL ; + }else if ((opts->c_ssize <1 ) || (opts->c_ssize >4 )) { +dev_err (dev,"Error: incorrect capture sample size\n" ); +return -EINVAL ; + }else if (!opts->p_srate) { +dev_err (dev,"Error: incorrect playback sampling rate\n" ); +return -EINVAL ; + }else if (!opts->c_srate) { +dev_err (dev,"Error: incorrect capture sampling rate\n" ); +return -EINVAL ; + } + +return 0 ; +} +/* audio function driver setup/binding */ static int f_audio_bind (struct usb_configuration *c,struct usb_function *f) {struct usb_composite_dev *cdev = c->cdev;struct usb_gadget *gadget = cdev->gadget; +struct device *dev = &gadget->dev;struct f_uac1 *uac1 =func_to_uac1 (f);struct g_audio *audio =func_to_g_audio (f);struct f_uac1_opts *audio_opts;
@@ -523,6 +562,10 @@ static int f_audio_bind(struct usb_configuration *c, struct usb_function *f)int rate;int status; + status =f_audio_validate_opts (audio, dev); +if (status) +return status; + audio_opts = container_of(f->fi, struct f_uac1_opts, func_inst); us =usb_gstrings_attach (cdev, uac1_strings,ARRAY_SIZE (strings_uac1));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 34/323 usb: dwc3: gadget: Ignore EP queue requests during bus reset
In reply to Greg Kroah-HartmanFrom: Wesley Cheng <[email protected]>
[ Upstream commit 71ca43f30df9c642970f9dc9b2d6f463f4967e7b ]
The current dwc3_gadget_reset_interrupt() will stop any active transfers, but only addresses blocking of EP queuing for while we are coming from a disconnected scenario, i.e. after receiving the disconnect event. If the host decides to issue a bus reset on the device, the connected parameter will still be set to true, allowing for EP queuing to continue while we are disabling the functions. To avoid this, set the connected flag to false until the stop active transfers is complete.
--- drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/dwc3/gadget.c +9 -0
@@ -2695,6 +2695,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) dwc->connected = true; +/* +* Ideally, dwc3_reset_gadget() would trigger the function +* drivers to stop any active transfers through ep disable. +* However, for functions which defer ep disable, such as mass +* storage, we will need to rely on the call to stop active +* transfers here, and avoid allowing of request queuing. +*/ + dwc->connected = false; +/* * WORKAROUND: DWC3 revisions <1.88a have an issue which * would cause a missing Disconnect Event if there's a
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 35/323 usb: xhci: Fix port minor revision
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
[ Upstream commit 64364bc912c01b33bba6c22e3ccb849bfca96398 ]
Some hosts incorrectly use sub-minor version for minor version (i.e. 0x02 instead of 0x20 for bcdUSB 0x320 and 0x01 for bcdUSB 0x310). Currently the xHCI driver works around this by just checking for minor revision > 0x01 for USB 3.1 everywhere. With the addition of USB 3.2, checking this gets a bit cumbersome. Since there is no USB release with bcdUSB 0x301 to 0x309, we can assume that sub-minor version 01 to 09 is incorrect. Let's try to fix this and use the minor revision that matches with the USB/xHCI spec to help with the version checking within the driver.
--- drivers/usb/host/xhci-mem.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/host/xhci-mem.c +9 -0
@@ -2085,6 +2085,15 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,if (major_revision ==0x03 ) { rhub = &xhci->usb3_rhub; +/* +* Some hosts incorrectly use sub-minor version for minor +* version (i.e. 0x02 instead of 0x20 for bcdUSB 0x320 and 0x01 +* for bcdUSB 0x310). Since there is no USB release with sub +* minor version 0x301 to 0x309, we can assume that they are +* incorrect and fix it here. +*/ +if (minor_revision >0x00 && minor_revision <0x10 ) + minor_revision <<=4 ; }else if (major_revision <=0x02 ) { rhub = &xhci->usb2_rhub; }else {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 36/323 PCI: PM: Do not read power state in pci_enable_device_flags()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 4514d991d99211f225d83b7e640285f29f0755d0 ]
It should not be necessary to update the current_state field of struct pci_dev in pci_enable_device_flags() before calling do_pci_enable_device() for the device, because none of the code between that point and the pci_set_power_state() call in do_pci_enable_device() invoked later depends on it.
Moreover, doing that is actively harmful in some cases. For example, if the given PCI device depends on an ACPI power resource whose _STA method initially returns 0 ("off"), but the config space of the PCI device is accessible and the power state retrieved from the PCI_PM_CTRL register is D0, the current_state field in the struct pci_dev representing that device will get out of sync with the power.state of its ACPI companion object and that will lead to power management issues going forward.
To avoid such issues it is better to leave the current_state value as is until it is changed to PCI_D0 by do_pci_enable_device() as appropriate. However, the power state of the device is not changed to PCI_D0 if it is already enabled when pci_enable_device_flags() gets called for it, so update its current_state in that case, but use pci_update_current_state() covering platform PM too for that.
--- drivers/pci/pci.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
drivers/pci/pci.c +3 -13
@@ -1378,20 +1378,10 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)int err;int i, bars =0 ; -/* -* Power state could be unknown at this point, either due to a fresh -* boot or a device removal call. So get the current power state -* so that things like MSI message writing will behave as expected -* (e.g. if the device really is in D0 at enable time). -*/ -if (dev->pm_cap) { -u16 pmcsr; -pci_read_config_word (dev, dev->pm_cap +PCI_PM_CTRL , &pmcsr); - dev->current_state = (pmcsr &PCI_PM_CTRL_STATE_MASK ); - } - -if (atomic_inc_return (&dev->enable_cnt) >1 ) +if (atomic_inc_return (&dev->enable_cnt) >1 ) { +pci_update_current_state (dev, dev->current_state);return 0 ;/* already enabled */ + } bridge =pci_upstream_bridge (dev);if (bridge)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 37/323 x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS)
In reply to Greg Kroah-HartmanFrom: John Millikin <[email protected]>
[ Upstream commit 8abe7fc26ad8f28bfdf78adbed56acd1fa93f82d ]
When cross-compiling with Clang, the $(CLANG_FLAGS)' variable contains additional flags needed to build C and assembly sources for the target platform. Normally this variable is automatically included in $(KBUILD_CFLAGS)' via the top-level Makefile.
The x86 real-mode makefile builds `$(REALMODE_CFLAGS)' from a plain assignment and therefore drops the Clang flags. This causes Clang to not recognize x86-specific assembler directives:
arch/x86/realmode/rm/header.S:36:1: error: unknown directive .type real_mode_header STT_OBJECT ; .size real_mode_header, .-real_mode_header ^
Explicit propagation of $(CLANG_FLAGS)' to $(REALMODE_CFLAGS)', which is inherited by real-mode make rules, fixes cross-compilation with Clang for x86 targets.
Relevant flags:
* --target' sets the target architecture when cross-compiling. This flag must be set for both compilation and assembly (KBUILD_AFLAGS') to support architecture-specific assembler directives.
* -no-integrated-as' tells clang to assemble with GNU Assembler instead of its built-in LLVM assembler. This flag is set by default unless LLVM_IAS=1' is set, because the LLVM assembler can't yet parse certain GNU extensions.
--- arch/x86/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/x86/Makefile +1 -0
@@ -41,6 +41,7 @@ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -ffreestanding REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -fno-stack-protector) REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -Wno-address-of-packed-member) REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), $(cc_stack_align4)) +REALMODE_CFLAGS += $(CLANG_FLAGS) export REALMODE_CFLAGS # BITS is used as extension for files which are available in a 32 bit
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 38/323 tee: optee: do not check memref size on return from Secure World
In reply to Greg Kroah-HartmanFrom: Jerome Forissier <[email protected]>
[ Upstream commit c650b8dc7a7910eb25af0aac1720f778b29e679d ]
When Secure World returns, it may have changed the size attribute of the memory references passed as [in/out] parameters. The GlobalPlatform TEE Internal Core API specification does not restrict the values that this size can take. In particular, Secure World may increase the value to be larger than the size of the input buffer to indicate that it needs more.
Therefore, the size check in optee_from_msg_param() is incorrect and needs to be removed. This fixes a number of failed test cases in the GlobalPlatform TEE Initial Configuratiom Test Suite v2_0_0_0-2017_06_09 when OP-TEE is compiled without dynamic shared memory support (CFG_CORE_DYN_SHM=n).
--- drivers/tee/optee/core.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/tee/optee/core.c +0 -10
@@ -86,16 +86,6 @@ int optee_from_msg_param(struct tee_param *params, size_t num_params,return rc; p->u.memref.shm_offs = mp->u.tmem.buf_ptr - pa; p->u.memref.shm = shm; - -/* Check that the memref is covered by the shm object */ -if (p->u.memref.size) { -size_t o = p->u.memref.shm_offs + - p->u.memref.size -1 ; - - rc =tee_shm_get_pa (shm, o,NULL ); -if (rc) -return rc; - }break ;default :return -EINVAL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 39/323 perf/arm_pmu_platform: Fix error handling
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
[ Upstream commit e338cb6bef254821a8c095018fd27254d74bfd6a ]
If we're aborting after failing to register the PMU device, we probably don't want to leak the IRQs that we've claimed.
--- drivers/perf/arm_pmu_platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/perf/arm_pmu_platform.c +1 -1
@@ -222,7 +222,7 @@ int arm_pmu_device_probe(struct platform_device *pdev, ret =armpmu_register (pmu);if (ret) - goto out_free; + goto out_free_irqs;return 0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 40/323 spi: dln2: Fix reference leak to master
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 9b844b087124c1538d05f40fda8a4fec75af55be ]
Call spi_master_get() holds the reference count to master device, thus we need an additional spi_master_put() call to reduce the reference count, otherwise we will leak a reference to master.
This commit fix it by removing the unnecessary spi_master_get().
--- drivers/spi/spi-dln2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-dln2.c +1 -1
@@ -783,7 +783,7 @@ exit_free_master:static int dln2_spi_remove (struct platform_device *pdev) { -struct spi_master *master =spi_master_get (platform_get_drvdata (pdev)); +struct spi_master *master =platform_get_drvdata (pdev);struct dln2_spi *dln2 =spi_master_get_devdata (master);pm_runtime_disable (&pdev->dev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 41/323 spi: omap-100k: Fix reference leak to master
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit a23faea76d4cf5f75decb574491e66f9ecd707e7 ]
Call spi_master_get() holds the reference count to master device, thus we need an additional spi_master_put() call to reduce the reference count, otherwise we will leak a reference to master.
This commit fix it by removing the unnecessary spi_master_get().
--- drivers/spi/spi-omap-100k.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/spi/spi-omap-100k.c +3 -3
@@ -435,7 +435,7 @@ err:static int omap1_spi100k_remove (struct platform_device *pdev) { -struct spi_master *master =spi_master_get (platform_get_drvdata (pdev)); +struct spi_master *master =platform_get_drvdata (pdev);struct omap1_spi100k *spi100k =spi_master_get_devdata (master);pm_runtime_disable (&pdev->dev);
@@ -449,7 +449,7 @@ static int omap1_spi100k_remove(struct platform_device *pdev)#ifdef CONFIG_PM static int omap1_spi100k_runtime_suspend (struct device *dev) { -struct spi_master *master =spi_master_get (dev_get_drvdata (dev)); +struct spi_master *master =dev_get_drvdata (dev);struct omap1_spi100k *spi100k =spi_master_get_devdata (master);clk_disable_unprepare (spi100k->ick);
@@ -460,7 +460,7 @@ static int omap1_spi100k_runtime_suspend(struct device *dev)static int omap1_spi100k_runtime_resume (struct device *dev) { -struct spi_master *master =spi_master_get (dev_get_drvdata (dev)); +struct spi_master *master =dev_get_drvdata (dev);struct omap1_spi100k *spi100k =spi_master_get_devdata (master);int ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 42/323 intel_th: Consistency and off-by-one fix
In reply to Greg Kroah-HartmanFrom: Pavel Machek <[email protected]>
[ Upstream commit 18ffbc47d45a1489b664dd68fb3a7610a6e1dea3 ]
Consistently use "< ... +1" in for loops.
Fix of-by-one in for_each_set_bit().
--- drivers/hwtracing/intel_th/gth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwtracing/intel_th/gth.c +2 -2
@@ -485,7 +485,7 @@ static void intel_th_gth_disable(struct intel_th_device *thdev, output->active = false;for_each_set_bit (master, gth->output[output->port].master, -TH_CONFIGURABLE_MASTERS ) { +TH_CONFIGURABLE_MASTERS +1 ) {gth_master_set (gth, master,-1 ); }spin_unlock (>h->gth_lock);
@@ -624,7 +624,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev, othdev->output.port =-1 ; othdev->output.active = false; gth->output[port].output =NULL ; -for (master =0 ; master <=TH_CONFIGURABLE_MASTERS ; master++) +for (master =0 ; master <TH_CONFIGURABLE_MASTERS +1 ; master++)if (gth->master[master] == port) gth->master[master] =-1 ;spin_unlock (>h->gth_lock);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 43/323 phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit e1723d8b87b73ab363256e7ca3af3ddb75855680 ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/phy/ti/phy-twl4030-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/ti/phy-twl4030-usb.c +1 -1
@@ -801,7 +801,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)usb_remove_phy (&twl->phy);pm_runtime_get_sync (twl->dev); -cancel_delayed_work (&twl->id_workaround_work); +cancel_delayed_work_sync (&twl->id_workaround_work);device_remove_file (twl->dev, &dev_attr_vbus);/* set transceiver mode to power on defaults */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 44/323 btrfs: convert logic BUG_ON()s in replace_path to ASSERT()s
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 7a9213a93546e7eaef90e6e153af6b8fc7553f10 ]
A few BUG_ON()'s in replace_path are purely to keep us from making logical mistakes, so replace them with ASSERT()'s.
--- fs/btrfs/relocation.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/btrfs/relocation.c +3 -3
@@ -1808,8 +1808,8 @@ int replace_path(struct btrfs_trans_handle *trans,int ret;int slot; -BUG_ON (src->root_key.objectid !=BTRFS_TREE_RELOC_OBJECTID ); -BUG_ON (dest->root_key.objectid ==BTRFS_TREE_RELOC_OBJECTID ); +ASSERT (src->root_key.objectid ==BTRFS_TREE_RELOC_OBJECTID ); +ASSERT (dest->root_key.objectid !=BTRFS_TREE_RELOC_OBJECTID ); last_snapshot =btrfs_root_last_snapshot (&src->root_item); again:
@@ -1841,7 +1841,7 @@ again: parent = eb;while (1 ) { level =btrfs_header_level (parent); -BUG_ON (level < lowest_level); +ASSERT (level >= lowest_level); ret =btrfs_bin_search (parent, &key, level, &slot);if (ret && slot >0 )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 45/323 scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 9302154c07bff4e7f7f43c506a1ac84540303d06 ]
The wqe_dbde field indicates whether a Data BDE is present in Words 0:2 and should therefore should be clear in the abts request wqe. By setting the bit we can be misleading fw into error cases.
Clear the wqe_dbde field.
--- drivers/scsi/lpfc/lpfc_nvmet.c | 1 - 1 file changed, 1 deletion(-)
drivers/scsi/lpfc/lpfc_nvmet.c +0 -1
@@ -2554,7 +2554,6 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,bf_set (wqe_rcvoxid, &wqe_abts->xmit_sequence.wqe_com, xri);/* Word 10 */ -bf_set (wqe_dbde, &wqe_abts->xmit_sequence.wqe_com,1 );bf_set (wqe_iod, &wqe_abts->xmit_sequence.wqe_com,LPFC_WQE_IOD_WRITE );bf_set (wqe_lenloc, &wqe_abts->xmit_sequence.wqe_com,LPFC_WQE_LENLOC_WORD12 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 46/323 scsi: lpfc: Fix pt2pt connection does not recover after LOGO
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit bd4f5100424d17d4e560d6653902ef8e49b2fc1f ]
On a pt2pt setup, between 2 initiators, if one side issues a a LOGO, there is no relogin attempt. The FC specs are grey in this area on which port (higher wwn or not) is to re-login.
As there is no spec guidance, unconditionally re-PLOGI after the logout to ensure a login is re-established.
--- drivers/scsi/lpfc/lpfc_nportdisc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_nportdisc.c +7 -2
@@ -708,9 +708,14 @@ lpfc_rcv_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, } }else if ((!(ndlp->nlp_type &NLP_FABRIC ) && ((ndlp->nlp_type &NLP_FCP_TARGET ) || - !(ndlp->nlp_type &NLP_FCP_INITIATOR ))) || + (ndlp->nlp_type &NLP_NVME_TARGET ) || + (vport->fc_flag &FC_PT2PT ))) || (ndlp->nlp_state ==NLP_STE_ADISC_ISSUE )) { -/* Only try to re-login if this is NOT a Fabric Node */ +/* Only try to re-login if this is NOT a Fabric Node +* AND the remote NPORT is a FCP/NVME Target or we +* are in pt2pt mode. NLP_STE_ADISC_ISSUE is a special +* case for LOGO as a response to ADISC behavior. +*/ mod_timer (&ndlp->nlp_delayfunc, jiffies +msecs_to_jiffies (1000 *1 ));spin_lock_irq (shost->host_lock);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 47/323 scsi: target: pscsi: Fix warning in pscsi_complete_cmd()
In reply to Greg Kroah-HartmanFrom: Chaitanya Kulkarni <[email protected]>
[ Upstream commit fd48c056a32ed6e7754c7c475490f3bed54ed378 ]
This fixes a compilation warning in pscsi_complete_cmd():
drivers/target/target_core_pscsi.c: In function ‘pscsi_complete_cmd’:
drivers/target/target_core_pscsi.c:624:5: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] ; /* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */
--- drivers/target/target_core_pscsi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/target/target_core_pscsi.c +2 -1
@@ -633,8 +633,9 @@ static void pscsi_complete_cmd(struct se_cmd *cmd, u8 scsi_status,unsigned char *buf; buf =transport_kmap_data_sg (cmd); -if (!buf) +if (!buf) { ;/* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */ + }if (cdb[0 ] ==MODE_SENSE_10 ) {if (!(buf[3 ] &0x80 ))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 48/323 media: ite-cir: check for receive overflow
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
[ Upstream commit 28c7afb07ccfc0a939bb06ac1e7afe669901c65a ]
It's best if this condition is reported.
--- drivers/media/rc/ite-cir.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/media/rc/ite-cir.c +7 -1
@@ -285,8 +285,14 @@ static irqreturn_t ite_cir_isr(int irq, void *data)/* read the interrupt flags */ iflags = dev->params.get_irq_causes (dev); +/* Check for RX overflow */ +if (iflags &ITE_IRQ_RX_FIFO_OVERRUN ) { +dev_warn (&dev->rdev->dev,"receive overflow\n" ); +ir_raw_event_reset (dev->rdev); + } +/* check for the receive interrupt */ -if (iflags & (ITE_IRQ_RX_FIFO |ITE_IRQ_RX_FIFO_OVERRUN )) { +if (iflags &ITE_IRQ_RX_FIFO ) {/* read the FIFO bytes */ rx_bytes = dev->params.get_rx_bytes(dev, rx_buf,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 49/323 power: supply: bq27xxx: fix power_avg for newer ICs
In reply to Greg Kroah-HartmanFrom: Matthias Schiffer <[email protected]>
[ Upstream commit c4d57c22ac65bd503716062a06fad55a01569cac ]
On all newer bq27xxx ICs, the AveragePower register contains a signed value; in addition to handling the raw value as unsigned, the driver code also didn't convert it to µW as expected.
At least for the BQ28Z610, the reference manual incorrectly states that the value is in units of 1mW and not 10mW. I have no way of knowing whether the manuals of other supported ICs contain the same error, or if there are models that actually use 1mW. At least, the new code shouldn't be *less* correct than the old version for any device.
power_avg is removed from the cache structure, se we don't have to extend it to store both a signed value and an error code. Always getting an up-to-date value may be desirable anyways, as it avoids inconsistent current and power readings when switching between charging and discharging.
--- drivers/power/supply/bq27xxx_battery.c | 51 ++++++++++++++------------ include/linux/power/bq27xxx_battery.h | 1 - 2 files changed, 27 insertions(+), 25 deletions(-)
drivers/power/supply/bq27xxx_battery.c +27 -24
@@ -1445,27 +1445,6 @@ static int bq27xxx_battery_read_time(struct bq27xxx_device_info *di, u8 reg)return tval *60 ; } -/* -* Read an average power register. -* Return < 0 if something fails. -*/ -static int bq27xxx_battery_read_pwr_avg (struct bq27xxx_device_info *di) -{ -int tval; - - tval =bq27xxx_read (di,BQ27XXX_REG_AP , false); -if (tval <0 ) { -dev_err (di->dev,"error reading average power register %02x: %d\n" , -BQ27XXX_REG_AP , tval); -return tval; - } - -if (di->opts &BQ27XXX_O_ZERO ) -return (tval *BQ27XXX_POWER_CONSTANT ) /BQ27XXX_RS ; -else -return tval; -} -/* * Returns true if a battery over temperature condition is detected */
@@ -1562,8 +1541,6 @@ void bq27xxx_battery_update(struct bq27xxx_device_info *di) }if (di->regs[BQ27XXX_REG_CYCT ] !=INVALID_REG_ADDR ) cache.cycle_count =bq27xxx_battery_read_cyct (di); -if (di->regs[BQ27XXX_REG_AP ] !=INVALID_REG_ADDR ) - cache.power_avg =bq27xxx_battery_read_pwr_avg (di);/* We only have to read charge design full once */ if (di->charge_design_full <=0 )
@@ -1625,6 +1602,32 @@ static int bq27xxx_battery_current(struct bq27xxx_device_info *di,return 0 ; } +/* +* Get the average power in µW +* Return < 0 if something fails. +*/ +static int bq27xxx_battery_pwr_avg (struct bq27xxx_device_info *di, +union power_supply_propval *val) +{ +int power; + + power =bq27xxx_read (di,BQ27XXX_REG_AP , false); +if (power <0 ) { +dev_err (di->dev, +"error reading average power register %02x: %d\n" , +BQ27XXX_REG_AP , power); +return power; + } + +if (di->opts &BQ27XXX_O_ZERO ) + val->intval = (power *BQ27XXX_POWER_CONSTANT ) /BQ27XXX_RS ; +else +/* Other gauges return a signed value in units of 10mW */ + val->intval = (int )((s16 )power) *10000 ; + +return 0 ; +} +static int bq27xxx_battery_status (struct bq27xxx_device_info *di,union power_supply_propval *val) {
@@ -1790,7 +1793,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy, ret =bq27xxx_simple_value (di->cache.energy, val);break ;case POWER_SUPPLY_PROP_POWER_AVG : - ret =bq27xxx_simple_value (di->cache.power_avg, val); + ret =bq27xxx_battery_pwr_avg (di, val);break ;case POWER_SUPPLY_PROP_HEALTH : ret =bq27xxx_simple_value (di->cache.health, val);
include/linux/power/bq27xxx_battery.h +0 -1
@@ -47,7 +47,6 @@ struct bq27xxx_reg_cache {int capacity;int energy;int flags; -int power_avg;int health; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 50/323 extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit c309a3e8793f7e01c4a4ec7960658380572cb576 ]
When the jack is partially inserted and then removed again it may be removed while the hpdet code is running. In this case the following may happen:
1. The "JACKDET rise" or ""JACKDET fall" IRQ triggers
2. arizona_jackdet runs and takes info->lock
3. The "HPDET" IRQ triggers
4. arizona_hpdet_irq runs, blocks on info->lock
5. arizona_jackdet calls arizona_stop_mic() and clears info->hpdet_done
6. arizona_jackdet releases info->lock
7. arizona_hpdet_irq now can continue running and:
7.1 Calls arizona_start_mic() (if a mic was detected)
7.2 sets info->hpdet_done
Step 7 is undesirable / a bug:
7.1 causes the device to stay in a high power-state (with MICVDD enabled) 7.2 causes hpdet to not run on the next jack insertion, which in turn
causes the EXTCON_JACK_HEADPHONE state to never get set
This fixes both issues by skipping these 2 steps when arizona_hpdet_irq runs after the jack has been unplugged.
--- drivers/extcon/extcon-arizona.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/extcon/extcon-arizona.c +9 -8
@@ -602,7 +602,7 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data)struct arizona *arizona = info->arizona;int id_gpio = arizona->pdata.hpdet_id_gpio;unsigned int report =EXTCON_JACK_HEADPHONE ; -int ret, reading; +int ret, reading, state;bool mic = false;mutex_lock (&info->lock);
@@ -615,12 +615,11 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data) }/* If the cable was removed while measuring ignore the result */ - ret =extcon_get_state (info->edev,EXTCON_MECHANICAL ); -if (ret <0 ) { -dev_err (arizona->dev,"Failed to check cable state: %d\n" , - ret); + state =extcon_get_state (info->edev,EXTCON_MECHANICAL ); +if (state <0 ) { +dev_err (arizona->dev,"Failed to check cable state: %d\n" , state); goto out; - }else if (!ret) { + }else if (!state) {dev_dbg (arizona->dev,"Ignoring HPDET for removed cable\n" ); goto done; }
@@ -673,7 +672,7 @@ done: ARIZONA_ACCDET_MODE_MASK, ARIZONA_ACCDET_MODE_MIC);/* If we have a mic then reenable MICDET */ -if (mic || info->mic) +if (state && (mic || info->mic))arizona_start_mic (info);if (info->hpdet_active) {
@@ -681,7 +680,9 @@ done: info->hpdet_active = false; } - info->hpdet_done = true; +/* Do not set hp_det done when the cable has been unplugged */ +if (state) + info->hpdet_done = true; out:mutex_unlock (&info->lock);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 51/323 media: media/saa7164: fix saa7164_encoder_register() memory leak bugs
In reply to Greg Kroah-HartmanFrom: Daniel Niv <[email protected]>
[ Upstream commit c759b2970c561e3b56aa030deb13db104262adfe ]
Add a fix for the memory leak bugs that can occur when the saa7164_encoder_register() function fails.
The function allocates memory without explicitly freeing
it when errors occur.
Add a better error handling that deallocate the unused buffers before the function exits during a fail.
--- drivers/media/pci/saa7164/saa7164-encoder.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/media/pci/saa7164/saa7164-encoder.c +11 -9
@@ -1024,7 +1024,7 @@ int saa7164_encoder_register(struct saa7164_port *port)printk (KERN_ERR "%s() failed (errno = %d), NO PCI configuration\n" , __func__, result); result = -ENOMEM ; - goto failed; + goto fail_pci; }/* Establish encoder defaults here */
@@ -1078,7 +1078,7 @@ int saa7164_encoder_register(struct saa7164_port *port) 100000, ENCODER_DEF_BITRATE);if (hdl->error) { result = hdl->error; - goto failed; + goto fail_hdl; } port->std =V4L2_STD_NTSC_M ;
@@ -1096,7 +1096,7 @@ int saa7164_encoder_register(struct saa7164_port *port)printk (KERN_INFO "%s: can't allocate mpeg device\n" , dev->name); result = -ENOMEM ; - goto failed; + goto fail_hdl; } port->v4l_device->ctrl_handler = hdl;
@@ -1107,10 +1107,7 @@ int saa7164_encoder_register(struct saa7164_port *port)if (result <0 ) {printk (KERN_INFO "%s: can't register mpeg device\n" , dev->name); -/* TODO: We're going to leak here if we don't dealloc -The buffers above. The unreg function can't deal wit it. -*/ - goto failed; + goto fail_reg; } printk(KERN_INFO "%s: registered device video%d [mpeg]\n",
@@ -1132,9 +1129,14 @@ int saa7164_encoder_register(struct saa7164_port *port)saa7164_api_set_encoder (port);saa7164_api_get_encoder (port); +return 0 ; - result =0 ; -failed: +fail_reg: +video_device_release (port->v4l_device); + port->v4l_device =NULL ; +fail_hdl: +v4l2_ctrl_handler_free (hdl); +fail_pci:return result; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 52/323 media: gspca/sq905.c: fix uninitialized variable
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit eaaea4681984c79d2b2b160387b297477f0c1aab ]
act_len can be uninitialized if usb_bulk_msg() returns an error. Set it to 0 to avoid a KMSAN error.
--- drivers/media/usb/gspca/sq905.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/gspca/sq905.c +1 -1
@@ -167,7 +167,7 @@ static int sq905_read_data(struct gspca_dev *gspca_dev, u8 *data, int size, int need_lock) { int ret; -int act_len; +int act_len =0 ; gspca_dev->usb_buf[0 ] ='\0' ;if (need_lock)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 53/323 power: supply: Use IRQF_ONESHOT
In reply to Greg Kroah-HartmanFrom: dongjian <[email protected]>
[ Upstream commit 2469b836fa835c67648acad17d62bc805236a6ea ]
Fixes coccicheck error:
drivers/power/supply/pm2301_charger.c:1089:7-27: ERROR:
drivers/power/supply/lp8788-charger.c:502:8-28: ERROR:
drivers/power/supply/tps65217_charger.c:239:8-33: ERROR:
drivers/power/supply/tps65090-charger.c:303:8-33: ERROR:
Threaded IRQ with no primary handler requested without IRQF_ONESHOT
--- drivers/power/supply/lp8788-charger.c | 2 +- drivers/power/supply/pm2301_charger.c | 2 +- drivers/power/supply/tps65090-charger.c | 2 +- drivers/power/supply/tps65217_charger.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
drivers/power/supply/lp8788-charger.c +1 -1
@@ -529,7 +529,7 @@ static int lp8788_set_irqs(struct platform_device *pdev, ret =request_threaded_irq (virq,NULL , lp8788_charger_irq_thread, -0 , name, pchg); +IRQF_ONESHOT , name, pchg);if (ret)break ; }
drivers/power/supply/pm2301_charger.c +1 -1
@@ -1098,7 +1098,7 @@ static int pm2xxx_wall_charger_probe(struct i2c_client *i2c_client, ret =request_threaded_irq (gpio_to_irq (pm2->pdata->gpio_irq_number),NULL , pm2xxx_charger_irq[0 ].isr, - pm2->pdata->irq_type, + pm2->pdata->irq_type |IRQF_ONESHOT , pm2xxx_charger_irq[0 ].name, pm2);if (ret !=0 ) {
drivers/power/supply/tps65090-charger.c +1 -1
@@ -311,7 +311,7 @@ static int tps65090_charger_probe(struct platform_device *pdev)if (irq != -ENXIO ) { ret =devm_request_threaded_irq (&pdev->dev, irq,NULL , - tps65090_charger_isr,0 ,"tps65090-charger" , cdata); + tps65090_charger_isr,IRQF_ONESHOT ,"tps65090-charger" , cdata);if (ret) { dev_err(cdata->dev, "Unable to register irq %d err %d\n", irq,
drivers/power/supply/tps65217_charger.c +1 -1
@@ -250,7 +250,7 @@ static int tps65217_charger_probe(struct platform_device *pdev)for (i =0 ; i <NUM_CHARGER_IRQS ; i++) { ret =devm_request_threaded_irq (&pdev->dev, irq[i],NULL , tps65217_charger_irq, -0 ,"tps65217-charger" , +IRQF_ONESHOT ,"tps65217-charger" , charger);if (ret) { dev_err(charger->dev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 54/323 drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f
In reply to Greg Kroah-HartmanFrom: shaoyunl <[email protected]>
[ Upstream commit c8941550aa66b2a90f4b32c45d59e8571e33336e ]
This recent change introduce SDMA interrupt info printing with irq->process function. These functions do not require a set function to enable/disable the irq
--- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c +1 -1
@@ -437,7 +437,7 @@ void amdgpu_irq_gpu_reset_resume_helper(struct amdgpu_device *adev)for (j =0 ; j <AMDGPU_MAX_IRQ_SRC_ID ; ++j) {struct amdgpu_irq_src *src = adev->irq.client[i].sources[j]; -if (!src) +if (!src || !src->funcs || !src->funcs->set)continue ;for (k =0 ; k < src->num_types; k++)amdgpu_irq_update (adev, src, k);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 55/323 scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats()
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit a2b2cc660822cae08c351c7f6b452bfd1330a4f7 ]
This patch fixes the following Coverity warning:
CID 361199 (#1 of 1): Unchecked return value (CHECKED_RETURN)
3. check_return: Calling qla24xx_get_isp_stats without checking return value (as is done elsewhere 4 out of 5 times).
