* [PATCH 4.14 001/242] spi: bcm2835aux: Fix use-after-free on unbind
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 002/242] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe Greg Kroah-Hartman
` (241 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mark Brown
From: Lukas Wunner <lukas@wunner.de>
[ Upstream commit e13ee6cc4781edaf8c7321bee19217e3702ed481 ]
bcm2835aux_spi_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.
Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.
Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v4.4+
Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-bcm2835aux.c | 18 ++++++------------
1 file changed, 6 insertions(+), 12 deletions(-)
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -407,7 +407,7 @@ static int bcm2835aux_spi_probe(struct p
unsigned long clk_hz;
int err;
- master = spi_alloc_master(&pdev->dev, sizeof(*bs));
+ master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
if (!master) {
dev_err(&pdev->dev, "spi_alloc_master() failed\n");
return -ENOMEM;
@@ -439,30 +439,26 @@ static int bcm2835aux_spi_probe(struct p
/* the main area */
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
bs->regs = devm_ioremap_resource(&pdev->dev, res);
- if (IS_ERR(bs->regs)) {
- err = PTR_ERR(bs->regs);
- goto out_master_put;
- }
+ if (IS_ERR(bs->regs))
+ return PTR_ERR(bs->regs);
bs->clk = devm_clk_get(&pdev->dev, NULL);
if ((!bs->clk) || (IS_ERR(bs->clk))) {
- err = PTR_ERR(bs->clk);
dev_err(&pdev->dev, "could not get clk: %d\n", err);
- goto out_master_put;
+ return PTR_ERR(bs->clk);
}
bs->irq = platform_get_irq(pdev, 0);
if (bs->irq <= 0) {
dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);
- err = bs->irq ? bs->irq : -ENODEV;
- goto out_master_put;
+ return bs->irq ? bs->irq : -ENODEV;
}
/* this also enables the HW block */
err = clk_prepare_enable(bs->clk);
if (err) {
dev_err(&pdev->dev, "could not prepare clock: %d\n", err);
- goto out_master_put;
+ return err;
}
/* just checking if the clock returns a sane value */
@@ -495,8 +491,6 @@ static int bcm2835aux_spi_probe(struct p
out_clk_disable:
clk_disable_unprepare(bs->clk);
-out_master_put:
- spi_master_put(master);
return err;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 002/242] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 001/242] spi: bcm2835aux: Fix use-after-free on unbind Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 003/242] iwlwifi: pcie: limit memory read spin time Greg Kroah-Hartman
` (240 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Mark Brown, Lukas Wunner
From: Nathan Chancellor <natechancellor@gmail.com>
[ Upstream commit d853b3406903a7dc5b14eb5bada3e8cd677f66a2 ]
Clang warns:
drivers/spi/spi-bcm2835aux.c:532:50: warning: variable 'err' is
uninitialized when used here [-Wuninitialized]
dev_err(&pdev->dev, "could not get clk: %d\n", err);
^~~
./include/linux/dev_printk.h:112:32: note: expanded from macro 'dev_err'
_dev_err(dev, dev_fmt(fmt), ##__VA_ARGS__)
^~~~~~~~~~~
drivers/spi/spi-bcm2835aux.c:495:9: note: initialize the variable 'err'
to silence this warning
int err;
^
= 0
1 warning generated.
Restore the assignment so that the error value can be used in the
dev_err statement and there is no uninitialized memory being leaked.
Fixes: e13ee6cc4781 ("spi: bcm2835aux: Fix use-after-free on unbind")
Link: https://github.com/ClangBuiltLinux/linux/issues/1199
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Link: https://lore.kernel.org/r/20201113180701.455541-1-natechancellor@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
[lukas: backport to 4.19-stable, add stable designation]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: e13ee6cc4781: spi: bcm2835aux: Fix use-after-free on unbind
Cc: <stable@vger.kernel.org> # v4.4+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-bcm2835aux.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -444,8 +444,9 @@ static int bcm2835aux_spi_probe(struct p
bs->clk = devm_clk_get(&pdev->dev, NULL);
if ((!bs->clk) || (IS_ERR(bs->clk))) {
+ err = PTR_ERR(bs->clk);
dev_err(&pdev->dev, "could not get clk: %d\n", err);
- return PTR_ERR(bs->clk);
+ return err;
}
bs->irq = platform_get_irq(pdev, 0);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 003/242] iwlwifi: pcie: limit memory read spin time
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 001/242] spi: bcm2835aux: Fix use-after-free on unbind Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 002/242] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 004/242] arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards Greg Kroah-Hartman
` (239 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes Berg, Mordechay Goodstein,
Luca Coelho, Kalle Valo, Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 04516706bb99889986ddfa3a769ed50d2dc7ac13 ]
When we read device memory, we lock a spinlock, write the address we
want to read from the device and then spin in a loop reading the data
in 32-bit quantities from another register.
As the description makes clear, this is rather inefficient, incurring
a PCIe bus transaction for every read. In a typical device today, we
want to read 786k SMEM if it crashes, leading to 192k register reads.
Occasionally, we've seen the whole loop take over 20 seconds and then
triggering the soft lockup detector.
Clearly, it is unreasonable to spin here for such extended periods of
time.
To fix this, break the loop down into an outer and an inner loop, and
break out of the inner loop if more than half a second elapsed. To
avoid too much overhead, check for that only every 128 reads, though
there's no particular reason for that number. Then, unlock and relock
to obtain NIC access again, reprogram the start address and continue.
This will keep (interrupt) latencies on the CPU down to a reasonable
time.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20201022165103.45878a7e49aa.I3b9b9c5a10002915072312ce75b68ed5b3dc6e14@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/intel/iwlwifi/pcie/trans.c | 36 ++++++++++++++-----
1 file changed, 27 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 8a074a516fb26..910edd034fe3a 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -1927,18 +1927,36 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
void *buf, int dwords)
{
unsigned long flags;
- int offs, ret = 0;
+ int offs = 0;
u32 *vals = buf;
- if (iwl_trans_grab_nic_access(trans, &flags)) {
- iwl_write32(trans, HBUS_TARG_MEM_RADDR, addr);
- for (offs = 0; offs < dwords; offs++)
- vals[offs] = iwl_read32(trans, HBUS_TARG_MEM_RDAT);
- iwl_trans_release_nic_access(trans, &flags);
- } else {
- ret = -EBUSY;
+ while (offs < dwords) {
+ /* limit the time we spin here under lock to 1/2s */
+ ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC);
+
+ if (iwl_trans_grab_nic_access(trans, &flags)) {
+ iwl_write32(trans, HBUS_TARG_MEM_RADDR,
+ addr + 4 * offs);
+
+ while (offs < dwords) {
+ vals[offs] = iwl_read32(trans,
+ HBUS_TARG_MEM_RDAT);
+ offs++;
+
+ /* calling ktime_get is expensive so
+ * do it once in 128 reads
+ */
+ if (offs % 128 == 0 && ktime_after(ktime_get(),
+ timeout))
+ break;
+ }
+ iwl_trans_release_nic_access(trans, &flags);
+ } else {
+ return -EBUSY;
+ }
}
- return ret;
+
+ return 0;
}
static int iwl_trans_pcie_write_mem(struct iwl_trans *trans, u32 addr,
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 004/242] arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards.
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 003/242] iwlwifi: pcie: limit memory read spin time Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 005/242] iwlwifi: mvm: fix kernel panic in case of assert during CSA Greg Kroah-Hartman
` (238 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Markus Reichl, Douglas Anderson,
Heiko Stuebner, Sasha Levin
From: Markus Reichl <m.reichl@fivetechno.de>
[ Upstream commit 0011c6d182774fc781fb9e115ebe8baa356029ae ]
Recently introduced async probe on mmc devices can shuffle block IDs.
Pin them to fixed values to ease booting in environments where UUIDs
are not practical. Use newly introduced aliases for mmcblk devices from [1].
[1]
https://patchwork.kernel.org/patch/11747669/
Signed-off-by: Markus Reichl <m.reichl@fivetechno.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20201104162356.1251-1-m.reichl@fivetechno.de
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3399.dtsi | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index b63d9653ff559..82747048381fa 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -66,6 +66,9 @@
i2c6 = &i2c6;
i2c7 = &i2c7;
i2c8 = &i2c8;
+ mmc0 = &sdio0;
+ mmc1 = &sdmmc;
+ mmc2 = &sdhci;
serial0 = &uart0;
serial1 = &uart1;
serial2 = &uart2;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 005/242] iwlwifi: mvm: fix kernel panic in case of assert during CSA
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 004/242] arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 006/242] ARC: stack unwinding: dont assume non-current task is sleeping Greg Kroah-Hartman
` (237 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sara Sharon, Luca Coelho, Kalle Valo,
Sasha Levin
From: Sara Sharon <sara.sharon@intel.com>
[ Upstream commit fe56d05ee6c87f6a1a8c7267affd92c9438249cc ]
During CSA, we briefly nullify the phy context, in __iwl_mvm_unassign_vif_chanctx.
In case we have a FW assert right after it, it remains NULL though.
We end up running into endless loop due to mac80211 trying repeatedly to
move us to ASSOC state, and we keep returning -EINVAL. Later down the road
we hit a kernel panic.
Detect and avoid this endless loop.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20201107104557.d64de2c17bff.Iedd0d2afa20a2aacba5259a5cae31cb3a119a4eb@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index ec2ecdd1cc4ec..9aab9a0269548 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2654,7 +2654,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
/* this would be a mac80211 bug ... but don't crash */
if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
- return -EINVAL;
+ return test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status) ? 0 : -EINVAL;
/*
* If we are in a STA removal flow and in DQA mode:
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 006/242] ARC: stack unwinding: dont assume non-current task is sleeping
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 005/242] iwlwifi: mvm: fix kernel panic in case of assert during CSA Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 007/242] scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE Greg Kroah-Hartman
` (236 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vineet Gupta, Sasha Levin
From: Vineet Gupta <vgupta@synopsys.com>
[ Upstream commit e42404fa10fd11fe72d0a0e149a321d10e577715 ]
To start stack unwinding (SP, PC and BLINK) are needed. When the
explicit execution context (pt_regs etc) is not available, unwinder
assumes the task is sleeping (in __switch_to()) and fetches SP and BLINK
from kernel mode stack.
But this assumption is not true, specially in a SMP system, when top
runs on 1 core, there may be active running processes on all cores.
So when unwinding non courrent tasks, ensure they are NOT running.
And while at it, handle the self unwinding case explicitly.
This came out of investigation of a customer reported hang with
rcutorture+top
Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/31
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arc/kernel/stacktrace.c | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
index b007c06efbea9..35d418cde03b5 100644
--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -41,15 +41,15 @@
#ifdef CONFIG_ARC_DW2_UNWIND
-static void seed_unwind_frame_info(struct task_struct *tsk,
- struct pt_regs *regs,
- struct unwind_frame_info *frame_info)
+static int
+seed_unwind_frame_info(struct task_struct *tsk, struct pt_regs *regs,
+ struct unwind_frame_info *frame_info)
{
/*
* synchronous unwinding (e.g. dump_stack)
* - uses current values of SP and friends
*/
- if (tsk == NULL && regs == NULL) {
+ if (regs == NULL && (tsk == NULL || tsk == current)) {
unsigned long fp, sp, blink, ret;
frame_info->task = current;
@@ -68,11 +68,15 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
frame_info->call_frame = 0;
} else if (regs == NULL) {
/*
- * Asynchronous unwinding of sleeping task
- * - Gets SP etc from task's pt_regs (saved bottom of kernel
- * mode stack of task)
+ * Asynchronous unwinding of a likely sleeping task
+ * - first ensure it is actually sleeping
+ * - if so, it will be in __switch_to, kernel mode SP of task
+ * is safe-kept and BLINK at a well known location in there
*/
+ if (tsk->state == TASK_RUNNING)
+ return -1;
+
frame_info->task = tsk;
frame_info->regs.r27 = TSK_K_FP(tsk);
@@ -106,6 +110,8 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
frame_info->regs.r63 = regs->ret;
frame_info->call_frame = 0;
}
+
+ return 0;
}
#endif
@@ -119,7 +125,8 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
unsigned int address;
struct unwind_frame_info frame_info;
- seed_unwind_frame_info(tsk, regs, &frame_info);
+ if (seed_unwind_frame_info(tsk, regs, &frame_info))
+ return 0;
while (1) {
address = UNW_PC(&frame_info);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 007/242] scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 006/242] ARC: stack unwinding: dont assume non-current task is sleeping Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 008/242] soc: fsl: dpio: Get the cpumask through cpumask_of(cpu) Greg Kroah-Hartman
` (235 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stanley Chu, Can Guo,
Martin K. Petersen, Sasha Levin
From: Can Guo <cang@codeaurora.org>
[ Upstream commit 73cc291c270248567245f084dcdf5078069af6b5 ]
If someone plays with the UFS clk scaling devfreq governor through sysfs,
ufshcd_devfreq_scale may be called even when HBA is not runtime ACTIVE.
This can lead to unexpected error. We cannot just protect it by calling
pm_runtime_get_sync() because that may cause a race condition since HBA
runtime suspend ops need to suspend clk scaling. To fix this call
pm_runtime_get_noresume() and check HBA's runtime status. Only proceed if
HBA is runtime ACTIVE, otherwise just bail.
governor_store
devfreq_performance_handler
update_devfreq
devfreq_set_target
ufshcd_devfreq_target
ufshcd_devfreq_scale
Link: https://lore.kernel.org/r/1600758548-28576-1-git-send-email-cang@codeaurora.org
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/ufs/ufshcd.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index a3a3ee6e2a002..342e086e41991 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -1215,8 +1215,15 @@ static int ufshcd_devfreq_target(struct device *dev,
}
spin_unlock_irqrestore(hba->host->host_lock, irq_flags);
+ pm_runtime_get_noresume(hba->dev);
+ if (!pm_runtime_active(hba->dev)) {
+ pm_runtime_put_noidle(hba->dev);
+ ret = -EAGAIN;
+ goto out;
+ }
start = ktime_get();
ret = ufshcd_devfreq_scale(hba, scale_up);
+ pm_runtime_put(hba->dev);
trace_ufshcd_profile_clk_scaling(dev_name(hba->dev),
(scale_up ? "up" : "down"),
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 008/242] soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 007/242] scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 009/242] platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE Greg Kroah-Hartman
` (234 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hao Si, Lin Chen, Yi Wang, Li Yang,
Sasha Levin
From: Hao Si <si.hao@zte.com.cn>
[ Upstream commit 2663b3388551230cbc4606a40fabf3331ceb59e4 ]
The local variable 'cpumask_t mask' is in the stack memory, and its address
is assigned to 'desc->affinity' in 'irq_set_affinity_hint()'.
But the memory area where this variable is located is at risk of being
modified.
During LTP testing, the following error was generated:
Unable to handle kernel paging request at virtual address ffff000012e9b790
Mem abort info:
ESR = 0x96000007
Exception class = DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000007
CM = 0, WnR = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp = 0000000075ac5e07
[ffff000012e9b790] pgd=00000027dbffe003, pud=00000027dbffd003,
pmd=00000027b6d61003, pte=0000000000000000
Internal error: Oops: 96000007 [#1] PREEMPT SMP
Modules linked in: xt_conntrack
Process read_all (pid: 20171, stack limit = 0x0000000044ea4095)
CPU: 14 PID: 20171 Comm: read_all Tainted: G B W
Hardware name: NXP Layerscape LX2160ARDB (DT)
pstate: 80000085 (Nzcv daIf -PAN -UAO)
pc : irq_affinity_hint_proc_show+0x54/0xb0
lr : irq_affinity_hint_proc_show+0x4c/0xb0
sp : ffff00001138bc10
x29: ffff00001138bc10 x28: 0000ffffd131d1e0
x27: 00000000007000c0 x26: ffff8025b9480dc0
x25: ffff8025b9480da8 x24: 00000000000003ff
x23: ffff8027334f8300 x22: ffff80272e97d000
x21: ffff80272e97d0b0 x20: ffff8025b9480d80
x19: ffff000009a49000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000040
x11: 0000000000000000 x10: ffff802735b79b88
x9 : 0000000000000000 x8 : 0000000000000000
x7 : ffff000009a49848 x6 : 0000000000000003
x5 : 0000000000000000 x4 : ffff000008157d6c
x3 : ffff00001138bc10 x2 : ffff000012e9b790
x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
irq_affinity_hint_proc_show+0x54/0xb0
seq_read+0x1b0/0x440
proc_reg_read+0x80/0xd8
__vfs_read+0x60/0x178
vfs_read+0x94/0x150
ksys_read+0x74/0xf0
__arm64_sys_read+0x24/0x30
el0_svc_common.constprop.0+0xd8/0x1a0
el0_svc_handler+0x34/0x88
el0_svc+0x10/0x14
Code: f9001bbf 943e0732 f94066c2 b4000062 (f9400041)
---[ end trace b495bdcb0b3b732b ]---
Kernel panic - not syncing: Fatal exception
SMP: stopping secondary CPUs
SMP: failed to stop secondary CPUs 0,2-4,6,8,11,13-15
Kernel Offset: disabled
CPU features: 0x0,21006008
Memory Limit: none
---[ end Kernel panic - not syncing: Fatal exception ]---
Fix it by using 'cpumask_of(cpu)' to get the cpumask.
Signed-off-by: Hao Si <si.hao@zte.com.cn>
Signed-off-by: Lin Chen <chen.lin5@zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/fsl-mc/bus/dpio/dpio-driver.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/staging/fsl-mc/bus/dpio/dpio-driver.c b/drivers/staging/fsl-mc/bus/dpio/dpio-driver.c
index e36da20a2796b..e7856a9e685f4 100644
--- a/drivers/staging/fsl-mc/bus/dpio/dpio-driver.c
+++ b/drivers/staging/fsl-mc/bus/dpio/dpio-driver.c
@@ -77,7 +77,6 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
struct dpio_priv *priv;
int error;
struct fsl_mc_device_irq *irq;
- cpumask_t mask;
priv = dev_get_drvdata(&dpio_dev->dev);
@@ -96,9 +95,7 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
}
/* set the affinity hint */
- cpumask_clear(&mask);
- cpumask_set_cpu(cpu, &mask);
- if (irq_set_affinity_hint(irq->msi_desc->irq, &mask))
+ if (irq_set_affinity_hint(irq->msi_desc->irq, cpumask_of(cpu)))
dev_err(&dpio_dev->dev,
"irq_set_affinity failed irq %d cpu %d\n",
irq->msi_desc->irq, cpu);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 009/242] platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 008/242] soc: fsl: dpio: Get the cpumask through cpumask_of(cpu) Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 010/242] Input: cm109 - do not stomp on control URB Greg Kroah-Hartman
` (233 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Timo Witte, Lee, Chun-Yi,
Hans de Goede, Sasha Levin
From: Timo Witte <timo.witte@gmail.com>
[ Upstream commit 9e7a005ad56aa7d6ea5830c5ffcc60bf35de380b ]
Got a dmesg message on my AMD Renoir based Acer laptop:
"acer_wmi: Unknown key number - 0x84" when toggling keyboard
background light
Signed-off-by: Timo Witte <timo.witte@gmail.com>
Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
Link: https://lore.kernel.org/r/20200804001423.36778-1-timo.witte@gmail.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/acer-wmi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 1be71f956d5c2..29f6f2bbb5fff 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -124,6 +124,7 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
{KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} }, /* Display Switch */
{KE_IGNORE, 0x81, {KEY_SLEEP} },
{KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} }, /* Touch Pad Toggle */
+ {KE_IGNORE, 0x84, {KEY_KBDILLUMTOGGLE} }, /* Automatic Keyboard background light toggle */
{KE_KEY, KEY_TOUCHPAD_ON, {KEY_TOUCHPAD_ON} },
{KE_KEY, KEY_TOUCHPAD_OFF, {KEY_TOUCHPAD_OFF} },
{KE_IGNORE, 0x83, {KEY_TOUCHPAD_TOGGLE} },
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 010/242] Input: cm109 - do not stomp on control URB
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 009/242] platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 011/242] Input: i8042 - add Acer laptops to the i8042 reset list Greg Kroah-Hartman
` (232 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Torokhov, syzbot+150f793ac5bc18eee150
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 82e06090473289ce63e23fdeb8737aad59b10645 upstream.
We need to make sure we are not stomping on the control URB that was
issued when opening the device when attempting to toggle buzzer.
To do that we need to mark it as pending in cm109_open().
Reported-and-tested-by: syzbot+150f793ac5bc18eee150@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/cm109.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -571,12 +571,15 @@ static int cm109_input_open(struct input
dev->ctl_data->byte[HID_OR2] = dev->keybit;
dev->ctl_data->byte[HID_OR3] = 0x00;
+ dev->ctl_urb_pending = 1;
error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL);
- if (error)
+ if (error) {
+ dev->ctl_urb_pending = 0;
dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n",
__func__, error);
- else
+ } else {
dev->open = 1;
+ }
mutex_unlock(&dev->pm_mutex);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 011/242] Input: i8042 - add Acer laptops to the i8042 reset list
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 010/242] Input: cm109 - do not stomp on control URB Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 012/242] pinctrl: amd: remove debounce filter setting in IRQ type setting Greg Kroah-Hartman
` (231 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chris Chiu, Dmitry Torokhov
From: Chris Chiu <chiu@endlessos.org>
commit ce6520b0eafad5962ffc21dc47cd7bd3250e9045 upstream.
The touchpad operates in Basic Mode by default in the Acer BIOS
setup, but some Aspire/TravelMate models require the i8042 to be
reset in order to be correctly detected.
Signed-off-by: Chris Chiu <chiu@endlessos.org>
Link: https://lore.kernel.org/r/20201207071250.15021-1-chiu@endlessos.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-x86ia64io.h | 42 ++++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -616,6 +616,48 @@ static const struct dmi_system_id __init
},
},
{
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A114-31"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A314-31"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A315-31"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-132"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-332"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-432"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate Spin B118-RN"),
+ },
+ },
+ {
/* Advent 4211 */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "DIXONSXP"),
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 012/242] pinctrl: amd: remove debounce filter setting in IRQ type setting
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 011/242] Input: i8042 - add Acer laptops to the i8042 reset list Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 013/242] kbuild: avoid static_assert for genksyms Greg Kroah-Hartman
` (230 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Coiby Xu, Andy Shevchenko,
Hans de Goede, Benjamin Tissoires, Linus Walleij
From: Coiby Xu <coiby.xu@gmail.com>
commit 47a0001436352c9853d72bf2071e85b316d688a2 upstream.
Debounce filter setting should be independent from IRQ type setting
because according to the ACPI specs, there are separate arguments for
specifying debounce timeout and IRQ type in GpioIo() and GpioInt().
Together with commit 06abe8291bc31839950f7d0362d9979edc88a666
("pinctrl: amd: fix incorrect way to disable debounce filter") and
Andy's patch "gpiolib: acpi: Take into account debounce settings" [1],
this will fix broken touchpads for laptops whose BIOS set the
debounce timeout to a relatively large value. For example, the BIOS
of Lenovo AMD gaming laptops including Legion-5 15ARH05 (R7000),
Legion-5P (R7000P) and IdeaPad Gaming 3 15ARH05, set the debounce
timeout to 124.8ms. This led to the kernel receiving only ~7 HID
reports per second from the Synaptics touchpad
(MSFT0001:00 06CB:7F28).
Existing touchpads like [2][3] are not troubled by this bug because
the debounce timeout has been set to 0 by the BIOS before enabling
the debounce filter in setting IRQ type.
[1] https://lore.kernel.org/linux-gpio/20201111222008.39993-11-andriy.shevchenko@linux.intel.com/
8dcb7a15a585 ("gpiolib: acpi: Take into account debounce settings")
[2] https://github.com/Syniurge/i2c-amd-mp2/issues/11#issuecomment-721331582
[3] https://forum.manjaro.org/t/random-short-touchpad-freezes/30832/28
Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-gpio/CAHp75VcwiGREBUJ0A06EEw-SyabqYsp%2Bdqs2DpSrhaY-2GVdAA%40mail.gmail.com/
BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1887190
Link: https://lore.kernel.org/r/20201125130320.311059-1-coiby.xu@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/pinctrl-amd.c | 7 -------
1 file changed, 7 deletions(-)
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -426,7 +426,6 @@ static int amd_gpio_irq_set_type(struct
pin_reg &= ~BIT(LEVEL_TRIG_OFF);
pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
pin_reg |= ACTIVE_HIGH << ACTIVE_LEVEL_OFF;
- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
irq_set_handler_locked(d, handle_edge_irq);
break;
@@ -434,7 +433,6 @@ static int amd_gpio_irq_set_type(struct
pin_reg &= ~BIT(LEVEL_TRIG_OFF);
pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
pin_reg |= ACTIVE_LOW << ACTIVE_LEVEL_OFF;
- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
irq_set_handler_locked(d, handle_edge_irq);
break;
@@ -442,7 +440,6 @@ static int amd_gpio_irq_set_type(struct
pin_reg &= ~BIT(LEVEL_TRIG_OFF);
pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
pin_reg |= BOTH_EADGE << ACTIVE_LEVEL_OFF;
- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
irq_set_handler_locked(d, handle_edge_irq);
break;
@@ -450,8 +447,6 @@ static int amd_gpio_irq_set_type(struct
pin_reg |= LEVEL_TRIGGER << LEVEL_TRIG_OFF;
pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
pin_reg |= ACTIVE_HIGH << ACTIVE_LEVEL_OFF;
- pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
- pin_reg |= DB_TYPE_PRESERVE_LOW_GLITCH << DB_CNTRL_OFF;
irq_set_handler_locked(d, handle_level_irq);
break;
@@ -459,8 +454,6 @@ static int amd_gpio_irq_set_type(struct
pin_reg |= LEVEL_TRIGGER << LEVEL_TRIG_OFF;
pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
pin_reg |= ACTIVE_LOW << ACTIVE_LEVEL_OFF;
- pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
- pin_reg |= DB_TYPE_PRESERVE_HIGH_GLITCH << DB_CNTRL_OFF;
irq_set_handler_locked(d, handle_level_irq);
break;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 013/242] kbuild: avoid static_assert for genksyms
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 012/242] pinctrl: amd: remove debounce filter setting in IRQ type setting Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:46 ` [PATCH 4.14 014/242] scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()" Greg Kroah-Hartman
` (229 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Ard Biesheuvel,
Masahiro Yamada, Michal Marek, Kees Cook, Rikard Falkeborn,
Marco Elver, Andrew Morton, Linus Torvalds
From: Arnd Bergmann <arnd@arndb.de>
commit 14dc3983b5dff513a90bd5a8cc90acaf7867c3d0 upstream.
genksyms does not know or care about the _Static_assert() built-in, and
sometimes falls back to ignoring the later symbols, which causes
undefined behavior such as
WARNING: modpost: EXPORT symbol "ethtool_set_ethtool_phy_ops" [vmlinux] version generation failed, symbol will not be versioned.
ld: net/ethtool/common.o: relocation R_AARCH64_ABS32 against `__crc_ethtool_set_ethtool_phy_ops' can not be used when making a shared object
net/ethtool/common.o:(_ftrace_annotated_branch+0x0): dangerous relocation: unsupported relocation
Redefine static_assert for genksyms to avoid that.
Link: https://lkml.kernel.org/r/20201203230955.1482058-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Michal Marek <michal.lkml@markovi.net>
Cc: Kees Cook <keescook@chromium.org>
Cc: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Cc: Marco Elver <elver@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/build_bug.h | 5 +++++
1 file changed, 5 insertions(+)
--- a/include/linux/build_bug.h
+++ b/include/linux/build_bug.h
@@ -82,4 +82,9 @@
#endif /* __CHECKER__ */
+#ifdef __GENKSYMS__
+/* genksyms gets confused by _Static_assert */
+#define _Static_assert(expr, ...)
+#endif
+
#endif /* _LINUX_BUILD_BUG_H */
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 014/242] scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 013/242] kbuild: avoid static_assert for genksyms Greg Kroah-Hartman
@ 2020-12-28 12:46 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 015/242] x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP Greg Kroah-Hartman
` (228 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:46 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Lamprecht, Dan Carpenter,
Martin K. Petersen
From: Dan Carpenter <dan.carpenter@oracle.com>
commit eeaf06af6f87e1dba371fbe42674e6f963220b9c upstream.
My patch caused kernel Oopses and delays in boot. Revert it.
The problem was that I moved the "mem->dma = paddr;" before the call to
be_fill_queue(). But the first thing that the be_fill_queue() function
does is memset the whole struct to zero which overwrites the assignment.
Link: https://lore.kernel.org/r/X8jXkt6eThjyVP1v@mwanda
Fixes: 38b2db564d9a ("scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs()")
Cc: stable <stable@vger.kernel.org>
Reported-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/be2iscsi/be_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -3013,7 +3013,6 @@ static int beiscsi_create_eqs(struct bei
goto create_eq_error;
}
- mem->dma = paddr;
mem->va = eq_vaddress;
ret = be_fill_queue(eq, phba->params.num_eq_entries,
sizeof(struct be_eq_entry), eq_vaddress);
@@ -3023,6 +3022,7 @@ static int beiscsi_create_eqs(struct bei
goto create_eq_error;
}
+ mem->dma = paddr;
ret = beiscsi_cmd_eq_create(&phba->ctrl, eq,
phwi_context->cur_eqd);
if (ret) {
@@ -3079,7 +3079,6 @@ static int beiscsi_create_cqs(struct bei
goto create_cq_error;
}
- mem->dma = paddr;
ret = be_fill_queue(cq, phba->params.num_cq_entries,
sizeof(struct sol_cqe), cq_vaddress);
if (ret) {
@@ -3089,6 +3088,7 @@ static int beiscsi_create_cqs(struct bei
goto create_cq_error;
}
+ mem->dma = paddr;
ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false,
false, 0);
if (ret) {
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 015/242] x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2020-12-28 12:46 ` [PATCH 4.14 014/242] scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()" Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 016/242] PCI: qcom: Add missing reset for ipq806x Greg Kroah-Hartman
` (227 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arvind Sankar, Borislav Petkov, Tom Lendacky
From: Arvind Sankar <nivedita@alum.mit.edu>
commit 29ac40cbed2bc06fa218ca25d7f5e280d3d08a25 upstream.
The PAT bit is in different locations for 4k and 2M/1G page table
entries.
Add a definition for _PAGE_LARGE_CACHE_MASK to represent the three
caching bits (PWT, PCD, PAT), similar to _PAGE_CACHE_MASK for 4k pages,
and use it in the definition of PMD_FLAGS_DEC_WP to get the correct PAT
index for write-protected pages.
Fixes: 6ebcb060713f ("x86/mm: Add support to encrypt the kernel in-place")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Borislav Petkov <bp@suse.de>
Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20201111160946.147341-1-nivedita@alum.mit.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pgtable_types.h | 1 +
arch/x86/mm/mem_encrypt.c | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -148,6 +148,7 @@ enum page_cache_mode {
#endif
#define _PAGE_CACHE_MASK (_PAGE_PAT | _PAGE_PCD | _PAGE_PWT)
+#define _PAGE_LARGE_CACHE_MASK (_PAGE_PWT | _PAGE_PCD | _PAGE_PAT_LARGE)
#define _PAGE_NOCACHE (cachemode2protval(_PAGE_CACHE_MODE_UC))
#define _PAGE_CACHE_WP (cachemode2protval(_PAGE_CACHE_MODE_WP))
--- a/arch/x86/mm/mem_encrypt.c
+++ b/arch/x86/mm/mem_encrypt.c
@@ -248,8 +248,8 @@ static void __init sme_clear_pgd(struct
#define PMD_FLAGS_LARGE (__PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL)
#define PMD_FLAGS_DEC PMD_FLAGS_LARGE
-#define PMD_FLAGS_DEC_WP ((PMD_FLAGS_DEC & ~_PAGE_CACHE_MASK) | \
- (_PAGE_PAT | _PAGE_PWT))
+#define PMD_FLAGS_DEC_WP ((PMD_FLAGS_DEC & ~_PAGE_LARGE_CACHE_MASK) | \
+ (_PAGE_PAT_LARGE | _PAGE_PWT))
#define PMD_FLAGS_ENC (PMD_FLAGS_LARGE | _PAGE_ENC)
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 016/242] PCI: qcom: Add missing reset for ipq806x
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 015/242] x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 017/242] net: stmmac: free tx skb buffer in stmmac_resume() Greg Kroah-Hartman
` (226 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sham Muthayyan, Ansuel Smith,
Lorenzo Pieralisi, Rob Herring, Philipp Zabel, Stanimir Varbanov,
Sudip Mukherjee
From: Ansuel Smith <ansuelsmth@gmail.com>
commit ee367e2cdd2202b5714982739e684543cd2cee0e upstream
Add missing ext reset used by ipq8064 SoC in PCIe qcom driver.
Link: https://lore.kernel.org/r/20200615210608.21469-5-ansuelsmth@gmail.com
Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver")
Signed-off-by: Sham Muthayyan <smuthayy@codeaurora.org>
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Acked-by: Stanimir Varbanov <svarbanov@mm-sol.com>
Cc: stable@vger.kernel.org # v4.5+
[sudip: manual backport]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/dwc/pcie-qcom.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/pci/dwc/pcie-qcom.c
+++ b/drivers/pci/dwc/pcie-qcom.c
@@ -96,6 +96,7 @@ struct qcom_pcie_resources_2_1_0 {
struct reset_control *ahb_reset;
struct reset_control *por_reset;
struct reset_control *phy_reset;
+ struct reset_control *ext_reset;
struct regulator *vdda;
struct regulator *vdda_phy;
struct regulator *vdda_refclk;
@@ -265,6 +266,10 @@ static int qcom_pcie_get_resources_2_1_0
if (IS_ERR(res->por_reset))
return PTR_ERR(res->por_reset);
+ res->ext_reset = devm_reset_control_get_optional_exclusive(dev, "ext");
+ if (IS_ERR(res->ext_reset))
+ return PTR_ERR(res->ext_reset);
+
res->phy_reset = devm_reset_control_get_exclusive(dev, "phy");
return PTR_ERR_OR_ZERO(res->phy_reset);
}
@@ -277,6 +282,7 @@ static void qcom_pcie_deinit_2_1_0(struc
reset_control_assert(res->axi_reset);
reset_control_assert(res->ahb_reset);
reset_control_assert(res->por_reset);
+ reset_control_assert(res->ext_reset);
reset_control_assert(res->pci_reset);
clk_disable_unprepare(res->iface_clk);
clk_disable_unprepare(res->core_clk);
@@ -342,6 +348,12 @@ static int qcom_pcie_init_2_1_0(struct q
goto err_deassert_ahb;
}
+ ret = reset_control_deassert(res->ext_reset);
+ if (ret) {
+ dev_err(dev, "cannot deassert ext reset\n");
+ goto err_deassert_ahb;
+ }
+
/* enable PCIe clocks and resets */
val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
val &= ~BIT(0);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 017/242] net: stmmac: free tx skb buffer in stmmac_resume()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 016/242] PCI: qcom: Add missing reset for ipq806x Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 018/242] tcp: fix cwnd-limited bug for TSO deferral where we send nothing Greg Kroah-Hartman
` (225 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fugang Duan, Joakim Zhang, David S. Miller
From: Fugang Duan <fugang.duan@nxp.com>
[ Upstream commit 4ec236c7c51f89abb0224a4da4a6b77f9beb6600 ]
When do suspend/resume test, there have WARN_ON() log dump from
stmmac_xmit() funciton, the code logic:
entry = tx_q->cur_tx;
first_entry = entry;
WARN_ON(tx_q->tx_skbuff[first_entry]);
In normal case, tx_q->tx_skbuff[txq->cur_tx] should be NULL because
the skb should be handled and freed in stmmac_tx_clean().
But stmmac_resume() reset queue parameters like below, skb buffers
may not be freed.
tx_q->cur_tx = 0;
tx_q->dirty_tx = 0;
So free tx skb buffer in stmmac_resume() to avoid warning and
memory leak.
log:
[ 46.139824] ------------[ cut here ]------------
[ 46.144453] WARNING: CPU: 0 PID: 0 at drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:3235 stmmac_xmit+0x7a0/0x9d0
[ 46.154969] Modules linked in: crct10dif_ce vvcam(O) flexcan can_dev
[ 46.161328] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 5.4.24-2.1.0+g2ad925d15481 #1
[ 46.170369] Hardware name: NXP i.MX8MPlus EVK board (DT)
[ 46.175677] pstate: 80000005 (Nzcv daif -PAN -UAO)
[ 46.180465] pc : stmmac_xmit+0x7a0/0x9d0
[ 46.184387] lr : dev_hard_start_xmit+0x94/0x158
[ 46.188913] sp : ffff800010003cc0
[ 46.192224] x29: ffff800010003cc0 x28: ffff000177e2a100
[ 46.197533] x27: ffff000176ef0840 x26: ffff000176ef0090
[ 46.202842] x25: 0000000000000000 x24: 0000000000000000
[ 46.208151] x23: 0000000000000003 x22: ffff8000119ddd30
[ 46.213460] x21: ffff00017636f000 x20: ffff000176ef0cc0
[ 46.218769] x19: 0000000000000003 x18: 0000000000000000
[ 46.224078] x17: 0000000000000000 x16: 0000000000000000
[ 46.229386] x15: 0000000000000079 x14: 0000000000000000
[ 46.234695] x13: 0000000000000003 x12: 0000000000000003
[ 46.240003] x11: 0000000000000010 x10: 0000000000000010
[ 46.245312] x9 : ffff00017002b140 x8 : 0000000000000000
[ 46.250621] x7 : ffff00017636f000 x6 : 0000000000000010
[ 46.255930] x5 : 0000000000000001 x4 : ffff000176ef0000
[ 46.261238] x3 : 0000000000000003 x2 : 00000000ffffffff
[ 46.266547] x1 : ffff000177e2a000 x0 : 0000000000000000
[ 46.271856] Call trace:
[ 46.274302] stmmac_xmit+0x7a0/0x9d0
[ 46.277874] dev_hard_start_xmit+0x94/0x158
[ 46.282056] sch_direct_xmit+0x11c/0x338
[ 46.285976] __qdisc_run+0x118/0x5f0
[ 46.289549] net_tx_action+0x110/0x198
[ 46.293297] __do_softirq+0x120/0x23c
[ 46.296958] irq_exit+0xb8/0xd8
[ 46.300098] __handle_domain_irq+0x64/0xb8
[ 46.304191] gic_handle_irq+0x5c/0x148
[ 46.307936] el1_irq+0xb8/0x180
[ 46.311076] cpuidle_enter_state+0x84/0x360
[ 46.315256] cpuidle_enter+0x34/0x48
[ 46.318829] call_cpuidle+0x18/0x38
[ 46.322314] do_idle+0x1e0/0x280
[ 46.325539] cpu_startup_entry+0x24/0x40
[ 46.329460] rest_init+0xd4/0xe0
[ 46.332687] arch_call_rest_init+0xc/0x14
[ 46.336695] start_kernel+0x420/0x44c
[ 46.340353] ---[ end trace bc1ee695123cbacd ]---
Fixes: 47dd7a540b8a0 ("net: add support for STMicroelectronics Ethernet controllers.")
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1429,6 +1429,19 @@ static void dma_free_tx_skbufs(struct st
}
/**
+ * stmmac_free_tx_skbufs - free TX skb buffers
+ * @priv: private structure
+ */
+static void stmmac_free_tx_skbufs(struct stmmac_priv *priv)
+{
+ u32 tx_queue_cnt = priv->plat->tx_queues_to_use;
+ u32 queue;
+
+ for (queue = 0; queue < tx_queue_cnt; queue++)
+ dma_free_tx_skbufs(priv, queue);
+}
+
+/**
* free_dma_rx_desc_resources - free RX dma desc resources
* @priv: private structure
*/
@@ -4503,6 +4516,7 @@ int stmmac_resume(struct device *dev)
*/
priv->mss = 0;
+ stmmac_free_tx_skbufs(priv);
stmmac_clear_descriptors(priv);
stmmac_hw_setup(ndev, false);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 018/242] tcp: fix cwnd-limited bug for TSO deferral where we send nothing
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 017/242] net: stmmac: free tx skb buffer in stmmac_resume() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 019/242] net/mlx4_en: Avoid scheduling restart task if it is already running Greg Kroah-Hartman
` (224 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ingemar Johansson, Neal Cardwell,
Yuchung Cheng, Soheil Hassas Yeganeh, Eric Dumazet,
Jakub Kicinski
From: Neal Cardwell <ncardwell@google.com>
[ Upstream commit 299bcb55ecd1412f6df606e9dc0912d55610029e ]
When cwnd is not a multiple of the TSO skb size of N*MSS, we can get
into persistent scenarios where we have the following sequence:
(1) ACK for full-sized skb of N*MSS arrives
-> tcp_write_xmit() transmit full-sized skb with N*MSS
-> move pacing release time forward
-> exit tcp_write_xmit() because pacing time is in the future
(2) TSQ callback or TCP internal pacing timer fires
-> try to transmit next skb, but TSO deferral finds remainder of
available cwnd is not big enough to trigger an immediate send
now, so we defer sending until the next ACK.
(3) repeat...
So we can get into a case where we never mark ourselves as
cwnd-limited for many seconds at a time, even with
bulk/infinite-backlog senders, because:
o In case (1) above, every time in tcp_write_xmit() we have enough
cwnd to send a full-sized skb, we are not fully using the cwnd
(because cwnd is not a multiple of the TSO skb size). So every time we
send data, we are not cwnd limited, and so in the cwnd-limited
tracking code in tcp_cwnd_validate() we mark ourselves as not
cwnd-limited.
o In case (2) above, every time in tcp_write_xmit() that we try to
transmit the "remainder" of the cwnd but defer, we set the local
variable is_cwnd_limited to true, but we do not send any packets, so
sent_pkts is zero, so we don't call the cwnd-limited logic to update
tp->is_cwnd_limited.
Fixes: ca8a22634381 ("tcp: make cwnd-limited checks measurement-based, and gentler")
Reported-by: Ingemar Johansson <ingemar.s.johansson@ericsson.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20201209035759.1225145-1-ncardwell.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_output.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1620,7 +1620,8 @@ static void tcp_cwnd_validate(struct soc
* window, and remember whether we were cwnd-limited then.
*/
if (!before(tp->snd_una, tp->max_packets_seq) ||
- tp->packets_out > tp->max_packets_out) {
+ tp->packets_out > tp->max_packets_out ||
+ is_cwnd_limited) {
tp->max_packets_out = tp->packets_out;
tp->max_packets_seq = tp->snd_nxt;
tp->is_cwnd_limited = is_cwnd_limited;
@@ -2411,6 +2412,10 @@ repair:
else
tcp_chrono_stop(sk, TCP_CHRONO_RWND_LIMITED);
+ is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
+ if (likely(sent_pkts || is_cwnd_limited))
+ tcp_cwnd_validate(sk, is_cwnd_limited);
+
if (likely(sent_pkts)) {
if (tcp_in_cwnd_reduction(sk))
tp->prr_out += sent_pkts;
@@ -2418,8 +2423,6 @@ repair:
/* Send one loss probe per tail loss episode. */
if (push_one != 2)
tcp_schedule_loss_probe(sk, false);
- is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
- tcp_cwnd_validate(sk, is_cwnd_limited);
return false;
}
return !tp->packets_out && tcp_send_head(sk);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 019/242] net/mlx4_en: Avoid scheduling restart task if it is already running
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 018/242] tcp: fix cwnd-limited bug for TSO deferral where we send nothing Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 020/242] net/mlx4_en: Handle TX error CQE Greg Kroah-Hartman
` (223 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Moshe Shemesh, Tariq Toukan, David S. Miller
From: Moshe Shemesh <moshe@mellanox.com>
[ Upstream commit fed91613c9dd455dd154b22fa8e11b8526466082 ]
Add restarting state flag to avoid scheduling another restart task while
such task is already running. Change task name from watchdog_task to
restart_task to better fit the task role.
Fixes: 1e338db56e5a ("mlx4_en: Fix a race at restart task")
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 20 +++++++++++++-------
drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 7 ++++++-
2 files changed, 19 insertions(+), 8 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1389,8 +1389,10 @@ static void mlx4_en_tx_timeout(struct ne
}
priv->port_stats.tx_timeout++;
- en_dbg(DRV, priv, "Scheduling watchdog\n");
- queue_work(mdev->workqueue, &priv->watchdog_task);
+ if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state)) {
+ en_dbg(DRV, priv, "Scheduling port restart\n");
+ queue_work(mdev->workqueue, &priv->restart_task);
+ }
}
@@ -1839,6 +1841,7 @@ int mlx4_en_start_port(struct net_device
local_bh_enable();
}
+ clear_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state);
netif_tx_start_all_queues(dev);
netif_device_attach(dev);
@@ -2009,7 +2012,7 @@ void mlx4_en_stop_port(struct net_device
static void mlx4_en_restart(struct work_struct *work)
{
struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
- watchdog_task);
+ restart_task);
struct mlx4_en_dev *mdev = priv->mdev;
struct net_device *dev = priv->dev;
@@ -2388,7 +2391,7 @@ static int mlx4_en_change_mtu(struct net
if (netif_running(dev)) {
mutex_lock(&mdev->state_lock);
if (!mdev->device_up) {
- /* NIC is probably restarting - let watchdog task reset
+ /* NIC is probably restarting - let restart task reset
* the port */
en_dbg(DRV, priv, "Change MTU called with card down!?\n");
} else {
@@ -2397,7 +2400,9 @@ static int mlx4_en_change_mtu(struct net
if (err) {
en_err(priv, "Failed restarting port:%d\n",
priv->port);
- queue_work(mdev->workqueue, &priv->watchdog_task);
+ if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING,
+ &priv->state))
+ queue_work(mdev->workqueue, &priv->restart_task);
}
}
mutex_unlock(&mdev->state_lock);
@@ -2883,7 +2888,8 @@ static int mlx4_xdp_set(struct net_devic
if (err) {
en_err(priv, "Failed starting port %d for XDP change\n",
priv->port);
- queue_work(mdev->workqueue, &priv->watchdog_task);
+ if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state))
+ queue_work(mdev->workqueue, &priv->restart_task);
}
}
@@ -3284,7 +3290,7 @@ int mlx4_en_init_netdev(struct mlx4_en_d
priv->counter_index = MLX4_SINK_COUNTER_INDEX(mdev->dev);
spin_lock_init(&priv->stats_lock);
INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode);
- INIT_WORK(&priv->watchdog_task, mlx4_en_restart);
+ INIT_WORK(&priv->restart_task, mlx4_en_restart);
INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate);
INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats);
INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task);
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -525,6 +525,10 @@ struct mlx4_en_stats_bitmap {
struct mutex mutex; /* for mutual access to stats bitmap */
};
+enum {
+ MLX4_EN_STATE_FLAG_RESTARTING,
+};
+
struct mlx4_en_priv {
struct mlx4_en_dev *mdev;
struct mlx4_en_port_profile *prof;
@@ -590,7 +594,7 @@ struct mlx4_en_priv {
struct mlx4_en_cq *rx_cq[MAX_RX_RINGS];
struct mlx4_qp drop_qp;
struct work_struct rx_mode_task;
- struct work_struct watchdog_task;
+ struct work_struct restart_task;
struct work_struct linkstate_task;
struct delayed_work stats_task;
struct delayed_work service_task;
@@ -637,6 +641,7 @@ struct mlx4_en_priv {
u32 pflags;
u8 rss_key[MLX4_EN_RSS_KEY_SIZE];
u8 rss_hash_fn;
+ unsigned long state;
};
enum mlx4_en_wol {
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 020/242] net/mlx4_en: Handle TX error CQE
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 019/242] net/mlx4_en: Avoid scheduling restart task if it is already running Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 021/242] net: stmmac: delete the eee_ctrl_timer after napi disabled Greg Kroah-Hartman
` (222 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Moshe Shemesh, Tariq Toukan, David S. Miller
From: Moshe Shemesh <moshe@mellanox.com>
[ Upstream commit ba603d9d7b1215c72513d7c7aa02b6775fd4891b ]
In case error CQE was found while polling TX CQ, the QP is in error
state and all posted WQEs will generate error CQEs without any data
transmitted. Fix it by reopening the channels, via same method used for
TX timeout handling.
In addition add some more info on error CQE and WQE for debug.
Fixes: bd2f631d7c60 ("net/mlx4_en: Notify user when TX ring in error state")
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 1
drivers/net/ethernet/mellanox/mlx4/en_tx.c | 40 ++++++++++++++++++++-----
drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 5 +++
3 files changed, 39 insertions(+), 7 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1746,6 +1746,7 @@ int mlx4_en_start_port(struct net_device
mlx4_en_deactivate_cq(priv, cq);
goto tx_err;
}
+ clear_bit(MLX4_EN_TX_RING_STATE_RECOVERING, &tx_ring->state);
if (t != TX_XDP) {
tx_ring->tx_queue = netdev_get_tx_queue(dev, i);
tx_ring->recycle_ring = NULL;
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -385,6 +385,35 @@ int mlx4_en_free_tx_buf(struct net_devic
return cnt;
}
+static void mlx4_en_handle_err_cqe(struct mlx4_en_priv *priv, struct mlx4_err_cqe *err_cqe,
+ u16 cqe_index, struct mlx4_en_tx_ring *ring)
+{
+ struct mlx4_en_dev *mdev = priv->mdev;
+ struct mlx4_en_tx_info *tx_info;
+ struct mlx4_en_tx_desc *tx_desc;
+ u16 wqe_index;
+ int desc_size;
+
+ en_err(priv, "CQE error - cqn 0x%x, ci 0x%x, vendor syndrome: 0x%x syndrome: 0x%x\n",
+ ring->sp_cqn, cqe_index, err_cqe->vendor_err_syndrome, err_cqe->syndrome);
+ print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, err_cqe, sizeof(*err_cqe),
+ false);
+
+ wqe_index = be16_to_cpu(err_cqe->wqe_index) & ring->size_mask;
+ tx_info = &ring->tx_info[wqe_index];
+ desc_size = tx_info->nr_txbb << LOG_TXBB_SIZE;
+ en_err(priv, "Related WQE - qpn 0x%x, wqe index 0x%x, wqe size 0x%x\n", ring->qpn,
+ wqe_index, desc_size);
+ tx_desc = ring->buf + (wqe_index << LOG_TXBB_SIZE);
+ print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, tx_desc, desc_size, false);
+
+ if (test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state))
+ return;
+
+ en_err(priv, "Scheduling port restart\n");
+ queue_work(mdev->workqueue, &priv->restart_task);
+}
+
bool mlx4_en_process_tx_cq(struct net_device *dev,
struct mlx4_en_cq *cq, int napi_budget)
{
@@ -431,13 +460,10 @@ bool mlx4_en_process_tx_cq(struct net_de
dma_rmb();
if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) ==
- MLX4_CQE_OPCODE_ERROR)) {
- struct mlx4_err_cqe *cqe_err = (struct mlx4_err_cqe *)cqe;
-
- en_err(priv, "CQE error - vendor syndrome: 0x%x syndrome: 0x%x\n",
- cqe_err->vendor_err_syndrome,
- cqe_err->syndrome);
- }
+ MLX4_CQE_OPCODE_ERROR))
+ if (!test_and_set_bit(MLX4_EN_TX_RING_STATE_RECOVERING, &ring->state))
+ mlx4_en_handle_err_cqe(priv, (struct mlx4_err_cqe *)cqe, index,
+ ring);
/* Skip over last polled CQE */
new_index = be16_to_cpu(cqe->wqe_index) & size_mask;
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -267,6 +267,10 @@ struct mlx4_en_page_cache {
} buf[MLX4_EN_CACHE_SIZE];
};
+enum {
+ MLX4_EN_TX_RING_STATE_RECOVERING,
+};
+
struct mlx4_en_priv;
struct mlx4_en_tx_ring {
@@ -313,6 +317,7 @@ struct mlx4_en_tx_ring {
* Only queue_stopped might be used if BQL is not properly working.
*/
unsigned long queue_stopped;
+ unsigned long state;
struct mlx4_hwq_resources sp_wqres;
struct mlx4_qp sp_qp;
struct mlx4_qp_context sp_context;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 021/242] net: stmmac: delete the eee_ctrl_timer after napi disabled
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 020/242] net/mlx4_en: Handle TX error CQE Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 022/242] net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux Greg Kroah-Hartman
` (221 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fugang Duan, Joakim Zhang, David S. Miller
From: Fugang Duan <fugang.duan@nxp.com>
[ Upstream commit 5f58591323bf3f342920179f24515935c4b5fd60 ]
There have chance to re-enable the eee_ctrl_timer and fire the timer
in napi callback after delete the timer in .stmmac_release(), which
introduces to access eee registers in the timer function after clocks
are disabled then causes system hang. Found this issue when do
suspend/resume and reboot stress test.
It is safe to delete the timer after napi disabled and disable lpi mode.
Fixes: d765955d2ae0b ("stmmac: add the Energy Efficient Ethernet support")
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2705,9 +2705,6 @@ static int stmmac_release(struct net_dev
{
struct stmmac_priv *priv = netdev_priv(dev);
- if (priv->eee_enabled)
- del_timer_sync(&priv->eee_ctrl_timer);
-
/* Stop and disconnect the PHY */
if (dev->phydev) {
phy_stop(dev->phydev);
@@ -2727,6 +2724,11 @@ static int stmmac_release(struct net_dev
if (priv->lpi_irq > 0)
free_irq(priv->lpi_irq, dev);
+ if (priv->eee_enabled) {
+ priv->tx_path_in_lpi_mode = false;
+ del_timer_sync(&priv->eee_ctrl_timer);
+ }
+
/* Stop TX/RX DMA and clear the descriptors */
stmmac_stop_all_dma(priv);
@@ -4418,6 +4420,11 @@ int stmmac_suspend(struct device *dev)
stmmac_disable_all_queues(priv);
+ if (priv->eee_enabled) {
+ priv->tx_path_in_lpi_mode = false;
+ del_timer_sync(&priv->eee_ctrl_timer);
+ }
+
/* Stop TX/RX DMA */
stmmac_stop_all_dma(priv);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 022/242] net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 021/242] net: stmmac: delete the eee_ctrl_timer after napi disabled Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 023/242] net: bridge: vlan: fix error return code in __vlan_add() Greg Kroah-Hartman
` (220 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Jerome Brunet,
Jakub Kicinski
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[ Upstream commit 82ca4c922b8992013a238d65cf4e60cc33e12f36 ]
The m250_sel mux clock uses bit 4 in the PRG_ETH0 register. Fix this by
shifting the PRG_ETH0_CLK_M250_SEL_MASK accordingly as the "mask" in
struct clk_mux expects the mask relative to the "shift" field in the
same struct.
While here, get rid of the PRG_ETH0_CLK_M250_SEL_SHIFT macro and use
__ffs() to determine it from the existing PRG_ETH0_CLK_M250_SEL_MASK
macro.
Fixes: 566e8251625304 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20201205213207.519341-1-martin.blumenstingl@googlemail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -30,7 +30,6 @@
#define PRG_ETH0_RGMII_MODE BIT(0)
/* mux to choose between fclk_div2 (bit unset) and mpll2 (bit set) */
-#define PRG_ETH0_CLK_M250_SEL_SHIFT 4
#define PRG_ETH0_CLK_M250_SEL_MASK GENMASK(4, 4)
#define PRG_ETH0_TXDLY_SHIFT 5
@@ -121,8 +120,9 @@ static int meson8b_init_clk(struct meson
init.num_parents = MUX_CLK_NUM_PARENTS;
dwmac->m250_mux.reg = dwmac->regs + PRG_ETH0;
- dwmac->m250_mux.shift = PRG_ETH0_CLK_M250_SEL_SHIFT;
- dwmac->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK;
+ dwmac->m250_mux.shift = __ffs(PRG_ETH0_CLK_M250_SEL_MASK);
+ dwmac->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK >>
+ dwmac->m250_mux.shift;
dwmac->m250_mux.flags = 0;
dwmac->m250_mux.table = NULL;
dwmac->m250_mux.hw.init = &init;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 023/242] net: bridge: vlan: fix error return code in __vlan_add()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 022/242] net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 024/242] mac80211: mesh: fix mesh_pathtbl_init() error path Greg Kroah-Hartman
` (219 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
Nikolay Aleksandrov, Jakub Kicinski
From: Zhang Changzhong <zhangchangzhong@huawei.com>
[ Upstream commit ee4f52a8de2c6f78b01f10b4c330867d88c1653a ]
Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.
Fixes: f8ed289fab84 ("bridge: vlan: use br_vlan_(get|put)_master to deal with refcounts")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Link: https://lore.kernel.org/r/1607071737-33875-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/br_vlan.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -241,8 +241,10 @@ static int __vlan_add(struct net_bridge_
}
masterv = br_vlan_get_master(br, v->vid);
- if (!masterv)
+ if (!masterv) {
+ err = -ENOMEM;
goto out_filt;
+ }
v->brvlan = masterv;
v->stats = masterv->stats;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 024/242] mac80211: mesh: fix mesh_pathtbl_init() error path
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 023/242] net: bridge: vlan: fix error return code in __vlan_add() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 025/242] USB: dummy-hcd: Fix uninitialized array use in init() Greg Kroah-Hartman
` (218 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot, Johannes Berg,
Jakub Kicinski
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 905b2032fa424f253d9126271439cc1db2b01130 ]
If tbl_mpp can not be allocated, we call mesh_table_free(tbl_path)
while tbl_path rhashtable has not yet been initialized, which causes
panics.
