* [PATCH 4.4 01/93] HID: make arrays usage and value to be the same
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 02/93] usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable Greg Kroah-Hartman
` (95 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Will McVicker, Jiri Kosina
From: Will McVicker <willmcvicker@google.com>
commit ed9be64eefe26d7d8b0b5b9fa3ffdf425d87a01f upstream.
The HID subsystem allows an "HID report field" to have a different
number of "values" and "usages" when it is allocated. When a field
struct is created, the size of the usage array is guaranteed to be at
least as large as the values array, but it may be larger. This leads to
a potential out-of-bounds write in
__hidinput_change_resolution_multipliers() and an out-of-bounds read in
hidinput_count_leds().
To fix this, let's make sure that both the usage and value arrays are
the same size.
Cc: stable@vger.kernel.org
Signed-off-by: Will McVicker <willmcvicker@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -91,7 +91,7 @@ EXPORT_SYMBOL_GPL(hid_register_report);
* Register a new field for this report.
*/
-static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values)
+static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages)
{
struct hid_field *field;
@@ -102,7 +102,7 @@ static struct hid_field *hid_register_fi
field = kzalloc((sizeof(struct hid_field) +
usages * sizeof(struct hid_usage) +
- values * sizeof(unsigned)), GFP_KERNEL);
+ usages * sizeof(unsigned)), GFP_KERNEL);
if (!field)
return NULL;
@@ -281,7 +281,7 @@ static int hid_add_field(struct hid_pars
usages = max_t(unsigned, parser->local.usage_index,
parser->global.report_count);
- field = hid_register_field(report, usages, parser->global.report_count);
+ field = hid_register_field(report, usages);
if (!field)
return 0;
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 02/93] usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 01/93] HID: make arrays usage and value to be the same Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 03/93] xen-netback: delete NAPI instance when queue fails to initialize Greg Kroah-Hartman
` (94 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Ursella
From: Stefan Ursella <stefan.ursella@wolfvision.net>
commit 1ebe718bb48278105816ba03a0408ecc2d6cf47f upstream.
Without this quirk starting a video capture from the device often fails with
kernel: uvcvideo: Failed to set UVC probe control : -110 (exp. 34).
Signed-off-by: Stefan Ursella <stefan.ursella@wolfvision.net>
Link: https://lore.kernel.org/r/20210210140713.18711-1-stefan.ursella@wolfvision.net
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -230,6 +230,9 @@ static const struct usb_device_id usb_qu
/* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
{ USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
+ /* ELMO L-12F document camera */
+ { USB_DEVICE(0x09a1, 0x0028), .driver_info = USB_QUIRK_DELAY_CTRL_MSG },
+
/* Broadcom BCM92035DGROM BT dongle */
{ USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 03/93] xen-netback: delete NAPI instance when queue fails to initialize
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 01/93] HID: make arrays usage and value to be the same Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 02/93] usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 04/93] ntfs: check for valid standard information attribute Greg Kroah-Hartman
` (93 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Vrabel, David S. Miller,
SeongJae Park, Markus Boehme
From: David Vrabel <david.vrabel@citrix.com>
commit 4a658527271bce43afb1cf4feec89afe6716ca59 upstream.
When xenvif_connect() fails it may leave a stale NAPI instance added to
the device. Make sure we delete it in the error path.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: SeongJae Park <sjpark@amazon.com>
Tested-by: Markus Boehme <markubo@amazon.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/xen-netback/interface.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -662,6 +662,7 @@ err_tx_unbind:
queue->tx_irq = 0;
err_unmap:
xenvif_unmap_frontend_rings(queue);
+ netif_napi_del(&queue->napi);
err:
return err;
}
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 04/93] ntfs: check for valid standard information attribute
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 03/93] xen-netback: delete NAPI instance when queue fails to initialize Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 05/93] igb: Remove incorrect "unexpected SYS WRAP" log message Greg Kroah-Hartman
` (92 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rustam Kovhaev,
syzbot+c584225dabdea2f71969, Anton Altaparmakov, Andrew Morton,
Linus Torvalds
From: Rustam Kovhaev <rkovhaev@gmail.com>
commit 4dfe6bd94959222e18d512bdf15f6bf9edb9c27c upstream.
Mounting a corrupted filesystem with NTFS resulted in a kernel crash.
We should check for valid STANDARD_INFORMATION attribute offset and length
before trying to access it
Link: https://lkml.kernel.org/r/20210217155930.1506815-1-rkovhaev@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=c584225dabdea2f71969
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Reported-by: syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com
Tested-by: syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -661,6 +661,12 @@ static int ntfs_read_locked_inode(struct
}
a = ctx->attr;
/* Get the standard information attribute value. */
+ if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset)
+ + le32_to_cpu(a->data.resident.value_length) >
+ (u8 *)ctx->mrec + vol->mft_record_size) {
+ ntfs_error(vi->i_sb, "Corrupt standard information attribute in inode.");
+ goto unm_err_out;
+ }
si = (STANDARD_INFORMATION*)((u8*)a +
le16_to_cpu(a->data.resident.value_offset));
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 05/93] igb: Remove incorrect "unexpected SYS WRAP" log message
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 04/93] ntfs: check for valid standard information attribute Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 06/93] scripts/recordmcount.pl: support big endian for ARCH sh Greg Kroah-Hartman
` (91 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Corinna Vinschen, Jacob Keller,
Aaron Brown, Jeff Kirsher, Punit Agrawal
From: Corinna Vinschen <vinschen@redhat.com>
commit 2643e6e90210e16c978919617170089b7c2164f7 upstream.