--- drivers/scsi/qla2xxx/qla_attr.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_attr.c +7 -1
@@ -1914,6 +1914,8 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost) vha->qla_stats.jiffies_at_last_reset =get_jiffies_64 ();if (IS_FWI2_CAPABLE (ha)) { +int rval; + stats =dma_alloc_coherent (&ha->pdev->dev,sizeof (*stats), &stats_dma,GFP_KERNEL );if (!stats) {
@@ -1923,7 +1925,11 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost) }/* reset firmware statistics */ -qla24xx_get_isp_stats (base_vha, stats, stats_dma,BIT_0 ); + rval =qla24xx_get_isp_stats (base_vha, stats, stats_dma,BIT_0 ); +if (rval !=QLA_SUCCESS ) +ql_log (ql_log_warn, vha,0x70de , +"Resetting ISP statistics failed: rval = %d\n" , + rval);dma_free_coherent (&ha->pdev->dev,sizeof (*stats), stats, stats_dma);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 56/323 scsi: qla2xxx: Fix use after free in bsg
In reply to Greg Kroah-HartmanFrom: Quinn Tran <[email protected]>
[ Upstream commit 2ce35c0821afc2acd5ee1c3f60d149f8b2520ce8 ]
On bsg command completion, bsg_job_done() was called while qla driver continued to access the bsg_job buffer. bsg_job_done() would free up resources that ended up being reused by other task while the driver continued to access the buffers. As a result, driver was reading garbage data.
localhost kernel: BUG: KASAN: use-after-free in sg_next+0x64/0x80 localhost kernel: Read of size 8 at addr ffff8883228a3330 by task swapper/26/0 localhost kernel:
localhost kernel: CPU: 26 PID: 0 Comm: swapper/26 Kdump:
loaded Tainted: G OE --------- - - 4.18.0-193.el8.x86_64+debug #1
localhost kernel: Hardware name: HP ProLiant DL360
Gen9/ProLiant DL360 Gen9, BIOS P89 08/12/2016
localhost kernel: Call Trace:
localhost kernel: <IRQ>
localhost kernel: dump_stack+0x9a/0xf0
localhost kernel: print_address_description.cold.3+0x9/0x23b localhost kernel: kasan_report.cold.4+0x65/0x95
localhost kernel: debug_dma_unmap_sg.part.12+0x10d/0x2d0 localhost kernel: qla2x00_bsg_sp_free+0xaf6/0x1010 [qla2xxx]
--- drivers/scsi/qla2xxx/qla_bsg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_bsg.c +2 -1
@@ -19,10 +19,11 @@ qla2x00_bsg_job_done(void *ptr, int res)struct bsg_job *bsg_job = sp->u.bsg_job;struct fc_bsg_reply *bsg_reply = bsg_job->reply; + sp->free (sp); + bsg_reply->result = res;bsg_job_done (bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len); - sp->free (sp); }void
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 57/323 scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()
In reply to Greg Kroah-HartmanFrom: Ewan D. Milne <[email protected]>
[ Upstream commit bc3f2b42b70eb1b8576e753e7d0e117bbb674496 ]
Some arrays return ILLEGAL_REQUEST with ASC 00h if they don't support the RTPG extended header so remove the check for INVALID FIELD IN CDB.
--- drivers/scsi/device_handler/scsi_dh_alua.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/scsi/device_handler/scsi_dh_alua.c +3 -2
@@ -560,10 +560,11 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)* even though it shouldn't according to T10. * The retry without rtpg_ext_hdr_req set * handles this. +* Note: some arrays return a sense key of ILLEGAL_REQUEST +* with ASC 00h if they don't support the extended header. */ if (!(pg->flags &ALUA_RTPG_EXT_HDR_UNSUPP ) && - sense_hdr.sense_key ==ILLEGAL_REQUEST && - sense_hdr.asc ==0x24 && sense_hdr.ascq ==0 ) { + sense_hdr.sense_key ==ILLEGAL_REQUEST ) { pg->flags |=ALUA_RTPG_EXT_HDR_UNSUPP ; goto retry; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 58/323 media: em28xx: fix memory leak
In reply to Greg Kroah-HartmanFrom: Muhammad Usama Anjum <[email protected]>
[ Upstream commit 0ae10a7dc8992ee682ff0b1752ff7c83d472eef1 ]
If some error occurs, URB buffers should also be freed. If they aren't freed with the dvb here, the em28xx_dvb_fini call doesn't frees the URB buffers as dvb is set to NULL. The function in which error occurs should do all the cleanup for the allocations it had done.
Tested the patch with the reproducer provided by syzbot. This patch fixes the memleak.
--- drivers/media/usb/em28xx/em28xx-dvb.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/usb/em28xx/em28xx-dvb.c +1 -0
@@ -2056,6 +2056,7 @@ ret:return result; out_free: +em28xx_uninit_usb_xfer (dev,EM28XX_DIGITAL_MODE );kfree (dvb); dev->dvb =NULL ; goto ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 59/323 media: vivid: update EDID
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 443ec4bbc6116f6f492a7a1282bfd8422c862158 ]
The EDID had a few mistakes as reported by edid-decode:
Block 1, CTA-861 Extension Block:
Video Data Block: For improved preferred timing interoperability, set 'Native detailed modes' to 1. Video Capability Data Block: S_PT is equal to S_IT and S_CE, so should be set to 0 instead.
Fixed those.
--- drivers/media/platform/vivid/vivid-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/media/platform/vivid/vivid-core.c +3 -3
@@ -186,13 +186,13 @@ static const u8 vivid_hdmi_edid[256] = {0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x01 ,0x7b , -0x02 ,0x03 ,0x3f ,0xf0 ,0x51 ,0x61 ,0x60 ,0x5f , +0x02 ,0x03 ,0x3f ,0xf1 ,0x51 ,0x61 ,0x60 ,0x5f ,0x5e ,0x5d ,0x10 ,0x1f ,0x04 ,0x13 ,0x22 ,0x21 ,0x20 ,0x05 ,0x14 ,0x02 ,0x11 ,0x01 ,0x23 ,0x09 ,0x07 ,0x07 ,0x83 ,0x01 ,0x00 ,0x00 ,0x6d ,0x03 ,0x0c ,0x00 ,0x10 ,0x00 ,0x00 ,0x3c ,0x21 ,0x00 ,0x60 ,0x01 ,0x02 ,0x03 ,0x67 ,0xd8 ,0x5d ,0xc4 , -0x01 ,0x78 ,0x00 ,0x00 ,0xe2 ,0x00 ,0xea ,0xe3 , +0x01 ,0x78 ,0x00 ,0x00 ,0xe2 ,0x00 ,0xca ,0xe3 ,0x05 ,0x00 ,0x00 ,0xe3 ,0x06 ,0x01 ,0x00 ,0x4d ,0xd0 ,0x00 ,0xa0 ,0xf0 ,0x70 ,0x3e ,0x80 ,0x30 , 0x20, 0x35, 0x00, 0xc0, 0x1c, 0x32, 0x00, 0x00,
@@ -201,7 +201,7 @@ static const u8 vivid_hdmi_edid[256] = {0x00 ,0x00 ,0x1a ,0x1a ,0x1d ,0x00 ,0x80 ,0x51 ,0xd0 ,0x1c ,0x20 ,0x40 ,0x80 ,0x35 ,0x00 ,0xc0 ,0x1c ,0x32 ,0x00 ,0x00 ,0x1c ,0x00 ,0x00 ,0x00 , - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x82, }; static int vidioc_querycap(struct file *file, void *priv,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 60/323 clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 657d4d1934f75a2d978c3cf2086495eaa542e7a9 ]
There is an error return path that is not kfree'ing socfpga_clk leading to a memory leak. Fix this by adding in the missing kfree call.
Addresses-Coverity: ("Resource leak")
--- drivers/clk/socfpga/clk-gate-a10.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/socfpga/clk-gate-a10.c +1 -0
@@ -157,6 +157,7 @@ static void __init __socfpga_gate_init(struct device_node *node,if (IS_ERR (socfpga_clk->sys_mgr_base_addr)) {pr_err ("%s: failed to find altr,sys-mgr regmap!\n" , __func__); +kfree (socfpga_clk);return ; } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 61/323 power: supply: generic-adc-battery: fix possible use-after-free in gab_remove()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit b6cfa007b3b229771d9588970adb4ab3e0487f49 ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/power/supply/generic-adc-battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/generic-adc-battery.c +1 -1
@@ -384,7 +384,7 @@ static int gab_remove(struct platform_device *pdev) }kfree (adc_bat->psy_desc.properties); -cancel_delayed_work (&adc_bat->bat_work); +cancel_delayed_work_sync (&adc_bat->bat_work);return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 62/323 power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 68ae256945d2abe9036a7b68af4cc65aff79d5b7 ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/power/supply/s3c_adc_battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/s3c_adc_battery.c +1 -1
@@ -392,7 +392,7 @@ static int s3c_adc_bat_remove(struct platform_device *pdev)gpio_free (pdata->gpio_charge_finished); } -cancel_delayed_work (&bat_work); +cancel_delayed_work_sync (&bat_work);if (pdata->exit) pdata->exit ();
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 63/323 media: adv7604: fix possible use-after-free in adv76xx_remove()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit fa56f5f1fe31c2050675fa63b84963ebd504a5b3 ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/media/i2c/adv7604.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/adv7604.c +1 -1
@@ -3557,7 +3557,7 @@ static int adv76xx_remove(struct i2c_client *client)io_write (sd,0x6e ,0 );io_write (sd,0x73 ,0 ); -cancel_delayed_work (&state->delayed_work_enable_hotplug); +cancel_delayed_work_sync (&state->delayed_work_enable_hotplug);v4l2_async_unregister_subdev (sd);media_entity_cleanup (&sd->entity);adv76xx_unregister_clients (to_state (sd));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 64/323 media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 2c9541720c66899adf6f3600984cf3ef151295ad ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/media/i2c/adv7511-v4l2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/adv7511-v4l2.c +1 -1
@@ -1976,7 +1976,7 @@ static int adv7511_remove(struct i2c_client *client)adv7511_set_isr (sd, false);adv7511_init_setup (sd); -cancel_delayed_work (&state->edid_handler); +cancel_delayed_work_sync (&state->edid_handler);i2c_unregister_device (state->i2c_edid);if (state->i2c_cec)i2c_unregister_device (state->i2c_cec);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 65/323 media: i2c: adv7842: fix possible use-after-free in adv7842_remove()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 4a15275b6a18597079f18241c87511406575179a ]
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
--- drivers/media/i2c/adv7842.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/adv7842.c +1 -1
@@ -3599,7 +3599,7 @@ static int adv7842_remove(struct i2c_client *client)struct adv7842_state *state =to_state (sd);adv7842_irq_enable (sd, false); -cancel_delayed_work (&state->delayed_work_enable_hotplug); +cancel_delayed_work_sync (&state->delayed_work_enable_hotplug);v4l2_device_unregister_subdev (sd);media_entity_cleanup (&sd->entity);adv7842_unregister_clients (sd);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 66/323 media: dvb-usb: fix memory leak in dvb_usb_adapter_init
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit b7cd0da982e3043f2eec7235ac5530cb18d6af1d ]
syzbot reported memory leak in dvb-usb. The problem was in invalid error handling in dvb_usb_adapter_init().
for (n = 0; n < d->props.num_adapters; n++) {
....
if ((ret = dvb_usb_adapter_stream_init(adap)) ||
(ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) ||
(ret = dvb_usb_adapter_frontend_init(adap))) {
return ret;
}
...
d->num_adapters_initialized++;...
}
In case of error in dvb_usb_adapter_dvb_init() or dvb_usb_adapter_dvb_init() d->num_adapters_initialized won't be incremented, but dvb_usb_adapter_exit() relies on it:
for (n = 0; n < d->num_adapters_initialized; n++)
So, allocated objects won't be freed.
--- drivers/media/usb/dvb-usb/dvb-usb-init.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/media/usb/dvb-usb/dvb-usb-init.c +16 -4
@@ -82,11 +82,17 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) } } -if ((ret =dvb_usb_adapter_stream_init (adap)) || - (ret =dvb_usb_adapter_dvb_init (adap, adapter_nrs)) || - (ret =dvb_usb_adapter_frontend_init (adap))) { + ret =dvb_usb_adapter_stream_init (adap); +if (ret)return ret; - } + + ret =dvb_usb_adapter_dvb_init (adap, adapter_nrs); +if (ret) + goto dvb_init_err; + + ret =dvb_usb_adapter_frontend_init (adap); +if (ret) + goto frontend_init_err;/* use exclusive FE lock if there is multiple shared FEs */ if (adap->fe_adap[1 ].fe)
@@ -106,6 +112,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) }return 0 ; + +frontend_init_err: +dvb_usb_adapter_dvb_exit (adap); +dvb_init_err: +dvb_usb_adapter_stream_exit (adap); +return ret; }static int dvb_usb_adapter_exit (struct dvb_usb_device *d)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 67/323 media: gscpa/stv06xx: fix memory leak
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 4f4e6644cd876c844cdb3bea2dd7051787d5ae25 ]
For two of the supported sensors the stv06xx driver allocates memory which is stored in sd->sensor_priv. This memory is freed on a disconnect, but if the probe() fails, then it isn't freed and so this leaks memory.
Add a new probe_error() op that drivers can use to free any allocated memory in case there was a probe failure.
Thanks to Pavel Skripkin <[email protected]> for discovering the cause of the memory leak.
--- drivers/media/usb/gspca/gspca.c | 2 ++ drivers/media/usb/gspca/gspca.h | 1 + drivers/media/usb/gspca/stv06xx/stv06xx.c | 9 +++++++++ 3 files changed, 12 insertions(+)
drivers/media/usb/gspca/gspca.c +2 -0
@@ -2141,6 +2141,8 @@ out:#endif v4l2_ctrl_handler_free (gspca_dev->vdev.ctrl_handler);v4l2_device_unregister (&gspca_dev->v4l2_dev); +if (sd_desc->probe_error) + sd_desc->probe_error (gspca_dev);kfree (gspca_dev->usb_buf);kfree (gspca_dev);return ret;
drivers/media/usb/gspca/gspca.h +1 -0
@@ -102,6 +102,7 @@ struct sd_desc {cam_cf_op config;/* called on probe */ cam_op init;/* called on probe and resume */ cam_op init_controls;/* called on probe */ +cam_v_op probe_error;/* called if probe failed, do cleanup here */ cam_op start;/* called on stream on after URBs creation */ cam_pkt_op pkt_scan;/* optional operations */
drivers/media/usb/gspca/stv06xx/stv06xx.c +9 -0
@@ -534,12 +534,21 @@ static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,static int stv06xx_config (struct gspca_dev *gspca_dev,const struct usb_device_id *id); +static void stv06xx_probe_error (struct gspca_dev *gspca_dev) +{ +struct sd *sd = (struct sd *)gspca_dev; + +kfree (sd->sensor_priv); + sd->sensor_priv =NULL ; +} +/* sub-driver description */ static const struct sd_desc sd_desc = { .name =MODULE_NAME , .config = stv06xx_config, .init = stv06xx_init, .init_controls = stv06xx_init_controls, + .probe_error = stv06xx_probe_error, .start = stv06xx_start, .stopN = stv06xx_stopN, .pkt_scan = stv06xx_pkt_scan,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 68/323 drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal
In reply to Greg Kroah-HartmanFrom: Marijn Suijten <[email protected]>
[ Upstream commit 2ad52bdb220de5ab348098e3482b01235d15a842 ]
Leaving this at a close-to-maximum register value 0xFFF0 means it takes very long for the MDSS to generate a software vsync interrupt when the hardware TE interrupt doesn't arrive. Configuring this to double the vtotal (like some downstream kernels) leads to a frame to take at most twice before the vsync signal, until hardware TE comes up.
In this case the hardware interrupt responsible for providing this signal - "disp-te" gpio - is not hooked up to the mdp5 vsync/pp logic at all. This solves severe panel update issues observed on at least the Xperia Loire and Tone series, until said gpio is properly hooked up to an irq.
--- drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c +9 -1
@@ -78,9 +78,17 @@ static int pingpong_tearcheck_setup(struct drm_encoder *encoder, | MDP5_PP_SYNC_CONFIG_VSYNC_IN_EN; cfg |=MDP5_PP_SYNC_CONFIG_VSYNC_COUNT (vclks_line); +/* +* Tearcheck emits a blanking signal every vclks_line * vtotal * 2 ticks on +* the vsync_clk equating to roughly half the desired panel refresh rate. +* This is only necessary as stability fallback if interrupts from the +* panel arrive too late or not at all, but is currently used by default +* because these panel interrupts are not wired up yet. +*/ mdp5_write (mdp5_kms,REG_MDP5_PP_SYNC_CONFIG_VSYNC (pp_id), cfg);mdp5_write (mdp5_kms, -REG_MDP5_PP_SYNC_CONFIG_HEIGHT (pp_id),0xfff0 ); +REG_MDP5_PP_SYNC_CONFIG_HEIGHT (pp_id), (2 * mode->vtotal)); +mdp5_write (mdp5_kms,REG_MDP5_PP_VSYNC_INIT_VAL (pp_id), mode->vdisplay);mdp5_write (mdp5_kms,REG_MDP5_PP_RD_PTR_IRQ (pp_id), mode->vdisplay +1 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 69/323 drm/amdgpu: fix NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Guchun Chen <[email protected]>
[ Upstream commit 3c3dc654333f6389803cdcaf03912e94173ae510 ]
ttm->sg needs to be checked before accessing its child member.
Call Trace: amdgpu_ttm_backend_destroy+0x12/0x70 [amdgpu] ttm_bo_cleanup_memtype_use+0x3a/0x60 [ttm] ttm_bo_release+0x17d/0x300 [ttm] amdgpu_bo_unref+0x1a/0x30 [amdgpu] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x78b/0x8b0 [amdgpu] kfd_ioctl_alloc_memory_of_gpu+0x118/0x220 [amdgpu] kfd_ioctl+0x222/0x400 [amdgpu] ? kfd_dev_is_large_bar+0x90/0x90 [amdgpu] __x64_sys_ioctl+0x8e/0xd0 ? __context_tracking_exit+0x52/0x90 do_syscall_64+0x33/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f97f264d317 Code: b3 66 90 48 8b 05 71 4b 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 41 4b 2d 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdb402c338 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f97f3cc63a0 RCX: 00007f97f264d317 RDX: 00007ffdb402c380 RSI: 00000000c0284b16 RDI: 0000000000000003 RBP: 00007ffdb402c380 R08: 00007ffdb402c428 R09: 00000000c4000004 R10: 00000000c4000004 R11: 0000000000000246 R12: 00000000c0284b16 R13: 0000000000000003 R14: 00007f97f3cc63a0 R15: 00007f8836200000
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +1 -1
@@ -742,7 +742,7 @@ static void amdgpu_ttm_tt_unpin_userptr(struct ttm_tt *ttm) DMA_BIDIRECTIONAL :DMA_TO_DEVICE ;/* double check that we don't free the table twice */ -if (!ttm->sg->sgl) +if (!ttm->sg || !ttm->sg->sgl)return ;/* free the sg table and pages again */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 70/323 scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit fffd18ec6579c2d9c72b212169259062fe747888 ]
Fix a crash caused by a double put on the node when the driver completed an ACC for an unsolicted abort on the same node. The second put was executed by lpfc_nlp_not_used() and is wrong because the completion routine executes the nlp_put when the iocbq was released. Additionally, the driver is issuing a LOGO then immediately calls lpfc_nlp_set_state to put the node into NPR. This call does nothing.
Remove the lpfc_nlp_not_used call and additional set_state in the completion routine. Remove the lpfc_nlp_set_state post issue_logo. Isn't necessary.
--- drivers/scsi/lpfc/lpfc_nportdisc.c | 2 -- drivers/scsi/lpfc/lpfc_sli.c | 1 - 2 files changed, 3 deletions(-)
drivers/scsi/lpfc/lpfc_nportdisc.c +0 -2
@@ -1707,8 +1707,6 @@ lpfc_cmpl_reglogin_reglogin_issue(struct lpfc_vport *vport, ndlp->nlp_last_elscmd =ELS_CMD_PLOGI ;lpfc_issue_els_logo (vport, ndlp,0 ); - ndlp->nlp_prev_state =NLP_STE_REG_LOGIN_ISSUE ; -lpfc_nlp_set_state (vport, ndlp,NLP_STE_NPR_NODE );return ndlp->nlp_state; }
drivers/scsi/lpfc/lpfc_sli.c +0 -1
@@ -16637,7 +16637,6 @@ lpfc_sli4_seq_abort_rsp_cmpl(struct lpfc_hba *phba,if (cmd_iocbq) { ndlp = (struct lpfc_nodelist *)cmd_iocbq->context1;lpfc_nlp_put (ndlp); -lpfc_nlp_not_used (ndlp);lpfc_sli_release_iocbq (phba, cmd_iocbq); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 71/323 scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit b62232ba8caccaf1954e197058104a6478fac1af ]
SLI-4 does not contain a PORT_CAPABILITIES mailbox command (only SLI-3 does, and SLI-3 doesn't use it), yet there are SLI-4 code paths that have code to issue the command. The command will always fail.
Remove the code for the mailbox command and leave only the resulting "failure path" logic.
--- drivers/scsi/lpfc/lpfc_crtn.h | 3 - drivers/scsi/lpfc/lpfc_hw4.h | 174 +--------------------------------- drivers/scsi/lpfc/lpfc_init.c | 103 +------------------- drivers/scsi/lpfc/lpfc_mbox.c | 36 ------- 4 files changed, 3 insertions(+), 313 deletions(-)
drivers/scsi/lpfc/lpfc_crtn.h +0 -3
@@ -56,9 +56,6 @@ void lpfc_register_new_vport(struct lpfc_hba *, struct lpfc_vport *,void lpfc_unreg_vpi (struct lpfc_hba *,uint16_t ,LPFC_MBOXQ_t *);void lpfc_init_link (struct lpfc_hba *,LPFC_MBOXQ_t *,uint32_t ,uint32_t );void lpfc_request_features (struct lpfc_hba *,struct lpfcMboxq *); -void lpfc_supported_pages (struct lpfcMboxq *); -void lpfc_pc_sli4_params (struct lpfcMboxq *); -int lpfc_pc_sli4_params_get (struct lpfc_hba *,LPFC_MBOXQ_t *);int lpfc_sli4_mbox_rsrc_extent (struct lpfc_hba *,struct lpfcMboxq *,uint16_t ,uint16_t ,bool );int lpfc_get_sli4_parameters (struct lpfc_hba *,LPFC_MBOXQ_t *);
drivers/scsi/lpfc/lpfc_hw4.h +1 -173
198 lines not on this page · raw message
drivers/scsi/lpfc/lpfc_init.c +2 -101
127 lines not on this page · raw message
drivers/scsi/lpfc/lpfc_mbox.c +0 -36
@@ -2620,39 +2620,3 @@ lpfc_resume_rpi(struct lpfcMboxq *mbox, struct lpfc_nodelist *ndlp) resume_rpi->event_tag = ndlp->phba->fc_eventTag; } -/** -* lpfc_supported_pages - Initialize the PORT_CAPABILITIES supported pages -* mailbox command. -* @mbox: pointer to lpfc mbox command to initialize. -* -* The PORT_CAPABILITIES supported pages mailbox command is issued to -* retrieve the particular feature pages supported by the port. -**/ -void -lpfc_supported_pages (struct lpfcMboxq *mbox) -{ -struct lpfc_mbx_supp_pages *supp_pages; - -memset (mbox,0 ,sizeof (*mbox)); - supp_pages = &mbox->u.mqe.un.supp_pages; -bf_set (lpfc_mqe_command, &mbox->u.mqe,MBX_PORT_CAPABILITIES ); -bf_set (cpn, supp_pages,LPFC_SUPP_PAGES ); -} - -/** -* lpfc_pc_sli4_params - Initialize the PORT_CAPABILITIES SLI4 Params mbox cmd. -* @mbox: pointer to lpfc mbox command to initialize. -* -* The PORT_CAPABILITIES SLI4 parameters mailbox command is issued to -* retrieve the particular SLI4 features supported by the port. -**/ -void -lpfc_pc_sli4_params (struct lpfcMboxq *mbox) -{ -struct lpfc_mbx_pc_sli4_params *sli4_params; - -memset (mbox,0 ,sizeof (*mbox)); - sli4_params = &mbox->u.mqe.un.sli4_params; -bf_set (lpfc_mqe_command, &mbox->u.mqe,MBX_PORT_CAPABILITIES ); -bf_set (cpn, sli4_params,LPFC_SLI4_PARAMETERS ); -}
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 72/323 scsi: libfc: Fix a format specifier
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 90d6697810f06aceea9de71ad836a8c7669789cd ]
Since the 'mfs' member has been declared as 'u32' in include/scsi/libfc.h, use the %u format specifier instead of %hu. This patch fixes the following clang compiler warning:
warning: format specifies type
'unsigned short' but the argument has type 'u32' (aka 'unsigned int')
[-Wformat]
"lport->mfs:%hu\n", mfs, lport->mfs);
~~~ ^~~~~~~~~~
%u--- drivers/scsi/libfc/fc_lport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/libfc/fc_lport.c +1 -1
@@ -1754,7 +1754,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,if (mfs <FC_SP_MIN_MAX_PAYLOAD || mfs >FC_SP_MAX_MAX_PAYLOAD ) {FC_LPORT_DBG (lport,"FLOGI bad mfs:%hu response, " -"lport->mfs:%hu\n" , mfs, lport->mfs); +"lport->mfs:%u\n" , mfs, lport->mfs);fc_lport_error (lport, fp); goto out; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 73/323 ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
commit 1c98f574403dbcf2eb832d5535a10d967333ef2d upstream.
Our code analyzer reported a uaf.
In snd_emu8000_create_mixer, the callee snd_ctl_add(..,emu->controls[i]) calls snd_ctl_add_replace(.., kcontrol,..). Inside snd_ctl_add_replace(), if error happens, kcontrol will be freed by snd_ctl_free_one(kcontrol). Then emu->controls[i] points to a freed memory, and the execution comes to __error branch of snd_emu8000_create_mixer. The freed emu->controls[i] is used in snd_ctl_remove(card, emu->controls[i]).
My patch set emu->controls[i] to NULL if snd_ctl_add() failed to avoid the uaf.
--- sound/isa/sb/emu8000.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/isa/sb/emu8000.c +3 -1
@@ -1042,8 +1042,10 @@ snd_emu8000_create_mixer(struct snd_cardmemset (emu->controls,0 ,sizeof (emu->controls));for (i =0 ; i <EMU8000_NUM_CONTROLS ; i++) { -if ((err =snd_ctl_add (card, emu->controls[i] =snd_ctl_new1 (mixer_defs[i], emu))) <0 ) +if ((err =snd_ctl_add (card, emu->controls[i] =snd_ctl_new1 (mixer_defs[i], emu))) <0 ) { + emu->controls[i] =NULL ; goto __error; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 74/323 ALSA: hda/conexant: Re-order CX5066 quirk table entries
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 2e6a731296be9d356fdccee9fb6ae345dad96438 upstream.
Just re-order the cx5066_fixups[] entries for HP devices for avoiding the oversight of the duplicated or unapplied item in future. No functional changes.
Also Cc-to-stable for the further patch applications.
--- sound/pci/hda/patch_conexant.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
sound/pci/hda/patch_conexant.c +7 -7
@@ -948,18 +948,18 @@ static const struct snd_pci_quirk cxt506SND_PCI_QUIRK (0x103c ,0x8079 ,"HP EliteBook 840 G3" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x807C ,"HP EliteBook 820 G3" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x80FD ,"HP ProBook 640 G2" ,CXT_FIXUP_HP_DOCK ), -SND_PCI_QUIRK (0x103c ,0x828c ,"HP EliteBook 840 G4" ,CXT_FIXUP_HP_DOCK ), -SND_PCI_QUIRK (0x103c ,0x83b2 ,"HP EliteBook 840 G5" ,CXT_FIXUP_HP_DOCK ), -SND_PCI_QUIRK (0x103c ,0x83b3 ,"HP EliteBook 830 G5" ,CXT_FIXUP_HP_DOCK ), -SND_PCI_QUIRK (0x103c ,0x83d3 ,"HP ProBook 640 G4" ,CXT_FIXUP_HP_DOCK ), -SND_PCI_QUIRK (0x103c ,0x8174 ,"HP Spectre x360" ,CXT_FIXUP_HP_SPECTRE ),SND_PCI_QUIRK (0x103c ,0x8115 ,"HP Z1 Gen3" ,CXT_FIXUP_HP_GATE_MIC ),SND_PCI_QUIRK (0x103c ,0x814f ,"HP ZBook 15u G3" ,CXT_FIXUP_MUTE_LED_GPIO ), +SND_PCI_QUIRK (0x103c ,0x8174 ,"HP Spectre x360" ,CXT_FIXUP_HP_SPECTRE ),SND_PCI_QUIRK (0x103c ,0x822e ,"HP ProBook 440 G4" ,CXT_FIXUP_MUTE_LED_GPIO ), -SND_PCI_QUIRK (0x103c ,0x836e ,"HP ProBook 455 G5" ,CXT_FIXUP_MUTE_LED_GPIO ), -SND_PCI_QUIRK (0x103c ,0x837f ,"HP ProBook 470 G5" ,CXT_FIXUP_MUTE_LED_GPIO ), +SND_PCI_QUIRK (0x103c ,0x828c ,"HP EliteBook 840 G4" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x8299 ,"HP 800 G3 SFF" ,CXT_FIXUP_HP_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x103c ,0x829a ,"HP 800 G3 DM" ,CXT_FIXUP_HP_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x103c ,0x836e ,"HP ProBook 455 G5" ,CXT_FIXUP_MUTE_LED_GPIO ), +SND_PCI_QUIRK (0x103c ,0x837f ,"HP ProBook 470 G5" ,CXT_FIXUP_MUTE_LED_GPIO ), +SND_PCI_QUIRK (0x103c ,0x83b2 ,"HP EliteBook 840 G5" ,CXT_FIXUP_HP_DOCK ), +SND_PCI_QUIRK (0x103c ,0x83b3 ,"HP EliteBook 830 G5" ,CXT_FIXUP_HP_DOCK ), +SND_PCI_QUIRK (0x103c ,0x83d3 ,"HP ProBook 640 G4" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x8402 ,"HP ProBook 645 G4" ,CXT_FIXUP_MUTE_LED_GPIO ),SND_PCI_QUIRK (0x103c ,0x8455 ,"HP Z2 G4" ,CXT_FIXUP_HP_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
Greg Kroah-Hartman
maintainerPATCH 75/323 ALSA: sb: Fix two use after free in snd_sb_qsound_build
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
commit 4fb44dd2c1dda18606348acdfdb97e8759dde9df upstream.
In snd_sb_qsound_build, snd_ctl_add(..,p->qsound_switch...) and snd_ctl_add(..,p->qsound_space..) are called. But the second arguments of snd_ctl_add() could be freed via snd_ctl_add_replace() ->snd_ctl_free_one(). After the error code is returned, snd_sb_qsound_destroy(p) is called in __error branch.
But in snd_sb_qsound_destroy(), the freed p->qsound_switch and p->qsound_space are still used by snd_ctl_remove().
My patch set p->qsound_switch and p->qsound_space to NULL if snd_ctl_add() failed to avoid the uaf bugs. But these codes need to further be improved with the code style.
--- sound/isa/sb/sb16_csp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
sound/isa/sb/sb16_csp.c +6 -2
@@ -1059,10 +1059,14 @@ static int snd_sb_qsound_build(struct snspin_lock_init (&p->q_lock); -if ((err =snd_ctl_add (card, p->qsound_switch =snd_ctl_new1 (&snd_sb_qsound_switch, p))) <0 ) +if ((err =snd_ctl_add (card, p->qsound_switch =snd_ctl_new1 (&snd_sb_qsound_switch, p))) <0 ) { + p->qsound_switch =NULL ; goto __error; -if ((err =snd_ctl_add (card, p->qsound_space =snd_ctl_new1 (&snd_sb_qsound_space, p))) <0 ) + } +if ((err =snd_ctl_add (card, p->qsound_space =snd_ctl_new1 (&snd_sb_qsound_space, p))) <0 ) { + p->qsound_space =NULL ; goto __error; + }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 76/323 btrfs: fix race when picking most recent mod log operation for an old root
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit f9690f426b2134cc3e74bfc5d9dfd6a4b2ca5281 ]
Commit dbcc7d57bffc0c ("btrfs: fix race when cloning extent buffer during rewind of an old root"), fixed a race when we need to rewind the extent buffer of an old root. It was caused by picking a new mod log operation for the extent buffer while getting a cloned extent buffer with an outdated number of items (off by -1), because we cloned the extent buffer without locking it first.