Simply factorize the rhashtable_init() call into mesh_table_alloc()
WARNING: CPU: 1 PID: 8474 at kernel/workqueue.c:3040 __flush_work kernel/workqueue.c:3040 [inline]
WARNING: CPU: 1 PID: 8474 at kernel/workqueue.c:3040 __cancel_work_timer+0x514/0x540 kernel/workqueue.c:3136
Modules linked in:
CPU: 1 PID: 8474 Comm: syz-executor663 Not tainted 5.10.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__flush_work kernel/workqueue.c:3040 [inline]
RIP: 0010:__cancel_work_timer+0x514/0x540 kernel/workqueue.c:3136
Code: 5d c3 e8 bf ae 29 00 0f 0b e9 f0 fd ff ff e8 b3 ae 29 00 0f 0b 43 80 3c 3e 00 0f 85 31 ff ff ff e9 34 ff ff ff e8 9c ae 29 00 <0f> 0b e9 dc fe ff ff 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 7d fd ff
RSP: 0018:ffffc9000165f5a0 EFLAGS: 00010293
RAX: ffffffff814b7064 RBX: 0000000000000001 RCX: ffff888021c80000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888024039ca0 R08: dffffc0000000000 R09: fffffbfff1dd3e64
R10: fffffbfff1dd3e64 R11: 0000000000000000 R12: 1ffff920002cbebd
R13: ffff888024039c88 R14: 1ffff11004807391 R15: dffffc0000000000
FS: 0000000001347880(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000140 CR3: 000000002cc0a000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
rhashtable_free_and_destroy+0x25/0x9c0 lib/rhashtable.c:1137
mesh_table_free net/mac80211/mesh_pathtbl.c:69 [inline]
mesh_pathtbl_init+0x287/0x2e0 net/mac80211/mesh_pathtbl.c:785
ieee80211_mesh_init_sdata+0x2ee/0x530 net/mac80211/mesh.c:1591
ieee80211_setup_sdata+0x733/0xc40 net/mac80211/iface.c:1569
ieee80211_if_add+0xd5c/0x1cd0 net/mac80211/iface.c:1987
ieee80211_add_iface+0x59/0x130 net/mac80211/cfg.c:125
rdev_add_virtual_intf net/wireless/rdev-ops.h:45 [inline]
nl80211_new_interface+0x563/0xb40 net/wireless/nl80211.c:3855
genl_family_rcv_msg_doit net/netlink/genetlink.c:739 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
genl_rcv_msg+0xe4e/0x1280 net/netlink/genetlink.c:800
netlink_rcv_skb+0x190/0x3a0 net/netlink/af_netlink.c:2494
genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x780/0x930 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x9a8/0xd40 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg net/socket.c:671 [inline]
____sys_sendmsg+0x519/0x800 net/socket.c:2353
___sys_sendmsg net/socket.c:2407 [inline]
__sys_sendmsg+0x2b1/0x360 net/socket.c:2440
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes: 60854fd94573 ("mac80211: mesh: convert path table to rhashtable")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Link: https://lore.kernel.org/r/20201204162428.2583119-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/mesh_pathtbl.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -61,6 +61,7 @@ static struct mesh_table *mesh_table_all
INIT_HLIST_HEAD(&newtbl->known_gates);
atomic_set(&newtbl->entries, 0);
spin_lock_init(&newtbl->gates_lock);
+ rhashtable_init(&newtbl->rhead, &mesh_rht_params);
return newtbl;
}
@@ -851,9 +852,6 @@ int mesh_pathtbl_init(struct ieee80211_s
goto free_path;
}
- rhashtable_init(&tbl_path->rhead, &mesh_rht_params);
- rhashtable_init(&tbl_mpp->rhead, &mesh_rht_params);
-
sdata->u.mesh.mesh_paths = tbl_path;
sdata->u.mesh.mpp_paths = tbl_mpp;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 025/242] USB: dummy-hcd: Fix uninitialized array use in init()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 024/242] mac80211: mesh: fix mesh_pathtbl_init() error path Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 026/242] USB: add RESET_RESUME quirk for Snapscan 1212 Greg Kroah-Hartman
` (217 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern, Bui Quang Minh
From: Bui Quang Minh <minhquangbui99@gmail.com>
commit e90cfa813da7a527785033a0b247594c2de93dd8 upstream.
This error path
err_add_pdata:
for (i = 0; i < mod_data.num; i++)
kfree(dum[i]);
can be triggered when not all dum's elements are initialized.
Fix this by initializing all dum's elements to NULL.
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/1607063090-3426-1-git-send-email-minhquangbui99@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/dummy_hcd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -2742,7 +2742,7 @@ static int __init init(void)
{
int retval = -ENOMEM;
int i;
- struct dummy *dum[MAX_NUM_UDC];
+ struct dummy *dum[MAX_NUM_UDC] = {};
if (usb_disabled())
return -ENODEV;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 026/242] USB: add RESET_RESUME quirk for Snapscan 1212
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 025/242] USB: dummy-hcd: Fix uninitialized array use in init() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 027/242] ALSA: usb-audio: Fix potential out-of-bounds shift Greg Kroah-Hartman
` (216 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Oliver Neukum
From: Oliver Neukum <oneukum@suse.com>
commit 08a02f954b0def3ada8ed6d4b2c7bcb67e885e9c upstream.
I got reports that some models of this old scanner need
this when using runtime PM.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201207130323.23857-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -189,6 +189,9 @@ static const struct usb_device_id usb_qu
{ USB_DEVICE(0x06a3, 0x0006), .driver_info =
USB_QUIRK_CONFIG_INTF_STRINGS },
+ /* Agfa SNAPSCAN 1212U */
+ { USB_DEVICE(0x06bd, 0x0001), .driver_info = USB_QUIRK_RESET_RESUME },
+
/* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */
{ USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 027/242] ALSA: usb-audio: Fix potential out-of-bounds shift
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 026/242] USB: add RESET_RESUME quirk for Snapscan 1212 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 028/242] ALSA: usb-audio: Fix control access overflow errors from chmap Greg Kroah-Hartman
` (215 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+df7dc146ebdd6435eea3, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 43d5ca88dfcd35e43010fdd818e067aa9a55f5ba upstream.
syzbot spotted a potential out-of-bounds shift in the USB-audio format
parser that receives the arbitrary shift value from the USB
descriptor.
Add a range check for avoiding the undefined behavior.
Reported-by: syzbot+df7dc146ebdd6435eea3@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209084552.17109-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/format.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -52,6 +52,8 @@ static u64 parse_audio_format_i_type(str
case UAC_VERSION_1:
default: {
struct uac_format_type_i_discrete_descriptor *fmt = _fmt;
+ if (format >= 64)
+ return 0; /* invalid format */
sample_width = fmt->bBitResolution;
sample_bytes = fmt->bSubframeSize;
format = 1 << format;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 028/242] ALSA: usb-audio: Fix control access overflow errors from chmap
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 027/242] ALSA: usb-audio: Fix potential out-of-bounds shift Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 029/242] xhci: Give USB2 ports time to enter U3 in bus suspend Greg Kroah-Hartman
` (214 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit c6dde8ffd071aea9d1ce64279178e470977b235c upstream.
The current channel-map control implementation in USB-audio driver may
lead to an error message like
"control 3:0:0:Playback Channel Map:0: access overflow"
when CONFIG_SND_CTL_VALIDATION is set. It's because the chmap get
callback clears the whole array no matter which count is set, and
rather the false-positive detection.
This patch fixes the problem by clearing only the needed array range
at usb_chmap_ctl_get().
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201211130048.6358-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/stream.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -185,16 +185,16 @@ static int usb_chmap_ctl_get(struct snd_
struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol);
struct snd_usb_substream *subs = info->private_data;
struct snd_pcm_chmap_elem *chmap = NULL;
- int i;
+ int i = 0;
- memset(ucontrol->value.integer.value, 0,
- sizeof(ucontrol->value.integer.value));
if (subs->cur_audiofmt)
chmap = subs->cur_audiofmt->chmap;
if (chmap) {
for (i = 0; i < chmap->channels; i++)
ucontrol->value.integer.value[i] = chmap->map[i];
}
+ for (; i < subs->channels_max; i++)
+ ucontrol->value.integer.value[i] = 0;
return 0;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 029/242] xhci: Give USB2 ports time to enter U3 in bus suspend
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 028/242] ALSA: usb-audio: Fix control access overflow errors from chmap Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 030/242] USB: UAS: introduce a quirk to set no_write_same Greg Kroah-Hartman
` (213 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Li Jun, Mathias Nyman
From: Li Jun <jun.li@nxp.com>
commit c1373f10479b624fb6dba0805d673e860f1b421d upstream.
If a USB2 device wakeup is not enabled/supported the link state may
still be in U0 in xhci_bus_suspend(), where it's then manually put
to suspended U3 state.
Just as with selective suspend the device needs time to enter U3
suspend before continuing with further suspend operations
(e.g. system suspend), otherwise we may enter system suspend with link
state in U0.
[commit message rewording -Mathias]
Cc: <stable@vger.kernel.org>
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20201208092912.1773650-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-hub.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1590,6 +1590,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd
hcd->state = HC_STATE_SUSPENDED;
bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
spin_unlock_irqrestore(&xhci->lock, flags);
+
+ if (bus_state->bus_suspended)
+ usleep_range(5000, 10000);
+
return 0;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 030/242] USB: UAS: introduce a quirk to set no_write_same
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 029/242] xhci: Give USB2 ports time to enter U3 in bus suspend Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 031/242] USB: sisusbvga: Make console support depend on BROKEN Greg Kroah-Hartman
` (212 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David C. Partridge, Oliver Neukum
From: Oliver Neukum <oneukum@suse.com>
commit 8010622c86ca5bb44bc98492f5968726fc7c7a21 upstream.
UAS does not share the pessimistic assumption storage is making that
devices cannot deal with WRITE_SAME. A few devices supported by UAS,
are reported to not deal well with WRITE_SAME. Those need a quirk.
Add it to the device that needs it.
Reported-by: David C. Partridge <david.partridge@perdrix.co.uk>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209152639.9195-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/kernel-parameters.txt | 1 +
drivers/usb/storage/uas.c | 3 +++
drivers/usb/storage/unusual_uas.h | 7 +++++--
drivers/usb/storage/usb.c | 3 +++
include/linux/usb_usual.h | 2 ++
5 files changed, 14 insertions(+), 2 deletions(-)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4750,6 +4750,7 @@
device);
j = NO_REPORT_LUNS (don't use report luns
command, uas only);
+ k = NO_SAME (do not use WRITE_SAME, uas only)
l = NOT_LOCKABLE (don't try to lock and
unlock ejectable media, not on uas);
m = MAX_SECTORS_64 (don't transfer more
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -874,6 +874,9 @@ static int uas_slave_configure(struct sc
if (devinfo->flags & US_FL_NO_READ_CAPACITY_16)
sdev->no_read_capacity_16 = 1;
+ /* Some disks cannot handle WRITE_SAME */
+ if (devinfo->flags & US_FL_NO_SAME)
+ sdev->no_write_same = 1;
/*
* Some disks return the total number of blocks in response
* to READ CAPACITY rather than the highest block number.
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -48,12 +48,15 @@ UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x99
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_NO_REPORT_OPCODES),
-/* Reported-by: Julian Groß <julian.g@posteo.de> */
+/*
+ * Initially Reported-by: Julian Groß <julian.g@posteo.de>
+ * Further reports David C. Partridge <david.partridge@perdrix.co.uk>
+ */
UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
"LaCie",
"2Big Quadra USB3",
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
- US_FL_NO_REPORT_OPCODES),
+ US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME),
/*
* Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -557,6 +557,9 @@ void usb_stor_adjust_quirks(struct usb_d
case 'j':
f |= US_FL_NO_REPORT_LUNS;
break;
+ case 'k':
+ f |= US_FL_NO_SAME;
+ break;
case 'l':
f |= US_FL_NOT_LOCKABLE;
break;
--- a/include/linux/usb_usual.h
+++ b/include/linux/usb_usual.h
@@ -84,6 +84,8 @@
/* Cannot handle REPORT_LUNS */ \
US_FLAG(ALWAYS_SYNC, 0x20000000) \
/* lies about caching, so always sync */ \
+ US_FLAG(NO_SAME, 0x40000000) \
+ /* Cannot handle WRITE_SAME */ \
#define US_FLAG(name, value) US_FL_##name = value ,
enum { US_DO_ALL_FLAGS };
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 031/242] USB: sisusbvga: Make console support depend on BROKEN
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 030/242] USB: UAS: introduce a quirk to set no_write_same Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 032/242] ALSA: pcm: oss: Fix potential out-of-bounds shift Greg Kroah-Hartman
` (211 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Thomas Winischhofer,
linux-usb
From: Thomas Gleixner <tglx@linutronix.de>
commit 862ee699fefe1e6d6f2c1518395f0b999b8beb15 upstream.
The console part of sisusbvga is broken vs. printk(). It uses in_atomic()
to detect contexts in which it cannot sleep despite the big fat comment in
preempt.h which says: Do not use in_atomic() in driver code.
in_atomic() does not work on kernels with CONFIG_PREEMPT_COUNT=n which
means that spin/rw_lock held regions are not detected by it.
There is no way to make this work by handing context information through to
the driver and this only can be solved once the core printk infrastructure
supports sleepable console drivers.
Make it depend on BROKEN for now.
Fixes: 1bbb4f2035d9 ("[PATCH] USB: sisusb[vga] update")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201019101109.603244207@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/sisusbvga/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/sisusbvga/Kconfig
+++ b/drivers/usb/misc/sisusbvga/Kconfig
@@ -15,7 +15,7 @@ config USB_SISUSBVGA
config USB_SISUSBVGA_CON
bool "Text console and mode switching support" if USB_SISUSBVGA
- depends on VT
+ depends on VT && BROKEN
select FONT_8x16
---help---
Say Y here if you want a VGA text console via the USB dongle or
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 032/242] ALSA: pcm: oss: Fix potential out-of-bounds shift
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 031/242] USB: sisusbvga: Make console support depend on BROKEN Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 033/242] serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access Greg Kroah-Hartman
` (210 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+df7dc146ebdd6435eea3, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 175b8d89fe292796811fdee87fa39799a5b6b87a upstream.
syzbot spotted a potential out-of-bounds shift in the PCM OSS layer
where it calculates the buffer size with the arbitrary shift value
given via an ioctl.
Add a range check for avoiding the undefined behavior.
As the value can be treated by a signed integer, the max shift should
be 30.
Reported-by: syzbot+df7dc146ebdd6435eea3@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209084552.17109-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/oss/pcm_oss.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1949,11 +1949,15 @@ static int snd_pcm_oss_set_subdivide(str
static int snd_pcm_oss_set_fragment1(struct snd_pcm_substream *substream, unsigned int val)
{
struct snd_pcm_runtime *runtime;
+ int fragshift;
runtime = substream->runtime;
if (runtime->oss.subdivision || runtime->oss.fragshift)
return -EINVAL;
- runtime->oss.fragshift = val & 0xffff;
+ fragshift = val & 0xffff;
+ if (fragshift >= 31)
+ return -EINVAL;
+ runtime->oss.fragshift = fragshift;
runtime->oss.maxfrags = (val >> 16) & 0xffff;
if (runtime->oss.fragshift < 4) /* < 16 */
runtime->oss.fragshift = 4;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 033/242] serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 032/242] ALSA: pcm: oss: Fix potential out-of-bounds shift Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 034/242] drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi Greg Kroah-Hartman
` (209 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Sverdlin
From: Alexander Sverdlin <alexander.sverdlin@gmail.com>
commit d96f04d347e4011977abdbb4da5d8f303ebd26f8 upstream.
It has been observed that once per 300-1300 port openings the first
transmitted byte is being corrupted on AM3352 ("v" written to FIFO appeared
as "e" on the wire). It only happened if single byte has been transmitted
right after port open, which means, DMA is not used for this transfer and
the corruption never happened afterwards.
Therefore I've carefully re-read the MDR1 errata (link below), which says
"when accessing the MDR1 registers that causes a dummy under-run condition
that will freeze the UART in IrDA transmission. In UART mode, this may
corrupt the transferred data". Strictly speaking,
omap_8250_mdr1_errataset() performs a read access and if the value is the
same as should be written, exits without errata-recommended FIFO reset.
A brief check of the serial_omap_mdr1_errataset() from the competing
omap-serial driver showed it has no read access of MDR1. After removing the
read access from omap_8250_mdr1_errataset() the data corruption never
happened any more.
Link: https://www.ti.com/lit/er/sprz360i/sprz360i.pdf
Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://lore.kernel.org/r/20201210055257.1053028-1-alexander.sverdlin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_omap.c | 5 -----
1 file changed, 5 deletions(-)
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -161,11 +161,6 @@ static void omap_8250_mdr1_errataset(str
struct omap8250_priv *priv)
{
u8 timeout = 255;
- u8 old_mdr1;
-
- old_mdr1 = serial_in(up, UART_OMAP_MDR1);
- if (old_mdr1 == priv->mdr1)
- return;
serial_out(up, UART_OMAP_MDR1, priv->mdr1);
udelay(2);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 034/242] drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 033/242] serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 035/242] pinctrl: merrifield: Set default bias in case no particular value given Greg Kroah-Hartman
` (208 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xiyu Yang, Xin Tan, Xin Xiong,
Lyude Paul, Sudip Mukherjee
From: Xin Xiong <xiongx18@fudan.edu.cn>
commit a34a0a632dd991a371fec56431d73279f9c54029 upstream
drm_dp_mst_allocate_vcpi() invokes
drm_dp_mst_topology_get_port_validated(), which increases the refcount
of the "port".
These reference counting issues take place in two exception handling
paths separately. Either when “slots” is less than 0 or when
drm_dp_init_vcpi() returns a negative value, the function forgets to
reduce the refcnt increased drm_dp_mst_topology_get_port_validated(),
which results in a refcount leak.
Fix these issues by pulling up the error handling when "slots" is less
than 0, and calling drm_dp_mst_topology_put_port() before termination
when drm_dp_init_vcpi() returns a negative value.
Fixes: 1e797f556c61 ("drm/dp: Split drm_dp_mst_allocate_vcpi")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200719154545.GA41231@xin-virtual-machine
[sudip: use old functions before rename]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2629,11 +2629,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm
{
int ret;
- port = drm_dp_get_validated_port_ref(mgr, port);
- if (!port)
+ if (slots < 0)
return false;
- if (slots < 0)
+ port = drm_dp_get_validated_port_ref(mgr, port);
+ if (!port)
return false;
if (port->vcpi.vcpi > 0) {
@@ -2648,6 +2648,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm
if (ret) {
DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n",
DIV_ROUND_UP(pbn, mgr->pbn_div), ret);
+ drm_dp_put_port(port);
goto out;
}
DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 035/242] pinctrl: merrifield: Set default bias in case no particular value given
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 034/242] drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 036/242] pinctrl: baytrail: Avoid clearing debounce value when turning it off Greg Kroah-Hartman
` (207 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Mika Westerberg,
Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 0fa86fc2e28227f1e64f13867e73cf864c6d25ad ]
When GPIO library asks pin control to set the bias, it doesn't pass
any value of it and argument is considered boolean (and this is true
for ACPI GpioIo() / GpioInt() resources, by the way). Thus, individual
drivers must behave well, when they got the resistance value of 1 Ohm,
i.e. transforming it to sane default.
In case of Intel Merrifield pin control hardware the 20 kOhm sounds plausible
because it gives a good trade off between weakness and minimization of leakage
current (will be only 50 uA with the above choice).
Fixes: 4e80c8f50574 ("pinctrl: intel: Add Intel Merrifield pin controller support")
Depends-on: 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/intel/pinctrl-merrifield.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
index 86c4b3fab7b0e..5aa6d1dbc70ae 100644
--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
@@ -731,6 +731,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin,
mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK;
bits |= BUFCFG_PU_EN;
+ /* Set default strength value in case none is given */
+ if (arg == 1)
+ arg = 20000;
+
switch (arg) {
case 50000:
bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT;
@@ -751,6 +755,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin,
mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK;
bits |= BUFCFG_PD_EN;
+ /* Set default strength value in case none is given */
+ if (arg == 1)
+ arg = 20000;
+
switch (arg) {
case 50000:
bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 036/242] pinctrl: baytrail: Avoid clearing debounce value when turning it off
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 035/242] pinctrl: merrifield: Set default bias in case no particular value given Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 037/242] ARM: dts: sun8i: v3s: fix GIC node memory range Greg Kroah-Hartman
` (206 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Mika Westerberg,
Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 0b74e40a4e41f3cbad76dff4c50850d47b525b26 ]
Baytrail pin control has a common register to set up debounce timeout.
When a pin configuration requested debounce to be disabled, the rest
of the pins may still want to have debounce enabled and thus rely on
the common timeout value. Avoid clearing debounce value when turning
it off for one pin while others may still use it.
Fixes: 658b476c742f ("pinctrl: baytrail: Add debounce configuration")
Depends-on: 04ff5a095d66 ("pinctrl: baytrail: Rectify debounce support")
Depends-on: 827e1579e1d5 ("pinctrl: baytrail: Rectify debounce support (part 2)")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 62eac76be9f66..519758d4297ee 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -1266,7 +1266,6 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
break;
case PIN_CONFIG_INPUT_DEBOUNCE:
debounce = readl(db_reg);
- debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
if (arg)
conf |= BYT_DEBOUNCE_EN;
@@ -1275,24 +1274,31 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
switch (arg) {
case 375:
+ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
debounce |= BYT_DEBOUNCE_PULSE_375US;
break;
case 750:
+ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
debounce |= BYT_DEBOUNCE_PULSE_750US;
break;
case 1500:
+ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
debounce |= BYT_DEBOUNCE_PULSE_1500US;
break;
case 3000:
+ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
debounce |= BYT_DEBOUNCE_PULSE_3MS;
break;
case 6000:
+ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
debounce |= BYT_DEBOUNCE_PULSE_6MS;
break;
case 12000:
+ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
debounce |= BYT_DEBOUNCE_PULSE_12MS;
break;
case 24000:
+ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
debounce |= BYT_DEBOUNCE_PULSE_24MS;
break;
default:
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 037/242] ARM: dts: sun8i: v3s: fix GIC node memory range
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 036/242] pinctrl: baytrail: Avoid clearing debounce value when turning it off Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 038/242] gpio: mvebu: fix potential user-after-free on probe Greg Kroah-Hartman
` (205 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Icenowy Zheng, Maxime Ripard, Sasha Levin
From: Icenowy Zheng <icenowy@aosc.io>
[ Upstream commit a98fd117a2553ab1a6d2fe3c7acae88c1eca4372 ]
Currently the GIC node in V3s DTSI follows some old DT examples, and
being broken. This leads a warning at boot.
Fix this.
Fixes: f989086ccbc6 ("ARM: dts: sunxi: add dtsi file for V3s SoC")
Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20201120050851.4123759-1-icenowy@aosc.io
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/sun8i-v3s.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi
index da5823c6fa3e6..e31804e448da2 100644
--- a/arch/arm/boot/dts/sun8i-v3s.dtsi
+++ b/arch/arm/boot/dts/sun8i-v3s.dtsi
@@ -419,7 +419,7 @@
gic: interrupt-controller@01c81000 {
compatible = "arm,cortex-a7-gic", "arm,cortex-a15-gic";
reg = <0x01c81000 0x1000>,
- <0x01c82000 0x1000>,
+ <0x01c82000 0x2000>,
<0x01c84000 0x2000>,
<0x01c86000 0x2000>;
interrupt-controller;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 038/242] gpio: mvebu: fix potential user-after-free on probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 037/242] ARM: dts: sun8i: v3s: fix GIC node memory range Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 039/242] scsi: bnx2i: Requires MMU Greg Kroah-Hartman
` (204 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Baruch Siach,
Bartosz Golaszewski, Sasha Levin
From: Baruch Siach <baruch@tkos.co.il>
[ Upstream commit 7ee1a01e47403f72b9f38839a737692f6991263e ]
When mvebu_pwm_probe() fails IRQ domain is not released. Move pwm probe
before IRQ domain allocation. Add pwm cleanup code to the failure path.
Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-mvebu.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index be85d4b39e997..fc762b4adcb22 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1195,6 +1195,13 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
+ /* Some MVEBU SoCs have simple PWM support for GPIO lines */
+ if (IS_ENABLED(CONFIG_PWM)) {
+ err = mvebu_pwm_probe(pdev, mvchip, id);
+ if (err)
+ return err;
+ }
+
/* Some gpio controllers do not provide irq support */
if (!have_irqs)
return 0;
@@ -1204,7 +1211,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
if (!mvchip->domain) {
dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
mvchip->chip.label);
- return -ENODEV;
+ err = -ENODEV;
+ goto err_pwm;
}
err = irq_alloc_domain_generic_chips(
@@ -1252,14 +1260,12 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
mvchip);
}
- /* Some MVEBU SoCs have simple PWM support for GPIO lines */
- if (IS_ENABLED(CONFIG_PWM))
- return mvebu_pwm_probe(pdev, mvchip, id);
-
return 0;
err_domain:
irq_domain_remove(mvchip->domain);
+err_pwm:
+ pwmchip_remove(&mvchip->mvpwm->chip);
return err;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 039/242] scsi: bnx2i: Requires MMU
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 038/242] gpio: mvebu: fix potential user-after-free on probe Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 040/242] can: softing: softing_netdev_open(): fix error handling Greg Kroah-Hartman
` (203 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, linux-scsi, Nilesh Javali,
Manish Rangankar, GR-QLogic-Storage-Upstream,
James E.J. Bottomley, Martin K. Petersen, Randy Dunlap,
Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 2d586494c4a001312650f0b919d534e429dd1e09 ]
The SCSI_BNX2_ISCSI kconfig symbol selects CNIC and CNIC selects UIO, which
depends on MMU.
Since 'select' does not follow dependency chains, add the same MMU
dependency to SCSI_BNX2_ISCSI.
Quietens this kconfig warning:
WARNING: unmet direct dependencies detected for CNIC
Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n) && MMU [=n]
Selected by [m]:
- SCSI_BNX2_ISCSI [=m] && SCSI_LOWLEVEL [=y] && SCSI [=y] && NET [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n)
Link: https://lore.kernel.org/r/20201129070916.3919-1-rdunlap@infradead.org
Fixes: cf4e6363859d ("[SCSI] bnx2i: Add bnx2i iSCSI driver.")
Cc: linux-scsi@vger.kernel.org
Cc: Nilesh Javali <njavali@marvell.com>
Cc: Manish Rangankar <mrangankar@marvell.com>
Cc: GR-QLogic-Storage-Upstream@marvell.com
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/bnx2i/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/bnx2i/Kconfig b/drivers/scsi/bnx2i/Kconfig
index ba30ff86d5818..b27a3738d940c 100644
--- a/drivers/scsi/bnx2i/Kconfig
+++ b/drivers/scsi/bnx2i/Kconfig
@@ -3,6 +3,7 @@ config SCSI_BNX2_ISCSI
depends on NET
depends on PCI
depends on (IPV6 || IPV6=n)
+ depends on MMU
select SCSI_ISCSI_ATTRS
select NETDEVICES
select ETHERNET
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 040/242] can: softing: softing_netdev_open(): fix error handling
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 039/242] scsi: bnx2i: Requires MMU Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 041/242] RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait Greg Kroah-Hartman
` (202 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Kurt Van Dijck,
Marc Kleine-Budde, Jakub Kicinski, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 4d1be581ec6b92a338bb7ed23e1381f45ddf336f ]
If softing_netdev_open() fails, we should call close_candev() to avoid
reference leak.
Fixes: 03fd3cf5a179d ("can: add driver for Softing card")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Link: https://lore.kernel.org/r/20201202151632.1343786-1-zhangqilong3@huawei.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://lore.kernel.org/r/20201204133508.742120-2-mkl@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/softing/softing_main.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
index 5f64deec9f6c1..26b3072daabd6 100644
--- a/drivers/net/can/softing/softing_main.c
+++ b/drivers/net/can/softing/softing_main.c
@@ -393,8 +393,13 @@ static int softing_netdev_open(struct net_device *ndev)
/* check or determine and set bittime */
ret = open_candev(ndev);
- if (!ret)
- ret = softing_startstop(ndev, 1);
+ if (ret)
+ return ret;
+
+ ret = softing_startstop(ndev, 1);
+ if (ret < 0)
+ close_candev(ndev);
+
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 041/242] RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 040/242] can: softing: softing_netdev_open(): fix error handling Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 042/242] kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling Greg Kroah-Hartman
` (201 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maor Gottlieb, Amit Matityahu,
Leon Romanovsky, Jason Gunthorpe, Sasha Levin
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 340b940ea0ed12d9adbb8f72dea17d516b2019e8 ]
If cm_create_timewait_info() fails, the timewait_info pointer will contain
an error value and will be used in cm_remove_remote() later.
general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0×0000000000000120-0×0000000000000127]
CPU: 2 PID: 12446 Comm: syz-executor.3 Not tainted 5.10.0-rc5-5d4c0742a60e #27
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:cm_remove_remote.isra.0+0x24/0×170 drivers/infiniband/core/cm.c:978
Code: 84 00 00 00 00 00 41 54 55 53 48 89 fb 48 8d ab 2d 01 00 00 e8 7d bf 4b fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 48 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 fc 00 00 00
RSP: 0018:ffff888013127918 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc9000a18b000
RDX: 0000000000000024 RSI: ffffffff82edc573 RDI: fffffffffffffff4
RBP: 0000000000000121 R08: 0000000000000001 R09: ffffed1002624f1d
R10: 0000000000000003 R11: ffffed1002624f1c R12: ffff888107760c70
R13: ffff888107760c40 R14: fffffffffffffff4 R15: ffff888107760c9c
FS: 00007fe1ffcc1700(0000) GS:ffff88811a600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff21000 CR3: 000000010f504001 CR4: 0000000000370ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cm_destroy_id+0x189/0×15b0 drivers/infiniband/core/cm.c:1155
cma_connect_ib drivers/infiniband/core/cma.c:4029 [inline]
rdma_connect_locked+0x1100/0×17c0 drivers/infiniband/core/cma.c:4107
rdma_connect+0x2a/0×40 drivers/infiniband/core/cma.c:4140
ucma_connect+0x277/0×340 drivers/infiniband/core/ucma.c:1069
ucma_write+0x236/0×2f0 drivers/infiniband/core/ucma.c:1724
vfs_write+0x220/0×830 fs/read_write.c:603
ksys_write+0x1df/0×240 fs/read_write.c:658
do_syscall_64+0x33/0×40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
Link: https://lore.kernel.org/r/20201204064205.145795-1-leon@kernel.org
Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
Reported-by: Amit Matityahu <mitm@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/cm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 80a8eb7e5d6ec..3ddc556df809c 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1349,6 +1349,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
id.local_id);
if (IS_ERR(cm_id_priv->timewait_info)) {
ret = PTR_ERR(cm_id_priv->timewait_info);
+ cm_id_priv->timewait_info = NULL;
goto out;
}
@@ -1836,6 +1837,7 @@ static int cm_req_handler(struct cm_work *work)
id.local_id);
if (IS_ERR(cm_id_priv->timewait_info)) {
ret = PTR_ERR(cm_id_priv->timewait_info);
+ cm_id_priv->timewait_info = NULL;
goto destroy;
}
cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 042/242] kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 041/242] RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 043/242] drm/tegra: sor: Disable clocks on error in tegra_sor_init() Greg Kroah-Hartman
` (200 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Piggin, Aneesh Kumar K.V,
Peter Zijlstra (Intel),
Michael Ellerman, Sasha Levin
From: Nicholas Piggin <npiggin@gmail.com>
[ Upstream commit 8ff00399b153440c1c83e20c43020385b416415b ]
powerpc/64s keeps a counter in the mm which counts bits set in
mm_cpumask as well as other things. This means it can't use generic code
to clear bits out of the mask and doesn't adjust the arch specific
counter.
Add an arch override that allows powerpc/64s to use
clear_tasks_mm_cpumask().
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201126102530.691335-4-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cpu.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/cpu.c b/kernel/cpu.c
index d8c77bfb6e7e4..e1d10629022a5 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -772,6 +772,10 @@ void __init cpuhp_threads_init(void)
}
#ifdef CONFIG_HOTPLUG_CPU
+#ifndef arch_clear_mm_cpumask_cpu
+#define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm))
+#endif
+
/**
* clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
* @cpu: a CPU id
@@ -807,7 +811,7 @@ void clear_tasks_mm_cpumask(int cpu)
t = find_lock_task_mm(p);
if (!t)
continue;
- cpumask_clear_cpu(cpu, mm_cpumask(t->mm));
+ arch_clear_mm_cpumask_cpu(cpu, t->mm);
task_unlock(t);
}
rcu_read_unlock();
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 043/242] drm/tegra: sor: Disable clocks on error in tegra_sor_init()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 042/242] kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 044/242] vxlan: Add needed_headroom for lower device Greg Kroah-Hartman
` (199 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qinglang Miao, Thierry Reding, Sasha Levin
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit bf3a3cdcad40e5928a22ea0fd200d17fd6d6308d ]
Fix the missing clk_disable_unprepare() before return from
tegra_sor_init() in the error handling case.
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/sor.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
index 7ab1d1dc7cd73..352ae52be3418 100644
--- a/drivers/gpu/drm/tegra/sor.c
+++ b/drivers/gpu/drm/tegra/sor.c
@@ -2378,17 +2378,23 @@ static int tegra_sor_init(struct host1x_client *client)
if (err < 0) {
dev_err(sor->dev, "failed to deassert SOR reset: %d\n",
err);
+ clk_disable_unprepare(sor->clk);
return err;
}
}
err = clk_prepare_enable(sor->clk_safe);
- if (err < 0)
+ if (err < 0) {
+ clk_disable_unprepare(sor->clk);
return err;
+ }
err = clk_prepare_enable(sor->clk_dp);
- if (err < 0)
+ if (err < 0) {
+ clk_disable_unprepare(sor->clk_safe);
+ clk_disable_unprepare(sor->clk);
return err;
+ }
return 0;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 044/242] vxlan: Add needed_headroom for lower device
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 043/242] drm/tegra: sor: Disable clocks on error in tegra_sor_init() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 045/242] vxlan: Copy needed_tailroom from lowerdev Greg Kroah-Hartman
` (198 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Annika Wickert, Sven Eckelmann,
Annika Wickert, Jakub Kicinski, Sasha Levin
From: Sven Eckelmann <sven@narfation.org>
[ Upstream commit 0a35dc41fea67ac4495ce7584406bf9557a6e7d0 ]
It was observed that sending data via batadv over vxlan (on top of
wireguard) reduced the performance massively compared to raw ethernet or
batadv on raw ethernet. A check of perf data showed that the
vxlan_build_skb was calling all the time pskb_expand_head to allocate
enough headroom for:
min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len
+ VXLAN_HLEN + iphdr_len;
But the vxlan_config_apply only requested needed headroom for:
lowerdev->hard_header_len + VXLAN6_HEADROOM or VXLAN_HEADROOM
So it completely ignored the needed_headroom of the lower device. The first
caller of net_dev_xmit could therefore never make sure that enough headroom
was allocated for the rest of the transmit path.
Cc: Annika Wickert <annika.wickert@exaring.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Tested-by: Annika Wickert <aw@awlnx.space>
Link: https://lore.kernel.org/r/20201126125247.1047977-1-sven@narfation.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/vxlan.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 82efa5bbf568b..c21f28840f05b 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3184,6 +3184,7 @@ static void vxlan_config_apply(struct net_device *dev,
dev->gso_max_segs = lowerdev->gso_max_segs;
needed_headroom = lowerdev->hard_header_len;
+ needed_headroom += lowerdev->needed_headroom;
max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
VXLAN_HEADROOM);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 045/242] vxlan: Copy needed_tailroom from lowerdev
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 044/242] vxlan: Add needed_headroom for lower device Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 046/242] scsi: mpt3sas: Increase IOCInit request timeout to 30s Greg Kroah-Hartman
` (197 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Jakub Kicinski, Sasha Levin
From: Sven Eckelmann <sven@narfation.org>
[ Upstream commit a5e74021e84bb5eadf760aaf2c583304f02269be ]
While vxlan doesn't need any extra tailroom, the lowerdev might need it. In
that case, copy it over to reduce the chance for additional (re)allocations
in the transmit path.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://lore.kernel.org/r/20201126125247.1047977-2-sven@narfation.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/vxlan.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index c21f28840f05b..94a9add2fc878 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3186,6 +3186,8 @@ static void vxlan_config_apply(struct net_device *dev,
needed_headroom = lowerdev->hard_header_len;
needed_headroom += lowerdev->needed_headroom;
+ dev->needed_tailroom = lowerdev->needed_tailroom;
+
max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
VXLAN_HEADROOM);
if (max_mtu < ETH_MIN_MTU)
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 046/242] scsi: mpt3sas: Increase IOCInit request timeout to 30s
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 045/242] vxlan: Copy needed_tailroom from lowerdev Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 047/242] dm table: Remove BUG_ON(in_interrupt()) Greg Kroah-Hartman
` (196 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sreekanth Reddy, Martin K. Petersen,
Sasha Levin
From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
[ Upstream commit 85dad327d9b58b4c9ce08189a2707167de392d23 ]
Currently the IOCInit request message timeout is set to 10s. This is not
sufficient in some scenarios such as during HBA FW downgrade operations.
Increase the IOCInit request timeout to 30s.
Link: https://lore.kernel.org/r/20201130082733.26120-1-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 556971c5f0b0e..20bf1fa7f2733 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -4575,7 +4575,7 @@ _base_send_ioc_init(struct MPT3SAS_ADAPTER *ioc)
r = _base_handshake_req_reply_wait(ioc,
sizeof(Mpi2IOCInitRequest_t), (u32 *)&mpi_request,
- sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 10);
+ sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 30);
if (r != 0) {
pr_err(MPT3SAS_FMT "%s: handshake failed (r=%d)\n",
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 047/242] dm table: Remove BUG_ON(in_interrupt())
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 046/242] scsi: mpt3sas: Increase IOCInit request timeout to 30s Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 048/242] soc/tegra: fuse: Fix index bug in get_process_id Greg Kroah-Hartman
` (195 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Sebastian Andrzej Siewior, Mike Snitzer, Sasha Levin
From: Thomas Gleixner <tglx@linutronix.de>
[ Upstream commit e7b624183d921b49ef0a96329f21647d38865ee9 ]
The BUG_ON(in_interrupt()) in dm_table_event() is a historic leftover from
a rework of the dm table code which changed the calling context.
Issuing a BUG for a wrong calling context is frowned upon and
in_interrupt() is deprecated and only covering parts of the wrong
contexts. The sanity check for the context is covered by
CONFIG_DEBUG_ATOMIC_SLEEP and other debug facilities already.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-table.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 777343cff5f1e..78d4e7347e2f3 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1295,12 +1295,6 @@ void dm_table_event_callback(struct dm_table *t,
void dm_table_event(struct dm_table *t)
{
- /*
- * You can no longer call dm_table_event() from interrupt
- * context, use a bottom half instead.
- */
- BUG_ON(in_interrupt());
-
mutex_lock(&_event_lock);
if (t->event_fn)
t->event_fn(t->event_context);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 048/242] soc/tegra: fuse: Fix index bug in get_process_id
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 047/242] dm table: Remove BUG_ON(in_interrupt()) Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 049/242] USB: serial: option: add interface-number sanity check to flag handling Greg Kroah-Hartman
` (194 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicolin Chen, Thierry Reding
From: Nicolin Chen <nicoleotsuka@gmail.com>
commit b9ce9b0f83b536a4ac7de7567a265d28d13e5bea upstream.
This patch simply fixes a bug of referencing speedos[num] in every
for-loop iteration in get_process_id function.
Fixes: 0dc5a0d83675 ("soc/tegra: fuse: Add Tegra210 support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/soc/tegra/fuse/speedo-tegra210.c
+++ b/drivers/soc/tegra/fuse/speedo-tegra210.c
@@ -105,7 +105,7 @@ static int get_process_id(int value, con
unsigned int i;
for (i = 0; i < num; i++)
- if (value < speedos[num])
+ if (value < speedos[i])
return i;
return -EINVAL;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 049/242] USB: serial: option: add interface-number sanity check to flag handling
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 048/242] soc/tegra: fuse: Fix index bug in get_process_id Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 050/242] USB: gadget: f_acm: add support for SuperSpeed Plus Greg Kroah-Hartman
` (193 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+8881b478dad0a7971f79, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit a251963f76fa0226d0fdf0c4f989496f18d9ae7f upstream.
Add an interface-number sanity check before testing the device flags to
avoid relying on undefined behaviour when left shifting in case a device
uses an interface number greater than or equal to BITS_PER_LONG (i.e. 64
or 32).
Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com
Fixes: c3a65808f04a ("USB: serial: option: reimplement interface masking")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -566,6 +566,9 @@ static void option_instat_callback(struc
/* Device flags */
+/* Highest interface number which can be used with NCTRL() and RSVD() */
+#define FLAG_IFNUM_MAX 7
+
/* Interface does not support modem-control requests */
#define NCTRL(ifnum) ((BIT(ifnum) & 0xff) << 8)
@@ -2102,6 +2105,14 @@ static struct usb_serial_driver * const
module_usb_serial_driver(serial_drivers, option_ids);
+static bool iface_is_reserved(unsigned long device_flags, u8 ifnum)
+{
+ if (ifnum > FLAG_IFNUM_MAX)
+ return false;
+
+ return device_flags & RSVD(ifnum);
+}
+
static int option_probe(struct usb_serial *serial,
const struct usb_device_id *id)
{
@@ -2119,7 +2130,7 @@ static int option_probe(struct usb_seria
* the same class/subclass/protocol as the serial interfaces. Look at
* the Windows driver .INF files for reserved interface numbers.
*/
- if (device_flags & RSVD(iface_desc->bInterfaceNumber))
+ if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber))
return -ENODEV;
/*
* Don't bind network interface on Samsung GT-B3730, it is handled by
@@ -2143,6 +2154,14 @@ static int option_probe(struct usb_seria
return 0;
}
+static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum)
+{
+ if (ifnum > FLAG_IFNUM_MAX)
+ return false;
+
+ return device_flags & NCTRL(ifnum);
+}
+
static int option_attach(struct usb_serial *serial)
{
struct usb_interface_descriptor *iface_desc;
@@ -2158,7 +2177,7 @@ static int option_attach(struct usb_seri
iface_desc = &serial->interface->cur_altsetting->desc;
- if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
+ if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber))
data->use_send_setup = 1;
if (device_flags & ZLP)
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 050/242] USB: gadget: f_acm: add support for SuperSpeed Plus
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 049/242] USB: serial: option: add interface-number sanity check to flag handling Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 051/242] USB: gadget: f_midi: setup SuperSpeed Plus descriptors Greg Kroah-Hartman
` (192 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Felipe Balbi, taehyun.cho,
Will McVicker, Peter Chen
From: taehyun.cho <taehyun.cho@samsung.com>
commit 3ee05c20656782387aa9eb010fdb9bb16982ac3f upstream.
Setup the SuperSpeed Plus descriptors for f_acm. This allows the gadget
to work properly without crashing at SuperSpeed rates.
Cc: Felipe Balbi <balbi@kernel.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: taehyun.cho <taehyun.cho@samsung.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201127140559.381351-3-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_acm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -687,7 +687,7 @@ acm_bind(struct usb_configuration *c, st
acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function,
- acm_ss_function, NULL);
+ acm_ss_function, acm_ss_function);
if (status)
goto fail;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 051/242] USB: gadget: f_midi: setup SuperSpeed Plus descriptors
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 050/242] USB: gadget: f_acm: add support for SuperSpeed Plus Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 052/242] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Greg Kroah-Hartman
` (191 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Will McVicker, Peter Chen
From: Will McVicker <willmcvicker@google.com>
commit 457a902ba1a73b7720666b21ca038cd19764db18 upstream.
Needed for SuperSpeed Plus support for f_midi. This allows the
gadget to work properly without crashing at SuperSpeed rates.
Cc: Felipe Balbi <balbi@kernel.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201127140559.381351-4-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_midi.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -1048,6 +1048,12 @@ static int f_midi_bind(struct usb_config
f->ss_descriptors = usb_copy_descriptors(midi_function);
if (!f->ss_descriptors)
goto fail_f_midi;
+
+ if (gadget_is_superspeed_plus(c->cdev->gadget)) {
+ f->ssp_descriptors = usb_copy_descriptors(midi_function);
+ if (!f->ssp_descriptors)
+ goto fail_f_midi;
+ }
}
kfree(midi_function);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 052/242] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 051/242] USB: gadget: f_midi: setup SuperSpeed Plus descriptors Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 053/242] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Greg Kroah-Hartman
` (190 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jack Pham
From: Jack Pham <jackp@codeaurora.org>
commit a353397b0d5dfa3c99b372505db3378fc919c6c6 upstream.
In many cases a function that supports SuperSpeed can very well
operate in SuperSpeedPlus, if a gadget controller supports it,
as the endpoint descriptors (and companion descriptors) are
generally identical and can be re-used. This is true for two
commonly used functions: Android's ADB and MTP. So we can simply
assign the usb_function's ssp_descriptors array to point to its
ss_descriptors, if available. Similarly, we need to allow an
epfile's ioctl for FUNCTIONFS_ENDPOINT_DESC to correctly
return the corresponding SuperSpeed endpoint descriptor in case
the connected speed is SuperSpeedPlus as well.
The only exception is if a function wants to implement an
Isochronous endpoint capable of transferring more than 48KB per
service interval when operating at greater than USB 3.1 Gen1
speed, in which case it would require an additional SuperSpeedPlus
Isochronous Endpoint Companion descriptor to be returned as part
of the Configuration Descriptor. Support for that would need
to be separately added to the userspace-facing FunctionFS API
which may not be a trivial task--likely a new descriptor format
(v3?) may need to be devised to allow for separate SS and SSP
descriptors to be supplied.
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201027230731.9073-1-jackp@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1248,6 +1248,7 @@ static long ffs_epfile_ioctl(struct file
switch (epfile->ffs->gadget->speed) {
case USB_SPEED_SUPER:
+ case USB_SPEED_SUPER_PLUS:
desc_idx = 2;
break;
case USB_SPEED_HIGH:
@@ -3067,7 +3068,8 @@ static int _ffs_func_bind(struct usb_con
}
if (likely(super)) {
- func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs);
+ func->function.ss_descriptors = func->function.ssp_descriptors =
+ vla_ptr(vlabuf, d, ss_descs);
ss_len = ffs_do_descs(ffs->ss_descs_count,
vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
d_raw_descs__sz - fs_len - hs_len,
@@ -3477,6 +3479,7 @@ static void ffs_func_unbind(struct usb_c
func->function.fs_descriptors = NULL;
func->function.hs_descriptors = NULL;
func->function.ss_descriptors = NULL;
+ func->function.ssp_descriptors = NULL;
func->interfaces_nums = NULL;
ffs_event_add(ffs, FUNCTIONFS_UNBIND);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 053/242] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 052/242] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 054/242] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Greg Kroah-Hartman
` (189 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Felipe Balbi, EJ Hsu, Peter Chen,
Will McVicker
From: Will McVicker <willmcvicker@google.com>
commit b00f444f9add39b64d1943fa75538a1ebd54a290 upstream.
Align the SuperSpeed Plus bitrate for f_rndis to match f_ncm's ncm_bitrate
defined by commit 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors
for CDC NCM").
Cc: Felipe Balbi <balbi@kernel.org>
Cc: EJ Hsu <ejh@nvidia.com>
Cc: Peter Chen <peter.chen@nxp.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201127140559.381351-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_rndis.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -91,8 +91,10 @@ static inline struct f_rndis *func_to_rn
/* peak (theoretical) bulk transfer rate in bits-per-second */
static unsigned int bitrate(struct usb_gadget *g)
{
+ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
+ return 4250000000U;
if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
- return 13 * 1024 * 8 * 1000 * 8;
+ return 3750000000U;
else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
return 13 * 512 * 8 * 1000 * 8;
else
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 054/242] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 053/242] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 055/242] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Greg Kroah-Hartman
` (188 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Peter Chen
From: Fabio Estevam <festevam@gmail.com>
commit c7721e15f434920145c376e8fe77e1c079fc3726 upstream.
According to the i.MX6UL Errata document:
https://www.nxp.com/docs/en/errata/IMX6ULCE.pdf
ERR007881 also affects i.MX6UL, so pass the
CI_HDRC_DISABLE_DEVICE_STREAMING flag to workaround the issue.
Fixes: 52fe568e5d71 ("usb: chipidea: imx: add imx6ul usb support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20201207020909.22483-2-peter.chen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/chipidea/ci_hdrc_imx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -64,7 +64,8 @@ static const struct ci_hdrc_imx_platform
static const struct ci_hdrc_imx_platform_flag imx6ul_usb_data = {
.flags = CI_HDRC_SUPPORTS_RUNTIME_PM |
- CI_HDRC_TURN_VBUS_EARLY_ON,
+ CI_HDRC_TURN_VBUS_EARLY_ON |
+ CI_HDRC_DISABLE_DEVICE_STREAMING,
};
static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = {
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 055/242] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 054/242] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 056/242] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Greg Kroah-Hartman
` (187 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Gabriel Ribba Esteva
From: Krzysztof Kozlowski <krzk@kernel.org>
commit ecc1ff532b499d20304a4f682247137025814c34 upstream.
On Odroid XU board the USB3-0 port is a microUSB and USB3-1 port is USB
type A (host). The roles were copied from Odroid XU3 (Exynos5422)
design which has it reversed.
Fixes: 8149afe4dbf9 ("ARM: dts: exynos: Add initial support for Odroid XU board")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201015182044.480562-1-krzk@kernel.org
Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos5410-odroidxu.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -629,11 +629,11 @@
};
&usbdrd_dwc3_0 {
- dr_mode = "host";
+ dr_mode = "peripheral";
};
&usbdrd_dwc3_1 {
- dr_mode = "peripheral";
+ dr_mode = "host";
};
&usbdrd3_0 {
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 056/242] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 055/242] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 057/242] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Greg Kroah-Hartman
` (186 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Gabriel Ribba Esteva
From: Krzysztof Kozlowski <krzk@kernel.org>
commit 3d992fd8f4e0f09c980726308d2f2725587b32d6 upstream.
The VBUS control (PWREN) and over-current pins of USB 3.0 DWC3
controllers are on Exynos5410 regular GPIOs. This is different than for
example on Exynos5422 where these are special ETC pins with proper reset
values (pulls, functions).
Therefore these pins should be configured to enable proper USB 3.0
peripheral and host modes. This also fixes over-current warning:
[ 6.024658] usb usb4-port1: over-current condition
[ 6.028271] usb usb3-port1: over-current condition
Fixes: cb0896562228 ("ARM: dts: exynos: Add USB to Exynos5410")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201015182044.480562-2-krzk@kernel.org
Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos5410-pinctrl.dtsi | 28 ++++++++++++++++++++++++++++
arch/arm/boot/dts/exynos5410.dtsi | 4 ++++
2 files changed, 32 insertions(+)
--- a/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
+++ b/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
@@ -563,6 +563,34 @@
interrupt-controller;
#interrupt-cells = <2>;
};
+
+ usb3_1_oc: usb3-1-oc {
+ samsung,pins = "gpk2-4", "gpk2-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
+ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+ };
+
+ usb3_1_vbusctrl: usb3-1-vbusctrl {
+ samsung,pins = "gpk2-6", "gpk2-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
+ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+ };
+
+ usb3_0_oc: usb3-0-oc {
+ samsung,pins = "gpk3-0", "gpk3-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
+ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+ };
+
+ usb3_0_vbusctrl: usb3-0-vbusctrl {
+ samsung,pins = "gpk3-2", "gpk3-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
+ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
+ };
};
&pinctrl_2 {
--- a/arch/arm/boot/dts/exynos5410.dtsi
+++ b/arch/arm/boot/dts/exynos5410.dtsi
@@ -381,6 +381,8 @@
&usbdrd3_0 {
clocks = <&clock CLK_USBD300>;
clock-names = "usbdrd30";
+ pinctrl-names = "default";
+ pinctrl-0 = <&usb3_0_oc>, <&usb3_0_vbusctrl>;
};
&usbdrd_phy0 {
@@ -392,6 +394,8 @@
&usbdrd3_1 {
clocks = <&clock CLK_USBD301>;
clock-names = "usbdrd30";
+ pinctrl-names = "default";
+ pinctrl-0 = <&usb3_1_oc>, <&usb3_1_vbusctrl>;
};
&usbdrd_dwc3_1 {
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 057/242] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 056/242] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 058/242] HID: i2c-hid: add Vero K147 to descriptor override Greg Kroah-Hartman
` (185 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Gabriel Ribba Esteva
From: Krzysztof Kozlowski <krzk@kernel.org>
commit bd7e7ff56feea7810df900fb09c9741d259861d9 upstream.
On Odroid XU LDO12 and LDO15 supplies the power to USB 3.0 blocks but
the GPK GPIO pins are supplied by LDO7 (VDDQ_LCD). LDO7 also supplies
GPJ GPIO pins.
The Exynos pinctrl driver does not take any supplies, so to have entire
GPIO block always available, make the regulator always on.
Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201015182044.480562-3-krzk@kernel.org
Tested-by: Gabriel Ribba Esteva <gabriel.ribbae@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos5410-odroidxu.dts | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -327,6 +327,8 @@
regulator-name = "vddq_lcd";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
+ /* Supplies also GPK and GPJ */
+ regulator-always-on;
};
ldo8_reg: LDO8 {
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 058/242] HID: i2c-hid: add Vero K147 to descriptor override
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 057/242] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 059/242] serial_core: Check for port state when tty is in error state Greg Kroah-Hartman
` (184 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Julian Sax, Hans de Goede, Jiri Kosina
From: Julian Sax <jsbc@gmx.de>
commit c870d50ce387d84b6438211a7044c60afbd5d60a upstream.
This device uses the SIPODEV SP1064 touchpad, which does not
supply descriptors, so it has to be added to the override list.
Cc: stable@vger.kernel.org
Signed-off-by: Julian Sax <jsbc@gmx.de>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
@@ -397,6 +397,14 @@ static const struct dmi_system_id i2c_hi
},
.driver_data = (void *)&sipodev_desc
},
+ {
+ .ident = "Vero K147",
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VERO"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "K147"),
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
{ } /* Terminate list */
};
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 059/242] serial_core: Check for port state when tty is in error state
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 058/242] HID: i2c-hid: add Vero K147 to descriptor override Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 060/242] quota: Sanity-check quota file headers on load Greg Kroah-Hartman
` (183 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy
From: Alexey Kardashevskiy <aik@ozlabs.ru>
commit 2f70e49ed860020f5abae4f7015018ebc10e1f0e upstream.
At the moment opening a serial device node (such as /dev/ttyS3)
succeeds even if there is no actual serial device behind it.
Reading/writing/ioctls fail as expected because the uart port is not
initialized (the type is PORT_UNKNOWN) and the TTY_IO_ERROR error state
bit is set fot the tty.
However setting line discipline does not have these checks
8250_port.c (8250 is the default choice made by univ8250_console_init()).
As the result of PORT_UNKNOWN, uart_port::iobase is NULL which
a platform translates onto some address accessing which produces a crash
like below.
This adds tty_port_initialized() to uart_set_ldisc() to prevent the crash.
Found by syzkaller.
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Link: https://lore.kernel.org/r/20201203055834.45838-1-aik@ozlabs.ru
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/serial_core.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1434,6 +1434,10 @@ static void uart_set_ldisc(struct tty_st
{
struct uart_state *state = tty->driver_data;
struct uart_port *uport;
+ struct tty_port *port = &state->port;
+
+ if (!tty_port_initialized(port))
+ return;
mutex_lock(&state->port.mutex);
uport = uart_port_check(state);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 060/242] quota: Sanity-check quota file headers on load
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 059/242] serial_core: Check for port state when tty is in error state Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 061/242] media: msi2500: assign SPI bus number dynamically Greg Kroah-Hartman
` (182 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+f816042a7ae2225f25ba,
Andreas Dilger, Jan Kara
From: Jan Kara <jack@suse.cz>
commit 11c514a99bb960941535134f0587102855e8ddee upstream.
Perform basic sanity checks of quota headers to avoid kernel crashes on
corrupted quota files.
CC: stable@vger.kernel.org
Reported-by: syzbot+f816042a7ae2225f25ba@syzkaller.appspotmail.com
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/quota/quota_v2.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/fs/quota/quota_v2.c
+++ b/fs/quota/quota_v2.c
@@ -158,6 +158,25 @@ static int v2_read_file_info(struct supe
qinfo->dqi_entry_size = sizeof(struct v2r1_disk_dqblk);
qinfo->dqi_ops = &v2r1_qtree_ops;
}
+ ret = -EUCLEAN;
+ /* Some sanity checks of the read headers... */
+ if ((loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits >
+ i_size_read(sb_dqopt(sb)->files[type])) {
+ quota_error(sb, "Number of blocks too big for quota file size (%llu > %llu).",
+ (loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits,
+ i_size_read(sb_dqopt(sb)->files[type]));
+ goto out;
+ }
+ if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) {
+ quota_error(sb, "Free block number too big (%u >= %u).",
+ qinfo->dqi_free_blk, qinfo->dqi_blocks);
+ goto out;
+ }
+ if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) {
+ quota_error(sb, "Block with free entry too big (%u >= %u).",
+ qinfo->dqi_free_entry, qinfo->dqi_blocks);
+ goto out;
+ }
ret = 0;
out:
up_read(&dqopt->dqio_sem);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 061/242] media: msi2500: assign SPI bus number dynamically
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 060/242] quota: Sanity-check quota file headers on load Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 062/242] crypto: af_alg - avoid undefined behavior accessing salg_name Greg Kroah-Hartman
` (181 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Antti Palosaari,
Mauro Carvalho Chehab, syzbot+c60ddb60b685777d9d59
From: Antti Palosaari <crope@iki.fi>
commit 9c60cc797cf72e95bb39f32316e9f0e5f85435f9 upstream.
SPI bus number must be assigned dynamically for each device, otherwise it
will crash when multiple devices are plugged to system.