However there is still another similar race, but in the opposite direction. The cloned extent buffer has a number of items that does not match the number of tree mod log operations that are going to be replayed. This is because right after we got the last (most recent) tree mod log operation to replay and before locking and cloning the extent buffer, another task adds a new pointer to the extent buffer, which results in adding a new tree mod log operation and incrementing the number of items in the extent buffer. So after cloning we have mismatch between the number of items in the extent buffer and the number of mod log operations we are going to apply to it. This results in hitting a BUG_ON() that produces the following stack trace:
------------[ cut here ]------------
kernel BUG at fs/btrfs/tree-mod-log.c:675!
invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 3 PID: 4811 Comm: crawl_1215 Tainted: G W 5.12.0-7d1efdf501f8-misc-next+ #99
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:tree_mod_log_rewind+0x3b1/0x3c0
Code: 05 48 8d 74 10 (...)
RSP: 0018:ffffc90001027090 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff8880a8514600 RCX: ffffffffaa9e59b6
RDX: 0000000000000007 RSI: dffffc0000000000 RDI: ffff8880a851462c
RBP: ffffc900010270e0 R08: 00000000000000c0 R09: ffffed1004333417
R10: ffff88802199a0b7 R11: ffffed1004333416 R12: 000000000000000e
R13: ffff888135af8748 R14: ffff88818766ff00 R15: ffff8880a851462c
FS: 00007f29acf62700(0000) GS:ffff8881f2200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0e6013f718 CR3: 000000010d42e003 CR4: 0000000000170ee0
Call Trace:
btrfs_get_old_root+0x16a/0x5c0
? lock_downgrade+0x400/0x400
btrfs_search_old_slot+0x192/0x520
? btrfs_search_slot+0x1090/0x1090
? free_extent_buffer.part.61+0xd7/0x140
? free_extent_buffer+0x13/0x20
resolve_indirect_refs+0x3e9/0xfc0
? lock_downgrade+0x400/0x400
? __kasan_check_read+0x11/0x20
? add_prelim_ref.part.11+0x150/0x150
? lock_downgrade+0x400/0x400
? __kasan_check_read+0x11/0x20
? lock_acquired+0xbb/0x620
? __kasan_check_write+0x14/0x20
? do_raw_spin_unlock+0xa8/0x140
? rb_insert_color+0x340/0x360
? prelim_ref_insert+0x12d/0x430
find_parent_nodes+0x5c3/0x1830
? stack_trace_save+0x87/0xb0
? resolve_indirect_refs+0xfc0/0xfc0
? fs_reclaim_acquire+0x67/0xf0
? __kasan_check_read+0x11/0x20
? lockdep_hardirqs_on_prepare+0x210/0x210
? fs_reclaim_acquire+0x67/0xf0
? __kasan_check_read+0x11/0x20
? ___might_sleep+0x10f/0x1e0
? __kasan_kmalloc+0x9d/0xd0
? trace_hardirqs_on+0x55/0x120
btrfs_find_all_roots_safe+0x142/0x1e0
? find_parent_nodes+0x1830/0x1830
? trace_hardirqs_on+0x55/0x120
? ulist_free+0x1f/0x30
? btrfs_inode_flags_to_xflags+0x50/0x50
iterate_extent_inodes+0x20e/0x580
? tree_backref_for_extent+0x230/0x230
? release_extent_buffer+0x225/0x280
? read_extent_buffer+0xdd/0x110
? lock_downgrade+0x400/0x400
? __kasan_check_read+0x11/0x20
? lock_acquired+0xbb/0x620
? __kasan_check_write+0x14/0x20
? do_raw_spin_unlock+0xa8/0x140
? _raw_spin_unlock+0x22/0x30
? release_extent_buffer+0x225/0x280
iterate_inodes_from_logical+0x129/0x170
? iterate_inodes_from_logical+0x129/0x170
? btrfs_inode_flags_to_xflags+0x50/0x50
? iterate_extent_inodes+0x580/0x580
? __vmalloc_node+0x92/0xb0
? init_data_container+0x34/0xb0
? init_data_container+0x34/0xb0
? kvmalloc_node+0x60/0x80
btrfs_ioctl_logical_to_ino+0x158/0x230
btrfs_ioctl+0x2038/0x4360
? __kasan_check_write+0x14/0x20
? mmput+0x3b/0x220
? btrfs_ioctl_get_supported_features+0x30/0x30
? __kasan_check_read+0x11/0x20
? __kasan_check_read+0x11/0x20
? lock_release+0xc8/0x650
? __might_fault+0x64/0xd0
? __kasan_check_read+0x11/0x20
? lock_downgrade+0x400/0x400
? lockdep_hardirqs_on_prepare+0x210/0x210
? lockdep_hardirqs_on_prepare+0x13/0x210
? _raw_spin_unlock_irqrestore+0x51/0x63
? __kasan_check_read+0x11/0x20
? do_vfs_ioctl+0xfc/0x9d0
? ioctl_file_clone+0xe0/0xe0
? lock_downgrade+0x400/0x400
? lockdep_hardirqs_on_prepare+0x210/0x210
? __kasan_check_read+0x11/0x20
? lock_release+0xc8/0x650
? __task_pid_nr_ns+0xd3/0x250
? __kasan_check_read+0x11/0x20
? __fget_files+0x160/0x230
? __fget_light+0xf2/0x110
__x64_sys_ioctl+0xc3/0x100
do_syscall_64+0x37/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f29ae85b427
Code: 00 00 90 48 8b (...)
RSP: 002b:00007f29acf5fcf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f29acf5ff40 RCX: 00007f29ae85b427
RDX: 00007f29acf5ff48 RSI: 00000000c038943b RDI: 0000000000000003
RBP: 0000000001000000 R08: 0000000000000000 R09: 00007f29acf60120
R10: 00005640d5fc7b00 R11: 0000000000000246 R12: 0000000000000003
R13: 00007f29acf5ff48 R14: 00007f29acf5ff40 R15: 00007f29acf5fef8
Modules linked in:
---[ end trace 85e5fce078dfbe04 ]--- (gdb) l *(tree_mod_log_rewind+0x3b1)
0xffffffff819e5b21 is in tree_mod_log_rewind (fs/btrfs/tree-mod-log.c:675).
670 * the modification. As we're going backwards, we do the 671 * opposite of each operation here. 672 */
673 switch (tm->op) {
674 case BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING:
675 BUG_ON(tm->slot < n);
676 fallthrough;
677 case BTRFS_MOD_LOG_KEY_REMOVE_WHILE_MOVING:
678 case BTRFS_MOD_LOG_KEY_REMOVE:
679 btrfs_set_node_key(eb, &tm->key, tm->slot);
(gdb) quit
The following steps explain in more detail how it happens:
1) We have one tree mod log user (through fiemap or the logical ino ioctl), with a sequence number of 1, so we have fs_info->tree_mod_seq == 1. This is task A;
2) Another task is at ctree.c:balance_level() and we have eb X currently as the root of the tree, and we promote its single child, eb Y, as the new root.
Then, at ctree.c:balance_level(), we call:
ret = btrfs_tree_mod_log_insert_root(root->node, child, true);
3) At btrfs_tree_mod_log_insert_root() we create a tree mod log operation of type BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING, with a ->logical field pointing to ebX->start. We only have one item in eb X, so we create only one tree mod log operation, and store in the "tm_list" array;
4) Then, still at btrfs_tree_mod_log_insert_root(), we create a tree mod log element of operation type BTRFS_MOD_LOG_ROOT_REPLACE, ->logical set to ebY->start, ->old_root.logical set to ebX->start, ->old_root.level set to the level of eb X and ->generation set to the generation of eb X;
5) Then btrfs_tree_mod_log_insert_root() calls tree_mod_log_free_eb() with "tm_list" as argument. After that, tree_mod_log_free_eb() calls tree_mod_log_insert(). This inserts the mod log operation of type BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING from step 3 into the rbtree with a sequence number of 2 (and fs_info->tree_mod_seq set to 2);
6) Then, after inserting the "tm_list" single element into the tree mod log rbtree, the BTRFS_MOD_LOG_ROOT_REPLACE element is inserted, which gets the sequence number 3 (and fs_info->tree_mod_seq set to 3);
7) Back to ctree.c:balance_level(), we free eb X by calling btrfs_free_tree_block() on it. Because eb X was created in the current transaction, has no other references and writeback did not happen for it, we add it back to the free space cache/tree;
8) Later some other task B allocates the metadata extent from eb X, since it is marked as free space in the space cache/tree, and uses it as a node for some other btree;
9) The tree mod log user task calls btrfs_search_old_slot(), which calls btrfs_get_old_root(), and finally that calls tree_mod_log_oldest_root() with time_seq == 1 and eb_root == eb Y;
10) The first iteration of the while loop finds the tree mod log element with sequence number 3, for the logical address of eb Y and of type BTRFS_MOD_LOG_ROOT_REPLACE;
11) Because the operation type is BTRFS_MOD_LOG_ROOT_REPLACE, we don't
break out of the loop, and set root_logical to point to
tm->old_root.logical, which corresponds to the logical address of
eb X;12) On the next iteration of the while loop, the call to tree_mod_log_search_oldest() returns the smallest tree mod log element for the logical address of eb X, which has a sequence number of 2, an operation type of BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING and corresponds to the old slot 0 of eb X (eb X had only 1 item in it before being freed at step 7);
13) We then break out of the while loop and return the tree mod log operation of type BTRFS_MOD_LOG_ROOT_REPLACE (eb Y), and not the one for slot 0 of eb X, to btrfs_get_old_root();
14) At btrfs_get_old_root(), we process the BTRFS_MOD_LOG_ROOT_REPLACE operation and set "logical" to the logical address of eb X, which was the old root. We then call tree_mod_log_search() passing it the logical address of eb X and time_seq == 1;
15) But before calling tree_mod_log_search(), task B locks eb X, adds a key to eb X, which results in adding a tree mod log operation of type BTRFS_MOD_LOG_KEY_ADD, with a sequence number of 4, to the tree mod log, and increments the number of items in eb X from 0 to 1. Now fs_info->tree_mod_seq has a value of 4;
16) Task A then calls tree_mod_log_search(), which returns the most recent tree mod log operation for eb X, which is the one just added by task B at the previous step, with a sequence number of 4, a type of BTRFS_MOD_LOG_KEY_ADD and for slot 0;
17) Before task A locks and clones eb X, task A adds another key to eb X, which results in adding a new BTRFS_MOD_LOG_KEY_ADD mod log operation, with a sequence number of 5, for slot 1 of eb X, increments the number of items in eb X from 1 to 2, and unlocks eb X.
Now fs_info->tree_mod_seq has a value of 5;
18) Task A then locks eb X and clones it. The clone has a value of 2 for the number of items and the pointer "tm" points to the tree mod log operation with sequence number 4, not the most recent one with a sequence number of 5, so there is mismatch between the number of mod log operations that are going to be applied to the cloned version of eb X and the number of items in the clone;
19) Task A then calls tree_mod_log_rewind() with the clone of eb X, the tree mod log operation with sequence number 4 and a type of BTRFS_MOD_LOG_KEY_ADD, and time_seq == 1;
20) At tree_mod_log_rewind(), we set the local variable "n" with a value of 2, which is the number of items in the clone of eb X.
Then in the first iteration of the while loop, we process the mod log operation with sequence number 4, which is targeted at slot 0 and has a type of BTRFS_MOD_LOG_KEY_ADD. This results in decrementing "n" from 2 to 1.
Then we pick the next tree mod log operation for eb X, which is the tree mod log operation with a sequence number of 2, a type of BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING and for slot 0, it is the one added in step 5 to the tree mod log tree.
We go back to the top of the loop to process this mod log operation, and because its slot is 0 and "n" has a value of 1, we hit the BUG_ON:
(...)
switch (tm->op) {
case BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING:
BUG_ON(tm->slot < n); fallthrough;
(...)
Fix this by checking for a more recent tree mod log operation after locking and cloning the extent buffer of the old root node, and use it as the first operation to apply to the cloned extent buffer when rewinding it.
Stable backport notes: due to moved code and renames, in =< 5.11 the change should be applied to ctree.c:get_old_root.
--- fs/btrfs/ctree.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
fs/btrfs/ctree.c +20 -0
@@ -1431,10 +1431,30 @@ get_old_root(struct btrfs_root *root, u64 time_seq)"failed to read tree block %llu from get_old_root" , logical); }else { +struct tree_mod_elem *tm2; +btrfs_tree_read_lock (old); eb =btrfs_clone_extent_buffer (old); +/* +* After the lookup for the most recent tree mod operation +* above and before we locked and cloned the extent buffer +* 'old', a new tree mod log operation may have been added. +* So lookup for a more recent one to make sure the number +* of mod log operations we replay is consistent with the +* number of items we have in the cloned extent buffer, +* otherwise we can hit a BUG_ON when rewinding the extent +* buffer. +*/ + tm2 =tree_mod_log_search (fs_info, logical, time_seq);btrfs_tree_read_unlock (old);free_extent_buffer (old); +ASSERT (tm2); +ASSERT (tm2 == tm || tm2->seq > tm->seq); +if (!tm2 || tm2->seq < tm->seq) { +free_extent_buffer (eb); +return NULL ; + } + tm = tm2; } }else if (old_root) { eb_root_owner =btrfs_header_owner (eb_root);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 77/323 arm64/vdso: Discard .note.gnu.property sections in vDSO
In reply to Greg Kroah-HartmanFrom: Bill Wendling <[email protected]>
[ Upstream commit 388708028e6937f3fc5fc19aeeb847f8970f489c ]
The arm64 assembler in binutils 2.32 and above generates a program property note in a note section, .note.gnu.property, to encode used x86 ISAs and features. But the kernel linker script only contains a single NOTE segment:
PHDRS
{
text PT_LOAD FLAGS(5) FILEHDR PHDRS; /* PF_R|PF_X */
dynamic PT_DYNAMIC FLAGS(4); /* PF_R */
note PT_NOTE FLAGS(4); /* PF_R */
}The NOTE segment generated by the vDSO linker script is aligned to 4 bytes. But the .note.gnu.property section must be aligned to 8 bytes on arm64.
$ readelf -n vdso64.so
Displaying notes found in: .note
Owner Data size Description
Linux 0x00000004 Unknown note type: (0x00000000)
description data: 06 00 00 00 readelf: Warning: note with invalid namesz and/or descsz found at offset 0x20
readelf: Warning: type: 0x78, namesize: 0x00000100, descsize: 0x756e694c, alignment: 8
Since the note.gnu.property section in the vDSO is not checked by the dynamic linker, discard the .note.gnu.property sections in the vDSO.
Similar to commit 4caffe6a28d31 ("x86/vdso: Discard .note.gnu.property sections in vDSO"), but for arm64.
--- arch/arm64/kernel/vdso/vdso.lds.S | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
arch/arm64/kernel/vdso/vdso.lds.S +7 -1
@@ -39,6 +39,13 @@ SECTIONS .gnu.version_d : { *(.gnu.version_d) } .gnu.version_r : { *(.gnu.version_r) } + /* + * Discard .note.gnu.property sections which are unused and have + * different alignment requirement from vDSO note sections. + */ + /DISCARD/ : { + *(.note.GNU-stack .note.gnu.property) + } .note : { *(.note.*) } :text :note . = ALIGN(16);
@@ -59,7 +66,6 @@ SECTIONS PROVIDE(end = .); /DISCARD/ : { - *(.note.GNU-stack) *(.data .data.* .gnu.linkonce.d.* .sdata*) *(.bss .sbss .dynbss .dynsbss) }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 78/323 openvswitch: fix stack OOB read while fragmenting IPv4 packets
In reply to Greg Kroah-HartmanFrom: Davide Caratti <[email protected]>
commit 7c0ea5930c1c211931819d83cfb157bff1539a4c upstream.
running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets:
BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367 CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 Call Trace: dump_stack+0x92/0xc1 print_address_description.constprop.7+0x1a/0x150 kasan_report.cold.13+0x7f/0x111 ip_do_fragment+0x1b03/0x1f60 ovs_fragment+0x5bf/0x840 [openvswitch] do_execute_actions+0x1bd5/0x2400 [openvswitch] ovs_execute_actions+0xc8/0x3d0 [openvswitch] ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch] genl_family_rcv_msg_doit.isra.15+0x227/0x2d0 genl_rcv_msg+0x287/0x490 netlink_rcv_skb+0x120/0x380 genl_rcv+0x24/0x40 netlink_unicast+0x439/0x630 netlink_sendmsg+0x719/0xbf0 sock_sendmsg+0xe2/0x110 ____sys_sendmsg+0x5ba/0x890 ___sys_sendmsg+0xe9/0x160 __sys_sendmsg+0xd3/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f957079db07 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48 RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07 RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019 RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0 The buggy address belongs to the page: page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7 flags: 0x17ffffc0000000() raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected
addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:
ovs_fragment+0x0/0x840 [openvswitch]
this frame has 2 objects:
[32, 144) 'ovs_dst'
[192, 424) 'ovs_rt'
Memory state around the buggy address:
ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00
>ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00
^
ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00for IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then, in the following call graph:
ip_do_fragment()
ip_skb_dst_mtu()
ip_dst_mtu_maybe_forward()
ip_mtu_locked()the pointer to struct dst_entry is used as pointer to struct rtable: this turns the access to struct members like rt_mtu_locked into an OOB read in the stack. Fix this changing the temporary variable used for IPv4 packets in ovs_fragment(), similarly to what is done for IPv6 few lines below.
--- net/openvswitch/actions.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/openvswitch/actions.c +4 -4
@@ -796,17 +796,17 @@ static void ovs_fragment(struct net *net }if (key->eth.type ==htons (ETH_P_IP )) { -struct dst_entry ovs_dst; +struct rtable ovs_rt = {0 };unsigned long orig_dst;prepare_frag (vport, skb, orig_network_offset,ovs_key_mac_proto (key)); -dst_init (&ovs_dst, &ovs_dst_ops,NULL ,1 , +dst_init (&ovs_rt.dst, &ovs_dst_ops,NULL ,1 ,DST_OBSOLETE_NONE ,DST_NOCOUNT ); - ovs_dst.dev = vport->dev; + ovs_rt.dst.dev = vport->dev; orig_dst = skb->_skb_refdst; -skb_dst_set_noref (skb, &ovs_dst); +skb_dst_set_noref (skb, &ovs_rt.dst);IPCB (skb)->frag_max_size = mru;ip_do_fragment (net, skb->sk, skb, ovs_vport_output);
Greg Kroah-Hartman
maintainerPATCH 79/323 ACPI: GTDT: Dont corrupt interrupt mappings on watchdow probe failure
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit 1ecd5b129252249b9bc03d7645a7bda512747277 upstream.
When failing the driver probe because of invalid firmware properties, the GTDT driver unmaps the interrupt that it mapped earlier.
However, it never checks whether the mapping of the interrupt actially succeeded. Even more, should the firmware report an illegal interrupt number that overlaps with the GIC SGI range, this can result in an IPI being unmapped, and subsequent fireworks (as reported by Dann Frazier).
Rework the driver to have a slightly saner behaviour and actually check whether the interrupt has been mapped before unmapping things.
--- drivers/acpi/arm64/gtdt.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/acpi/arm64/gtdt.c +6 -4
@@ -332,7 +332,7 @@ static int __init gtdt_import_sbsa_gwdt( int index) {struct platform_device *pdev; -int irq =map_gt_gsi (wd->timer_interrupt, wd->timer_flags); +int irq;/* * According to SBSA specification the size of refresh and control
@@ -341,7 +341,7 @@ static int __init gtdt_import_sbsa_gwdt(struct resource res[] = {DEFINE_RES_MEM (wd->control_frame_address,SZ_4K ),DEFINE_RES_MEM (wd->refresh_frame_address,SZ_4K ), -DEFINE_RES_IRQ (irq), + {}, };int nr_res =ARRAY_SIZE (res);
@@ -351,10 +351,11 @@ static int __init gtdt_import_sbsa_gwdt(if (!(wd->refresh_frame_address && wd->control_frame_address)) {pr_err (FW_BUG "failed to get the Watchdog base address.\n" ); -acpi_unregister_gsi (wd->timer_interrupt);return -EINVAL ; } + irq =map_gt_gsi (wd->timer_interrupt, wd->timer_flags); + res[2 ] = (struct resource )DEFINE_RES_IRQ (irq);if (irq <=0 ) {pr_warn ("failed to map the Watchdog interrupt.\n" ); nr_res--;
@@ -367,7 +368,8 @@ static int __init gtdt_import_sbsa_gwdt(*/ pdev =platform_device_register_simple ("sbsa-gwdt" , index, res, nr_res);if (IS_ERR (pdev)) { -acpi_unregister_gsi (wd->timer_interrupt); +if (irq >0 ) +acpi_unregister_gsi (wd->timer_interrupt);return PTR_ERR (pdev); }
Greg Kroah-Hartman
maintainerPATCH 80/323 NFSv4: Dont discard segments marked for return in _pnfs_return_layout()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit de144ff4234f935bd2150108019b5d87a90a8a96 upstream.
If the pNFS layout segment is marked with the NFS_LSEG_LAYOUTRETURN flag, then the assumption is that it has some reporting requirement to perform through a layoutreturn (e.g. flexfiles layout stats or error information).
--- fs/nfs/pnfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/pnfs.c +1 -1
@@ -1162,7 +1162,7 @@ _pnfs_return_layout(struct inode *ino) } valid_layout =pnfs_layout_is_valid (lo);pnfs_clear_layoutcommit (ino, &tmp_list); -pnfs_mark_matching_lsegs_invalid (lo, &tmp_list,NULL ,0 ); +pnfs_mark_matching_lsegs_return (lo, &tmp_list,NULL ,0 );if (NFS_SERVER (ino)->pnfs_curr_ld->return_range) {struct pnfs_layout_range range = {
Greg Kroah-Hartman
maintainerPATCH 81/323 jffs2: Fix kasan slab-out-of-bounds problem
In reply to Greg Kroah-HartmanFrom: lizhe <[email protected]>
commit 960b9a8a7676b9054d8b46a2c7db52a0c8766b56 upstream.
KASAN report a slab-out-of-bounds problem. The logs are listed below. It is because in function jffs2_scan_dirent_node, we alloc "checkedlen+1" bytes for fd->name and we check crc with length rd->nsize. If checkedlen is less than rd->nsize, it will cause the slab-out-of-bounds problem.
jffs2: Dirent at *** has zeroes in name. Truncating to %d char
==================================================================
BUG: KASAN: slab-out-of-bounds in crc32_le+0x1ce/0x260 at addr ffff8800842cf2d1
Read of size 1 by task test_JFFS2/915
=============================================================================
BUG kmalloc-64 (Tainted: G B O ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in jffs2_alloc_full_dirent+0x2a/0x40 age=0 cpu=1 pid=915
___slab_alloc+0x580/0x5f0
__slab_alloc.isra.24+0x4e/0x64
__kmalloc+0x170/0x300
jffs2_alloc_full_dirent+0x2a/0x40
jffs2_scan_eraseblock+0x1ca4/0x3b64
jffs2_scan_medium+0x285/0xfe0
jffs2_do_mount_fs+0x5fb/0x1bbc
jffs2_do_fill_super+0x245/0x6f0
jffs2_fill_super+0x287/0x2e0
mount_mtd_aux.isra.0+0x9a/0x144
mount_mtd+0x222/0x2f0
jffs2_mount+0x41/0x60
mount_fs+0x63/0x230
vfs_kern_mount.part.6+0x6c/0x1f4
do_mount+0xae8/0x1940
SyS_mount+0x105/0x1d0
INFO: Freed in jffs2_free_full_dirent+0x22/0x40 age=27 cpu=1 pid=915
__slab_free+0x372/0x4e4
kfree+0x1d4/0x20c
jffs2_free_full_dirent+0x22/0x40
jffs2_build_remove_unlinked_inode+0x17a/0x1e4
jffs2_do_mount_fs+0x1646/0x1bbc
jffs2_do_fill_super+0x245/0x6f0
jffs2_fill_super+0x287/0x2e0
mount_mtd_aux.isra.0+0x9a/0x144
mount_mtd+0x222/0x2f0
jffs2_mount+0x41/0x60
mount_fs+0x63/0x230
vfs_kern_mount.part.6+0x6c/0x1f4
do_mount+0xae8/0x1940
SyS_mount+0x105/0x1d0
entry_SYSCALL_64_fastpath+0x1e/0x97
Call Trace:
[<ffffffff815befef>] dump_stack+0x59/0x7e
[<ffffffff812d1d65>] print_trailer+0x125/0x1b0
[<ffffffff812d82c8>] object_err+0x34/0x40
[<ffffffff812dadef>] kasan_report.part.1+0x21f/0x534
[<ffffffff81132401>] ? vprintk+0x2d/0x40
[<ffffffff815f1ee2>] ? crc32_le+0x1ce/0x260
[<ffffffff812db41a>] kasan_report+0x26/0x30
[<ffffffff812d9fc1>] __asan_load1+0x3d/0x50
[<ffffffff815f1ee2>] crc32_le+0x1ce/0x260
[<ffffffff814764ae>] ? jffs2_alloc_full_dirent+0x2a/0x40
[<ffffffff81485cec>] jffs2_scan_eraseblock+0x1d0c/0x3b64
[<ffffffff81488813>] ? jffs2_scan_medium+0xccf/0xfe0
[<ffffffff81483fe0>] ? jffs2_scan_make_ino_cache+0x14c/0x14c
[<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
[<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
[<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
[<ffffffff812d5d90>] ? kmem_cache_alloc_trace+0x10c/0x2cc
[<ffffffff818169fb>] ? mtd_point+0xf7/0x130
[<ffffffff81487dc9>] jffs2_scan_medium+0x285/0xfe0
[<ffffffff81487b44>] ? jffs2_scan_eraseblock+0x3b64/0x3b64
[<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
[<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
[<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
[<ffffffff812d57df>] ? __kmalloc+0x12b/0x300
[<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
[<ffffffff814a2753>] ? jffs2_sum_init+0x9f/0x240
[<ffffffff8148b2ff>] jffs2_do_mount_fs+0x5fb/0x1bbc
[<ffffffff8148ad04>] ? jffs2_del_noinode_dirent+0x640/0x640
[<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
[<ffffffff81127c5b>] ? __init_rwsem+0x97/0xac
[<ffffffff81492349>] jffs2_do_fill_super+0x245/0x6f0
[<ffffffff81493c5b>] jffs2_fill_super+0x287/0x2e0
[<ffffffff814939d4>] ? jffs2_parse_options+0x594/0x594
[<ffffffff81819bea>] mount_mtd_aux.isra.0+0x9a/0x144
[<ffffffff81819eb6>] mount_mtd+0x222/0x2f0
[<ffffffff814939d4>] ? jffs2_parse_options+0x594/0x594
[<ffffffff81819c94>] ? mount_mtd_aux.isra.0+0x144/0x144
[<ffffffff81258757>] ? free_pages+0x13/0x1c
[<ffffffff814fa0ac>] ? selinux_sb_copy_data+0x278/0x2e0
[<ffffffff81492b35>] jffs2_mount+0x41/0x60
[<ffffffff81302fb7>] mount_fs+0x63/0x230
[<ffffffff8133755f>] ? alloc_vfsmnt+0x32f/0x3b0
[<ffffffff81337f2c>] vfs_kern_mount.part.6+0x6c/0x1f4
[<ffffffff8133ceec>] do_mount+0xae8/0x1940
[<ffffffff811b94e0>] ? audit_filter_rules.constprop.6+0x1d10/0x1d10
[<ffffffff8133c404>] ? copy_mount_string+0x40/0x40
[<ffffffff812cbf78>] ? alloc_pages_current+0xa4/0x1bc
[<ffffffff81253a89>] ? __get_free_pages+0x25/0x50
[<ffffffff81338993>] ? copy_mount_options.part.17+0x183/0x264
[<ffffffff8133e3a9>] SyS_mount+0x105/0x1d0
[<ffffffff8133e2a4>] ? copy_mnt_ns+0x560/0x560
[<ffffffff810e8391>] ? msa_space_switch_handler+0x13d/0x190
[<ffffffff81be184a>] entry_SYSCALL_64_fastpath+0x1e/0x97
[<ffffffff810e9274>] ? msa_space_switch+0xb0/0xe0
Memory state around the buggy address:
ffff8800842cf180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8800842cf200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8800842cf280: fc fc fc fc fc fc 00 00 00 00 01 fc fc fc fc fc
^
ffff8800842cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8800842cf380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================--- fs/jffs2/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jffs2/scan.c +1 -1
@@ -1075,7 +1075,7 @@ static int jffs2_scan_dirent_node(structmemcpy (&fd->name, rd->name, checkedlen); fd->name[checkedlen] =0 ; - crc =crc32 (0 , fd->name, rd->nsize); + crc =crc32 (0 , fd->name, checkedlen);if (crc !=je32_to_cpu (rd->name_crc)) {pr_notice ("%s(): Name CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n" , __func__, ofs,je32_to_cpu (rd->name_crc), crc);
Greg Kroah-Hartman
maintainerPATCH 82/323 powerpc/eeh: Fix EEH handling for hugepages in ioremap space.
In reply to Greg Kroah-HartmanFrom: Mahesh Salgaonkar <[email protected]>
commit 5ae5bc12d0728db60a0aa9b62160ffc038875f1a upstream.
During the EEH MMIO error checking, the current implementation fails to map the (virtual) MMIO address back to the pci device on radix with hugepage mappings for I/O. This results into failure to dispatch EEH event with no recovery even when EEH capability has been enabled on the device.
eeh_check_failure(token) # token = virtual MMIO address
addr = eeh_token_to_phys(token);
edev = eeh_addr_cache_get_dev(addr);
if (!edev)
return 0;
eeh_dev_check_failure(edev); <= Dispatch the EEH event
In case of hugepage mappings, eeh_token_to_phys() has a bug in virt -> phys translation that results in wrong physical address, which is then passed to eeh_addr_cache_get_dev() to match it against cached pci I/O address ranges to get to a PCI device. Hence, it fails to find a match and the EEH event never gets dispatched leaving the device in failed state.
The commit 33439620680be ("powerpc/eeh: Handle hugepages in ioremap space") introduced following logic to translate virt to phys for hugepage mappings:
eeh_token_to_phys():
+ pa = pte_pfn(*ptep);
+
+ /* On radix we can do hugepage mappings for io, so handle that */
+ if (hugepage_shift) {
+ pa <<= hugepage_shift; <= This is wrong
+ pa |= token & ((1ul << hugepage_shift) - 1);
+ }
This patch fixes the virt -> phys translation in eeh_token_to_phys() function.
$ cat /sys/kernel/debug/powerpc/eeh_address_cache mem addr range [0x0000040080000000-0x00000400807fffff]: 0030:01:00.1 mem addr range [0x0000040080800000-0x0000040080ffffff]: 0030:01:00.1 mem addr range [0x0000040081000000-0x00000400817fffff]: 0030:01:00.0 mem addr range [0x0000040081800000-0x0000040081ffffff]: 0030:01:00.0 mem addr range [0x0000040082000000-0x000004008207ffff]: 0030:01:00.1 mem addr range [0x0000040082080000-0x00000400820fffff]: 0030:01:00.0 mem addr range [0x0000040082100000-0x000004008210ffff]: 0030:01:00.1 mem addr range [0x0000040082110000-0x000004008211ffff]: 0030:01:00.0
Above is the list of cached io address ranges of pci 0030:01:00.<fn>.
Before this patch:
Tracing 'arg1' of function eeh_addr_cache_get_dev() during error injection clearly shows that 'addr=' contains wrong physical address:
kworker/u16:0-7 [001] .... 108.883775: eeh_addr_cache_get_dev:
(eeh_addr_cache_get_dev+0xc/0xf0) addr=0x80103000a510
dmesg shows no EEH recovery messages:
[ 108.563768] bnx2x: [bnx2x_timer:5801(eth2)]MFW seems hanged: drv_pulse (0x9ae) != mcp_pulse (0x7fff) [ 108.563788] bnx2x: [bnx2x_hw_stats_update:870(eth2)]NIG timer max (4294967295) [ 108.883788] bnx2x: [bnx2x_acquire_hw_lock:2013(eth1)]lock_status 0xffffffff resource_bit 0x1 [ 108.884407] bnx2x 0030:01:00.0 eth1: MDC/MDIO access timeout [ 108.884976] bnx2x 0030:01:00.0 eth1: MDC/MDIO access timeout <..>
After this patch:
eeh_addr_cache_get_dev() trace shows correct physical address:
<idle>-0 [001] ..s. 1043.123828: eeh_addr_cache_get_dev:
(eeh_addr_cache_get_dev+0xc/0xf0) addr=0x40080bc7cd8
dmesg logs shows EEH recovery getting triggerred:
[ 964.323980] bnx2x: [bnx2x_timer:5801(eth2)]MFW seems hanged: drv_pulse (0x746f) != mcp_pulse (0x7fff) [ 964.323991] EEH: Recovering PHB#30-PE#10000 [ 964.324002] EEH: PE location: N/A, PHB location: N/A [ 964.324006] EEH: Frozen PHB#30-PE#10000 detected <..>
--- arch/powerpc/kernel/eeh.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
arch/powerpc/kernel/eeh.c +4 -7
@@ -365,14 +365,11 @@ static inline unsigned long eeh_token_to pa =pte_pfn (*ptep);/* On radix we can do hugepage mappings for io, so handle that */ -if (hugepage_shift) { - pa <<= hugepage_shift; - pa |= token & ((1ul << hugepage_shift) -1 ); - }else { - pa <<=PAGE_SHIFT ; - pa |= token & (PAGE_SIZE -1 ); - } +if (!hugepage_shift) + hugepage_shift =PAGE_SHIFT ; + pa <<=PAGE_SHIFT ; + pa |= token & ((1ul << hugepage_shift) -1 );return pa; }
Greg Kroah-Hartman
maintainerPATCH 83/323 powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h
In reply to Greg Kroah-HartmanFrom: Tony Ambardar <[email protected]>
commit 7de21e679e6a789f3729e8402bc440b623a28eae upstream.
A few archs like powerpc have different errno.h values for macros EDEADLOCK and EDEADLK. In code including both libc and linux versions of errno.h, this can result in multiple definitions of EDEADLOCK in the include chain. Definitions to the same value (e.g. seen with mips) do not raise warnings, but on powerpc there are redefinitions changing the value, which raise warnings and errors (if using "-Werror").
Guard against these redefinitions to avoid build errors like the following, first seen cross-compiling libbpf v5.8.9 for powerpc using GCC 8.4.0 with musl 1.1.24:
In file included from ../../arch/powerpc/include/uapi/asm/errno.h:5,
from ../../include/linux/err.h:8,
from libbpf.c:29: ../../include/uapi/asm-generic/errno.h:40: error: "EDEADLOCK" redefined [-Werror]
#define EDEADLOCK EDEADLK
In file included from toolchain-powerpc_8540_gcc-8.4.0_musl/include/errno.h:10,
from libbpf.c:26:
toolchain-powerpc_8540_gcc-8.4.0_musl/include/bits/errno.h:58: note: this is the location of the previous definition
#define EDEADLOCK 58
cc1: all warnings being treated as errors
--- arch/powerpc/include/uapi/asm/errno.h | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/include/uapi/asm/errno.h +1 -0
@@ -2,6 +2,7 @@#ifndef _ASM_POWERPC_ERRNO_H#define _ASM_POWERPC_ERRNO_H +#undef EDEADLOCK#include <asm-generic/errno.h> #undef EDEADLOCK
Greg Kroah-Hartman
maintainerPATCH 84/323 intel_th: pci: Add Alder Lake-M support
In reply to Greg Kroah-HartmanFrom: Alexander Shishkin <[email protected]>
commit 48cb17531b15967d9d3f34c770a25cc6c4ca6ad1 upstream.
This adds support for the Trace Hub in Alder Lake-M PCH.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -249,6 +249,11 @@ static const struct pci_device_id intel_ .driver_data = (kernel_ulong_t)&intel_th_2x, }, { +/* Alder Lake-M */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x54a6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + {/* Rocket Lake CPU */ PCI_DEVICE (PCI_VENDOR_ID_INTEL ,0x4c19 ), .driver_data = (kernel_ulong_t)&intel_th_2x,
Greg Kroah-Hartman
maintainerPATCH 85/323 md/raid1: properly indicate failure when ending a failed write request
In reply to Greg Kroah-HartmanFrom: Paul Clements <[email protected]>
commit 2417b9869b81882ab90fd5ed1081a1cb2d4db1dd upstream.
This patch addresses a data corruption bug in raid1 arrays using bitmaps. Without this fix, the bitmap bits for the failed I/O end up being cleared.
Since we are in the failure leg of raid1_end_write_request, the request either needs to be retried (R1BIO_WriteError) or failed (R1BIO_Degraded).
--- drivers/md/raid1.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/raid1.c +2 -0
@@ -446,6 +446,8 @@ static void raid1_end_write_request(struif (!test_bit (Faulty, &rdev->flags))set_bit (R1BIO_WriteError, &r1_bio->state);else { +/* Fail the request */ +set_bit (R1BIO_Degraded, &r1_bio->state);/* Finished with this branch */ r1_bio->bios[mirror] =NULL ; to_put = bio;
Greg Kroah-Hartman
maintainerPATCH 86/323 security: commoncap: fix -Wstringop-overread warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 82e5d8cc768b0c7b03c551a9ab1f8f3f68d5f83f upstream.
gcc-11 introdces a harmless warning for cap_inode_getsecurity:
security/commoncap.c: In function ‘cap_inode_getsecurity’:security/commoncap.c:440:33: error: ‘memcpy’ reading 16 bytes from a region of size 0 [-Werror=stringop-overread]
440 | memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~The problem here is that tmpbuf is initialized to NULL, so gcc assumes it is not accessible unless it gets set by vfs_getxattr_alloc(). This is a legitimate warning as far as I can tell, but the code is correct since it correctly handles the error when that function fails.
Add a separate NULL check to tell gcc about it as well.
--- security/commoncap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/commoncap.c +1 -1
@@ -398,7 +398,7 @@ int cap_inode_getsecurity(struct inode * &tmpbuf, size, GFP_NOFS);dput (dentry); -if (ret <0 ) +if (ret <0 || !tmpbuf)return ret; fs_ns = inode->i_sb->s_user_ns;
Greg Kroah-Hartman
maintainerPATCH 87/323 Fix misc new gcc warnings
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit e7c6e405e171fb33990a12ecfd14e6500d9e5cf2 upstream.
It seems like Fedora 34 ends up enabling a few new gcc warnings, notably "-Wstringop-overread" and "-Warray-parameter".
Both of them cause what seem to be valid warnings in the kernel, where we have array size mismatches in function arguments (that are no longer just silently converted to a pointer to element, but actually checked).
This fixes most of the trivial ones, by making the function declaration match the function definition, and in the case of intel_pm.c, removing the over-specified array size from the argument declaration.
At least one 'stringop-overread' warning remains in the i915 driver, but that one doesn't have the same obvious trivial fix, and may or may not actually be indicative of a bug.
[ It was a mistake to upgrade one of my machines to Fedora 34 while
being busy with the merge window, but if this is the extent of the
compiler upgrade problems, things are better than usual - Linus ]
--- drivers/gpu/drm/i915/intel_pm.c | 2 +- drivers/media/usb/dvb-usb/dvb-usb.h | 2 +- include/scsi/libfcoe.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/intel_pm.c +1 -1
@@ -2934,7 +2934,7 @@ int ilk_wm_max_level(const struct drm_i9static void intel_print_wm_latency (struct drm_i915_private *dev_priv,const char *name, -const uint16_t wm[8 ]) +const uint16_t wm[]) {int level, max_level =ilk_wm_max_level (dev_priv);
drivers/media/usb/dvb-usb/dvb-usb.h +1 -1
@@ -474,7 +474,7 @@ extern int __must_check dvb_usb_generic_write(struct dvb_usb_device *, u8 *, u16);/* commonly used remote control parsing */ -extern int dvb_usb_nec_rc_key_to_event (struct dvb_usb_device *,u8 [],u32 *,int *); +extern int dvb_usb_nec_rc_key_to_event (struct dvb_usb_device *,u8 [5 ],u32 *,int *);/* commonly used firmware download types and function */ struct hexline {
include/scsi/libfcoe.h +1 -1
@@ -261,7 +261,7 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctl struct fc_frame *);/* libfcoe funcs */ -u64 fcoe_wwn_from_mac (unsigned char mac[],unsigned int ,unsigned int ); +u64 fcoe_wwn_from_mac (unsigned char mac[MAX_ADDR_LEN ],unsigned int ,unsigned int );int fcoe_libfc_config (struct fc_lport *,struct fcoe_ctlr *,const struct libfc_function_template *,int init_fcp);u32 fcoe_fc_crc (struct fc_frame *fp);
Greg Kroah-Hartman
maintainerPATCH 88/323 jffs2: check the validity of dstlen in jffs2_zlib_compress()
In reply to Greg Kroah-HartmanFrom: Yang Yang <[email protected]>
commit 90ada91f4610c5ef11bc52576516d96c496fc3f1 upstream.
KASAN reports a BUG when download file in jffs2 filesystem.It is because when dstlen == 1, cpage_out will write array out of bounds. Actually, data will not be compressed in jffs2_zlib_compress() if data's length less than 4.
[ 393.799778] BUG: KASAN: slab-out-of-bounds in jffs2_rtime_compress+0x214/0x2f0 at addr ffff800062e3b281 [ 393.809166] Write of size 1 by task tftp/2918 [ 393.813526] CPU: 3 PID: 2918 Comm: tftp Tainted: G B 4.9.115-rt93-EMBSYS-CGEL-6.1.R6-dirty #1 [ 393.823173] Hardware name: LS1043A RDB Board (DT) [ 393.827870] Call trace: [ 393.830322] [<ffff20000808c700>] dump_backtrace+0x0/0x2f0 [ 393.835721] [<ffff20000808ca04>] show_stack+0x14/0x20 [ 393.840774] [<ffff2000086ef700>] dump_stack+0x90/0xb0 [ 393.845829] [<ffff20000827b19c>] kasan_object_err+0x24/0x80 [ 393.851402] [<ffff20000827b404>] kasan_report_error+0x1b4/0x4d8 [ 393.857323] [<ffff20000827bae8>] kasan_report+0x38/0x40 [ 393.862548] [<ffff200008279d44>] __asan_store1+0x4c/0x58 [ 393.867859] [<ffff2000084ce2ec>] jffs2_rtime_compress+0x214/0x2f0 [ 393.873955] [<ffff2000084bb3b0>] jffs2_selected_compress+0x178/0x2a0 [ 393.880308] [<ffff2000084bb530>] jffs2_compress+0x58/0x478 [ 393.885796] [<ffff2000084c5b34>] jffs2_write_inode_range+0x13c/0x450 [ 393.892150] [<ffff2000084be0b8>] jffs2_write_end+0x2a8/0x4a0 [ 393.897811] [<ffff2000081f3008>] generic_perform_write+0x1c0/0x280 [ 393.903990] [<ffff2000081f5074>] __generic_file_write_iter+0x1c4/0x228 [ 393.910517] [<ffff2000081f5210>] generic_file_write_iter+0x138/0x288 [ 393.916870] [<ffff20000829ec1c>] __vfs_write+0x1b4/0x238 [ 393.922181] [<ffff20000829ff00>] vfs_write+0xd0/0x238 [ 393.927232] [<ffff2000082a1ba8>] SyS_write+0xa0/0x110 [ 393.932283] [<ffff20000808429c>] __sys_trace_return+0x0/0x4 [ 393.937851] Object at ffff800062e3b280, in cache kmalloc-64 size: 64 [ 393.944197] Allocated: [ 393.946552] PID = 2918 [ 393.948913] save_stack_trace_tsk+0x0/0x220 [ 393.953096] save_stack_trace+0x18/0x20 [ 393.956932] kasan_kmalloc+0xd8/0x188 [ 393.960594] __kmalloc+0x144/0x238 [ 393.963994] jffs2_selected_compress+0x48/0x2a0 [ 393.968524] jffs2_compress+0x58/0x478 [ 393.972273] jffs2_write_inode_range+0x13c/0x450 [ 393.976889] jffs2_write_end+0x2a8/0x4a0 [ 393.980810] generic_perform_write+0x1c0/0x280 [ 393.985251] __generic_file_write_iter+0x1c4/0x228 [ 393.990040] generic_file_write_iter+0x138/0x288 [ 393.994655] __vfs_write+0x1b4/0x238 [ 393.998228] vfs_write+0xd0/0x238 [ 394.001543] SyS_write+0xa0/0x110 [ 394.004856] __sys_trace_return+0x0/0x4 [ 394.008684] Freed: [ 394.010691] PID = 2918 [ 394.013051] save_stack_trace_tsk+0x0/0x220 [ 394.017233] save_stack_trace+0x18/0x20 [ 394.021069] kasan_slab_free+0x88/0x188 [ 394.024902] kfree+0x6c/0x1d8 [ 394.027868] jffs2_sum_write_sumnode+0x2c4/0x880 [ 394.032486] jffs2_do_reserve_space+0x198/0x598 [ 394.037016] jffs2_reserve_space+0x3f8/0x4d8 [ 394.041286] jffs2_write_inode_range+0xf0/0x450 [ 394.045816] jffs2_write_end+0x2a8/0x4a0 [ 394.049737] generic_perform_write+0x1c0/0x280 [ 394.054179] __generic_file_write_iter+0x1c4/0x228 [ 394.058968] generic_file_write_iter+0x138/0x288 [ 394.063583] __vfs_write+0x1b4/0x238 [ 394.067157] vfs_write+0xd0/0x238 [ 394.070470] SyS_write+0xa0/0x110 [ 394.073783] __sys_trace_return+0x0/0x4 [ 394.077612] Memory state around the buggy address: [ 394.082404] ffff800062e3b180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 394.089623] ffff800062e3b200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 394.096842] >ffff800062e3b280: 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 394.104056] ^ [ 394.107283] ffff800062e3b300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 394.114502] ffff800062e3b380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 394.121718] ==================================================================
--- fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jffs2/compr_rtime.c +3 -0
@@ -37,6 +37,9 @@ static int jffs2_rtime_compress(unsignedint outpos =0 ;int pos=0 ; +if (*dstlen <=3 ) +return -1 ; +memset (positions,0 ,sizeof (positions));while (pos < (*sourcelen) && outpos <= (*dstlen)-2 ) {
Greg Kroah-Hartman
maintainerPATCH 89/323 Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op")
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 4fbf5d6837bf81fd7a27d771358f4ee6c4f243f8 upstream.
The FUTEX_WAIT operand has historically a relative timeout which means that the clock id is irrelevant as relative timeouts on CLOCK_REALTIME are not subject to wall clock changes and therefore are mapped by the kernel to CLOCK_MONOTONIC for simplicity.
If a caller would set FUTEX_CLOCK_REALTIME for FUTEX_WAIT the timeout is still treated relative vs. CLOCK_MONOTONIC and then the wait arms that timeout based on CLOCK_REALTIME which is broken and obviously has never been used or even tested.
Reject any attempt to use FUTEX_CLOCK_REALTIME with FUTEX_WAIT again.
The desired functionality can be achieved with FUTEX_WAIT_BITSET and a FUTEX_BITSET_MATCH_ANY argument.
--- kernel/futex.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/futex.c +1 -2
@@ -3885,8 +3885,7 @@ long do_futex(u32 __user *uaddr, int op,if (op &FUTEX_CLOCK_REALTIME ) { flags |=FLAGS_CLOCKRT ; -if (cmd !=FUTEX_WAIT && cmd !=FUTEX_WAIT_BITSET && \ - cmd !=FUTEX_WAIT_REQUEUE_PI ) +if (cmd !=FUTEX_WAIT_BITSET && cmd !=FUTEX_WAIT_REQUEUE_PI )return -ENOSYS ; }
Greg Kroah-Hartman
maintainerPATCH 90/323 posix-timers: Preserve return value in clock_adjtime32()
In reply to Greg Kroah-HartmanFrom: Chen Jun <[email protected]>
commit 2d036dfa5f10df9782f5278fc591d79d283c1fad upstream.
The return value on success (>= 0) is overwritten by the return value of put_old_timex32(). That works correct in the fault case, but is wrong for the success case where put_old_timex32() returns 0.
Just check the return value of put_old_timex32() and return -EFAULT in case it is not zero.
[ tglx: Massage changelog ]
--- kernel/time/posix-timers.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/time/posix-timers.c +2 -2
@@ -1172,8 +1172,8 @@ COMPAT_SYSCALL_DEFINE2(clock_adjtime, cl err = kc->clock_adj (which_clock, &ktx); -if (err >=0 ) - err =compat_put_timex (utp, &ktx); +if (err >=0 &&compat_put_timex (utp, &ktx)) +return -EFAULT ;return err; }
Greg Kroah-Hartman
maintainerPATCH 91/323 ftrace: Handle commands when closing set_ftrace_filter file
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 8c9af478c06bb1ab1422f90d8ecbc53defd44bc3 upstream.
# echo switch_mm:traceoff > /sys/kernel/tracing/set_ftrace_filter
will cause switch_mm to stop tracing by the traceoff command.
# echo -n switch_mm:traceoff > /sys/kernel/tracing/set_ftrace_filter
does nothing.
The reason is that the parsing in the write function only processes commands if it finished parsing (there is white space written after the command). That's to handle:
write(fd, "switch_mm:", 10);
write(fd, "traceoff", 8);
cases, where the command is broken over multiple writes.
The problem is if the file descriptor is closed, then the write call is not processed, and the command needs to be processed in the release code. The release code can handle matching of functions, but does not handle commands.
--- kernel/trace/ftrace.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/trace/ftrace.c +4 -1
@@ -5096,8 +5096,11 @@ int ftrace_regex_release(struct inode *i parser = &iter->parser;if (trace_parser_loaded (parser)) { +int enable = !(iter->flags &FTRACE_ITER_NOTRACE ); + parser->buffer[parser->idx] =0 ; -ftrace_match_records (iter->hash, parser->buffer, parser->idx); +ftrace_process_regex (iter, parser->buffer, + parser->idx, enable); }trace_parser_put (parser);
Greg Kroah-Hartman
maintainerPATCH 92/323 ext4: fix check to prevent false positive report of incorrect used inodes
In reply to Greg Kroah-HartmanFrom: Zhang Yi <[email protected]>
commit a149d2a5cabbf6507a7832a1c4fd2593c55fd450 upstream.
Commit <50122847007> ("ext4: fix check to prevent initializing reserved inodes") check the block group zero and prevent initializing reserved inodes. But in some special cases, the reserved inode may not all belong to the group zero, it may exist into the second group if we format filesystem below.
mkfs.ext4 -b 4096 -g 8192 -N 1024 -I 4096 /dev/sda
So, it will end up triggering a false positive report of a corrupted file system. This patch fix it by avoid check reserved inodes if no free inode blocks will be zeroed.
--- fs/ext4/ialloc.c | 48 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 32 insertions(+), 16 deletions(-)
fs/ext4/ialloc.c +32 -16
@@ -1367,6 +1367,7 @@ int ext4_init_inode_table(struct super_bhandle_t *handle;ext4_fsblk_t blk;int num, ret =0 , used_blks =0 ; +unsigned long used_inos =0 ;/* This should not happen, but just to be sure check this */ if (sb_rdonly (sb)) {
@@ -1397,22 +1398,37 @@ int ext4_init_inode_table(struct super_b* used inodes so we need to skip blocks with used inodes in * inode table. */ -if (!(gdp->bg_flags &cpu_to_le16 (EXT4_BG_INODE_UNINIT ))) - used_blks =DIV_ROUND_UP ((EXT4_INODES_PER_GROUP (sb) - -ext4_itable_unused_count (sb, gdp)), - sbi->s_inodes_per_block); - -if ((used_blks <0 ) || (used_blks > sbi->s_itb_per_group) || - ((group ==0 ) && ((EXT4_INODES_PER_GROUP (sb) - -ext4_itable_unused_count (sb, gdp)) < -EXT4_FIRST_INO (sb)))) { -ext4_error (sb,"Something is wrong with group %u: " -"used itable blocks: %d; " -"itable unused count: %u" , - group, used_blks, -ext4_itable_unused_count (sb, gdp)); - ret =1 ; - goto err_out; +if (!(gdp->bg_flags &cpu_to_le16 (EXT4_BG_INODE_UNINIT ))) { + used_inos =EXT4_INODES_PER_GROUP (sb) - +ext4_itable_unused_count (sb, gdp); + used_blks =DIV_ROUND_UP (used_inos, sbi->s_inodes_per_block); + +/* Bogus inode unused count? */ +if (used_blks <0 || used_blks > sbi->s_itb_per_group) { +ext4_error (sb,"Something is wrong with group %u: " +"used itable blocks: %d; " +"itable unused count: %u" , + group, used_blks, +ext4_itable_unused_count (sb, gdp)); + ret =1 ; + goto err_out; + } + + used_inos += group *EXT4_INODES_PER_GROUP (sb); +/* +* Are there some uninitialized inodes in the inode table +* before the first normal inode? +*/ +if ((used_blks != sbi->s_itb_per_group) && + (used_inos <EXT4_FIRST_INO (sb))) { +ext4_error (sb,"Something is wrong with group %u: " +"itable unused count: %u; " +"itables initialized count: %ld" , + group,ext4_itable_unused_count (sb, gdp), + used_inos); + ret =1 ; + goto err_out; + } } blk =ext4_inode_table (sb, gdp) + used_blks;
Greg Kroah-Hartman
maintainerPATCH 93/323 ext4: fix error code in ext4_commit_super
In reply to Greg Kroah-HartmanFrom: Fengnan Chang <[email protected]>
commit f88f1466e2a2e5ca17dfada436d3efa1b03a3972 upstream.
We should set the error code when ext4_commit_super check argument failed. Found in code review.
--- fs/ext4/super.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ext4/super.c +4 -2
@@ -4859,8 +4859,10 @@ static int ext4_commit_super(struct supestruct buffer_head *sbh =EXT4_SB (sb)->s_sbh;int error =0 ; -if (!sbh ||block_device_ejected (sb)) -return error; +if (!sbh) +return -EINVAL ; +if (block_device_ejected (sb)) +return -ENODEV ;/* * If the file system is mounted read-only, don't update the
Greg Kroah-Hartman
maintainerPATCH 94/323 media: dvbdev: Fix memory leak in dvb_media_device_free()
In reply to Greg Kroah-HartmanFrom: Peilin Ye <[email protected]>
commit bf9a40ae8d722f281a2721779595d6df1c33a0bf upstream.
dvb_media_device_free() is leaking memory. Free dvbdev->adapter->conn before setting it to NULL, as documented in include/media/media-device.h:
"The media_entity instance itself must be freed explicitly by the driver if required."
--- drivers/media/dvb-core/dvbdev.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/dvb-core/dvbdev.c +1 -0
@@ -218,6 +218,7 @@ static void dvb_media_device_free(structif (dvbdev->adapter->conn) {media_device_unregister_entity (dvbdev->adapter->conn); +kfree (dvbdev->adapter->conn); dvbdev->adapter->conn =NULL ;kfree (dvbdev->adapter->conn_pads); dvbdev->adapter->conn_pads =NULL ;
Greg Kroah-Hartman
maintainerPATCH 95/323 usb: gadget: dummy_hcd: fix gpf in gadget_setup
In reply to Greg Kroah-HartmanFrom: Anirudh Rayabharam <[email protected]>
commit 4a5d797a9f9c4f18585544237216d7812686a71f upstream.
Fix a general protection fault reported by syzbot due to a race between gadget_setup() and gadget_unbind() in raw_gadget.
The gadget core is supposed to guarantee that there won't be any more callbacks to the gadget driver once the driver's unbind routine is called. That guarantee is enforced in usb_gadget_remove_driver as follows:
usb_gadget_disconnect(udc->gadget);
if (udc->gadget->irq)
synchronize_irq(udc->gadget->irq);
udc->driver->unbind(udc->gadget);
usb_gadget_udc_stop(udc);usb_gadget_disconnect turns off the pullup resistor, telling the host that the gadget is no longer connected and preventing the transmission of any more USB packets. Any packets that have already been received are sure to processed by the UDC driver's interrupt handler by the time synchronize_irq returns.
But this doesn't work with dummy_hcd, because dummy_hcd doesn't use interrupts; it uses a timer instead. It does have code to emulate the effect of synchronize_irq, but that code doesn't get invoked at the right time -- it currently runs in usb_gadget_udc_stop, after the unbind callback instead of before. Indeed, there's no way for usb_gadget_remove_driver to invoke this code before the unbind callback.
To fix this, move the synchronize_irq() emulation code to dummy_pullup so that it runs before unbind. Also, add a comment explaining why it is necessary to have it there.
--- drivers/usb/gadget/udc/dummy_hcd.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
drivers/usb/gadget/udc/dummy_hcd.c +15 -8
@@ -902,6 +902,21 @@ static int dummy_pullup(struct usb_gadgespin_lock_irqsave (&dum->lock, flags); dum->pullup = (value !=0 );set_link_state (dum_hcd); +if (value ==0 ) { +/* +* Emulate synchronize_irq(): wait for callbacks to finish. +* This seems to be the best place to emulate the call to +* synchronize_irq() that's in usb_gadget_remove_driver(). +* Doing it in dummy_udc_stop() would be too late since it +* is called after the unbind callback and unbind shouldn't +* be invoked until all the other callbacks are finished. +*/ +while (dum->callback_usage >0 ) { +spin_unlock_irqrestore (&dum->lock, flags); +usleep_range (1000 ,2000 ); +spin_lock_irqsave (&dum->lock, flags); + } + }spin_unlock_irqrestore (&dum->lock, flags);usb_hcd_poll_rh_status (dummy_hcd_to_hcd (dum_hcd));
@@ -1005,14 +1020,6 @@ static int dummy_udc_stop(struct usb_gadspin_lock_irq (&dum->lock); dum->ints_enabled =0 ;stop_activity (dum); - -/* emulate synchronize_irq(): wait for callbacks to finish */ -while (dum->callback_usage >0 ) { -spin_unlock_irq (&dum->lock); -usleep_range (1000 ,2000 ); -spin_lock_irq (&dum->lock); - } - dum->driver =NULL ;spin_unlock_irq (&dum->lock);
Greg Kroah-Hartman
maintainerPATCH 96/323 usb: gadget: Fix double free of device descriptor pointers
In reply to Greg Kroah-HartmanFrom: Hemant Kumar <[email protected]>
commit 43c4cab006f55b6ca549dd1214e22f5965a8675f upstream.
Upon driver unbind usb_free_all_descriptors() function frees all speed descriptor pointers without setting them to NULL. In case gadget speed changes (i.e from super speed plus to super speed) after driver unbind only upto super speed descriptor pointers get populated. Super speed plus desc still holds the stale (already freed) pointer. Fix this issue by setting all descriptor pointers to NULL after freeing them in usb_free_all_descriptors().
--- drivers/usb/gadget/config.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/gadget/config.c +4 -0
@@ -198,9 +198,13 @@ EXPORT_SYMBOL_GPL(usb_assign_descriptorsvoid usb_free_all_descriptors (struct usb_function *f) {usb_free_descriptors (f->fs_descriptors); + f->fs_descriptors =NULL ;usb_free_descriptors (f->hs_descriptors); + f->hs_descriptors =NULL ;usb_free_descriptors (f->ss_descriptors); + f->ss_descriptors =NULL ;usb_free_descriptors (f->ssp_descriptors); + f->ssp_descriptors =NULL ; }EXPORT_SYMBOL_GPL (usb_free_all_descriptors);
Greg Kroah-Hartman
maintainerPATCH 97/323 usb: gadget/function/f_fs string table fix for multiple languages
In reply to Greg Kroah-HartmanFrom: Dean Anderson <[email protected]>
commit 55b74ce7d2ce0b0058f3e08cab185a0afacfe39e upstream.
Fixes bug with the handling of more than one language in the string table in f_fs.c.str_count was not reset for subsequent language codes. str_count-- "rolls under" and processes u32 max strings on the processing of the second language entry.
The existing bug can be reproduced by adding a second language table to the structure "strings" in tools/usb/ffs-test.c.
--- drivers/usb/gadget/function/f_fs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +2 -1
@@ -2543,6 +2543,7 @@ static int __ffs_data_got_strings(struct do { /* lang_count > 0 so we can use do-while */ unsigned needed = needed_count; + u32 str_per_lang = str_count; if (unlikely(len < 3)) goto error_free;
@@ -2578,7 +2579,7 @@ static int __ffs_data_got_strings(struct data += length +1 ; len -= length +1 ; - }while (--str_count); + }while (--str_per_lang); s->id =0 ;/* terminator */ s->s =NULL ;
Greg Kroah-Hartman
maintainerPATCH 98/323 usb: dwc3: gadget: Fix START_TRANSFER link state check
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
commit c560e76319a94a3b9285bc426c609903408e4826 upstream.
The START_TRANSFER command needs to be executed while in ON/U0 link state (with an exception during register initialization). Don't use dwc->link_state to check this since the driver only tracks the link state when the link state change interrupt is enabled. Check the link state from DSTS register instead.
Note that often the host already brings the device out of low power before it sends/requests the next transfer. So, the user won't see any issue when the device starts transfer then. This issue is more noticeable in cases when the device delays starting transfer, which can happen during delayed control status after the host put the device in low power.
--- drivers/usb/dwc3/gadget.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/usb/dwc3/gadget.c +7 -6
@@ -310,13 +310,12 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ }if (DWC3_DEPCMD_CMD (cmd) ==DWC3_DEPCMD_STARTTRANSFER ) { -int needs_wakeup; +int link_state; - needs_wakeup = (dwc->link_state ==DWC3_LINK_STATE_U1 || - dwc->link_state ==DWC3_LINK_STATE_U2 || - dwc->link_state ==DWC3_LINK_STATE_U3 ); - -if (unlikely (needs_wakeup)) { + link_state =dwc3_gadget_get_link_state (dwc); +if (link_state ==DWC3_LINK_STATE_U1 || + link_state ==DWC3_LINK_STATE_U2 || + link_state ==DWC3_LINK_STATE_U3 ) { ret =__dwc3_gadget_wakeup (dwc);dev_WARN_ONCE (dwc->dev, ret,"wakeup failed --> %d\n" , ret);
@@ -1671,6 +1670,8 @@ static int __dwc3_gadget_wakeup(struct dcase DWC3_LINK_STATE_RESET :case DWC3_LINK_STATE_RX_DET :/* in HS, means Early Suspend */ case DWC3_LINK_STATE_U3 :/* in HS, means SUSPEND */ +case DWC3_LINK_STATE_U2 :/* in HS, means Sleep (L1) */ +case DWC3_LINK_STATE_U1 :case DWC3_LINK_STATE_RESUME :break ;default :
Greg Kroah-Hartman
maintainerPATCH 99/323 tracing: Map all PIDs to command lines
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 785e3c0a3a870e72dc530856136ab4c8dd207128 upstream.
The default max PID is set by PID_MAX_DEFAULT, and the tracing infrastructure uses this number to map PIDs to the comm names of the tasks, such output of the trace can show names from the recorded PIDs in the ring buffer. This mapping is also exported to user space via the "saved_cmdlines" file in the tracefs directory.
But currently the mapping expects the PIDs to be less than PID_MAX_DEFAULT, which is the default maximum and not the real maximum. Recently, systemd will increases the maximum value of a PID on the system, and when tasks are traced that have a PID higher than PID_MAX_DEFAULT, its comm is not recorded. This leads to the entire trace to have "<...>" as the comm name, which is pretty useless.
Instead, keep the array mapping the size of PID_MAX_DEFAULT, but instead of just mapping the index to the comm, map a mask of the PID (PID_MAX_DEFAULT - 1) to the comm, and find the full PID from the map_cmdline_to_pid array (that already exists).
This bug goes back to the beginning of ftrace, but hasn't been an issue until user space started increasing the maximum value of PIDs.
--- kernel/trace/trace.c | 41 +++++++++++++++-------------------------- 1 file changed, 15 insertions(+), 26 deletions(-)
kernel/trace/trace.c +15 -26
@@ -1928,14 +1928,13 @@ static void tracing_stop_tr(struct tracestatic int trace_save_cmdline (struct task_struct *tsk) { -unsigned pid, idx; +unsigned tpid, idx;/* treat recording of idle task as a success */ if (!tsk->pid)return 1 ; -if (unlikely (tsk->pid >PID_MAX_DEFAULT )) -return 0 ; + tpid = tsk->pid & (PID_MAX_DEFAULT -1 );/* * It's not the end of the world if we don't get
@@ -1946,26 +1945,15 @@ static int trace_save_cmdline(struct tasif (!arch_spin_trylock (&trace_cmdline_lock))return 0 ; - idx = savedcmd->map_pid_to_cmdline[tsk->pid]; + idx = savedcmd->map_pid_to_cmdline[tpid];if (idx ==NO_CMDLINE_MAP ) { idx = (savedcmd->cmdline_idx +1 ) % savedcmd->cmdline_num; -/* -* Check whether the cmdline buffer at idx has a pid -* mapped. We are going to overwrite that entry so we -* need to clear the map_pid_to_cmdline. Otherwise we -* would read the new comm for the old pid. -*/ - pid = savedcmd->map_cmdline_to_pid[idx]; -if (pid !=NO_CMDLINE_MAP ) - savedcmd->map_pid_to_cmdline[pid] =NO_CMDLINE_MAP ; - - savedcmd->map_cmdline_to_pid[idx] = tsk->pid; - savedcmd->map_pid_to_cmdline[tsk->pid] = idx; - + savedcmd->map_pid_to_cmdline[tpid] = idx; savedcmd->cmdline_idx = idx; } + savedcmd->map_cmdline_to_pid[idx] = tsk->pid;set_cmdline (idx, tsk->comm);arch_spin_unlock (&trace_cmdline_lock);
@@ -1976,6 +1964,7 @@ static int trace_save_cmdline(struct tasstatic void __trace_find_cmdline (int pid,char comm[]) {unsigned map; +int tpid;if (!pid) {strcpy (comm,"<idle>" );
@@ -1987,16 +1976,16 @@ static void __trace_find_cmdline(int pidreturn ; } -if (pid >PID_MAX_DEFAULT ) { -strcpy (comm,"<...>" ); -return ; + tpid = pid & (PID_MAX_DEFAULT -1 ); + map = savedcmd->map_pid_to_cmdline[tpid]; +if (map !=NO_CMDLINE_MAP ) { + tpid = savedcmd->map_cmdline_to_pid[map]; +if (tpid == pid) { +strlcpy (comm,get_saved_cmdlines (map),TASK_COMM_LEN ); +return ; + } } - - map = savedcmd->map_pid_to_cmdline[pid]; -if (map !=NO_CMDLINE_MAP ) -strlcpy (comm,get_saved_cmdlines (map),TASK_COMM_LEN ); -else -strcpy (comm,"<...>" ); +strcpy (comm,"<...>" ); }void trace_find_cmdline (int pid,char comm[])
Greg Kroah-Hartman
maintainerPATCH 100/323 dm persistent data: packed struct should have an aligned() attribute too
In reply to Greg Kroah-HartmanFrom: Joe Thornber <[email protected]>
commit a88b2358f1da2c9f9fcc432f2e0a79617fea397c upstream.