Reported-and-tested-by: syzbot+c60ddb60b685777d9d59@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/msi2500/msi2500.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/usb/msi2500/msi2500.c
+++ b/drivers/media/usb/msi2500/msi2500.c
@@ -1250,7 +1250,7 @@ static int msi2500_probe(struct usb_inte
}
dev->master = master;
- master->bus_num = 0;
+ master->bus_num = -1;
master->num_chipselect = 1;
master->transfer_one_message = msi2500_transfer_one_message;
spi_master_set_devdata(master, dev);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 062/242] crypto: af_alg - avoid undefined behavior accessing salg_name
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 061/242] media: msi2500: assign SPI bus number dynamically Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 063/242] md: fix a warning caused by a race between concurrent md_ioctl()s Greg Kroah-Hartman
` (180 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+92ead4eb8e26a26d465e,
Eric Biggers, Herbert Xu
From: Eric Biggers <ebiggers@google.com>
commit 92eb6c3060ebe3adf381fd9899451c5b047bb14d upstream.
Commit 3f69cc60768b ("crypto: af_alg - Allow arbitrarily long algorithm
names") made the kernel start accepting arbitrarily long algorithm names
in sockaddr_alg. However, the actual length of the salg_name field
stayed at the original 64 bytes.
This is broken because the kernel can access indices >= 64 in salg_name,
which is undefined behavior -- even though the memory that is accessed
is still located within the sockaddr structure. It would only be
defined behavior if the array were properly marked as arbitrary-length
(either by making it a flexible array, which is the recommended way
these days, or by making it an array of length 0 or 1).
We can't simply change salg_name into a flexible array, since that would
break source compatibility with userspace programs that embed
sockaddr_alg into another struct, or (more commonly) declare a
sockaddr_alg like 'struct sockaddr_alg sa = { .salg_name = "foo" };'.
One solution would be to change salg_name into a flexible array only
when '#ifdef __KERNEL__'. However, that would keep userspace without an
easy way to actually use the longer algorithm names.
Instead, add a new structure 'sockaddr_alg_new' that has the flexible
array field, and expose it to both userspace and the kernel.
Make the kernel use it correctly in alg_bind().
This addresses the syzbot report
"UBSAN: array-index-out-of-bounds in alg_bind"
(https://syzkaller.appspot.com/bug?extid=92ead4eb8e26a26d465e).
Reported-by: syzbot+92ead4eb8e26a26d465e@syzkaller.appspotmail.com
Fixes: 3f69cc60768b ("crypto: af_alg - Allow arbitrarily long algorithm names")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/af_alg.c | 10 +++++++---
include/uapi/linux/if_alg.h | 16 ++++++++++++++++
2 files changed, 23 insertions(+), 3 deletions(-)
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -151,7 +151,7 @@ static int alg_bind(struct socket *sock,
const u32 allowed = CRYPTO_ALG_KERN_DRIVER_ONLY;
struct sock *sk = sock->sk;
struct alg_sock *ask = alg_sk(sk);
- struct sockaddr_alg *sa = (void *)uaddr;
+ struct sockaddr_alg_new *sa = (void *)uaddr;
const struct af_alg_type *type;
void *private;
int err;
@@ -159,7 +159,11 @@ static int alg_bind(struct socket *sock,
if (sock->state == SS_CONNECTED)
return -EINVAL;
- if (addr_len < sizeof(*sa))
+ BUILD_BUG_ON(offsetof(struct sockaddr_alg_new, salg_name) !=
+ offsetof(struct sockaddr_alg, salg_name));
+ BUILD_BUG_ON(offsetof(struct sockaddr_alg, salg_name) != sizeof(*sa));
+
+ if (addr_len < sizeof(*sa) + 1)
return -EINVAL;
/* If caller uses non-allowed flag, return error. */
@@ -167,7 +171,7 @@ static int alg_bind(struct socket *sock,
return -EINVAL;
sa->salg_type[sizeof(sa->salg_type) - 1] = 0;
- sa->salg_name[sizeof(sa->salg_name) + addr_len - sizeof(*sa) - 1] = 0;
+ sa->salg_name[addr_len - sizeof(*sa) - 1] = 0;
type = alg_get_type(sa->salg_type);
if (IS_ERR(type) && PTR_ERR(type) == -ENOENT) {
--- a/include/uapi/linux/if_alg.h
+++ b/include/uapi/linux/if_alg.h
@@ -24,6 +24,22 @@ struct sockaddr_alg {
__u8 salg_name[64];
};
+/*
+ * Linux v4.12 and later removed the 64-byte limit on salg_name[]; it's now an
+ * arbitrary-length field. We had to keep the original struct above for source
+ * compatibility with existing userspace programs, though. Use the new struct
+ * below if support for very long algorithm names is needed. To do this,
+ * allocate 'sizeof(struct sockaddr_alg_new) + strlen(algname) + 1' bytes, and
+ * copy algname (including the null terminator) into salg_name.
+ */
+struct sockaddr_alg_new {
+ __u16 salg_family;
+ __u8 salg_type[14];
+ __u32 salg_feat;
+ __u32 salg_mask;
+ __u8 salg_name[];
+};
+
struct af_alg_iv {
__u32 ivlen;
__u8 iv[0];
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 063/242] md: fix a warning caused by a race between concurrent md_ioctl()s
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 062/242] crypto: af_alg - avoid undefined behavior accessing salg_name Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 064/242] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Greg Kroah-Hartman
` (179 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+1e46a0864c1a6e9bd3d8,
Dae R. Jeong, Song Liu
From: Dae R. Jeong <dae.r.jeong@kaist.ac.kr>
commit c731b84b51bf7fe83448bea8f56a6d55006b0615 upstream.
Syzkaller reports a warning as belows.
WARNING: CPU: 0 PID: 9647 at drivers/md/md.c:7169
...
Call Trace:
...
RIP: 0010:md_ioctl+0x4017/0x5980 drivers/md/md.c:7169
RSP: 0018:ffff888096027950 EFLAGS: 00010293
RAX: ffff88809322c380 RBX: 0000000000000932 RCX: ffffffff84e266f2
RDX: 0000000000000000 RSI: ffffffff84e299f7 RDI: 0000000000000007
RBP: ffff888096027bc0 R08: ffff88809322c380 R09: ffffed101341a482
R10: ffff888096027940 R11: ffff88809a0d240f R12: 0000000000000932
R13: ffff8880a2c14100 R14: ffff88809a0d2268 R15: ffff88809a0d2408
__blkdev_driver_ioctl block/ioctl.c:304 [inline]
blkdev_ioctl+0xece/0x1c10 block/ioctl.c:606
block_ioctl+0xee/0x130 fs/block_dev.c:1930
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:696
ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301
entry_SYSCALL_64_after_hwframe+0x49/0xbe
This is caused by a race between two concurrenct md_ioctl()s closing
the array.
CPU1 (md_ioctl()) CPU2 (md_ioctl())
------ ------
set_bit(MD_CLOSING, &mddev->flags);
did_set_md_closing = true;
WARN_ON_ONCE(test_bit(MD_CLOSING,
&mddev->flags));
if(did_set_md_closing)
clear_bit(MD_CLOSING, &mddev->flags);
Fix the warning by returning immediately if the MD_CLOSING bit is set
in &mddev->flags which indicates that the array is being closed.
Fixes: 065e519e71b2 ("md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop")
Reported-by: syzbot+1e46a0864c1a6e9bd3d8@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dae R. Jeong <dae.r.jeong@kaist.ac.kr>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7187,8 +7187,11 @@ static int md_ioctl(struct block_device
err = -EBUSY;
goto out;
}
- WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags));
- set_bit(MD_CLOSING, &mddev->flags);
+ if (test_and_set_bit(MD_CLOSING, &mddev->flags)) {
+ mutex_unlock(&mddev->open_mutex);
+ err = -EBUSY;
+ goto out;
+ }
did_set_md_closing = true;
mutex_unlock(&mddev->open_mutex);
sync_blockdev(bdev);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 064/242] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 063/242] md: fix a warning caused by a race between concurrent md_ioctl()s Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 065/242] drm/gma500: fix double free of gma_connector Greg Kroah-Hartman
` (178 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peilin Ye, Marcel Holtmann,
syzbot+24ebd650e20bd263ca01
From: Peilin Ye <yepeilin.cs@gmail.com>
commit f7e0e8b2f1b0a09b527885babda3e912ba820798 upstream.
`num_reports` is not being properly checked. A malformed event packet with
a large `num_reports` number makes hci_le_direct_adv_report_evt() read out
of bounds. Fix it.
Cc: stable@vger.kernel.org
Fixes: 2f010b55884e ("Bluetooth: Add support for handling LE Direct Advertising Report events")
Reported-and-tested-by: syzbot+24ebd650e20bd263ca01@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=24ebd650e20bd263ca01
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5141,20 +5141,18 @@ static void hci_le_direct_adv_report_evt
struct sk_buff *skb)
{
u8 num_reports = skb->data[0];
- void *ptr = &skb->data[1];
+ struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
- hci_dev_lock(hdev);
+ if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
+ return;
- while (num_reports--) {
- struct hci_ev_le_direct_adv_info *ev = ptr;
+ hci_dev_lock(hdev);
+ for (; num_reports; num_reports--, ev++)
process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
ev->bdaddr_type, &ev->direct_addr,
ev->direct_addr_type, ev->rssi, NULL, 0);
- ptr += sizeof(*ev);
- }
-
hci_dev_unlock(hdev);
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 065/242] drm/gma500: fix double free of gma_connector
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 064/242] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 066/242] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Greg Kroah-Hartman
` (177 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tom Rix, Daniel Vetter, Sasha Levin
From: Tom Rix <trix@redhat.com>
[ Upstream commit 4e19d51ca5b28a1d435a844c7b2a8e1b1b6fa237 ]
clang static analysis reports this problem:
cdv_intel_dp.c:2101:2: warning: Attempt to free released memory
kfree(gma_connector);
^~~~~~~~~~~~~~~~~~~~
In cdv_intel_dp_init() when the call to cdv_intel_edp_panel_vdd_off()
fails, the handler calls cdv_intel_dp_destroy(connector) which does
the first free of gma_connector. So adjust the goto label and skip
the second free.
Fixes: d112a8163f83 ("gma500/cdv: Add eDP support")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201003193928.18869-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
index 7ec4e3fbafd8c..ec6ea202cf5de 100644
--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
@@ -2126,7 +2126,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
DRM_INFO("failed to retrieve link info, disabling eDP\n");
cdv_intel_dp_encoder_destroy(encoder);
cdv_intel_dp_destroy(connector);
- goto err_priv;
+ goto err_connector;
} else {
DRM_DEBUG_KMS("DPCD: Rev=%x LN_Rate=%x LN_CNT=%x LN_DOWNSP=%x\n",
intel_dp->dpcd[0], intel_dp->dpcd[1],
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 066/242] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 065/242] drm/gma500: fix double free of gma_connector Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 067/242] soc: mediatek: Check if power domains can be powered on at boot time Greg Kroah-Hartman
` (176 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Geert Uytterhoeven,
Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit cf25d802e029c31efac8bdc979236927f37183bd ]
This code needs to call iounmap() on one error path.
Fixes: 2173fc7cb681 ("ARM: shmobile: R-Mobile: Add DT support for PM domains")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200923113142.GC1473821@mwanda
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-shmobile/pm-rmobile.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-shmobile/pm-rmobile.c b/arch/arm/mach-shmobile/pm-rmobile.c
index 3a4ed4c33a68e..e312f676a0fdf 100644
--- a/arch/arm/mach-shmobile/pm-rmobile.c
+++ b/arch/arm/mach-shmobile/pm-rmobile.c
@@ -336,6 +336,7 @@ static int __init rmobile_init_pm_domains(void)
pmd = of_get_child_by_name(np, "pm-domains");
if (!pmd) {
+ iounmap(base);
pr_warn("%pOF lacks pm-domains node\n", np);
continue;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 067/242] soc: mediatek: Check if power domains can be powered on at boot time
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 066/242] soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 068/242] RDMA/bnxt_re: Set queue pair state when being queried Greg Kroah-Hartman
` (175 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolas Boichat, Matthias Brugger,
Sasha Levin
From: Nicolas Boichat <drinkcat@chromium.org>
[ Upstream commit 4007844b05815717f522c7ea9914e24ad0ff6c79 ]
In the error case, where a power domain cannot be powered on
successfully at boot time (in mtk_register_power_domains),
pm_genpd_init would still be called with is_off=false, and the
system would later try to disable the power domain again, triggering
warnings as disabled clocks are disabled again (and other potential
issues).
Also print a warning splat in that case, as this should never
happen.
Fixes: c84e358718a66f7 ("soc: Mediatek: Add SCPSYS power domain driver")
Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
Link: https://lore.kernel.org/r/20200928113107.v2.1.I5e6f8c262031d0451fe7241b744f4f3111c1ce71@changeid
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/mediatek/mtk-scpsys.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c
index fb2a8b1e79791..d0b18cc7e61b5 100644
--- a/drivers/soc/mediatek/mtk-scpsys.c
+++ b/drivers/soc/mediatek/mtk-scpsys.c
@@ -481,6 +481,7 @@ static void mtk_register_power_domains(struct platform_device *pdev,
for (i = 0; i < num; i++) {
struct scp_domain *scpd = &scp->domains[i];
struct generic_pm_domain *genpd = &scpd->genpd;
+ bool on;
/*
* Initially turn on all domains to make the domains usable
@@ -488,9 +489,9 @@ static void mtk_register_power_domains(struct platform_device *pdev,
* software. The unused domains will be switched off during
* late_init time.
*/
- genpd->power_on(genpd);
+ on = !WARN_ON(genpd->power_on(genpd) < 0);
- pm_genpd_init(genpd, NULL, false);
+ pm_genpd_init(genpd, NULL, !on);
}
/*
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 068/242] RDMA/bnxt_re: Set queue pair state when being queried
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 067/242] soc: mediatek: Check if power domains can be powered on at boot time Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 069/242] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
` (174 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kamal Heib, Selvin Xavier,
Jason Gunthorpe, Sasha Levin
From: Kamal Heib <kamalheib1@gmail.com>
[ Upstream commit 53839b51a7671eeb3fb44d479d541cf3a0f2dd45 ]
The API for ib_query_qp requires the driver to set cur_qp_state on return,
add the missing set.
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Link: https://lore.kernel.org/r/20201021114952.38876-1-kamalheib1@gmail.com
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index ef9135aa392c1..ab218767bf05f 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -1590,6 +1590,7 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
goto out;
}
qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state);
+ qp_attr->cur_qp_state = __to_ib_qp_state(qplib_qp->cur_qp_state);
qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0;
qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access);
qp_attr->pkey_index = qplib_qp->pkey_index;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 069/242] selinux: fix error initialization in inode_doinit_with_dentry()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 068/242] RDMA/bnxt_re: Set queue pair state when being queried Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 070/242] RDMA/rxe: Compute PSN windows correctly Greg Kroah-Hartman
` (173 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tianyue Ren, Paul Moore, Sasha Levin
From: Tianyue Ren <rentianyue@kylinos.cn>
[ Upstream commit 83370b31a915493231e5b9addc72e4bef69f8d31 ]
Mark the inode security label as invalid if we cannot find
a dentry so that we will retry later rather than marking it
initialized with the unlabeled SID.
Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock")
Signed-off-by: Tianyue Ren <rentianyue@kylinos.cn>
[PM: minor comment tweaks]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/selinux/hooks.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 5def19ec11797..af8ddae0ddedb 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1569,7 +1569,13 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
* inode_doinit with a dentry, before these inodes could
* be used again by userspace.
*/
- goto out;
+ isec->initialized = LABEL_INVALID;
+ /*
+ * There is nothing useful to jump to the "out"
+ * label, except a needless spin lock/unlock
+ * cycle.
+ */
+ return 0;
}
len = INITCONTEXTLEN;
@@ -1677,8 +1683,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
* inode_doinit() with a dentry, before these inodes
* could be used again by userspace.
*/
- if (!dentry)
- goto out;
+ if (!dentry) {
+ isec->initialized = LABEL_INVALID;
+ /*
+ * There is nothing useful to jump to the "out"
+ * label, except a needless spin lock/unlock
+ * cycle.
+ */
+ return 0;
+ }
rc = selinux_genfs_get_sid(dentry, sclass,
sbsec->flags, &sid);
dput(dentry);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 070/242] RDMA/rxe: Compute PSN windows correctly
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 069/242] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 071/242] x86/mm/ident_map: Check for errors from ident_pud_init() Greg Kroah-Hartman
` (172 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bob Pearson, Jason Gunthorpe, Sasha Levin
From: Bob Pearson <rpearsonhpe@gmail.com>
[ Upstream commit bb3ab2979fd69db23328691cb10067861df89037 ]
The code which limited the number of unacknowledged PSNs was incorrect.
The PSNs are limited to 24 bits and wrap back to zero from 0x00ffffff.
The test was computing a 32 bit value which wraps at 32 bits so that
qp->req.psn can appear smaller than the limit when it is actually larger.
Replace '>' test with psn_compare which is used for other PSN comparisons
and correctly handles the 24 bit size.
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20201013170741.3590-1-rpearson@hpe.com
Signed-off-by: Bob Pearson <rpearson@hpe.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_req.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index e6785b1ea85fc..693884160f001 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -664,7 +664,8 @@ next_wqe:
}
if (unlikely(qp_type(qp) == IB_QPT_RC &&
- qp->req.psn > (qp->comp.psn + RXE_MAX_UNACKED_PSNS))) {
+ psn_compare(qp->req.psn, (qp->comp.psn +
+ RXE_MAX_UNACKED_PSNS)) > 0)) {
qp->req.wait_psn = 1;
goto exit;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 071/242] x86/mm/ident_map: Check for errors from ident_pud_init()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 070/242] RDMA/rxe: Compute PSN windows correctly Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 072/242] ARM: p2v: fix handling of LPAE translation in BE mode Greg Kroah-Hartman
` (171 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arvind Sankar, Borislav Petkov,
Joerg Roedel, Kirill A. Shutemov, Sasha Levin
From: Arvind Sankar <nivedita@alum.mit.edu>
[ Upstream commit 1fcd009102ee02e217f2e7635ab65517d785da8e ]
Commit
ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
added ident_p4d_init() to support 5-level paging, but this function
doesn't check and return errors from ident_pud_init().
For example, the decompressor stub uses this code to create an identity
mapping. If it runs out of pages while trying to allocate a PMD
pagetable, the error will be currently ignored.
Fix this to propagate errors.
[ bp: Space out statements for better readability. ]
Fixes: ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Joerg Roedel <jroedel@suse.de>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Link: https://lkml.kernel.org/r/20201027230648.1885111-1-nivedita@alum.mit.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/mm/ident_map.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
index ab33a32df2a8e..407fa1df470e0 100644
--- a/arch/x86/mm/ident_map.c
+++ b/arch/x86/mm/ident_map.c
@@ -62,6 +62,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
unsigned long addr, unsigned long end)
{
unsigned long next;
+ int result;
for (; addr < end; addr = next) {
p4d_t *p4d = p4d_page + p4d_index(addr);
@@ -73,13 +74,20 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
if (p4d_present(*p4d)) {
pud = pud_offset(p4d, 0);
- ident_pud_init(info, pud, addr, next);
+ result = ident_pud_init(info, pud, addr, next);
+ if (result)
+ return result;
+
continue;
}
pud = (pud_t *)info->alloc_pgt_page(info->context);
if (!pud)
return -ENOMEM;
- ident_pud_init(info, pud, addr, next);
+
+ result = ident_pud_init(info, pud, addr, next);
+ if (result)
+ return result;
+
set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag));
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 072/242] ARM: p2v: fix handling of LPAE translation in BE mode
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 071/242] x86/mm/ident_map: Check for errors from ident_pud_init() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 073/242] sched/deadline: Fix sched_dl_global_validate() Greg Kroah-Hartman
` (170 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolas Pitre, Linus Walleij,
Ard Biesheuvel, Sasha Levin
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ]
When running in BE mode on LPAE hardware with a PA-to-VA translation
that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong
byte of the opcode. So fix that, by rotating the offset in r0 to the
right by 8 bits, which will put the 8-bit immediate in bits 31:24.
Note that this will also move bit #22 in its correct place when
applying the rotation to the constant #0x400000.
Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE")
Acked-by: Nicolas Pitre <nico@fluxnic.net>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/head.S | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 6b1148cafffdb..90add5ded3f1f 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -674,12 +674,8 @@ ARM_BE8(rev16 ip, ip)
ldrcc r7, [r4], #4 @ use branch for delay slot
bcc 1b
bx lr
-#else
-#ifdef CONFIG_CPU_ENDIAN_BE8
- moveq r0, #0x00004000 @ set bit 22, mov to mvn instruction
#else
moveq r0, #0x400000 @ set bit 22, mov to mvn instruction
-#endif
b 2f
1: ldr ip, [r7, r3]
#ifdef CONFIG_CPU_ENDIAN_BE8
@@ -688,7 +684,7 @@ ARM_BE8(rev16 ip, ip)
tst ip, #0x000f0000 @ check the rotation field
orrne ip, ip, r6, lsl #24 @ mask in offset bits 31-24
biceq ip, ip, #0x00004000 @ clear bit 22
- orreq ip, ip, r0 @ mask in offset bits 7-0
+ orreq ip, ip, r0, ror #8 @ mask in offset bits 7-0
#else
bic ip, ip, #0x000000ff
tst ip, #0xf00 @ check the rotation field
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 073/242] sched/deadline: Fix sched_dl_global_validate()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 072/242] ARM: p2v: fix handling of LPAE translation in BE mode Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:47 ` [PATCH 4.14 074/242] sched: Reenable interrupts in do_sched_yield() Greg Kroah-Hartman
` (169 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peng Liu, Peter Zijlstra (Intel),
Daniel Bristot de Oliveira, Juri Lelli, Sasha Levin
From: Peng Liu <iwtbavbm@gmail.com>
[ Upstream commit a57415f5d1e43c3a5c5d412cd85e2792d7ed9b11 ]
When change sched_rt_{runtime, period}_us, we validate that the new
settings should at least accommodate the currently allocated -dl
bandwidth:
sched_rt_handler()
--> sched_dl_bandwidth_validate()
{
new_bw = global_rt_runtime()/global_rt_period();
for_each_possible_cpu(cpu) {
dl_b = dl_bw_of(cpu);
if (new_bw < dl_b->total_bw) <-------
ret = -EBUSY;
}
}
But under CONFIG_SMP, dl_bw is per root domain , but not per CPU,
dl_b->total_bw is the allocated bandwidth of the whole root domain.
Instead, we should compare dl_b->total_bw against "cpus*new_bw",
where 'cpus' is the number of CPUs of the root domain.
Also, below annotation(in kernel/sched/sched.h) implied implementation
only appeared in SCHED_DEADLINE v2[1], then deadline scheduler kept
evolving till got merged(v9), but the annotation remains unchanged,
meaningless and misleading, update it.
* With respect to SMP, the bandwidth is given on a per-CPU basis,
* meaning that:
* - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
* - dl_total_bw array contains, in the i-eth element, the currently
* allocated bandwidth on the i-eth CPU.
[1]: https://lore.kernel.org/lkml/1267385230.13676.101.camel@Palantir/
Fixes: 332ac17ef5bf ("sched/deadline: Add bandwidth management for SCHED_DEADLINE tasks")
Signed-off-by: Peng Liu <iwtbavbm@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Acked-by: Juri Lelli <juri.lelli@redhat.com>
Link: https://lkml.kernel.org/r/db6bbda316048cda7a1bbc9571defde193a8d67e.1602171061.git.iwtbavbm@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/deadline.c | 5 +++--
kernel/sched/sched.h | 42 ++++++++++++++++++-----------------------
2 files changed, 21 insertions(+), 26 deletions(-)
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 22770168bff84..06a6bcd6cfa66 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2345,7 +2345,7 @@ int sched_dl_global_validate(void)
u64 period = global_rt_period();
u64 new_bw = to_ratio(period, runtime);
struct dl_bw *dl_b;
- int cpu, ret = 0;
+ int cpu, cpus, ret = 0;
unsigned long flags;
/*
@@ -2360,9 +2360,10 @@ int sched_dl_global_validate(void)
for_each_possible_cpu(cpu) {
rcu_read_lock_sched();
dl_b = dl_bw_of(cpu);
+ cpus = dl_bw_cpus(cpu);
raw_spin_lock_irqsave(&dl_b->lock, flags);
- if (new_bw < dl_b->total_bw)
+ if (new_bw * cpus < dl_b->total_bw)
ret = -EBUSY;
raw_spin_unlock_irqrestore(&dl_b->lock, flags);
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 391d73a12ad72..e5cfec6bc8913 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -191,30 +191,6 @@ struct rt_bandwidth {
void __dl_clear_params(struct task_struct *p);
-/*
- * To keep the bandwidth of -deadline tasks and groups under control
- * we need some place where:
- * - store the maximum -deadline bandwidth of the system (the group);
- * - cache the fraction of that bandwidth that is currently allocated.
- *
- * This is all done in the data structure below. It is similar to the
- * one used for RT-throttling (rt_bandwidth), with the main difference
- * that, since here we are only interested in admission control, we
- * do not decrease any runtime while the group "executes", neither we
- * need a timer to replenish it.
- *
- * With respect to SMP, the bandwidth is given on a per-CPU basis,
- * meaning that:
- * - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
- * - dl_total_bw array contains, in the i-eth element, the currently
- * allocated bandwidth on the i-eth CPU.
- * Moreover, groups consume bandwidth on each CPU, while tasks only
- * consume bandwidth on the CPU they're running on.
- * Finally, dl_total_bw_cpu is used to cache the index of dl_total_bw
- * that will be shown the next time the proc or cgroup controls will
- * be red. It on its turn can be changed by writing on its own
- * control.
- */
struct dl_bandwidth {
raw_spinlock_t dl_runtime_lock;
u64 dl_runtime;
@@ -226,6 +202,24 @@ static inline int dl_bandwidth_enabled(void)
return sysctl_sched_rt_runtime >= 0;
}
+/*
+ * To keep the bandwidth of -deadline tasks under control
+ * we need some place where:
+ * - store the maximum -deadline bandwidth of each cpu;
+ * - cache the fraction of bandwidth that is currently allocated in
+ * each root domain;
+ *
+ * This is all done in the data structure below. It is similar to the
+ * one used for RT-throttling (rt_bandwidth), with the main difference
+ * that, since here we are only interested in admission control, we
+ * do not decrease any runtime while the group "executes", neither we
+ * need a timer to replenish it.
+ *
+ * With respect to SMP, bandwidth is given on a per root domain basis,
+ * meaning that:
+ * - bw (< 100%) is the deadline bandwidth of each CPU;
+ * - total_bw is the currently allocated bandwidth in each root domain;
+ */
struct dl_bw {
raw_spinlock_t lock;
u64 bw, total_bw;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 074/242] sched: Reenable interrupts in do_sched_yield()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 073/242] sched/deadline: Fix sched_dl_global_validate() Greg Kroah-Hartman
@ 2020-12-28 12:47 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 075/242] crypto: talitos - Fix return type of current_desc_hdr() Greg Kroah-Hartman
` (168 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:47 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
Peter Zijlstra (Intel),
Sasha Levin
From: Thomas Gleixner <tglx@linutronix.de>
[ Upstream commit 345a957fcc95630bf5535d7668a59ed983eb49a7 ]
do_sched_yield() invokes schedule() with interrupts disabled which is
not allowed. This goes back to the pre git era to commit a6efb709806c
("[PATCH] irqlock patch 2.5.27-H6") in the history tree.
Reenable interrupts and remove the misleading comment which "explains" it.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/87r1pt7y5c.fsf@nanos.tec.linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/core.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index c5599174e7450..7cedada731c1b 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4826,12 +4826,8 @@ SYSCALL_DEFINE0(sched_yield)
schedstat_inc(rq->yld_count);
current->sched_class->yield_task(rq);
- /*
- * Since we are going to call schedule() anyway, there's
- * no need to preempt or enable interrupts:
- */
preempt_disable();
- rq_unlock(rq, &rf);
+ rq_unlock_irq(rq, &rf);
sched_preempt_enable_no_resched();
schedule();
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 075/242] crypto: talitos - Fix return type of current_desc_hdr()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2020-12-28 12:47 ` [PATCH 4.14 074/242] sched: Reenable interrupts in do_sched_yield() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 076/242] spi: img-spfi: fix reference leak in img_spfi_resume Greg Kroah-Hartman
` (167 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Herbert Xu, Sasha Levin
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 0237616173fd363a54bd272aa3bd376faa1d7caa ]
current_desc_hdr() returns a u32 but in fact this is a __be32,
leading to a lot of sparse warnings.
Change the return type to __be32 and ensure it is handled as
sure by the caller.
Fixes: 3e721aeb3df3 ("crypto: talitos - handle descriptor not found in error path")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/talitos.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 6c8a03a1132f6..8028fbd5cda47 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -447,7 +447,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE)
/*
* locate current (offending) descriptor
*/
-static u32 current_desc_hdr(struct device *dev, int ch)
+static __be32 current_desc_hdr(struct device *dev, int ch)
{
struct talitos_private *priv = dev_get_drvdata(dev);
int tail, iter;
@@ -478,13 +478,13 @@ static u32 current_desc_hdr(struct device *dev, int ch)
/*
* user diagnostics; report root cause of error based on execution unit status
*/
-static void report_eu_error(struct device *dev, int ch, u32 desc_hdr)
+static void report_eu_error(struct device *dev, int ch, __be32 desc_hdr)
{
struct talitos_private *priv = dev_get_drvdata(dev);
int i;
if (!desc_hdr)
- desc_hdr = in_be32(priv->chan[ch].reg + TALITOS_DESCBUF);
+ desc_hdr = cpu_to_be32(in_be32(priv->chan[ch].reg + TALITOS_DESCBUF));
switch (desc_hdr & DESC_HDR_SEL0_MASK) {
case DESC_HDR_SEL0_AFEU:
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 076/242] spi: img-spfi: fix reference leak in img_spfi_resume
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 075/242] crypto: talitos - Fix return type of current_desc_hdr() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 077/242] ASoC: pcm: DRAIN support reactivation Greg Kroah-Hartman
` (166 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit ee5558a9084584015c8754ffd029ce14a5827fa8 ]
pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in img_spfi_resume, so we should fix it.
Fixes: deba25800a12b ("spi: Add driver for IMG SPFI controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201102145651.3875-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-img-spfi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index 2e65b70c78792..2a340234c85c1 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -771,8 +771,10 @@ static int img_spfi_resume(struct device *dev)
int ret;
ret = pm_runtime_get_sync(dev);
- if (ret)
+ if (ret) {
+ pm_runtime_put_noidle(dev);
return ret;
+ }
spfi_reset(spfi);
pm_runtime_put(dev);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 077/242] ASoC: pcm: DRAIN support reactivation
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 076/242] spi: img-spfi: fix reference leak in img_spfi_resume Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 078/242] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
` (165 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cezary Rojewski, Ranjani Sridharan,
Mark Brown, Sasha Levin
From: Cezary Rojewski <cezary.rojewski@intel.com>
[ Upstream commit 4c22b80f61540ea99d9b4af0127315338755f05b ]
soc-pcm's dpcm_fe_dai_do_trigger() supported DRAIN commnad up to kernel
v5.4 where explicit switch(cmd) has been introduced which takes into
account all SNDRV_PCM_TRIGGER_xxx but SNDRV_PCM_TRIGGER_DRAIN. Update
switch statement to reactive support for it.
As DRAIN is somewhat unique by lacking negative/stop counterpart, bring
behaviour of dpcm_fe_dai_do_trigger() for said command back to its
pre-v5.4 state by adding it to START/RESUME/PAUSE_RELEASE group.
Fixes: acbf27746ecf ("ASoC: pcm: update FE/BE trigger order based on the command")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20201026100129.8216-1-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-pcm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index fd4b71729eedd..e995e96ab9030 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -2172,6 +2172,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
case SNDRV_PCM_TRIGGER_START:
case SNDRV_PCM_TRIGGER_RESUME:
case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+ case SNDRV_PCM_TRIGGER_DRAIN:
ret = dpcm_dai_trigger_fe_be(substream, cmd, true);
break;
case SNDRV_PCM_TRIGGER_STOP:
@@ -2189,6 +2190,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
case SNDRV_PCM_TRIGGER_START:
case SNDRV_PCM_TRIGGER_RESUME:
case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+ case SNDRV_PCM_TRIGGER_DRAIN:
ret = dpcm_dai_trigger_fe_be(substream, cmd, false);
break;
case SNDRV_PCM_TRIGGER_STOP:
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 078/242] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 077/242] ASoC: pcm: DRAIN support reactivation Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 079/242] arm64: dts: exynos: Correct psci compatible used on Exynos7 Greg Kroah-Hartman
` (164 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Ondrej Mosnacek,
Paul Moore, Sasha Levin
From: Paul Moore <paul@paul-moore.com>
[ Upstream commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 ]
A previous fix, commit 83370b31a915 ("selinux: fix error initialization
in inode_doinit_with_dentry()"), changed how failures were handled
before a SELinux policy was loaded. Unfortunately that patch was
potentially problematic for two reasons: it set the isec->initialized
state without holding a lock, and it didn't set the inode's SELinux
label to the "default" for the particular filesystem. The later can
be a problem if/when a later attempt to revalidate the inode fails
and SELinux reverts to the existing inode label.
This patch should restore the default inode labeling that existed
before the original fix, without affecting the LABEL_INVALID marking
such that revalidation will still be attempted in the future.
Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
Reported-by: Sven Schnelle <svens@linux.ibm.com>
Tested-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/selinux/hooks.c | 31 +++++++++++++------------------
1 file changed, 13 insertions(+), 18 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index af8ddae0ddedb..895d369bc4103 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1569,13 +1569,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
* inode_doinit with a dentry, before these inodes could
* be used again by userspace.
*/
- isec->initialized = LABEL_INVALID;
- /*
- * There is nothing useful to jump to the "out"
- * label, except a needless spin lock/unlock
- * cycle.
- */
- return 0;
+ goto out_invalid;
}
len = INITCONTEXTLEN;
@@ -1683,15 +1677,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
* inode_doinit() with a dentry, before these inodes
* could be used again by userspace.
*/
- if (!dentry) {
- isec->initialized = LABEL_INVALID;
- /*
- * There is nothing useful to jump to the "out"
- * label, except a needless spin lock/unlock
- * cycle.
- */
- return 0;
- }
+ if (!dentry)
+ goto out_invalid;
rc = selinux_genfs_get_sid(dentry, sclass,
sbsec->flags, &sid);
dput(dentry);
@@ -1704,11 +1691,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
out:
spin_lock(&isec->lock);
if (isec->initialized == LABEL_PENDING) {
- if (!sid || rc) {
+ if (rc) {
isec->initialized = LABEL_INVALID;
goto out_unlock;
}
-
isec->initialized = LABEL_INITIALIZED;
isec->sid = sid;
}
@@ -1716,6 +1702,15 @@ out:
out_unlock:
spin_unlock(&isec->lock);
return rc;
+
+out_invalid:
+ spin_lock(&isec->lock);
+ if (isec->initialized == LABEL_PENDING) {
+ isec->initialized = LABEL_INVALID;
+ isec->sid = sid;
+ }
+ spin_unlock(&isec->lock);
+ return 0;
}
/* Convert a Linux signal to an access vector. */
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 079/242] arm64: dts: exynos: Correct psci compatible used on Exynos7
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 078/242] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 080/242] Bluetooth: Fix null pointer dereference in hci_event_packet() Greg Kroah-Hartman
` (163 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paweł Chmiel,
Krzysztof Kozlowski, Sasha Levin
From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
[ Upstream commit e1e47fbca668507a81bb388fcae044b89d112ecc ]
It's not possible to reboot or poweroff Exynos7420 using PSCI. Instead
we need to use syscon reboot/poweroff drivers, like it's done for other
Exynos SoCs. This was confirmed by checking vendor source and testing it
on Samsung Galaxy S6 device based on this SoC.
To be able to use custom restart/poweroff handlers instead of PSCI
functions, we need to correct psci compatible. This also requires us to
provide function ids for CPU_ON and CPU_OFF.
Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
Link: https://lore.kernel.org/r/20201107133926.37187-2-pawel.mikolaj.chmiel@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/exynos/exynos7.dtsi | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index 9a3fbed1765af..875297a470dab 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -65,8 +65,10 @@
};
psci {
- compatible = "arm,psci-0.2";
+ compatible = "arm,psci";
method = "smc";
+ cpu_off = <0x84000002>;
+ cpu_on = <0xC4000003>;
};
soc: soc {
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 080/242] Bluetooth: Fix null pointer dereference in hci_event_packet()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 079/242] arm64: dts: exynos: Correct psci compatible used on Exynos7 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 081/242] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Greg Kroah-Hartman
` (162 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anmol Karn, Marcel Holtmann,
Sasha Levin, syzbot+0bef568258653cff272f
From: Anmol Karn <anmol.karan123@gmail.com>
[ Upstream commit 6dfccd13db2ff2b709ef60a50163925d477549aa ]
AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
not be found when accessing after initialization of hcon.
- net/bluetooth/hci_event.c:4945
The bug seems to get triggered in this line:
bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.
Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_event.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 0db218b14bf3c..5e05a96e0646a 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4350,6 +4350,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
return;
}
+ if (!hcon->amp_mgr) {
+ hci_dev_unlock(hdev);
+ return;
+ }
+
if (ev->status) {
hci_conn_del(hcon);
hci_dev_unlock(hdev);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 081/242] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 080/242] Bluetooth: Fix null pointer dereference in hci_event_packet() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 082/242] spi: tegra20-slink: fix reference leak in slink ops of tegra20 Greg Kroah-Hartman
` (161 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 45c0cba753641e5d7c3207f04241bd0e7a021698 ]
pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in ti_qspi_setup, so we should fix it.
Fixes: 505a14954e2d7 ("spi/qspi: Add qspi flash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103140947.3815-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-ti-qspi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index d0ea62d151c0f..29c1b5d3ae7ad 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -180,6 +180,7 @@ static int ti_qspi_setup(struct spi_device *spi)
ret = pm_runtime_get_sync(qspi->dev);
if (ret < 0) {
+ pm_runtime_put_noidle(qspi->dev);
dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 082/242] spi: tegra20-slink: fix reference leak in slink ops of tegra20
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 081/242] spi: spi-ti-qspi: fix reference leak in ti_qspi_setup Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 083/242] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Greg Kroah-Hartman
` (160 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 763eab7074f6e71babd85d796156f05a675f9510 ]
pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_slink_setup and
tegra_slink_resume), so we should fix it.
Fixes: dc4dc36056392 ("spi: tegra: add spi driver for SLINK controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141345.6188-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-tegra20-slink.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
index 62b074b167a9a..c39bfcbda5f2c 100644
--- a/drivers/spi/spi-tegra20-slink.c
+++ b/drivers/spi/spi-tegra20-slink.c
@@ -761,6 +761,7 @@ static int tegra_slink_setup(struct spi_device *spi)
ret = pm_runtime_get_sync(tspi->dev);
if (ret < 0) {
+ pm_runtime_put_noidle(tspi->dev);
dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
return ret;
}
@@ -1197,6 +1198,7 @@ static int tegra_slink_resume(struct device *dev)
ret = pm_runtime_get_sync(dev);
if (ret < 0) {
+ pm_runtime_put_noidle(dev);
dev_err(dev, "pm runtime failed, e = %d\n", ret);
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 083/242] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 082/242] spi: tegra20-slink: fix reference leak in slink ops of tegra20 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 084/242] spi: tegra114: fix reference leak in tegra spi ops Greg Kroah-Hartman
` (159 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 3482e797ab688da6703fe18d8bad52f94199f4f2 ]
pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in tegra_sflash_resume, so we should fix it.
Fixes: 8528547bcc336 ("spi: tegra: add spi driver for sflash controller")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141323.5841-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-tegra20-sflash.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
index 22893a7e0aa0e..749288310c36c 100644
--- a/drivers/spi/spi-tegra20-sflash.c
+++ b/drivers/spi/spi-tegra20-sflash.c
@@ -564,6 +564,7 @@ static int tegra_sflash_resume(struct device *dev)
ret = pm_runtime_get_sync(dev);
if (ret < 0) {
+ pm_runtime_put_noidle(dev);
dev_err(dev, "pm runtime failed, e = %d\n", ret);
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 084/242] spi: tegra114: fix reference leak in tegra spi ops
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 083/242] spi: tegra20-sflash: fix reference leak in tegra_sflash_resume Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 085/242] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Greg Kroah-Hartman
` (158 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit a042184c7fb99961ea083d4ec192614bec671969 ]
pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in two callers(tegra_spi_setup and
tegra_spi_resume), so we should fix it.
Fixes: f333a331adfac ("spi/tegra114: add spi driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201103141306.5607-1-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-tegra114.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
index 84ff0c507f0b6..0e1a8d7aa3224 100644
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -827,6 +827,7 @@ static int tegra_spi_setup(struct spi_device *spi)
ret = pm_runtime_get_sync(tspi->dev);
if (ret < 0) {
+ pm_runtime_put_noidle(tspi->dev);
dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
return ret;
}
@@ -1252,6 +1253,7 @@ static int tegra_spi_resume(struct device *dev)
ret = pm_runtime_get_sync(dev);
if (ret < 0) {
+ pm_runtime_put_noidle(dev);
dev_err(dev, "pm runtime failed, e = %d\n", ret);
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 085/242] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 084/242] spi: tegra114: fix reference leak in tegra spi ops Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 086/242] ASoC: wm8998: Fix PM disable depth imbalance on error Greg Kroah-Hartman
` (157 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tsuchiya Yuto, Kalle Valo, Sasha Levin
From: Tsuchiya Yuto <kitakar@gmail.com>
[ Upstream commit fa74cb1dc0f4da46c441b735ca865ac52de42c0e ]
When a PCIe function level reset (FLR) is performed but without fw reset for
some reasons (e.g., on Microsoft Surface devices, fw reset requires other
quirks), it fails to reset wifi properly. You can trigger the issue on such
devices via debugfs entry for reset:
$ echo 1 | sudo tee /sys/kernel/debug/mwifiex/mlan0/reset
and the resulting dmesg log:
[ 45.740508] mwifiex_pcie 0000:03:00.0: Resetting per request
[ 45.742937] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 3
[ 45.744666] mwifiex_pcie 0000:03:00.0: info: shutdown mwifiex...
[ 45.751530] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
[ 45.751539] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
[ 45.771691] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
[ 45.771695] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
[ 45.771697] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
[ 45.771698] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
[ 45.771699] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
[ 45.771701] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
[ 45.771702] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
[ 45.771703] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
[ 45.771704] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
[ 45.771705] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
[ 45.771707] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
[ 45.771708] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
[ 53.099343] mwifiex_pcie 0000:03:00.0: info: trying to associate to '[SSID]' bssid [BSSID]
[ 53.241870] mwifiex_pcie 0000:03:00.0: info: associated to bssid [BSSID] successfully
[ 75.377942] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
[ 85.385491] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 15
[ 87.539408] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
[ 87.539412] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
[ 99.699917] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
[ 99.699925] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
[ 111.859802] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
[ 111.859808] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
[...]
When comparing mwifiex_shutdown_sw() with mwifiex_pcie_remove(), it
lacks mwifiex_init_shutdown_fw().
This commit fixes mwifiex_shutdown_sw() by adding the missing
mwifiex_init_shutdown_fw().
Fixes: 4c5dae59d2e9 ("mwifiex: add PCIe function level reset support")
Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201028142110.18144-2-kitakar@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index ee40b739b2897..cd668e5427d07 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -1447,6 +1447,8 @@ int mwifiex_shutdown_sw(struct mwifiex_adapter *adapter)
priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
mwifiex_deauthenticate(priv, NULL);
+ mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN);
+
mwifiex_uninit_sw(adapter);
if (adapter->if_ops.down_dev)
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 086/242] ASoC: wm8998: Fix PM disable depth imbalance on error
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 085/242] mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 087/242] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
` (156 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Richard Fitzgerald,
Mark Brown, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 193aa0a043645220d2a2f783ba06ae13d4601078 ]
The pm_runtime_enable will increase power disable depth. Thus
a pairing decrement is needed on the error handling path to
keep it balanced according to context.
Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20201111041326.1257558-4-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm8998.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/soc/codecs/wm8998.c b/sound/soc/codecs/wm8998.c
index 44f447136e224..a94e0aeb2e198 100644
--- a/sound/soc/codecs/wm8998.c
+++ b/sound/soc/codecs/wm8998.c
@@ -1425,7 +1425,7 @@ static int wm8998_probe(struct platform_device *pdev)
ret = arizona_init_spk_irqs(arizona);
if (ret < 0)
- return ret;
+ goto err_pm_disable;
ret = snd_soc_register_codec(&pdev->dev, &soc_codec_dev_wm8998,
wm8998_dai, ARRAY_SIZE(wm8998_dai));
@@ -1438,6 +1438,8 @@ static int wm8998_probe(struct platform_device *pdev)
err_spk_irqs:
arizona_free_spk_irqs(arizona);
+err_pm_disable:
+ pm_runtime_disable(&pdev->dev);
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 087/242] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 086/242] ASoC: wm8998: Fix PM disable depth imbalance on error Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 088/242] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Greg Kroah-Hartman
` (155 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vincent Bernat, Jakub Kicinski, Sasha Levin
From: Vincent Bernat <vincent@bernat.ch>
[ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ]
Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl
ignores a route whose interface is down. It is provided as a
per-interface sysctl. However, while a "all" variant is exposed, it
was a noop since it was never evaluated. We use the usual "or" logic
for this kind of sysctls.
Tested with:
ip link add type veth # veth0 + veth1
ip link add type veth # veth1 + veth2
ip link set up dev veth0
ip link set up dev veth1 # link-status paired with veth0
ip link set up dev veth2
ip link set up dev veth3 # link-status paired with veth2
# First available path
ip -4 addr add 203.0.113.${uts#H}/24 dev veth0
ip -6 addr add 2001:db8:1::${uts#H}/64 dev veth0
# Second available path
ip -4 addr add 192.0.2.${uts#H}/24 dev veth2
ip -6 addr add 2001:db8:2::${uts#H}/64 dev veth2
# More specific route through first path
ip -4 route add 198.51.100.0/25 via 203.0.113.254 # via veth0
ip -6 route add 2001:db8:3::/56 via 2001:db8:1::ff # via veth0
# Less specific route through second path
ip -4 route add 198.51.100.0/24 via 192.0.2.254 # via veth2
ip -6 route add 2001:db8:3::/48 via 2001:db8:2::ff # via veth2
# H1: enable on "all"
# H2: enable on "veth0"
for v in ipv4 ipv6; do
case $uts in
H1)
sysctl -qw net.${v}.conf.all.ignore_routes_with_linkdown=1
;;
H2)
sysctl -qw net.${v}.conf.veth0.ignore_routes_with_linkdown=1
;;
esac
done
set -xe
# When veth0 is up, best route is through veth0
ip -o route get 198.51.100.1 | grep -Fw veth0
ip -o route get 2001:db8:3::1 | grep -Fw veth0
# When veth0 is down, best route should be through veth2 on H1/H2,
# but on veth0 on H2
ip link set down dev veth1 # down veth0
ip route show
[ $uts != H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth0
[ $uts != H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth0
[ $uts = H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth2
[ $uts = H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth2
Without this patch, the two last lines would fail on H1 (the one using
the "all" sysctl). With the patch, everything succeeds as expected.
Also document the sysctl in `ip-sysctl.rst`.
Fixes: 0eeb075fad73 ("net: ipv4 sysctl option to ignore routes when nexthop link is down")
Signed-off-by: Vincent Bernat <vincent@bernat.ch>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/networking/ip-sysctl.txt | 3 +++
include/linux/inetdevice.h | 2 +-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 5f1e3dc567f1d..fe0e46418f6db 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1271,6 +1271,9 @@ igmpv3_unsolicited_report_interval - INTEGER
IGMPv3 report retransmit will take place.
Default: 1000 (1 seconds)
+ignore_routes_with_linkdown - BOOLEAN
+ Ignore routes whose link is down when performing a FIB lookup.
+
promote_secondaries - BOOLEAN
When a primary IP address is removed from this interface
promote a corresponding secondary IP address instead of
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 5058f061cb2bd..ff876bf66cf25 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -123,7 +123,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS)))
#define IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) \
- IN_DEV_CONF_GET((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
+ IN_DEV_ORCONF((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
#define IN_DEV_ARPFILTER(in_dev) IN_DEV_ORCONF((in_dev), ARPFILTER)
#define IN_DEV_ARP_ACCEPT(in_dev) IN_DEV_ORCONF((in_dev), ARP_ACCEPT)
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 088/242] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 087/242] net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 089/242] ASoC: arizona: Fix a wrong free in wm8997_probe Greg Kroah-Hartman
` (154 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vincent Bernat, Jakub Kicinski, Sasha Levin
From: Vincent Bernat <vincent@bernat.ch>
[ Upstream commit 1af5318c00a8acc33a90537af49b3f23f72a2c4b ]
Introduced in 65324144b50b, the "proxy_arp_vlan" sysctl is a
per-interface sysctl to tune proxy ARP support for private VLANs.
While the "all" variant is exposed, it was a noop and never evaluated.
We use the usual "or" logic for this kind of sysctls.
Fixes: 65324144b50b ("net: RFC3069, private VLAN proxy arp support")
Signed-off-by: Vincent Bernat <vincent@bernat.ch>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/inetdevice.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index ff876bf66cf25..52e1230cfe1b4 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -102,7 +102,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
#define IN_DEV_LOG_MARTIANS(in_dev) IN_DEV_ORCONF((in_dev), LOG_MARTIANS)
#define IN_DEV_PROXY_ARP(in_dev) IN_DEV_ORCONF((in_dev), PROXY_ARP)
-#define IN_DEV_PROXY_ARP_PVLAN(in_dev) IN_DEV_CONF_GET(in_dev, PROXY_ARP_PVLAN)
+#define IN_DEV_PROXY_ARP_PVLAN(in_dev) IN_DEV_ORCONF((in_dev), PROXY_ARP_PVLAN)
#define IN_DEV_SHARED_MEDIA(in_dev) IN_DEV_ORCONF((in_dev), SHARED_MEDIA)
#define IN_DEV_TX_REDIRECTS(in_dev) IN_DEV_ORCONF((in_dev), SEND_REDIRECTS)
#define IN_DEV_SEC_REDIRECTS(in_dev) IN_DEV_ORCONF((in_dev), \
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 089/242] ASoC: arizona: Fix a wrong free in wm8997_probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 088/242] net: evaluate net.ipv4.conf.all.proxy_arp_pvlan Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 090/242] RDMa/mthca: Work around -Wenum-conversion warning Greg Kroah-Hartman
` (153 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Fitzgerald, Zhang Qilong,
Mark Brown, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 5e7aace13df24ff72511f29c14ebbfe638ef733c ]
In the normal path, we should not free the arizona,
we should return immediately. It will be free when
call remove operation.
Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
Reported-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Acked-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20201111130923.220186-2-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm8997.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
index 49401a8aae64a..19c963801e264 100644
--- a/sound/soc/codecs/wm8997.c
+++ b/sound/soc/codecs/wm8997.c
@@ -1179,6 +1179,8 @@ static int wm8997_probe(struct platform_device *pdev)
goto err_spk_irqs;
}
+ return ret;
+
err_spk_irqs:
arizona_free_spk_irqs(arizona);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 090/242] RDMa/mthca: Work around -Wenum-conversion warning
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 089/242] ASoC: arizona: Fix a wrong free in wm8997_probe Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 091/242] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Greg Kroah-Hartman
` (152 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Jason Gunthorpe, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit fbb7dc5db6dee553b5a07c27e86364a5223e244c ]
gcc points out a suspicious mixing of enum types in a function that
converts from MTHCA_OPCODE_* values to IB_WC_* values:
drivers/infiniband/hw/mthca/mthca_cq.c: In function 'mthca_poll_one':
drivers/infiniband/hw/mthca/mthca_cq.c:607:21: warning: implicit conversion from 'enum <anonymous>' to 'enum ib_wc_opcode' [-Wenum-conversion]
607 | entry->opcode = MTHCA_OPCODE_INVALID;
Nothing seems to ever check for MTHCA_OPCODE_INVALID again, no idea if
this is meaningful, but it seems harmless as it deals with an invalid
input.
Remove MTHCA_OPCODE_INVALID and set the ib_wc_opcode to 0xFF, which is
still bogus, but at least doesn't make compiler warnings.
Fixes: 2a4443a69934 ("[PATCH] IB/mthca: fill in opcode field for send completions")
Link: https://lore.kernel.org/r/20201026211311.3887003-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mthca/mthca_cq.c | 2 +-
drivers/infiniband/hw/mthca/mthca_dev.h | 1 -
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index a5694dec3f2ee..098653b8157ed 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -609,7 +609,7 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
entry->byte_len = MTHCA_ATOMIC_BYTE_LEN;
break;
default:
- entry->opcode = MTHCA_OPCODE_INVALID;
+ entry->opcode = 0xFF;
break;
}
} else {
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index 5508afbf1c677..b487e1339c7fb 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -105,7 +105,6 @@ enum {
MTHCA_OPCODE_ATOMIC_CS = 0x11,
MTHCA_OPCODE_ATOMIC_FA = 0x12,
MTHCA_OPCODE_BIND_MW = 0x18,
- MTHCA_OPCODE_INVALID = 0xff
};
enum {
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 091/242] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 090/242] RDMa/mthca: Work around -Wenum-conversion warning Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 092/242] staging: greybus: codecs: Fix reference counter leak in error handling Greg Kroah-Hartman
` (151 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran,
Thomas Bogendoerfer, Sasha Levin
From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
[ Upstream commit 3a5fe2fb9635c43359c9729352f45044f3c8df6b ]
When BCM47XX_BCMA is enabled and BCMA_DRIVER_PCI is disabled, it results
in the following Kbuild warning:
WARNING: unmet direct dependencies detected for BCMA_DRIVER_PCI_HOSTMODE
Depends on [n]: MIPS [=y] && BCMA_DRIVER_PCI [=n] && PCI_DRIVERS_LEGACY [=y] && BCMA [=y]=y
Selected by [y]:
- BCM47XX_BCMA [=y] && BCM47XX [=y] && PCI [=y]
The reason is that BCM47XX_BCMA selects BCMA_DRIVER_PCI_HOSTMODE without
depending on or selecting BCMA_DRIVER_PCI while BCMA_DRIVER_PCI_HOSTMODE
depends on BCMA_DRIVER_PCI. This can also fail building the kernel.
Honor the kconfig dependency to remove unmet direct dependency warnings
and avoid any potential build failures.
Fixes: c1d1c5d4213e ("bcm47xx: add support for bcma bus")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209879
Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/bcm47xx/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index 29471038d817e..c6b99845fb377 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -27,6 +27,7 @@ config BCM47XX_BCMA
select BCMA
select BCMA_HOST_SOC
select BCMA_DRIVER_MIPS
+ select BCMA_DRIVER_PCI if PCI
select BCMA_DRIVER_PCI_HOSTMODE if PCI
select BCMA_DRIVER_GPIO
default y
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 092/242] staging: greybus: codecs: Fix reference counter leak in error handling
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 091/242] MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 093/242] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Greg Kroah-Hartman
` (150 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 3952659a6108f77a0d062d8e8487bdbdaf52a66c ]
gb_pm_runtime_get_sync has increased the usage counter of the device here.
Forgetting to call gb_pm_runtime_put_noidle will result in usage counter
leak in the error branch of (gbcodec_hw_params and gbcodec_prepare). We
fixed it by adding it.
Fixes: c388ae7696992 ("greybus: audio: Update pm runtime support in dai_ops callback")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201109131347.1725288-2-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/greybus/audio_codec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c
index a6d01f0761f32..6ba5a34fcdf29 100644
--- a/drivers/staging/greybus/audio_codec.c
+++ b/drivers/staging/greybus/audio_codec.c
@@ -490,6 +490,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
if (ret) {
dev_err_ratelimited(dai->dev, "%d: Error during set_config\n",
ret);
+ gb_pm_runtime_put_noidle(bundle);
mutex_unlock(&codec->lock);
return ret;
}
@@ -566,6 +567,7 @@ static int gbcodec_prepare(struct snd_pcm_substream *substream,
break;
}
if (ret) {
+ gb_pm_runtime_put_noidle(bundle);
mutex_unlock(&codec->lock);
dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n",
ret);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 093/242] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 092/242] staging: greybus: codecs: Fix reference counter leak in error handling Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 094/242] scsi: core: Fix VPD LUN ID designator priorities Greg Kroah-Hartman
` (149 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yu Kuai, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 27c3943683f74e35e1d390ceb2e3639eff616ad6 ]
mtk_vcodec_release_dec_pm() will be called in two places:
a. mtk_vcodec_init_dec_pm() succeed while mtk_vcodec_probe() return error.
b. mtk_vcodec_dec_remove().
In both cases put_device() call is needed, since of_find_device_by_node()
was called in mtk_vcodec_init_dec_pm() previously.
Thus add put_devices() call in mtk_vcodec_release_dec_pm()
Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
index 79ca03ac449c3..3f64119e8c082 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
@@ -103,6 +103,7 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev)
{
pm_runtime_disable(dev->pm.dev);
+ put_device(dev->pm.larbvdec);
}
void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm)
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 094/242] scsi: core: Fix VPD LUN ID designator priorities
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 093/242] media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 095/242] media: solo6x10: fix missing snd_card_free in error handling case Greg Kroah-Hartman
` (148 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hannes Reinecke, Martin Wilck,
Martin K. Petersen, Sasha Levin
From: Martin Wilck <mwilck@suse.com>
[ Upstream commit 2e4209b3806cda9b89c30fd5e7bfecb7044ec78b ]
The current implementation of scsi_vpd_lun_id() uses the designator length
as an implicit measure of priority. This works most of the time, but not
always. For example, some Hitachi storage arrays return this in VPD 0x83:
VPD INQUIRY: Device Identification page
Designation descriptor number 1, descriptor length: 24
designator_type: T10 vendor identification, code_set: ASCII
associated with the Addressed logical unit
vendor id: HITACHI
vendor specific: 5030C3502025
Designation descriptor number 2, descriptor length: 6
designator_type: vendor specific [0x0], code_set: Binary
associated with the Target port
vendor specific: 08 03
Designation descriptor number 3, descriptor length: 20
designator_type: NAA, code_set: Binary
associated with the Addressed logical unit
NAA 6, IEEE Company_id: 0x60e8
Vendor Specific Identifier: 0x7c35000
Vendor Specific Identifier Extension: 0x30c35000002025
[0x60060e8007c350000030c35000002025]
The current code would use the first descriptor because it's longer than
the NAA descriptor. But this is wrong, the kernel is supposed to prefer NAA
descriptors over T10 vendor ID. Designator length should only be used to
compare designators of the same type.