Otherwise most non-x86 architectures (e.g. riscv, arm) will resort to byte-by-byte access.
--- drivers/md/persistent-data/dm-btree-internal.h | 4 ++-- drivers/md/persistent-data/dm-space-map-common.h | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/md/persistent-data/dm-btree-internal.h +2 -2
@@ -34,12 +34,12 @@ struct node_header {__le32 max_entries;__le32 value_size;__le32 padding; -} __packed; +} __attribute__((packed, aligned(8)));struct btree_node {struct node_header header;__le64 keys[0 ]; -} __packed; +} __attribute__((packed,aligned (8 )));/*
drivers/md/persistent-data/dm-space-map-common.h +4 -4
@@ -33,7 +33,7 @@ struct disk_index_entry {__le64 blocknr;__le32 nr_free;__le32 none_free_before; -} __packed; +} __attribute__ ((packed, aligned(8)));#define MAX_METADATA_BITMAPS 255
@@ -43,7 +43,7 @@ struct disk_metadata_index {__le64 blocknr;struct disk_index_entry index[MAX_METADATA_BITMAPS ]; -} __packed; +} __attribute__ ((packed, aligned(8)));struct ll_disk ;
@@ -86,7 +86,7 @@ struct disk_sm_root {__le64 nr_allocated;__le64 bitmap_root;__le64 ref_count_root; -} __packed; +} __attribute__ ((packed, aligned(8)));#define ENTRIES_PER_BYTE 4
@@ -94,7 +94,7 @@ struct disk_bitmap_header {__le32 csum;__le32 not_used;__le64 blocknr; -} __packed; +} __attribute__ ((packed, aligned(8)));enum allocation_event {SM_NONE ,
Greg Kroah-Hartman
maintainerPATCH 101/323 dm space map common: fix division bug in sm_ll_find_free_block()
In reply to Greg Kroah-HartmanFrom: Joe Thornber <[email protected]>
commit 5208692e80a1f3c8ce2063a22b675dd5589d1d80 upstream.
This division bug meant the search for free metadata space could skip the final allocation bitmap's worth of entries. Fix affects DM thinp, cache and era targets.
--- drivers/md/persistent-data/dm-space-map-common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/persistent-data/dm-space-map-common.c +2 -0
@@ -337,6 +337,8 @@ int sm_ll_find_free_block(struct ll_disk*/ begin =do_div (index_begin, ll->entries_per_block); end =do_div (end, ll->entries_per_block); +if (end ==0 ) + end = ll->entries_per_block;for (i = index_begin; i < index_end; i++, begin =0 ) {struct dm_block *blk;
Greg Kroah-Hartman
maintainerPATCH 102/323 dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails
In reply to Greg Kroah-HartmanFrom: Benjamin Block <[email protected]>
commit 8e947c8f4a5620df77e43c9c75310dc510250166 upstream.
When loading a device-mapper table for a request-based mapped device, and the allocation/initialization of the blk_mq_tag_set for the device fails, a following device remove will cause a double free.
E.g. (dmesg):
device-mapper: core: Cannot initialize queue for request-based dm-mq mapped device
device-mapper: ioctl: unable to set up device queue for new table.
Unable to handle kernel pointer dereference in virtual kernel address space
Failing address: 0305e098835de000 TEID: 0305e098835de803
Fault in home space mode while using kernel ASCE.
AS:000000025efe0007 R3:0000000000000024
Oops: 0038 ilc:3 [#1] SMP
Modules linked in: ... lots of modules ...
Supported: Yes, External
CPU: 0 PID: 7348 Comm: multipathd Kdump: loaded Tainted: G W X 5.3.18-53-default #1 SLE15-SP3
Hardware name: IBM 8561 T01 7I2 (LPAR)
Krnl PSW : 0704e00180000000 000000025e368eca (kfree+0x42/0x330)
R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3
Krnl GPRS: 000000000000004a 000000025efe5230 c1773200d779968d 0000000000000000
000000025e520270 000000025e8d1b40 0000000000000003 00000007aae10000
000000025e5202a2 0000000000000001 c1773200d779968d 0305e098835de640
00000007a8170000 000003ff80138650 000000025e5202a2 000003e00396faa8
Krnl Code: 000000025e368eb8: c4180041e100 lgrl %r1,25eba50b8
000000025e368ebe: ecba06b93a55 risbg %r11,%r10,6,185,58
#000000025e368ec4: e3b010000008 ag %r11,0(%r1)
>000000025e368eca: e310b0080004 lg %r1,8(%r11)
000000025e368ed0: a7110001 tmll %r1,1
000000025e368ed4: a7740129 brc 7,25e369126
000000025e368ed8: e320b0080004 lg %r2,8(%r11)
000000025e368ede: b904001b lgr %r1,%r11
Call Trace:
[<000000025e368eca>] kfree+0x42/0x330
[<000000025e5202a2>] blk_mq_free_tag_set+0x72/0xb8
[<000003ff801316a8>] dm_mq_cleanup_mapped_device+0x38/0x50 [dm_mod]
[<000003ff80120082>] free_dev+0x52/0xd0 [dm_mod]
[<000003ff801233f0>] __dm_destroy+0x150/0x1d0 [dm_mod]
[<000003ff8012bb9a>] dev_remove+0x162/0x1c0 [dm_mod]
[<000003ff8012a988>] ctl_ioctl+0x198/0x478 [dm_mod]
[<000003ff8012ac8a>] dm_ctl_ioctl+0x22/0x38 [dm_mod]
[<000000025e3b11ee>] ksys_ioctl+0xbe/0xe0
[<000000025e3b127a>] __s390x_sys_ioctl+0x2a/0x40
[<000000025e8c15ac>] system_call+0xd8/0x2c8
Last Breaking-Event-Address:
[<000000025e52029c>] blk_mq_free_tag_set+0x6c/0xb8
Kernel panic - not syncing: Fatal exception: panic_on_oopsWhen allocation/initialization of the blk_mq_tag_set fails in dm_mq_init_request_queue(), it is uninitialized/freed, but the pointer is not reset to NULL; so when dev_remove() later gets into dm_mq_cleanup_mapped_device() it sees the pointer and tries to uninitialize and free it again.
Fix this by setting the pointer to NULL in dm_mq_init_request_queue() error-handling. Also set it to NULL in dm_mq_cleanup_mapped_device().
--- drivers/md/dm-rq.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/dm-rq.c +2 -0
@@ -822,6 +822,7 @@ out_tag_set:blk_mq_free_tag_set (md->tag_set); out_kfree_tag_set:kfree (md->tag_set); + md->tag_set =NULL ;return err; }
@@ -831,6 +832,7 @@ void dm_mq_cleanup_mapped_device(structif (md->tag_set) {blk_mq_free_tag_set (md->tag_set);kfree (md->tag_set); + md->tag_set =NULL ; } }
Greg Kroah-Hartman
maintainerPATCH 103/323 modules: mark ref_module static
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 7ef5264de773279b9f23b6cc8afb5addb30e970b upstream.
ref_module isn't used anywhere outside of module.c.
--- include/linux/module.h | 1 - kernel/module.c | 6 ++---- 2 files changed, 2 insertions(+), 5 deletions(-)
include/linux/module.h +0 -1
@@ -597,7 +597,6 @@ static inline void __module_get(struct m#define symbol_put_addr (p) do { } while (0)#endif /* CONFIG_MODULE_UNLOAD */ -int ref_module (struct module *a,struct module *b);/* This is a #define so the string doesn't get put in every .o file */ #define module_name (mod) \
kernel/module.c +2 -4
@@ -850,7 +850,7 @@ static int add_module_usage(struct modul }/* Module a uses b: caller needs module_mutex() */ -int ref_module (struct module *a,struct module *b) +static int ref_module (struct module *a,struct module *b) {int err;
@@ -869,7 +869,6 @@ int ref_module(struct module *a, struct }return 0 ; } -EXPORT_SYMBOL_GPL (ref_module);/* Clear the unload stuff of the module. */ static void module_unload_free (struct module *mod)
@@ -1150,11 +1149,10 @@ static inline void module_unload_free(st { } -int ref_module (struct module *a,struct module *b) +static int ref_module (struct module *a,struct module *b) {return strong_try_module_get (b); } -EXPORT_SYMBOL_GPL (ref_module);static inline int module_unload_init (struct module *mod) {
Greg Kroah-Hartman
maintainerPATCH 104/323 modules: mark find_symbol static
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 773110470e2fa3839523384ae014f8a723c4d178 upstream.
find_symbol is only used in module.c.
--- include/linux/module.h | 11 ----------- kernel/module.c | 3 +-- 2 files changed, 1 insertion(+), 13 deletions(-)
include/linux/module.h +0 -11
@@ -531,17 +531,6 @@ struct symsearch { };/* -* Search for an exported symbol by name. -* -* Must be called with module_mutex held or preemption disabled. -*/ -const struct kernel_symbol *find_symbol (const char *name, -struct module **owner, -const s32 **crc, -bool gplok, -bool warn); - -/* * Walk the exported symbol table * * Must be called with module_mutex held or preemption disabled.
kernel/module.c +1 -2
@@ -565,7 +565,7 @@ static bool find_symbol_in_section(const/* Find a symbol and return it, along with, (optional) crc and * (optional) module which owns it. Needs preempt disabled or module_mutex. */ -const struct kernel_symbol *find_symbol(const char *name, +static const struct kernel_symbol *find_symbol(const char *name, struct module **owner, const s32 **crc, bool gplok,
@@ -588,7 +588,6 @@ const struct kernel_symbol *find_symbol(pr_debug ("Failed to find symbol %s\n" , name);return NULL ; } -EXPORT_SYMBOL_GPL (find_symbol);/* * Search for module by name: must hold module_mutex (or preempt disabled
Greg Kroah-Hartman
maintainerPATCH 105/323 modules: mark each_symbol_section static
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit a54e04914c211b5678602a46b3ede5d82ec1327d upstream.
each_symbol_section is only used inside of module.c.
--- include/linux/module.h | 9 --------- kernel/module.c | 3 +-- 2 files changed, 1 insertion(+), 11 deletions(-)
include/linux/module.h +0 -9
@@ -530,15 +530,6 @@ struct symsearch {bool unused; }; -/* -* Walk the exported symbol table -* -* Must be called with module_mutex held or preemption disabled. -*/ -bool each_symbol_section (bool (*fn)(const struct symsearch *arr, -struct module *owner, -void *data),void *data); -/* Returns 0 and fills in value, defined and namebuf, or -ERANGE if symnum out of range. */ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
kernel/module.c +1 -2
@@ -430,7 +430,7 @@ static bool each_symbol_in_section(const }/* Returns true as soon as fn returns true, otherwise false. */ -bool each_symbol_section (bool (*fn)(const struct symsearch *arr, +static bool each_symbol_section (bool (*fn)(const struct symsearch *arr,struct module *owner,void *data),void *data)
@@ -491,7 +491,6 @@ bool each_symbol_section(bool (*fn)(cons }return false; } -EXPORT_SYMBOL_GPL (each_symbol_section);struct find_symbol_arg {/* Input */
Greg Kroah-Hartman
maintainerPATCH 106/323 modules: unexport __module_text_address
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 3fe1e56d0e68b623dd62d8d38265d2a052e7e185 upstream.
__module_text_address is only used by built-in code.
--- kernel/module.c | 1 - 1 file changed, 1 deletion(-)
kernel/module.c +0 -1
@@ -4363,7 +4363,6 @@ struct module *__module_text_address(uns }return mod; } -EXPORT_SYMBOL_GPL (__module_text_address);/* Don't grab lock, we're oopsing. */ void print_modules (void )
Greg Kroah-Hartman
maintainerPATCH 107/323 modules: unexport __module_address
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 34e64705ad415ed7a816e60ef62b42fe6d1729d9 upstream.
__module_address is only used by built-in code.
--- kernel/module.c | 1 - 1 file changed, 1 deletion(-)
kernel/module.c +0 -1
@@ -4324,7 +4324,6 @@ struct module *__module_address(unsigned }return mod; } -EXPORT_SYMBOL_GPL (__module_address);/* * is_module_text_address - is this address inside module code?
Greg Kroah-Hartman
maintainerPATCH 108/323 modules: rename the licence field in struct symsearch to license
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit cd8732cdcc37d7077c4fa2c966b748c0662b607e upstream.
Use the same spelling variant as the rest of the file.
--- include/linux/module.h | 2 +- kernel/module.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
include/linux/module.h +1 -1
@@ -526,7 +526,7 @@ struct symsearch {NOT_GPL_ONLY ,GPL_ONLY ,WILL_BE_GPL_ONLY , - } licence; + } license;bool unused; };
kernel/module.c +2 -2
@@ -511,9 +511,9 @@ static bool check_symbol(const struct systruct find_symbol_arg *fsa = data;if (!fsa->gplok) { -if (syms->licence ==GPL_ONLY ) +if (syms->license ==GPL_ONLY )return false; -if (syms->licence ==WILL_BE_GPL_ONLY && fsa->warn) { +if (syms->license ==WILL_BE_GPL_ONLY && fsa->warn) {pr_warn ("Symbol %s is being used by a non-GPL module, " "which will not be allowed in the future\n" , fsa->name);
Greg Kroah-Hartman
maintainerPATCH 109/323 modules: return licensing information from find_symbol
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit ef1dac6021cc8ec5de02ce31722bf26ac4ed5523 upstream.
Report the GPLONLY status through a new argument.
--- include/linux/module.h | 2 +- kernel/module.c | 16 +++++++++++----- 2 files changed, 12 insertions(+), 6 deletions(-)
include/linux/module.h +1 -1
@@ -522,7 +522,7 @@ struct module *find_module(const char *nstruct symsearch {const struct kernel_symbol *start, *stop;const s32 *crcs; -enum { +enum mod_license {NOT_GPL_ONLY ,GPL_ONLY ,WILL_BE_GPL_ONLY ,
kernel/module.c +11 -5
@@ -502,6 +502,7 @@ struct find_symbol_arg {struct module *owner;const s32 *crc;const struct kernel_symbol *sym; +enum mod_license license; }; static bool check_symbol(const struct symsearch *syms,
@@ -535,6 +536,7 @@ static bool check_symbol(const struct sy fsa->owner = owner; fsa->crc =symversion (syms->crcs, symnum); fsa->sym = &syms->start[symnum]; + fsa->license = syms->license;return true; }
@@ -567,6 +569,7 @@ static bool find_symbol_in_section(conststatic const struct kernel_symbol *find_symbol (const char *name,struct module **owner,const s32 **crc, +enum mod_license *license,bool gplok,bool warn) {
@@ -581,6 +584,8 @@ static const struct kernel_symbol *find_ *owner = fsa.owner;if (crc) *crc = fsa.crc; +if (license) + *license = fsa.license;return fsa.sym; }
@@ -1055,7 +1060,7 @@ void __symbol_put(const char *symbol)struct module *owner;preempt_disable (); -if (!find_symbol (symbol, &owner,NULL , true, false)) +if (!find_symbol (symbol, &owner,NULL ,NULL , true, false))BUG ();module_put (owner);preempt_enable ();
@@ -1334,7 +1339,7 @@ static inline int check_modstruct_versio*/ preempt_disable ();if (!find_symbol (VMLINUX_SYMBOL_STR (module_layout),NULL , - &crc, true, false)) { + &crc,NULL , true, false)) {preempt_enable ();BUG (); }
@@ -1384,6 +1389,7 @@ static const struct kernel_symbol *resolstruct module *owner;const struct kernel_symbol *sym;const s32 *crc; +enum mod_license license;int err;/*
@@ -1393,7 +1399,7 @@ static const struct kernel_symbol *resol*/ sched_annotate_sleep ();mutex_lock (&module_mutex); - sym =find_symbol (name, &owner, &crc, + sym =find_symbol (name, &owner, &crc, &license, !(mod->taints & (1 <<TAINT_PROPRIETARY_MODULE )), true);if (!sym) goto unlock;
@@ -2197,7 +2203,7 @@ void *__symbol_get(const char *symbol)const struct kernel_symbol *sym;preempt_disable (); - sym =find_symbol (symbol, &owner,NULL , true, true); + sym =find_symbol (symbol, &owner,NULL ,NULL , true, true);if (sym &&strong_try_module_get (owner)) sym =NULL ;preempt_enable ();
@@ -2232,7 +2238,7 @@ static int verify_export_symbols(structfor (i =0 ; i <ARRAY_SIZE (arr); i++) {for (s = arr[i].sym; s < arr[i].sym + arr[i].num; s++) { -if (find_symbol (s->name, &owner,NULL , true, false)) { +if (find_symbol (s->name, &owner,NULL ,NULL , true, false)) {pr_err ("%s: exports duplicate symbol %s" " (owned by %s)\n" , mod->name, s->name,module_name (owner));
Greg Kroah-Hartman
maintainerPATCH 110/323 modules: inherit TAINT_PROPRIETARY_MODULE
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 262e6ae7081df304fc625cf368d5c2cbba2bb991 upstream.
If a TAINT_PROPRIETARY_MODULE exports symbol, inherit the taint flag for all modules importing these symbols, and don't allow loading symbols from TAINT_PROPRIETARY_MODULE modules if the module previously imported gplonly symbols. Add a anti-circumvention devices so people don't accidentally get themselves into trouble this way.
Comment from Greg:
"Ah, the proven-to-be-illegal "GPL Condom" defense :)"
--- include/linux/module.h | 1 + kernel/module.c | 27 +++++++++++++++++++++++++++ 2 files changed, 28 insertions(+)
include/linux/module.h +1 -0
@@ -357,6 +357,7 @@ struct module {unsigned int num_gpl_syms;const struct kernel_symbol *gpl_syms;const s32 *gpl_crcs; +bool using_gplonly_symbols;#ifdef CONFIG_UNUSED_SYMBOLS /* unused exported symbols. */
kernel/module.c +27 -0
@@ -1380,6 +1380,25 @@ static inline int same_magic(const char }#endif /* CONFIG_MODVERSIONS */ +static bool inherit_taint (struct module *mod,struct module *owner) +{ +if (!owner || !test_bit (TAINT_PROPRIETARY_MODULE , &owner->taints)) +return true; + +if (mod->using_gplonly_symbols) { +pr_err ("%s: module using GPL-only symbols uses symbols from proprietary module %s.\n" , + mod->name, owner->name); +return false; + } + +if (!test_bit (TAINT_PROPRIETARY_MODULE , &mod->taints)) { +pr_warn ("%s: module uses symbols from proprietary module %s, inheriting taint.\n" , + mod->name, owner->name); +set_bit (TAINT_PROPRIETARY_MODULE , &mod->taints); + } +return true; +} +/* Resolve a symbol for this module. I.e. if we find one, record usage. */ static const struct kernel_symbol *resolve_symbol(struct module *mod, const struct load_info *info,
@@ -1404,6 +1423,14 @@ static const struct kernel_symbol *resolif (!sym) goto unlock; +if (license ==GPL_ONLY ) + mod->using_gplonly_symbols = true; + +if (!inherit_taint (mod, owner)) { + sym =NULL ; + goto getname; + } +if (!check_version (info, name, mod, crc)) { sym =ERR_PTR (-EINVAL ); goto getname;
Greg Kroah-Hartman
maintainerPATCH 111/323 Bluetooth: verify AMP hci_chan before amp_destroy
In reply to Greg Kroah-HartmanFrom: Archie Pusaka <[email protected]>
commit 5c4c8c9544099bb9043a10a5318130a943e32fc3 upstream.
hci_chan can be created in 2 places: hci_loglink_complete_evt() if it is an AMP hci_chan, or l2cap_conn_add() otherwise. In theory, Only AMP hci_chan should be removed by a call to hci_disconn_loglink_complete_evt(). However, the controller might mess up, call that function, and destroy an hci_chan which is not initiated by hci_loglink_complete_evt().
This patch adds a verification that the destroyed hci_chan must have been init'd by hci_loglink_complete_evt().
Example crash call trace:
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xe3/0x144 lib/dump_stack.c:118
print_address_description+0x67/0x22a mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report mm/kasan/report.c:412 [inline]
kasan_report+0x251/0x28f mm/kasan/report.c:396
hci_send_acl+0x3b/0x56e net/bluetooth/hci_core.c:4072
l2cap_send_cmd+0x5af/0x5c2 net/bluetooth/l2cap_core.c:877
l2cap_send_move_chan_cfm_icid+0x8e/0xb1 net/bluetooth/l2cap_core.c:4661
l2cap_move_fail net/bluetooth/l2cap_core.c:5146 [inline]
l2cap_move_channel_rsp net/bluetooth/l2cap_core.c:5185 [inline]
l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5464 [inline]
l2cap_sig_channel net/bluetooth/l2cap_core.c:5799 [inline]
l2cap_recv_frame+0x1d12/0x51aa net/bluetooth/l2cap_core.c:7023
l2cap_recv_acldata+0x2ea/0x693 net/bluetooth/l2cap_core.c:7596
hci_acldata_packet net/bluetooth/hci_core.c:4606 [inline]
hci_rx_work+0x2bd/0x45e net/bluetooth/hci_core.c:4796
process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175
worker_thread+0x4fc/0x670 kernel/workqueue.c:2321
kthread+0x2f0/0x304 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415
Allocated by task 38:
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0x8d/0x9a mm/kasan/kasan.c:553
kmem_cache_alloc_trace+0x102/0x129 mm/slub.c:2787
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
hci_chan_create+0x86/0x26d net/bluetooth/hci_conn.c:1674
l2cap_conn_add.part.0+0x1c/0x814 net/bluetooth/l2cap_core.c:7062
l2cap_conn_add net/bluetooth/l2cap_core.c:7059 [inline]
l2cap_connect_cfm+0x134/0x852 net/bluetooth/l2cap_core.c:7381
hci_connect_cfm+0x9d/0x122 include/net/bluetooth/hci_core.h:1404
hci_remote_ext_features_evt net/bluetooth/hci_event.c:4161 [inline]
hci_event_packet+0x463f/0x72fa net/bluetooth/hci_event.c:5981
hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791
process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175
worker_thread+0x4fc/0x670 kernel/workqueue.c:2321
kthread+0x2f0/0x304 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415
Freed by task 1732:
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free mm/kasan/kasan.c:521 [inline]
__kasan_slab_free+0x106/0x128 mm/kasan/kasan.c:493
slab_free_hook mm/slub.c:1409 [inline]
slab_free_freelist_hook+0xaa/0xf6 mm/slub.c:1436
slab_free mm/slub.c:3009 [inline]
kfree+0x182/0x21e mm/slub.c:3972
hci_disconn_loglink_complete_evt net/bluetooth/hci_event.c:4891 [inline]
hci_event_packet+0x6a1c/0x72fa net/bluetooth/hci_event.c:6050
hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791
process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175
worker_thread+0x4fc/0x670 kernel/workqueue.c:2321
kthread+0x2f0/0x304 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415
The buggy address belongs to the object at ffff8881d7af9180
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 24 bytes inside of
128-byte region [ffff8881d7af9180, ffff8881d7af9200)
The buggy address belongs to the page:
page:ffffea00075ebe40 count:1 mapcount:0 mapping:ffff8881da403200 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 dead000000000100 dead000000000200 ffff8881da403200
raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881d7af9080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8881d7af9100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8881d7af9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881d7af9200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881d7af9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc--- include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_event.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
include/net/bluetooth/hci_core.h +1 -0
@@ -514,6 +514,7 @@ struct hci_chan {struct sk_buff_head data_q;unsigned int sent;__u8 state; +bool amp; };struct hci_conn_params {
net/bluetooth/hci_event.c +2 -1
@@ -4399,6 +4399,7 @@ static void hci_loglink_complete_evt(strreturn ; hchan->handle =le16_to_cpu (ev->handle); + hchan->amp = true;BT_DBG ("hcon %p mgr %p hchan %p" , hcon, hcon->amp_mgr, hchan);
@@ -4431,7 +4432,7 @@ static void hci_disconn_loglink_completehci_dev_lock (hdev); hchan =hci_chan_lookup_handle (hdev,le16_to_cpu (ev->handle)); -if (!hchan) +if (!hchan || !hchan->amp) goto unlock;amp_destroy_logical_link (hchan, ev->reason);
Greg Kroah-Hartman
maintainerPATCH 112/323 hsr: use netdev_err() instead of WARN_ONCE()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
commit 4b793acdca0050739b99ace6a8b9e7f717f57c6b upstream.
When HSR interface is sending a frame, it finds a node with the destination ethernet address from the list.
If there is no node, it calls WARN_ONCE().
But, using WARN_ONCE() for this situation is a little bit overdoing. So, in this patch, the netdev_err() is used instead.
--- net/hsr/hsr_framereg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/hsr/hsr_framereg.c +2 -1
@@ -310,7 +310,8 @@ void hsr_addr_subst_dest(struct hsr_node node_dst =find_node_by_AddrA (&port->hsr->node_db,eth_hdr (skb)->h_dest);if (!node_dst) { -WARN_ONCE (1 ,"%s: Unknown node\n" , __func__); +if (net_ratelimit ()) +netdev_err (skb->dev,"%s: Unknown node\n" , __func__);return ; }if (port->type != node_dst->AddrB_port)
Greg Kroah-Hartman
maintainerPATCH 113/323 bluetooth: eliminate the potential race condition when removing the HCI controller
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
commit e2cb6b891ad2b8caa9131e3be70f45243df82a80 upstream.
There is a possible race condition vulnerability between issuing a HCI command and removing the cont. Specifically, functions hci_req_sync() and hci_dev_do_close() can race each other like below:
thread-A in hci_req_sync() | thread-B in hci_dev_do_close()
| hci_req_sync_lock(hdev);
test_bit(HCI_UP, &hdev->flags); |
... | test_and_clear_bit(HCI_UP, &hdev->flags)
hci_req_sync_lock(hdev); |
|In this commit we alter the sequence in function hci_req_sync(). Hence, the thread-A cannot issue th.
--- net/bluetooth/hci_request.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/bluetooth/hci_request.c +8 -4
@@ -277,12 +277,16 @@ int hci_req_sync(struct hci_dev *hdev, i {int ret; -if (!test_bit (HCI_UP , &hdev->flags)) -return -ENETDOWN ; -/* Serialize all requests */ hci_req_sync_lock (hdev); - ret =__hci_req_sync (hdev, req, opt, timeout, hci_status); +/* check the state after obtaing the lock to protect the HCI_UP +* against any races from hci_dev_do_close when the controller +* gets removed. +*/ +if (test_bit (HCI_UP , &hdev->flags)) + ret =__hci_req_sync (hdev, req, opt, timeout, hci_status); +else + ret = -ENETDOWN ;hci_req_sync_unlock (hdev);return ret;
Greg Kroah-Hartman
maintainerPATCH 114/323 net/nfc: fix use-after-free llcp_sock_bind/connect
In reply to Greg Kroah-HartmanFrom: Or Cohen <[email protected]>
commit c61760e6940dd4039a7f5e84a6afc9cdbf4d82b6 upstream.
Commits 8a4cd82d ("nfc: fix refcount leak in llcp_sock_connect()") and c33b1cc62 ("nfc: fix refcount leak in llcp_sock_bind()") fixed a refcount leak bug in bind/connect but introduced a use-after-free if the same local is assigned to 2 different sockets.
This can be triggered by the following simple program:
int sock1 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP );
int sock2 = socket( AF_NFC, SOCK_STREAM, NFC_SOCKPROTO_LLCP );
memset( &addr, 0, sizeof(struct sockaddr_nfc_llcp) );
addr.sa_family = AF_NFC;
addr.nfc_protocol = NFC_PROTO_NFC_DEP;
bind( sock1, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) )
bind( sock2, (struct sockaddr*) &addr, sizeof(struct sockaddr_nfc_llcp) )
close(sock1);
close(sock2);Fix this by assigning NULL to llcp_sock->local after calling nfc_llcp_local_put.
This addresses CVE-2021-23134.
--- net/nfc/llcp_sock.c | 4 ++++ 1 file changed, 4 insertions(+)
net/nfc/llcp_sock.c +4 -0
@@ -121,12 +121,14 @@ static int llcp_sock_bind(struct socket GFP_KERNEL);if (!llcp_sock->service_name) {nfc_llcp_local_put (llcp_sock->local); + llcp_sock->local =NULL ; ret = -ENOMEM ; goto put_dev; } llcp_sock->ssap =nfc_llcp_get_sdp_ssap (local, llcp_sock);if (llcp_sock->ssap ==LLCP_SAP_MAX ) {nfc_llcp_local_put (llcp_sock->local); + llcp_sock->local =NULL ;kfree (llcp_sock->service_name); llcp_sock->service_name =NULL ; ret = -EADDRINUSE ;
@@ -722,6 +724,7 @@ static int llcp_sock_connect(struct sock llcp_sock->ssap =nfc_llcp_get_local_ssap (local);if (llcp_sock->ssap ==LLCP_SAP_MAX ) {nfc_llcp_local_put (llcp_sock->local); + llcp_sock->local =NULL ; ret = -ENOMEM ; goto put_dev; }
@@ -760,6 +763,7 @@ static int llcp_sock_connect(struct sock sock_unlink:nfc_llcp_put_ssap (local, llcp_sock->ssap);nfc_llcp_local_put (llcp_sock->local); + llcp_sock->local =NULL ;nfc_llcp_sock_unlink (&local->connecting_sockets, sk);kfree (llcp_sock->service_name);
Greg Kroah-Hartman
maintainerPATCH 115/323 MIPS: pci-rt2880: fix slot 0 configuration
In reply to Greg Kroah-HartmanFrom: Ilya Lipnitskiy <[email protected]>
commit 8e98b697006d749d745d3b174168a877bb96c500 upstream.
pci_fixup_irqs() used to call pcibios_map_irq on every PCI device, which for RT2880 included bus 0 slot 0. After pci_fixup_irqs() got removed, only slots/funcs with devices attached would be called. While arguably the right thing, that left no chance for this driver to ever initialize slot 0, effectively bricking PCI and USB on RT2880 devices such as the Belkin F5D8235-4 v1.
Slot 0 configuration needs to happen after PCI bus enumeration, but before any device at slot 0x11 (func 0 or 1) is talked to. That was determined empirically by testing on a Belkin F5D8235-4 v1 device. A minimal BAR 0 config write followed by read, then setting slot 0 PCI_COMMAND to MASTER | IO | MEMORY is all that seems to be required for proper functionality.
Tested by ensuring that full- and high-speed USB devices get enumerated on the Belkin F5D8235-4 v1 (with an out of tree DTS file from OpenWrt).