This patch addresses the issue by separating designator priority and
length.
Link: https://lore.kernel.org/r/20201029170846.14786-1-mwilck@suse.com
Fixes: 9983bed3907c ("scsi: Add scsi_vpd_lun_id()")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Martin Wilck <mwilck@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_lib.c | 126 +++++++++++++++++++++++++++-------------
1 file changed, 86 insertions(+), 40 deletions(-)
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index c36c84c8725a0..6e0981b09c58b 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -3326,6 +3326,78 @@ void sdev_enable_disk_events(struct scsi_device *sdev)
}
EXPORT_SYMBOL(sdev_enable_disk_events);
+static unsigned char designator_prio(const unsigned char *d)
+{
+ if (d[1] & 0x30)
+ /* not associated with LUN */
+ return 0;
+
+ if (d[3] == 0)
+ /* invalid length */
+ return 0;
+
+ /*
+ * Order of preference for lun descriptor:
+ * - SCSI name string
+ * - NAA IEEE Registered Extended
+ * - EUI-64 based 16-byte
+ * - EUI-64 based 12-byte
+ * - NAA IEEE Registered
+ * - NAA IEEE Extended
+ * - EUI-64 based 8-byte
+ * - SCSI name string (truncated)
+ * - T10 Vendor ID
+ * as longer descriptors reduce the likelyhood
+ * of identification clashes.
+ */
+
+ switch (d[1] & 0xf) {
+ case 8:
+ /* SCSI name string, variable-length UTF-8 */
+ return 9;
+ case 3:
+ switch (d[4] >> 4) {
+ case 6:
+ /* NAA registered extended */
+ return 8;
+ case 5:
+ /* NAA registered */
+ return 5;
+ case 4:
+ /* NAA extended */
+ return 4;
+ case 3:
+ /* NAA locally assigned */
+ return 1;
+ default:
+ break;
+ }
+ break;
+ case 2:
+ switch (d[3]) {
+ case 16:
+ /* EUI64-based, 16 byte */
+ return 7;
+ case 12:
+ /* EUI64-based, 12 byte */
+ return 6;
+ case 8:
+ /* EUI64-based, 8 byte */
+ return 3;
+ default:
+ break;
+ }
+ break;
+ case 1:
+ /* T10 vendor ID */
+ return 1;
+ default:
+ break;
+ }
+
+ return 0;
+}
+
/**
* scsi_vpd_lun_id - return a unique device identification
* @sdev: SCSI device
@@ -3342,7 +3414,7 @@ EXPORT_SYMBOL(sdev_enable_disk_events);
*/
int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
{
- u8 cur_id_type = 0xff;
+ u8 cur_id_prio = 0;
u8 cur_id_size = 0;
const unsigned char *d, *cur_id_str;
const struct scsi_vpd *vpd_pg83;
@@ -3355,20 +3427,6 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
return -ENXIO;
}
- /*
- * Look for the correct descriptor.
- * Order of preference for lun descriptor:
- * - SCSI name string
- * - NAA IEEE Registered Extended
- * - EUI-64 based 16-byte
- * - EUI-64 based 12-byte
- * - NAA IEEE Registered
- * - NAA IEEE Extended
- * - T10 Vendor ID
- * as longer descriptors reduce the likelyhood
- * of identification clashes.
- */
-
/* The id string must be at least 20 bytes + terminating NULL byte */
if (id_len < 21) {
rcu_read_unlock();
@@ -3378,8 +3436,9 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
memset(id, 0, id_len);
d = vpd_pg83->data + 4;
while (d < vpd_pg83->data + vpd_pg83->len) {
- /* Skip designators not referring to the LUN */
- if ((d[1] & 0x30) != 0x00)
+ u8 prio = designator_prio(d);
+
+ if (prio == 0 || cur_id_prio > prio)
goto next_desig;
switch (d[1] & 0xf) {
@@ -3387,28 +3446,19 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
/* T10 Vendor ID */
if (cur_id_size > d[3])
break;
- /* Prefer anything */
- if (cur_id_type > 0x01 && cur_id_type != 0xff)
- break;
+ cur_id_prio = prio;
cur_id_size = d[3];
if (cur_id_size + 4 > id_len)
cur_id_size = id_len - 4;
cur_id_str = d + 4;
- cur_id_type = d[1] & 0xf;
id_size = snprintf(id, id_len, "t10.%*pE",
cur_id_size, cur_id_str);
break;
case 0x2:
/* EUI-64 */
- if (cur_id_size > d[3])
- break;
- /* Prefer NAA IEEE Registered Extended */
- if (cur_id_type == 0x3 &&
- cur_id_size == d[3])
- break;
+ cur_id_prio = prio;
cur_id_size = d[3];
cur_id_str = d + 4;
- cur_id_type = d[1] & 0xf;
switch (cur_id_size) {
case 8:
id_size = snprintf(id, id_len,
@@ -3426,17 +3476,14 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
cur_id_str);
break;
default:
- cur_id_size = 0;
break;
}
break;
case 0x3:
/* NAA */
- if (cur_id_size > d[3])
- break;
+ cur_id_prio = prio;
cur_id_size = d[3];
cur_id_str = d + 4;
- cur_id_type = d[1] & 0xf;
switch (cur_id_size) {
case 8:
id_size = snprintf(id, id_len,
@@ -3449,26 +3496,25 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
cur_id_str);
break;
default:
- cur_id_size = 0;
break;
}
break;
case 0x8:
/* SCSI name string */
- if (cur_id_size + 4 > d[3])
+ if (cur_id_size > d[3])
break;
/* Prefer others for truncated descriptor */
- if (cur_id_size && d[3] > id_len)
- break;
+ if (d[3] > id_len) {
+ prio = 2;
+ if (cur_id_prio > prio)
+ break;
+ }
+ cur_id_prio = prio;
cur_id_size = id_size = d[3];
cur_id_str = d + 4;
- cur_id_type = d[1] & 0xf;
if (cur_id_size >= id_len)
cur_id_size = id_len - 1;
memcpy(id, cur_id_str, cur_id_size);
- /* Decrease priority for truncated descriptor */
- if (cur_id_size != id_size)
- cur_id_size = 6;
break;
default:
break;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 095/242] media: solo6x10: fix missing snd_card_free in error handling case
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 094/242] scsi: core: Fix VPD LUN ID designator priorities Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 096/242] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Greg Kroah-Hartman
` (147 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit dcdff74fa6bc00c32079d0bebd620764c26f2d89 ]
Fix to goto snd_error in error handling case when fails
to do snd_ctl_add, as done elsewhere in this function.
Fixes: 28cae868cd24 ("[media] solo6x10: move out of staging into drivers/media/pci.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c
index 81be1b8df7584..0cbb3ee96e1e8 100644
--- a/drivers/media/pci/solo6x10/solo6x10-g723.c
+++ b/drivers/media/pci/solo6x10/solo6x10-g723.c
@@ -401,7 +401,7 @@ int solo_g723_init(struct solo_dev *solo_dev)
ret = snd_ctl_add(card, snd_ctl_new1(&kctl, solo_dev));
if (ret < 0)
- return ret;
+ goto snd_error;
ret = solo_snd_pcm_init(solo_dev);
if (ret < 0)
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 096/242] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 095/242] media: solo6x10: fix missing snd_card_free in error handling case Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 097/242] Input: ads7846 - fix race that causes missing releases Greg Kroah-Hartman
` (146 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
Thomas Zimmermann, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 723ae803218da993143387bf966042eccefac077 ]
Return -ENOMEM when allocating refill memory failed.
Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20201117061045.3452287-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index 32901c6fe3dfc..6d0c0405e736d 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -751,6 +751,7 @@ static int omap_dmm_probe(struct platform_device *dev)
&omap_dmm->refill_pa, GFP_KERNEL);
if (!omap_dmm->refill_va) {
dev_err(&dev->dev, "could not allocate refill memory\n");
+ ret = -ENOMEM;
goto fail;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 097/242] Input: ads7846 - fix race that causes missing releases
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 096/242] drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 098/242] Input: ads7846 - fix integer overflow on Rt calculation Greg Kroah-Hartman
` (145 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Jander, Oleksij Rempel,
Dmitry Torokhov, Sasha Levin
From: David Jander <david@protonic.nl>
[ Upstream commit e52cd628a03f72a547dbf90ccb703ee64800504a ]
If touchscreen is released while busy reading HWMON device, the release
can be missed. The IRQ thread is not started because no touch is active
and BTN_TOUCH release event is never sent.
Fixes: f5a28a7d4858f94a ("Input: ads7846 - avoid pen up/down when reading hwmon")
Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201027105416.18773-1-o.rempel@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/touchscreen/ads7846.c | 44 +++++++++++++++++------------
1 file changed, 26 insertions(+), 18 deletions(-)
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index a2f45aefce08a..0fbad337e45a3 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -199,6 +199,26 @@ struct ads7846 {
#define REF_ON (READ_12BIT_DFR(x, 1, 1))
#define REF_OFF (READ_12BIT_DFR(y, 0, 0))
+static int get_pendown_state(struct ads7846 *ts)
+{
+ if (ts->get_pendown_state)
+ return ts->get_pendown_state();
+
+ return !gpio_get_value(ts->gpio_pendown);
+}
+
+static void ads7846_report_pen_up(struct ads7846 *ts)
+{
+ struct input_dev *input = ts->input;
+
+ input_report_key(input, BTN_TOUCH, 0);
+ input_report_abs(input, ABS_PRESSURE, 0);
+ input_sync(input);
+
+ ts->pendown = false;
+ dev_vdbg(&ts->spi->dev, "UP\n");
+}
+
/* Must be called with ts->lock held */
static void ads7846_stop(struct ads7846 *ts)
{
@@ -215,6 +235,10 @@ static void ads7846_stop(struct ads7846 *ts)
static void ads7846_restart(struct ads7846 *ts)
{
if (!ts->disabled && !ts->suspended) {
+ /* Check if pen was released since last stop */
+ if (ts->pendown && !get_pendown_state(ts))
+ ads7846_report_pen_up(ts);
+
/* Tell IRQ thread that it may poll the device. */
ts->stopped = false;
mb();
@@ -605,14 +629,6 @@ static const struct attribute_group ads784x_attr_group = {
/*--------------------------------------------------------------------------*/
-static int get_pendown_state(struct ads7846 *ts)
-{
- if (ts->get_pendown_state)
- return ts->get_pendown_state();
-
- return !gpio_get_value(ts->gpio_pendown);
-}
-
static void null_wait_for_sync(void)
{
}
@@ -871,16 +887,8 @@ static irqreturn_t ads7846_irq(int irq, void *handle)
msecs_to_jiffies(TS_POLL_PERIOD));
}
- if (ts->pendown && !ts->stopped) {
- struct input_dev *input = ts->input;
-
- input_report_key(input, BTN_TOUCH, 0);
- input_report_abs(input, ABS_PRESSURE, 0);
- input_sync(input);
-
- ts->pendown = false;
- dev_vdbg(&ts->spi->dev, "UP\n");
- }
+ if (ts->pendown && !ts->stopped)
+ ads7846_report_pen_up(ts);
return IRQ_HANDLED;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 098/242] Input: ads7846 - fix integer overflow on Rt calculation
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 097/242] Input: ads7846 - fix race that causes missing releases Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 099/242] Input: ads7846 - fix unaligned access on 7845 Greg Kroah-Hartman
` (144 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Jander, Oleksij Rempel,
Dmitry Torokhov, Sasha Levin
From: Oleksij Rempel <o.rempel@pengutronix.de>
[ Upstream commit 820830ec918f6c3dcd77a54a1c6198ab57407916 ]
In some rare cases the 32 bit Rt value will overflow if z2 and x is max,
z1 is minimal value and x_plate_ohms is relatively high (for example 800
ohm). This would happen on some screen age with low pressure.
There are two possible fixes:
- make Rt 64bit
- reorder calculation to avoid overflow
The second variant seems to be preferable, since 64 bit calculation on
32 bit system is a bit more expensive.
Fixes: ffa458c1bd9b6f653008d450f337602f3d52a646 ("spi: ads7846 driver")
Co-developed-by: David Jander <david@protonic.nl>
Signed-off-by: David Jander <david@protonic.nl>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20201113112240.1360-1-o.rempel@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/touchscreen/ads7846.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 0fbad337e45a3..7ce0eedaa0e5e 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -801,10 +801,11 @@ static void ads7846_report_state(struct ads7846 *ts)
/* compute touch pressure resistance using equation #2 */
Rt = z2;
Rt -= z1;
- Rt *= x;
Rt *= ts->x_plate_ohms;
+ Rt = DIV_ROUND_CLOSEST(Rt, 16);
+ Rt *= x;
Rt /= z1;
- Rt = (Rt + 2047) >> 12;
+ Rt = DIV_ROUND_CLOSEST(Rt, 256);
} else {
Rt = 0;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 099/242] Input: ads7846 - fix unaligned access on 7845
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 098/242] Input: ads7846 - fix integer overflow on Rt calculation Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 100/242] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Greg Kroah-Hartman
` (143 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Torokhov, Sasha Levin
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[ Upstream commit 03e2c9c782f721b661a0e42b1b58f394b5298544 ]
req->sample[1] is not naturally aligned at word boundary, and therefore we
should use get_unaligned_be16() when accessing it.
Fixes: 3eac5c7e44f3 ("Input: ads7846 - extend the driver for ads7845 controller support")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/touchscreen/ads7846.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 7ce0eedaa0e5e..b536768234b7c 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -35,6 +35,7 @@
#include <linux/regulator/consumer.h>
#include <linux/module.h>
#include <asm/irq.h>
+#include <asm/unaligned.h>
/*
* This code has been heavily tested on a Nokia 770, and lightly
@@ -434,7 +435,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command)
if (status == 0) {
/* BE12 value, then padding */
- status = be16_to_cpu(*((u16 *)&req->sample[1]));
+ status = get_unaligned_be16(&req->sample[1]);
status = status >> 3;
status &= 0x0fff;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 100/242] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 099/242] Input: ads7846 - fix unaligned access on 7845 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 101/242] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Greg Kroah-Hartman
` (142 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman,
Sasha Levin
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 78665179e569c7e1fe102fb6c21d0f5b6951f084 ]
On 8xx, we get the following features:
[ 0.000000] cpu_features = 0x0000000000000100
[ 0.000000] possible = 0x0000000000000120
[ 0.000000] always = 0x0000000000000000
This is not correct. As CONFIG_PPC_8xx is mutually exclusive with all
other configurations, the three lines should be equal.
The problem is due to CPU_FTRS_GENERIC_32 which is taken when
CONFIG_BOOK3S_32 is NOT selected. This CPU_FTRS_GENERIC_32 is
pointless because there is no generic configuration supporting
all 32 bits but book3s/32.
Remove this pointless generic features definition to unbreak the
calculation of 'possible' features and 'always' features.
Fixes: 76bc080ef5a3 ("[POWERPC] Make default cputable entries reflect selected CPU family")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/76a85f30bf981d1aeaae00df99321235494da254.1604426550.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/include/asm/cputable.h | 5 -----
1 file changed, 5 deletions(-)
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index e4451b30d7e32..89a5cdf46ad7f 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -423,7 +423,6 @@ enum {
CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \
CPU_FTR_CELL_TB_BUG | CPU_FTR_SMT)
-#define CPU_FTRS_GENERIC_32 (CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
/* 64-bit CPUs */
#define CPU_FTRS_POWER4 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
@@ -515,8 +514,6 @@ enum {
CPU_FTRS_7447 | CPU_FTRS_7447A | CPU_FTRS_82XX |
CPU_FTRS_G2_LE | CPU_FTRS_E300 | CPU_FTRS_E300C2 |
CPU_FTRS_CLASSIC32 |
-#else
- CPU_FTRS_GENERIC_32 |
#endif
#ifdef CONFIG_PPC_8xx
CPU_FTRS_8XX |
@@ -567,8 +564,6 @@ enum {
CPU_FTRS_7447 & CPU_FTRS_7447A & CPU_FTRS_82XX &
CPU_FTRS_G2_LE & CPU_FTRS_E300 & CPU_FTRS_E300C2 &
CPU_FTRS_CLASSIC32 &
-#else
- CPU_FTRS_GENERIC_32 &
#endif
#ifdef CONFIG_PPC_8xx
CPU_FTRS_8XX &
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 101/242] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 100/242] powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 102/242] soc: ti: knav_qmss: fix reference leak in knav_queue_probe Greg Kroah-Hartman
` (141 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Herbert Xu, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit ff8107200367f4abe0e5bce66a245e8d0f2d229e ]
The pm_runtime_enable will increase power disable depth.
Thus a pairing decrement is needed on the error handling
path to keep it balanced according to context.
Fixes: f7b2b5dd6a62a ("crypto: omap-aes - add error check for pm_runtime_get_sync")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/omap-aes.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
index c376a3ee7c2c3..41c411ee0da5d 100644
--- a/drivers/crypto/omap-aes.c
+++ b/drivers/crypto/omap-aes.c
@@ -1071,7 +1071,7 @@ static int omap_aes_probe(struct platform_device *pdev)
if (err < 0) {
dev_err(dev, "%s: failed to get_sync(%d)\n",
__func__, err);
- goto err_res;
+ goto err_pm_disable;
}
omap_aes_dma_stop(dd);
@@ -1180,6 +1180,7 @@ err_engine:
omap_aes_dma_cleanup(dd);
err_irq:
tasklet_kill(&dd->done_task);
+err_pm_disable:
pm_runtime_disable(dev);
err_res:
dd = NULL;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 102/242] soc: ti: knav_qmss: fix reference leak in knav_queue_probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 101/242] crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 103/242] soc: ti: Fix reference imbalance in knav_dma_probe Greg Kroah-Hartman
` (140 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Santosh Shilimkar, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit ec8684847d8062496c4619bc3fcff31c19d56847 ]
pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak in knav_queue_probe, so we should fix it.
Fixes: 41f93af900a20 ("soc: ti: add Keystone Navigator QMSS driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/ti/knav_qmss_queue.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index 9879ca5f8c5f5..eef79cd5a7238 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1719,6 +1719,7 @@ static int knav_queue_probe(struct platform_device *pdev)
pm_runtime_enable(&pdev->dev);
ret = pm_runtime_get_sync(&pdev->dev);
if (ret < 0) {
+ pm_runtime_put_noidle(&pdev->dev);
dev_err(dev, "Failed to enable QMSS\n");
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 103/242] soc: ti: Fix reference imbalance in knav_dma_probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 102/242] soc: ti: knav_qmss: fix reference leak in knav_queue_probe Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 104/242] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Greg Kroah-Hartman
` (139 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Santosh Shilimkar, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit b4fa73358c306d747a2200aec6f7acb97e5750e6 ]
The patch fix two reference leak.
1) pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to call put operation will result in
reference leak.
2) The pm_runtime_enable will increase power disable depth. Thus
a pairing decrement is needed on the error handling path to
keep it balanced.
We fix it by: 1) adding call pm_runtime_put_noidle or
pm_runtime_put_sync in error handling. 2) adding pm_runtime_disable
in error handling, to keep usage counter and disable depth balanced.
Fixes: 88139ed030583 ("soc: ti: add Keystone Navigator DMA support")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/ti/knav_dma.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
index 026182d3b27c1..6d137b1f43ae5 100644
--- a/drivers/soc/ti/knav_dma.c
+++ b/drivers/soc/ti/knav_dma.c
@@ -752,8 +752,9 @@ static int knav_dma_probe(struct platform_device *pdev)
pm_runtime_enable(kdev->dev);
ret = pm_runtime_get_sync(kdev->dev);
if (ret < 0) {
+ pm_runtime_put_noidle(kdev->dev);
dev_err(kdev->dev, "unable to enable pktdma, err %d\n", ret);
- return ret;
+ goto err_pm_disable;
}
/* Initialise all packet dmas */
@@ -767,13 +768,21 @@ static int knav_dma_probe(struct platform_device *pdev)
if (list_empty(&kdev->list)) {
dev_err(dev, "no valid dma instance\n");
- return -ENODEV;
+ ret = -ENODEV;
+ goto err_put_sync;
}
debugfs_create_file("knav_dma", S_IFREG | S_IRUGO, NULL, NULL,
&knav_dma_debug_ops);
return ret;
+
+err_put_sync:
+ pm_runtime_put_sync(kdev->dev);
+err_pm_disable:
+ pm_runtime_disable(kdev->dev);
+
+ return ret;
}
static int knav_dma_remove(struct platform_device *pdev)
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 104/242] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 103/242] soc: ti: Fix reference imbalance in knav_dma_probe Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 105/242] Input: omap4-keypad - fix runtime PM error handling Greg Kroah-Hartman
` (138 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhihao Cheng,
Santosh Shilimkar, Sasha Levin
From: Zhihao Cheng <chengzhihao1@huawei.com>
[ Upstream commit 4cba398f37f868f515ff12868418dc28574853a1 ]
Fix to return the error code from of_get_child_by_name() instaed of 0
in knav_queue_probe().
Fixes: 41f93af900a20d1a0a ("soc: ti: add Keystone Navigator QMSS driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/ti/knav_qmss_queue.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index eef79cd5a7238..25baf13d6dfd2 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -1787,9 +1787,10 @@ static int knav_queue_probe(struct platform_device *pdev)
if (ret)
goto err;
- regions = of_get_child_by_name(node, "descriptor-regions");
+ regions = of_get_child_by_name(node, "descriptor-regions");
if (!regions) {
dev_err(dev, "descriptor-regions not specified\n");
+ ret = -ENODEV;
goto err;
}
ret = knav_queue_setup_regions(kdev, regions);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 105/242] Input: omap4-keypad - fix runtime PM error handling
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 104/242] drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 106/242] RDMA/cxgb4: Validate the number of CQEs Greg Kroah-Hartman
` (137 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Dmitry Torokhov, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 59bbf83835f591b95c3bdd09d900f3584fa227af ]
In omap4_keypad_probe, the patch fix several bugs.
1) pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to pm_runtime_put_noidle will result in
reference leak.
2) In err_unmap, forget to disable runtime of device,
pm_runtime_enable will increase power disable depth. Thus a
pairing decrement is needed on the error handling path to keep
it balanced.
3) In err_pm_disable, it will call pm_runtime_put_sync twice not
one time.
To fix this we factor out code reading revision and disabling touchpad, and
drop PM reference once we are done talking to the device.
Fixes: f77621cc640a7 ("Input: omap-keypad - dynamically handle register offsets")
Fixes: 5ad567ffbaf20 ("Input: omap4-keypad - wire up runtime PM handling")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201120133918.2559681-1-zhangqilong3@huawei.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/keyboard/omap4-keypad.c | 89 ++++++++++++++++-----------
1 file changed, 53 insertions(+), 36 deletions(-)
diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
index 5480f1a5658ee..a42a75a53a113 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -199,12 +199,8 @@ static int omap4_keypad_open(struct input_dev *input)
return 0;
}
-static void omap4_keypad_close(struct input_dev *input)
+static void omap4_keypad_stop(struct omap4_keypad *keypad_data)
{
- struct omap4_keypad *keypad_data = input_get_drvdata(input);
-
- disable_irq(keypad_data->irq);
-
/* Disable interrupts and wake-up events */
kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
OMAP4_VAL_IRQDISABLE);
@@ -213,7 +209,15 @@ static void omap4_keypad_close(struct input_dev *input)
/* clear pending interrupts */
kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+}
+
+static void omap4_keypad_close(struct input_dev *input)
+{
+ struct omap4_keypad *keypad_data;
+ keypad_data = input_get_drvdata(input);
+ disable_irq(keypad_data->irq);
+ omap4_keypad_stop(keypad_data);
enable_irq(keypad_data->irq);
pm_runtime_put_sync(input->dev.parent);
@@ -236,13 +240,37 @@ static int omap4_keypad_parse_dt(struct device *dev,
return 0;
}
+static int omap4_keypad_check_revision(struct device *dev,
+ struct omap4_keypad *keypad_data)
+{
+ unsigned int rev;
+
+ rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
+ rev &= 0x03 << 30;
+ rev >>= 30;
+ switch (rev) {
+ case KBD_REVISION_OMAP4:
+ keypad_data->reg_offset = 0x00;
+ keypad_data->irqreg_offset = 0x00;
+ break;
+ case KBD_REVISION_OMAP5:
+ keypad_data->reg_offset = 0x10;
+ keypad_data->irqreg_offset = 0x0c;
+ break;
+ default:
+ dev_err(dev, "Keypad reports unsupported revision %d", rev);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
static int omap4_keypad_probe(struct platform_device *pdev)
{
struct omap4_keypad *keypad_data;
struct input_dev *input_dev;
struct resource *res;
unsigned int max_keys;
- int rev;
int irq;
int error;
@@ -282,41 +310,33 @@ static int omap4_keypad_probe(struct platform_device *pdev)
goto err_release_mem;
}
+ pm_runtime_enable(&pdev->dev);
/*
* Enable clocks for the keypad module so that we can read
* revision register.
*/
- pm_runtime_enable(&pdev->dev);
error = pm_runtime_get_sync(&pdev->dev);
if (error) {
dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
- goto err_unmap;
- }
- rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
- rev &= 0x03 << 30;
- rev >>= 30;
- switch (rev) {
- case KBD_REVISION_OMAP4:
- keypad_data->reg_offset = 0x00;
- keypad_data->irqreg_offset = 0x00;
- break;
- case KBD_REVISION_OMAP5:
- keypad_data->reg_offset = 0x10;
- keypad_data->irqreg_offset = 0x0c;
- break;
- default:
- dev_err(&pdev->dev,
- "Keypad reports unsupported revision %d", rev);
- error = -EINVAL;
- goto err_pm_put_sync;
+ pm_runtime_put_noidle(&pdev->dev);
+ } else {
+ error = omap4_keypad_check_revision(&pdev->dev,
+ keypad_data);
+ if (!error) {
+ /* Ensure device does not raise interrupts */
+ omap4_keypad_stop(keypad_data);
+ }
+ pm_runtime_put_sync(&pdev->dev);
}
+ if (error)
+ goto err_pm_disable;
/* input device allocation */
keypad_data->input = input_dev = input_allocate_device();
if (!input_dev) {
error = -ENOMEM;
- goto err_pm_put_sync;
+ goto err_pm_disable;
}
input_dev->name = pdev->name;
@@ -361,28 +381,25 @@ static int omap4_keypad_probe(struct platform_device *pdev)
goto err_free_keymap;
}
- device_init_wakeup(&pdev->dev, true);
- pm_runtime_put_sync(&pdev->dev);
-
error = input_register_device(keypad_data->input);
if (error < 0) {
dev_err(&pdev->dev, "failed to register input device\n");
- goto err_pm_disable;
+ goto err_free_irq;
}
+ device_init_wakeup(&pdev->dev, true);
platform_set_drvdata(pdev, keypad_data);
+
return 0;
-err_pm_disable:
- pm_runtime_disable(&pdev->dev);
+err_free_irq:
free_irq(keypad_data->irq, keypad_data);
err_free_keymap:
kfree(keypad_data->keymap);
err_free_input:
input_free_device(input_dev);
-err_pm_put_sync:
- pm_runtime_put_sync(&pdev->dev);
-err_unmap:
+err_pm_disable:
+ pm_runtime_disable(&pdev->dev);
iounmap(keypad_data->base);
err_release_mem:
release_mem_region(res->start, resource_size(res));
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 106/242] RDMA/cxgb4: Validate the number of CQEs
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 105/242] Input: omap4-keypad - fix runtime PM error handling Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 107/242] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
` (136 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kamal Heib, Jason Gunthorpe, Sasha Levin
From: Kamal Heib <kamalheib1@gmail.com>
[ Upstream commit 6d8285e604e0221b67bd5db736921b7ddce37d00 ]
Before create CQ, make sure that the requested number of CQEs is in the
supported range.
Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC")
Link: https://lore.kernel.org/r/20201108132007.67537-1-kamalheib1@gmail.com
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/cxgb4/cq.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -906,6 +906,9 @@ struct ib_cq *c4iw_create_cq(struct ib_d
rhp = to_c4iw_dev(ibdev);
+ if (entries < 1 || entries > ibdev->attrs.max_cqe)
+ return ERR_PTR(-EINVAL);
+
if (vector >= rhp->rdev.lldi.nciq)
return ERR_PTR(-EINVAL);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 107/242] memstick: fix a double-free bug in memstick_check
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 106/242] RDMA/cxgb4: Validate the number of CQEs Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 108/242] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host Greg Kroah-Hartman
` (135 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
Ulf Hansson, Sasha Levin
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]
kfree(host->card) has been called in put_device so that
another kfree would raise cause a double-free bug.
Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memstick/core/memstick.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index b1564cacd19e1..20ae8652adf44 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -469,7 +469,6 @@ static void memstick_check(struct work_struct *work)
host->card = card;
if (device_register(&card->dev)) {
put_device(&card->dev);
- kfree(host->card);
host->card = NULL;
}
} else
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 108/242] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 107/242] memstick: fix a double-free bug in memstick_check Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 109/242] ARM: dts: at91: sama5d3_xplained: " Greg Kroah-Hartman
` (134 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cristian Birsan, Alexandre Belloni,
Ludovic Desroches, Sasha Levin
From: Cristian Birsan <cristian.birsan@microchip.com>
[ Upstream commit be4dd2d448816a27c1446f8f37fce375daf64148 ]
The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.
Fixes: 38153a017896f ("ARM: at91/dt: sama5d4: add dts for sama5d4 xplained board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-3-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
index 10f2fb9e0ea61..c271ca960caee 100644
--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
@@ -158,6 +158,11 @@
atmel,pins =
<AT91_PIOE 31 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;
};
+ pinctrl_usb_default: usb_default {
+ atmel,pins =
+ <AT91_PIOE 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+ AT91_PIOE 14 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+ };
pinctrl_key_gpio: key_gpio_0 {
atmel,pins =
<AT91_PIOE 8 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
@@ -183,6 +188,8 @@
&pioE 11 GPIO_ACTIVE_HIGH
&pioE 14 GPIO_ACTIVE_HIGH
>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usb_default>;
status = "okay";
};
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 109/242] ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 108/242] ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 110/242] orinoco: Move context allocation after processing the skb Greg Kroah-Hartman
` (133 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cristian Birsan, Alexandre Belloni,
Ludovic Desroches, Sasha Levin
From: Cristian Birsan <cristian.birsan@microchip.com>
[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ]
The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
it the driver probes but VBus is not powered because of wrong pincontrol
configuration.
Fixes: b7c2b61570798 ("ARM: at91: add Atmel's SAMA5D3 Xplained board")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Link: https://lore.kernel.org/r/20201118120019.1257580-4-cristian.birsan@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
index 3af088d2cba79..ce059f9eaa7d9 100644
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -231,6 +231,11 @@
atmel,pins =
<AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>; /* PE9, conflicts with A9 */
};
+ pinctrl_usb_default: usb_default {
+ atmel,pins =
+ <AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+ AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+ };
};
};
};
@@ -248,6 +253,8 @@
&pioE 3 GPIO_ACTIVE_LOW
&pioE 4 GPIO_ACTIVE_LOW
>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usb_default>;
status = "okay";
};
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 110/242] orinoco: Move context allocation after processing the skb
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 109/242] ARM: dts: at91: sama5d3_xplained: " Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 111/242] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Greg Kroah-Hartman
` (132 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior,
Kalle Valo, Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit a31eb615646a63370aa1da1053c45439c7653d83 ]
ezusb_xmit() allocates a context which is leaked if
orinoco_process_xmit_skb() returns an error.
Move ezusb_alloc_ctx() after the invocation of
orinoco_process_xmit_skb() because the context is not needed so early.
ezusb_access_ltv() will cleanup the context in case of an error.
Fixes: bac6fafd4d6a0 ("orinoco: refactor xmit path")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201113212252.2243570-2-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/intersil/orinoco/orinoco_usb.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
index 5a64674a5c8da..74a313e6d98f2 100644
--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
@@ -1237,13 +1237,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
if (skb->len < ETH_HLEN)
goto drop;
- ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
- if (!ctx)
- goto busy;
-
- memset(ctx->buf, 0, BULK_BUF_SIZE);
- buf = ctx->buf->data;
-
tx_control = 0;
err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
@@ -1251,6 +1244,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
if (err)
goto drop;
+ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
+ if (!ctx)
+ goto drop;
+
+ memset(ctx->buf, 0, BULK_BUF_SIZE);
+ buf = ctx->buf->data;
+
{
__le16 *tx_cntl = (__le16 *)buf;
*tx_cntl = cpu_to_le16(tx_control);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 111/242] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 110/242] orinoco: Move context allocation after processing the skb Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 112/242] media: siano: fix memory leak of debugfs members in smsdvb_hotplug Greg Kroah-Hartman
` (131 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
Kalle Valo, Sasha Levin
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit 7ec8a926188eb8e7a3cbaca43ec44f2d7146d71b ]
Add the missing destroy_workqueue() before return from
cw1200_init_common in the error handling case.
Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/st/cw1200/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/st/cw1200/main.c b/drivers/net/wireless/st/cw1200/main.c
index 84624c812a15f..f4338bce78f4a 100644
--- a/drivers/net/wireless/st/cw1200/main.c
+++ b/drivers/net/wireless/st/cw1200/main.c
@@ -385,6 +385,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
CW1200_LINK_ID_MAX,
cw1200_skb_dtor,
priv)) {
+ destroy_workqueue(priv->workqueue);
ieee80211_free_hw(hw);
return NULL;
}
@@ -396,6 +397,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
for (; i > 0; i--)
cw1200_queue_deinit(&priv->tx_queue[i - 1]);
cw1200_queue_stats_deinit(&priv->tx_queue_stats);
+ destroy_workqueue(priv->workqueue);
ieee80211_free_hw(hw);
return NULL;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 112/242] media: siano: fix memory leak of debugfs members in smsdvb_hotplug
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 111/242] cw1200: fix missing destroy_workqueue() on error in cw1200_init_common Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 113/242] samples: bpf: Fix lwt_len_hist reusing previous BPF map Greg Kroah-Hartman
` (130 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Keita Suzuki, Sean Young,
Mauro Carvalho Chehab, Sasha Levin
From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
[ Upstream commit abf287eeff4c6da6aa804bbd429dfd9d0dfb6ea7 ]
When dvb_create_media_graph fails, the debugfs kept inside client should
be released. However, the current implementation does not release them.
Fix this by adding a new goto label to call smsdvb_debugfs_release.
Fixes: 0d3ab8410dcb ("[media] dvb core: must check dvb_create_media_graph()")
Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/common/siano/smsdvb-main.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
index affde1426b7a2..15e895c9f2e0b 100644
--- a/drivers/media/common/siano/smsdvb-main.c
+++ b/drivers/media/common/siano/smsdvb-main.c
@@ -1180,12 +1180,15 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
rc = dvb_create_media_graph(&client->adapter, true);
if (rc < 0) {
pr_err("dvb_create_media_graph failed %d\n", rc);
- goto client_error;
+ goto media_graph_error;
}
pr_info("DVB interface registered.\n");
return 0;
+media_graph_error:
+ smsdvb_debugfs_release(client);
+
client_error:
dvb_unregister_frontend(&client->frontend);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 113/242] samples: bpf: Fix lwt_len_hist reusing previous BPF map
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 112/242] media: siano: fix memory leak of debugfs members in smsdvb_hotplug Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 114/242] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Greg Kroah-Hartman
` (129 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel T. Lee, Andrii Nakryiko, Sasha Levin
From: Daniel T. Lee <danieltimlee@gmail.com>
[ Upstream commit 0afe0a998c40085a6342e1aeb4c510cccba46caf ]
Currently, lwt_len_hist's map lwt_len_hist_map is uses pinning, and the
map isn't cleared on test end. This leds to reuse of that map for
each test, which prevents the results of the test from being accurate.
This commit fixes the problem by removing of pinned map from bpffs.
Also, this commit add the executable permission to shell script
files.
Fixes: f74599f7c5309 ("bpf: Add tests and samples for LWT-BPF")
Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20201124090310.24374-7-danieltimlee@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
samples/bpf/lwt_len_hist.sh | 2 ++
samples/bpf/test_lwt_bpf.sh | 0
2 files changed, 2 insertions(+)
mode change 100644 => 100755 samples/bpf/lwt_len_hist.sh
mode change 100644 => 100755 samples/bpf/test_lwt_bpf.sh
diff --git a/samples/bpf/lwt_len_hist.sh b/samples/bpf/lwt_len_hist.sh
old mode 100644
new mode 100755
index 090b96eaf7f76..0eda9754f50b8
--- a/samples/bpf/lwt_len_hist.sh
+++ b/samples/bpf/lwt_len_hist.sh
@@ -8,6 +8,8 @@ VETH1=tst_lwt1b
TRACE_ROOT=/sys/kernel/debug/tracing
function cleanup {
+ # To reset saved histogram, remove pinned map
+ rm /sys/fs/bpf/tc/globals/lwt_len_hist_map
ip route del 192.168.253.2/32 dev $VETH0 2> /dev/null
ip link del $VETH0 2> /dev/null
ip link del $VETH1 2> /dev/null
diff --git a/samples/bpf/test_lwt_bpf.sh b/samples/bpf/test_lwt_bpf.sh
old mode 100644
new mode 100755
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 114/242] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 113/242] samples: bpf: Fix lwt_len_hist reusing previous BPF map Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 115/242] media: max2175: fix max2175_set_csm_mode() error code Greg Kroah-Hartman
` (128 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
Serge Semin, Thomas Bogendoerfer, Sasha Levin
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ]
kfree(dev) has been called inside put_device so anther
kfree would cause a use-after-free bug/
Fixes: 8286ae03308c ("MIPS: Add CDMM bus support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/mips_cdmm.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c
index 1b14256376d24..7c1da45be166e 100644
--- a/drivers/bus/mips_cdmm.c
+++ b/drivers/bus/mips_cdmm.c
@@ -544,10 +544,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus)
dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id);
++id;
ret = device_register(&dev->dev);
- if (ret) {
+ if (ret)
put_device(&dev->dev);
- kfree(dev);
- }
}
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 115/242] media: max2175: fix max2175_set_csm_mode() error code
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 114/242] mips: cdmm: fix use-after-free in mips_cdmm_bus_discover Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 116/242] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller() Greg Kroah-Hartman
` (127 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mauro Carvalho Chehab,
Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 9b1b0cb0636166187478ef68d5b95f5caea062ec ]
This is supposed to return negative error codes but the type is bool so
it returns true instead.
Fixes: b47b79d8a231 ("[media] media: i2c: max2175: Add MAX2175 support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/max2175.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/max2175.c b/drivers/media/i2c/max2175.c
index bf0e821a2b933..5cd09501ca7df 100644
--- a/drivers/media/i2c/max2175.c
+++ b/drivers/media/i2c/max2175.c
@@ -511,7 +511,7 @@ static void max2175_set_bbfilter(struct max2175 *ctx)
}
}
-static bool max2175_set_csm_mode(struct max2175 *ctx,
+static int max2175_set_csm_mode(struct max2175 *ctx,
enum max2175_csm_mode new_mode)
{
int ret = max2175_poll_csm_ready(ctx);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 116/242] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 115/242] media: max2175: fix max2175_set_csm_mode() error code Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 117/242] ARM: dts: Remove non-existent i2c1 from 98dx3236 Greg Kroah-Hartman
` (126 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Sebastian Reichel,
Sasha Levin
From: Jing Xiangfeng <jingxiangfeng@huawei.com>
[ Upstream commit 41fff6e19bc8d6d8bca79ea388427c426e72e097 ]
In current code, it jumps to ida_simple_remove() when ida_simple_get()
failes to allocate an ID. Just return to fix it.
Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hsi/controllers/omap_ssi_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
index 88e48b3469164..3554443a609cb 100644
--- a/drivers/hsi/controllers/omap_ssi_core.c
+++ b/drivers/hsi/controllers/omap_ssi_core.c
@@ -389,7 +389,7 @@ static int ssi_add_controller(struct hsi_controller *ssi,
err = ida_simple_get(&platform_omap_ssi_ida, 0, 0, GFP_KERNEL);
if (err < 0)
- goto out_err;
+ return err;
ssi->id = err;
ssi->owner = THIS_MODULE;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 117/242] ARM: dts: Remove non-existent i2c1 from 98dx3236
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 116/242] HSI: omap_ssi: Dont jump to free ID in ssi_add_controller() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 118/242] power: supply: bq24190_charger: fix reference leak Greg Kroah-Hartman
` (125 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Packham, Andrew Lunn,
Gregory CLEMENT, Sasha Levin
From: Chris Packham <chris.packham@alliedtelesis.co.nz>
[ Upstream commit 7f24479ead579459106bb55c2320a000135731f9 ]
The switches with integrated CPUs have only got a single i2c controller.
They incorrectly gained one when they were split from the Armada-XP.
Fixes: 43e28ba87708 ("ARM: dts: Use armada-370-xp as a base for armada-xp-98dx3236")
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 -----
1 file changed, 5 deletions(-)
diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
index bdd4c7a45fbf4..8d1356311e3f0 100644
--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
@@ -303,11 +303,6 @@
reg = <0x11000 0x100>;
};
-&i2c1 {
- compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c";
- reg = <0x11100 0x100>;
-};
-
&mpic {
reg = <0x20a00 0x2d0>, <0x21070 0x58>;
};
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 118/242] power: supply: bq24190_charger: fix reference leak
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 117/242] ARM: dts: Remove non-existent i2c1 from 98dx3236 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 119/242] genirq/irqdomain: Dont try to free an interrupt that has no mapping Greg Kroah-Hartman
` (124 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Sebastian Reichel, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit b2f6cb78eaa1cad57dd3fe11d0458cd4fae9a584 ]
pm_runtime_get_sync will increment pm usage counter even it
failed. Forgetting to call pm_runtime_put_noidle will result
in reference leak in callers(bq24190_sysfs_show,
bq24190_charger_get_property, bq24190_charger_set_property,
bq24190_battery_get_property, bq24190_battery_set_property),
so we should fix it.
Fixes: f385e6e2a1532 ("power: bq24190_charger: Use PM runtime autosuspend")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/bq24190_charger.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
index 35ff406aca483..0906f6b562bc4 100644
--- a/drivers/power/supply/bq24190_charger.c
+++ b/drivers/power/supply/bq24190_charger.c
@@ -450,8 +450,10 @@ static ssize_t bq24190_sysfs_show(struct device *dev,
return -EINVAL;
ret = pm_runtime_get_sync(bdi->dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(bdi->dev);
return ret;
+ }
ret = bq24190_read_mask(bdi, info->reg, info->mask, info->shift, &v);
if (ret)
@@ -1086,8 +1088,10 @@ static int bq24190_charger_get_property(struct power_supply *psy,
dev_dbg(bdi->dev, "prop: %d\n", psp);
ret = pm_runtime_get_sync(bdi->dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(bdi->dev);
return ret;
+ }
switch (psp) {
case POWER_SUPPLY_PROP_CHARGE_TYPE:
@@ -1158,8 +1162,10 @@ static int bq24190_charger_set_property(struct power_supply *psy,
dev_dbg(bdi->dev, "prop: %d\n", psp);
ret = pm_runtime_get_sync(bdi->dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(bdi->dev);
return ret;
+ }
switch (psp) {
case POWER_SUPPLY_PROP_ONLINE:
@@ -1424,8 +1430,10 @@ static int bq24190_battery_get_property(struct power_supply *psy,
dev_dbg(bdi->dev, "prop: %d\n", psp);
ret = pm_runtime_get_sync(bdi->dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(bdi->dev);
return ret;
+ }
switch (psp) {
case POWER_SUPPLY_PROP_STATUS:
@@ -1470,8 +1478,10 @@ static int bq24190_battery_set_property(struct power_supply *psy,
dev_dbg(bdi->dev, "prop: %d\n", psp);
ret = pm_runtime_get_sync(bdi->dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put_noidle(bdi->dev);
return ret;
+ }
switch (psp) {
case POWER_SUPPLY_PROP_ONLINE:
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 119/242] genirq/irqdomain: Dont try to free an interrupt that has no mapping
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 118/242] power: supply: bq24190_charger: fix reference leak Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 120/242] PCI: iproc: Fix out-of-bound array accesses Greg Kroah-Hartman
` (123 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Thomas Gleixner, Sasha Levin
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit 4615fbc3788ddc8e7c6d697714ad35a53729aa2c ]
When an interrupt allocation fails for N interrupts, it is pretty
common for the error handling code to free the same number of interrupts,
no matter how many interrupts have actually been allocated.
This may result in the domain freeing code to be unexpectedly called
for interrupts that have no mapping in that domain. Things end pretty
badly.
Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure
that thiss does not follow the hierarchy if no mapping exists for a given
interrupt.
Fixes: 6a6544e520abe ("genirq/irqdomain: Remove auto-recursive hierarchy support")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20201129135551.396777-1-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/irq/irqdomain.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 0d54f8256b9f4..cafea68749e0a 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1364,8 +1364,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain,
unsigned int irq_base,
unsigned int nr_irqs)
{
- if (domain->ops->free)
- domain->ops->free(domain, irq_base, nr_irqs);
+ unsigned int i;
+
+ if (!domain->ops->free)
+ return;
+
+ for (i = 0; i < nr_irqs; i++) {
+ if (irq_domain_get_irq_data(domain, irq_base + i))
+ domain->ops->free(domain, irq_base + i, 1);
+ }
}
int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 120/242] PCI: iproc: Fix out-of-bound array accesses
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 119/242] genirq/irqdomain: Dont try to free an interrupt that has no mapping Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 121/242] ARM: dts: at91: at91sam9rl: fix ADC triggers Greg Kroah-Hartman
` (122 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bharat Gooty, Lorenzo Pieralisi, Sasha Levin
From: Bharat Gooty <bharat.gooty@broadcom.com>
[ Upstream commit a3ff529f5d368a17ff35ada8009e101162ebeaf9 ]
Declare the full size array for all revisions of PAX register sets
to avoid potentially out of bound access of the register array
when they are being initialized in iproc_pcie_rev_init().
Link: https://lore.kernel.org/r/20201001060054.6616-2-srinath.mannam@broadcom.com
Fixes: 06324ede76cdf ("PCI: iproc: Improve core register population")
Signed-off-by: Bharat Gooty <bharat.gooty@broadcom.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/host/pcie-iproc.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/pci/host/pcie-iproc.c b/drivers/pci/host/pcie-iproc.c
index 8f8dac0155d63..2565abbe1a910 100644
--- a/drivers/pci/host/pcie-iproc.c
+++ b/drivers/pci/host/pcie-iproc.c
@@ -306,7 +306,7 @@ enum iproc_pcie_reg {
};
/* iProc PCIe PAXB BCMA registers */
-static const u16 iproc_pcie_reg_paxb_bcma[] = {
+static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG] = {
[IPROC_PCIE_CLK_CTRL] = 0x000,
[IPROC_PCIE_CFG_IND_ADDR] = 0x120,
[IPROC_PCIE_CFG_IND_DATA] = 0x124,
@@ -317,7 +317,7 @@ static const u16 iproc_pcie_reg_paxb_bcma[] = {
};
/* iProc PCIe PAXB registers */
-static const u16 iproc_pcie_reg_paxb[] = {
+static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG] = {
[IPROC_PCIE_CLK_CTRL] = 0x000,
[IPROC_PCIE_CFG_IND_ADDR] = 0x120,
[IPROC_PCIE_CFG_IND_DATA] = 0x124,
@@ -333,7 +333,7 @@ static const u16 iproc_pcie_reg_paxb[] = {
};
/* iProc PCIe PAXB v2 registers */
-static const u16 iproc_pcie_reg_paxb_v2[] = {
+static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = {
[IPROC_PCIE_CLK_CTRL] = 0x000,
[IPROC_PCIE_CFG_IND_ADDR] = 0x120,
[IPROC_PCIE_CFG_IND_DATA] = 0x124,
@@ -361,7 +361,7 @@ static const u16 iproc_pcie_reg_paxb_v2[] = {
};
/* iProc PCIe PAXC v1 registers */
-static const u16 iproc_pcie_reg_paxc[] = {
+static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG] = {
[IPROC_PCIE_CLK_CTRL] = 0x000,
[IPROC_PCIE_CFG_IND_ADDR] = 0x1f0,
[IPROC_PCIE_CFG_IND_DATA] = 0x1f4,
@@ -370,7 +370,7 @@ static const u16 iproc_pcie_reg_paxc[] = {
};
/* iProc PCIe PAXC v2 registers */
-static const u16 iproc_pcie_reg_paxc_v2[] = {
+static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG] = {
[IPROC_PCIE_MSI_GIC_MODE] = 0x050,
[IPROC_PCIE_MSI_BASE_ADDR] = 0x074,
[IPROC_PCIE_MSI_WINDOW_SIZE] = 0x078,
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 121/242] ARM: dts: at91: at91sam9rl: fix ADC triggers
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 120/242] PCI: iproc: Fix out-of-bound array accesses Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 122/242] ath10k: Fix an error handling path Greg Kroah-Hartman
` (121 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexandre Belloni, Sasha Levin
From: Alexandre Belloni <alexandre.belloni@bootlin.com>
[ Upstream commit 851a95da583c26e2ddeb7281e9b61f0d76ea5aba ]
The triggers for the ADC were taken from at91sam9260 dtsi but are not
correct.
Fixes: a4c1d6c75822 ("ARM: at91/dt: sam9rl: add lcd, adc, usb gadget and pwm support")
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20201128222818.1910764-10-alexandre.belloni@bootlin.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/at91sam9rl.dtsi | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi
index 7768342a66385..64273f9439926 100644
--- a/arch/arm/boot/dts/at91sam9rl.dtsi
+++ b/arch/arm/boot/dts/at91sam9rl.dtsi
@@ -274,23 +274,26 @@
atmel,adc-use-res = "highres";
trigger0 {
- trigger-name = "timer-counter-0";
+ trigger-name = "external-rising";
trigger-value = <0x1>;
+ trigger-external;
};
+
trigger1 {
- trigger-name = "timer-counter-1";
- trigger-value = <0x3>;
+ trigger-name = "external-falling";
+ trigger-value = <0x2>;
+ trigger-external;
};
trigger2 {
- trigger-name = "timer-counter-2";
- trigger-value = <0x5>;
+ trigger-name = "external-any";
+ trigger-value = <0x3>;
+ trigger-external;
};
trigger3 {
- trigger-name = "external";
- trigger-value = <0x13>;
- trigger-external;
+ trigger-name = "continuous";
+ trigger-value = <0x6>;
};
};
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 122/242] ath10k: Fix an error handling path
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 121/242] ARM: dts: at91: at91sam9rl: fix ADC triggers Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 123/242] ath10k: Release some resources in " Greg Kroah-Hartman
` (120 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Kalle Valo, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit ed3573bc3943c27d2d8e405a242f87ed14572ca1 ]
If 'ath10k_usb_create()' fails, we should release some resources and report
an error instead of silently continuing.
Fixes: 4db66499df91 ("ath10k: add initial USB support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201122170342.1346011-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/usb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index c64a03f164c0f..f4e6d84bfb91c 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -1019,6 +1019,8 @@ static int ath10k_usb_probe(struct usb_interface *interface,
ar_usb = ath10k_usb_priv(ar);
ret = ath10k_usb_create(ar, interface);
+ if (ret)
+ goto err;
ar_usb->ar = ar;
ar->dev_id = product_id;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 123/242] ath10k: Release some resources in an error handling path
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 122/242] ath10k: Fix an error handling path Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 124/242] NFSv4.2: condition READDIRs mask for security label based on LSM state Greg Kroah-Hartman
` (119 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Kalle Valo, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 6364e693f4a7a89a2fb3dd2cbd6cc06d5fd6e26d ]
Should an error occur after calling 'ath10k_usb_create()', it should be
undone by a corresponding 'ath10k_usb_destroy()' call
Fixes: 4db66499df91 ("ath10k: add initial USB support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20201122170358.1346065-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/usb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index f4e6d84bfb91c..16d5fe6d1e2e4 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -1032,7 +1032,7 @@ static int ath10k_usb_probe(struct usb_interface *interface,
ret = ath10k_core_register(ar, chip_id);
if (ret) {
ath10k_warn(ar, "failed to register driver core: %d\n", ret);
- goto err;
+ goto err_usb_destroy;
}
/* TODO: remove this once USB support is fully implemented */
@@ -1040,6 +1040,9 @@ static int ath10k_usb_probe(struct usb_interface *interface,
return 0;
+err_usb_destroy:
+ ath10k_usb_destroy(ar);
+
err:
ath10k_core_destroy(ar);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 124/242] NFSv4.2: condition READDIRs mask for security label based on LSM state
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 123/242] ath10k: Release some resources in " Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 125/242] SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Greg Kroah-Hartman
` (118 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ondrej Mosnacek, Scott Mayhew,
Olga Kornievskaia, Trond Myklebust, Sasha Levin
From: Olga Kornievskaia <kolga@netapp.com>
[ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ]
Currently, the client will always ask for security_labels if the server
returns that it supports that feature regardless of any LSM modules
(such as Selinux) enforcing security policy. This adds performance
penalty to the READDIR operation.
Client adjusts superblock's support of the security_label based on
the server's support but also current client's configuration of the
LSM modules. Thus, prior to using the default bitmask in READDIR,
this patch checks the server's capabilities and then instructs
READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask.
v5: fixing silly mistakes of the rushed v4
v4: simplifying logic
v3: changing label's initialization per Ondrej's comment
v2: dropping selinux hook and using the sb cap.
Suggested-by: Ondrej Mosnacek <omosnace@redhat.com>
Suggested-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Fixes: 2b0143b5c986 ("VFS: normal filesystems (and lustre): d_inode() annotations")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index bb899a6fe8ac0..9f2ba4874f10f 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4445,12 +4445,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
u64 cookie, struct page **pages, unsigned int count, bool plus)
{
struct inode *dir = d_inode(dentry);
+ struct nfs_server *server = NFS_SERVER(dir);
struct nfs4_readdir_arg args = {
.fh = NFS_FH(dir),
.pages = pages,
.pgbase = 0,
.count = count,
- .bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask,
.plus = plus,
};
struct nfs4_readdir_res res;
@@ -4465,9 +4465,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__,
dentry,
(unsigned long long)cookie);
+ if (!(server->caps & NFS_CAP_SECURITY_LABEL))
+ args.bitmask = server->attr_bitmask_nl;
+ else
+ args.bitmask = server->attr_bitmask;
+
nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
res.pgbase = args.pgbase;
- status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
+ status = nfs4_call_sync(server->client, server, &msg, &args.seq_args,
+ &res.seq_res, 0);
if (status >= 0) {
memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
status += args.pgbase;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 125/242] SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 124/242] NFSv4.2: condition READDIRs mask for security label based on LSM state Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 126/242] lockd: dont use interval-based rebinding over TCP Greg Kroah-Hartman
` (117 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit d5aa6b22e2258f05317313ecc02efbb988ed6d38 ]
According to RFC5666, the correct netid for an IPv6 addressed RDMA
transport is "rdma6", which we've supported as a mount option since
Linux-4.7. The problem is when we try to load the module "xprtrdma6",
that will fail, since there is no modulealias of that name.
Fixes: 181342c5ebe8 ("xprtrdma: Add rdma6 option to support NFS/RDMA IPv6")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/sunrpc/xprt.h | 1 +
net/sunrpc/xprt.c | 65 +++++++++++++++++++++++++--------
net/sunrpc/xprtrdma/module.c | 1 +
net/sunrpc/xprtrdma/transport.c | 1 +
net/sunrpc/xprtsock.c | 4 ++
5 files changed, 56 insertions(+), 16 deletions(-)
diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index 7fad83881ce19..9785715eea145 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -316,6 +316,7 @@ struct xprt_class {
struct rpc_xprt * (*setup)(struct xprt_create *);
struct module *owner;
char name[32];
+ const char * netid[];
};
/*
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index b852c34bb6373..7b1213be3e81a 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -143,31 +143,64 @@ out:
}
EXPORT_SYMBOL_GPL(xprt_unregister_transport);
+static void
+xprt_class_release(const struct xprt_class *t)
+{
+ module_put(t->owner);
+}
+
+static const struct xprt_class *
+xprt_class_find_by_netid_locked(const char *netid)
+{
+ const struct xprt_class *t;
+ unsigned int i;
+
+ list_for_each_entry(t, &xprt_list, list) {
+ for (i = 0; t->netid[i][0] != '\0'; i++) {
+ if (strcmp(t->netid[i], netid) != 0)
+ continue;
+ if (!try_module_get(t->owner))
+ continue;
+ return t;
+ }
+ }
+ return NULL;
+}
+
+static const struct xprt_class *
+xprt_class_find_by_netid(const char *netid)
+{
+ const struct xprt_class *t;
+
+ spin_lock(&xprt_list_lock);
+ t = xprt_class_find_by_netid_locked(netid);
+ if (!t) {
+ spin_unlock(&xprt_list_lock);
+ request_module("rpc%s", netid);
+ spin_lock(&xprt_list_lock);
+ t = xprt_class_find_by_netid_locked(netid);
+ }
+ spin_unlock(&xprt_list_lock);
+ return t;
+}
+
/**
* xprt_load_transport - load a transport implementation
- * @transport_name: transport to load
+ * @netid: transport to load
*
* Returns:
* 0: transport successfully loaded
* -ENOENT: transport module not available
*/
-int xprt_load_transport(const char *transport_name)
+int xprt_load_transport(const char *netid)
{
- struct xprt_class *t;
- int result;
+ const struct xprt_class *t;
- result = 0;
- spin_lock(&xprt_list_lock);
- list_for_each_entry(t, &xprt_list, list) {
- if (strcmp(t->name, transport_name) == 0) {
- spin_unlock(&xprt_list_lock);
- goto out;
- }
- }
- spin_unlock(&xprt_list_lock);
- result = request_module("xprt%s", transport_name);
-out:
- return result;
+ t = xprt_class_find_by_netid(netid);
+ if (!t)
+ return -ENOENT;
+ xprt_class_release(t);
+ return 0;
}
EXPORT_SYMBOL_GPL(xprt_load_transport);
diff --git a/net/sunrpc/xprtrdma/module.c b/net/sunrpc/xprtrdma/module.c
index 560712bd9fa2c..dd227de31a589 100644
--- a/net/sunrpc/xprtrdma/module.c
+++ b/net/sunrpc/xprtrdma/module.c
@@ -19,6 +19,7 @@ MODULE_DESCRIPTION("RPC/RDMA Transport");
MODULE_LICENSE("Dual BSD/GPL");
MODULE_ALIAS("svcrdma");
MODULE_ALIAS("xprtrdma");
+MODULE_ALIAS("rpcrdma6");
static void __exit rpc_rdma_cleanup(void)
{
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index b1b40a1be8c57..ead20e6754ab7 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -849,6 +849,7 @@ static struct xprt_class xprt_rdma = {
.owner = THIS_MODULE,
.ident = XPRT_TRANSPORT_RDMA,
.setup = xprt_setup_rdma,
+ .netid = { "rdma", "rdma6", "" },
};
void xprt_rdma_cleanup(void)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index f75b5b7c1fc2a..5124a21ecfa39 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -3208,6 +3208,7 @@ static struct xprt_class xs_local_transport = {
.owner = THIS_MODULE,
.ident = XPRT_TRANSPORT_LOCAL,
.setup = xs_setup_local,
+ .netid = { "" },
};
static struct xprt_class xs_udp_transport = {
@@ -3216,6 +3217,7 @@ static struct xprt_class xs_udp_transport = {
.owner = THIS_MODULE,
.ident = XPRT_TRANSPORT_UDP,
.setup = xs_setup_udp,
+ .netid = { "udp", "udp6", "" },
};
static struct xprt_class xs_tcp_transport = {
@@ -3224,6 +3226,7 @@ static struct xprt_class xs_tcp_transport = {
.owner = THIS_MODULE,
.ident = XPRT_TRANSPORT_TCP,
.setup = xs_setup_tcp,
+ .netid = { "tcp", "tcp6", "" },
};
static struct xprt_class xs_bc_tcp_transport = {
@@ -3232,6 +3235,7 @@ static struct xprt_class xs_bc_tcp_transport = {
.owner = THIS_MODULE,
.ident = XPRT_TRANSPORT_BC_TCP,
.setup = xs_setup_bc_tcp,
+ .netid = { "" },
};
/**
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 126/242] lockd: dont use interval-based rebinding over TCP
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 125/242] SUNRPC: xprt_load_transport() needs to support the netid "rdma6" Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 127/242] NFS: switch nfsiod to be an UNBOUND workqueue Greg Kroah-Hartman
` (116 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Calum Mackay, Trond Myklebust, Sasha Levin
From: Calum Mackay <calum.mackay@oracle.com>
[ Upstream commit 9b82d88d5976e5f2b8015d58913654856576ace5 ]
NLM uses an interval-based rebinding, i.e. it clears the transport's
binding under certain conditions if more than 60 seconds have elapsed
since the connection was last bound.
This rebinding is not necessary for an autobind RPC client over a
connection-oriented protocol like TCP.
It can also cause problems: it is possible for nlm_bind_host() to clear
XPRT_BOUND whilst a connection worker is in the middle of trying to
reconnect, after it had already been checked in xprt_connect().
When the connection worker notices that XPRT_BOUND has been cleared
under it, in xs_tcp_finish_connecting(), that results in:
xs_tcp_setup_socket: connect returned unhandled error -107
Worse, it's possible that the two can get into lockstep, resulting in
the same behaviour repeated indefinitely, with the above error every
300 seconds, without ever recovering, and the connection never being
established. This has been seen in practice, with a large number of NLM
client tasks, following a server restart.
The existing callers of nlm_bind_host & nlm_rebind_host should not need
to force the rebind, for TCP, so restrict the interval-based rebinding
to UDP only.
For TCP, we will still rebind when needed, e.g. on timeout, and connection
error (including closure), since connection-related errors on an existing
connection, ECONNREFUSED when trying to connect, and rpc_check_timeout(),
already unconditionally clear XPRT_BOUND.
To avoid having to add the fix, and explanation, to both nlm_bind_host()
and nlm_rebind_host(), remove the duplicate code from the former, and
have it call the latter.
Drop the dprintk, which adds no value over a trace.
Signed-off-by: Calum Mackay <calum.mackay@oracle.com>
Fixes: 35f5a422ce1a ("SUNRPC: new interface to force an RPC rebind")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/lockd/host.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index c4504ed9f6807..9c39e13a28df2 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -431,12 +431,7 @@ nlm_bind_host(struct nlm_host *host)
* RPC rebind is required
*/
if ((clnt = host->h_rpcclnt) != NULL) {
- if (time_after_eq(jiffies, host->h_nextrebind)) {
- rpc_force_rebind(clnt);
- host->h_nextrebind = jiffies + NLM_HOST_REBIND;
- dprintk("lockd: next rebind in %lu jiffies\n",
- host->h_nextrebind - jiffies);
- }
+ nlm_rebind_host(host);
} else {
unsigned long increment = nlmsvc_timeout;
struct rpc_timeout timeparms = {
@@ -484,13 +479,20 @@ nlm_bind_host(struct nlm_host *host)
return clnt;
}
-/*
- * Force a portmap lookup of the remote lockd port
+/**
+ * nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port
+ * @host: NLM host handle for peer
+ *
+ * This is not needed when using a connection-oriented protocol, such as TCP.
+ * The existing autobind mechanism is sufficient to force a rebind when
+ * required, e.g. on connection state transitions.
*/
void
nlm_rebind_host(struct nlm_host *host)
{
- dprintk("lockd: rebind host %s\n", host->h_name);
+ if (host->h_proto != IPPROTO_UDP)
+ return;
+
if (host->h_rpcclnt && time_after_eq(jiffies, host->h_nextrebind)) {
rpc_force_rebind(host->h_rpcclnt);
host->h_nextrebind = jiffies + NLM_HOST_REBIND;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 127/242] NFS: switch nfsiod to be an UNBOUND workqueue.
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 126/242] lockd: dont use interval-based rebinding over TCP Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 128/242] vfio-pci: Use io_remap_pfn_range() for PCI IO memory Greg Kroah-Hartman
` (115 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, NeilBrown, Trond Myklebust, Sasha Levin
From: NeilBrown <neilb@suse.de>
[ Upstream commit bf701b765eaa82dd164d65edc5747ec7288bb5c3 ]
nfsiod is currently a concurrency-managed workqueue (CMWQ).
This means that workitems scheduled to nfsiod on a given CPU are queued
behind all other work items queued on any CMWQ on the same CPU. This
can introduce unexpected latency.
Occaionally nfsiod can even cause excessive latency. If the work item
to complete a CLOSE request calls the final iput() on an inode, the
address_space of that inode will be dismantled. This takes time
proportional to the number of in-memory pages, which on a large host
working on large files (e.g.. 5TB), can be a large number of pages
resulting in a noticable number of seconds.
We can avoid these latency problems by switching nfsiod to WQ_UNBOUND.
This causes each concurrent work item to gets a dedicated thread which
can be scheduled to an idle CPU.
There is precedent for this as several other filesystems use WQ_UNBOUND
workqueue for handling various async events.
Signed-off-by: NeilBrown <neilb@suse.de>
Fixes: ada609ee2ac2 ("workqueue: use WQ_MEM_RECLAIM instead of WQ_RESCUER")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 71a399f6805ac..f0534b356f071 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -2053,7 +2053,7 @@ static int nfsiod_start(void)
{
struct workqueue_struct *wq;
dprintk("RPC: creating workqueue nfsiod\n");
- wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM, 0);
+ wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM | WQ_UNBOUND, 0);
if (wq == NULL)
return -ENOMEM;
nfsiod_workqueue = wq;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 128/242] vfio-pci: Use io_remap_pfn_range() for PCI IO memory
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 127/242] NFS: switch nfsiod to be an UNBOUND workqueue Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 129/242] media: saa7146: fix array overflow in vidioc_s_audio() Greg Kroah-Hartman
` (114 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gunthorpe, Peter Xu,
Tom Lendacky, Alex Williamson, Sasha Levin
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 7b06a56d468b756ad6bb43ac21b11e474ebc54a0 ]
commit f8f6ae5d077a ("mm: always have io_remap_pfn_range() set
pgprot_decrypted()") allows drivers using mmap to put PCI memory mapped
BAR space into userspace to work correctly on AMD SME systems that default
to all memory encrypted.
Since vfio_pci_mmap_fault() is working with PCI memory mapped BAR space it
should be calling io_remap_pfn_range() otherwise it will not work on SME
systems.
Fixes: 11c4cd07ba11 ("vfio-pci: Fault mmaps to enable vma tracking")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Acked-by: Peter Xu <peterx@redhat.com>
Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/vfio_pci.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index ac1c54bcfe8fb..6fceefcab81db 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -1380,8 +1380,8 @@ static int vfio_pci_mmap_fault(struct vm_fault *vmf)
mutex_unlock(&vdev->vma_lock);
- if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
- vma->vm_end - vma->vm_start, vma->vm_page_prot))
+ if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+ vma->vm_end - vma->vm_start, vma->vm_page_prot))
ret = VM_FAULT_SIGBUS;
up_out:
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 129/242] media: saa7146: fix array overflow in vidioc_s_audio()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 128/242] vfio-pci: Use io_remap_pfn_range() for PCI IO memory Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 130/242] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Greg Kroah-Hartman
` (113 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ]
The "a->index" value comes from the user via the ioctl. The problem is
that the shift can wrap resulting in setting "mxb->cur_audinput" to an
invalid value, which later results in an array overflow.
Fixes: 6680427791c9 ("[media] mxb: fix audio handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/saa7146/mxb.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c
index 930218cc2de19..2e7bd82282caa 100644
--- a/drivers/media/pci/saa7146/mxb.c
+++ b/drivers/media/pci/saa7146/mxb.c
@@ -652,16 +652,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio *
struct mxb *mxb = (struct mxb *)dev->ext_priv;
DEB_D("VIDIOC_S_AUDIO %d\n", a->index);
- if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) {
- if (mxb->cur_audinput != a->index) {
- mxb->cur_audinput = a->index;
- tea6420_route(mxb, a->index);
- if (mxb->cur_audinput == 0)
- mxb_update_audmode(mxb);
- }
- return 0;
+ if (a->index >= 32 ||
+ !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index)))
+ return -EINVAL;
+
+ if (mxb->cur_audinput != a->index) {
+ mxb->cur_audinput = a->index;
+ tea6420_route(mxb, a->index);
+ if (mxb->cur_audinput == 0)
+ mxb_update_audmode(mxb);
}
- return -EINVAL;
+ return 0;
}
#ifdef CONFIG_VIDEO_ADV_DEBUG
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 130/242] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 129/242] media: saa7146: fix array overflow in vidioc_s_audio() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 131/242] ARM: dts: at91: sama5d2: map securam as device Greg Kroah-Hartman
` (112 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yu Kuai, Daniel Lezcano,
Sasha Levin
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit eee422c46e6840a81c9db18a497b74387a557b29 ]
If clk_notifier_register() failed, ttc_setup_clockevent() will return
without freeing 'ttcce', which will leak memory.
Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201116135123.2164033-1-yukuai3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/cadence_ttc_timer.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/clocksource/cadence_ttc_timer.c b/drivers/clocksource/cadence_ttc_timer.c
index 29d51755e18b2..a7eb858a84a0f 100644
--- a/drivers/clocksource/cadence_ttc_timer.c
+++ b/drivers/clocksource/cadence_ttc_timer.c
@@ -419,10 +419,8 @@ static int __init ttc_setup_clockevent(struct clk *clk,
ttcce->ttc.clk = clk;
err = clk_prepare_enable(ttcce->ttc.clk);
- if (err) {
- kfree(ttcce);
- return err;
- }
+ if (err)
+ goto out_kfree;
ttcce->ttc.clk_rate_change_nb.notifier_call =
ttc_rate_change_clockevent_cb;
@@ -432,7 +430,7 @@ static int __init ttc_setup_clockevent(struct clk *clk,
&ttcce->ttc.clk_rate_change_nb);
if (err) {
pr_warn("Unable to register clock notifier.\n");
- return err;
+ goto out_kfree;
}
ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk);
@@ -461,15 +459,17 @@ static int __init ttc_setup_clockevent(struct clk *clk,
err = request_irq(irq, ttc_clock_event_interrupt,
IRQF_TIMER, ttcce->ce.name, ttcce);
- if (err) {
- kfree(ttcce);
- return err;
- }
+ if (err)
+ goto out_kfree;
clockevents_config_and_register(&ttcce->ce,
ttcce->ttc.freq / PRESCALE, 1, 0xfffe);
return 0;
+
+out_kfree:
+ kfree(ttcce);
+ return err;
}
/**
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 131/242] ARM: dts: at91: sama5d2: map securam as device
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 130/242] clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 132/242] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Greg Kroah-Hartman
` (111 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Alexandre Belloni,
Nicolas Ferre, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 9b5dcc8d427e2bcb84c49eb03ffefe11e7537a55 ]
Due to strobe signal not being propagated from CPU to securam
the securam needs to be mapped as device or strongly ordered memory
to work properly. Otherwise, updating to one offset may affect
the adjacent locations in securam.
Fixes: d4ce5f44d4409 ("ARM: dts: at91: sama5d2: Add securam node")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/1606903025-14197-3-git-send-email-claudiu.beznea@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/sama5d2.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index a8e4b89097d9c..8a09c2eab0f97 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -1243,6 +1243,7 @@
clocks = <&securam_clk>;
#address-cells = <1>;
#size-cells = <1>;
+ no-memory-wc;
ranges = <0 0xf8044000 0x1420>;
};
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 132/242] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 131/242] ARM: dts: at91: sama5d2: map securam as device Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 133/242] arm64: dts: rockchip: Fix UART pull-ups on rk3328 Greg Kroah-Hartman
` (110 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yu Kuai, Linus Walleij, Sasha Levin
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 89cce2b3f247a434ee174ab6803698041df98014 ]
if of_find_device_by_node() succeed, pinctrl_falcon_probe() doesn't have
a corresponding put_device(). Thus add put_device() to fix the exception
handling for this function implementation.
Fixes: e316cb2b16bb ("OF: pinctrl: MIPS: lantiq: adds support for FALCON SoC")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20201119011219.2248232-1-yukuai3@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-falcon.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c
index fb73dcbb5ef37..68dcf53aaac34 100644
--- a/drivers/pinctrl/pinctrl-falcon.c
+++ b/drivers/pinctrl/pinctrl-falcon.c
@@ -438,24 +438,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev)
/* load and remap the pad resources of the different banks */
for_each_compatible_node(np, NULL, "lantiq,pad-falcon") {
- struct platform_device *ppdev = of_find_device_by_node(np);
const __be32 *bank = of_get_property(np, "lantiq,bank", NULL);
struct resource res;
+ struct platform_device *ppdev;
u32 avail;
int pins;
if (!of_device_is_available(np))
continue;
- if (!ppdev) {
- dev_err(&pdev->dev, "failed to find pad pdev\n");
- continue;
- }
if (!bank || *bank >= PORTS)
continue;
if (of_address_to_resource(np, 0, &res))
continue;
+
+ ppdev = of_find_device_by_node(np);
+ if (!ppdev) {
+ dev_err(&pdev->dev, "failed to find pad pdev\n");
+ continue;
+ }
+
falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL);
+ put_device(&ppdev->dev);
if (IS_ERR(falcon_info.clk[*bank])) {
dev_err(&ppdev->dev, "failed to get clock\n");
return PTR_ERR(falcon_info.clk[*bank]);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 133/242] arm64: dts: rockchip: Fix UART pull-ups on rk3328
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 132/242] pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe() Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:48 ` [PATCH 4.14 134/242] memstick: r592: Fix error return in r592_probe() Greg Kroah-Hartman
` (109 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Heiko Stuebner, Sasha Levin
From: Chen-Yu Tsai <wens@csie.org>
[ Upstream commit 94dad6bed3c86c00050bf7c2b2ad6b630facae31 ]
For UARTs, the local pull-ups should be on the RX pin, not the TX pin.
UARTs transmit active-low, so a disconnected RX pin should be pulled
high instead of left floating to prevent noise being interpreted as
transmissions.
This gets rid of bogus sysrq events when the UART console is not
connected.
Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20201204064805.6480-1-wens@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index c34daae3c37c2..6c3684885fac0 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -1062,8 +1062,8 @@
uart0 {
uart0_xfer: uart0-xfer {
- rockchip,pins = <1 RK_PB1 1 &pcfg_pull_up>,
- <1 RK_PB0 1 &pcfg_pull_none>;
+ rockchip,pins = <1 RK_PB1 1 &pcfg_pull_none>,
+ <1 RK_PB0 1 &pcfg_pull_up>;
};
uart0_cts: uart0-cts {
@@ -1081,8 +1081,8 @@
uart1 {
uart1_xfer: uart1-xfer {
- rockchip,pins = <3 RK_PA4 4 &pcfg_pull_up>,
- <3 RK_PA6 4 &pcfg_pull_none>;
+ rockchip,pins = <3 RK_PA4 4 &pcfg_pull_none>,
+ <3 RK_PA6 4 &pcfg_pull_up>;
};
uart1_cts: uart1-cts {
@@ -1100,15 +1100,15 @@
uart2-0 {
uart2m0_xfer: uart2m0-xfer {
- rockchip,pins = <1 RK_PA0 2 &pcfg_pull_up>,
- <1 RK_PA1 2 &pcfg_pull_none>;
+ rockchip,pins = <1 RK_PA0 2 &pcfg_pull_none>,
+ <1 RK_PA1 2 &pcfg_pull_up>;
};
};
uart2-1 {
uart2m1_xfer: uart2m1-xfer {
- rockchip,pins = <2 RK_PA0 1 &pcfg_pull_up>,
- <2 RK_PA1 1 &pcfg_pull_none>;
+ rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>,
+ <2 RK_PA1 1 &pcfg_pull_up>;
};
};
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 134/242] memstick: r592: Fix error return in r592_probe()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 133/242] arm64: dts: rockchip: Fix UART pull-ups on rk3328 Greg Kroah-Hartman
@ 2020-12-28 12:48 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 135/242] net/mlx5: Properly convey driver version to firmware Greg Kroah-Hartman
` (108 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:48 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jing Xiangfeng, Ulf Hansson, Sasha Levin
From: Jing Xiangfeng <jingxiangfeng@huawei.com>
[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ]
Fix to return a error code from the error handling case instead of 0.
Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memstick/host/r592.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
index d5cfb503b9d69..2539984c1db1c 100644
--- a/drivers/memstick/host/r592.c
+++ b/drivers/memstick/host/r592.c
@@ -762,8 +762,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
goto error3;
dev->mmio = pci_ioremap_bar(pdev, 0);
- if (!dev->mmio)
+ if (!dev->mmio) {
+ error = -ENOMEM;
goto error4;
+ }
dev->irq = pdev->irq;
spin_lock_init(&dev->irq_lock);
@@ -790,12 +792,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
&dev->dummy_dma_page_physical_address, GFP_KERNEL);
r592_stop_dma(dev , 0);
- if (request_irq(dev->irq, &r592_irq, IRQF_SHARED,
- DRV_NAME, dev))
+ error = request_irq(dev->irq, &r592_irq, IRQF_SHARED,
+ DRV_NAME, dev);
+ if (error)
goto error6;
r592_update_card_detect(dev);
- if (memstick_add_host(host))
+ error = memstick_add_host(host);
+ if (error)
goto error7;
message("driver successfully loaded");
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 135/242] net/mlx5: Properly convey driver version to firmware
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2020-12-28 12:48 ` [PATCH 4.14 134/242] memstick: r592: Fix error return in r592_probe() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 136/242] ASoC: jz4740-i2s: add missed checks for clk_get() Greg Kroah-Hartman
` (107 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Sasha Levin
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 907af0f0cab4ee5d5604f182ecec2c5b5119d294 ]
mlx5 firmware expects driver version in specific format X.X.X, so
make it always correct and based on real kernel version aligned with
the driver.
Fixes: 012e50e109fd ("net/mlx5: Set driver version into firmware")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 1ac0e173da12c..049d9d19c66d9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -51,6 +51,7 @@
#ifdef CONFIG_RFS_ACCEL
#include <linux/cpu_rmap.h>
#endif
+#include <linux/version.h>
#include <net/devlink.h>
#include "mlx5_core.h"
#include "fs_core.h"
@@ -204,7 +205,10 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev)
strncat(string, ",", remaining_size);
remaining_size = max_t(int, 0, driver_ver_sz - strlen(string));
- strncat(string, DRIVER_VERSION, remaining_size);
+
+ snprintf(string + strlen(string), remaining_size, "%u.%u.%u",
+ (u8)((LINUX_VERSION_CODE >> 16) & 0xff), (u8)((LINUX_VERSION_CODE >> 8) & 0xff),
+ (u16)(LINUX_VERSION_CODE & 0xffff));
/*Send the command*/
MLX5_SET(set_driver_version_in, in, opcode,
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 136/242] ASoC: jz4740-i2s: add missed checks for clk_get()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 135/242] net/mlx5: Properly convey driver version to firmware Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 137/242] dm ioctl: fix error return code in target_message Greg Kroah-Hartman
` (106 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chuhong Yuan, Mark Brown, Sasha Levin
From: Chuhong Yuan <hslester96@gmail.com>
[ Upstream commit 1c1fb2653a0c2e3f310c07eacd8fc3a10e08c97a ]
jz4740_i2s_set_sysclk() does not check the return values of clk_get(),
while the file dereferences the pointers in clk_put().
Add the missed checks to fix it.
Fixes: 11bd3dd1b7c2 ("ASoC: Add JZ4740 ASoC support")
Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/20201203144227.418194-1-hslester96@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/jz4740/jz4740-i2s.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c
index e099c0505b765..2c6b0ac97c684 100644
--- a/sound/soc/jz4740/jz4740-i2s.c
+++ b/sound/soc/jz4740/jz4740-i2s.c
@@ -318,10 +318,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id,
switch (clk_id) {
case JZ4740_I2S_CLKSRC_EXT:
parent = clk_get(NULL, "ext");
+ if (IS_ERR(parent))
+ return PTR_ERR(parent);
clk_set_parent(i2s->clk_i2s, parent);
break;
case JZ4740_I2S_CLKSRC_PLL:
parent = clk_get(NULL, "pll half");
+ if (IS_ERR(parent))
+ return PTR_ERR(parent);
clk_set_parent(i2s->clk_i2s, parent);
ret = clk_set_rate(i2s->clk_i2s, freq);
break;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 137/242] dm ioctl: fix error return code in target_message
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 136/242] ASoC: jz4740-i2s: add missed checks for clk_get() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 138/242] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Greg Kroah-Hartman
` (105 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
Mike Snitzer, Sasha Levin
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit 4d7659bfbe277a43399a4a2d90fca141e70f29e1 ]
Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.
Fixes: 2ca4c92f58f9 ("dm ioctl: prevent empty message")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-ioctl.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index ca948155191ac..469453e106d14 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1574,6 +1574,7 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
if (!argc) {
DMWARN("Empty message received.");
+ r = -EINVAL;
goto out_argv;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 138/242] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 137/242] dm ioctl: fix error return code in target_message Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 139/242] cpufreq: highbank: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
` (104 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Keqian Zhu,
Daniel Lezcano, Sasha Levin
From: Keqian Zhu <zhukeqian1@huawei.com>
[ Upstream commit 8b7770b877d187bfdae1eaf587bd2b792479a31c ]
ARM virtual counter supports event stream, it can only trigger an event
when the trigger bit (the value of CNTKCTL_EL1.EVNTI) of CNTVCT_EL0 changes,
so the actual period of event stream is 2^(cntkctl_evnti + 1). For example,
when the trigger bit is 0, then virtual counter trigger an event for every
two cycles.
While we're at it, rework the way we compute the trigger bit position
by making it more obvious that when bits [n:n-1] are both set (with n
being the most significant bit), we pick bit (n + 1).
Fixes: 037f637767a8 ("drivers: clocksource: add support for ARM architected timer event stream")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20201204073126.6920-3-zhukeqian1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/arm_arch_timer.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 14e2419063e93..2c5913057b87b 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -744,15 +744,24 @@ static void arch_timer_evtstrm_enable(int divider)
static void arch_timer_configure_evtstream(void)
{
- int evt_stream_div, pos;
+ int evt_stream_div, lsb;
+
+ /*
+ * As the event stream can at most be generated at half the frequency
+ * of the counter, use half the frequency when computing the divider.
+ */
+ evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ / 2;
+
+ /*
+ * Find the closest power of two to the divisor. If the adjacent bit
+ * of lsb (last set bit, starts from 0) is set, then we use (lsb + 1).
+ */
+ lsb = fls(evt_stream_div) - 1;
+ if (lsb > 0 && (evt_stream_div & BIT(lsb - 1)))
+ lsb++;
- /* Find the closest power of two to the divisor */
- evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ;
- pos = fls(evt_stream_div);
- if (pos > 1 && !(evt_stream_div & (1 << (pos - 2))))
- pos--;
/* enable event stream */
- arch_timer_evtstrm_enable(min(pos, 15));
+ arch_timer_evtstrm_enable(max(0, min(lsb, 15)));
}
static void arch_counter_set_user_access(void)
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 139/242] cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 138/242] clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 140/242] cpufreq: mediatek: " Greg Kroah-Hartman
` (103 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin
From: Pali Rohár <pali@kernel.org>
[ Upstream commit 9433777a6e0aae27468d3434b75cd51bb88ff711 ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.
Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 6754f556103be ("cpufreq / highbank: add support for highbank cpufreq")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/highbank-cpufreq.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
index 1608f7105c9f8..ad743f2f31e78 100644
--- a/drivers/cpufreq/highbank-cpufreq.c
+++ b/drivers/cpufreq/highbank-cpufreq.c
@@ -104,6 +104,13 @@ out_put_node:
}
module_init(hb_cpufreq_driver_init);
+static const struct of_device_id __maybe_unused hb_cpufreq_of_match[] = {
+ { .compatible = "calxeda,highbank" },
+ { .compatible = "calxeda,ecx-2000" },
+ { },
+};
+MODULE_DEVICE_TABLE(of, hb_cpufreq_of_match);
+
MODULE_AUTHOR("Mark Langsdorf <mark.langsdorf@calxeda.com>");
MODULE_DESCRIPTION("Calxeda Highbank cpufreq driver");
MODULE_LICENSE("GPL");
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 140/242] cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 139/242] cpufreq: highbank: Add missing MODULE_DEVICE_TABLE Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 141/242] cpufreq: st: " Greg Kroah-Hartman
` (102 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin
From: Pali Rohár <pali@kernel.org>
[ Upstream commit af6eca06501118af3e2ad46eee8edab20624b74e ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.
Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 501c574f4e3a5 ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/mediatek-cpufreq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
index 18c4bd9a5c656..993cd461e34c1 100644
--- a/drivers/cpufreq/mediatek-cpufreq.c
+++ b/drivers/cpufreq/mediatek-cpufreq.c
@@ -582,6 +582,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
{ }
};
+MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines);
static int __init mtk_cpufreq_driver_init(void)
{
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 141/242] cpufreq: st: Add missing MODULE_DEVICE_TABLE
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 140/242] cpufreq: mediatek: " Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 142/242] cpufreq: loongson1: Add missing MODULE_ALIAS Greg Kroah-Hartman
` (101 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin
From: Pali Rohár <pali@kernel.org>
[ Upstream commit 183747ab52654eb406fc6b5bfb40806b75d31811 ]
This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this cpufreq driver when it is
compiled as an external module.
Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: ab0ea257fc58d ("cpufreq: st: Provide runtime initialised driver for ST's platforms")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/sti-cpufreq.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
index 6b5d241c30b70..2d09960afa591 100644
--- a/drivers/cpufreq/sti-cpufreq.c
+++ b/drivers/cpufreq/sti-cpufreq.c
@@ -295,6 +295,13 @@ register_cpufreq_dt:
}
module_init(sti_cpufreq_init);
+static const struct of_device_id __maybe_unused sti_cpufreq_of_match[] = {
+ { .compatible = "st,stih407" },
+ { .compatible = "st,stih410" },
+ { },
+};
+MODULE_DEVICE_TABLE(of, sti_cpufreq_of_match);
+
MODULE_DESCRIPTION("STMicroelectronics CPUFreq/OPP driver");
MODULE_AUTHOR("Ajitpal Singh <ajitpal.singh@st.com>");
MODULE_AUTHOR("Lee Jones <lee.jones@linaro.org>");
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 142/242] cpufreq: loongson1: Add missing MODULE_ALIAS
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 141/242] cpufreq: st: " Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 143/242] cpufreq: scpi: " Greg Kroah-Hartman
` (100 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin
From: Pali Rohár <pali@kernel.org>
[ Upstream commit b9acab091842ca8b288882798bb809f7abf5408a ]
This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
driver when it is compiled as an external module.
Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: a0a22cf14472f ("cpufreq: Loongson1: Add cpufreq driver for Loongson1B")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/loongson1-cpufreq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/cpufreq/loongson1-cpufreq.c b/drivers/cpufreq/loongson1-cpufreq.c
index be89416e2358f..9d902f67f8716 100644
--- a/drivers/cpufreq/loongson1-cpufreq.c
+++ b/drivers/cpufreq/loongson1-cpufreq.c
@@ -217,6 +217,7 @@ static struct platform_driver ls1x_cpufreq_platdrv = {
module_platform_driver(ls1x_cpufreq_platdrv);
+MODULE_ALIAS("platform:ls1x-cpufreq");
MODULE_AUTHOR("Kelvin Cheung <keguang.zhang@gmail.com>");
MODULE_DESCRIPTION("Loongson1 CPUFreq driver");
MODULE_LICENSE("GPL");
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 143/242] cpufreq: scpi: Add missing MODULE_ALIAS
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 142/242] cpufreq: loongson1: Add missing MODULE_ALIAS Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 144/242] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe Greg Kroah-Hartman
` (99 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Viresh Kumar, Sasha Levin
From: Pali Rohár <pali@kernel.org>
[ Upstream commit c0382d049d2def37b81e907a8b22661a4a4a6eb5 ]
This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
driver when it is compiled as an external module.
Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 8def31034d033 ("cpufreq: arm_big_little: add SCPI interface driver")
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/scpi-cpufreq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
index 8de2364b5995a..df6617b19de28 100644
--- a/drivers/cpufreq/scpi-cpufreq.c
+++ b/drivers/cpufreq/scpi-cpufreq.c
@@ -85,6 +85,7 @@ static struct platform_driver scpi_cpufreq_platdrv = {
};
module_platform_driver(scpi_cpufreq_platdrv);
+MODULE_ALIAS("platform:scpi-cpufreq");
MODULE_AUTHOR("Sudeep Holla <sudeep.holla@arm.com>");
MODULE_DESCRIPTION("ARM SCPI CPUFreq interface driver");
MODULE_LICENSE("GPL v2");
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 144/242] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 143/242] cpufreq: scpi: " Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 145/242] scsi: pm80xx: Fix error return in pm8001_pci_probe() Greg Kroah-Hartman
` (98 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Christie, Qinglang Miao,
Martin K. Petersen, Sasha Levin
From: Qinglang Miao <miaoqinglang@huawei.com>
[ Upstream commit 62eebd5247c4e4ce08826ad5995cf4dd7ce919dd ]
Add the missing destroy_workqueue() before return from __qedi_probe in the
error handling case when fails to create workqueue qedi->offload_thread.
Link: https://lore.kernel.org/r/20201109091518.55941-1-miaoqinglang@huawei.com
Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qedi/qedi_main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 24b945b555ba3..a742b88567762 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -2387,7 +2387,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
QEDI_ERR(&qedi->dbg_ctx,
"Unable to start offload thread!\n");
rc = -ENODEV;
- goto free_cid_que;
+ goto free_tmf_thread;
}
/* F/w needs 1st task context memory entry for performance */
@@ -2407,6 +2407,8 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
return 0;
+free_tmf_thread:
+ destroy_workqueue(qedi->tmf_thread);
free_cid_que:
qedi_release_cid_que(qedi);
free_uio:
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 145/242] scsi: pm80xx: Fix error return in pm8001_pci_probe()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 144/242] scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 146/242] seq_buf: Avoid type mismatch for seq_buf_init Greg Kroah-Hartman
` (97 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jack Wang, Zhang Qilong,
Martin K. Petersen, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 97031ccffa4f62728602bfea8439dd045cd3aeb2 ]
The driver did not return an error in the case where
pm8001_configure_phy_settings() failed.
Use rc to store the return value of pm8001_configure_phy_settings().
Link: https://lore.kernel.org/r/20201205115551.2079471-1-zhangqilong3@huawei.com
Fixes: 279094079a44 ("[SCSI] pm80xx: Phy settings support for motherboard controller.")
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_init.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 0e013f76b582e..30e49b4acaeaf 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -1054,7 +1054,8 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
pm8001_init_sas_add(pm8001_ha);
/* phy setting support for motherboard controller */
- if (pm8001_configure_phy_settings(pm8001_ha))
+ rc = pm8001_configure_phy_settings(pm8001_ha);
+ if (rc)
goto err_out_shost;
pm8001_post_sas_ha_init(shost, chip);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 146/242] seq_buf: Avoid type mismatch for seq_buf_init
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 145/242] scsi: pm80xx: Fix error return in pm8001_pci_probe() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 147/242] scsi: fnic: Fix error return code in fnic_probe() Greg Kroah-Hartman
` (96 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cezary Rojewski, Arnd Bergmann,
Steven Rostedt (VMware),
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit d9a9280a0d0ae51dc1d4142138b99242b7ec8ac6 ]
Building with W=2 prints a number of warnings for one function that
has a pointer type mismatch:
linux/seq_buf.h: In function 'seq_buf_init':
linux/seq_buf.h:35:12: warning: pointer targets in assignment from 'unsigned char *' to 'char *' differ in signedness [-Wpointer-sign]
Change the type in the function prototype according to the type in
the structure.
Link: https://lkml.kernel.org/r/20201026161108.3707783-1-arnd@kernel.org
Fixes: 9a7777935c34 ("tracing: Convert seq_buf fields to be like seq_file fields")
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/seq_buf.h | 2 +-
include/linux/trace_seq.h | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h
index aa5deb041c25d..7cc952282e8be 100644
--- a/include/linux/seq_buf.h
+++ b/include/linux/seq_buf.h
@@ -30,7 +30,7 @@ static inline void seq_buf_clear(struct seq_buf *s)
}
static inline void
-seq_buf_init(struct seq_buf *s, unsigned char *buf, unsigned int size)
+seq_buf_init(struct seq_buf *s, char *buf, unsigned int size)
{
s->buffer = buf;
s->size = size;
diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h
index 6609b39a72326..6db257466af68 100644
--- a/include/linux/trace_seq.h
+++ b/include/linux/trace_seq.h
@@ -12,7 +12,7 @@
*/
struct trace_seq {
- unsigned char buffer[PAGE_SIZE];
+ char buffer[PAGE_SIZE];
struct seq_buf seq;
int full;
};
@@ -51,7 +51,7 @@ static inline int trace_seq_used(struct trace_seq *s)
* that is about to be written to and then return the result
* of that write.
*/
-static inline unsigned char *
+static inline char *
trace_seq_buffer_ptr(struct trace_seq *s)
{
return s->buffer + seq_buf_used(&s->seq);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 147/242] scsi: fnic: Fix error return code in fnic_probe()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 146/242] seq_buf: Avoid type mismatch for seq_buf_init Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2021-01-13 1:20 ` Karan Tilak Kumar (kartilak)
2020-12-28 12:49 ` [PATCH 4.14 148/242] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops Greg Kroah-Hartman
` (95 subsequent siblings)
242 siblings, 1 reply; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Karan Tilak Kumar,
Zhang Changzhong, Martin K. Petersen, Sasha Levin
From: Zhang Changzhong <zhangchangzhong@huawei.com>
[ Upstream commit d4fc94fe65578738ded138e9fce043db6bfc3241 ]
Return a negative error code from the error handling case instead of 0 as
done elsewhere in this function.
Link: https://lore.kernel.org/r/1607068060-31203-1-git-send-email-zhangchangzhong@huawei.com
Fixes: 5df6d737dd4b ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/fnic/fnic_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
index aacadbf20b695..878e486762729 100644
--- a/drivers/scsi/fnic/fnic_main.c
+++ b/drivers/scsi/fnic/fnic_main.c
@@ -746,6 +746,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
for (i = 0; i < FNIC_IO_LOCKS; i++)
spin_lock_init(&fnic->io_req_lock[i]);
+ err = -ENOMEM;
fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache);
if (!fnic->io_req_pool)
goto err_out_free_resources;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* RE: [PATCH 4.14 147/242] scsi: fnic: Fix error return code in fnic_probe()
2020-12-28 12:49 ` [PATCH 4.14 147/242] scsi: fnic: Fix error return code in fnic_probe() Greg Kroah-Hartman
@ 2021-01-13 1:20 ` Karan Tilak Kumar (kartilak)
0 siblings, 0 replies; 245+ messages in thread
From: Karan Tilak Kumar (kartilak) @ 2021-01-13 1:20 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, Hulk Robot, Zhang Changzhong, Martin K. Petersen, Sasha Levin
Acked-by: Karan Tilak Kumar <kartilak@cisco.com>
Regards,
Karan
-----Original Message-----
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Sent: Monday, December 28, 2020 4:49 AM
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>; stable@vger.kernel.org; Hulk Robot <hulkci@huawei.com>; Karan Tilak Kumar (kartilak) <kartilak@cisco.com>; Zhang Changzhong <zhangchangzhong@huawei.com>; Martin K. Petersen <martin.petersen@oracle.com>; Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 147/242] scsi: fnic: Fix error return code in fnic_probe()
From: Zhang Changzhong <zhangchangzhong@huawei.com>
[ Upstream commit d4fc94fe65578738ded138e9fce043db6bfc3241 ]
Return a negative error code from the error handling case instead of 0 as done elsewhere in this function.
Link: https://lore.kernel.org/r/1607068060-31203-1-git-send-email-zhangchangzhong@huawei.com
Fixes: 5df6d737dd4b ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/fnic/fnic_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c index aacadbf20b695..878e486762729 100644
--- a/drivers/scsi/fnic/fnic_main.c
+++ b/drivers/scsi/fnic/fnic_main.c
@@ -746,6 +746,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
for (i = 0; i < FNIC_IO_LOCKS; i++)
spin_lock_init(&fnic->io_req_lock[i]);
+ err = -ENOMEM;
fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache);
if (!fnic->io_req_pool)
goto err_out_free_resources;
--
2.27.0
^ permalink raw reply [flat|nested] 245+ messages in thread
* [PATCH 4.14 148/242] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 147/242] scsi: fnic: Fix error return code in fnic_probe() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 149/242] powerpc/pseries/hibernation: remove redundant cacheinfo update Greg Kroah-Hartman
` (94 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Michael Ellerman, Sasha Levin
From: Nathan Lynch <nathanl@linux.ibm.com>
[ Upstream commit 52719fce3f4c7a8ac9eaa191e8d75a697f9fbcbc ]
There are three ways pseries_suspend_begin() can be reached:
1. When "mem" is written to /sys/power/state:
kobj_attr_store()
-> state_store()
-> pm_suspend()
-> suspend_devices_and_enter()
-> pseries_suspend_begin()
This never works because there is no way to supply a valid stream id
using this interface, and H_VASI_STATE is called with a stream id of
zero. So this call path is useless at best.
2. When a stream id is written to /sys/devices/system/power/hibernate.
pseries_suspend_begin() is polled directly from store_hibernate()
until the stream is in the "Suspending" state (i.e. the platform is
ready for the OS to suspend execution):
dev_attr_store()
-> store_hibernate()
-> pseries_suspend_begin()
3. When a stream id is written to /sys/devices/system/power/hibernate
(continued). After #2, pseries_suspend_begin() is called once again
from the pm core:
dev_attr_store()
-> store_hibernate()
-> pm_suspend()
-> suspend_devices_and_enter()
-> pseries_suspend_begin()
This is redundant because the VASI suspend state is already known to
be Suspending.
The begin() callback of platform_suspend_ops is optional, so we can
simply remove that assignment with no loss of function.
Fixes: 32d8ad4e621d ("powerpc/pseries: Partition hibernation support")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201207215200.1785968-18-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/suspend.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
index 89726f07d2492..33077ad106cf0 100644
--- a/arch/powerpc/platforms/pseries/suspend.c
+++ b/arch/powerpc/platforms/pseries/suspend.c
@@ -224,7 +224,6 @@ static struct bus_type suspend_subsys = {
static const struct platform_suspend_ops pseries_suspend_ops = {
.valid = suspend_valid_only_mem,
- .begin = pseries_suspend_begin,
.prepare_late = pseries_prepare_late,
.enter = pseries_suspend_enter,
};
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 149/242] powerpc/pseries/hibernation: remove redundant cacheinfo update
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 148/242] powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 150/242] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe Greg Kroah-Hartman
` (93 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Michael Ellerman, Sasha Levin
From: Nathan Lynch <nathanl@linux.ibm.com>
[ Upstream commit b866459489fe8ef0e92cde3cbd6bbb1af6c4e99b ]
Partitions with cache nodes in the device tree can encounter the
following warning on resume:
CPU 0 already accounted in PowerPC,POWER9@0(Data)
WARNING: CPU: 0 PID: 3177 at arch/powerpc/kernel/cacheinfo.c:197 cacheinfo_cpu_online+0x640/0x820
These calls to cacheinfo_cpu_offline/online have been redundant since
commit e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo
hierarchy post-migration").
Fixes: e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201207215200.1785968-25-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/suspend.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
index 33077ad106cf0..b7cdad95584da 100644
--- a/arch/powerpc/platforms/pseries/suspend.c
+++ b/arch/powerpc/platforms/pseries/suspend.c
@@ -26,7 +26,6 @@
#include <asm/mmu.h>
#include <asm/rtas.h>
#include <asm/topology.h>
-#include "../../kernel/cacheinfo.h"
static u64 stream_id;
static struct device suspend_dev;
@@ -91,9 +90,7 @@ static void pseries_suspend_enable_irqs(void)
* Update configuration which can be modified based on device tree
* changes during resume.
*/
- cacheinfo_cpu_offline(smp_processor_id());
post_mobility_fixup();
- cacheinfo_cpu_online(smp_processor_id());
}
/**
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 150/242] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 149/242] powerpc/pseries/hibernation: remove redundant cacheinfo update Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 151/242] usb: oxu210hp-hcd: Fix memory leak in oxu_create Greg Kroah-Hartman
` (92 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Stern, Zhang Qilong, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit d6ff32478d7e95d6ca199b5c852710d6964d5811 ]
The pm_runtime_enable will decrement the power disable depth. Imbalance
depth will resulted in enabling runtime PM of device fails later. Thus
a pairing decrement must be needed on the error handling path to keep it
balanced.
Fixes: 6c984b066d84b ("ARM: OMAP: USBHOST: Replace usbhs core driver APIs by Runtime pm APIs")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201123145719.1455849-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/ehci-omap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index 4d308533bc835..a6b738139cd21 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -237,6 +237,7 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
err_pm_runtime:
pm_runtime_put_sync(dev);
+ pm_runtime_disable(dev);
err_phy:
for (i = 0; i < omap->nports; i++) {
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 151/242] usb: oxu210hp-hcd: Fix memory leak in oxu_create
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 150/242] usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 152/242] speakup: fix uninitialized flush_lock Greg Kroah-Hartman
` (91 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Qilong, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit e5548b05631ec3e6bfdaef1cad28c799545b791b ]
usb_create_hcd will alloc memory for hcd, and we should
call usb_put_hcd to free it when adding fails to prevent
memory leak.
Fixes: b92a78e582b1a ("usb host: Oxford OXU210HP HCD driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201123145809.1456541-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/oxu210hp-hcd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
index ed20fb34c897f..1d3a79c2eba2f 100644
--- a/drivers/usb/host/oxu210hp-hcd.c
+++ b/drivers/usb/host/oxu210hp-hcd.c
@@ -3732,8 +3732,10 @@ static struct usb_hcd *oxu_create(struct platform_device *pdev,
oxu->is_otg = otg;
ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
- if (ret < 0)
+ if (ret < 0) {
+ usb_put_hcd(hcd);
return ERR_PTR(ret);
+ }
device_wakeup_enable(hcd->self.controller);
return hcd;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 152/242] speakup: fix uninitialized flush_lock
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 151/242] usb: oxu210hp-hcd: Fix memory leak in oxu_create Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 153/242] nfsd: Fix message level for normal termination Greg Kroah-Hartman
` (90 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Samuel Thibault,
Yang Yingliang, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit d1b928ee1cfa965a3327bbaa59bfa005d97fa0fe ]
The flush_lock is uninitialized, use DEFINE_SPINLOCK
to define and initialize flush_lock.
Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20201117012229.3395186-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/speakup/speakup_dectlk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/speakup/speakup_dectlk.c b/drivers/staging/speakup/speakup_dectlk.c
index f069954800226..53316b0c0b13c 100644
--- a/drivers/staging/speakup/speakup_dectlk.c
+++ b/drivers/staging/speakup/speakup_dectlk.c
@@ -46,7 +46,7 @@ static unsigned char get_index(struct spk_synth *synth);
static int in_escape;
static int is_flushing;
-static spinlock_t flush_lock;
+static DEFINE_SPINLOCK(flush_lock);
static DECLARE_WAIT_QUEUE_HEAD(flush);
static struct var_t vars[] = {
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 153/242] nfsd: Fix message level for normal termination
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 152/242] speakup: fix uninitialized flush_lock Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 154/242] nfs_common: need lock during iterate through the list Greg Kroah-Hartman
` (89 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kazuo ito, Chuck Lever, Sasha Levin
From: kazuo ito <kzpn200@gmail.com>
[ Upstream commit 4420440c57892779f265108f46f83832a88ca795 ]
The warning message from nfsd terminating normally
can confuse system adminstrators or monitoring software.
Though it's not exactly fair to pin-point a commit where it
originated, the current form in the current place started
to appear in:
Fixes: e096bbc6488d ("knfsd: remove special handling for SIGHUP")
Signed-off-by: kazuo ito <kzpn200@gmail.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfssvc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 4a9e0fb634b6c..67e85a752d3a4 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -410,8 +410,7 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
return;
nfsd_shutdown_net(net);
- printk(KERN_WARNING "nfsd: last server has exited, flushing export "
- "cache\n");
+ pr_info("nfsd: last server has exited, flushing export cache\n");
nfsd_export_flush(net);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 154/242] nfs_common: need lock during iterate through the list
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 153/242] nfsd: Fix message level for normal termination Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 155/242] x86/kprobes: Restore BTF if the single-stepping is cancelled Greg Kroah-Hartman
` (88 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cheng Lin ,
Yi Wang ,
Chuck Lever, Sasha Levin
From: Cheng Lin <cheng.lin130@zte.com.cn>
[ Upstream commit 4a9d81caf841cd2c0ae36abec9c2963bf21d0284 ]
If the elem is deleted during be iterated on it, the iteration
process will fall into an endless loop.
kernel: NMI watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [nfsd:17137]
PID: 17137 TASK: ffff8818d93c0000 CPU: 4 COMMAND: "nfsd"
[exception RIP: __state_in_grace+76]
RIP: ffffffffc00e817c RSP: ffff8818d3aefc98 RFLAGS: 00000246
RAX: ffff881dc0c38298 RBX: ffffffff81b03580 RCX: ffff881dc02c9f50
RDX: ffff881e3fce8500 RSI: 0000000000000001 RDI: ffffffff81b03580
RBP: ffff8818d3aefca0 R8: 0000000000000020 R9: ffff8818d3aefd40
R10: ffff88017fc03800 R11: ffff8818e83933c0 R12: ffff8818d3aefd40
R13: 0000000000000000 R14: ffff8818e8391068 R15: ffff8818fa6e4000
CS: 0010 SS: 0018
#0 [ffff8818d3aefc98] opens_in_grace at ffffffffc00e81e3 [grace]
#1 [ffff8818d3aefca8] nfs4_preprocess_stateid_op at ffffffffc02a3e6c [nfsd]
#2 [ffff8818d3aefd18] nfsd4_write at ffffffffc028ed5b [nfsd]
#3 [ffff8818d3aefd80] nfsd4_proc_compound at ffffffffc0290a0d [nfsd]
#4 [ffff8818d3aefdd0] nfsd_dispatch at ffffffffc027b800 [nfsd]
#5 [ffff8818d3aefe08] svc_process_common at ffffffffc02017f3 [sunrpc]
#6 [ffff8818d3aefe70] svc_process at ffffffffc0201ce3 [sunrpc]
#7 [ffff8818d3aefe98] nfsd at ffffffffc027b117 [nfsd]
#8 [ffff8818d3aefec8] kthread at ffffffff810b88c1
#9 [ffff8818d3aeff50] ret_from_fork at ffffffff816d1607
The troublemake elem:
crash> lock_manager ffff881dc0c38298
struct lock_manager {
list = {
next = 0xffff881dc0c38298,
prev = 0xffff881dc0c38298
},
block_opens = false
}
Fixes: c87fb4a378f9 ("lockd: NLM grace period shouldn't block NFSv4 opens")
Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs_common/grace.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c
index 3b13fb3b05530..63c9c2a70937f 100644
--- a/fs/nfs_common/grace.c
+++ b/fs/nfs_common/grace.c
@@ -75,10 +75,14 @@ __state_in_grace(struct net *net, bool open)
if (!open)
return !list_empty(grace_list);
+ spin_lock(&grace_lock);
list_for_each_entry(lm, grace_list, list) {
- if (lm->block_opens)
+ if (lm->block_opens) {
+ spin_unlock(&grace_lock);
return true;
+ }
}
+ spin_unlock(&grace_lock);
return false;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 155/242] x86/kprobes: Restore BTF if the single-stepping is cancelled
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 154/242] nfs_common: need lock during iterate through the list Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 156/242] clk: tegra: Fix duplicated SE clock entry Greg Kroah-Hartman
` (87 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masami Hiramatsu,
Peter Zijlstra (Intel),
Sasha Levin
From: Masami Hiramatsu <mhiramat@kernel.org>
[ Upstream commit 78ff2733ff352175eb7f4418a34654346e1b6cd2 ]
Fix to restore BTF if single-stepping causes a page fault and
it is cancelled.
Usually the BTF flag was restored when the single stepping is done
(in resume_execution()). However, if a page fault happens on the
single stepping instruction, the fault handler is invoked and
the single stepping is cancelled. Thus, the BTF flag is not
restored.
Fixes: 1ecc798c6764 ("x86: debugctlmsr kprobes")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/160389546985.106936.12727996109376240993.stgit@devnote2
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/kprobes/core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 02665ffef0506..700d434f5bda9 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -1022,6 +1022,11 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
* So clear it by resetting the current kprobe:
*/
regs->flags &= ~X86_EFLAGS_TF;
+ /*
+ * Since the single step (trap) has been cancelled,
+ * we need to restore BTF here.
+ */
+ restore_btf();
/*
* If the TF flag was set before the kprobe hit,
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 156/242] clk: tegra: Fix duplicated SE clock entry
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 155/242] x86/kprobes: Restore BTF if the single-stepping is cancelled Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 157/242] extcon: max77693: Fix modalias string Greg Kroah-Hartman
` (86 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Thierry Reding,
Stephen Boyd, Sasha Levin
From: Dmitry Osipenko <digetx@gmail.com>
[ Upstream commit 5bf5861d6ea6c3f4b38fc8fda2062b2dc44ac63d ]
The periph_clks[] array contains duplicated entry for Security Engine
clock which was meant to be defined for T210, but it wasn't added
properly. This patch corrects the T210 SE entry and fixes the following
error message on T114/T124: "Tegra clk 127: register failed with -17".
Fixes: dc37fec48314 ("clk: tegra: periph: Add new periph clks and muxes for Tegra210")
Tested-by Nicolas Chauvet <kwizart@gmail.com>
Reported-by Nicolas Chauvet <kwizart@gmail.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20201025224212.7790-1-digetx@gmail.com
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tegra/clk-id.h | 1 +
drivers/clk/tegra/clk-tegra-periph.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
index 11ee5f9ce99e1..4374e4a6b5be5 100644
--- a/drivers/clk/tegra/clk-id.h
+++ b/drivers/clk/tegra/clk-id.h
@@ -234,6 +234,7 @@ enum clk_id {
tegra_clk_sdmmc4_8,
tegra_clk_sdmmc4_9,
tegra_clk_se,
+ tegra_clk_se_10,
tegra_clk_soc_therm,
tegra_clk_soc_therm_8,
tegra_clk_sor0,
diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
index d300a256fcacb..ca0735dc70ece 100644
--- a/drivers/clk/tegra/clk-tegra-periph.c
+++ b/drivers/clk/tegra/clk-tegra-periph.c
@@ -673,7 +673,7 @@ static struct tegra_periph_init_data periph_clks[] = {
INT8("host1x", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_8),
INT8("host1x", mux_pllc4_out1_pllc_pllc4_out2_pllp_clkm_plla_pllc4_out0, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_9),
INT8("se", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
- INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
+ INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se_10),
INT8("2d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_2D, 21, 0, tegra_clk_gr2d_8),
INT8("3d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_3D, 24, 0, tegra_clk_gr3d_8),
INT8("vic03", mux_pllm_pllc_pllp_plla_pllc2_c3_clkm, CLK_SOURCE_VIC03, 178, 0, tegra_clk_vic03),
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 157/242] extcon: max77693: Fix modalias string
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 156/242] clk: tegra: Fix duplicated SE clock entry Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 158/242] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() Greg Kroah-Hartman
` (85 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Chanwoo Choi, Sasha Levin
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit e1efdb604f5c9903a5d92ef42244009d3c04880f ]
The platform device driver name is "max77693-muic", so advertise it
properly in the modalias string. This fixes automated module loading when
this driver is compiled as a module.
Fixes: db1b9037424b ("extcon: MAX77693: Add extcon-max77693 driver to support Maxim MAX77693 MUIC device")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/extcon/extcon-max77693.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index 7a58568090474..8ea33946b4b25 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -1275,4 +1275,4 @@ module_platform_driver(max77693_muic_driver);
MODULE_DESCRIPTION("Maxim MAX77693 Extcon driver");
MODULE_AUTHOR("Chanwoo Choi <cw00.choi@samsung.com>");
MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:extcon-max77693");
+MODULE_ALIAS("platform:max77693-muic");
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 158/242] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 157/242] extcon: max77693: Fix modalias string Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 159/242] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path Greg Kroah-Hartman
` (84 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Charles Keepax,
Mark Brown, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 85a7555575a0e48f9b73db310d0d762a08a46d63 ]
The error handling frees "ctl" but it's still on the "dsp->ctl_list"
list so that could result in a use after free. Remove it from the list
before returning.
Fixes: 2323736dca72 ("ASoC: wm_adsp: Add basic support for rev 1 firmware file format")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/X9B0keV/02wrx9Xs@mwanda
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm_adsp.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 158ce68bc9bf3..1516252aa0a53 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1391,7 +1391,7 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
ctl_work = kzalloc(sizeof(*ctl_work), GFP_KERNEL);
if (!ctl_work) {
ret = -ENOMEM;
- goto err_ctl_cache;
+ goto err_list_del;
}
ctl_work->dsp = dsp;
@@ -1401,7 +1401,8 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
return 0;
-err_ctl_cache:
+err_list_del:
+ list_del(&ctl->list);
kfree(ctl->cache);
err_ctl_name:
kfree(ctl->name);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 159/242] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 158/242] ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 160/242] watchdog: sirfsoc: Add missing dependency on HAS_IOMEM Greg Kroah-Hartman
` (83 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Antoine Tenart,
Tsahee Zidenberg, Sasha Levin
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit 3841245e8498a789c65dedd7ffa8fb2fee2c0684 ]
The alpine-msi driver has an interesting allocation error handling,
where it frees the same interrupts repeatedly. Hilarity follows.
This code is probably never executed, but let's fix it nonetheless.
Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Antoine Tenart <atenart@kernel.org>
Cc: Tsahee Zidenberg <tsahee@annapurnalabs.com>
Cc: Antoine Tenart <atenart@kernel.org>
Link: https://lore.kernel.org/r/20201129135525.396671-1-maz@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-alpine-msi.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
index 63d980995d17d..ac431697ebe1c 100644
--- a/drivers/irqchip/irq-alpine-msi.c
+++ b/drivers/irqchip/irq-alpine-msi.c
@@ -165,8 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain,
return 0;
err_sgi:
- while (--i >= 0)
- irq_domain_free_irqs_parent(domain, virq, i);
+ irq_domain_free_irqs_parent(domain, virq, i - 1);
alpine_msix_free_sgi(priv, sgi, nr_irqs);
return err;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 160/242] watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 159/242] irqchip/alpine-msi: Fix freeing of interrupts on allocation error path Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 161/242] um: chan_xterm: Fix fd leak Greg Kroah-Hartman
` (82 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran, Guenter Roeck,
Wim Van Sebroeck, Sasha Levin
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit 8ae2511112d2e18bc7d324b77f965d34083a25a2 ]
If HAS_IOMEM is not defined and SIRFSOC_WATCHDOG is enabled,
the build fails with the following error.
drivers/watchdog/sirfsoc_wdt.o: in function `sirfsoc_wdt_probe':
sirfsoc_wdt.c:(.text+0x112):
undefined reference to `devm_platform_ioremap_resource'
Reported-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
Link: https://lore.kernel.org/r/20201108162550.27660-2-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index fa15a683ae2d4..529b0527bf2e2 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -620,6 +620,7 @@ config MOXART_WDT
config SIRFSOC_WATCHDOG
tristate "SiRFSOC watchdog"
+ depends on HAS_IOMEM
depends on ARCH_SIRF || COMPILE_TEST
select WATCHDOG_CORE
default y
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 161/242] um: chan_xterm: Fix fd leak
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 160/242] watchdog: sirfsoc: Add missing dependency on HAS_IOMEM Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 162/242] nfc: s3fwrn5: Release the nfc firmware Greg Kroah-Hartman
` (81 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anton Ivanov, Richard Weinberger,
Sasha Levin
From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
[ Upstream commit 9431f7c199ab0d02da1482d62255e0b4621cb1b5 ]
xterm serial channel was leaking a fd used in setting up the
port helper
This bug is prehistoric - it predates switching to git. The "fixes"
header here is really just to mark all the versions we would like this to
apply to which is "Anything from the Cretaceous period onwards".