--- arch/mips/pci/pci-rt2880.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-)
arch/mips/pci/pci-rt2880.c +24 -13
@@ -183,7 +183,6 @@ static inline void rt2880_pci_write_u32(int pcibios_map_irq (const struct pci_dev *dev,u8 slot,u8 pin) { -u16 cmd;int irq =-1 ;if (dev->bus->number !=0 )
@@ -191,8 +190,6 @@ int pcibios_map_irq(const struct pci_devswitch (PCI_SLOT (dev->devfn)) {case 0x00 : -rt2880_pci_write_u32 (PCI_BASE_ADDRESS_0 ,0x08000000 ); - (void )rt2880_pci_read_u32 (PCI_BASE_ADDRESS_0 );break ;case 0x11 : irq =RT288X_CPU_IRQ_PCI ;
@@ -204,16 +201,6 @@ int pcibios_map_irq(const struct pci_devbreak ; } -pci_write_config_byte ((struct pci_dev *) dev, -PCI_CACHE_LINE_SIZE ,0x14 ); -pci_write_config_byte ((struct pci_dev *) dev,PCI_LATENCY_TIMER ,0xFF ); -pci_read_config_word ((struct pci_dev *) dev,PCI_COMMAND , &cmd); - cmd |=PCI_COMMAND_MASTER |PCI_COMMAND_IO |PCI_COMMAND_MEMORY | -PCI_COMMAND_INVALIDATE |PCI_COMMAND_FAST_BACK | -PCI_COMMAND_SERR |PCI_COMMAND_WAIT |PCI_COMMAND_PARITY ; -pci_write_config_word ((struct pci_dev *) dev,PCI_COMMAND , cmd); -pci_write_config_byte ((struct pci_dev *) dev,PCI_INTERRUPT_LINE , - dev->irq);return irq; }
@@ -252,6 +239,30 @@ static int rt288x_pci_probe(struct platfint pcibios_plat_dev_init (struct pci_dev *dev) { +static bool slot0_init; + +/* +* Nobody seems to initialize slot 0, but this platform requires it, so +* do it once when some other slot is being enabled. The PCI subsystem +* should configure other slots properly, so no need to do anything +* special for those. +*/ +if (!slot0_init && dev->bus->number ==0 ) { +u16 cmd; +u32 bar0; + + slot0_init = true; + +pci_bus_write_config_dword (dev->bus,0 ,PCI_BASE_ADDRESS_0 , +0x08000000 ); +pci_bus_read_config_dword (dev->bus,0 ,PCI_BASE_ADDRESS_0 , + &bar0); + +pci_bus_read_config_word (dev->bus,0 ,PCI_COMMAND , &cmd); + cmd |=PCI_COMMAND_MASTER |PCI_COMMAND_IO |PCI_COMMAND_MEMORY ; +pci_bus_write_config_word (dev->bus,0 ,PCI_COMMAND , cmd); + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 116/323 FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit f626ca682912fab55dff15469ce893ae16b65c7e upstream.
Recent versions of the PCI Express specification have deprecated support for I/O transactions and actually some PCIe host bridges, such as Power Systems Host Bridge 4 (PHB4), do not implement them.
For those systems the PCI BARs that request a mapping in the I/O space have the length recorded in the corresponding PCI resource set to zero, which makes it unassigned:
# lspci -s 0031:02:04.0 -v 0031:02:04.0 FDDI network controller: Digital Equipment Corporation PCI-to-PDQ Interface Chip [PFI] FDDI (DEFPA) (rev 02) Subsystem: Digital Equipment Corporation FDDIcontroller/PCI (DEFPA) Flags: bus master, medium devsel, latency 136, IRQ 57, NUMA node 8 Memory at 620c080020000 (32-bit, non-prefetchable) [size=128] I/O ports at <unassigned> [disabled] Memory at 620c080030000 (32-bit, non-prefetchable) [size=64K] Capabilities: [50] Power Management version 2 Kernel driver in use: defxx Kernel modules: defxx
#
Regardless the driver goes ahead and requests it (here observed with a Raptor Talos II POWER9 system), resulting in an odd /proc/ioport entry:
# cat /proc/ioports 00000000-ffffffffffffffff : 0031:02:04.0 #
Furthermore, the system gets confused as the driver actually continues and pokes at those locations, causing a flood of messages being output to the system console by the underlying system firmware, like:
defxx: v1.11 2014/07/01 Lawrence V. Stefani and others defxx 0031:02:04.0: enabling device (0140 -> 0142) LPC[000]: Got SYNC no-response error. Error address reg: 0xd0010000
IPMI: dropping non severe PEL event
LPC[000]: Got SYNC no-response error. Error address reg: 0xd0010014
IPMI: dropping non severe PEL event
LPC[000]: Got SYNC no-response error. Error address reg: 0xd0010014
IPMI: dropping non severe PEL event
and so on and so on (possibly intermixed actually, as there's no locking between the kernel and the firmware in console port access with this particular system, but cleaned up above for clarity), and once some 10k of such pairs of the latter two messages have been produced an interace eventually shows up in a useless state:
0031:02:04.0: DEFPA at I/O addr = 0x0, IRQ = 57, Hardware addr = 00-00-00-00-00-00
This was not expected to happen as resource handling was added to the driver a while ago, because it was not known at that time that a PCI system would be possible that cannot assign port I/O resources, and oddly enough `request_region' does not fail, which would have caught it.
Correct the problem then by checking for the length of zero for the CSR resource and bail out gracefully refusing to register an interface if that turns out to be the case, producing messages like:
defxx: v1.11 2014/07/01 Lawrence V. Stefani and others 0031:02:04.0: Cannot use I/O, no address set, aborting 0031:02:04.0: Recompile driver with "CONFIG_DEFXX_MMIO=y"
Keep the original check for the EISA MMIO resource as implemented, because in that case the length is hardwired to 0x400 as a consequence of how the compare/mask address decoding works in the ESIC chip and it is only the base address that is set to zero if MMIO has been disabled for the adapter in EISA configuration, which in turn could be a valid bus address in a legacy-free system implementing PCI, especially for port I/O.
Where the EISA MMIO resource has been disabled for the adapter in EISA configuration this arrangement keeps producing messages like:
eisa 00:05: EISA: slot 5: DEC3002 detected
defxx: v1.11 2014/07/01 Lawrence V. Stefani and others 00:05: Cannot use MMIO, no address set, aborting 00:05: Recompile driver with "CONFIG_DEFXX_MMIO=n" 00:05: Or run ECU and set adapter's MMIO location
with the last two lines now swapped for easier handling in the driver.
There is no need to check for and catch the case of a port I/O resource not having been assigned for EISA as the adapter uses the slot-specific I/O space, which gets assigned by how EISA has been specified and maps directly to the particular slot an option card has been placed in. And the EISA variant of the adapter has additional registers that are only accessible via the port I/O space anyway.
While at it factor out the error message calls into helpers and fix an argument order bug with the pr_err' call now in dfx_register_res_err'.
--- drivers/net/fddi/defxx.c | 47 ++++++++++++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 17 deletions(-)
drivers/net/fddi/defxx.c +30 -17
@@ -495,6 +495,25 @@ static const struct net_device_ops dfx_n .ndo_set_mac_address = dfx_ctl_set_mac_address, }; +static void dfx_register_res_alloc_err (const char *print_name,bool mmio, +bool eisa) +{ +pr_err ("%s: Cannot use %s, no address set, aborting\n" , + print_name, mmio ?"MMIO" :"I/O" ); +pr_err ("%s: Recompile driver with \"CONFIG_DEFXX_MMIO=%c\"\n" , + print_name, mmio ?'n' :'y' ); +if (eisa && mmio) +pr_err ("%s: Or run ECU and set adapter's MMIO location\n" , + print_name); +} + +static void dfx_register_res_err (const char *print_name,bool mmio, +unsigned long start,unsigned long len) +{ +pr_err ("%s: Cannot reserve %s resource 0x%lx @ 0x%lx, aborting\n" , + print_name, mmio ?"MMIO" :"I/O" , len, start); +} +/* * ================ * = dfx_register =
@@ -568,15 +587,12 @@ static int dfx_register(struct device *bdev_set_drvdata (bdev, dev);dfx_get_bars (bdev, bar_start, bar_len); -if (dfx_bus_eisa && dfx_use_mmio && bar_start[0 ] ==0 ) { -pr_err ("%s: Cannot use MMIO, no address set, aborting\n" , - print_name); -pr_err ("%s: Run ECU and set adapter's MMIO location\n" , - print_name); -pr_err ("%s: Or recompile driver with \"CONFIG_DEFXX_MMIO=n\"" -"\n" , print_name); +if (bar_len[0 ] ==0 || + (dfx_bus_eisa && dfx_use_mmio && bar_start[0 ] ==0 )) { +dfx_register_res_alloc_err (print_name, dfx_use_mmio, + dfx_bus_eisa); err = -ENXIO ; - goto err_out; + goto err_out_disable; }if (dfx_use_mmio)
@@ -585,18 +601,16 @@ static int dfx_register(struct device *belse region =request_region (bar_start[0 ], bar_len[0 ], print_name);if (!region) { -pr_err ("%s: Cannot reserve %s resource 0x%lx @ 0x%lx, " -"aborting\n" , dfx_use_mmio ?"MMIO" :"I/O" , print_name, - (long )bar_len[0 ], (long )bar_start[0 ]); +dfx_register_res_err (print_name, dfx_use_mmio, + bar_start[0 ], bar_len[0 ]); err = -EBUSY ; goto err_out_disable; }if (bar_start[1 ] !=0 ) { region =request_region (bar_start[1 ], bar_len[1 ], print_name);if (!region) { -pr_err ("%s: Cannot reserve I/O resource " -"0x%lx @ 0x%lx, aborting\n" , print_name, - (long )bar_len[1 ], (long )bar_start[1 ]); +dfx_register_res_err (print_name,0 , + bar_start[1 ], bar_len[1 ]); err = -EBUSY ; goto err_out_csr_region; }
@@ -604,9 +618,8 @@ static int dfx_register(struct device *bif (bar_start[2 ] !=0 ) { region =request_region (bar_start[2 ], bar_len[2 ], print_name);if (!region) { -pr_err ("%s: Cannot reserve I/O resource " -"0x%lx @ 0x%lx, aborting\n" , print_name, - (long )bar_len[2 ], (long )bar_start[2 ]); +dfx_register_res_err (print_name,0 , + bar_start[2 ], bar_len[2 ]); err = -EBUSY ; goto err_out_bh_region; }
Greg Kroah-Hartman
maintainerPATCH 117/323 misc: lis3lv02d: Fix false-positive WARN on various HP models
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 3641762c1c9c7cfd84a7061a0a73054f09b412e3 upstream.
Before this commit lis3lv02d_get_pwron_wait() had a WARN_ONCE() to catch a potential divide by 0. WARN macros should only be used to catch internal kernel bugs and that is not the case here. We have been receiving a lot of bug reports about kernel backtraces caused by this WARN.
The div value being checked comes from the lis3->odrs[] array. Which is sized to be a power-of-2 matching the number of bits in lis3->odr_mask.
The only lis3 model where this array is not entirely filled with non zero values. IOW the only model where we can hit the div == 0 check is the 3dc ("8 bits 3DC sensor") model:
int lis3_3dc_rates[16] = {0, 1, 10, 25, 50, 100, 200, 400, 1600, 5000};
Note the 0 value at index 0, according to the datasheet an odr index of 0 means "Power-down mode". HP typically uses a lis3 accelerometer for HDD fall protection. What I believe is happening here is that on newer HP devices, which only contain a SDD, the BIOS is leaving the lis3 device powered-down since it is not used for HDD fall protection.
Note that the lis3_3dc_rates array initializer only specifies 10 values, which matches the datasheet. So it also contains 6 zero values at the end.
Replace the WARN with a normal check, which treats an odr index of 0 as power-down and uses a normal dev_err() to report the error in case odr index point past the initialized part of the array.
--- drivers/misc/lis3lv02d/lis3lv02d.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/misc/lis3lv02d/lis3lv02d.c +16 -5
@@ -221,7 +221,7 @@ static int lis3_3dc_rates[16] = {0, 1, 1static int lis3_3dlh_rates[4 ] = {50 ,100 ,400 ,1000 };/* ODR is Output Data Rate */ -static int lis3lv02d_get_odr (struct lis3lv02d *lis3) +static int lis3lv02d_get_odr_index (struct lis3lv02d *lis3) {u8 ctrl;int shift;
@@ -229,15 +229,23 @@ static int lis3lv02d_get_odr(struct lis3 lis3->read (lis3,CTRL_REG1 , &ctrl); ctrl &= lis3->odr_mask; shift =ffs (lis3->odr_mask) -1 ; -return lis3->odrs[(ctrl >> shift)]; +return (ctrl >> shift); }static int lis3lv02d_get_pwron_wait (struct lis3lv02d *lis3) { -int div =lis3lv02d_get_odr (lis3); +int odr_idx =lis3lv02d_get_odr_index (lis3); +int div = lis3->odrs[odr_idx]; -if (WARN_ONCE (div ==0 ,"device returned spurious data" )) +if (div ==0 ) { +if (odr_idx ==0 ) { +/* Power-down mode, not sampling no need to sleep */ +return 0 ; + } + +dev_err (&lis3->pdev->dev,"Error unknown odrs-index: %d\n" , odr_idx);return -ENXIO ; + }/* LIS3 power on delay is quite long */ msleep (lis3->pwron_delay / div);
@@ -820,9 +828,12 @@ static ssize_t lis3lv02d_rate_show(struc struct device_attribute *attr, char *buf) { struct lis3lv02d *lis3 = dev_get_drvdata(dev); +int odr_idx;lis3lv02d_sysfs_poweron (lis3); -return sprintf (buf,"%d\n" ,lis3lv02d_get_odr (lis3)); + + odr_idx =lis3lv02d_get_odr_index (lis3); +return sprintf (buf,"%d\n" , lis3->odrs[odr_idx]); } static ssize_t lis3lv02d_rate_set(struct device *dev,
Greg Kroah-Hartman
maintainerPATCH 118/323 misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit 376565b9717c30cd58ad33860fa42697615fa2e4 upstream.
KMSAN complains that the vmci_use_ppn64() == false path in vmci_dbell_register_notification_bitmap() left upper 32bits of bitmap_set_msg.bitmap_ppn64 member uninitialized.
=====================================================
BUG: KMSAN: uninit-value in kmsan_check_memory+0xd/0x10 CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.11.0-rc7+ #4 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020 Call Trace: dump_stack+0x21c/0x280 kmsan_report+0xfb/0x1e0 kmsan_internal_check_memory+0x484/0x520 kmsan_check_memory+0xd/0x10 iowrite8_rep+0x86/0x380 vmci_send_datagram+0x150/0x280 vmci_dbell_register_notification_bitmap+0x133/0x1e0 vmci_guest_probe_device+0xcab/0x1e70 pci_device_probe+0xab3/0xe70 really_probe+0xd16/0x24d0 driver_probe_device+0x29d/0x3a0 device_driver_attach+0x25a/0x490 __driver_attach+0x78c/0x840 bus_for_each_dev+0x210/0x340 driver_attach+0x89/0xb0 bus_add_driver+0x677/0xc40 driver_register+0x485/0x8e0 __pci_register_driver+0x1ff/0x350 vmci_guest_init+0x3e/0x41 vmci_drv_init+0x1d6/0x43f do_one_initcall+0x39c/0x9a0 do_initcall_level+0x1d7/0x259 do_initcalls+0x127/0x1cb do_basic_setup+0x33/0x36 kernel_init_freeable+0x29a/0x3ed kernel_init+0x1f/0x840 ret_from_fork+0x1f/0x30
Local variable ----bitmap_set_msg@vmci_dbell_register_notification_bitmap created at:
vmci_dbell_register_notification_bitmap+0x50/0x1e0 vmci_dbell_register_notification_bitmap+0x50/0x1e0
Bytes 28-31 of 32 are uninitialized
Memory access of size 32 starts at ffff88810098f570
=====================================================
--- drivers/misc/vmw_vmci/vmci_doorbell.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/vmw_vmci/vmci_doorbell.c +1 -1
@@ -334,7 +334,7 @@ int vmci_dbell_host_context_notify(u32 sbool vmci_dbell_register_notification_bitmap (u32 bitmap_ppn) {int result; -struct vmci_notify_bm_set_msg bitmap_set_msg; +struct vmci_notify_bm_set_msg bitmap_set_msg = { }; bitmap_set_msg.hdr.dst =vmci_make_handle (VMCI_HYPERVISOR_CONTEXT_ID ,VMCI_SET_NOTIFY_BITMAP );
Greg Kroah-Hartman
maintainerPATCH 119/323 misc: vmw_vmci: explicitly initialize vmci_datagram payload
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit b2192cfeba8481224da0a4ec3b4a7ccd80b1623b upstream.
KMSAN complains that vmci_check_host_caps() left the payload part of check_msg uninitialized.
=====================================================
BUG: KMSAN: uninit-value in kmsan_check_memory+0xd/0x10 CPU: 1 PID: 1 Comm: swapper/0 Tainted: G B 5.11.0-rc7+ #4 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020 Call Trace: dump_stack+0x21c/0x280 kmsan_report+0xfb/0x1e0 kmsan_internal_check_memory+0x202/0x520 kmsan_check_memory+0xd/0x10 iowrite8_rep+0x86/0x380 vmci_guest_probe_device+0xf0b/0x1e70 pci_device_probe+0xab3/0xe70 really_probe+0xd16/0x24d0 driver_probe_device+0x29d/0x3a0 device_driver_attach+0x25a/0x490 __driver_attach+0x78c/0x840 bus_for_each_dev+0x210/0x340 driver_attach+0x89/0xb0 bus_add_driver+0x677/0xc40 driver_register+0x485/0x8e0 __pci_register_driver+0x1ff/0x350 vmci_guest_init+0x3e/0x41 vmci_drv_init+0x1d6/0x43f do_one_initcall+0x39c/0x9a0 do_initcall_level+0x1d7/0x259 do_initcalls+0x127/0x1cb do_basic_setup+0x33/0x36 kernel_init_freeable+0x29a/0x3ed kernel_init+0x1f/0x840 ret_from_fork+0x1f/0x30
Uninit was created at:
kmsan_internal_poison_shadow+0x5c/0xf0 kmsan_slab_alloc+0x8d/0xe0 kmem_cache_alloc+0x84f/0xe30 vmci_guest_probe_device+0xd11/0x1e70 pci_device_probe+0xab3/0xe70 really_probe+0xd16/0x24d0 driver_probe_device+0x29d/0x3a0 device_driver_attach+0x25a/0x490 __driver_attach+0x78c/0x840 bus_for_each_dev+0x210/0x340 driver_attach+0x89/0xb0 bus_add_driver+0x677/0xc40 driver_register+0x485/0x8e0 __pci_register_driver+0x1ff/0x350 vmci_guest_init+0x3e/0x41 vmci_drv_init+0x1d6/0x43f do_one_initcall+0x39c/0x9a0 do_initcall_level+0x1d7/0x259 do_initcalls+0x127/0x1cb do_basic_setup+0x33/0x36 kernel_init_freeable+0x29a/0x3ed kernel_init+0x1f/0x840 ret_from_fork+0x1f/0x30
Bytes 28-31 of 36 are uninitialized
Memory access of size 36 starts at ffff8881675e5f00
=====================================================
--- drivers/misc/vmw_vmci/vmci_guest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/vmw_vmci/vmci_guest.c +1 -1
@@ -169,7 +169,7 @@ static int vmci_check_host_caps(struct p VMCI_UTIL_NUM_RESOURCES * sizeof(u32);struct vmci_datagram *check_msg; - check_msg =kmalloc (msg_size,GFP_KERNEL ); + check_msg =kzalloc (msg_size,GFP_KERNEL );if (!check_msg) {dev_err (&pdev->dev,"%s: Insufficient memory\n" , __func__);return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 120/323 tracing: Restructure trace_clock_global() to never block
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit aafe104aa9096827a429bc1358f8260ee565b7cc upstream.
It was reported that a fix to the ring buffer recursion detection would cause a hung machine when performing suspend / resume testing. The following backtrace was extracted from debugging that case:
Call Trace: trace_clock_global+0x91/0xa0 __rb_reserve_next+0x237/0x460 ring_buffer_lock_reserve+0x12a/0x3f0 trace_buffer_lock_reserve+0x10/0x50 __trace_graph_return+0x1f/0x80 trace_graph_return+0xb7/0xf0 ? trace_clock_global+0x91/0xa0 ftrace_return_to_handler+0x8b/0xf0 ? pv_hash+0xa0/0xa0 return_to_handler+0x15/0x30 ? ftrace_graph_caller+0xa0/0xa0 ? trace_clock_global+0x91/0xa0 ? __rb_reserve_next+0x237/0x460 ? ring_buffer_lock_reserve+0x12a/0x3f0 ? trace_event_buffer_lock_reserve+0x3c/0x120 ? trace_event_buffer_reserve+0x6b/0xc0 ? trace_event_raw_event_device_pm_callback_start+0x125/0x2d0 ? dpm_run_callback+0x3b/0xc0 ? pm_ops_is_empty+0x50/0x50 ? platform_get_irq_byname_optional+0x90/0x90 ? trace_device_pm_callback_start+0x82/0xd0 ? dpm_run_callback+0x49/0xc0
With the following RIP:
RIP: 0010:native_queued_spin_lock_slowpath+0x69/0x200
Since the fix to the recursion detection would allow a single recursion to happen while tracing, this lead to the trace_clock_global() taking a spin lock and then trying to take it again:
ring_buffer_lock_reserve() {
trace_clock_global() {
arch_spin_lock() {
queued_spin_lock_slowpath() {
/* lock taken */
(something else gets traced by function graph tracer)
ring_buffer_lock_reserve() {
trace_clock_global() {
arch_spin_lock() {
queued_spin_lock_slowpath() {
/* DEAD LOCK! */Tracing should *never* block, as it can lead to strange lockups like the above.
Restructure the trace_clock_global() code to instead of simply taking a lock to update the recorded "prev_time" simply use it, as two events happening on two different CPUs that calls this at the same time, really doesn't matter which one goes first. Use a trylock to grab the lock for updating the prev_time, and if it fails, simply try again the next time. If it failed to be taken, that means something else is already updating it.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=212761
--- kernel/trace/trace_clock.c | 48 ++++++++++++++++++++++++++++++--------------- 1 file changed, 32 insertions(+), 16 deletions(-)
kernel/trace/trace_clock.c +32 -16
@@ -94,33 +94,49 @@ u64 notrace trace_clock_global(void) {unsigned long flags;int this_cpu; -u64 now; +u64 now, prev_time;local_irq_save (flags); this_cpu =raw_smp_processor_id (); - now =sched_clock_cpu (this_cpu); +/* -* If in an NMI context then dont risk lockups and return the -* cpu_clock() time: +* The global clock "guarantees" that the events are ordered +* between CPUs. But if two events on two different CPUS call +* trace_clock_global at roughly the same time, it really does +* not matter which one gets the earlier time. Just make sure +* that the same CPU will always show a monotonic clock. +* +* Use a read memory barrier to get the latest written +* time that was recorded. */ -if (unlikely (in_nmi ())) - goto out; +smp_rmb (); + prev_time =READ_ONCE (trace_clock_struct.prev_time); + now =sched_clock_cpu (this_cpu); -arch_spin_lock (&trace_clock_struct.lock); +/* Make sure that now is always greater than prev_time */ +if ((s64)(now - prev_time) <0 ) + now = prev_time +1 ;/* -* TODO: if this happens often then maybe we should reset -* my_scd->clock to prev_time+1, to make sure -* we start ticking with the local clock from now on? +* If in an NMI context then dont risk lockups and simply return +* the current time. */ -if ((s64)(now - trace_clock_struct.prev_time) <0 ) - now = trace_clock_struct.prev_time +1 ; - - trace_clock_struct.prev_time = now; - -arch_spin_unlock (&trace_clock_struct.lock); +if (unlikely (in_nmi ())) + goto out; +/* Tracing can cause strange recursion, always use a try lock */ +if (arch_spin_trylock (&trace_clock_struct.lock)) { +/* Reread prev_time in case it was already updated */ + prev_time =READ_ONCE (trace_clock_struct.prev_time); +if ((s64)(now - prev_time) <0 ) + now = prev_time +1 ; + + trace_clock_struct.prev_time = now; + +/* The unlock acts as the wmb for the above rmb */ +arch_spin_unlock (&trace_clock_struct.lock); + } out:local_irq_restore (flags);
Greg Kroah-Hartman
maintainerPATCH 121/323 md-cluster: fix use-after-free issue when removing rdev
In reply to Greg Kroah-HartmanFrom: Heming Zhao <[email protected]>
commit f7c7a2f9a23e5b6e0f5251f29648d0238bb7757e upstream.
md_kick_rdev_from_array will remove rdev, so we should use rdev_for_each_safe to search list.
How to trigger:
env: Two nodes on kvm-qemu x86_64 VMs (2C2G with 2 iscsi luns).
```
node2=192.168.0.3
for i in {1..20}; do
echo ==== $i `date` ====;
mdadm -Ss && ssh ${node2} "mdadm -Ss"
wipefs -a /dev/sda /dev/sdb
mdadm -CR /dev/md0 -b clustered -e 1.2 -n 2 -l 1 /dev/sda \
/dev/sdb --assume-clean
ssh ${node2} "mdadm -A /dev/md0 /dev/sda /dev/sdb"
mdadm --wait /dev/md0
ssh ${node2} "mdadm --wait /dev/md0"
mdadm --manage /dev/md0 --fail /dev/sda --remove /dev/sda
sleep 1
done
```Crash stack:
``` stack segment: 0000 [#1] SMP ... ... RIP: 0010:md_check_recovery+0x1e8/0x570 [md_mod] ... ... RSP: 0018:ffffb149807a7d68 EFLAGS: 00010207 RAX: 0000000000000000 RBX: ffff9d494c180800 RCX: ffff9d490fc01e50 RDX: fffff047c0ed8308 RSI: 0000000000000246 RDI: 0000000000000246 RBP: 6b6b6b6b6b6b6b6b R08: ffff9d490fc01e40 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: ffff9d494c180818 R14: ffff9d493399ef38 R15: ffff9d4933a1d800 FS: 0000000000000000(0000) GS:ffff9d494f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe68cab9010 CR3: 000000004c6be001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: raid1d+0x5c/0xd40 [raid1] ? finish_task_switch+0x75/0x2a0 ? lock_timer_base+0x67/0x80 ? try_to_del_timer_sync+0x4d/0x80 ? del_timer_sync+0x41/0x50 ? schedule_timeout+0x254/0x2d0 ? md_start_sync+0xe0/0xe0 [md_mod] ? md_thread+0x127/0x160 [md_mod] md_thread+0x127/0x160 [md_mod] ? wait_woken+0x80/0x80 kthread+0x10d/0x130 ? kthread_park+0xa0/0xa0 ret_from_fork+0x1f/0x40 ```
--- drivers/md/md.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/md/md.c +4 -4
@@ -8831,11 +8831,11 @@ void md_check_recovery(struct mddev *mdd }if (mddev_is_clustered (mddev)) { -struct md_rdev *rdev; +struct md_rdev *rdev, *tmp;/* kick the device if another node issued a * remove disk. */ -rdev_for_each (rdev, mddev) { +rdev_for_each_safe (rdev, tmp, mddev) {if (test_and_clear_bit (ClusterRemove, &rdev->flags) && rdev->raid_disk <0 )md_kick_rdev_from_array (rdev);
@@ -9135,7 +9135,7 @@ err_wq:static void check_sb_changes (struct mddev *mddev,struct md_rdev *rdev) {struct mdp_superblock_1 *sb =page_address (rdev->sb_page); -struct md_rdev *rdev2; +struct md_rdev *rdev2, *tmp;int role, ret;char b[BDEVNAME_SIZE ];
@@ -9152,7 +9152,7 @@ static void check_sb_changes(struct mdde }/* Check for change of roles in the active devices */ -rdev_for_each (rdev2, mddev) { +rdev_for_each_safe (rdev2, tmp, mddev) {if (test_bit (Faulty, &rdev2->flags))continue ;
Greg Kroah-Hartman
maintainerPATCH 122/323 md: split mddev_find
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 65aa97c4d2bfd76677c211b9d03ef05a98c6d68e upstream.
Split mddev_find into a simple mddev_find that just finds an existing mddev by the unit number, and a more complicated mddev_find that deals with find or allocating a mddev.
This turns out to fix this bug reported by Zhao Heming.
----------------------------- snip ------------------------------ commit d3374825ce57 ("md: make devices disappear when they are no longer needed.") introduced protection between mddev creating & removing. The md_open shouldn't create mddev when all_mddevs list doesn't contain mddev. With currently code logic, there will be very easy to trigger soft lockup in non-preempt env.
--- drivers/md/md.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
drivers/md/md.c +19 -5
@@ -570,6 +570,22 @@ EXPORT_SYMBOL_GPL(mddev_init);static struct mddev *mddev_find (dev_t unit) { +struct mddev *mddev; + +if (MAJOR (unit) !=MD_MAJOR ) + unit &= ~((1 << MdpMinorShift) -1 ); + +spin_lock (&all_mddevs_lock); + mddev =mddev_find_locked (unit); +if (mddev) +mddev_get (mddev); +spin_unlock (&all_mddevs_lock); + +return mddev; +} + +static struct mddev *mddev_find_or_alloc (dev_t unit) +{struct mddev *mddev, *new =NULL ;if (unit &&MAJOR (unit) !=MD_MAJOR )
@@ -5276,7 +5292,7 @@ static int md_alloc(dev_t dev, char *nam* writing to /sys/module/md_mod/parameters/new_array. */ static DEFINE_MUTEX (disks_mutex); -struct mddev *mddev =mddev_find (dev); +struct mddev *mddev =mddev_find_or_alloc (dev);struct gendisk *disk;int partitioned;int shift;
@@ -6126,11 +6142,9 @@ static void autorun_devices(int part)md_probe (dev,NULL ,NULL ); mddev =mddev_find (dev); -if (!mddev || !mddev->gendisk) { -if (mddev) -mddev_put (mddev); +if (!mddev)break ; - } +if (mddev_lock (mddev))pr_warn ("md: %s locked, cannot run\n" ,mdname (mddev)); else if (mddev->raid_disks || mddev->major_version
Greg Kroah-Hartman
maintainerPATCH 123/323 md: factor out a mddev_find_locked helper from mddev_find
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 8b57251f9a91f5e5a599de7549915d2d226cc3af upstream.
Factor out a self-contained helper to just lookup a mddev by the dev_t "unit".
--- drivers/md/md.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-)
drivers/md/md.c +19 -13
@@ -568,6 +568,17 @@ void mddev_init(struct mddev *mddev) }EXPORT_SYMBOL_GPL (mddev_init); +static struct mddev *mddev_find_locked (dev_t unit) +{ +struct mddev *mddev; + +list_for_each_entry (mddev, &all_mddevs, all_mddevs) +if (mddev->unit == unit) +return mddev; + +return NULL ; +} +static struct mddev *mddev_find (dev_t unit) {struct mddev *mddev;
@@ -595,13 +606,13 @@ static struct mddev *mddev_find_or_allocspin_lock (&all_mddevs_lock);if (unit) { -list_for_each_entry (mddev, &all_mddevs, all_mddevs) -if (mddev->unit == unit) { -mddev_get (mddev); -spin_unlock (&all_mddevs_lock); -kfree (new); -return mddev; - } + mddev =mddev_find_locked (unit); +if (mddev) { +mddev_get (mddev); +spin_unlock (&all_mddevs_lock); +kfree (new); +return mddev; + }if (new) {list_add (&new->all_mddevs, &all_mddevs);
@@ -627,12 +638,7 @@ static struct mddev *mddev_find_or_allocreturn NULL ; } - is_free =1 ; -list_for_each_entry (mddev, &all_mddevs, all_mddevs) -if (mddev->unit == dev) { - is_free =0 ; -break ; - } + is_free = !mddev_find_locked (dev); } new->unit = dev; new->md_minor =MINOR (dev);
Greg Kroah-Hartman
maintainerPATCH 124/323 md: md_open returns -EBUSY when entering racing area
In reply to Greg Kroah-HartmanFrom: Zhao Heming <[email protected]>
commit 6a4db2a60306eb65bfb14ccc9fde035b74a4b4e7 upstream.
commit d3374825ce57 ("md: make devices disappear when they are no longer needed.") introduced protection between mddev creating & removing. The md_open shouldn't create mddev when all_mddevs list doesn't contain mddev. With currently code logic, there will be very easy to trigger soft lockup in non-preempt env.
This patch changes md_open returning from -ERESTARTSYS to -EBUSY, which will break the infinitely retry when md_open enter racing area.
This patch is partly fix soft lockup issue, full fix needs mddev_find is split into two functions: mddev_find & mddev_find_or_alloc. And md_open should call new mddev_find (it only does searching job).
For more detail, please refer with Christoph's "split mddev_find" patch in later commits.
*** env ***
kvm-qemu VM 2C1G with 2 iscsi luns
kernel should be non-preempt
*** script ***
about trigger every time with below script
```
1 node1="mdcluster1"
2 node2="mdcluster2"
3
4 mdadm -Ss
5 ssh ${node2} "mdadm -Ss"
6 wipefs -a /dev/sda /dev/sdb
7 mdadm -CR /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda \
/dev/sdb --assume-clean
8
9 for i in {1..10}; do
10 echo ==== $i ====;
11
12 echo "test ...."
13 ssh ${node2} "mdadm -A /dev/md0 /dev/sda /dev/sdb"
14 sleep 1
15
16 echo "clean ....."