No dinosaurs were harmed in fixing this bug.
Fixes: b40997b872cd ("um: drivers/xterm.c: fix a file descriptor leak")
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/um/drivers/xterm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
index 20e30be44795b..e3b422ebce09f 100644
--- a/arch/um/drivers/xterm.c
+++ b/arch/um/drivers/xterm.c
@@ -18,6 +18,7 @@
struct xterm_chan {
int pid;
int helper_pid;
+ int chan_fd;
char *title;
int device;
int raw;
@@ -33,6 +34,7 @@ static void *xterm_init(char *str, int device, const struct chan_opts *opts)
return NULL;
*data = ((struct xterm_chan) { .pid = -1,
.helper_pid = -1,
+ .chan_fd = -1,
.device = device,
.title = opts->xterm_title,
.raw = opts->raw } );
@@ -149,6 +151,7 @@ static int xterm_open(int input, int output, int primary, void *d,
goto out_kill;
}
+ data->chan_fd = fd;
new = xterm_fd(fd, &data->helper_pid);
if (new < 0) {
err = new;
@@ -206,6 +209,8 @@ static void xterm_close(int fd, void *d)
os_kill_process(data->helper_pid, 0);
data->helper_pid = -1;
+ if (data->chan_fd != -1)
+ os_close_file(data->chan_fd);
os_close_file(fd);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 162/242] nfc: s3fwrn5: Release the nfc firmware
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 161/242] um: chan_xterm: Fix fd leak Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 163/242] powerpc/ps3: use dma_mapping_error() Greg Kroah-Hartman
` (80 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bongsu Jeon, Krzysztof Kozlowski,
Jakub Kicinski, Sasha Levin
From: Bongsu Jeon <bongsu.jeon@samsung.com>
[ Upstream commit a4485baefa1efa596702ebffd5a9c760d42b14b5 ]
add the code to release the nfc firmware when the firmware image size is
wrong.
Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip")
Signed-off-by: Bongsu Jeon <bongsu.jeon@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201213095850.28169-1-bongsu.jeon@samsung.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nfc/s3fwrn5/firmware.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/nfc/s3fwrn5/firmware.c b/drivers/nfc/s3fwrn5/firmware.c
index 38548bd970cd2..43c801e725b6f 100644
--- a/drivers/nfc/s3fwrn5/firmware.c
+++ b/drivers/nfc/s3fwrn5/firmware.c
@@ -304,8 +304,10 @@ static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info)
if (ret < 0)
return ret;
- if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE)
+ if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) {
+ release_firmware(fw->fw);
return -EINVAL;
+ }
memcpy(fw->date, fw->fw->data + 0x00, 12);
fw->date[12] = '\0';
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 163/242] powerpc/ps3: use dma_mapping_error()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 162/242] nfc: s3fwrn5: Release the nfc firmware Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 164/242] checkpatch: fix unescaped left brace Greg Kroah-Hartman
` (79 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vincent Stehlé,
Geert Uytterhoeven, Michael Ellerman, Sasha Levin
From: Vincent Stehlé <vincent.stehle@laposte.net>
[ Upstream commit d0edaa28a1f7830997131cbce87b6c52472825d1 ]
The DMA address returned by dma_map_single() should be checked with
dma_mapping_error(). Fix the ps3stor_setup() function accordingly.
Fixes: 80071802cb9c ("[POWERPC] PS3: Storage Driver Core")
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201213182622.23047-1-vincent.stehle@laposte.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ps3/ps3stor_lib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ps3/ps3stor_lib.c b/drivers/ps3/ps3stor_lib.c
index 8c3f5adf1bc65..2d76183756626 100644
--- a/drivers/ps3/ps3stor_lib.c
+++ b/drivers/ps3/ps3stor_lib.c
@@ -201,7 +201,7 @@ int ps3stor_setup(struct ps3_storage_device *dev, irq_handler_t handler)
dev->bounce_lpar = ps3_mm_phys_to_lpar(__pa(dev->bounce_buf));
dev->bounce_dma = dma_map_single(&dev->sbd.core, dev->bounce_buf,
dev->bounce_size, DMA_BIDIRECTIONAL);
- if (!dev->bounce_dma) {
+ if (dma_mapping_error(&dev->sbd.core, dev->bounce_dma)) {
dev_err(&dev->sbd.core, "%s:%u: map DMA region failed\n",
__func__, __LINE__);
error = -ENODEV;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 164/242] checkpatch: fix unescaped left brace
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 163/242] powerpc/ps3: use dma_mapping_error() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 165/242] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin Greg Kroah-Hartman
` (78 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dwaipayan Ray, Joe Perches,
Andrew Morton, Linus Torvalds, Sasha Levin
From: Dwaipayan Ray <dwaipayanray1@gmail.com>
[ Upstream commit 03f4935135b9efeb780b970ba023c201f81cf4e6 ]
There is an unescaped left brace in a regex in OPEN_BRACE check. This
throws a runtime error when checkpatch is run with --fix flag and the
OPEN_BRACE check is executed.
Fix it by escaping the left brace.
Link: https://lkml.kernel.org/r/20201115202928.81955-1-dwaipayanray1@gmail.com
Fixes: 8d1824780f2f ("checkpatch: add --fix option for a couple OPEN_BRACE misuses")
Signed-off-by: Dwaipayan Ray <dwaipayanray1@gmail.com>
Acked-by: Joe Perches <joe@perches.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/checkpatch.pl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index d702bdf19eb10..0f24a6f3af995 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3898,7 +3898,7 @@ sub process {
$fix) {
fix_delete_line($fixlinenr, $rawline);
my $fixed_line = $rawline;
- $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*){(.*)$/;
+ $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*)\{(.*)$/;
my $line1 = $1;
my $line2 = $2;
fix_insert_line($fixlinenr, ltrim($line1));
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 165/242] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 164/242] checkpatch: fix unescaped left brace Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 166/242] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function Greg Kroah-Hartman
` (77 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Florian Fainelli,
Jakub Kicinski, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 4375ada01963d1ebf733d60d1bb6e5db401e1ac6 ]
If the 'register_netdev()' call fails, we must undo a previous
'bcmgenet_mii_init()' call.
Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201212182005.120437-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 8bfa2523e2533..5855ffec49528 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -3593,8 +3593,10 @@ static int bcmgenet_probe(struct platform_device *pdev)
clk_disable_unprepare(priv->clk);
err = register_netdev(dev);
- if (err)
+ if (err) {
+ bcmgenet_mii_exit(dev);
goto err;
+ }
return err;
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 166/242] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 165/242] net: bcmgenet: Fix a resource leak in an error handling path in the probe functin Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 167/242] net: korina: fix return value Greg Kroah-Hartman
` (76 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Jakub Kicinski,
Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 322e53d1e2529ae9d501f5e0f20604a79b873aef ]
'irq_of_parse_and_map()' should be balanced by a corresponding
'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.
Add such a call in the error handling path of the probe function and in the
remove function.
Fixes: 492205050d77 ("net: Add EMAC ethernet driver found on Allwinner A10 SoC's")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201214202117.146293-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index c458b81ba63af..d249a4309da2f 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -847,13 +847,13 @@ static int emac_probe(struct platform_device *pdev)
db->clk = devm_clk_get(&pdev->dev, NULL);
if (IS_ERR(db->clk)) {
ret = PTR_ERR(db->clk);
- goto out_iounmap;
+ goto out_dispose_mapping;
}
ret = clk_prepare_enable(db->clk);
if (ret) {
dev_err(&pdev->dev, "Error couldn't enable clock (%d)\n", ret);
- goto out_iounmap;
+ goto out_dispose_mapping;
}
ret = sunxi_sram_claim(&pdev->dev);
@@ -910,6 +910,8 @@ out_release_sram:
sunxi_sram_release(&pdev->dev);
out_clk_disable_unprepare:
clk_disable_unprepare(db->clk);
+out_dispose_mapping:
+ irq_dispose_mapping(ndev->irq);
out_iounmap:
iounmap(db->membase);
out:
@@ -928,6 +930,7 @@ static int emac_remove(struct platform_device *pdev)
unregister_netdev(ndev);
sunxi_sram_release(&pdev->dev);
clk_disable_unprepare(db->clk);
+ irq_dispose_mapping(ndev->irq);
iounmap(db->membase);
free_netdev(ndev);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 167/242] net: korina: fix return value
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 166/242] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 168/242] watchdog: qcom: Avoid context switch in restart handler Greg Kroah-Hartman
` (75 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Vincent Stehlé,
Florian Fainelli, Sasha Levin
From: Vincent Stehlé <vincent.stehle@laposte.net>
[ Upstream commit 7eb000bdbe7c7da811ef51942b356f6e819b13ba ]
The ndo_start_xmit() method must not attempt to free the skb to transmit
when returning NETDEV_TX_BUSY. Therefore, make sure the
korina_send_packet() function returns NETDEV_TX_OK when it frees a packet.
Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201214220952.19935-1-vincent.stehle@laposte.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/korina.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
index 1eccdbaa9a515..ec1c14e3eace6 100644
--- a/drivers/net/ethernet/korina.c
+++ b/drivers/net/ethernet/korina.c
@@ -216,7 +216,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
dev_kfree_skb_any(skb);
spin_unlock_irqrestore(&lp->lock, flags);
- return NETDEV_TX_BUSY;
+ return NETDEV_TX_OK;
}
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 168/242] watchdog: qcom: Avoid context switch in restart handler
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 167/242] net: korina: fix return value Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 169/242] watchdog: coh901327: add COMMON_CLK dependency Greg Kroah-Hartman
` (74 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Manivannan Sadhasivam, Guenter Roeck,
Wim Van Sebroeck, Sasha Levin
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[ Upstream commit 7948fab26bcc468aa2a76462f441291b5fb0d5c7 ]
The use of msleep() in the restart handler will cause scheduler to
induce a context switch which is not desirable. This generates below
warning on SDX55 when WDT is the only available restart source:
[ 39.800188] reboot: Restarting system
[ 39.804115] ------------[ cut here ]------------
[ 39.807855] WARNING: CPU: 0 PID: 678 at kernel/rcu/tree_plugin.h:297 rcu_note_context_switch+0x190/0x764
[ 39.812538] Modules linked in:
[ 39.821954] CPU: 0 PID: 678 Comm: reboot Not tainted 5.10.0-rc1-00063-g33a9990d1d66-dirty #47
[ 39.824854] Hardware name: Generic DT based system
[ 39.833470] [<c0310fbc>] (unwind_backtrace) from [<c030c544>] (show_stack+0x10/0x14)
[ 39.838154] [<c030c544>] (show_stack) from [<c0c218f0>] (dump_stack+0x8c/0xa0)
[ 39.846049] [<c0c218f0>] (dump_stack) from [<c0322f80>] (__warn+0xd8/0xf0)
[ 39.853058] [<c0322f80>] (__warn) from [<c0c1dc08>] (warn_slowpath_fmt+0x64/0xc8)
[ 39.859925] [<c0c1dc08>] (warn_slowpath_fmt) from [<c038b6f4>] (rcu_note_context_switch+0x190/0x764)
[ 39.867503] [<c038b6f4>] (rcu_note_context_switch) from [<c0c2aa3c>] (__schedule+0x84/0x640)
[ 39.876685] [<c0c2aa3c>] (__schedule) from [<c0c2b050>] (schedule+0x58/0x10c)
[ 39.885095] [<c0c2b050>] (schedule) from [<c0c2eed0>] (schedule_timeout+0x1e8/0x3d4)
[ 39.892135] [<c0c2eed0>] (schedule_timeout) from [<c039ad40>] (msleep+0x2c/0x38)
[ 39.899947] [<c039ad40>] (msleep) from [<c0a59d0c>] (qcom_wdt_restart+0xc4/0xcc)
[ 39.907319] [<c0a59d0c>] (qcom_wdt_restart) from [<c0a58290>] (watchdog_restart_notifier+0x18/0x28)
[ 39.914715] [<c0a58290>] (watchdog_restart_notifier) from [<c03468e0>] (atomic_notifier_call_chain+0x60/0x84)
[ 39.923487] [<c03468e0>] (atomic_notifier_call_chain) from [<c030ae64>] (machine_restart+0x78/0x7c)
[ 39.933551] [<c030ae64>] (machine_restart) from [<c0348048>] (__do_sys_reboot+0xdc/0x1e0)
[ 39.942397] [<c0348048>] (__do_sys_reboot) from [<c0300060>] (ret_fast_syscall+0x0/0x54)
[ 39.950721] Exception stack(0xc3e0bfa8 to 0xc3e0bff0)
[ 39.958855] bfa0: 0001221c bed2fe24 fee1dead 28121969 01234567 00000000
[ 39.963832] bfc0: 0001221c bed2fe24 00000003 00000058 000225e0 00000000 00000000 00000000
[ 39.971985] bfe0: b6e62560 bed2fc84 00010fd8 b6e62580
[ 39.980124] ---[ end trace 3f578288bad866e4 ]---
Hence, replace msleep() with mdelay() to fix this issue.
Fixes: 05e487d905ab ("watchdog: qcom: register a restart notifier")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201207060005.21293-1-manivannan.sadhasivam@linaro.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/qcom-wdt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c
index 780971318810d..1a0005a8fadb2 100644
--- a/drivers/watchdog/qcom-wdt.c
+++ b/drivers/watchdog/qcom-wdt.c
@@ -121,7 +121,7 @@ static int qcom_wdt_restart(struct watchdog_device *wdd, unsigned long action,
*/
wmb();
- msleep(150);
+ mdelay(150);
return 0;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 169/242] watchdog: coh901327: add COMMON_CLK dependency
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 168/242] watchdog: qcom: Avoid context switch in restart handler Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 170/242] clk: ti: Fix memleak in ti_fapll_synth_setup Greg Kroah-Hartman
` (73 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Guenter Roeck,
Wim Van Sebroeck, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 36c47df85ee8e1f8a35366ac11324f8875de00eb ]
clang produces a build failure in configurations without COMMON_CLK
when a timeout calculation goes wrong:
arm-linux-gnueabi-ld: drivers/watchdog/coh901327_wdt.o: in function `coh901327_enable':
coh901327_wdt.c:(.text+0x50): undefined reference to `__bad_udelay'
Add a Kconfig dependency to only do build testing when COMMON_CLK
is enabled.
Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201203223358.1269372-1-arnd@kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 529b0527bf2e2..de228669a2c8b 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -495,7 +495,7 @@ config SUNXI_WATCHDOG
config COH901327_WATCHDOG
bool "ST-Ericsson COH 901 327 watchdog"
- depends on ARCH_U300 || (ARM && COMPILE_TEST)
+ depends on ARCH_U300 || (ARM && COMMON_CLK && COMPILE_TEST)
default y if MACH_U300
select WATCHDOG_CORE
help
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 170/242] clk: ti: Fix memleak in ti_fapll_synth_setup
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 169/242] watchdog: coh901327: add COMMON_CLK dependency Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 171/242] pwm: zx: Add missing cleanup in error path Greg Kroah-Hartman
` (72 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Qilong,
Tony Lindgren, Stephen Boyd, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 8c6239f6e95f583bb763d0228e02d4dd0fb3d492 ]
If clk_register fails, we should goto free branch
before function returns to prevent memleak.
Fixes: 163152cbbe321 ("clk: ti: Add support for FAPLL on dm816x")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201113131623.2098222-1-zhangqilong3@huawei.com
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/ti/fapll.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index 071af44b1ba85..e33ce851837e4 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -497,6 +497,7 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
{
struct clk_init_data *init;
struct fapll_synth *synth;
+ struct clk *clk = ERR_PTR(-ENOMEM);
init = kzalloc(sizeof(*init), GFP_KERNEL);
if (!init)
@@ -519,13 +520,19 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
synth->hw.init = init;
synth->clk_pll = pll_clk;
- return clk_register(NULL, &synth->hw);
+ clk = clk_register(NULL, &synth->hw);
+ if (IS_ERR(clk)) {
+ pr_err("failed to register clock\n");
+ goto free;
+ }
+
+ return clk;
free:
kfree(synth);
kfree(init);
- return ERR_PTR(-ENOMEM);
+ return clk;
}
static void __init ti_fapll_setup(struct device_node *node)
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 171/242] pwm: zx: Add missing cleanup in error path
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 170/242] clk: ti: Fix memleak in ti_fapll_synth_setup Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 173/242] perf record: Fix memory leak when using --user-regs=? to list registers Greg Kroah-Hartman
` (71 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König, Shawn Guo,
Thierry Reding, Sasha Levin
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 269effd03f6142df4c74814cfdd5f0b041b30bf9 ]
zx_pwm_probe() called clk_prepare_enable() before; this must be undone
in the error path.
Fixes: 4836193c435c ("pwm: Add ZTE ZX PWM device driver")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-zx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pwm/pwm-zx.c b/drivers/pwm/pwm-zx.c
index 5d27c16edfb13..0d4112410b69d 100644
--- a/drivers/pwm/pwm-zx.c
+++ b/drivers/pwm/pwm-zx.c
@@ -241,6 +241,7 @@ static int zx_pwm_probe(struct platform_device *pdev)
ret = pwmchip_add(&zpc->chip);
if (ret < 0) {
dev_err(&pdev->dev, "failed to add PWM chip: %d\n", ret);
+ clk_disable_unprepare(zpc->pclk);
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 173/242] perf record: Fix memory leak when using --user-regs=? to list registers
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 171/242] pwm: zx: Add missing cleanup in error path Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 174/242] qlcnic: Fix error code in probe Greg Kroah-Hartman
` (70 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zheng Zengkai, Jiri Olsa,
Alexander Shishkin, Li Bin, Mark Rutland, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
From: Zheng Zengkai <zhengzengkai@huawei.com>
[ Upstream commit 2eb5dd418034ecea2f7031e3d33f2991a878b148 ]
When using 'perf record's option '-I' or '--user-regs=' along with
argument '?' to list available register names, memory of variable 'os'
allocated by strdup() needs to be released before __parse_regs()
returns, otherwise memory leak will occur.
Fixes: bcc84ec65ad1 ("perf record: Add ability to name registers to record")
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Li Bin <huawei.libin@huawei.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/r/20200703093344.189450-1-zhengzengkai@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/parse-regs-options.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/parse-regs-options.c b/tools/perf/util/parse-regs-options.c
index e6599e290f467..e5ad120e7f69a 100644
--- a/tools/perf/util/parse-regs-options.c
+++ b/tools/perf/util/parse-regs-options.c
@@ -41,7 +41,7 @@ parse_regs(const struct option *opt, const char *str, int unset)
}
fputc('\n', stderr);
/* just printing available regs */
- return -1;
+ goto error;
}
for (r = sample_reg_masks; r->name; r++) {
if (!strcasecmp(s, r->name))
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 174/242] qlcnic: Fix error code in probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 173/242] perf record: Fix memory leak when using --user-regs=? to list registers Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 175/242] clk: s2mps11: Fix a resource leak in error handling paths in the probe function Greg Kroah-Hartman
` (69 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jakub Kicinski, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 0d52848632a357948028eab67ff9b7cc0c12a0fb ]
Return -EINVAL if we can't find the correct device. Currently it
returns success.
Fixes: 13159183ec7a ("qlcnic: 83xx base driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X9nHbMqEyI/xPfGd@mwanda
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 1b5f7d57b6f8f..6684a4cb8b88b 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -2511,6 +2511,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
qlcnic_sriov_vf_register_map(ahw);
break;
default:
+ err = -EINVAL;
goto err_out_free_hw_res;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 175/242] clk: s2mps11: Fix a resource leak in error handling paths in the probe function
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 174/242] qlcnic: Fix error code in probe Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 176/242] clk: sunxi-ng: Make sure divider tables have sentinel Greg Kroah-Hartman
` (68 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET,
Krzysztof Kozlowski, Stephen Boyd, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit d2d94fc567624f96187e8b52083795620f93e69f ]
Some resource should be released in the error handling path of the probe
function, as already done in the remove function.
The remove function was fixed in commit bf416bd45738 ("clk: s2mps11: Add
missing of_node_put and of_clk_del_provider")
Fixes: 7cc560dea415 ("clk: s2mps11: Add support for s2mps11")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201212122818.86195-1-christophe.jaillet@wanadoo.fr
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-s2mps11.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
index f5d74e8db4327..1803af6230b27 100644
--- a/drivers/clk/clk-s2mps11.c
+++ b/drivers/clk/clk-s2mps11.c
@@ -211,6 +211,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
return ret;
err_reg:
+ of_node_put(s2mps11_clks[0].clk_np);
while (--i >= 0)
clkdev_drop(s2mps11_clks[i].lookup);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 176/242] clk: sunxi-ng: Make sure divider tables have sentinel
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 175/242] clk: s2mps11: Fix a resource leak in error handling paths in the probe function Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 177/242] cfg80211: initialize rekey_data Greg Kroah-Hartman
` (67 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard,
Stephen Boyd, Sasha Levin
From: Jernej Skrabec <jernej.skrabec@siol.net>
[ Upstream commit 48f68de00c1405351fa0e7bc44bca067c49cd0a3 ]
Two clock divider tables are missing sentinel at the end. Effect of that
is that clock framework reads past the last entry. Fix that with adding
sentinel at the end.
Issue was discovered with KASan.
Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks")
Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks")
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201202203817.438713-1-jernej.skrabec@siol.net
Acked-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 +
drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
index 183985c8c9bab..7e3cd0bd597dc 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
@@ -381,6 +381,7 @@ static struct clk_div_table ths_div_table[] = {
{ .val = 1, .div = 2 },
{ .val = 2, .div = 4 },
{ .val = 3, .div = 6 },
+ { /* Sentinel */ },
};
static const char * const ths_parents[] = { "osc24M" };
static struct ccu_div ths_clk = {
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
index b09acda71abe9..aa44602896fac 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
@@ -315,6 +315,7 @@ static struct clk_div_table ths_div_table[] = {
{ .val = 1, .div = 2 },
{ .val = 2, .div = 4 },
{ .val = 3, .div = 6 },
+ { /* Sentinel */ },
};
static SUNXI_CCU_DIV_TABLE_WITH_GATE(ths_clk, "ths", "osc24M",
0x074, 0, 2, ths_div_table, BIT(31), 0);
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 177/242] cfg80211: initialize rekey_data
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 176/242] clk: sunxi-ng: Make sure divider tables have sentinel Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 178/242] [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY Greg Kroah-Hartman
` (66 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sara Sharon, Luca Coelho,
Johannes Berg, Sasha Levin
From: Sara Sharon <sara.sharon@intel.com>
[ Upstream commit f495acd8851d7b345e5f0e521b2645b1e1f928a0 ]
In case we have old supplicant, the akm field is uninitialized.
Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201129172929.930f0ab7ebee.Ic546e384efab3f4a89f318eafddc3eb7d556aecb@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/nl80211.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 6bd4f6c8fc2ef..f630fa2e31647 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -10969,7 +10969,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
struct net_device *dev = info->user_ptr[1];
struct wireless_dev *wdev = dev->ieee80211_ptr;
struct nlattr *tb[NUM_NL80211_REKEY_DATA];
- struct cfg80211_gtk_rekey_data rekey_data;
+ struct cfg80211_gtk_rekey_data rekey_data = {};
int err;
if (!info->attrs[NL80211_ATTR_REKEY_DATA])
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 178/242] [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 177/242] cfg80211: initialize rekey_data Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 179/242] Input: cros_ec_keyb - send scancodes in addition to key events Greg Kroah-Hartman
` (65 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hervé Guillemet,
Casey Schaufler, Serge Hallyn, Andrew G. Morgan, James Morris,
Sasha Levin
From: Serge Hallyn <shallyn@cisco.com>
[ Upstream commit ed9b25d1970a4787ac6a39c2091e63b127ecbfc1 ]
Namespaced file capabilities were introduced in 8db6c34f1dbc .
When userspace reads an xattr for a namespaced capability, a
virtualized representation of it is returned if the caller is
in a user namespace owned by the capability's owning rootid.
The function which performs this virtualization was not hooked
up if CONFIG_SECURITY=n. Therefore in that case the original
xattr was shown instead of the virtualized one.
To test this using libcap-bin (*1),
$ v=$(mktemp)
$ unshare -Ur setcap cap_sys_admin-eip $v
$ unshare -Ur setcap -v cap_sys_admin-eip $v
/tmp/tmp.lSiIFRvt8Y: OK
"setcap -v" verifies the values instead of setting them, and
will check whether the rootid value is set. Therefore, with
this bug un-fixed, and with CONFIG_SECURITY=n, setcap -v will
fail:
$ v=$(mktemp)
$ unshare -Ur setcap cap_sys_admin=eip $v
$ unshare -Ur setcap -v cap_sys_admin=eip $v
nsowner[got=1000, want=0],/tmp/tmp.HHDiOOl9fY differs in []
Fix this bug by calling cap_inode_getsecurity() in
security_inode_getsecurity() instead of returning
-EOPNOTSUPP, when CONFIG_SECURITY=n.
*1 - note, if libcap is too old for getcap to have the '-n'
option, then use verify-caps instead.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=209689
Cc: Hervé Guillemet <herve@guillemet.org>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Serge Hallyn <shallyn@cisco.com>
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Signed-off-by: James Morris <jamorris@linux.microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/security.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index ce6265960d6c4..dab093af4ee8d 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -780,7 +780,7 @@ static inline int security_inode_killpriv(struct dentry *dentry)
static inline int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
{
- return -EOPNOTSUPP;
+ return cap_inode_getsecurity(inode, name, buffer, alloc);
}
static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 179/242] Input: cros_ec_keyb - send scancodes in addition to key events
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 178/242] [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 180/242] Input: goodix - add upside-down quirk for Teclast X98 Pro tablet Greg Kroah-Hartman
` (64 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rajat Jain, Dmitry Torokhov, Sasha Levin
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[ Upstream commit 80db2a087f425b63f0163bc95217abd01c637cb5 ]
To let userspace know what 'scancodes' should be used in EVIOCGKEYCODE
and EVIOCSKEYCODE ioctls, we should send EV_MSC/MSC_SCAN events in
addition to EV_KEY/KEY_* events. The driver already declared MSC_SCAN
capability, so it is only matter of actually sending the events.
Link: https://lore.kernel.org/r/X87aOaSptPTvZ3nZ@google.com
Acked-by: Rajat Jain <rajatja@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/keyboard/cros_ec_keyb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
index 0993b3f12df6a..149f4045f0f15 100644
--- a/drivers/input/keyboard/cros_ec_keyb.c
+++ b/drivers/input/keyboard/cros_ec_keyb.c
@@ -196,6 +196,7 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev,
"changed: [r%d c%d]: byte %02x\n",
row, col, new_state);
+ input_event(idev, EV_MSC, MSC_SCAN, pos);
input_report_key(idev, keycodes[pos],
new_state);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 180/242] Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 179/242] Input: cros_ec_keyb - send scancodes in addition to key events Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 181/242] media: gspca: Fix memory leak in probe Greg Kroah-Hartman
` (63 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Simon Beginn, Bastien Nocera,
Dmitry Torokhov, Sasha Levin
From: Simon Beginn <linux@simonmicro.de>
[ Upstream commit cffdd6d90482316e18d686060a4397902ea04bd2 ]
The touchscreen on the Teclast x98 Pro is also mounted upside-down in
relation to the display orientation.
Signed-off-by: Simon Beginn <linux@simonmicro.de>
Signed-off-by: Bastien Nocera <hadess@hadess.net>
Link: https://lore.kernel.org/r/20201117004253.27A5A27EFD@localhost
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/touchscreen/goodix.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
index 777dd5b159d39..87f5722a67829 100644
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -101,6 +101,18 @@ static const struct dmi_system_id rotated_screen[] = {
DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"),
},
},
+ {
+ .ident = "Teclast X98 Pro",
+ .matches = {
+ /*
+ * Only match BIOS date, because the manufacturers
+ * BIOS does not report the board name at all
+ * (sometimes)...
+ */
+ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
+ DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"),
+ },
+ },
{
.ident = "WinBook TW100",
.matches = {
--
2.27.0
^ permalink raw reply related [flat|nested] 245+ messages in thread* [PATCH 4.14 181/242] media: gspca: Fix memory leak in probe
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 180/242] Input: goodix - add upside-down quirk for Teclast X98 Pro tablet Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 182/242] media: sunxi-cir: ensure IR is handled when it is continuous Greg Kroah-Hartman
` (62 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Stern, Hans Verkuil,
Mauro Carvalho Chehab, syzbot+44e64397bd81d5e84cba
From: Alan Stern <stern@rowland.harvard.edu>
commit e469d0b09a19496e1972a20974bbf55b728151eb upstream.
The gspca driver leaks memory when a probe fails. gspca_dev_probe2()
calls v4l2_device_register(), which takes a reference to the
underlying device node (in this case, a USB interface). But the
failure pathway neglects to call v4l2_device_unregister(), the routine
responsible for dropping this reference. Consequently the memory for
the USB interface and its device never gets released.
This patch adds the missing function call.
Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/gspca/gspca.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -2140,6 +2140,7 @@ out:
input_unregister_device(gspca_dev->input_dev);
#endif
v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+ v4l2_device_unregister(&gspca_dev->v4l2_dev);
kfree(gspca_dev->usb_buf);
kfree(gspca_dev);
return ret;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 182/242] media: sunxi-cir: ensure IR is handled when it is continuous
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 181/242] media: gspca: Fix memory leak in probe Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 183/242] media: netup_unidvb: Dont leak SPI master in probe error path Greg Kroah-Hartman
` (61 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Maxime Ripard,
Sean Young, Mauro Carvalho Chehab
From: Sean Young <sean@mess.org>
commit 3f56df4c8ffeb120ed41906d3aae71799b7e726a upstream.
If a user holds a button down on a remote, then no ir idle interrupt will
be generated until the user releases the button, depending on how quickly
the remote repeats. No IR is processed until that point, which means that
holding down a button may not do anything.
This also resolves an issue on a Cubieboard 1 where the IR receiver is
picking up ambient infrared as IR and spews out endless
"rc rc0: IR event FIFO is full!" messages unless you choose to live in
the dark.
Cc: stable@vger.kernel.org
Tested-by: Hans Verkuil <hverkuil@xs4all.nl>
Acked-by: Maxime Ripard <mripard@kernel.org>
Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/sunxi-cir.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/media/rc/sunxi-cir.c
+++ b/drivers/media/rc/sunxi-cir.c
@@ -132,6 +132,8 @@ static irqreturn_t sunxi_ir_irq(int irqn
} else if (status & REG_RXINT_RPEI_EN) {
ir_raw_event_set_idle(ir->rc, true);
ir_raw_event_handle(ir->rc);
+ } else {
+ ir_raw_event_handle(ir->rc);
}
spin_unlock(&ir->ir_lock);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 183/242] media: netup_unidvb: Dont leak SPI master in probe error path
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 182/242] media: sunxi-cir: ensure IR is handled when it is continuous Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 184/242] Input: cyapa_gen6 - fix out-of-bounds stack access Greg Kroah-Hartman
` (60 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mauro Carvalho Chehab,
Kozlov Sergey, Mark Brown
From: Lukas Wunner <lukas@wunner.de>
commit e297ddf296de35037fa97f4302782def196d350a upstream.
If the call to spi_register_master() fails on probe of the NetUP
Universal DVB driver, the spi_master struct is erroneously not freed.
Likewise, if spi_new_device() fails, the spi_controller struct is
not unregistered. Plug the leaks.
While at it, fix an ordering issue in netup_spi_release() wherein
spi_unregister_master() is called after fiddling with the IRQ control
register. The correct order is to call spi_unregister_master() *before*
this teardown step because bus accesses may still be ongoing until that
function returns.
Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: <stable@vger.kernel.org> # v4.3+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.3+
Cc: Kozlov Sergey <serjk@netup.ru>
Link: https://lore.kernel.org/r/c4c24f333fc7840f4a3db24789e6e10dd660bede.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/netup_unidvb/netup_unidvb_spi.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
@@ -184,7 +184,7 @@ int netup_spi_init(struct netup_unidvb_d
struct spi_master *master;
struct netup_spi *nspi;
- master = spi_alloc_master(&ndev->pci_dev->dev,
+ master = devm_spi_alloc_master(&ndev->pci_dev->dev,
sizeof(struct netup_spi));
if (!master) {
dev_err(&ndev->pci_dev->dev,
@@ -217,6 +217,7 @@ int netup_spi_init(struct netup_unidvb_d
ndev->pci_slot,
ndev->pci_func);
if (!spi_new_device(master, &netup_spi_board)) {
+ spi_unregister_master(master);
ndev->spi = NULL;
dev_err(&ndev->pci_dev->dev,
"%s(): unable to create SPI device\n", __func__);
@@ -235,13 +236,13 @@ void netup_spi_release(struct netup_unid
if (!spi)
return;
+ spi_unregister_master(spi->master);
spin_lock_irqsave(&spi->lock, flags);
reg = readw(&spi->regs->control_stat);
writew(reg | NETUP_SPI_CTRL_IRQ, &spi->regs->control_stat);
reg = readw(&spi->regs->control_stat);
writew(reg & ~NETUP_SPI_CTRL_IMASK, &spi->regs->control_stat);
spin_unlock_irqrestore(&spi->lock, flags);
- spi_unregister_master(spi->master);
ndev->spi = NULL;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 184/242] Input: cyapa_gen6 - fix out-of-bounds stack access
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 183/242] media: netup_unidvb: Dont leak SPI master in probe error path Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 185/242] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() Greg Kroah-Hartman
` (59 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Dmitry Torokhov
From: Arnd Bergmann <arnd@arndb.de>
commit f051ae4f6c732c231046945b36234e977f8467c6 upstream.
gcc -Warray-bounds warns about a serious bug in
cyapa_pip_retrieve_data_structure:
drivers/input/mouse/cyapa_gen6.c: In function 'cyapa_pip_retrieve_data_structure.constprop':
include/linux/unaligned/access_ok.h:40:17: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds]
40 | *((__le16 *)p) = cpu_to_le16(val);
drivers/input/mouse/cyapa_gen6.c:569:13: note: while referencing 'cmd'
569 | } __packed cmd;
| ^~~
Apparently the '-2' was added to the pointer instead of the value,
writing garbage into the stack next to this variable.
Fixes: c2c06c41f700 ("Input: cyapa - add gen6 device module support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20201026161332.3708389-1-arnd@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/cyapa_gen6.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/mouse/cyapa_gen6.c
+++ b/drivers/input/mouse/cyapa_gen6.c
@@ -573,7 +573,7 @@ static int cyapa_pip_retrieve_data_struc
memset(&cmd, 0, sizeof(cmd));
put_unaligned_le16(PIP_OUTPUT_REPORT_ADDR, &cmd.head.addr);
- put_unaligned_le16(sizeof(cmd), &cmd.head.length - 2);
+ put_unaligned_le16(sizeof(cmd) - 2, &cmd.head.length);
cmd.head.report_id = PIP_APP_CMD_REPORT_ID;
cmd.head.cmd_code = PIP_RETRIEVE_DATA_STRUCTURE;
put_unaligned_le16(read_offset, &cmd.read_offset);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 185/242] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 184/242] Input: cyapa_gen6 - fix out-of-bounds stack access Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 186/242] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Greg Kroah-Hartman
` (58 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Mika Westerberg,
Bjorn Helgaas
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
commit 7482c5cb90e5a7f9e9e12dd154d405e0219656e3 upstream.
The idea behind acpi_pm_set_bridge_wakeup() was to allow bridges to
be reference counted for wakeup enabling, because they may be enabled
to signal wakeup on behalf of their subordinate devices and that
may happen for multiple times in a row, whereas for the other devices
it only makes sense to enable wakeup signaling once.
However, this becomes problematic if the bridge itself is suspended,
because it is treated as a "regular" device in that case and the
reference counting doesn't work.
For instance, suppose that there are two devices below a bridge and
they both can signal wakeup. Every time one of them is suspended,
wakeup signaling is enabled for the bridge, so when they both have
been suspended, the bridge's wakeup reference counter value is 2.
Say that the bridge is suspended subsequently and acpi_pci_wakeup()
is called for it. Because the bridge can signal wakeup, that
function will invoke acpi_pm_set_device_wakeup() to configure it
and __acpi_pm_set_device_wakeup() will be called with the last
argument equal to 1. This causes __acpi_device_wakeup_enable()
invoked by it to omit the reference counting, because the reference
counter of the target device (the bridge) is 2 at that time.
Now say that the bridge resumes and one of the device below it
resumes too, so the bridge's reference counter becomes 0 and
wakeup signaling is disabled for it, but there is still the other
suspended device which may need the bridge to signal wakeup on its
behalf and that is not going to work.
To address this scenario, use wakeup enable reference counting for
all devices, not just for bridges, so drop the last argument from
__acpi_device_wakeup_enable() and __acpi_pm_set_device_wakeup(),
which causes acpi_pm_set_device_wakeup() and
acpi_pm_set_bridge_wakeup() to become identical, so drop the latter
and use the former instead of it everywhere.
Fixes: 1ba51a7c1496 ("ACPI / PCI / PM: Rework acpi_pci_propagate_wakeup()")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: 4.14+ <stable@vger.kernel.org> # 4.14+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/device_pm.c | 41 ++++++++++++-----------------------------
drivers/pci/pci-acpi.c | 4 ++--
include/acpi/acpi_bus.h | 5 -----
3 files changed, 14 insertions(+), 36 deletions(-)
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -694,7 +694,7 @@ static void acpi_pm_notify_work_func(str
static DEFINE_MUTEX(acpi_wakeup_lock);
static int __acpi_device_wakeup_enable(struct acpi_device *adev,
- u32 target_state, int max_count)
+ u32 target_state)
{
struct acpi_device_wakeup *wakeup = &adev->wakeup;
acpi_status status;
@@ -702,9 +702,10 @@ static int __acpi_device_wakeup_enable(s
mutex_lock(&acpi_wakeup_lock);
- if (wakeup->enable_count >= max_count)
+ if (wakeup->enable_count >= INT_MAX) {
+ acpi_handle_info(adev->handle, "Wakeup enable count out of bounds!\n");
goto out;
-
+ }
if (wakeup->enable_count > 0)
goto inc;
@@ -741,7 +742,7 @@ out:
*/
static int acpi_device_wakeup_enable(struct acpi_device *adev, u32 target_state)
{
- return __acpi_device_wakeup_enable(adev, target_state, 1);
+ return __acpi_device_wakeup_enable(adev, target_state);
}
/**
@@ -771,8 +772,12 @@ out:
mutex_unlock(&acpi_wakeup_lock);
}
-static int __acpi_pm_set_device_wakeup(struct device *dev, bool enable,
- int max_count)
+/**
+ * acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device.
+ * @dev: Device to enable/disable to generate wakeup events.
+ * @enable: Whether to enable or disable the wakeup functionality.
+ */
+int acpi_pm_set_device_wakeup(struct device *dev, bool enable)
{
struct acpi_device *adev;
int error;
@@ -792,37 +797,15 @@ static int __acpi_pm_set_device_wakeup(s
return 0;
}
- error = __acpi_device_wakeup_enable(adev, acpi_target_system_state(),
- max_count);
+ error = __acpi_device_wakeup_enable(adev, acpi_target_system_state());
if (!error)
dev_dbg(dev, "Wakeup enabled by ACPI\n");
return error;
}
-
-/**
- * acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device.
- * @dev: Device to enable/disable to generate wakeup events.
- * @enable: Whether to enable or disable the wakeup functionality.
- */
-int acpi_pm_set_device_wakeup(struct device *dev, bool enable)
-{
- return __acpi_pm_set_device_wakeup(dev, enable, 1);
-}
EXPORT_SYMBOL_GPL(acpi_pm_set_device_wakeup);
/**
- * acpi_pm_set_bridge_wakeup - Enable/disable remote wakeup for given bridge.
- * @dev: Bridge device to enable/disable to generate wakeup events.
- * @enable: Whether to enable or disable the wakeup functionality.
- */
-int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable)
-{
- return __acpi_pm_set_device_wakeup(dev, enable, INT_MAX);
-}
-EXPORT_SYMBOL_GPL(acpi_pm_set_bridge_wakeup);
-
-/**
* acpi_dev_pm_low_power - Put ACPI device into a low-power state.
* @dev: Device to put into a low-power state.
* @adev: ACPI device node corresponding to @dev.
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -573,7 +573,7 @@ static int acpi_pci_propagate_wakeup(str
{
while (bus->parent) {
if (acpi_pm_device_can_wakeup(&bus->self->dev))
- return acpi_pm_set_bridge_wakeup(&bus->self->dev, enable);
+ return acpi_pm_set_device_wakeup(&bus->self->dev, enable);
bus = bus->parent;
}
@@ -581,7 +581,7 @@ static int acpi_pci_propagate_wakeup(str
/* We have reached the root bus. */
if (bus->bridge) {
if (acpi_pm_device_can_wakeup(bus->bridge))
- return acpi_pm_set_bridge_wakeup(bus->bridge, enable);
+ return acpi_pm_set_device_wakeup(bus->bridge, enable);
}
return 0;
}
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -619,7 +619,6 @@ acpi_status acpi_remove_pm_notifier(stru
bool acpi_pm_device_can_wakeup(struct device *dev);
int acpi_pm_device_sleep_state(struct device *, int *, int);
int acpi_pm_set_device_wakeup(struct device *dev, bool enable);
-int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable);
#else
static inline void acpi_pm_wakeup_event(struct device *dev)
{
@@ -650,10 +649,6 @@ static inline int acpi_pm_set_device_wak
{
return -ENODEV;
}
-static inline int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable)
-{
- return -ENODEV;
-}
#endif
#ifdef CONFIG_ACPI_SLEEP
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 186/242] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 185/242] PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 187/242] ACPI: PNP: compare the string length in the matching_id() Greg Kroah-Hartman
` (57 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Daniel Scally, Rafael J. Wysocki
From: Daniel Scally <djrscally@gmail.com>
commit 12fc4dad94dfac25599f31257aac181c691ca96f upstream.
This reverts commit 8a66790b7850a6669129af078768a1d42076a0ef.
Switching this function to AE_CTRL_TERMINATE broke the documented
behaviour of acpi_dev_get_resources() - AE_CTRL_TERMINATE does not, in
fact, terminate the resource walk because acpi_walk_resource_buffer()
ignores it (specifically converting it to AE_OK), referring to that
value as "an OK termination by the user function". This means that
acpi_dev_get_resources() does not abort processing when the preproc
function returns a negative value.
Signed-off-by: Daniel Scally <djrscally@gmail.com>
Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/resource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -548,7 +548,7 @@ static acpi_status acpi_dev_process_reso
ret = c->preproc(ares, c->preproc_data);
if (ret < 0) {
c->error = ret;
- return AE_CTRL_TERMINATE;
+ return AE_ABORT_METHOD;
} else if (ret > 0) {
return AE_OK;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 187/242] ACPI: PNP: compare the string length in the matching_id()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 186/242] Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 188/242] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 Greg Kroah-Hartman
` (56 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Hui Wang
From: Hui Wang <hui.wang@canonical.com>
commit b08221c40febcbda9309dd70c61cf1b0ebb0e351 upstream.
Recently we met a touchscreen problem on some Thinkpad machines, the
touchscreen driver (i2c-hid) is not loaded and the touchscreen can't
work.
An i2c ACPI device with the name WACF2200 is defined in the BIOS, with
the current rule in matching_id(), this device will be regarded as
a PNP device since there is WACFXXX in the acpi_pnp_device_ids[] and
this PNP device is attached to the acpi device as the 1st
physical_node, this will make the i2c bus match fail when i2c bus
calls acpi_companion_match() to match the acpi_id_table in the i2c-hid
driver.
WACF2200 is an i2c device instead of a PNP device, after adding the
string length comparing, the matching_id() will return false when
matching WACF2200 and WACFXXX, and it is reasonable to compare the
string length when matching two IDs.
Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpi_pnp.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/acpi/acpi_pnp.c
+++ b/drivers/acpi/acpi_pnp.c
@@ -320,6 +320,9 @@ static bool matching_id(const char *idst
{
int i;
+ if (strlen(idstr) != strlen(list_id))
+ return false;
+
if (memcmp(idstr, list_id, 3))
return false;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 188/242] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 187/242] ACPI: PNP: compare the string length in the matching_id() Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 189/242] ALSA: pcm: oss: Fix a few more UBSAN fixes Greg Kroah-Hartman
` (55 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Chiu, Jian-Hong Pan, Takashi Iwai
From: Chris Chiu <chiu@endlessos.org>
commit 7e413528474d5895e3e315c019fb0c43522eb6d9 upstream.
The ASUS laptop Q524UQK with ALC255 codec can't detect the headset
microphone until ALC255_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied.
Signed-off-by: Chris Chiu <chiu@endlessos.org>
Signed-off-by: Jian-Hong Pan <jhp@endlessos.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209045730.9972-1-chiu@endlessos.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6590,6 +6590,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 189/242] ALSA: pcm: oss: Fix a few more UBSAN fixes
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 188/242] ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255 Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 190/242] ALSA: usb-audio: Disable sample read check if firmware doesnt give back Greg Kroah-Hartman
` (54 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+33ef0b6639a8d2d42b4c, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 11cb881bf075cea41092a20236ba708b18e1dbb2 upstream.
There are a few places that call round{up|down}_pow_of_two() with the
value zero, and this causes undefined behavior warnings. Avoid
calling those macros if such a nonsense value is passed; it's a minor
optimization as well, as we handle it as either an error or a value to
be skipped, instead.
Reported-by: syzbot+33ef0b6639a8d2d42b4c@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201218161730.26596-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/oss/pcm_oss.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -708,6 +708,8 @@ static int snd_pcm_oss_period_size(struc
oss_buffer_size = snd_pcm_plug_client_size(substream,
snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, NULL)) * oss_frame_size;
+ if (!oss_buffer_size)
+ return -EINVAL;
oss_buffer_size = rounddown_pow_of_two(oss_buffer_size);
if (atomic_read(&substream->mmap_count)) {
if (oss_buffer_size > runtime->oss.mmap_bytes)
@@ -743,17 +745,21 @@ static int snd_pcm_oss_period_size(struc
min_period_size = snd_pcm_plug_client_size(substream,
snd_pcm_hw_param_value_min(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
- min_period_size *= oss_frame_size;
- min_period_size = roundup_pow_of_two(min_period_size);
- if (oss_period_size < min_period_size)
- oss_period_size = min_period_size;
+ if (min_period_size) {
+ min_period_size *= oss_frame_size;
+ min_period_size = roundup_pow_of_two(min_period_size);
+ if (oss_period_size < min_period_size)
+ oss_period_size = min_period_size;
+ }
max_period_size = snd_pcm_plug_client_size(substream,
snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
- max_period_size *= oss_frame_size;
- max_period_size = rounddown_pow_of_two(max_period_size);
- if (oss_period_size > max_period_size)
- oss_period_size = max_period_size;
+ if (max_period_size) {
+ max_period_size *= oss_frame_size;
+ max_period_size = rounddown_pow_of_two(max_period_size);
+ if (oss_period_size > max_period_size)
+ oss_period_size = max_period_size;
+ }
oss_periods = oss_buffer_size / oss_period_size;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 190/242] ALSA: usb-audio: Disable sample read check if firmware doesnt give back
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 189/242] ALSA: pcm: oss: Fix a few more UBSAN fixes Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 191/242] s390/smp: perform initial CPU reset also for SMT siblings Greg Kroah-Hartman
` (53 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 9df28edce7c6ab38050235f6f8b43dd7ccd01b6d upstream.
Some buggy firmware don't give the current sample rate but leaves
zero. Handle this case more gracefully without warning but just skip
the current rate verification from the next time.
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201218145858.2357-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/clock.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -327,6 +327,12 @@ static int set_sample_rate_v1(struct snd
}
crate = data[0] | (data[1] << 8) | (data[2] << 16);
+ if (!crate) {
+ dev_info(&dev->dev, "failed to read current rate; disabling the check\n");
+ chip->sample_rate_read_error = 3; /* three strikes, see above */
+ return 0;
+ }
+
if (crate != rate) {
dev_warn(&dev->dev, "current rate %d is different from the runtime rate %d\n", crate, rate);
// runtime->rate = crate;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 191/242] s390/smp: perform initial CPU reset also for SMT siblings
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 190/242] ALSA: usb-audio: Disable sample read check if firmware doesnt give back Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 192/242] s390/dasd: prevent inconsistent LCU device data Greg Kroah-Hartman
` (52 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Sven Schnelle, stable
From: Sven Schnelle <svens@linux.ibm.com>
commit b5e438ebd7e808d1d2435159ac4742e01a94b8da upstream.
Not resetting the SMT siblings might leave them in unpredictable
state. One of the observed problems was that the CPU timer wasn't
reset and therefore large system time values where accounted during
CPU bringup.
Cc: <stable@kernel.org> # 4.0
Fixes: 10ad34bc76dfb ("s390: add SMT support")
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/smp.c | 18 +++---------------
1 file changed, 3 insertions(+), 15 deletions(-)
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -864,24 +864,12 @@ static void smp_start_secondary(void *cp
/* Upping and downing of CPUs */
int __cpu_up(unsigned int cpu, struct task_struct *tidle)
{
- struct pcpu *pcpu;
- int base, i, rc;
+ struct pcpu *pcpu = pcpu_devices + cpu;
+ int rc;
- pcpu = pcpu_devices + cpu;
if (pcpu->state != CPU_STATE_CONFIGURED)
return -EIO;
- base = smp_get_base_cpu(cpu);
- for (i = 0; i <= smp_cpu_mtid; i++) {
- if (base + i < nr_cpu_ids)
- if (cpu_online(base + i))
- break;
- }
- /*
- * If this is the first CPU of the core to get online
- * do an initial CPU reset.
- */
- if (i > smp_cpu_mtid &&
- pcpu_sigp_retry(pcpu_devices + base, SIGP_INITIAL_CPU_RESET, 0) !=
+ if (pcpu_sigp_retry(pcpu, SIGP_INITIAL_CPU_RESET, 0) !=
SIGP_CC_ORDER_CODE_ACCEPTED)
return -EIO;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 192/242] s390/dasd: prevent inconsistent LCU device data
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 191/242] s390/smp: perform initial CPU reset also for SMT siblings Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 193/242] s390/dasd: fix list corruption of pavgroup group list Greg Kroah-Hartman
` (51 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe
From: Stefan Haberland <sth@linux.ibm.com>
commit a29ea01653493b94ea12bb2b89d1564a265081b6 upstream.
Prevent _lcu_update from adding a device to a pavgroup if the LCU still
requires an update. The data is not reliable any longer and in parallel
devices might have been moved on the lists already.
This might lead to list corruptions or invalid PAV grouping.
Only add devices to a pavgroup if the LCU is up to date. Additional steps
are taken by the scheduled lcu update.
Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd_alias.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -503,6 +503,14 @@ static int _lcu_update(struct dasd_devic
return rc;
spin_lock_irqsave(&lcu->lock, flags);
+ /*
+ * there is another update needed skip the remaining handling
+ * the data might already be outdated
+ * but especially do not add the device to an LCU with pending
+ * update
+ */
+ if (lcu->flags & NEED_UAC_UPDATE)
+ goto out;
lcu->pav = NO_PAV;
for (i = 0; i < MAX_DEVICES_PER_LCU; ++i) {
switch (lcu->uac->unit[i].ua_type) {
@@ -521,6 +529,7 @@ static int _lcu_update(struct dasd_devic
alias_list) {
_add_device_to_lcu(lcu, device, refdev);
}
+out:
spin_unlock_irqrestore(&lcu->lock, flags);
return 0;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 193/242] s390/dasd: fix list corruption of pavgroup group list
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 192/242] s390/dasd: prevent inconsistent LCU device data Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:49 ` [PATCH 4.14 194/242] s390/dasd: fix list corruption of lcu list Greg Kroah-Hartman
` (50 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe
From: Stefan Haberland <sth@linux.ibm.com>
commit 0ede91f83aa335da1c3ec68eb0f9e228f269f6d8 upstream.
dasd_alias_add_device() moves devices to the active_devices list in case
of a scheduled LCU update regardless if they have previously been in a
pavgroup or not.
Example: device A and B are in the same pavgroup.
Device A has already been in a pavgroup and the private->pavgroup pointer
is set and points to a valid pavgroup. While going through dasd_add_device
it is moved from the pavgroup to the active_devices list.
In parallel device B might be removed from the same pavgroup in
remove_device_from_lcu() which in turn checks if the group is empty
and deletes it accordingly because device A has already been removed from
there.
When now device A enters remove_device_from_lcu() it is tried to remove it
from the pavgroup again because the pavgroup pointer is still set and again
the empty group will be cleaned up which leads to a list corruption.
Fix by setting private->pavgroup to NULL in dasd_add_device.
If the device has been the last device on the pavgroup an empty pavgroup
remains but this will be cleaned up by the scheduled lcu_update which
iterates over all existing pavgroups.
Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd_alias.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -634,6 +634,7 @@ int dasd_alias_add_device(struct dasd_de
}
if (lcu->flags & UPDATE_PENDING) {
list_move(&device->alias_list, &lcu->active_devices);
+ private->pavgroup = NULL;
_schedule_lcu_update(lcu, device);
}
spin_unlock_irqrestore(&lcu->lock, flags);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 194/242] s390/dasd: fix list corruption of lcu list
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 193/242] s390/dasd: fix list corruption of pavgroup group list Greg Kroah-Hartman
@ 2020-12-28 12:49 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 195/242] staging: comedi: mf6x4: Fix AI end-of-conversion detection Greg Kroah-Hartman
` (49 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:49 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe
From: Stefan Haberland <sth@linux.ibm.com>
commit 53a7f655834c7c335bf683f248208d4fbe4b47bc upstream.
In dasd_alias_disconnect_device_from_lcu the device is removed from any
list on the LCU. Afterwards the LCU is removed from the lcu list if it
does not contain devices any longer.
The lcu->lock protects the lcu from parallel updates. But to cancel all
workers and wait for completion the lcu->lock has to be unlocked.
If two devices are removed in parallel and both are removed from the LCU
the first device that takes the lcu->lock again will delete the LCU because
it is already empty but the second device also tries to free the LCU which
leads to a list corruption of the lcu list.
Fix by removing the device right before the lcu is checked without
unlocking the lcu->lock in between.
Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd_alias.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -256,7 +256,6 @@ void dasd_alias_disconnect_device_from_l
return;
device->discipline->get_uid(device, &uid);
spin_lock_irqsave(&lcu->lock, flags);
- list_del_init(&device->alias_list);
/* make sure that the workers don't use this device */
if (device == lcu->suc_data.device) {
spin_unlock_irqrestore(&lcu->lock, flags);
@@ -283,6 +282,7 @@ void dasd_alias_disconnect_device_from_l
spin_lock_irqsave(&aliastree.lock, flags);
spin_lock(&lcu->lock);
+ list_del_init(&device->alias_list);
if (list_empty(&lcu->grouplist) &&
list_empty(&lcu->active_devices) &&
list_empty(&lcu->inactive_devices)) {
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 195/242] staging: comedi: mf6x4: Fix AI end-of-conversion detection
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2020-12-28 12:49 ` [PATCH 4.14 194/242] s390/dasd: fix list corruption of lcu list Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 196/242] powerpc/perf: Exclude kernel samples while counting events in user space Greg Kroah-Hartman
` (48 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rostislav Lisovy, Ian Abbott
From: Ian Abbott <abbotti@mev.co.uk>
commit 56c90457ebfe9422496aac6ef3d3f0f0ea8b2ec2 upstream.
I have had reports from two different people that attempts to read the
analog input channels of the MF624 board fail with an `ETIMEDOUT` error.
After triggering the conversion, the code calls `comedi_timeout()` with
`mf6x4_ai_eoc()` as the callback function to check if the conversion is
complete. The callback returns 0 if complete or `-EBUSY` if not yet
complete. `comedi_timeout()` returns `-ETIMEDOUT` if it has not
completed within a timeout period which is propagated as an error to the
user application.
The existing code considers the conversion to be complete when the EOLC
bit is high. However, according to the user manuals for the MF624 and
MF634 boards, this test is incorrect because EOLC is an active low
signal that goes high when the conversion is triggered, and goes low
when the conversion is complete. Fix the problem by inverting the test
of the EOLC bit state.
Fixes: 04b565021a83 ("comedi: Humusoft MF634 and MF624 DAQ cards driver")
Cc: <stable@vger.kernel.org> # v4.4+
Cc: Rostislav Lisovy <lisovy@gmail.com>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20201207145806.4046-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/drivers/mf6x4.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/staging/comedi/drivers/mf6x4.c
+++ b/drivers/staging/comedi/drivers/mf6x4.c
@@ -121,8 +121,9 @@ static int mf6x4_ai_eoc(struct comedi_de
struct mf6x4_private *devpriv = dev->private;
unsigned int status;
+ /* EOLC goes low at end of conversion. */
status = ioread32(devpriv->gpioc_reg);
- if (status & MF6X4_GPIOC_EOLC)
+ if ((status & MF6X4_GPIOC_EOLC) == 0)
return 0;
return -EBUSY;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 196/242] powerpc/perf: Exclude kernel samples while counting events in user space.
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 195/242] staging: comedi: mf6x4: Fix AI end-of-conversion detection Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 197/242] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() Greg Kroah-Hartman
` (47 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Athira Rajeev, Michael Ellerman
From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
commit aa8e21c053d72b6639ea5a7f1d3a1d0209534c94 upstream.