17 ssh ${node2} "mdadm -Ss"
18 done
```I use mdcluster env to trigger soft lockup, but it isn't mdcluster speical bug. To stop md array in mdcluster env will do more jobs than non-cluster array, which will leave enough time/gap to allow kernel to run md_open.
*** stack ***
``` [ 884.226509] mddev_put+0x1c/0xe0 [md_mod] [ 884.226515] md_open+0x3c/0xe0 [md_mod] [ 884.226518] __blkdev_get+0x30d/0x710 [ 884.226520] ? bd_acquire+0xd0/0xd0 [ 884.226522] blkdev_get+0x14/0x30 [ 884.226524] do_dentry_open+0x204/0x3a0 [ 884.226531] path_openat+0x2fc/0x1520 [ 884.226534] ? seq_printf+0x4e/0x70 [ 884.226536] do_filp_open+0x9b/0x110 [ 884.226542] ? md_release+0x20/0x20 [md_mod] [ 884.226543] ? seq_read+0x1d8/0x3e0 [ 884.226545] ? kmem_cache_alloc+0x18a/0x270 [ 884.226547] ? do_sys_open+0x1bd/0x260 [ 884.226548] do_sys_open+0x1bd/0x260 [ 884.226551] do_syscall_64+0x5b/0x1e0 [ 884.226554] entry_SYSCALL_64_after_hwframe+0x44/0xa9 ```
*** rootcause ***
"mdadm -A" (or other array assemble commands) will start a daemon "mdadm --monitor" by default. When "mdadm -Ss" is running, the stop action will wakeup "mdadm --monitor". The "--monitor" daemon will immediately get info from /proc/mdstat. This time mddev in kernel still exist, so /proc/mdstat still show md device, which makes "mdadm --monitor" to open /dev/md0.
The previously "mdadm -Ss" is removing action, the "mdadm --monitor" open action will trigger md_open which is creating action. Racing is happening.
```
<thread 1>: "mdadm -Ss"
md_release
mddev_put deletes mddev from all_mddevs
queue_work for mddev_delayed_delete
at this time, "/dev/md0" is still available for opening
<thread 2>: "mdadm --monitor ..."
md_open
+ mddev_find can't find mddev of /dev/md0, and create a new mddev and
| return.
+ trigger "if (mddev->gendisk != bdev->bd_disk)" and return
-ERESTARTSYS.
```In non-preempt kernel, <thread 2> is occupying on current CPU. and mddev_delayed_delete which was created in <thread 1> also can't be schedule.
In preempt kernel, it can also trigger above racing. But kernel doesn't allow one thread running on a CPU all the time. after <thread 2> running some time, the later "mdadm -A" (refer above script line 13) will call md_alloc to alloc a new gendisk for mddev. it will break md_open statement "if (mddev->gendisk != bdev->bd_disk)" and return 0 to caller, the soft lockup is broken.
--- drivers/md/md.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/md/md.c +1 -2
@@ -7821,8 +7821,7 @@ static int md_open(struct block_device *bdev, fmode_t mode)/* Wait until bdev->bd_disk is definitely gone */ if (work_pending (&mddev->del_work))flush_workqueue (md_misc_wq); -/* Then retry the open from the top */ -return -ERESTARTSYS ; +return -EBUSY ; }BUG_ON (mddev != bdev->bd_disk->private_data);
Signature · 1 line
2.31.1
Greg Kroah-Hartman
maintainerPATCH 125/323 ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 260a9ad9446723d4063ed802989758852809714d upstream.
The "ext->key_len" is a u16 that comes from the user. If it's over SCM_KEY_LEN (32) that could lead to memory corruption.
--- drivers/net/wireless/intel/ipw2x00/libipw_wx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/ipw2x00/libipw_wx.c +4 -2
@@ -649,8 +649,10 @@ int libipw_wx_set_encodeext(struct libip }if (ext->alg !=IW_ENCODE_ALG_NONE ) { -memcpy (sec.keys[idx], ext->key, ext->key_len); - sec.key_sizes[idx] = ext->key_len; +int key_len =clamp_val (ext->key_len,0 ,SCM_KEY_LEN ); + +memcpy (sec.keys[idx], ext->key, key_len); + sec.key_sizes[idx] = key_len; sec.flags |= (1 << idx);if (ext->alg ==IW_ENCODE_ALG_WEP ) { sec.encode_alg[idx] =SEC_ALG_WEP ;
Greg Kroah-Hartman
maintainerPATCH 126/323 cfg80211: scan: drop entry from hidden_list on overflow
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 010bfbe768f7ecc876ffba92db30432de4997e2a upstream.
If we overflow the maximum number of BSS entries and free the new entry, drop it from any hidden_list that it may have been added to in the code above or in cfg80211_combine_bsses().
--- net/wireless/scan.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/scan.c +2 -0
@@ -1033,6 +1033,8 @@ cfg80211_bss_update(struct cfg80211_regiif (rdev->bss_entries >= bss_entries_limit && !cfg80211_bss_expire_oldest (rdev)) { +if (!list_empty (&new->hidden_list)) +list_del (&new->hidden_list);kfree (new); goto drop; }
Greg Kroah-Hartman
maintainerPATCH 127/323 drm/radeon: fix copy of uninitialized variable back to userspace
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 upstream.
Currently the ioctl command RADEON_INFO_SI_BACKEND_ENABLED_MASK can copy back uninitialised data in value_tmp that pointer *value points to. This can occur when rdev->family is less than CHIP_BONAIRE and less than CHIP_TAHITI. Fix this by adding in a missing -EINVAL so that no invalid value is copied back to userspace.
Addresses-Coverity: ("Uninitialized scalar variable)
--- drivers/gpu/drm/radeon/radeon_kms.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/radeon_kms.c +1 -0
@@ -531,6 +531,7 @@ static int radeon_info_ioctl(struct drm_ *value = rdev->config.si.backend_enable_mask; }else {DRM_DEBUG_KMS ("BACKEND_ENABLED_MASK is si+ only!\n" ); +return -EINVAL ; }break ;case RADEON_INFO_MAX_SCLK :
Greg Kroah-Hartman
maintainerPATCH 128/323 ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit b265047ac56bad8c4f3d0c8bf9cb4e828ee0d28e upstream.
Just re-order the alc882_fixup_tbl[] entries for Acer devices for avoiding the oversight of the duplicated or unapplied item in future. No functional changes.
Also Cc-to-stable for the further patch applications.
--- sound/pci/hda/patch_realtek.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/pci/hda/patch_realtek.c +3 -3
@@ -2301,13 +2301,13 @@ static const struct snd_pci_quirk alc882 ALC882_FIXUP_ACER_ASPIRE_8930G),SND_PCI_QUIRK (0x1025 ,0x0146 ,"Acer Aspire 6935G" ,ALC882_FIXUP_ACER_ASPIRE_8930G ), +SND_PCI_QUIRK (0x1025 ,0x0142 ,"Acer Aspire 7730G" , +ALC882_FIXUP_ACER_ASPIRE_4930G ), +SND_PCI_QUIRK (0x1025 ,0x0155 ,"Packard-Bell M5120" ,ALC882_FIXUP_PB_M5210 ),SND_PCI_QUIRK (0x1025 ,0x015e ,"Acer Aspire 6930G" ,ALC882_FIXUP_ACER_ASPIRE_4930G ),SND_PCI_QUIRK (0x1025 ,0x0166 ,"Acer Aspire 6530G" ,ALC882_FIXUP_ACER_ASPIRE_4930G ), -SND_PCI_QUIRK (0x1025 ,0x0142 ,"Acer Aspire 7730G" , -ALC882_FIXUP_ACER_ASPIRE_4930G ), -SND_PCI_QUIRK (0x1025 ,0x0155 ,"Packard-Bell M5120" ,ALC882_FIXUP_PB_M5210 ),SND_PCI_QUIRK (0x1025 ,0x021e ,"Acer Aspire 5739G" ,ALC882_FIXUP_ACER_ASPIRE_4930G ), SND_PCI_QUIRK(0x1025, 0x0259, "Acer Aspire 5935", ALC889_FIXUP_DAC_ROUTE),
Greg Kroah-Hartman
maintainerPATCH 129/323 ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit b7529c18feecb1af92f9db08c8e7fe446a82d96d upstream.
Just re-order the alc882_fixup_tbl[] entries for Sony devices for avoiding the oversight of the duplicated or unapplied item in future. No functional changes.
Also Cc-to-stable for the further patch applications.
--- sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +2 -2
@@ -2319,11 +2319,11 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1043 ,0x835f ,"Asus Eee 1601" ,ALC888_FIXUP_EEE1601 ),SND_PCI_QUIRK (0x1043 ,0x84bc ,"ASUS ET2700" ,ALC887_FIXUP_ASUS_BASS ),SND_PCI_QUIRK (0x1043 ,0x8691 ,"ASUS ROG Ranger VIII" ,ALC882_FIXUP_GPIO3 ), +SND_PCI_QUIRK (0x104d ,0x9043 ,"Sony Vaio VGC-LN51JGB" ,ALC882_FIXUP_NO_PRIMARY_HP ), +SND_PCI_QUIRK (0x104d ,0x9044 ,"Sony VAIO AiO" ,ALC882_FIXUP_NO_PRIMARY_HP ),SND_PCI_QUIRK (0x104d ,0x9047 ,"Sony Vaio TT" ,ALC889_FIXUP_VAIO_TT ),SND_PCI_QUIRK (0x104d ,0x905a ,"Sony Vaio Z" ,ALC882_FIXUP_NO_PRIMARY_HP ),SND_PCI_QUIRK (0x104d ,0x9060 ,"Sony Vaio VPCL14M1R" ,ALC882_FIXUP_NO_PRIMARY_HP ), -SND_PCI_QUIRK (0x104d ,0x9043 ,"Sony Vaio VGC-LN51JGB" ,ALC882_FIXUP_NO_PRIMARY_HP ), -SND_PCI_QUIRK (0x104d ,0x9044 ,"Sony VAIO AiO" ,ALC882_FIXUP_NO_PRIMARY_HP ),/* All Apple entries are in codec SSIDs */ SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
Greg Kroah-Hartman
maintainerPATCH 130/323 ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit cab561f8d4bc9b196ae20c960aa5da89fd786ab5 upstream.
Just re-order the alc269_fixup_tbl[] entries for Sony devices for avoiding the oversight of the duplicated or unapplied item in future. No functional changes.
Also Cc-to-stable for the further patch applications.
--- sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +2 -2
@@ -6615,12 +6615,12 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1043 ,0x8398 ,"ASUS P1005" ,ALC269_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x1043 ,0x83ce ,"ASUS P1005" ,ALC269_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x1043 ,0x8516 ,"ASUS X101CH" ,ALC269_FIXUP_ASUS_X101 ), -SND_PCI_QUIRK (0x104d ,0x90b5 ,"Sony VAIO Pro 11" ,ALC286_FIXUP_SONY_MIC_NO_PRESENCE ), -SND_PCI_QUIRK (0x104d ,0x90b6 ,"Sony VAIO Pro 13" ,ALC286_FIXUP_SONY_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x104d ,0x9073 ,"Sony VAIO" ,ALC275_FIXUP_SONY_VAIO_GPIO2 ),SND_PCI_QUIRK (0x104d ,0x907b ,"Sony VAIO" ,ALC275_FIXUP_SONY_HWEQ ),SND_PCI_QUIRK (0x104d ,0x9084 ,"Sony VAIO" ,ALC275_FIXUP_SONY_HWEQ ),SND_PCI_QUIRK (0x104d ,0x9099 ,"Sony VAIO S13" ,ALC275_FIXUP_SONY_DISABLE_AAMIX ), +SND_PCI_QUIRK (0x104d ,0x90b5 ,"Sony VAIO Pro 11" ,ALC286_FIXUP_SONY_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x104d ,0x90b6 ,"Sony VAIO Pro 13" ,ALC286_FIXUP_SONY_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x10cf ,0x1475 ,"Lifebook" ,ALC269_FIXUP_LIFEBOOK ),SND_PCI_QUIRK (0x10cf ,0x159f ,"Lifebook E780" ,ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT ), SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
Greg Kroah-Hartman
maintainerPATCH 131/323 ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit f552ff54c2a700616a02b038e4bf3cbf859f65b7 upstream.
Just re-order the alc269_fixup_tbl[] entries for Lenovo devices for avoiding the oversight of the duplicated or unapplied item in future. No functional changes.
Also Cc-to-stable for the further patch applications.
--- sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +2 -2
@@ -6641,9 +6641,9 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x21b8 ,"Thinkpad Edge 14" ,ALC269_FIXUP_SKU_IGNORE ),SND_PCI_QUIRK (0x17aa ,0x21ca ,"Thinkpad L412" ,ALC269_FIXUP_SKU_IGNORE ),SND_PCI_QUIRK (0x17aa ,0x21e9 ,"Thinkpad Edge 15" ,ALC269_FIXUP_SKU_IGNORE ), +SND_PCI_QUIRK (0x17aa ,0x21f3 ,"Thinkpad T430" ,ALC269_FIXUP_LENOVO_DOCK ),SND_PCI_QUIRK (0x17aa ,0x21f6 ,"Thinkpad T530" ,ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST ),SND_PCI_QUIRK (0x17aa ,0x21fa ,"Thinkpad X230" ,ALC269_FIXUP_LENOVO_DOCK ), -SND_PCI_QUIRK (0x17aa ,0x21f3 ,"Thinkpad T430" ,ALC269_FIXUP_LENOVO_DOCK ),SND_PCI_QUIRK (0x17aa ,0x21fb ,"Thinkpad T430s" ,ALC269_FIXUP_LENOVO_DOCK ),SND_PCI_QUIRK (0x17aa ,0x2203 ,"Thinkpad X230 Tablet" ,ALC269_FIXUP_LENOVO_DOCK ), SND_PCI_QUIRK(0x17aa, 0x2208, "Thinkpad T431s", ALC269_FIXUP_LENOVO_DOCK),
@@ -6683,6 +6683,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x3902 ,"Lenovo E50-80" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ),SND_PCI_QUIRK (0x17aa ,0x3977 ,"IdeaPad S210" ,ALC283_FIXUP_INT_MIC ),SND_PCI_QUIRK (0x17aa ,0x3978 ,"Lenovo B50-70" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ), +SND_PCI_QUIRK (0x17aa ,0x3bf8 ,"Quanta FL1" ,ALC269_FIXUP_PCM_44K ),SND_PCI_QUIRK (0x17aa ,0x5013 ,"Thinkpad" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x17aa ,0x501a ,"Thinkpad" ,ALC283_FIXUP_INT_MIC ), SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK),
@@ -6701,7 +6702,6 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x5109 ,"Thinkpad" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x17aa ,0x511e ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x511f ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ), -SND_PCI_QUIRK (0x17aa ,0x3bf8 ,"Quanta FL1" ,ALC269_FIXUP_PCM_44K ),SND_PCI_QUIRK (0x17aa ,0x9e54 ,"LENOVO NB" ,ALC269_FIXUP_LENOVO_EAPD ), SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
Greg Kroah-Hartman
maintainerPATCH 132/323 ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit defce244b01ee12534910a4544e11be5eb927d25 upstream.
The quirk entry for Uniwill ECS M31EI is with the PCI SSID device 0, which means matching with all. That is, it's essentially equivalent with SND_PCI_QUIRK_VENDOR(0x1584), which also matches with the previous entry for Haier W18 applying the very same quirk.
Let's unify them with the single vendor-quirk entry.
--- sound/pci/hda/patch_realtek.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +1 -2
@@ -7470,8 +7470,7 @@ static const struct snd_pci_quirk alc861SND_PCI_QUIRK (0x1043 ,0x1393 ,"ASUS A6Rp" ,ALC861_FIXUP_ASUS_A6RP ),SND_PCI_QUIRK_VENDOR (0x1043 ,"ASUS laptop" ,ALC861_FIXUP_AMP_VREF_0F ),SND_PCI_QUIRK (0x1462 ,0x7254 ,"HP DX2200" ,ALC861_FIXUP_NO_JACK_DETECT ), -SND_PCI_QUIRK (0x1584 ,0x2b01 ,"Haier W18" ,ALC861_FIXUP_AMP_VREF_0F ), -SND_PCI_QUIRK (0x1584 ,0x0000 ,"Uniwill ECS M31EI" ,ALC861_FIXUP_AMP_VREF_0F ), +SND_PCI_QUIRK_VENDOR (0x1584 ,"Haier/Uniwill" ,ALC861_FIXUP_AMP_VREF_0F ), SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", ALC861_FIXUP_FSC_AMILO_PI1505), {} };
Greg Kroah-Hartman
maintainerPATCH 133/323 x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit b6b4fbd90b155a0025223df2c137af8a701d53b3 upstream.
Initialize MSR_TSC_AUX with CPU node information if RDTSCP or RDPID is supported. This fixes a bug where vdso_read_cpunode() will read garbage via RDPID if RDPID is supported but RDTSCP is not. While no known CPU supports RDPID but not RDTSCP, both Intel's SDM and AMD's APM allow for RDPID to exist without RDTSCP, e.g. it's technically a legal CPU model for a virtual machine.
Note, technically MSR_TSC_AUX could be initialized if and only if RDPID is supported since RDTSCP is currently not used to retrieve the CPU node. But, the cost of the superfluous WRMSR is negigible, whereas leaving MSR_TSC_AUX uninitialized is just asking for future breakage if someone decides to utilize RDTSCP.
--- arch/x86/entry/vdso/vma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/entry/vdso/vma.c +1 -1
@@ -342,7 +342,7 @@ static void vgetcpu_cpu_init(void *arg)#ifdef CONFIG_NUMA node =cpu_to_node (cpu);#endif -if (static_cpu_has (X86_FEATURE_RDTSCP )) +if (boot_cpu_has (X86_FEATURE_RDTSCP ) ||boot_cpu_has (X86_FEATURE_RDPID ))write_rdtscp_aux ((node <<12 ) | cpu);/*
Greg Kroah-Hartman
maintainerPATCH 134/323 KVM: s390: split kvm_s390_logical_to_effective
In reply to Greg Kroah-HartmanFrom: Claudio Imbrenda <[email protected]>
commit f85f1baaa18932a041fd2b1c2ca6cfd9898c7d2b upstream.
Split kvm_s390_logical_to_effective to a generic function called _kvm_s390_logical_to_effective. The new function takes a PSW and an address and returns the address with the appropriate bits masked off. The old function now calls the new function with the appropriate PSW from the vCPU.
This is needed to avoid code duplication for vSIE.
--- arch/s390/kvm/gaccess.h | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-)
arch/s390/kvm/gaccess.h +24 -7
@@ -40,6 +40,29 @@ static inline unsigned long kvm_s390_rea }/** +* _kvm_s390_logical_to_effective - convert guest logical to effective address +* @psw: psw of the guest +* @ga: guest logical address +* +* Convert a guest logical address to an effective address by applying the +* rules of the addressing mode defined by bits 31 and 32 of the given PSW +* (extendended/basic addressing mode). +* +* Depending on the addressing mode, the upper 40 bits (24 bit addressing +* mode), 33 bits (31 bit addressing mode) or no bits (64 bit addressing +* mode) of @ga will be zeroed and the remaining bits will be returned. +*/ +static inline unsigned long _kvm_s390_logical_to_effective (psw_t *psw, +unsigned long ga) +{ +if (psw_bits (*psw).eaba ==PSW_BITS_AMODE_64BIT ) +return ga; +if (psw_bits (*psw).eaba ==PSW_BITS_AMODE_31BIT ) +return ga & ((1UL <<31 ) -1 ); +return ga & ((1UL <<24 ) -1 ); +} + +/** * kvm_s390_logical_to_effective - convert guest logical to effective address * @vcpu: guest virtual cpu * @ga: guest logical address
@@ -55,13 +78,7 @@ static inline unsigned long kvm_s390_reastatic inline unsigned long kvm_s390_logical_to_effective (struct kvm_vcpu *vcpu,unsigned long ga) { -psw_t *psw = &vcpu->arch.sie_block->gpsw; - -if (psw_bits (*psw).eaba ==PSW_BITS_AMODE_64BIT ) -return ga; -if (psw_bits (*psw).eaba ==PSW_BITS_AMODE_31BIT ) -return ga & ((1UL <<31 ) -1 ); -return ga & ((1UL <<24 ) -1 ); +return _kvm_s390_logical_to_effective (&vcpu->arch.sie_block->gpsw, ga); }/*
Greg Kroah-Hartman
maintainerPATCH 135/323 KVM: s390: fix guarded storage control register handling
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
commit 44bada28219031f9e8e86b84460606efa57b871e upstream.
store_regs_fmt2() has an ordering problem: first the guarded storage facility is enabled on the local cpu, then preemption disabled, and then the STGSC (store guarded storage controls) instruction is executed.
If the process gets scheduled away between enabling the guarded storage facility and before preemption is disabled, this might lead to a special operation exception and therefore kernel crash as soon as the process is scheduled back and the STGSC instruction is executed.
--- arch/s390/kvm/kvm-s390.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/s390/kvm/kvm-s390.c +2 -2
@@ -3395,16 +3395,16 @@ static void store_regs(struct kvm_vcpu * current->thread.fpu.fpc = vcpu->arch.host_fpregs.fpc; current->thread.fpu.regs = vcpu->arch.host_fpregs.regs;if (MACHINE_HAS_GS ) { +preempt_disable ();__ctl_set_bit (2 ,4 );if (vcpu->arch.gs_enabled)save_gs_cb (current->thread.gs_cb); -preempt_disable (); current->thread.gs_cb = vcpu->arch.host_gscb;restore_gs_cb (vcpu->arch.host_gscb); -preempt_enable ();if (!vcpu->arch.host_gscb)__ctl_clear_bit (2 ,4 ); vcpu->arch.host_gscb =NULL ; +preempt_enable (); } }
Greg Kroah-Hartman
maintainerPATCH 136/323 KVM: s390: split kvm_s390_real_to_abs
In reply to Greg Kroah-HartmanFrom: Claudio Imbrenda <[email protected]>
commit c5d1f6b531e68888cbe6718b3f77a60115d58b9c upstream.
A new function _kvm_s390_real_to_abs will apply prefixing to a real address with a given prefix value.
The old kvm_s390_real_to_abs becomes now a wrapper around the new function.
This is needed to avoid code duplication in vSIE.
--- arch/s390/kvm/gaccess.h | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
arch/s390/kvm/gaccess.h +17 -6
@@ -21,17 +21,14 @@/** * kvm_s390_real_to_abs - convert guest real address to guest absolute address -* @vcpu - guest virtual cpu +* @prefix - guest prefix * @gra - guest real address * * Returns the guest absolute address that corresponds to the passed guest real -* address @gra of a virtual guest cpu by applying its prefix. +* address @gra of by applying the given prefix. */ -static inline unsigned long kvm_s390_real_to_abs (struct kvm_vcpu *vcpu, -unsigned long gra) +static inline unsigned long _kvm_s390_real_to_abs (u32 prefix,unsigned long gra) { -unsigned long prefix =kvm_s390_get_prefix (vcpu); -if (gra <2 *PAGE_SIZE ) gra += prefix;else if (gra >= prefix && gra < prefix +2 *PAGE_SIZE )
@@ -40,6 +37,20 @@ static inline unsigned long kvm_s390_rea }/** +* kvm_s390_real_to_abs - convert guest real address to guest absolute address +* @vcpu - guest virtual cpu +* @gra - guest real address +* +* Returns the guest absolute address that corresponds to the passed guest real +* address @gra of a virtual guest cpu by applying its prefix. +*/ +static inline unsigned long kvm_s390_real_to_abs (struct kvm_vcpu *vcpu, +unsigned long gra) +{ +return _kvm_s390_real_to_abs (kvm_s390_get_prefix (vcpu), gra); +} + +/** * _kvm_s390_logical_to_effective - convert guest logical to effective address * @psw: psw of the guest * @ga: guest logical address
Greg Kroah-Hartman
maintainerPATCH 137/323 usb: gadget: pch_udc: Revert d3cb25a12138 completely
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit 50a318cc9b54a36f00beadf77e578a50f3620477 upstream.
The commit d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc") obviously was not thought through and had made the situation even worse than it was before. Two changes after almost reverted it. but a few leftovers have been left as it. With this revert d3cb25a12138 completely.
While at it, narrow down the scope of unlocked section to prevent potential race when prot_stall is assigned.
--- drivers/usb/gadget/udc/pch_udc.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/usb/gadget/udc/pch_udc.c +13 -4
@@ -604,18 +604,22 @@ static void pch_udc_reconnect(struct pchstatic inline void pch_udc_vbus_session (struct pch_udc_dev *dev,int is_active) { +unsigned long iflags; + +spin_lock_irqsave (&dev->lock, iflags);if (is_active) {pch_udc_reconnect (dev); dev->vbus_session =1 ; }else {if (dev->driver && dev->driver->disconnect) { -spin_lock (&dev->lock); +spin_unlock_irqrestore (&dev->lock, iflags); dev->driver->disconnect (&dev->gadget); -spin_unlock (&dev->lock); +spin_lock_irqsave (&dev->lock, iflags); }pch_udc_set_disconnect (dev); dev->vbus_session =0 ; } +spin_unlock_irqrestore (&dev->lock, iflags); }/**
@@ -1172,20 +1176,25 @@ static int pch_udc_pcd_selfpowered(strucstatic int pch_udc_pcd_pullup (struct usb_gadget *gadget,int is_on) {struct pch_udc_dev *dev; +unsigned long iflags;if (!gadget)return -EINVAL ; + dev = container_of(gadget, struct pch_udc_dev, gadget); + +spin_lock_irqsave (&dev->lock, iflags);if (is_on) {pch_udc_reconnect (dev); }else {if (dev->driver && dev->driver->disconnect) { -spin_lock (&dev->lock); +spin_unlock_irqrestore (&dev->lock, iflags); dev->driver->disconnect (&dev->gadget); -spin_unlock (&dev->lock); +spin_lock_irqsave (&dev->lock, iflags); }pch_udc_set_disconnect (dev); } +spin_unlock_irqrestore (&dev->lock, iflags);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 138/323 memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit e004c3e67b6459c99285b18366a71af467d869f5 ]
Currently the array gpmc_cs is indexed by cs before it cs is range checked and the pointer read from this out-of-index read is dereferenced. Fix this by performing the range check on cs before the read and the following pointer dereference.
Addresses-Coverity: ("Negative array index read")
--- drivers/memory/omap-gpmc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/memory/omap-gpmc.c +5 -2
@@ -1028,8 +1028,8 @@ EXPORT_SYMBOL(gpmc_cs_request);void gpmc_cs_free (int cs) { -struct gpmc_cs_data *gpmc = &gpmc_cs[cs]; -struct resource *res = &gpmc->mem; +struct gpmc_cs_data *gpmc; +struct resource *res;spin_lock (&gpmc_mem_lock);if (cs >= gpmc_cs_num || cs <0 || !gpmc_cs_reserved (cs)) {
@@ -1038,6 +1038,9 @@ void gpmc_cs_free(int cs)spin_unlock (&gpmc_mem_lock);return ; } + gpmc = &gpmc_cs[cs]; + res = &gpmc->mem; +gpmc_cs_disable_mem (cs);if (res->flags)release_resource (res);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 139/323 ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 6503c568e97a52f8b7a3109718db438e52e59485 ]
The Maxim PMIC datasheets describe the interrupt line as active low with a requirement of acknowledge from the CPU. Without specifying the interrupt type in Devicetree, kernel might apply some fixed configuration, not necessarily working for this hardware.
Additionally, the interrupt line is shared so using level sensitive interrupt is here especially important to avoid races.
--- arch/arm/boot/dts/exynos4412-odroid-common.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos4412-odroid-common.dtsi +1 -1
@@ -265,7 +265,7 @@ max77686: pmic@09 { compatible = "maxim,max77686"; interrupt-parent = <&gpx3>; - interrupts = <2 IRQ_TYPE_NONE>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; pinctrl-names = "default"; pinctrl-0 = <&max77686_irq>; reg = <0x09>;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 140/323 ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f6368c60561370e4a92fac22982a3bd656172170 ]
The Maxim PMIC datasheets describe the interrupt line as active low with a requirement of acknowledge from the CPU. Without specifying the interrupt type in Devicetree, kernel might apply some fixed configuration, not necessarily working for this hardware.
Additionally, the interrupt line is shared so using level sensitive interrupt is here especially important to avoid races.
--- arch/arm/boot/dts/exynos5250-smdk5250.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos5250-smdk5250.dts +1 -1
@@ -133,7 +133,7 @@ compatible = "maxim,max77686"; reg = <0x09>; interrupt-parent = <&gpx3>; - interrupts = <2 IRQ_TYPE_NONE>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; pinctrl-names = "default"; pinctrl-0 = <&max77686_irq>; wakeup-source;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 141/323 ARM: dts: exynos: correct PMIC interrupt trigger level on Snow
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 8987efbb17c2522be8615085df9a14da2ab53d34 ]
The Maxim PMIC datasheets describe the interrupt line as active low with a requirement of acknowledge from the CPU. Without specifying the interrupt type in Devicetree, kernel might apply some fixed configuration, not necessarily working for this hardware.
Additionally, the interrupt line is shared so using level sensitive interrupt is here especially important to avoid races.
--- arch/arm/boot/dts/exynos5250-snow-common.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos5250-snow-common.dtsi +1 -1
@@ -284,7 +284,7 @@ max77686: max77686@09 { compatible = "maxim,max77686"; interrupt-parent = <&gpx3>; - interrupts = <2 IRQ_TYPE_NONE>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; pinctrl-names = "default"; pinctrl-0 = <&max77686_irq>; wakeup-source;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 142/323 serial: stm32: fix incorrect characters on console
In reply to Greg Kroah-HartmanFrom: Erwan Le Ray <[email protected]>
[ Upstream commit f264c6f6aece81a9f8fbdf912b20bd3feb476a7a ]
Incorrect characters are observed on console during boot. This issue occurs when init/main.c is modifying termios settings to open /dev/console on the rootfs.
This patch adds a waiting loop in set_termios to wait for TX shift register empty (and TX FIFO if any) before stopping serial port.
--- drivers/tty/serial/stm32-usart.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/tty/serial/stm32-usart.c +11 -1
@@ -499,8 +499,9 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,unsigned int baud;u32 usartdiv, mantissa, fraction, oversampling;tcflag_t cflag = termios->c_cflag; -u32 cr1, cr2, cr3; +u32 cr1, cr2, cr3, isr;unsigned long flags; +int ret;if (!stm32_port->hw_flow_control) cflag &= ~CRTSCTS ;
@@ -509,6 +510,15 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,spin_lock_irqsave (&port->lock, flags); + ret =readl_relaxed_poll_timeout_atomic (port->membase + ofs->isr, + isr, + (isr &USART_SR_TC ), +10 ,100000 ); + +/* Send the TC error message only when ISR_TC is not set. */ +if (ret) +dev_err (port->dev,"Transmission is not complete\n" ); +/* Stop serial port and reset value */ writel_relaxed (0 , port->membase + ofs->cr1);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 143/323 serial: stm32: fix tx_empty condition
In reply to Greg Kroah-HartmanFrom: Erwan Le Ray <[email protected]>
[ Upstream commit 3db1d52466dc11dca4e47ef12a6e6e97f846af62 ]
In "tx_empty", we should poll TC bit in both DMA and PIO modes (instead of TXE) to check transmission data register has been transmitted independently of the FIFO mode. TC indicates that both transmit register and shift register are empty. When shift register is empty, tx_empty should return TIOCSER_TEMT instead of TC value.
Cleans the USART_CR_TC TCCF register define (transmission complete clear flag) as it is duplicate of USART_ICR_TCCF.
--- drivers/tty/serial/stm32-usart.c | 5 ++++- drivers/tty/serial/stm32-usart.h | 3 --- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/tty/serial/stm32-usart.c +4 -1
@@ -365,7 +365,10 @@ static unsigned int stm32_tx_empty(struct uart_port *port)struct stm32_port *stm32_port =to_stm32_port (port);struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; -return readl_relaxed (port->membase + ofs->isr) &USART_SR_TXE ; +if (readl_relaxed (port->membase + ofs->isr) &USART_SR_TC ) +return TIOCSER_TEMT ; + +return 0 ; }static void stm32_set_mctrl (struct uart_port *port,unsigned int mctrl)
drivers/tty/serial/stm32-usart.h +0 -3
@@ -123,9 +123,6 @@ struct stm32_usart_info stm32h7_info = {/* Dummy bits */ #define USART_SR_DUMMY_RX BIT(16) -/* USART_ICR (F7) */ -#define USART_CR_TC BIT(6) -/* USART_DR */ #define USART_DR_MASK GENMASK(8, 0)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 144/323 usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS
In reply to Greg Kroah-HartmanFrom: Badhri Jagan Sridharan <[email protected]>
[ Upstream commit 19c234a14eafca78e0bc14ffb8be3891096ce147 ]
While interpreting CC_STATUS, ROLE_CONTROL has to be read to make sure that CC1/CC2 is not forced presenting Rp/Rd.