Perf event attritube supports exclude_kernel flag to avoid
sampling/profiling in supervisor state (kernel). Based on this event
attr flag, Monitor Mode Control Register bit is set to freeze on
supervisor state. But sometimes (due to hardware limitation), Sampled
Instruction Address Register (SIAR) locks on to kernel address even
when freeze on supervisor is set. Patch here adds a check to drop
those samples.
Cc: stable@vger.kernel.org
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1606289215-1433-1-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/perf/core-book3s.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2068,6 +2068,16 @@ static void record_and_restart(struct pe
perf_event_update_userpage(event);
/*
+ * Due to hardware limitation, sometimes SIAR could sample a kernel
+ * address even when freeze on supervisor state (kernel) is set in
+ * MMCR2. Check attr.exclude_kernel and address to drop the sample in
+ * these cases.
+ */
+ if (event->attr.exclude_kernel && record)
+ if (is_kernel_addr(mfspr(SPRN_SIAR)))
+ record = 0;
+
+ /*
* Finally record data if requested.
*/
if (record) {
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 197/242] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 196/242] powerpc/perf: Exclude kernel samples while counting events in user space Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 198/242] EDAC/amd64: Fix PCI component registration Greg Kroah-Hartman
` (46 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Herbert Xu
From: Ard Biesheuvel <ardb@kernel.org>
commit 17858b140bf49961b71d4e73f1c3ea9bc8e7dda0 upstream.
ecdh_set_secret() casts a void* pointer to a const u64* in order to
feed it into ecc_is_key_valid(). This is not generally permitted by
the C standard, and leads to actual misalignment faults on ARMv6
cores. In some cases, these are fixed up in software, but this still
leads to performance hits that are entirely avoidable.
So let's copy the key into the ctx buffer first, which we will do
anyway in the common case, and which guarantees correct alignment.
Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/ecdh.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/crypto/ecdh.c
+++ b/crypto/ecdh.c
@@ -57,12 +57,13 @@ static int ecdh_set_secret(struct crypto
return ecc_gen_privkey(ctx->curve_id, ctx->ndigits,
ctx->private_key);
- if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
- (const u64 *)params.key, params.key_size) < 0)
- return -EINVAL;
-
memcpy(ctx->private_key, params.key, params.key_size);
+ if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
+ ctx->private_key, params.key_size) < 0) {
+ memzero_explicit(ctx->private_key, params.key_size);
+ return -EINVAL;
+ }
return 0;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 198/242] EDAC/amd64: Fix PCI component registration
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 197/242] crypto: ecdh - avoid unaligned accesses in ecdh_set_secret() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 199/242] USB: serial: mos7720: fix parallel-port state restore Greg Kroah-Hartman
` (45 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Borislav Petkov
From: Borislav Petkov <bp@suse.de>
commit 706657b1febf446a9ba37dc51b89f46604f57ee9 upstream.
In order to setup its PCI component, the driver needs any node private
instance in order to get a reference to the PCI device and hand that
into edac_pci_create_generic_ctl(). For convenience, it uses the 0th
memory controller descriptor under the assumption that if any, the 0th
will be always present.
However, this assumption goes wrong when the 0th node doesn't have
memory and the driver doesn't initialize an instance for it:
EDAC amd64: F17h detected (node 0).
...
EDAC amd64: Node 0: No DIMMs detected.
But looking up node instances is not really needed - all one needs is
the pointer to the proper device which gets discovered during instance
init.
So stash that pointer into a variable and use it when setting up the
EDAC PCI component.
Clear that variable when the driver needs to unwind due to some
instances failing init to avoid any registration imbalance.
Cc: <stable@vger.kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20201122150815.13808-1-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/amd64_edac.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -18,6 +18,9 @@ static struct msr __percpu *msrs;
/* Per-node stuff */
static struct ecc_settings **ecc_stngs;
+/* Device for the PCI component */
+static struct device *pci_ctl_dev;
+
/*
* Valid scrub rates for the K8 hardware memory scrubber. We map the scrubbing
* bandwidth to a valid bit pattern. The 'set' operation finds the 'matching-
@@ -2554,6 +2557,9 @@ reserve_mc_sibling_devs(struct amd64_pvt
return -ENODEV;
}
+ if (!pci_ctl_dev)
+ pci_ctl_dev = &pvt->F0->dev;
+
edac_dbg(1, "F0: %s\n", pci_name(pvt->F0));
edac_dbg(1, "F3: %s\n", pci_name(pvt->F3));
edac_dbg(1, "F6: %s\n", pci_name(pvt->F6));
@@ -2578,6 +2584,9 @@ reserve_mc_sibling_devs(struct amd64_pvt
return -ENODEV;
}
+ if (!pci_ctl_dev)
+ pci_ctl_dev = &pvt->F2->dev;
+
edac_dbg(1, "F1: %s\n", pci_name(pvt->F1));
edac_dbg(1, "F2: %s\n", pci_name(pvt->F2));
edac_dbg(1, "F3: %s\n", pci_name(pvt->F3));
@@ -3428,21 +3437,10 @@ static void remove_one_instance(unsigned
static void setup_pci_device(void)
{
- struct mem_ctl_info *mci;
- struct amd64_pvt *pvt;
-
if (pci_ctl)
return;
- mci = edac_mc_find(0);
- if (!mci)
- return;
-
- pvt = mci->pvt_info;
- if (pvt->umc)
- pci_ctl = edac_pci_create_generic_ctl(&pvt->F0->dev, EDAC_MOD_STR);
- else
- pci_ctl = edac_pci_create_generic_ctl(&pvt->F2->dev, EDAC_MOD_STR);
+ pci_ctl = edac_pci_create_generic_ctl(pci_ctl_dev, EDAC_MOD_STR);
if (!pci_ctl) {
pr_warn("%s(): Unable to create PCI control\n", __func__);
pr_warn("%s(): PCI error report via EDAC not set\n", __func__);
@@ -3517,6 +3515,8 @@ static int __init amd64_edac_init(void)
return 0;
err_pci:
+ pci_ctl_dev = NULL;
+
msrs_free(msrs);
msrs = NULL;
@@ -3548,6 +3548,8 @@ static void __exit amd64_edac_exit(void)
kfree(ecc_stngs);
ecc_stngs = NULL;
+ pci_ctl_dev = NULL;
+
msrs_free(msrs);
msrs = NULL;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 199/242] USB: serial: mos7720: fix parallel-port state restore
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 198/242] EDAC/amd64: Fix PCI component registration Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 200/242] USB: serial: keyspan_pda: fix dropped unthrottle interrupts Greg Kroah-Hartman
` (44 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit 975323ab8f116667676c30ca3502a6757bd89e8d upstream.
The parallel-port restore operations is called when a driver claims the
port and is supposed to restore the provided state (e.g. saved when
releasing the port).
Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715")
Cc: stable <stable@vger.kernel.org> # 2.6.35
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/mos7720.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -640,6 +640,8 @@ static void parport_mos7715_restore_stat
spin_unlock(&release_lock);
return;
}
+ mos_parport->shadowDCR = s->u.pc.ctr;
+ mos_parport->shadowECR = s->u.pc.ecr;
write_parport_reg_nonblock(mos_parport, MOS7720_DCR,
mos_parport->shadowDCR);
write_parport_reg_nonblock(mos_parport, MOS7720_ECR,
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 200/242] USB: serial: keyspan_pda: fix dropped unthrottle interrupts
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 199/242] USB: serial: mos7720: fix parallel-port state restore Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 201/242] USB: serial: keyspan_pda: fix write deadlock Greg Kroah-Hartman
` (43 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit 696c541c8c6cfa05d65aa24ae2b9e720fc01766e upstream.
Commit c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity
checks") broke write-unthrottle handling by dropping well-formed
unthrottle-interrupt packets which are precisely two bytes long. This
could lead to blocked writers not being woken up when buffer space again
becomes available.
Instead, stop unconditionally printing the third byte which is
(presumably) only valid on modem-line changes.
Fixes: c528fcb116e6 ("USB: serial: keyspan_pda: fix receive sanity checks")
Cc: stable <stable@vger.kernel.org> # 4.11
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan_pda.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -176,11 +176,11 @@ static void keyspan_pda_rx_interrupt(str
break;
case 1:
/* status interrupt */
- if (len < 3) {
+ if (len < 2) {
dev_warn(&port->dev, "short interrupt message received\n");
break;
}
- dev_dbg(&port->dev, "rx int, d1=%d, d2=%d\n", data[1], data[2]);
+ dev_dbg(&port->dev, "rx int, d1=%d\n", data[1]);
switch (data[1]) {
case 1: /* modemline change */
break;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 201/242] USB: serial: keyspan_pda: fix write deadlock
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 200/242] USB: serial: keyspan_pda: fix dropped unthrottle interrupts Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 202/242] USB: serial: keyspan_pda: fix stalled writes Greg Kroah-Hartman
` (42 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit 7353cad7ee4deaefc16e94727e69285563e219f6 upstream.
The write() callback can be called in interrupt context (e.g. when used
as a console) so interrupts must be disabled while holding the port lock
to prevent a possible deadlock.
Fixes: e81ee637e4ae ("usb-serial: possible irq lock inversion (PPP vs. usb/serial)")
Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
Cc: stable <stable@vger.kernel.org> # 2.6.19
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan_pda.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -447,6 +447,7 @@ static int keyspan_pda_write(struct tty_
int request_unthrottle = 0;
int rc = 0;
struct keyspan_pda_private *priv;
+ unsigned long flags;
priv = usb_get_serial_port_data(port);
/* guess how much room is left in the device's ring buffer, and if we
@@ -466,13 +467,13 @@ static int keyspan_pda_write(struct tty_
the TX urb is in-flight (wait until it completes)
the device is full (wait until it says there is room)
*/
- spin_lock_bh(&port->lock);
+ spin_lock_irqsave(&port->lock, flags);
if (!test_bit(0, &port->write_urbs_free) || priv->tx_throttled) {
- spin_unlock_bh(&port->lock);
+ spin_unlock_irqrestore(&port->lock, flags);
return 0;
}
clear_bit(0, &port->write_urbs_free);
- spin_unlock_bh(&port->lock);
+ spin_unlock_irqrestore(&port->lock, flags);
/* At this point the URB is in our control, nobody else can submit it
again (the only sudden transition was the one from EINPROGRESS to
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 202/242] USB: serial: keyspan_pda: fix stalled writes
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 201/242] USB: serial: keyspan_pda: fix write deadlock Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 203/242] USB: serial: keyspan_pda: fix write-wakeup use-after-free Greg Kroah-Hartman
` (41 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit c01d2c58698f710c9e13ba3e2d296328606f74fd upstream.
Make sure to clear the write-busy flag also in case no new data was
submitted due to lack of device buffer space so that writing is
resumed once space again becomes available.
Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
Cc: stable <stable@vger.kernel.org> # 2.6.13
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan_pda.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -552,7 +552,7 @@ static int keyspan_pda_write(struct tty_
rc = count;
exit:
- if (rc < 0)
+ if (rc <= 0)
set_bit(0, &port->write_urbs_free);
return rc;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 203/242] USB: serial: keyspan_pda: fix write-wakeup use-after-free
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 202/242] USB: serial: keyspan_pda: fix stalled writes Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 204/242] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free Greg Kroah-Hartman
` (40 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit 37faf50615412947868c49aee62f68233307f4e4 upstream.
The driver's deferred write wakeup was never flushed on disconnect,
something which could lead to the driver port data being freed while the
wakeup work is still scheduled.
Fix this by using the usb-serial write wakeup which gets cancelled
properly on disconnect.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan_pda.c | 17 +++--------------
1 file changed, 3 insertions(+), 14 deletions(-)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -47,8 +47,7 @@
struct keyspan_pda_private {
int tx_room;
int tx_throttled;
- struct work_struct wakeup_work;
- struct work_struct unthrottle_work;
+ struct work_struct unthrottle_work;
struct usb_serial *serial;
struct usb_serial_port *port;
};
@@ -101,15 +100,6 @@ static const struct usb_device_id id_tab
};
#endif
-static void keyspan_pda_wakeup_write(struct work_struct *work)
-{
- struct keyspan_pda_private *priv =
- container_of(work, struct keyspan_pda_private, wakeup_work);
- struct usb_serial_port *port = priv->port;
-
- tty_port_tty_wakeup(&port->port);
-}
-
static void keyspan_pda_request_unthrottle(struct work_struct *work)
{
struct keyspan_pda_private *priv =
@@ -187,7 +177,7 @@ static void keyspan_pda_rx_interrupt(str
case 2: /* tx unthrottle interrupt */
priv->tx_throttled = 0;
/* queue up a wakeup at scheduler time */
- schedule_work(&priv->wakeup_work);
+ usb_serial_port_softint(port);
break;
default:
break;
@@ -567,7 +557,7 @@ static void keyspan_pda_write_bulk_callb
priv = usb_get_serial_port_data(port);
/* queue up a wakeup at scheduler time */
- schedule_work(&priv->wakeup_work);
+ usb_serial_port_softint(port);
}
@@ -720,7 +710,6 @@ static int keyspan_pda_port_probe(struct
if (!priv)
return -ENOMEM;
- INIT_WORK(&priv->wakeup_work, keyspan_pda_wakeup_write);
INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle);
priv->serial = port->serial;
priv->port = port;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 204/242] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 203/242] USB: serial: keyspan_pda: fix write-wakeup use-after-free Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 205/242] USB: serial: keyspan_pda: fix write unthrottling Greg Kroah-Hartman
` (39 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit 49fbb8e37a961396a5b6c82937c70df91de45e9d upstream.
The driver's transmit-unthrottle work was never flushed on disconnect,
something which could lead to the driver port data being freed while the
unthrottle work is still scheduled.
Fix this by cancelling the unthrottle work when shutting down the port.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan_pda.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -651,8 +651,12 @@ error:
}
static void keyspan_pda_close(struct usb_serial_port *port)
{
+ struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
+
usb_kill_urb(port->write_urb);
usb_kill_urb(port->interrupt_in_urb);
+
+ cancel_work_sync(&priv->unthrottle_work);
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 205/242] USB: serial: keyspan_pda: fix write unthrottling
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 204/242] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 206/242] Btrfs: fix selftests failure due to uninitialized i_mode in test inodes Greg Kroah-Hartman
` (38 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Andrzej Siewior, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit 320f9028c7873c3c7710e8e93e5c979f4c857490 upstream.
The driver did not update its view of the available device buffer space
until write() was called in task context. This meant that write_room()
would return 0 even after the device had sent a write-unthrottle
notification, something which could lead to blocked writers not being
woken up (e.g. when using OPOST).
Note that we must also request an unthrottle notification is case a
write() request fills the device buffer exactly.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan_pda.c | 29 ++++++++++++++++++++---------
1 file changed, 20 insertions(+), 9 deletions(-)
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -44,6 +44,8 @@
#define DRIVER_AUTHOR "Brian Warner <warner@lothar.com>"
#define DRIVER_DESC "USB Keyspan PDA Converter driver"
+#define KEYSPAN_TX_THRESHOLD 16
+
struct keyspan_pda_private {
int tx_room;
int tx_throttled;
@@ -114,7 +116,7 @@ static void keyspan_pda_request_unthrott
7, /* request_unthrottle */
USB_TYPE_VENDOR | USB_RECIP_INTERFACE
| USB_DIR_OUT,
- 16, /* value: threshold */
+ KEYSPAN_TX_THRESHOLD,
0, /* index */
NULL,
0,
@@ -133,6 +135,8 @@ static void keyspan_pda_rx_interrupt(str
int retval;
int status = urb->status;
struct keyspan_pda_private *priv;
+ unsigned long flags;
+
priv = usb_get_serial_port_data(port);
switch (status) {
@@ -175,7 +179,10 @@ static void keyspan_pda_rx_interrupt(str
case 1: /* modemline change */
break;
case 2: /* tx unthrottle interrupt */
+ spin_lock_irqsave(&port->lock, flags);
priv->tx_throttled = 0;
+ priv->tx_room = max(priv->tx_room, KEYSPAN_TX_THRESHOLD);
+ spin_unlock_irqrestore(&port->lock, flags);
/* queue up a wakeup at scheduler time */
usb_serial_port_softint(port);
break;
@@ -509,7 +516,8 @@ static int keyspan_pda_write(struct tty_
goto exit;
}
}
- if (count > priv->tx_room) {
+
+ if (count >= priv->tx_room) {
/* we're about to completely fill the Tx buffer, so
we'll be throttled afterwards. */
count = priv->tx_room;
@@ -564,14 +572,17 @@ static void keyspan_pda_write_bulk_callb
static int keyspan_pda_write_room(struct tty_struct *tty)
{
struct usb_serial_port *port = tty->driver_data;
- struct keyspan_pda_private *priv;
- priv = usb_get_serial_port_data(port);
- /* used by n_tty.c for processing of tabs and such. Giving it our
- conservative guess is probably good enough, but needs testing by
- running a console through the device. */
- return priv->tx_room;
-}
+ struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
+ unsigned long flags;
+ int room = 0;
+
+ spin_lock_irqsave(&port->lock, flags);
+ if (test_bit(0, &port->write_urbs_free) && !priv->tx_throttled)
+ room = priv->tx_room;
+ spin_unlock_irqrestore(&port->lock, flags);
+ return room;
+}
static int keyspan_pda_chars_in_buffer(struct tty_struct *tty)
{
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 206/242] Btrfs: fix selftests failure due to uninitialized i_mode in test inodes
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 205/242] USB: serial: keyspan_pda: fix write unthrottling Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 207/242] btrfs: fix return value mixup in btrfs_get_extent Greg Kroah-Hartman
` (37 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Filipe Manana, Qu Wenruo,
David Sterba, Sudip Mukherjee
From: Filipe Manana <fdmanana@suse.com>
commit 9f7fec0ba89108b9385f1b9fb167861224912a4a upstream
Some of the self tests create a test inode, setup some extents and then do
calls to btrfs_get_extent() to test that the corresponding extent maps
exist and are correct. However btrfs_get_extent(), since the 5.2 merge
window, now errors out when it finds a regular or prealloc extent for an
inode that does not correspond to a regular file (its ->i_mode is not
S_IFREG). This causes the self tests to fail sometimes, specially when
KASAN, slub_debug and page poisoning are enabled:
$ modprobe btrfs
modprobe: ERROR: could not insert 'btrfs': Invalid argument
$ dmesg
[ 9414.691648] Btrfs loaded, crc32c=crc32c-intel, debug=on, assert=on, integrity-checker=on, ref-verify=on
[ 9414.692655] BTRFS: selftest: sectorsize: 4096 nodesize: 4096
[ 9414.692658] BTRFS: selftest: running btrfs free space cache tests
[ 9414.692918] BTRFS: selftest: running extent only tests
[ 9414.693061] BTRFS: selftest: running bitmap only tests
[ 9414.693366] BTRFS: selftest: running bitmap and extent tests
[ 9414.696455] BTRFS: selftest: running space stealing from bitmap to extent tests
[ 9414.697131] BTRFS: selftest: running extent buffer operation tests
[ 9414.697133] BTRFS: selftest: running btrfs_split_item tests
[ 9414.697564] BTRFS: selftest: running extent I/O tests
[ 9414.697583] BTRFS: selftest: running find delalloc tests
[ 9415.081125] BTRFS: selftest: running find_first_clear_extent_bit test
[ 9415.081278] BTRFS: selftest: running extent buffer bitmap tests
[ 9415.124192] BTRFS: selftest: running inode tests
[ 9415.124195] BTRFS: selftest: running btrfs_get_extent tests
[ 9415.127909] BTRFS: selftest: running hole first btrfs_get_extent test
[ 9415.128343] BTRFS critical (device (efault)): regular/prealloc extent found for non-regular inode 256
[ 9415.131428] BTRFS: selftest: fs/btrfs/tests/inode-tests.c:904 expected a real extent, got 0
This happens because the test inodes are created without ever initializing
the i_mode field of the inode, and neither VFS's new_inode() nor the btrfs
callback btrfs_alloc_inode() initialize the i_mode. Initialization of the
i_mode is done through the various callbacks used by the VFS to create
new inodes (regular files, directories, symlinks, tmpfiles, etc), which
all call btrfs_new_inode() which in turn calls inode_init_owner(), which
sets the inode's i_mode. Since the tests only uses new_inode() to create
the test inodes, the i_mode was never initialized.
This always happens on a VM I used with kasan, slub_debug and many other
debug facilities enabled. It also happened to someone who reported this
on bugzilla (on a 5.3-rc).
Fix this by setting i_mode to S_IFREG at btrfs_new_test_inode().
Fixes: 6bf9e4bd6a2778 ("btrfs: inode: Verify inode mode to avoid NULL pointer dereference")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204397
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/tests/btrfs-tests.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/fs/btrfs/tests/btrfs-tests.c
+++ b/fs/btrfs/tests/btrfs-tests.c
@@ -51,7 +51,13 @@ static struct file_system_type test_type
struct inode *btrfs_new_test_inode(void)
{
- return new_inode(test_mnt->mnt_sb);
+ struct inode *inode;
+
+ inode = new_inode(test_mnt->mnt_sb);
+ if (inode)
+ inode_init_owner(inode, NULL, S_IFREG);
+
+ return inode;
}
static int btrfs_init_test_fs(void)
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 207/242] btrfs: fix return value mixup in btrfs_get_extent
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 206/242] Btrfs: fix selftests failure due to uninitialized i_mode in test inodes Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 208/242] ext4: fix a memory leak of ext4_free_data Greg Kroah-Hartman
` (36 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Pavel Machek (CIP),
David Sterba, Sudip Mukherjee
From: Pavel Machek <pavel@denx.de>
commit 881a3a11c2b858fe9b69ef79ac5ee9978a266dc9 upstream
btrfs_get_extent() sets variable ret, but out: error path expect error
to be in variable err so the error code is lost.
Fixes: 6bf9e4bd6a27 ("btrfs: inode: Verify inode mode to avoid NULL pointer dereference")
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Pavel Machek (CIP) <pavel@denx.de>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -7179,7 +7179,7 @@ again:
found_type == BTRFS_FILE_EXTENT_PREALLOC) {
/* Only regular file could have regular/prealloc extent */
if (!S_ISREG(inode->vfs_inode.i_mode)) {
- ret = -EUCLEAN;
+ err = -EUCLEAN;
btrfs_crit(fs_info,
"regular/prealloc extent found for non-regular inode %llu",
btrfs_ino(inode));
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 208/242] ext4: fix a memory leak of ext4_free_data
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 207/242] btrfs: fix return value mixup in btrfs_get_extent Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 209/242] ext4: fix deadlock with fs freezing and EA inodes Greg Kroah-Hartman
` (35 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chunguang Xu, Theodore Tso, stable
From: Chunguang Xu <brookxu@tencent.com>
commit cca415537244f6102cbb09b5b90db6ae2c953bdd upstream.
When freeing metadata, we will create an ext4_free_data and
insert it into the pending free list. After the current
transaction is committed, the object will be freed.
ext4_mb_free_metadata() will check whether the area to be freed
overlaps with the pending free list. If true, return directly. At this
time, ext4_free_data is leaked. Fortunately, the probability of this
problem is small, since it only occurs if the file system is corrupted
such that a block is claimed by more one inode and those inodes are
deleted within a single jbd2 transaction.
Signed-off-by: Chunguang Xu <brookxu@tencent.com>
Link: https://lore.kernel.org/r/1604764698-4269-8-git-send-email-brookxu@tencent.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/mballoc.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4718,6 +4718,7 @@ ext4_mb_free_metadata(handle_t *handle,
ext4_group_first_block_no(sb, group) +
EXT4_C2B(sbi, cluster),
"Block already on to-be-freed list");
+ kmem_cache_free(ext4_free_data_cachep, new_entry);
return 0;
}
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 209/242] ext4: fix deadlock with fs freezing and EA inodes
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 208/242] ext4: fix a memory leak of ext4_free_data Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 210/242] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps Greg Kroah-Hartman
` (34 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Kara, Andreas Dilger, Theodore Tso
From: Jan Kara <jack@suse.cz>
commit 46e294efc355c48d1dd4d58501aa56dac461792a upstream.
Xattr code using inodes with large xattr data can end up dropping last
inode reference (and thus deleting the inode) from places like
ext4_xattr_set_entry(). That function is called with transaction started
and so ext4_evict_inode() can deadlock against fs freezing like:
CPU1 CPU2
removexattr() freeze_super()
vfs_removexattr()
ext4_xattr_set()
handle = ext4_journal_start()
...
ext4_xattr_set_entry()
iput(old_ea_inode)
ext4_evict_inode(old_ea_inode)
sb->s_writers.frozen = SB_FREEZE_FS;
sb_wait_write(sb, SB_FREEZE_FS);
ext4_freeze()
jbd2_journal_lock_updates()
-> blocks waiting for all
handles to stop
sb_start_intwrite()
-> blocks as sb is already in SB_FREEZE_FS state
Generally it is advisable to delete inodes from a separate transaction
as it can consume quite some credits however in this case it would be
quite clumsy and furthermore the credits for inode deletion are quite
limited and already accounted for. So just tweak ext4_evict_inode() to
avoid freeze protection if we have transaction already started and thus
it is not really needed anyway.
Cc: stable@vger.kernel.org
Fixes: dec214d00e0d ("ext4: xattr inode deduplication")
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Link: https://lore.kernel.org/r/20201127110649.24730-1-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/inode.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -202,6 +202,7 @@ void ext4_evict_inode(struct inode *inod
*/
int extra_credits = 6;
struct ext4_xattr_inode_array *ea_inode_array = NULL;
+ bool freeze_protected = false;
trace_ext4_evict_inode(inode);
@@ -249,9 +250,14 @@ void ext4_evict_inode(struct inode *inod
/*
* Protect us against freezing - iput() caller didn't have to have any
- * protection against it
- */
- sb_start_intwrite(inode->i_sb);
+ * protection against it. When we are in a running transaction though,
+ * we are already protected against freezing and we cannot grab further
+ * protection due to lock ordering constraints.
+ */
+ if (!ext4_journal_current_handle()) {
+ sb_start_intwrite(inode->i_sb);
+ freeze_protected = true;
+ }
if (!IS_NOQUOTA(inode))
extra_credits += EXT4_MAXQUOTAS_DEL_BLOCKS(inode->i_sb);
@@ -270,7 +276,8 @@ void ext4_evict_inode(struct inode *inod
* cleaned up.
*/
ext4_orphan_del(NULL, inode);
- sb_end_intwrite(inode->i_sb);
+ if (freeze_protected)
+ sb_end_intwrite(inode->i_sb);
goto no_delete;
}
@@ -311,7 +318,8 @@ void ext4_evict_inode(struct inode *inod
stop_handle:
ext4_journal_stop(handle);
ext4_orphan_del(NULL, inode);
- sb_end_intwrite(inode->i_sb);
+ if (freeze_protected)
+ sb_end_intwrite(inode->i_sb);
ext4_xattr_inode_array_free(ea_inode_array);
goto no_delete;
}
@@ -340,7 +348,8 @@ stop_handle:
else
ext4_free_inode(handle, inode);
ext4_journal_stop(handle);
- sb_end_intwrite(inode->i_sb);
+ if (freeze_protected)
+ sb_end_intwrite(inode->i_sb);
ext4_xattr_inode_array_free(ea_inode_array);
return;
no_delete:
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 210/242] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 209/242] ext4: fix deadlock with fs freezing and EA inodes Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 211/242] ARM: dts: at91: sama5d2: fix CAN message ram offset and size Greg Kroah-Hartman
` (33 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, James Morse, Marc Zyngier
From: Marc Zyngier <maz@kernel.org>
commit ca4e514774930f30b66375a974b5edcbebaf0e7e upstream.
ARMv8.2 introduced TTBCR2, which shares TCR_EL1 with TTBCR.
Gracefully handle traps to this register when HCR_EL2.TVM is set.
Cc: stable@vger.kernel.org
Reported-by: James Morse <james.morse@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/kvm_host.h | 1 +
arch/arm64/kvm/sys_regs.c | 1 +
2 files changed, 2 insertions(+)
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -158,6 +158,7 @@ enum vcpu_sysreg {
#define c2_TTBR1 (TTBR1_EL1 * 2) /* Translation Table Base Register 1 */
#define c2_TTBR1_high (c2_TTBR1 + 1) /* TTBR1 top 32 bits */
#define c2_TTBCR (TCR_EL1 * 2) /* Translation Table Base Control R. */
+#define c2_TTBCR2 (c2_TTBCR + 1) /* Translation Table Base Control R. 2 */
#define c3_DACR (DACR32_EL2 * 2)/* Domain Access Control Register */
#define c5_DFSR (ESR_EL1 * 2) /* Data Fault Status Register */
#define c5_IFSR (IFSR32_EL2 * 2)/* Instruction Fault Status Register */
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -1286,6 +1286,7 @@ static const struct sys_reg_desc cp15_re
{ Op1( 0), CRn( 2), CRm( 0), Op2( 0), access_vm_reg, NULL, c2_TTBR0 },
{ Op1( 0), CRn( 2), CRm( 0), Op2( 1), access_vm_reg, NULL, c2_TTBR1 },
{ Op1( 0), CRn( 2), CRm( 0), Op2( 2), access_vm_reg, NULL, c2_TTBCR },
+ { Op1( 0), CRn( 2), CRm( 0), Op2( 3), access_vm_reg, NULL, c2_TTBCR2 },
{ Op1( 0), CRn( 3), CRm( 0), Op2( 0), access_vm_reg, NULL, c3_DACR },
{ Op1( 0), CRn( 5), CRm( 0), Op2( 0), access_vm_reg, NULL, c5_DFSR },
{ Op1( 0), CRn( 5), CRm( 0), Op2( 1), access_vm_reg, NULL, c5_IFSR },
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 211/242] ARM: dts: at91: sama5d2: fix CAN message ram offset and size
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 210/242] KVM: arm64: Introduce handling of AArch32 TTBCR2 traps Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 212/242] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter Greg Kroah-Hartman
` (32 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Sneddon, Nicolas Ferre,
Alexandre Belloni, Cristian Birsan
From: Nicolas Ferre <nicolas.ferre@microchip.com>
commit 85b8350ae99d1300eb6dc072459246c2649a8e50 upstream.
CAN0 and CAN1 instances share the same message ram configured
at 0x210000 on sama5d2 Linux systems.
According to current configuration of CAN0, we need 0x1c00 bytes
so that the CAN1 don't overlap its message ram:
64 x RX FIFO0 elements => 64 x 72 bytes
32 x TXE (TX Event FIFO) elements => 32 x 8 bytes
32 x TXB (TX Buffer) elements => 32 x 72 bytes
So a total of 7168 bytes (0x1C00).
Fix offset to match this needed size.
Make the CAN0 message ram ioremap match exactly this size so that is
easily understandable. Adapt CAN1 size accordingly.
Fixes: bc6d5d7666b7 ("ARM: dts: at91: sama5d2: add m_can nodes")
Reported-by: Dan Sneddon <dan.sneddon@microchip.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Tested-by: Cristian Birsan <cristian.birsan@microchip.com>
Cc: stable@vger.kernel.org # v4.13+
Link: https://lore.kernel.org/r/20201203091949.9015-1-nicolas.ferre@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/sama5d2.dtsi | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -1294,7 +1294,7 @@
can0: can@f8054000 {
compatible = "bosch,m_can";
- reg = <0xf8054000 0x4000>, <0x210000 0x4000>;
+ reg = <0xf8054000 0x4000>, <0x210000 0x1c00>;
reg-names = "m_can", "message_ram";
interrupts = <56 IRQ_TYPE_LEVEL_HIGH 7>,
<64 IRQ_TYPE_LEVEL_HIGH 7>;
@@ -1485,7 +1485,7 @@
can1: can@fc050000 {
compatible = "bosch,m_can";
- reg = <0xfc050000 0x4000>, <0x210000 0x4000>;
+ reg = <0xfc050000 0x4000>, <0x210000 0x3800>;
reg-names = "m_can", "message_ram";
interrupts = <57 IRQ_TYPE_LEVEL_HIGH 7>,
<65 IRQ_TYPE_LEVEL_HIGH 7>;
@@ -1495,7 +1495,7 @@
assigned-clocks = <&can1_gclk>;
assigned-clock-parents = <&utmi>;
assigned-clock-rates = <40000000>;
- bosch,mram-cfg = <0x1100 0 0 64 0 0 32 32>;
+ bosch,mram-cfg = <0x1c00 0 0 64 0 0 32 32>;
status = "disabled";
};
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 212/242] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 211/242] ARM: dts: at91: sama5d2: fix CAN message ram offset and size Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 213/242] powerpc/xmon: Change printk() to pr_cont() Greg Kroah-Hartman
` (31 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tyrel Datwyler, Michael Ellerman
From: Tyrel Datwyler <tyreld@linux.ibm.com>
commit f10881a46f8914428110d110140a455c66bdf27b upstream.
Commit bd59380c5ba4 ("powerpc/rtas: Restrict RTAS requests from userspace")
introduced the following error when invoking the errinjct userspace
tool:
[root@ltcalpine2-lp5 librtas]# errinjct open
[327884.071171] sys_rtas: RTAS call blocked - exploit attempt?
[327884.071186] sys_rtas: token=0x26, nargs=0 (called by errinjct)
errinjct: Could not open RTAS error injection facility
errinjct: librtas: open: Unexpected I/O error
The entry for ibm,open-errinjct in rtas_filter array has a typo where
the "j" is omitted in the rtas call name. After fixing this typo the
errinjct tool functions again as expected.
[root@ltcalpine2-lp5 linux]# errinjct open
RTAS error injection facility open, token = 1
Fixes: bd59380c5ba4 ("powerpc/rtas: Restrict RTAS requests from userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201208195434.8289-1-tyreld@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/rtas.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -1094,7 +1094,7 @@ static struct rtas_filter rtas_filters[]
{ "ibm,display-message", -1, 0, -1, -1, -1 },
{ "ibm,errinjct", -1, 2, -1, -1, -1, 1024 },
{ "ibm,close-errinjct", -1, -1, -1, -1, -1 },
- { "ibm,open-errinct", -1, -1, -1, -1, -1 },
+ { "ibm,open-errinjct", -1, -1, -1, -1, -1 },
{ "ibm,get-config-addr-info2", -1, -1, -1, -1, -1 },
{ "ibm,get-dynamic-sensor-state", -1, 1, -1, -1, -1 },
{ "ibm,get-indices", -1, 2, 3, -1, -1 },
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 213/242] powerpc/xmon: Change printk() to pr_cont()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 212/242] powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 214/242] powerpc/powernv/memtrace: Dont leak kernel memory to user space Greg Kroah-Hartman
` (30 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe Leroy, Michael Ellerman
From: Christophe Leroy <christophe.leroy@csgroup.eu>
commit 7c6c86b36a36dd4a13d30bba07718e767aa2e7a1 upstream.
Since some time now, printk() adds carriage return, leading to
unusable xmon output if there is no udbg backend available:
[ 54.288722] sysrq: Entering xmon
[ 54.292209] Vector: 0 at [cace3d2c]
[ 54.292274] pc:
[ 54.292331] c0023650
[ 54.292468] : xmon+0x28/0x58
[ 54.292519]
[ 54.292574] lr:
[ 54.292630] c0023724
[ 54.292749] : sysrq_handle_xmon+0xa4/0xfc
[ 54.292801]
[ 54.292867] sp: cace3de8
[ 54.292931] msr: 9032
[ 54.292999] current = 0xc28d0000
[ 54.293072] pid = 377, comm = sh
[ 54.293157] Linux version 5.10.0-rc6-s3k-dev-01364-gedf13f0ccd76-dirty (root@po17688vm.idsi0.si.c-s.fr) (powerpc64-linux-gcc (GCC) 10.1.0, GNU ld (GNU Binutils) 2.34) #4211 PREEMPT Fri Dec 4 09:32:11 UTC 2020
[ 54.293287] enter ? for help
[ 54.293470] [cace3de8]
[ 54.293532] c0023724
[ 54.293654] sysrq_handle_xmon+0xa4/0xfc
[ 54.293711] (unreliable)
...
[ 54.296002]
[ 54.296159] --- Exception: c01 (System Call) at
[ 54.296217] 0fd4e784
[ 54.296303]
[ 54.296375] SP (7fca6ff0) is in userspace
[ 54.296431] mon>
[ 54.296484] <no input ...>
Use pr_cont() instead.
Fixes: 4bcc595ccd80 ("printk: reinstate KERN_CONT for printing continuation lines")
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
[mpe: Mention that it only happens when udbg is not available]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/c8a6ec704416ecd5ff2bd26213c9bc026bdd19de.1607077340.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/xmon/nonstdio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/xmon/nonstdio.c
+++ b/arch/powerpc/xmon/nonstdio.c
@@ -182,7 +182,7 @@ void xmon_printf(const char *format, ...
if (n && rc == 0) {
/* No udbg hooks, fallback to printk() - dangerous */
- printk("%s", xmon_outbuf);
+ pr_cont("%s", xmon_outbuf);
}
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 214/242] powerpc/powernv/memtrace: Dont leak kernel memory to user space
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 213/242] powerpc/xmon: Change printk() to pr_cont() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 215/242] ima: Dont modify file descriptor mode on the fly Greg Kroah-Hartman
` (29 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Ellerman, David Hildenbrand,
Oscar Salvador
From: David Hildenbrand <david@redhat.com>
commit c74cf7a3d59a21b290fe0468f5b470d0b8ee37df upstream.
We currently leak kernel memory to user space, because memory
offlining doesn't do any implicit clearing of memory and we are
missing explicit clearing of memory.
Let's keep it simple and clear pages before removing the linear
mapping.
Reproduced in QEMU/TCG with 10 GiB of main memory:
[root@localhost ~]# dd obs=9G if=/dev/urandom of=/dev/null
[... wait until "free -m" used counter no longer changes and cancel]
19665802+0 records in
1+0 records out
9663676416 bytes (9.7 GB, 9.0 GiB) copied, 135.548 s, 71.3 MB/s
[root@localhost ~]# cat /sys/devices/system/memory/block_size_bytes
40000000
[root@localhost ~]# echo 0x40000000 > /sys/kernel/debug/powerpc/memtrace/enable
[ 402.978663][ T1086] page:000000001bc4bc74 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24900
[ 402.980063][ T1086] flags: 0x7ffff000001000(reserved)
[ 402.980415][ T1086] raw: 007ffff000001000 c00c000000924008 c00c000000924008 0000000000000000
[ 402.980627][ T1086] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 402.980845][ T1086] page dumped because: unmovable page
[ 402.989608][ T1086] Offlined Pages 16384
[ 403.324155][ T1086] memtrace: Allocated trace memory on node 0 at 0x0000000200000000
Before this patch:
[root@localhost ~]# hexdump -C /sys/kernel/debug/powerpc/memtrace/00000000/trace | head
00000000 c8 25 72 51 4d 26 36 c5 5c c2 56 15 d5 1a cd 10 |.%rQM&6.\.V.....|
00000010 19 b9 50 b2 cb e3 60 b8 ec 0a f3 ec 4b 3c 39 f0 |..P...`.....K<9.|$
00000020 4e 5a 4c cf bd 26 19 ff 37 79 13 67 24 b7 b8 57 |NZL..&..7y.g$..W|$
00000030 98 3e f5 be 6f 14 6a bd a4 52 bc 6e e9 e0 c1 5d |.>..o.j..R.n...]|$
00000040 76 b3 ae b5 88 d7 da e3 64 23 85 2c 10 88 07 b6 |v.......d#.,....|$
00000050 9a d8 91 de f7 50 27 69 2e 64 9c 6f d3 19 45 79 |.....P'i.d.o..Ey|$
00000060 6a 6f 8a 61 71 19 1f c7 f1 df 28 26 ca 0f 84 55 |jo.aq.....(&...U|$
00000070 01 3f be e4 e2 e1 da ff 7b 8c 8e 32 37 b4 24 53 |.?......{..27.$S|$
00000080 1b 70 30 45 56 e6 8c c4 0e b5 4c fb 9f dd 88 06 |.p0EV.....L.....|$
00000090 ef c4 18 79 f1 60 b1 5c 79 59 4d f4 36 d7 4a 5c |...y.`.\yYM.6.J\|$
After this patch:
[root@localhost ~]# hexdump -C /sys/kernel/debug/powerpc/memtrace/00000000/trace | head
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
40000000
Fixes: 9d5171a8f248 ("powerpc/powernv: Enable removal of memory for in memory tracing")
Cc: stable@vger.kernel.org # v4.14+
Reported-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201111145322.15793-2-david@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powernv/memtrace.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/arch/powerpc/platforms/powernv/memtrace.c
+++ b/arch/powerpc/platforms/powernv/memtrace.c
@@ -99,6 +99,23 @@ static int change_memblock_state(struct
return 0;
}
+static void memtrace_clear_range(unsigned long start_pfn,
+ unsigned long nr_pages)
+{
+ unsigned long pfn;
+
+ /*
+ * As pages are offline, we cannot trust the memmap anymore. As HIGHMEM
+ * does not apply, avoid passing around "struct page" and use
+ * clear_page() instead directly.
+ */
+ for (pfn = start_pfn; pfn < start_pfn + nr_pages; pfn++) {
+ if (IS_ALIGNED(pfn, PAGES_PER_SECTION))
+ cond_resched();
+ clear_page(__va(PFN_PHYS(pfn)));
+ }
+}
+
/* called with device_hotplug_lock held */
static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages)
{
@@ -144,6 +161,11 @@ static u64 memtrace_alloc_node(u32 nid,
for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) {
if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) {
/*
+ * Clear the range while we still have a linear
+ * mapping.
+ */
+ memtrace_clear_range(base_pfn, nr_pages);
+ /*
* Remove memory in memory block size chunks so that
* iomem resources are always split to the same size and
* we never try to remove memory that spans two iomem
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 215/242] ima: Dont modify file descriptor mode on the fly
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 214/242] powerpc/powernv/memtrace: Dont leak kernel memory to user space Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 216/242] ceph: fix race in concurrent __ceph_remove_cap invocations Greg Kroah-Hartman
` (28 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Roberto Sassu, Christoph Hellwig, Mimi Zohar
From: Roberto Sassu <roberto.sassu@huawei.com>
commit 207cdd565dfc95a0a5185263a567817b7ebf5467 upstream.
Commit a408e4a86b36b ("ima: open a new file instance if no read
permissions") already introduced a second open to measure a file when the
original file descriptor does not allow it. However, it didn't remove the
existing method of changing the mode of the original file descriptor, which
is still necessary if the current process does not have enough privileges
to open a new one.
Changing the mode isn't really an option, as the filesystem might need to
do preliminary steps to make the read possible. Thus, this patch removes
the code and keeps the second open as the only option to measure a file
when it is unreadable with the original file descriptor.
Cc: <stable@vger.kernel.org> # 4.20.x: 0014cc04e8ec0 ima: Set file->f_mode
Fixes: 2fe5d6def1672 ("ima: integrity appraisal extension")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/integrity/ima/ima_crypto.c | 20 +++++---------------
1 file changed, 5 insertions(+), 15 deletions(-)
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -432,7 +432,7 @@ int ima_calc_file_hash(struct file *file
loff_t i_size;
int rc;
struct file *f = file;
- bool new_file_instance = false, modified_mode = false;
+ bool new_file_instance = false;
/*
* For consistency, fail file's opened with the O_DIRECT flag on
@@ -450,18 +450,10 @@ int ima_calc_file_hash(struct file *file
O_TRUNC | O_CREAT | O_NOCTTY | O_EXCL);
flags |= O_RDONLY;
f = dentry_open(&file->f_path, flags, file->f_cred);
- if (IS_ERR(f)) {
- /*
- * Cannot open the file again, lets modify f_mode
- * of original and continue
- */
- pr_info_ratelimited("Unable to reopen file for reading.\n");
- f = file;
- f->f_mode |= FMODE_READ;
- modified_mode = true;
- } else {
- new_file_instance = true;
- }
+ if (IS_ERR(f))
+ return PTR_ERR(f);
+
+ new_file_instance = true;
}
i_size = i_size_read(file_inode(f));
@@ -476,8 +468,6 @@ int ima_calc_file_hash(struct file *file
out:
if (new_file_instance)
fput(f);
- else if (modified_mode)
- f->f_mode &= ~FMODE_READ;
return rc;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 216/242] ceph: fix race in concurrent __ceph_remove_cap invocations
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 215/242] ima: Dont modify file descriptor mode on the fly Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 217/242] jffs2: Fix GC exit abnormally Greg Kroah-Hartman
` (27 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jeff Layton, Luis Henriques, Ilya Dryomov
From: Luis Henriques <lhenriques@suse.de>
commit e5cafce3ad0f8652d6849314d951459c2bff7233 upstream.
A NULL pointer dereference may occur in __ceph_remove_cap with some of the
callbacks used in ceph_iterate_session_caps, namely trim_caps_cb and
remove_session_caps_cb. Those callers hold the session->s_mutex, so they
are prevented from concurrent execution, but ceph_evict_inode does not.
Since the callers of this function hold the i_ceph_lock, the fix is simply
a matter of returning immediately if caps->ci is NULL.
Cc: stable@vger.kernel.org
URL: https://tracker.ceph.com/issues/43272
Suggested-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Luis Henriques <lhenriques@suse.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/caps.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -929,12 +929,19 @@ void __ceph_remove_cap(struct ceph_cap *
{
struct ceph_mds_session *session = cap->session;
struct ceph_inode_info *ci = cap->ci;
- struct ceph_mds_client *mdsc =
- ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc;
+ struct ceph_mds_client *mdsc;
int removed = 0;
+ /* 'ci' being NULL means the remove have already occurred */
+ if (!ci) {
+ dout("%s: cap inode is NULL\n", __func__);
+ return;
+ }
+
dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
+ mdsc = ceph_inode_to_client(&ci->vfs_inode)->mdsc;
+
/* remove from inode's cap rbtree, and clear auth cap */
rb_erase(&cap->ci_node, &ci->i_caps);
if (ci->i_auth_cap == cap)
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 217/242] jffs2: Fix GC exit abnormally
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 216/242] ceph: fix race in concurrent __ceph_remove_cap invocations Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 218/242] jfs: Fix array index bounds check in dbAdjTree Greg Kroah-Hartman
` (26 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhe Li, Richard Weinberger
From: Zhe Li <lizhe67@huawei.com>
commit 9afc9a8a4909fece0e911e72b1060614ba2f7969 upstream.
The log of this problem is:
jffs2: Error garbage collecting node at 0x***!
jffs2: No space for garbage collection. Aborting GC thread
This is because GC believe that it do nothing, so it abort.
After going over the image of jffs2, I find a scene that
can trigger this problem stably.
The scene is: there is a normal dirent node at summary-area,
but abnormal at corresponding not-summary-area with error
name_crc.
The reason that GC exit abnormally is because it find that
abnormal dirent node to GC, but when it goes to function
jffs2_add_fd_to_list, it cannot meet the condition listed
below:
if ((*prev)->nhash == new->nhash && !strcmp((*prev)->name, new->name))
So no node is marked obsolete, statistical information of
erase_block do not change, which cause GC exit abnormally.
The root cause of this problem is: we do not check the
name_crc of the abnormal dirent node with summary is enabled.
Noticed that in function jffs2_scan_dirent_node, we use
function jffs2_scan_dirty_space to deal with the dirent
node with error name_crc. So this patch add a checking
code in function read_direntry to ensure the correctness
of dirent node. If checked failed, the dirent node will
be marked obsolete so GC will pass this node and this
problem will be fixed.
Cc: <stable@vger.kernel.org>
Signed-off-by: Zhe Li <lizhe67@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jffs2/readinode.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -672,6 +672,22 @@ static inline int read_direntry(struct j
jffs2_free_full_dirent(fd);
return -EIO;
}
+
+#ifdef CONFIG_JFFS2_SUMMARY
+ /*
+ * we use CONFIG_JFFS2_SUMMARY because without it, we
+ * have checked it while mounting
+ */
+ crc = crc32(0, fd->name, rd->nsize);
+ if (unlikely(crc != je32_to_cpu(rd->name_crc))) {
+ JFFS2_NOTICE("name CRC failed on dirent node at"
+ "%#08x: read %#08x,calculated %#08x\n",
+ ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
+ jffs2_mark_node_obsolete(c, ref);
+ jffs2_free_full_dirent(fd);
+ return 0;
+ }
+#endif
}
fd->nhash = full_name_hash(NULL, fd->name, rd->nsize);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 218/242] jfs: Fix array index bounds check in dbAdjTree
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 217/242] jffs2: Fix GC exit abnormally Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 219/242] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() Greg Kroah-Hartman
` (25 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dave Kleikamp, butt3rflyh4ck
From: Dave Kleikamp <dave.kleikamp@oracle.com>
commit c61b3e4839007668360ed8b87d7da96d2e59fc6c upstream.
Bounds checking tools can flag a bug in dbAdjTree() for an array index
out of bounds in dmt_stree. Since dmt_stree can refer to the stree in
both structures dmaptree and dmapctl, use the larger array to eliminate
the false positive.
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jfs/jfs_dmap.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/jfs/jfs_dmap.h
+++ b/fs/jfs/jfs_dmap.h
@@ -196,7 +196,7 @@ typedef union dmtree {
#define dmt_leafidx t1.leafidx
#define dmt_height t1.height
#define dmt_budmin t1.budmin
-#define dmt_stree t1.stree
+#define dmt_stree t2.stree
/*
* on-disk aggregate disk allocation map descriptor.
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 219/242] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 218/242] jfs: Fix array index bounds check in dbAdjTree Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 220/242] spi: spi-sh: Fix use-after-free on unbind Greg Kroah-Hartman
` (24 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zwane Mwaikambo, Lyude Paul
From: Zwane Mwaikambo <zwane@yosper.io>
commit 73b62cdb93b68d7e2c1d373c6a411bc00c53e702 upstream.
I observed this when unplugging a DP monitor whilst a computer is asleep
and then waking it up. This left DP chardev nodes still being present on
the filesystem and accessing these device nodes caused an oops because
drm_dp_aux_dev_get_by_minor() assumes a device exists if it is opened.
This can also be reproduced by creating a device node with mknod(1) and
issuing an open(2)
[166164.933198] BUG: kernel NULL pointer dereference, address: 0000000000000018
[166164.933202] #PF: supervisor read access in kernel mode
[166164.933204] #PF: error_code(0x0000) - not-present page
[166164.933205] PGD 0 P4D 0
[166164.933208] Oops: 0000 [#1] PREEMPT SMP NOPTI
[166164.933211] CPU: 4 PID: 99071 Comm: fwupd Tainted: G W
5.8.0-rc6+ #1
[166164.933213] Hardware name: LENOVO 20RD002VUS/20RD002VUS, BIOS R16ET25W
(1.11 ) 04/21/2020
[166164.933232] RIP: 0010:drm_dp_aux_dev_get_by_minor+0x29/0x70
[drm_kms_helper]
[166164.933234] Code: 00 0f 1f 44 00 00 55 48 89 e5 41 54 41 89 fc 48 c7
c7 60 01 a4 c0 e8 26 ab 30 d7 44 89 e6 48 c7 c7 80 01 a4 c0 e8 47 94 d6 d6
<8b> 50 18 49 89 c4 48 8d 78 18 85 d2 74 33 8d 4a 01 89 d0 f0 0f b1
[166164.933236] RSP: 0018:ffffb7d7c41cbbf0 EFLAGS: 00010246
[166164.933237] RAX: 0000000000000000 RBX: ffff8a90001fe900 RCX: 0000000000000000
[166164.933238] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffffffc0a40180
[166164.933239] RBP: ffffb7d7c41cbbf8 R08: 0000000000000000 R09: ffff8a93e157d6d0
[166164.933240] R10: 0000000000000000 R11: ffffffffc0a40188 R12: 0000000000000003
[166164.933241] R13: ffff8a9402200e80 R14: ffff8a90001fe900 R15: 0000000000000000
[166164.933244] FS: 00007f7fb041eb00(0000) GS:ffff8a9411500000(0000)
knlGS:0000000000000000
[166164.933245] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[166164.933246] CR2: 0000000000000018 CR3: 00000000352c2003 CR4: 00000000003606e0
[166164.933247] Call Trace:
[166164.933264] auxdev_open+0x1b/0x40 [drm_kms_helper]
[166164.933278] chrdev_open+0xa7/0x1c0
[166164.933282] ? cdev_put.part.0+0x20/0x20
[166164.933287] do_dentry_open+0x161/0x3c0
[166164.933291] vfs_open+0x2d/0x30
[166164.933297] path_openat+0xb27/0x10e0
[166164.933306] ? atime_needs_update+0x73/0xd0
[166164.933309] do_filp_open+0x91/0x100
[166164.933313] ? __alloc_fd+0xb2/0x150
[166164.933316] do_sys_openat2+0x210/0x2d0
[166164.933318] do_sys_open+0x46/0x80
[166164.933320] __x64_sys_openat+0x20/0x30
[166164.933328] do_syscall_64+0x52/0xc0
[166164.933336] entry_SYSCALL_64_after_hwframe+0x44/0xa9
(gdb) disassemble drm_dp_aux_dev_get_by_minor+0x29
Dump of assembler code for function drm_dp_aux_dev_get_by_minor:
0x0000000000017b10 <+0>: callq 0x17b15 <drm_dp_aux_dev_get_by_minor+5>
0x0000000000017b15 <+5>: push %rbp
0x0000000000017b16 <+6>: mov %rsp,%rbp
0x0000000000017b19 <+9>: push %r12
0x0000000000017b1b <+11>: mov %edi,%r12d
0x0000000000017b1e <+14>: mov $0x0,%rdi
0x0000000000017b25 <+21>: callq 0x17b2a <drm_dp_aux_dev_get_by_minor+26>
0x0000000000017b2a <+26>: mov %r12d,%esi
0x0000000000017b2d <+29>: mov $0x0,%rdi
0x0000000000017b34 <+36>: callq 0x17b39 <drm_dp_aux_dev_get_by_minor+41>
0x0000000000017b39 <+41>: mov 0x18(%rax),%edx <=========
0x0000000000017b3c <+44>: mov %rax,%r12
0x0000000000017b3f <+47>: lea 0x18(%rax),%rdi
0x0000000000017b43 <+51>: test %edx,%edx
0x0000000000017b45 <+53>: je 0x17b7a <drm_dp_aux_dev_get_by_minor+106>
0x0000000000017b47 <+55>: lea 0x1(%rdx),%ecx
0x0000000000017b4a <+58>: mov %edx,%eax
0x0000000000017b4c <+60>: lock cmpxchg %ecx,(%rdi)
0x0000000000017b50 <+64>: jne 0x17b76 <drm_dp_aux_dev_get_by_minor+102>
0x0000000000017b52 <+66>: test %edx,%edx
0x0000000000017b54 <+68>: js 0x17b6d <drm_dp_aux_dev_get_by_minor+93>
0x0000000000017b56 <+70>: test %ecx,%ecx
0x0000000000017b58 <+72>: js 0x17b6d <drm_dp_aux_dev_get_by_minor+93>
0x0000000000017b5a <+74>: mov $0x0,%rdi
0x0000000000017b61 <+81>: callq 0x17b66 <drm_dp_aux_dev_get_by_minor+86>
0x0000000000017b66 <+86>: mov %r12,%rax
0x0000000000017b69 <+89>: pop %r12
0x0000000000017b6b <+91>: pop %rbp
0x0000000000017b6c <+92>: retq
0x0000000000017b6d <+93>: xor %esi,%esi
0x0000000000017b6f <+95>: callq 0x17b74 <drm_dp_aux_dev_get_by_minor+100>
0x0000000000017b74 <+100>: jmp 0x17b5a <drm_dp_aux_dev_get_by_minor+74>
0x0000000000017b76 <+102>: mov %eax,%edx
0x0000000000017b78 <+104>: jmp 0x17b43 <drm_dp_aux_dev_get_by_minor+51>
0x0000000000017b7a <+106>: xor %r12d,%r12d
0x0000000000017b7d <+109>: jmp 0x17b5a <drm_dp_aux_dev_get_by_minor+74>
End of assembler dump.
(gdb) list *drm_dp_aux_dev_get_by_minor+0x29
0x17b39 is in drm_dp_aux_dev_get_by_minor (drivers/gpu/drm/drm_dp_aux_dev.c:65).
60 static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index)
61 {
62 struct drm_dp_aux_dev *aux_dev = NULL;
63
64 mutex_lock(&aux_idr_mutex);
65 aux_dev = idr_find(&aux_idr, index);
66 if (!kref_get_unless_zero(&aux_dev->refcount))
67 aux_dev = NULL;
68 mutex_unlock(&aux_idr_mutex);
69
(gdb) p/x &((struct drm_dp_aux_dev *)(0x0))->refcount
$8 = 0x18
Looking at the caller, checks on the minor are pushed down to
drm_dp_aux_dev_get_by_minor()
static int auxdev_open(struct inode *inode, struct file *file)
{
unsigned int minor = iminor(inode);
struct drm_dp_aux_dev *aux_dev;
aux_dev = drm_dp_aux_dev_get_by_minor(minor); <====
if (!aux_dev)
return -ENODEV;
file->private_data = aux_dev;
return 0;
}
Fixes: e94cb37b34eb ("drm/dp: Add a drm_aux-dev module for reading/writing dpcd registers.")
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: Zwane Mwaikambo <zwane@yosper.io>
Reviewed-by: Lyude Paul <lyude@redhat.com>
[added Cc to stable]
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/alpine.DEB.2.21.2010122231070.38717@montezuma.home
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_dp_aux_dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/drm_dp_aux_dev.c
+++ b/drivers/gpu/drm/drm_dp_aux_dev.c
@@ -60,7 +60,7 @@ static struct drm_dp_aux_dev *drm_dp_aux
mutex_lock(&aux_idr_mutex);
aux_dev = idr_find(&aux_idr, index);
- if (!kref_get_unless_zero(&aux_dev->refcount))
+ if (aux_dev && !kref_get_unless_zero(&aux_dev->refcount))
aux_dev = NULL;
mutex_unlock(&aux_idr_mutex);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 220/242] spi: spi-sh: Fix use-after-free on unbind
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 219/242] drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 221/242] spi: davinci: " Greg Kroah-Hartman
` (23 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Axel Lin, Mark Brown
From: Lukas Wunner <lukas@wunner.de>
commit e77df3eca12be4b17f13cf9f215cff248c57d98f upstream.
spi_sh_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.
Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.
Fixes: 680c1305e259 ("spi/spi_sh: use spi_unregister_master instead of spi_master_put in remove path")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v3.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v3.0+
Cc: Axel Lin <axel.lin@ingics.com>
Link: https://lore.kernel.org/r/6d97628b536baf01d5e3e39db61108f84d44c8b2.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-sh.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
--- a/drivers/spi/spi-sh.c
+++ b/drivers/spi/spi-sh.c
@@ -450,7 +450,7 @@ static int spi_sh_probe(struct platform_
return irq;
}
- master = spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data));
+ master = devm_spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data));
if (master == NULL) {
dev_err(&pdev->dev, "spi_alloc_master error.\n");
return -ENOMEM;
@@ -468,16 +468,14 @@ static int spi_sh_probe(struct platform_
break;
default:
dev_err(&pdev->dev, "No support width\n");
- ret = -ENODEV;
- goto error1;
+ return -ENODEV;
}
ss->irq = irq;
ss->master = master;
ss->addr = devm_ioremap(&pdev->dev, res->start, resource_size(res));
if (ss->addr == NULL) {
dev_err(&pdev->dev, "ioremap error.\n");
- ret = -ENOMEM;
- goto error1;
+ return -ENOMEM;
}
INIT_LIST_HEAD(&ss->queue);
spin_lock_init(&ss->lock);
@@ -487,7 +485,7 @@ static int spi_sh_probe(struct platform_
ret = request_irq(irq, spi_sh_irq, 0, "spi_sh", ss);
if (ret < 0) {
dev_err(&pdev->dev, "request_irq error\n");
- goto error1;
+ return ret;
}
master->num_chipselect = 2;
@@ -506,9 +504,6 @@ static int spi_sh_probe(struct platform_
error3:
free_irq(irq, ss);
- error1:
- spi_master_put(master);
-
return ret;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 221/242] spi: davinci: Fix use-after-free on unbind
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 220/242] spi: spi-sh: Fix use-after-free on unbind Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 222/242] spi: pic32: Dont leak DMA channels in probe error path Greg Kroah-Hartman
` (22 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Peter Ujfalusi, Mark Brown
From: Lukas Wunner <lukas@wunner.de>
commit 373afef350a93519b4b8d636b0895da8650b714b upstream.
davinci_spi_remove() accesses the driver's private data after it's been
freed with spi_master_put().
Fix by moving the spi_master_put() to the end of the function.
Fixes: fe5fd2540947 ("spi: davinci: Use dma_request_chan() for requesting DMA channel")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Cc: <stable@vger.kernel.org> # v4.7+
Link: https://lore.kernel.org/r/412f7eb1cf8990e0a3a2153f4c577298deab623e.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-davinci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -1085,13 +1085,13 @@ static int davinci_spi_remove(struct pla
spi_bitbang_stop(&dspi->bitbang);
clk_disable_unprepare(dspi->clk);
- spi_master_put(master);
if (dspi->dma_rx) {
dma_release_channel(dspi->dma_rx);
dma_release_channel(dspi->dma_tx);
}
+ spi_master_put(master);
return 0;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 222/242] spi: pic32: Dont leak DMA channels in probe error path
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 221/242] spi: davinci: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 223/242] spi: rb4xx: Dont leak SPI master " Greg Kroah-Hartman
` (21 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Purna Chandra Mandal,
Mark Brown
From: Lukas Wunner <lukas@wunner.de>
commit c575e9113bff5e024d75481613faed5ef9d465b2 upstream.
If the calls to devm_request_irq() or devm_spi_register_master() fail
on probe of the PIC32 SPI driver, the DMA channels requested by
pic32_spi_dma_prep() are erroneously not released. Plug the leak.
Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.7+
Cc: Purna Chandra Mandal <purna.mandal@microchip.com>
Link: https://lore.kernel.org/r/9624250e3a7aa61274b38219a62375bac1def637.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-pic32.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/spi/spi-pic32.c
+++ b/drivers/spi/spi-pic32.c
@@ -839,6 +839,7 @@ static int pic32_spi_probe(struct platfo
return 0;
err_bailout:
+ pic32_spi_dma_unprep(pic32s);
clk_disable_unprepare(pic32s->clk);
err_master:
spi_master_put(master);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 223/242] spi: rb4xx: Dont leak SPI master in probe error path
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 222/242] spi: pic32: Dont leak DMA channels in probe error path Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 224/242] spi: sc18is602: " Greg Kroah-Hartman
` (20 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Bert Vermeulen, Mark Brown
From: Lukas Wunner <lukas@wunner.de>
commit a4729c3506c3eb1a6ca5c0289f4e7cafa4115065 upstream.
If the calls to devm_clk_get(), devm_spi_register_master() or
clk_prepare_enable() fail on probe of the Mikrotik RB4xx SPI driver,
the spi_master struct is erroneously not freed.
Fix by switching over to the new devm_spi_alloc_master() helper.
Fixes: 05aec357871f ("spi: Add SPI driver for Mikrotik RB4xx series boards")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.2+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.2+
Cc: Bert Vermeulen <bert@biot.com>
Link: https://lore.kernel.org/r/369bf26d71927f60943b1d9d8f51810f00b0237d.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-rb4xx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/spi/spi-rb4xx.c
+++ b/drivers/spi/spi-rb4xx.c
@@ -148,7 +148,7 @@ static int rb4xx_spi_probe(struct platfo
if (IS_ERR(spi_base))
return PTR_ERR(spi_base);
- master = spi_alloc_master(&pdev->dev, sizeof(*rbspi));
+ master = devm_spi_alloc_master(&pdev->dev, sizeof(*rbspi));
if (!master)
return -ENOMEM;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 224/242] spi: sc18is602: Dont leak SPI master in probe error path
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 223/242] spi: rb4xx: Dont leak SPI master " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 225/242] spi: st-ssc4: Fix unbalanced pm_runtime_disable() " Greg Kroah-Hartman
` (19 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Phil Reid, Mark Brown
From: Lukas Wunner <lukas@wunner.de>
commit 5b8c88462d83331dacb48aeaec8388117fef82e0 upstream.
If the call to devm_gpiod_get_optional() fails on probe of the NXP
SC18IS602/603 SPI driver, the spi_master struct is erroneously not freed.
Fix by switching over to the new devm_spi_alloc_master() helper.
Fixes: f99008013e19 ("spi: sc18is602: Add reset control via gpio pin.")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.9+
Cc: Phil Reid <preid@electromag.com.au>
Link: https://lore.kernel.org/r/d5f715527b894b91d530fe11a86f51b3184a4e1a.1607286887.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-sc18is602.c | 13 ++-----------
1 file changed, 2 insertions(+), 11 deletions(-)
--- a/drivers/spi/spi-sc18is602.c
+++ b/drivers/spi/spi-sc18is602.c
@@ -248,13 +248,12 @@ static int sc18is602_probe(struct i2c_cl
struct sc18is602_platform_data *pdata = dev_get_platdata(dev);
struct sc18is602 *hw;
struct spi_master *master;
- int error;
if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C |
I2C_FUNC_SMBUS_WRITE_BYTE_DATA))
return -EINVAL;
- master = spi_alloc_master(dev, sizeof(struct sc18is602));
+ master = devm_spi_alloc_master(dev, sizeof(struct sc18is602));
if (!master)
return -ENOMEM;
@@ -308,15 +307,7 @@ static int sc18is602_probe(struct i2c_cl
master->min_speed_hz = hw->freq / 128;
master->max_speed_hz = hw->freq / 4;
- error = devm_spi_register_master(dev, master);
- if (error)
- goto error_reg;
-
- return 0;
-
-error_reg:
- spi_master_put(master);
- return error;
+ return devm_spi_register_master(dev, master);
}
static const struct i2c_device_id sc18is602_id[] = {
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 225/242] spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 224/242] spi: sc18is602: " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 226/242] soc: qcom: smp2p: Safely acquire spinlock without IRQs Greg Kroah-Hartman
` (18 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Chuhong Yuan, Mark Brown
From: Lukas Wunner <lukas@wunner.de>
commit 5ef76dac0f2c26aeae4ee79eb830280f16d5aceb upstream.
If the calls to devm_platform_ioremap_resource(), irq_of_parse_and_map()
or devm_request_irq() fail on probe of the ST SSC4 SPI driver, the
runtime PM disable depth is incremented even though it was not
decremented before. Fix it.
Fixes: cd050abeba2a ("spi: st-ssc4: add missed pm_runtime_disable")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.5+
Cc: Chuhong Yuan <hslester96@gmail.com>
Link: https://lore.kernel.org/r/fbe8768c30dc829e2d77eabe7be062ca22f84024.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-st-ssc4.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/spi/spi-st-ssc4.c
+++ b/drivers/spi/spi-st-ssc4.c
@@ -379,13 +379,14 @@ static int spi_st_probe(struct platform_
ret = devm_spi_register_master(&pdev->dev, master);
if (ret) {
dev_err(&pdev->dev, "Failed to register master\n");
- goto clk_disable;
+ goto rpm_disable;
}
return 0;
-clk_disable:
+rpm_disable:
pm_runtime_disable(&pdev->dev);
+clk_disable:
clk_disable_unprepare(spi_st->clk);
put_master:
spi_master_put(master);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 226/242] soc: qcom: smp2p: Safely acquire spinlock without IRQs
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 225/242] spi: st-ssc4: Fix unbalanced pm_runtime_disable() " Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 227/242] mtd: parser: cmdline: Fix parsing of part-names with colons Greg Kroah-Hartman
` (17 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bjorn Andersson, Stephen Boyd, Evan Green
From: Evan Green <evgreen@chromium.org>
commit fc3e62e25c3896855b7c3d72df19ca6be3459c9f upstream.
smp2p_update_bits() should disable interrupts when it acquires its
spinlock. This is important because without the _irqsave, a priority
inversion can occur.
This function is called both with interrupts enabled in
qcom_q6v5_request_stop(), and with interrupts disabled in
ipa_smp2p_panic_notifier(). IRQ handling of spinlocks should be
consistent to avoid the panic notifier deadlocking because it's
sitting on the thread that's already got the lock via _request_stop().
Found via lockdep.
Cc: stable@vger.kernel.org
Fixes: 50e99641413e7 ("soc: qcom: smp2p: Qualcomm Shared Memory Point to Point")
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Evan Green <evgreen@chromium.org>
Link: https://lore.kernel.org/r/20200929133040.RESEND.1.Ideabf6dcdfc577cf39ce3d95b0e4aa1ac8b38f0c@changeid
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/smp2p.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/soc/qcom/smp2p.c
+++ b/drivers/soc/qcom/smp2p.c
@@ -314,15 +314,16 @@ static int qcom_smp2p_inbound_entry(stru
static int smp2p_update_bits(void *data, u32 mask, u32 value)
{
struct smp2p_entry *entry = data;
+ unsigned long flags;
u32 orig;
u32 val;
- spin_lock(&entry->lock);
+ spin_lock_irqsave(&entry->lock, flags);
val = orig = readl(entry->value);
val &= ~mask;
val |= value;
writel(val, entry->value);
- spin_unlock(&entry->lock);
+ spin_unlock_irqrestore(&entry->lock, flags);
if (val != orig)
qcom_smp2p_kick(entry->smp2p);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 227/242] mtd: parser: cmdline: Fix parsing of part-names with colons
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 226/242] soc: qcom: smp2p: Safely acquire spinlock without IRQs Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 228/242] iio: buffer: Fix demux update Greg Kroah-Hartman
` (16 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ron Minnich, Sven Eckelmann, Miquel Raynal
From: Sven Eckelmann <sven@narfation.org>
commit 639a82434f16a6df0ce0e7c8595976f1293940fd upstream.
Some devices (especially QCA ones) are already using hardcoded partition
names with colons in it. The OpenMesh A62 for example provides following
mtd relevant information via cmdline:
root=31:11 mtdparts=spi0.0:256k(0:SBL1),128k(0:MIBIB),384k(0:QSEE),64k(0:CDT),64k(0:DDRPARAMS),64k(0:APPSBLENV),512k(0:APPSBL),64k(0:ART),64k(custom),64k(0:KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive) rootfsname=rootfs rootwait
The change to split only on the last colon between mtd-id and partitions
will cause newpart to see following string for the first partition:
KEYS),0x002b0000(kernel),0x00c80000(rootfs),15552k(inactive)
Such a partition list cannot be parsed and thus the device fails to boot.
Avoid this behavior by making sure that the start of the first part-name
("(") will also be the last byte the mtd-id split algorithm is using for
its colon search.
Fixes: eb13fa022741 ("mtd: parser: cmdline: Support MTD names containing one or more colons")
Cc: stable@vger.kernel.org
Cc: Ron Minnich <rminnich@google.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20201124062506.185392-1-sven@narfation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/cmdlinepart.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- a/drivers/mtd/cmdlinepart.c
+++ b/drivers/mtd/cmdlinepart.c
@@ -228,7 +228,7 @@ static int mtdpart_setup_real(char *s)
struct cmdline_mtd_partition *this_mtd;
struct mtd_partition *parts;
int mtd_id_len, num_parts;
- char *p, *mtd_id, *semicol;
+ char *p, *mtd_id, *semicol, *open_parenth;
/*
* Replace the first ';' by a NULL char so strrchr can work
@@ -238,6 +238,14 @@ static int mtdpart_setup_real(char *s)
if (semicol)
*semicol = '\0';
+ /*
+ * make sure that part-names with ":" will not be handled as
+ * part of the mtd-id with an ":"
+ */
+ open_parenth = strchr(s, '(');
+ if (open_parenth)
+ *open_parenth = '\0';
+
mtd_id = s;
/*
@@ -247,6 +255,10 @@ static int mtdpart_setup_real(char *s)
*/
p = strrchr(s, ':');
+ /* Restore the '(' now. */
+ if (open_parenth)
+ *open_parenth = '(';
+
/* Restore the ';' now. */
if (semicol)
*semicol = ';';
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 228/242] iio: buffer: Fix demux update
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 227/242] mtd: parser: cmdline: Fix parsing of part-names with colons Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 229/242] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume Greg Kroah-Hartman
` (15 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nuno Sá, Stable, Jonathan Cameron
From: Nuno Sá <nuno.sa@analog.com>
commit 19ef7b70ca9487773c29b449adf0c70f540a0aab upstream.
When updating the buffer demux, we will skip a scan element from the
device in the case `in_ind != out_ind` and we enter the while loop.
in_ind should only be refreshed with `find_next_bit()` in the end of the
loop.
Note, to cause problems we need a situation where we are skippig over
an element (channel not enabled) that happens to not have the same size
as the next element. Whilst this is a possible situation we haven't
actually identified any cases in mainline where it happens as most drivers
have consistent channel storage sizes with the exception of the timestamp
which is the last element and hence never skipped over.
Fixes: 5ada4ea9be16 ("staging:iio: add demux optionally to path from device to buffer")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20201112144323.28887-1-nuno.sa@analog.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-buffer.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -850,12 +850,12 @@ static int iio_buffer_update_demux(struc
indio_dev->masklength,
in_ind + 1);
while (in_ind != out_ind) {
- in_ind = find_next_bit(indio_dev->active_scan_mask,
- indio_dev->masklength,
- in_ind + 1);
length = iio_storage_bytes_for_si(indio_dev, in_ind);
/* Make sure we are aligned */
in_loc = roundup(in_loc, length) + length;
+ in_ind = find_next_bit(indio_dev->active_scan_mask,
+ indio_dev->masklength,
+ in_ind + 1);
}
length = iio_storage_bytes_for_si(indio_dev, in_ind);
out_loc = roundup(out_loc, length);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 229/242] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 228/242] iio: buffer: Fix demux update Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 230/242] iio:light:rpr0521: Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
` (14 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robin Murphy, Qinglang Miao, Stable,
Jonathan Cameron
From: Qinglang Miao <miaoqinglang@huawei.com>
commit 560c6b914c6ec7d9d9a69fddbb5bf3bf71433e8b upstream.
Fix the missing clk_disable_unprepare() of info->pclk
before return from rockchip_saradc_resume in the error
handling case when fails to prepare and enable info->clk.
Suggested-by: Robin Murphy <robin.murphy@arm.com>
Fixes: 44d6f2ef94f9 ("iio: adc: add driver for Rockchip saradc")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201103120743.110662-1-miaoqinglang@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/rockchip_saradc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -384,7 +384,7 @@ static int rockchip_saradc_resume(struct
ret = clk_prepare_enable(info->clk);
if (ret)
- return ret;
+ clk_disable_unprepare(info->pclk);
return ret;
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 230/242] iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 229/242] iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 231/242] iio:pressure:mpl3115: Force alignment of buffer Greg Kroah-Hartman
` (13 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Alexandru Ardelean,
Mikko Koivunen, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit a61817216bcc755eabbcb1cf281d84ccad267ed1 upstream.
One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes). This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here. We close both issues by
moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc() so no data can leak apart
from previous readings and in this case the status byte from the device.
The forced alignment of ts is not necessary in this case but it
potentially makes the code less fragile.
>From personal communications with Mikko:
We could probably split the reading of the int register, but it
would mean a significant performance cost of 20 i2c clock cycles.
Fixes: e12ffd241c00 ("iio: light: rpr0521 triggered buffer")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Mikko Koivunen <mikko.koivunen@fi.rohmeurope.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-2-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/rpr0521.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/iio/light/rpr0521.c
+++ b/drivers/iio/light/rpr0521.c
@@ -197,6 +197,17 @@ struct rpr0521_data {
bool pxs_need_dis;
struct regmap *regmap;
+
+ /*
+ * Ensure correct naturally aligned timestamp.
+ * Note that the read will put garbage data into
+ * the padding but this should not be a problem
+ */
+ struct {
+ __le16 channels[3];
+ u8 garbage;
+ s64 ts __aligned(8);
+ } scan;
};
static IIO_CONST_ATTR(in_intensity_scale_available, RPR0521_ALS_SCALE_AVAIL);
@@ -452,8 +463,6 @@ static irqreturn_t rpr0521_trigger_consu
struct rpr0521_data *data = iio_priv(indio_dev);
int err;
- u8 buffer[16]; /* 3 16-bit channels + padding + ts */
-
/* Use irq timestamp when reasonable. */
if (iio_trigger_using_own(indio_dev) && data->irq_timestamp) {
pf->timestamp = data->irq_timestamp;
@@ -464,11 +473,11 @@ static irqreturn_t rpr0521_trigger_consu
pf->timestamp = iio_get_time_ns(indio_dev);
err = regmap_bulk_read(data->regmap, RPR0521_REG_PXS_DATA,
- &buffer,
+ data->scan.channels,
(3 * 2) + 1); /* 3 * 16-bit + (discarded) int clear reg. */
if (!err)
iio_push_to_buffers_with_timestamp(indio_dev,
- buffer, pf->timestamp);
+ &data->scan, pf->timestamp);
else
dev_err(&data->client->dev,
"Trigger consumer can't read from sensor.\n");
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 231/242] iio:pressure:mpl3115: Force alignment of buffer
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 230/242] iio:light:rpr0521: Fix timestamp alignment and prevent data leak Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 232/242] iio:imu:bmi160: Fix too large a buffer Greg Kroah-Hartman
` (12 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Jonathan Cameron,
Andy Shevchenko, Alexandru Ardelean, Peter Meerwald, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit 198cf32f0503d2ad60d320b95ef6fb8243db857f upstream.
Whilst this is another case of the issue Lars reported with
an array of elements of smaller than 8 bytes being passed
to iio_push_to_buffers_with_timestamp(), the solution here is
a bit different from the other cases and relies on __aligned
working on the stack (true since 4.6?)
This one is unusual. We have to do an explicit memset() each time
as we are reading 3 bytes into a potential 4 byte channel which
may sometimes be a 2 byte channel depending on what is enabled.
As such, moving the buffer to the heap in the iio_priv structure
doesn't save us much. We can't use a nice explicit structure
on the stack either as the data channels have different storage
sizes and are all separately controlled.
Fixes: cc26ad455f57 ("iio: Add Freescale MPL3115A2 pressure / temperature sensor driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Peter Meerwald <pmeerw@pmeerw.net>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-7-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/mpl3115.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/iio/pressure/mpl3115.c
+++ b/drivers/iio/pressure/mpl3115.c
@@ -147,7 +147,14 @@ static irqreturn_t mpl3115_trigger_handl
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct mpl3115_data *data = iio_priv(indio_dev);
- u8 buffer[16]; /* 32-bit channel + 16-bit channel + padding + ts */
+ /*
+ * 32-bit channel + 16-bit channel + padding + ts
+ * Note that it is possible for only one of the first 2
+ * channels to be enabled. If that happens, the first element
+ * of the buffer may be either 16 or 32-bits. As such we cannot
+ * use a simple structure definition to express this data layout.
+ */
+ u8 buffer[16] __aligned(8);
int ret, pos = 0;
mutex_lock(&data->lock);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 232/242] iio:imu:bmi160: Fix too large a buffer.
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 231/242] iio:pressure:mpl3115: Force alignment of buffer Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 233/242] md/cluster: fix deadlock when node is doing resync job Greg Kroah-Hartman
` (11 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonathan Cameron, Alexandru Ardelean,
Daniel Baluta, Stable
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
commit dc7de42d6b50a07b37feeba4c6b5136290fcee81 upstream.
The comment implies this device has 3 sensor types, but it only
has an accelerometer and a gyroscope (both 3D). As such the
buffer does not need to be as long as stated.
Note I've separated this from the following patch which fixes
the alignment for passing to iio_push_to_buffers_with_timestamp()
as they are different issues even if they affect the same line
of code.
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Daniel Baluta <daniel.baluta@oss.nxp.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-5-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/bmi160/bmi160_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/imu/bmi160/bmi160_core.c
+++ b/drivers/iio/imu/bmi160/bmi160_core.c
@@ -385,8 +385,8 @@ static irqreturn_t bmi160_trigger_handle
struct iio_poll_func *pf = p;
struct iio_dev *indio_dev = pf->indio_dev;
struct bmi160_data *data = iio_priv(indio_dev);
- __le16 buf[16];
- /* 3 sens x 3 axis x __le16 + 3 x __le16 pad + 4 x __le16 tstamp */
+ __le16 buf[12];
+ /* 2 sens x 3 axis x __le16 + 2 x __le16 pad + 4 x __le16 tstamp */
int i, ret, j = 0, base = BMI160_REG_DATA_MAGN_XOUT_L;
__le16 sample;
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 233/242] md/cluster: fix deadlock when node is doing resync job
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 232/242] iio:imu:bmi160: Fix too large a buffer Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 234/242] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 Greg Kroah-Hartman
` (10 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhao Heming, Xiao Ni, Song Liu
From: Zhao Heming <heming.zhao@suse.com>
commit bca5b0658020be90b6b504ca514fd80110204f71 upstream.
md-cluster uses MD_CLUSTER_SEND_LOCK to make node can exclusively send msg.
During sending msg, node can concurrently receive msg from another node.
When node does resync job, grab token_lockres:EX may trigger a deadlock:
```
nodeA nodeB
-------------------- --------------------
a.
send METADATA_UPDATED
held token_lockres:EX
b.
md_do_sync
resync_info_update
send RESYNCING
+ set MD_CLUSTER_SEND_LOCK
+ wait for holding token_lockres:EX
c.
mdadm /dev/md0 --remove /dev/sdg
+ held reconfig_mutex
+ send REMOVE
+ wait_event(MD_CLUSTER_SEND_LOCK)
d.
recv_daemon //METADATA_UPDATED from A
process_metadata_update
+ (mddev_trylock(mddev) ||
MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD)
//this time, both return false forever
```
Explaination:
a. A send METADATA_UPDATED
This will block another node to send msg
b. B does sync jobs, which will send RESYNCING at intervals.
This will be block for holding token_lockres:EX lock.
c. B do "mdadm --remove", which will send REMOVE.
This will be blocked by step <b>: MD_CLUSTER_SEND_LOCK is 1.
d. B recv METADATA_UPDATED msg, which send from A in step <a>.
This will be blocked by step <c>: holding mddev lock, it makes
wait_event can't hold mddev lock. (btw,
MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD keep ZERO in this scenario.)
There is a similar deadlock in commit 0ba959774e93
("md-cluster: use sync way to handle METADATA_UPDATED msg")
In that commit, step c is "update sb". This patch step c is
"mdadm --remove".
For fixing this issue, we can refer the solution of function:
metadata_update_start. Which does the same grab lock_token action.
lock_comm can use the same steps to avoid deadlock. By moving
MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD from lock_token to lock_comm.
It enlarge a little bit window of MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
but it is safe & can break deadlock.
Repro steps (I only triggered 3 times with hundreds tests):
two nodes share 3 iSCSI luns: sdg/sdh/sdi. Each lun size is 1GB.
```
ssh root@node2 "mdadm -S --scan"
mdadm -S --scan
for i in {g,h,i};do dd if=/dev/zero of=/dev/sd$i oflag=direct bs=1M \
count=20; done
mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sdg /dev/sdh \
--bitmap-chunk=1M
ssh root@node2 "mdadm -A /dev/md0 /dev/sdg /dev/sdh"
sleep 5
mkfs.xfs /dev/md0
mdadm --manage --add /dev/md0 /dev/sdi
mdadm --wait /dev/md0
mdadm --grow --raid-devices=3 /dev/md0
mdadm /dev/md0 --fail /dev/sdg
mdadm /dev/md0 --remove /dev/sdg
mdadm --grow --raid-devices=2 /dev/md0
```
test script will hung when executing "mdadm --remove".
```
# dump stacks by "echo t > /proc/sysrq-trigger"
md0_cluster_rec D 0 5329 2 0x80004000
Call Trace:
__schedule+0x1f6/0x560
? _cond_resched+0x2d/0x40
? schedule+0x4a/0xb0
? process_metadata_update.isra.0+0xdb/0x140 [md_cluster]
? wait_woken+0x80/0x80
? process_recvd_msg+0x113/0x1d0 [md_cluster]
? recv_daemon+0x9e/0x120 [md_cluster]
? md_thread+0x94/0x160 [md_mod]
? wait_woken+0x80/0x80
? md_congested+0x30/0x30 [md_mod]
? kthread+0x115/0x140
? __kthread_bind_mask+0x60/0x60
? ret_from_fork+0x1f/0x40
mdadm D 0 5423 1 0x00004004
Call Trace:
__schedule+0x1f6/0x560
? __schedule+0x1fe/0x560
? schedule+0x4a/0xb0
? lock_comm.isra.0+0x7b/0xb0 [md_cluster]
? wait_woken+0x80/0x80
? remove_disk+0x4f/0x90 [md_cluster]
? hot_remove_disk+0xb1/0x1b0 [md_mod]
? md_ioctl+0x50c/0xba0 [md_mod]
? wait_woken+0x80/0x80
? blkdev_ioctl+0xa2/0x2a0
? block_ioctl+0x39/0x40
? ksys_ioctl+0x82/0xc0
? __x64_sys_ioctl+0x16/0x20
? do_syscall_64+0x5f/0x150
? entry_SYSCALL_64_after_hwframe+0x44/0xa9
md0_resync D 0 5425 2 0x80004000
Call Trace:
__schedule+0x1f6/0x560
? schedule+0x4a/0xb0
? dlm_lock_sync+0xa1/0xd0 [md_cluster]
? wait_woken+0x80/0x80
? lock_token+0x2d/0x90 [md_cluster]
? resync_info_update+0x95/0x100 [md_cluster]
? raid1_sync_request+0x7d3/0xa40 [raid1]
? md_do_sync.cold+0x737/0xc8f [md_mod]
? md_thread+0x94/0x160 [md_mod]
? md_congested+0x30/0x30 [md_mod]
? kthread+0x115/0x140
? __kthread_bind_mask+0x60/0x60
? ret_from_fork+0x1f/0x40
```
At last, thanks for Xiao's solution.
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Heming <heming.zhao@suse.com>
Suggested-by: Xiao Ni <xni@redhat.com>
Reviewed-by: Xiao Ni <xni@redhat.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md-cluster.c | 67 +++++++++++++++++++++++++++---------------------
drivers/md/md.c | 6 ++--
2 files changed, 42 insertions(+), 31 deletions(-)
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -659,9 +659,27 @@ out:
* Takes the lock on the TOKEN lock resource so no other
* node can communicate while the operation is underway.
*/
-static int lock_token(struct md_cluster_info *cinfo, bool mddev_locked)
+static int lock_token(struct md_cluster_info *cinfo)
{
- int error, set_bit = 0;
+ int error;
+
+ error = dlm_lock_sync(cinfo->token_lockres, DLM_LOCK_EX);
+ if (error) {
+ pr_err("md-cluster(%s:%d): failed to get EX on TOKEN (%d)\n",
+ __func__, __LINE__, error);
+ } else {
+ /* Lock the receive sequence */
+ mutex_lock(&cinfo->recv_mutex);
+ }
+ return error;
+}
+
+/* lock_comm()
+ * Sets the MD_CLUSTER_SEND_LOCK bit to lock the send channel.
+ */
+static int lock_comm(struct md_cluster_info *cinfo, bool mddev_locked)
+{
+ int rv, set_bit = 0;
struct mddev *mddev = cinfo->mddev;
/*
@@ -672,34 +690,19 @@ static int lock_token(struct md_cluster_
*/
if (mddev_locked && !test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
&cinfo->state)) {
- error = test_and_set_bit_lock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
+ rv = test_and_set_bit_lock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
&cinfo->state);
- WARN_ON_ONCE(error);
+ WARN_ON_ONCE(rv);
md_wakeup_thread(mddev->thread);
set_bit = 1;
}
- error = dlm_lock_sync(cinfo->token_lockres, DLM_LOCK_EX);
- if (set_bit)
- clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
- if (error)
- pr_err("md-cluster(%s:%d): failed to get EX on TOKEN (%d)\n",
- __func__, __LINE__, error);
-
- /* Lock the receive sequence */
- mutex_lock(&cinfo->recv_mutex);
- return error;
-}
-
-/* lock_comm()
- * Sets the MD_CLUSTER_SEND_LOCK bit to lock the send channel.
- */
-static int lock_comm(struct md_cluster_info *cinfo, bool mddev_locked)
-{
wait_event(cinfo->wait,
!test_and_set_bit(MD_CLUSTER_SEND_LOCK, &cinfo->state));
-
- return lock_token(cinfo, mddev_locked);
+ rv = lock_token(cinfo);
+ if (set_bit)
+ clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
+ return rv;
}
static void unlock_comm(struct md_cluster_info *cinfo)
@@ -779,9 +782,11 @@ static int sendmsg(struct md_cluster_inf
{
int ret;
- lock_comm(cinfo, mddev_locked);
- ret = __sendmsg(cinfo, cmsg);
- unlock_comm(cinfo);
+ ret = lock_comm(cinfo, mddev_locked);
+ if (!ret) {
+ ret = __sendmsg(cinfo, cmsg);
+ unlock_comm(cinfo);
+ }
return ret;
}
@@ -1053,7 +1058,7 @@ static int metadata_update_start(struct
return 0;
}
- ret = lock_token(cinfo, 1);
+ ret = lock_token(cinfo);
clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
return ret;
}
@@ -1171,7 +1176,10 @@ static void update_size(struct mddev *md
int raid_slot = -1;
md_update_sb(mddev, 1);
- lock_comm(cinfo, 1);
+ if (lock_comm(cinfo, 1)) {
+ pr_err("%s: lock_comm failed\n", __func__);
+ return;
+ }
memset(&cmsg, 0, sizeof(cmsg));
cmsg.type = cpu_to_le32(METADATA_UPDATED);
@@ -1310,7 +1318,8 @@ static int add_new_disk(struct mddev *md
cmsg.type = cpu_to_le32(NEWDISK);
memcpy(cmsg.uuid, uuid, 16);
cmsg.raid_slot = cpu_to_le32(rdev->desc_nr);
- lock_comm(cinfo, 1);
+ if (lock_comm(cinfo, 1))
+ return -EAGAIN;
ret = __sendmsg(cinfo, &cmsg);
if (ret) {
unlock_comm(cinfo);
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6537,8 +6537,10 @@ static int hot_remove_disk(struct mddev
goto busy;
kick_rdev:
- if (mddev_is_clustered(mddev))
- md_cluster_ops->remove_disk(mddev, rdev);
+ if (mddev_is_clustered(mddev)) {
+ if (md_cluster_ops->remove_disk(mddev, rdev))
+ goto busy;
+ }
md_kick_rdev_from_array(rdev);
set_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 234/242] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 233/242] md/cluster: fix deadlock when node is doing resync job Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 235/242] xen-blkback: set ring->xenblkd to NULL after kthread_stop() Greg Kroah-Hartman
` (9 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Terry Zhou, Pali Rohár,
Marek Behún, Stephen Boyd
From: Terry Zhou <bjzhou@marvell.com>
commit 6f37689cf6b38fff96de52e7f0d3e78f22803ba0 upstream.
There is an error in the current code that the XTAL MODE
pin was set to NB MPP1_31 which should be NB MPP1_9.
The latch register of NB MPP1_9 has different offset of 0x8.
Signed-off-by: Terry Zhou <bjzhou@marvell.com>
[pali: Fix pin name in commit message]
Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 7ea8250406a6 ("clk: mvebu: Add the xtal clock for Armada 3700 SoC")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201106100039.11385-1-pali@kernel.org
Reviewed-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/mvebu/armada-37xx-xtal.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/clk/mvebu/armada-37xx-xtal.c
+++ b/drivers/clk/mvebu/armada-37xx-xtal.c
@@ -15,8 +15,8 @@
#include <linux/platform_device.h>
#include <linux/regmap.h>
-#define NB_GPIO1_LATCH 0xC
-#define XTAL_MODE BIT(31)
+#define NB_GPIO1_LATCH 0x8
+#define XTAL_MODE BIT(9)
static int armada_3700_xtal_clock_probe(struct platform_device *pdev)
{
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 235/242] xen-blkback: set ring->xenblkd to NULL after kthread_stop()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 234/242] clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9 Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 236/242] xen/xenbus: Allow watches discard events before queueing Greg Kroah-Hartman
` (8 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Olivier Benjamin,
Pawel Wieczorkiewicz, Julien Grall, Juergen Gross
From: Pawel Wieczorkiewicz <wipawel@amazon.de>
commit 1c728719a4da6e654afb9cc047164755072ed7c9 upstream.
When xen_blkif_disconnect() is called, the kernel thread behind the
block interface is stopped by calling kthread_stop(ring->xenblkd).
The ring->xenblkd thread pointer being non-NULL determines if the
thread has been already stopped.
Normally, the thread's function xen_blkif_schedule() sets the
ring->xenblkd to NULL, when the thread's main loop ends.
However, when the thread has not been started yet (i.e.
wake_up_process() has not been called on it), the xen_blkif_schedule()
function would not be called yet.
In such case the kthread_stop() call returns -EINTR and the
ring->xenblkd remains dangling.
When this happens, any consecutive call to xen_blkif_disconnect (for
example in frontend_changed() callback) leads to a kernel crash in
kthread_stop() (e.g. NULL pointer dereference in exit_creds()).
This is XSA-350.
Cc: <stable@vger.kernel.org> # 4.12
Fixes: a24fa22ce22a ("xen/blkback: don't use xen_blkif_get() in xen-blkback kthread")
Reported-by: Olivier Benjamin <oliben@amazon.com>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Signed-off-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/xen-blkback/xenbus.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -263,6 +263,7 @@ static int xen_blkif_disconnect(struct x
if (ring->xenblkd) {
kthread_stop(ring->xenblkd);
+ ring->xenblkd = NULL;
wake_up(&ring->shutdown_wq);
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 236/242] xen/xenbus: Allow watches discard events before queueing
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 235/242] xen-blkback: set ring->xenblkd to NULL after kthread_stop() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 237/242] xen/xenbus: Add will_handle callback support in xenbus_watch_path() Greg Kroah-Hartman
` (7 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
Pawel Wieczorkiewicz, Juergen Gross
From: SeongJae Park <sjpark@amazon.de>
commit fed1755b118147721f2c87b37b9d66e62c39b668 upstream.
If handling logics of watch events are slower than the events enqueue
logic and the events can be created from the guests, the guests could
trigger memory pressure by intensively inducing the events, because it
will create a huge number of pending events that exhausting the memory.
Fortunately, some watch events could be ignored, depending on its
handler callback. For example, if the callback has interest in only one
single path, the watch wouldn't want multiple pending events. Or, some
watches could ignore events to same path.
To let such watches to volutarily help avoiding the memory pressure
situation, this commit introduces new watch callback, 'will_handle'. If
it is not NULL, it will be called for each new event just before
enqueuing it. Then, if the callback returns false, the event will be
discarded. No watch is using the callback for now, though.
This is part of XSA-349
Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/xen-netback/xenbus.c | 4 ++++
drivers/xen/xenbus/xenbus_client.c | 1 +
drivers/xen/xenbus/xenbus_xs.c | 5 ++++-
include/xen/xenbus.h | 7 +++++++
4 files changed, 16 insertions(+), 1 deletion(-)
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -777,12 +777,14 @@ static int xen_register_credit_watch(str
return -ENOMEM;
snprintf(node, maxlen, "%s/rate", dev->nodename);
vif->credit_watch.node = node;
+ vif->credit_watch.will_handle = NULL;
vif->credit_watch.callback = xen_net_rate_changed;
err = register_xenbus_watch(&vif->credit_watch);
if (err) {
pr_err("Failed to set watcher %s\n", vif->credit_watch.node);
kfree(node);
vif->credit_watch.node = NULL;
+ vif->credit_watch.will_handle = NULL;
vif->credit_watch.callback = NULL;
}
return err;
@@ -829,6 +831,7 @@ static int xen_register_mcast_ctrl_watch
snprintf(node, maxlen, "%s/request-multicast-control",
dev->otherend);
vif->mcast_ctrl_watch.node = node;
+ vif->mcast_ctrl_watch.will_handle = NULL;
vif->mcast_ctrl_watch.callback = xen_mcast_ctrl_changed;
err = register_xenbus_watch(&vif->mcast_ctrl_watch);
if (err) {
@@ -836,6 +839,7 @@ static int xen_register_mcast_ctrl_watch
vif->mcast_ctrl_watch.node);
kfree(node);
vif->mcast_ctrl_watch.node = NULL;
+ vif->mcast_ctrl_watch.will_handle = NULL;
vif->mcast_ctrl_watch.callback = NULL;
}
return err;
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -120,6 +120,7 @@ int xenbus_watch_path(struct xenbus_devi
int err;
watch->node = path;
+ watch->will_handle = NULL;
watch->callback = callback;
err = register_xenbus_watch(watch);
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -700,7 +700,10 @@ int xs_watch_msg(struct xs_watch_event *
spin_lock(&watches_lock);
event->handle = find_watch(event->token);
- if (event->handle != NULL) {
+ if (event->handle != NULL &&
+ (!event->handle->will_handle ||
+ event->handle->will_handle(event->handle,
+ event->path, event->token))) {
spin_lock(&watch_events_lock);
list_add_tail(&event->list, &watch_events);
wake_up(&watch_events_waitq);
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -59,6 +59,13 @@ struct xenbus_watch
/* Path being watched. */
const char *node;
+ /*
+ * Called just before enqueing new event while a spinlock is held.
+ * The event will be discarded if this callback returns false.
+ */
+ bool (*will_handle)(struct xenbus_watch *,
+ const char *path, const char *token);
+
/* Callback (executed in a process context with no locks held). */
void (*callback)(struct xenbus_watch *,
const char *path, const char *token);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 237/242] xen/xenbus: Add will_handle callback support in xenbus_watch_path()
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 236/242] xen/xenbus: Allow watches discard events before queueing Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 238/242] xen/xenbus/xen_bus_type: Support will_handle watch callback Greg Kroah-Hartman
` (6 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
Pawel Wieczorkiewicz, Juergen Gross
From: SeongJae Park <sjpark@amazon.de>
commit 2e85d32b1c865bec703ce0c962221a5e955c52c2 upstream.
Some code does not directly make 'xenbus_watch' object and call
'register_xenbus_watch()' but use 'xenbus_watch_path()' instead. This
commit adds support of 'will_handle' callback in the
'xenbus_watch_path()' and it's wrapper, 'xenbus_watch_pathfmt()'.
This is part of XSA-349
Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/xen-blkback/xenbus.c | 3 ++-
drivers/net/xen-netback/xenbus.c | 2 +-
drivers/xen/xen-pciback/xenbus.c | 2 +-
drivers/xen/xenbus/xenbus_client.c | 9 +++++++--
drivers/xen/xenbus/xenbus_probe.c | 2 +-
include/xen/xenbus.h | 6 +++++-
6 files changed, 17 insertions(+), 7 deletions(-)
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -651,7 +651,8 @@ static int xen_blkbk_probe(struct xenbus
/* setup back pointer */
be->blkif->be = be;
- err = xenbus_watch_pathfmt(dev, &be->backend_watch, backend_changed,
+ err = xenbus_watch_pathfmt(dev, &be->backend_watch, NULL,
+ backend_changed,
"%s/%s", dev->nodename, "physical-device");
if (err)
goto fail;
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -1043,7 +1043,7 @@ static void connect(struct backend_info
xenvif_carrier_on(be->vif);
unregister_hotplug_status_watch(be);
- err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
+ err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, NULL,
hotplug_status_changed,
"%s/%s", dev->nodename, "hotplug-status");
if (!err)
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -688,7 +688,7 @@ static int xen_pcibk_xenbus_probe(struct
/* watch the backend node for backend configuration information */
err = xenbus_watch_path(dev, dev->nodename, &pdev->be_watch,
- xen_pcibk_be_watch);
+ NULL, xen_pcibk_be_watch);
if (err)
goto out;
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -114,19 +114,22 @@ EXPORT_SYMBOL_GPL(xenbus_strstate);
*/
int xenbus_watch_path(struct xenbus_device *dev, const char *path,
struct xenbus_watch *watch,
+ bool (*will_handle)(struct xenbus_watch *,
+ const char *, const char *),
void (*callback)(struct xenbus_watch *,
const char *, const char *))
{
int err;
watch->node = path;
- watch->will_handle = NULL;
+ watch->will_handle = will_handle;
watch->callback = callback;
err = register_xenbus_watch(watch);
if (err) {
watch->node = NULL;
+ watch->will_handle = NULL;
watch->callback = NULL;
xenbus_dev_fatal(dev, err, "adding watch on %s", path);
}
@@ -153,6 +156,8 @@ EXPORT_SYMBOL_GPL(xenbus_watch_path);
*/
int xenbus_watch_pathfmt(struct xenbus_device *dev,
struct xenbus_watch *watch,
+ bool (*will_handle)(struct xenbus_watch *,
+ const char *, const char *),
void (*callback)(struct xenbus_watch *,
const char *, const char *),
const char *pathfmt, ...)
@@ -169,7 +174,7 @@ int xenbus_watch_pathfmt(struct xenbus_d
xenbus_dev_fatal(dev, -ENOMEM, "allocating path for watch");
return -ENOMEM;
}
- err = xenbus_watch_path(dev, path, watch, callback);
+ err = xenbus_watch_path(dev, path, watch, will_handle, callback);
if (err)
kfree(path);
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -136,7 +136,7 @@ static int watch_otherend(struct xenbus_
container_of(dev->dev.bus, struct xen_bus_type, bus);
return xenbus_watch_pathfmt(dev, &dev->otherend_watch,
- bus->otherend_changed,
+ NULL, bus->otherend_changed,
"%s/%s", dev->otherend, "state");
}
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -199,10 +199,14 @@ void xenbus_probe(struct work_struct *);
int xenbus_watch_path(struct xenbus_device *dev, const char *path,
struct xenbus_watch *watch,
+ bool (*will_handle)(struct xenbus_watch *,
+ const char *, const char *),
void (*callback)(struct xenbus_watch *,
const char *, const char *));
-__printf(4, 5)
+__printf(5, 6)
int xenbus_watch_pathfmt(struct xenbus_device *dev, struct xenbus_watch *watch,
+ bool (*will_handle)(struct xenbus_watch *,
+ const char *, const char *),
void (*callback)(struct xenbus_watch *,
const char *, const char *),
const char *pathfmt, ...);
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 238/242] xen/xenbus/xen_bus_type: Support will_handle watch callback
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 237/242] xen/xenbus: Add will_handle callback support in xenbus_watch_path() Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 239/242] xen/xenbus: Count pending messages for each watch Greg Kroah-Hartman
` (5 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
Pawel Wieczorkiewicz, Juergen Gross
From: SeongJae Park <sjpark@amazon.de>
commit be987200fbaceaef340872841d4f7af2c5ee8dc3 upstream.
This commit adds support of the 'will_handle' watch callback for
'xen_bus_type' users.
This is part of XSA-349
Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xenbus/xenbus.h | 2 ++
drivers/xen/xenbus/xenbus_probe.c | 3 ++-
2 files changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/xen/xenbus/xenbus.h
+++ b/drivers/xen/xenbus/xenbus.h
@@ -44,6 +44,8 @@ struct xen_bus_type {
int (*get_bus_id)(char bus_id[XEN_BUS_ID_SIZE], const char *nodename);
int (*probe)(struct xen_bus_type *bus, const char *type,
const char *dir);
+ bool (*otherend_will_handle)(struct xenbus_watch *watch,
+ const char *path, const char *token);
void (*otherend_changed)(struct xenbus_watch *watch, const char *path,
const char *token);
struct bus_type bus;
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -136,7 +136,8 @@ static int watch_otherend(struct xenbus_
container_of(dev->dev.bus, struct xen_bus_type, bus);
return xenbus_watch_pathfmt(dev, &dev->otherend_watch,
- NULL, bus->otherend_changed,
+ bus->otherend_will_handle,
+ bus->otherend_changed,
"%s/%s", dev->otherend, "state");
}
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 239/242] xen/xenbus: Count pending messages for each watch
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 238/242] xen/xenbus/xen_bus_type: Support will_handle watch callback Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 240/242] xenbus/xenbus_backend: Disallow pending watch messages Greg Kroah-Hartman
` (4 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
Pawel Wieczorkiewicz, Juergen Gross
From: SeongJae Park <sjpark@amazon.de>
commit 3dc86ca6b4c8cfcba9da7996189d1b5a358a94fc upstream.
This commit adds a counter of pending messages for each watch in the
struct. It is used to skip unnecessary pending messages lookup in
'unregister_xenbus_watch()'. It could also be used in 'will_handle'
callback.
This is part of XSA-349
Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xenbus/xenbus_xs.c | 29 ++++++++++++++++++-----------
include/xen/xenbus.h | 2 ++
2 files changed, 20 insertions(+), 11 deletions(-)
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -706,6 +706,7 @@ int xs_watch_msg(struct xs_watch_event *
event->path, event->token))) {
spin_lock(&watch_events_lock);
list_add_tail(&event->list, &watch_events);
+ event->handle->nr_pending++;
wake_up(&watch_events_waitq);
spin_unlock(&watch_events_lock);
} else
@@ -763,6 +764,8 @@ int register_xenbus_watch(struct xenbus_
sprintf(token, "%lX", (long)watch);
+ watch->nr_pending = 0;
+
down_read(&xs_watch_rwsem);
spin_lock(&watches_lock);
@@ -812,11 +815,14 @@ void unregister_xenbus_watch(struct xenb
/* Cancel pending watch events. */
spin_lock(&watch_events_lock);
- list_for_each_entry_safe(event, tmp, &watch_events, list) {
- if (event->handle != watch)
- continue;
- list_del(&event->list);
- kfree(event);
+ if (watch->nr_pending) {
+ list_for_each_entry_safe(event, tmp, &watch_events, list) {
+ if (event->handle != watch)
+ continue;
+ list_del(&event->list);
+ kfree(event);
+ }
+ watch->nr_pending = 0;
}
spin_unlock(&watch_events_lock);
@@ -863,7 +869,6 @@ void xs_suspend_cancel(void)
static int xenwatch_thread(void *unused)
{
- struct list_head *ent;
struct xs_watch_event *event;
xenwatch_pid = current->pid;
@@ -878,13 +883,15 @@ static int xenwatch_thread(void *unused)
mutex_lock(&xenwatch_mutex);
spin_lock(&watch_events_lock);
- ent = watch_events.next;
- if (ent != &watch_events)
- list_del(ent);
+ event = list_first_entry_or_null(&watch_events,
+ struct xs_watch_event, list);
+ if (event) {
+ list_del(&event->list);
+ event->handle->nr_pending--;
+ }
spin_unlock(&watch_events_lock);
- if (ent != &watch_events) {
- event = list_entry(ent, struct xs_watch_event, list);
+ if (event) {
event->handle->callback(event->handle, event->path,
event->token);
kfree(event);
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -59,6 +59,8 @@ struct xenbus_watch
/* Path being watched. */
const char *node;
+ unsigned int nr_pending;
+
/*
* Called just before enqueing new event while a spinlock is held.
* The event will be discarded if this callback returns false.
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 240/242] xenbus/xenbus_backend: Disallow pending watch messages
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 239/242] xen/xenbus: Count pending messages for each watch Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 241/242] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels Greg Kroah-Hartman
` (3 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, SeongJae Park, Michael Kurth,
Pawel Wieczorkiewicz, Juergen Gross
From: SeongJae Park <sjpark@amazon.de>
commit 9996bd494794a2fe393e97e7a982388c6249aa76 upstream.
'xenbus_backend' watches 'state' of devices, which is writable by
guests. Hence, if guests intensively updates it, dom0 will have lots of
pending events that exhausting memory of dom0. In other words, guests
can trigger dom0 memory pressure. This is known as XSA-349. However,
the watch callback of it, 'frontend_changed()', reads only 'state', so
doesn't need to have the pending events.
To avoid the problem, this commit disallows pending watch messages for
'xenbus_backend' using the 'will_handle()' watch callback.
This is part of XSA-349
Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xenbus/xenbus_probe_backend.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/xen/xenbus/xenbus_probe_backend.c
+++ b/drivers/xen/xenbus/xenbus_probe_backend.c
@@ -180,6 +180,12 @@ static int xenbus_probe_backend(struct x
return err;
}
+static bool frontend_will_handle(struct xenbus_watch *watch,
+ const char *path, const char *token)
+{
+ return watch->nr_pending == 0;
+}
+
static void frontend_changed(struct xenbus_watch *watch,
const char *path, const char *token)
{
@@ -191,6 +197,7 @@ static struct xen_bus_type xenbus_backen
.levels = 3, /* backend/type/<frontend>/<id> */
.get_bus_id = backend_bus_id,
.probe = xenbus_probe_backend,
+ .otherend_will_handle = frontend_will_handle,
.otherend_changed = frontend_changed,
.bus = {
.name = "xen-backend",
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 241/242] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 240/242] xenbus/xenbus_backend: Disallow pending watch messages Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 12:50 ` [PATCH 4.14 242/242] PCI: Fix pci_slot_release() NULL pointer dereference Greg Kroah-Hartman
` (2 subsequent siblings)
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vishal Verma, Dave Jiang, Ira Weiny,
Dan Williams
From: Dan Williams <dan.j.williams@intel.com>
commit 2dd2a1740ee19cd2636d247276cf27bfa434b0e2 upstream.
A recent change to ndctl to attempt to reconfigure namespaces in place
uncovered a label accounting problem in block-window-type namespaces.
The ndctl "create.sh" test is able to trigger this signature:
WARNING: CPU: 34 PID: 9167 at drivers/nvdimm/label.c:1100 __blk_label_update+0x9a3/0xbc0 [libnvdimm]
[..]
RIP: 0010:__blk_label_update+0x9a3/0xbc0 [libnvdimm]
[..]
Call Trace:
uuid_store+0x21b/0x2f0 [libnvdimm]
kernfs_fop_write+0xcf/0x1c0
vfs_write+0xcc/0x380
ksys_write+0x68/0xe0
When allocated capacity for a namespace is renamed (new UUID) the labels
with the old UUID need to be deleted. The ndctl behavior to always
destroy namespaces on reconfiguration hid this problem.
The immediate impact of this bug is limited since block-window-type
namespaces only seem to exist in the specification and not in any
shipping products. However, the label handling code is being reused for
other technologies like CXL region labels, so there is a benefit to
making sure both vertical labels sets (block-window) and horizontal
label sets (pmem) have a functional reference implementation in
libnvdimm.
Fixes: c4703ce11c23 ("libnvdimm/namespace: Fix label tracking error")
Cc: <stable@vger.kernel.org>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/label.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -852,6 +852,15 @@ static int __blk_label_update(struct nd_
}
}
+ /* release slots associated with any invalidated UUIDs */
+ mutex_lock(&nd_mapping->lock);
+ list_for_each_entry_safe(label_ent, e, &nd_mapping->labels, list)
+ if (test_and_clear_bit(ND_LABEL_REAP, &label_ent->flags)) {
+ reap_victim(nd_mapping, label_ent);
+ list_move(&label_ent->list, &list);
+ }
+ mutex_unlock(&nd_mapping->lock);
+
/*
* Find the resource associated with the first label in the set
* per the v1.2 namespace specification.
^ permalink raw reply [flat|nested] 245+ messages in thread* [PATCH 4.14 242/242] PCI: Fix pci_slot_release() NULL pointer dereference
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 241/242] libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels Greg Kroah-Hartman
@ 2020-12-28 12:50 ` Greg Kroah-Hartman
2020-12-28 20:25 ` [PATCH 4.14 000/242] 4.14.213-rc1 review Guenter Roeck
2020-12-29 8:59 ` Naresh Kamboju
242 siblings, 0 replies; 245+ messages in thread
From: Greg Kroah-Hartman @ 2020-12-28 12:50 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jubin Zhong, Bjorn Helgaas
From: Jubin Zhong <zhongjubin@huawei.com>
commit 4684709bf81a2d98152ed6b610e3d5c403f9bced upstream.
If kobject_init_and_add() fails, pci_slot_release() is called to delete
slot->list from parent->slots. But slot->list hasn't been initialized
yet, so we dereference a NULL pointer:
Unable to handle kernel NULL pointer dereference at virtual address
00000000
...
CPU: 10 PID: 1 Comm: swapper/0 Not tainted 4.4.240 #197
task: ffffeb398a45ef10 task.stack: ffffeb398a470000
PC is at __list_del_entry_valid+0x5c/0xb0
LR is at pci_slot_release+0x84/0xe4
...
__list_del_entry_valid+0x5c/0xb0
pci_slot_release+0x84/0xe4
kobject_put+0x184/0x1c4
pci_create_slot+0x17c/0x1b4
__pci_hp_initialize+0x68/0xa4
pciehp_probe+0x1a4/0x2fc
pcie_port_probe_service+0x58/0x84
driver_probe_device+0x320/0x470
Initialize slot->list before calling kobject_init_and_add() to avoid this.
Fixes: 8a94644b440e ("PCI: Fix pci_create_slot() reference count leak")
Link: https://lore.kernel.org/r/1606876422-117457-1-git-send-email-zhongjubin@huawei.com
Signed-off-by: Jubin Zhong <zhongjubin@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # v5.9+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/slot.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -307,6 +307,9 @@ placeholder:
goto err;
}
+ INIT_LIST_HEAD(&slot->list);
+ list_add(&slot->list, &parent->slots);
+
err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
"%s", slot_name);
if (err) {
@@ -314,9 +317,6 @@ placeholder:
goto err;
}
- INIT_LIST_HEAD(&slot->list);
- list_add(&slot->list, &parent->slots);
-
down_read(&pci_bus_sem);
list_for_each_entry(dev, &parent->devices, bus_list)
if (PCI_SLOT(dev->devfn) == slot_nr)
^ permalink raw reply [flat|nested] 245+ messages in thread* Re: [PATCH 4.14 000/242] 4.14.213-rc1 review
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2020-12-28 12:50 ` [PATCH 4.14 242/242] PCI: Fix pci_slot_release() NULL pointer dereference Greg Kroah-Hartman
@ 2020-12-28 20:25 ` Guenter Roeck
2020-12-29 8:59 ` Naresh Kamboju
242 siblings, 0 replies; 245+ messages in thread
From: Guenter Roeck @ 2020-12-28 20:25 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel, stable
On Mon, Dec 28, 2020 at 01:46:45PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.14.213 release.
> There are 242 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 168 pass: 168 fail: 0
Qemu test results:
total: 404 pass: 404 fail: 0
Tested-by: Guenter Roeck <linux@roeck-us.net>
Guenter
^ permalink raw reply [flat|nested] 245+ messages in thread* Re: [PATCH 4.14 000/242] 4.14.213-rc1 review
2020-12-28 12:46 [PATCH 4.14 000/242] 4.14.213-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2020-12-28 20:25 ` [PATCH 4.14 000/242] 4.14.213-rc1 review Guenter Roeck
@ 2020-12-29 8:59 ` Naresh Kamboju
242 siblings, 0 replies; 245+ messages in thread
From: Naresh Kamboju @ 2020-12-29 8:59 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: open list, Shuah Khan, patches, lkft-triage, linux-stable, pavel,
Andrew Morton, Linus Torvalds, Guenter Roeck
On Mon, 28 Dec 2020 at 18:38, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 4.14.213 release.
> There are 242 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 30 Dec 2020 12:48:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.213-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Summary
------------------------------------------------------------------------
kernel: 4.14.213-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: caadb02efa3e1be5616bc1cae5b2a4a628b4730c
git describe: v4.14.212-243-gcaadb02efa3e
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.14.y/build/v4.14.212-243-gcaadb02efa3e
No regressions (compared to build v4.14.212)
No fixes (compared to build v4.14.212)
Ran 38814 total tests in the following environments and test suites.
Environments
--------------
- arm
- arm64
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- mips
- qemu-arm64-kasan
- qemu-x86_64-kasan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- sparc
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* linux-log-parser
* install-android-platform-tools-r2600
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-securebits-tests
* perf
* fwts
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fs-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-sched-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* ltp-controllers-tests
* ltp-open-posix-tests
* v4l2-compliance
* kvm-unit-tests
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 245+ messages in thread