Quoted 1 line
From the TCPCI spec:
4.4.5.2 ROLE_CONTROL (Normative):
The TCPM shall write B6 (DRP) = 0b and B3..0 (CC1/CC2) if it wishes to control the Rp/Rd directly instead of having the TCPC perform DRP toggling autonomously. When controlling Rp/Rd directly, the TCPM writes to B3..0 (CC1/CC2) each time it wishes to change the CC1/CC2 values. This control is used for TCPM-TCPC implementing Source or Sink only as well as when a connection has been detected via DRP toggling but the TCPM wishes to attempt Try.Src or Try.Snk.
Table 4-22. CC_STATUS Register Definition:
If (ROLE_CONTROL.CC1 = Rd) or ConnectResult=1)
00b: SNK.Open (Below maximum vRa)
01b: SNK.Default (Above minimum vRd-Connect)
10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp-1.5A 11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp-3.0A
If (ROLE_CONTROL.CC2=Rd) or (ConnectResult=1)
00b: SNK.Open (Below maximum vRa)
01b: SNK.Default (Above minimum vRd-Connect)
10b: SNK.Power1.5 (Above minimum vRd-Connect) Detects Rp 1.5A 11b: SNK.Power3.0 (Above minimum vRd-Connect) Detects Rp 3.0A
--- drivers/staging/typec/tcpci.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
drivers/staging/typec/tcpci.c +18 -3
@@ -28,6 +28,15 @@#define PD_RETRY_COUNT 3 +#define tcpc_presenting_cc1_rd (reg) \ + (!(TCPC_ROLE_CTRL_DRP & (reg)) && \ + (((reg) & (TCPC_ROLE_CTRL_CC1_MASK << TCPC_ROLE_CTRL_CC1_SHIFT)) == \ + (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC1_SHIFT))) +#define tcpc_presenting_cc2_rd (reg) \ + (!(TCPC_ROLE_CTRL_DRP & (reg)) && \ + (((reg) & (TCPC_ROLE_CTRL_CC2_MASK << TCPC_ROLE_CTRL_CC2_SHIFT)) == \ + (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC2_SHIFT))) +struct tcpci {struct device *dev;struct i2c_client *client;
@@ -149,19 +158,25 @@ static int tcpci_get_cc(struct tcpc_dev *tcpc, enum typec_cc_status *cc1, enum typec_cc_status *cc2) { struct tcpci *tcpci = tcpc_to_tcpci(tcpc); -unsigned int reg; +unsigned int reg, role_control;int ret; + ret =regmap_read (tcpci->regmap,TCPC_ROLE_CTRL , &role_control); +if (ret <0 ) +return ret; + ret =regmap_read (tcpci->regmap,TCPC_CC_STATUS , ®);if (ret <0 )return ret; *cc1 =tcpci_to_typec_cc ((reg >>TCPC_CC_STATUS_CC1_SHIFT ) &TCPC_CC_STATUS_CC1_MASK , - reg &TCPC_CC_STATUS_TERM ); + reg &TCPC_CC_STATUS_TERM || +tcpc_presenting_cc1_rd (role_control)); *cc2 =tcpci_to_typec_cc ((reg >>TCPC_CC_STATUS_CC2_SHIFT ) &TCPC_CC_STATUS_CC2_MASK , - reg &TCPC_CC_STATUS_TERM ); + reg &TCPC_CC_STATUS_TERM || +tcpc_presenting_cc2_rd (role_control));return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 145/323 x86/microcode: Check for offline CPUs before requesting new microcode
In reply to Greg Kroah-HartmanFrom: Otavio Pontes <[email protected]>
[ Upstream commit 7189b3c11903667808029ec9766a6e96de5012a5 ]
Currently, the late microcode loading mechanism checks whether any CPUs are offlined, and, in such a case, aborts the load attempt.
However, this must be done before the kernel caches new microcode from the filesystem. Otherwise, when offlined CPUs are onlined later, those cores are going to be updated through the CPU hotplug notifier callback with the new microcode, while CPUs previously onine will continue to run with the older microcode.
For example:
Turn off one core (2 threads):
echo 0 > /sys/devices/system/cpu/cpu3/online
echo 0 > /sys/devices/system/cpu/cpu1/online
Install the ucode fails because a primary SMT thread is offline:
cp intel-ucode/06-8e-09 /lib/firmware/intel-ucode/ echo 1 > /sys/devices/system/cpu/microcode/reload
bash: echo: write error: Invalid argument
Turn the core back on
echo 1 > /sys/devices/system/cpu/cpu3/online
echo 1 > /sys/devices/system/cpu/cpu1/online
cat /proc/cpuinfo |grep microcode
microcode : 0x30
microcode : 0xde
microcode : 0x30
microcode : 0xde
The rationale for why the update is aborted when at least one primary thread is offline is because even if that thread is soft-offlined and idle, it will still have to participate in broadcasted MCE's synchronization dance or enter SMM, and in both examples it will execute instructions so it better have the same microcode revision as the other cores.
[ bp: Heavily edit and extend commit message with the reasoning behind all
this. ]
--- arch/x86/kernel/cpu/microcode/core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/x86/kernel/cpu/microcode/core.c +4 -4
@@ -627,16 +627,16 @@ static ssize_t reload_store(struct device *dev,if (val !=1 )return size; - tmp_ret = microcode_ops->request_microcode_fw (bsp, µcode_pdev->dev, true); -if (tmp_ret !=UCODE_NEW ) -return size; -get_online_cpus (); ret =check_online_cpus ();if (ret) goto put; + tmp_ret = microcode_ops->request_microcode_fw (bsp, µcode_pdev->dev, true); +if (tmp_ret !=UCODE_NEW ) + goto put; +mutex_lock (µcode_mutex); ret =microcode_reload_late ();mutex_unlock (µcode_mutex);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 146/323 usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 91356fed6afd1c83bf0d3df1fc336d54e38f0458 ]
Either way ~0 will be in the correct byte order, hence replace cpu_to_le32() by lower_32_bits(). Moreover, it makes sparse happy, otherwise it complains:
.../pch_udc.c:1813:27: warning: incorrect type in assignment (different base types).../pch_udc.c:1813:27: expected unsigned int [usertype] dataptr.../pch_udc.c:1813:27: got restricted __le32 [usertype]
--- drivers/usb/gadget/udc/pch_udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/pch_udc.c +1 -1
@@ -1786,7 +1786,7 @@ static struct usb_request *pch_udc_alloc_request(struct usb_ep *usbep, }/* prevent from using desc. - set HOST BUSY */ dma_desc->status |=PCH_UDC_BS_HST_BSY ; - dma_desc->dataptr =cpu_to_le32 (DMA_ADDR_INVALID ); + dma_desc->dataptr =lower_32_bits (DMA_ADDR_INVALID ); req->td_data = dma_desc; req->td_data_last = dma_desc; req->chain_len =1 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 147/323 usb: gadget: pch_udc: Check if driver is present before calling ->setup()
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit fbdbbe6d3ee502b3bdeb4f255196bb45003614be ]
Since we have a separate routine for VBUS sense, the interrupt may occur before gadget driver is present. Hence, ->setup() call may oops the kernel:
[ 55.245843] BUG: kernel NULL pointer dereference, address: 00000010 ... [ 55.245843] EIP: pch_udc_isr.cold+0x162/0x33f ... [ 55.245843] <IRQ> [ 55.245843] ? pch_udc_svc_data_out+0x160/0x160
Check if driver is present before calling ->setup().
--- drivers/usb/gadget/udc/pch_udc.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-)
drivers/usb/gadget/udc/pch_udc.c +18 -10
@@ -2329,6 +2329,21 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num)pch_udc_set_dma (dev,DMA_DIR_RX ); } +static int pch_udc_gadget_setup (struct pch_udc_dev *dev) + __must_hold(&dev->lock) +{ +int rc; + +/* In some cases we can get an interrupt before driver gets setup */ +if (!dev->driver) +return -ESHUTDOWN ; + +spin_unlock (&dev->lock); + rc = dev->driver->setup (&dev->gadget, &dev->setup_data); +spin_lock (&dev->lock); +return rc; +} +/** * pch_udc_svc_control_in() - Handle Control IN endpoint interrupts * @dev: Reference to the device structure
@@ -2400,15 +2415,12 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev) dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX ].ep; else /* OUT */ dev->gadget.ep0 = &ep->ep; -spin_lock (&dev->lock);/* If Mass storage Reset */ if ((dev->setup_data.bRequestType ==0x21 ) && (dev->setup_data.bRequest ==0xFF )) dev->prot_stall =0 ;/* call gadget with setup data received */ - setup_supported = dev->driver->setup (&dev->gadget, - &dev->setup_data); -spin_unlock (&dev->lock); + setup_supported =pch_udc_gadget_setup (dev);if (dev->setup_data.bRequestType &USB_DIR_IN ) { ep->td_data->status = (ep->td_data->status &
@@ -2656,9 +2668,7 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev) dev->ep[i].halted =0 ; } dev->stall =0 ; -spin_unlock (&dev->lock); - dev->driver->setup (&dev->gadget, &dev->setup_data); -spin_lock (&dev->lock); +pch_udc_gadget_setup (dev); }/**
@@ -2693,9 +2703,7 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev) dev->stall =0 ;/* call gadget zero with setup data received */ -spin_unlock (&dev->lock); - dev->driver->setup (&dev->gadget, &dev->setup_data); -spin_lock (&dev->lock); +pch_udc_gadget_setup (dev); }/**
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 148/323 usb: gadget: pch_udc: Check for DMA mapping error
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 4a28d77e359009b846951b06f7c0d8eec8dce298 ]
DMA mapping might fail, we have to check it with dma_mapping_error(). Otherwise DMA-API is not happy:
DMA-API: pch_udc 0000:02:02.4: device driver failed to check map error[device address=0x00000000027ee678] [size=64 bytes] [mapped as single]
--- drivers/usb/gadget/udc/pch_udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/pch_udc.c +1 -1
@@ -2977,7 +2977,7 @@ static int init_dma_pools(struct pch_udc_dev *dev) dev->dma_addr =dma_map_single (&dev->pdev->dev, ep0out_buf,UDC_EP0OUT_BUFF_SIZE *4 ,DMA_FROM_DEVICE ); -return 0 ; +return dma_mapping_error (&dev->pdev->dev, dev->dma_addr); } static int pch_udc_start(struct usb_gadget *g,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 149/323 crypto: qat - dont release uninitialized resources
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit b66accaab3791e15ac99c92f236d0d3a6d5bd64e ]
adf_vf_isr_resource_alloc() is not unwinding correctly when error happens and it want to release uninitialized resources. To fix this, only release initialized resources.
[ 1.792845] Trying to free already-free IRQ 11 [ 1.793091] WARNING: CPU: 0 PID: 182 at kernel/irq/manage.c:1821 free_irq+0x202/0x380 [ 1.801340] Call Trace: [ 1.801477] adf_vf_isr_resource_free+0x32/0xb0 [intel_qat] [ 1.801785] adf_vf_isr_resource_alloc+0x14d/0x150 [intel_qat] [ 1.802105] adf_dev_init+0xba/0x140 [intel_qat]
--- drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/crypto/qat/qat_common/adf_vf_isr.c +13 -4
@@ -304,17 +304,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev) goto err_out;if (adf_setup_pf2vf_bh (accel_dev)) - goto err_out; + goto err_disable_msi;if (adf_setup_bh (accel_dev)) - goto err_out; + goto err_cleanup_pf2vf_bh;if (adf_request_msi_irq (accel_dev)) - goto err_out; + goto err_cleanup_bh;return 0 ; + +err_cleanup_bh: +adf_cleanup_bh (accel_dev); + +err_cleanup_pf2vf_bh: +adf_cleanup_pf2vf_bh (accel_dev); + +err_disable_msi: +adf_disable_msi (accel_dev); + err_out: -adf_vf_isr_resource_free (accel_dev);return -EFAULT ; }EXPORT_SYMBOL_GPL (adf_vf_isr_resource_alloc);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 150/323 crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 8609f5cfdc872fc3a462efa6a3eca5cb1e2f6446 ]
ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown() before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the vf2pf_lock is initialized in adf_dev_init(), which can fail and when it fail, the vf2pf_lock is either not initialized or destroyed, a subsequent use of vf2pf_lock will cause issue.
To fix this issue, only set this flag if adf_dev_init() returns 0.
[ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0 [ 7.180345] Call Trace: [ 7.182576] mutex_lock+0xc9/0xd0 [ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat] [ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat] [ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat] [ 7.184127] adf_probe+0x5e9/0x600 [qat_dh895xccvf]
--- drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++-- drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++-- drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-)
drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +2 -2
@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)if (ret) goto out_err_free_reg; -set_bit (ADF_STATUS_PF_RUNNING , &accel_dev->status); - ret =adf_dev_init (accel_dev);if (ret) goto out_err_dev_shutdown; +set_bit (ADF_STATUS_PF_RUNNING , &accel_dev->status); + ret =adf_dev_start (accel_dev);if (ret) goto out_err_dev_stop;
drivers/crypto/qat/qat_c62xvf/adf_drv.c +2 -2
@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)if (ret) goto out_err_free_reg; -set_bit (ADF_STATUS_PF_RUNNING , &accel_dev->status); - ret =adf_dev_init (accel_dev);if (ret) goto out_err_dev_shutdown; +set_bit (ADF_STATUS_PF_RUNNING , &accel_dev->status); + ret =adf_dev_start (accel_dev);if (ret) goto out_err_dev_stop;
drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +2 -2
@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)if (ret) goto out_err_free_reg; -set_bit (ADF_STATUS_PF_RUNNING , &accel_dev->status); - ret =adf_dev_init (accel_dev);if (ret) goto out_err_dev_shutdown; +set_bit (ADF_STATUS_PF_RUNNING , &accel_dev->status); + ret =adf_dev_start (accel_dev);if (ret) goto out_err_dev_stop;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 151/323 fotg210-udc: Fix DMA on EP0 for length > max packet size
In reply to Greg Kroah-HartmanFrom: Fabian Vogt <[email protected]>
[ Upstream commit 755915fc28edfc608fa89a163014acb2f31c1e19 ]
For a 75 Byte request, it would send the first 64 separately, then detect that the remaining 11 Byte fit into a single DMA, but due to this bug set the length to the original 75 Bytes. This leads to a DMA failure (which is ignored...) and the request completes without the remaining bytes having been sent.
--- drivers/usb/gadget/udc/fotg210-udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/fotg210-udc.c +1 -1
@@ -348,7 +348,7 @@ static void fotg210_start_dma(struct fotg210_ep *ep,if (req->req.length - req->req.actual > ep->ep.maxpacket) length = ep->ep.maxpacket;else - length = req->req.length; + length = req->req.length - req->req.actual; } d = dma_map_single(NULL, buffer, length,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 152/323 fotg210-udc: Fix EP0 IN requests bigger than two packets
In reply to Greg Kroah-HartmanFrom: Fabian Vogt <[email protected]>
[ Upstream commit 078ba935651e149c92c41161e0322e3372cc2705 ]
For a 134 Byte packet, it sends the first two 64 Byte packets just fine, but then notice that less than a packet is remaining and call fotg210_done without actually sending the rest.
--- drivers/usb/gadget/udc/fotg210-udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/fotg210-udc.c +1 -1
@@ -827,7 +827,7 @@ static void fotg210_ep0in(struct fotg210_udc *fotg210)if (req->req.length)fotg210_start_dma (ep, req); -if ((req->req.length - req->req.actual) < ep->ep.maxpacket) +if (req->req.actual == req->req.length)fotg210_done (ep, req,0 ); }else {fotg210_set_cxdone (fotg210);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 153/323 fotg210-udc: Remove a dubious condition leading to fotg210_done
In reply to Greg Kroah-HartmanFrom: Fabian Vogt <[email protected]>
[ Upstream commit c7f755b243494d6043aadcd9a2989cb157958b95 ]
When the EP0 IN request was not completed but less than a packet sent, it would complete the request successfully. That doesn't make sense and can't really happen as fotg210_start_dma always sends min(length, maxpkt) bytes.
--- drivers/usb/gadget/udc/fotg210-udc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/gadget/udc/fotg210-udc.c +1 -2
@@ -385,8 +385,7 @@ static void fotg210_ep0_queue(struct fotg210_ep *ep, }if (ep->dir_in) {/* if IN */ fotg210_start_dma (ep, req); -if ((req->req.length == req->req.actual) || - (req->req.actual < ep->ep.maxpacket)) +if (req->req.length == req->req.actual)fotg210_done (ep, req,0 ); }else {/* OUT */ u32 value =ioread32 (ep->fotg210->reg +FOTG210_DMISGR0 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 154/323 fotg210-udc: Mask GRP2 interrupts we dont handle
In reply to Greg Kroah-HartmanFrom: Fabian Vogt <[email protected]>
[ Upstream commit 9aee3a23d6455200702f3a57e731fa11e8408667 ]
Currently it leaves unhandled interrupts unmasked, but those are never acked. In the case of a "device idle" interrupt, this leads to an effectively frozen system until plugging it in.
--- drivers/usb/gadget/udc/fotg210-udc.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/gadget/udc/fotg210-udc.c +6 -0
@@ -1033,6 +1033,12 @@ static void fotg210_init(struct fotg210_udc *fotg210) value &= ~DMCR_GLINT_EN ;iowrite32 (value, fotg210->reg +FOTG210_DMCR ); +/* enable only grp2 irqs we handle */ +iowrite32 (~(DISGR2_DMA_ERROR |DISGR2_RX0BYTE_INT |DISGR2_TX0BYTE_INT + |DISGR2_ISO_SEQ_ABORT_INT |DISGR2_ISO_SEQ_ERR_INT + |DISGR2_RESM_INT |DISGR2_SUSP_INT |DISGR2_USBRST_INT ), + fotg210->reg +FOTG210_DMISGR2 ); +/* disable all fifo interrupt */ iowrite32 (~(u32 )0 , fotg210->reg +FOTG210_DMISGR1 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 155/323 fotg210-udc: Dont DMA more than the buffer can take
In reply to Greg Kroah-HartmanFrom: Fabian Vogt <[email protected]>
[ Upstream commit 3e7c2510bdfe89a9ec223dd7acd6bfc8bb1cbeb6 ]
Before this, it wrote as much as available into the buffer, even if it didn't fit.
--- drivers/usb/gadget/udc/fotg210-udc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/fotg210-udc.c +3 -2
@@ -340,8 +340,9 @@ static void fotg210_start_dma(struct fotg210_ep *ep, }else { buffer = req->req.buf + req->req.actual; length =ioread32 (ep->fotg210->reg + -FOTG210_FIBCR (ep->epnum -1 )); - length &=FIBCR_BCFX ; +FOTG210_FIBCR (ep->epnum -1 )) &FIBCR_BCFX ; +if (length > req->req.length - req->req.actual) + length = req->req.length - req->req.actual; } }else { buffer = req->req.buf + req->req.actual;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 156/323 fotg210-udc: Complete OUT requests on short packets
In reply to Greg Kroah-HartmanFrom: Fabian Vogt <[email protected]>
[ Upstream commit 75bb93be0027123b5db6cbcce89eb62f0f6b3c5b ]
A short packet indicates the end of a transfer and marks the request as complete.
--- drivers/usb/gadget/udc/fotg210-udc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/fotg210-udc.c +6 -2
@@ -856,12 +856,16 @@ static void fotg210_out_fifo_handler(struct fotg210_ep *ep) {struct fotg210_request *req =list_entry (ep->queue.next, struct fotg210_request, queue); +int disgr1 =ioread32 (ep->fotg210->reg +FOTG210_DISGR1 );fotg210_start_dma (ep, req); -/* finish out transfer */ +/* Complete the request when it's full or a short packet arrived. +* Like other drivers, short_not_ok isn't handled. +*/ +if (req->req.length == req->req.actual || - req->req.actual < ep->ep.maxpacket) + (disgr1 &DISGR1_SPK_INT (ep->epnum -1 )))fotg210_done (ep, req,0 ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 157/323 mtd: require write permissions for locking and badblock ioctls
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit 1e97743fd180981bef5f01402342bb54bf1c6366 ]
MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require write permission. Depending on the hardware MEMLOCK might even be write-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK is always write-once.
MEMSETBADBLOCK modifies the bad block table.
--- drivers/mtd/mtdchar.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/mtd/mtdchar.c +4 -4
@@ -689,16 +689,12 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)case MEMGETINFO :case MEMREADOOB :case MEMREADOOB64 : -case MEMLOCK : -case MEMUNLOCK :case MEMISLOCKED :case MEMGETOOBSEL :case MEMGETBADBLOCK : -case MEMSETBADBLOCK :case OTPSELECT :case OTPGETREGIONCOUNT :case OTPGETREGIONINFO : -case OTPLOCK :case ECCGETLAYOUT :case ECCGETSTATS :case MTDFILEMODE :
@@ -709,9 +705,13 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)/* "dangerous" commands */ case MEMERASE :case MEMERASE64 : +case MEMLOCK : +case MEMUNLOCK : +case MEMSETBADBLOCK :case MEMWRITEOOB :case MEMWRITEOOB64 :case MEMWRITE : +case OTPLOCK :if (!(file->f_mode &FMODE_WRITE ))return -EPERM ;break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 158/323 bus: qcom: Put child node before return
In reply to Greg Kroah-HartmanFrom: Pan Bian <[email protected]>
[ Upstream commit ac6ad7c2a862d682bb584a4bc904d89fa7721af8 ]
Put child node before return to fix potential reference count leak. Generally, the reference count of child is incremented and decremented automatically in the macro for_each_available_child_of_node() and should be decremented manually if the loop is broken in loop body.
--- drivers/bus/qcom-ebi2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/bus/qcom-ebi2.c +3 -1
@@ -357,8 +357,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev)/* Figure out the chipselect */ ret =of_property_read_u32 (child,"reg" , &csindex); -if (ret) +if (ret) { +of_node_put (child);return ret; + }if (csindex >5 ) { dev_err(dev,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 159/323 phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 6cb17707aad869de163d7bf42c253caf501be4e2 ]
Merely enabling CONFIG_COMPILE_TEST should not enable additional code. To fix this, restrict the automatic enabling of ARMADA375_USBCLUSTER_PHY to MACH_ARMADA_375, and ask the user in case of compile-testing.
--- drivers/phy/marvell/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/phy/marvell/Kconfig +2 -2
@@ -2,8 +2,8 @@ # Phy drivers for Marvell platforms # config ARMADA375_USBCLUSTER_PHY - def_bool y - depends on MACH_ARMADA_375 || COMPILE_TEST + bool "Armada 375 USB cluster PHY support" if COMPILE_TEST + default y if MACH_ARMADA_375 depends on OF && HAS_IOMEM select GENERIC_PHY
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 160/323 crypto: qat - fix error path in adf_isr_resource_alloc()
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 83dc1173d73f80cbce2fee4d308f51f87b2f26ae ]
The function adf_isr_resource_alloc() is not unwinding correctly in case of error.
This patch fixes the error paths and propagate the errors to the caller.
--- drivers/crypto/qat/qat_common/adf_isr.c | 29 ++++++++++++++++++------- 1 file changed, 21 insertions(+), 8 deletions(-)
drivers/crypto/qat/qat_common/adf_isr.c +21 -8
@@ -330,19 +330,32 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev) ret =adf_isr_alloc_msix_entry_table (accel_dev);if (ret) -return ret; -if (adf_enable_msix (accel_dev)) goto err_out; -if (adf_setup_bh (accel_dev)) - goto err_out; + ret =adf_enable_msix (accel_dev); +if (ret) + goto err_free_msix_table; -if (adf_request_irqs (accel_dev)) - goto err_out; + ret =adf_setup_bh (accel_dev); +if (ret) + goto err_disable_msix; + + ret =adf_request_irqs (accel_dev); +if (ret) + goto err_cleanup_bh;return 0 ; + +err_cleanup_bh: +adf_cleanup_bh (accel_dev); + +err_disable_msix: +adf_disable_msix (&accel_dev->accel_pci_dev); + +err_free_msix_table: +adf_isr_free_msix_entry_table (accel_dev); + err_out: -adf_isr_resource_free (accel_dev); -return -EFAULT ; +return ret; }EXPORT_SYMBOL_GPL (adf_isr_resource_alloc);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 161/323 USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 2e3d055bf27d70204cae349335a62a4f9b7c165a ]
IS_ERR() and PTR_ERR() use wrong pointer, it should be udc->virt_addr, fix it.
--- drivers/usb/gadget/udc/snps_udc_plat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/snps_udc_plat.c +2 -2
@@ -122,8 +122,8 @@ static int udc_plat_probe(struct platform_device *pdev) res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); udc->virt_addr =devm_ioremap_resource (dev, res); -if (IS_ERR (udc->regs)) -return PTR_ERR (udc->regs); +if (IS_ERR (udc->virt_addr)) +return PTR_ERR (udc->virt_addr);/* udc csr registers base */ udc->csr = udc->virt_addr +UDC_CSR_ADDR ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 162/323 mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit 076de75de1e53160e9b099f75872c1f9adf41a0b ]
If the callee gpmi_alloc_dma_buffer() failed to alloc memory for this->raw_buffer, gpmi_free_dma_buffer() will be called to free this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL and valid ptr.
Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer() is called again to free this->auxiliary_virt in err_out. This causes a double free.
As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's error path, so it should return err directly instead of releasing the dma buffer again.
--- drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/gpmi-nand/gpmi-nand.c +1 -1
@@ -2022,7 +2022,7 @@ static int gpmi_nand_init(struct gpmi_nand_data *this) this->bch_geometry.auxiliary_size =128 ; ret =gpmi_alloc_dma_buffer (this);if (ret) - goto err_out; +return ret; ret =nand_scan_ident (mtd,GPMI_IS_MX6 (this) ?2 :1 ,NULL );if (ret)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 163/323 staging: rtl8192u: Fix potential infinite loop
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit f9b9263a25dc3d2eaaa829e207434db6951ca7bc ]
The for-loop iterates with a u8 loop counter i and compares this with the loop upper limit of riv->ieee80211->LinkDetectInfo.SlotNum that is a u16 type. There is a potential infinite loop if SlotNum is larger than the u8 loop counter. Fix this by making the loop counter the same type as SlotNum.
Addresses-Coverity: ("Infinite loop")
--- drivers/staging/rtl8192u/r8192U_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rtl8192u/r8192U_core.c +1 -1
@@ -3418,7 +3418,7 @@ static void rtl819x_update_rxcounts(struct r8192_priv *priv, u32 *TotalRxBcnNum, u32 *TotalRxDataNum) {u16 SlotIndex; -u8 i; +u16 i; *TotalRxBcnNum =0 ; *TotalRxDataNum =0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 164/323 staging: greybus: uart: fix unprivileged TIOCCSERIAL
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit 60c6b305c11b5fd167ce5e2ce42f3a9098c388f0 ]
TIOCSSERIAL is a horrid, underspecified, legacy interface which for most serial devices is only useful for setting the close_delay and closing_wait parameters.
A non-privileged user has only ever been able to set the since long deprecated ASYNC_SPD flags and trying to change any other *supported* feature should result in -EPERM being returned. Setting the current values for any supported features should return success.
Fix the greybus implementation which instead indicated that the TIOCSSERIAL ioctl was not even implemented when a non-privileged user set the current values.
--- drivers/staging/greybus/uart.c | 2 -- 1 file changed, 2 deletions(-)
drivers/staging/greybus/uart.c +0 -2
@@ -657,8 +657,6 @@ static int set_serial_info(struct gb_tty *gb_tty,if ((close_delay != gb_tty->port.close_delay) || (closing_wait != gb_tty->port.closing_wait)) retval = -EPERM ; -else - retval = -EOPNOTSUPP ; }else { gb_tty->port.close_delay = close_delay; gb_tty->port.closing_wait = closing_wait;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 165/323 spi: Fix use-after-free with devm_spi_alloc_*
In reply to Greg Kroah-HartmanFrom: William A. Kennington III <[email protected]>
[ Upstream commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 ]
We can't rely on the contents of the devres list during spi_unregister_controller(), as the list is already torn down at the time we perform devres_find() for devm_spi_release_controller. This causes devices registered with devm_spi_alloc_{master,slave}() to be mistakenly identified as legacy, non-devm managed devices and have their reference counters decremented below 0.
------------[ cut here ]------------ WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174 [<b0396f04>] (refcount_warn_saturate) from [<b03c56a4>] (kobject_put+0x90/0x98) [<b03c5614>] (kobject_put) from [<b0447b4c>] (put_device+0x20/0x24) r4:b6700140 [<b0447b2c>] (put_device) from [<b07515e8>] (devm_spi_release_controller+0x3c/0x40) [<b07515ac>] (devm_spi_release_controller) from [<b045343c>] (release_nodes+0x84/0xc4) r5:b6700180 r4:b6700100 [<b04533b8>] (release_nodes) from [<b0454160>] (devres_release_all+0x5c/0x60) r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10 [<b0454104>] (devres_release_all) from [<b044e41c>] (__device_release_driver+0x144/0x1ec) r5:b117ad94 r4:b163dc10 [<b044e2d8>] (__device_release_driver) from [<b044f70c>] (device_driver_detach+0x84/0xa0) r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10 [<b044f688>] (device_driver_detach) from [<b044d274>] (unbind_store+0xe4/0xf8)
Instead, determine the devm allocation state as a flag on the controller which is guaranteed to be stable during cleanup.
--- drivers/spi/spi.c | 9 ++------- include/linux/spi/spi.h | 3 +++ 2 files changed, 5 insertions(+), 7 deletions(-)
drivers/spi/spi.c +2 -7
@@ -2076,6 +2076,7 @@ struct spi_controller *__devm_spi_alloc_controller(struct device *dev, ctlr =__spi_alloc_controller (dev, size, slave);if (ctlr) { + ctlr->devm_allocated = true; *ptr = ctlr;devres_add (dev, ptr); }else {
@@ -2304,11 +2305,6 @@ int devm_spi_register_controller(struct device *dev, }EXPORT_SYMBOL_GPL (devm_spi_register_controller); -static int devm_spi_match_controller (struct device *dev,void *res,void *ctlr) -{ -return *(struct spi_controller **)res == ctlr; -} -static int __unregister (struct device *dev,void *null) {spi_unregister_device (to_spi_device (dev));
@@ -2353,8 +2349,7 @@ void spi_unregister_controller(struct spi_controller *ctlr)/* Release the last reference on the controller if its driver * has not yet been converted to devm_spi_alloc_master/slave(). */ -if (!devres_find (ctlr->dev.parent, devm_spi_release_controller, - devm_spi_match_controller, ctlr)) +if (!ctlr->devm_allocated)put_device (&ctlr->dev);/* free bus id */
include/linux/spi/spi.h +3 -0
@@ -452,6 +452,9 @@ struct spi_controller {#define SPI_MASTER_GPIO_SS BIT(5)/* GPIO CS must select slave */ +/* flag indicating this is a non-devres managed controller */ +bool devm_allocated; +/* flag indicating this is an SPI slave controller */ bool slave;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 166/323 soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit 84168d1b54e76a1bcb5192991adde5176abe02e3 ]
The code validates that segments of p_memsz bytes of a segment will fit in the provided memory region, but does not validate that p_filesz bytes will, which means that an incorrectly crafted ELF header might write beyond the provided memory region.
--- drivers/soc/qcom/mdt_loader.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/soc/qcom/mdt_loader.c +8 -0
@@ -174,6 +174,14 @@ int qcom_mdt_load(struct device *dev, const struct firmware *fw,break ; } +if (phdr->p_filesz > phdr->p_memsz) { +dev_err (dev, +"refusing to load segment %d with p_filesz > p_memsz\n" , + i); + ret = -EINVAL ; +break ; + } + ptr = mem_region + offset;if (phdr->p_filesz) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 167/323 soc: qcom: mdt_loader: Detect truncated read of segments
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit 0648c55e3a21ccd816e99b6600d6199fbf39d23a ]
Given that no validation of how much data the firmware loader read in for a given segment truncated segment files would best case result in a hash verification failure, without any indication of what went wrong.
Improve this by validating that the firmware loader did return the amount of data requested.
--- drivers/soc/qcom/mdt_loader.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/soc/qcom/mdt_loader.c +9 -0
@@ -193,6 +193,15 @@ int qcom_mdt_load(struct device *dev, const struct firmware *fw,break ; } +if (seg_fw->size != phdr->p_filesz) { +dev_err (dev, +"failed to load segment %d from truncated file %s\n" , + i, fw_name); +release_firmware (seg_fw); + ret = -EINVAL ; +break ; + } +release_firmware (seg_fw); }
Signature · 1 line
2.30.2