TSAUXC.DisableSystime is never set, so SYSTIM runs into a SYS WRAP
every 1100 secs on 80580/i350/i354 (40 bit SYSTIM) and every 35000
secs on 80576 (45 bit SYSTIM).
This wrap event sets the TSICR.SysWrap bit unconditionally.
However, checking TSIM at interrupt time shows that this event does not
actually cause the interrupt. Rather, it's just bycatch while the
actual interrupt is caused by, for instance, TSICR.TXTS.
The conclusion is that the SYS WRAP is actually expected, so the
"unexpected SYS WRAP" message is entirely bogus and just helps to
confuse users. Drop it.
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
Acked-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Cc: Punit Agrawal <punit1.agrawal@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/igb/igb_main.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -5421,8 +5421,6 @@ static void igb_tsync_interrupt(struct i
event.type = PTP_CLOCK_PPS;
if (adapter->ptp_caps.pps)
ptp_clock_event(adapter->ptp_clock, &event);
- else
- dev_err(&adapter->pdev->dev, "unexpected SYS WRAP");
ack |= TSINTR_SYS_WRAP;
}
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 06/93] scripts/recordmcount.pl: support big endian for ARCH sh
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 05/93] igb: Remove incorrect "unexpected SYS WRAP" log message Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 07/93] kdb: Make memory allocations more robust Greg Kroah-Hartman
` (90 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rong Chen, kernel test robot,
Yoshinori Sato, Rich Felker, Andrew Morton, Linus Torvalds,
Sasha Levin
From: Rong Chen <rong.a.chen@intel.com>
[ Upstream commit 93ca696376dd3d44b9e5eae835ffbc84772023ec ]
The kernel test robot reported the following issue:
CC [M] drivers/soc/litex/litex_soc_ctrl.o
sh4-linux-objcopy: Unable to change endianness of input file(s)
sh4-linux-ld: cannot find drivers/soc/litex/.tmp_gl_litex_soc_ctrl.o: No such file or directory
sh4-linux-objcopy: 'drivers/soc/litex/.tmp_mx_litex_soc_ctrl.o': No such file
The problem is that the format of input file is elf32-shbig-linux, but
sh4-linux-objcopy wants to output a file which format is elf32-sh-linux:
$ sh4-linux-objdump -d drivers/soc/litex/litex_soc_ctrl.o | grep format
drivers/soc/litex/litex_soc_ctrl.o: file format elf32-shbig-linux
Link: https://lkml.kernel.org/r/20210210150435.2171567-1-rong.a.chen@intel.com
Link: https://lore.kernel.org/linux-mm/202101261118.GbbYSlHu-lkp@intel.com
Signed-off-by: Rong Chen <rong.a.chen@intel.com>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Yoshinori Sato <ysato@users.osdn.me>
Cc: Rich Felker <dalias@libc.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/recordmcount.pl | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index 96e2486a6fc47..ccd6614ea2182 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -259,7 +259,11 @@ if ($arch eq "x86_64") {
# force flags for this arch
$ld .= " -m shlelf_linux";
- $objcopy .= " -O elf32-sh-linux";
+ if ($endian eq "big") {
+ $objcopy .= " -O elf32-shbig-linux";
+ } else {
+ $objcopy .= " -O elf32-sh-linux";
+ }
} elsif ($arch eq "powerpc") {
$local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)";
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 07/93] kdb: Make memory allocations more robust
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 06/93] scripts/recordmcount.pl: support big endian for ARCH sh Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 08/93] MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section Greg Kroah-Hartman
` (89 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sumit Garg, Daniel Thompson
From: Sumit Garg <sumit.garg@linaro.org>
commit 93f7a6d818deef69d0ba652d46bae6fbabbf365c upstream.
Currently kdb uses in_interrupt() to determine whether its library
code has been called from the kgdb trap handler or from a saner calling
context such as driver init. This approach is broken because
in_interrupt() alone isn't able to determine kgdb trap handler entry from
normal task context. This can happen during normal use of basic features
such as breakpoints and can also be trivially reproduced using:
echo g > /proc/sysrq-trigger
We can improve this by adding check for in_dbg_master() instead which
explicitly determines if we are running in debugger context.
Cc: stable@vger.kernel.org
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Link: https://lore.kernel.org/r/1611313556-4004-1-git-send-email-sumit.garg@linaro.org
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/debug/kdb/kdb_private.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/debug/kdb/kdb_private.h
+++ b/kernel/debug/kdb/kdb_private.h
@@ -234,7 +234,7 @@ extern struct task_struct *kdb_curr_task
#define kdb_do_each_thread(g, p) do_each_thread(g, p)
#define kdb_while_each_thread(g, p) while_each_thread(g, p)
-#define GFP_KDB (in_interrupt() ? GFP_ATOMIC : GFP_KERNEL)
+#define GFP_KDB (in_dbg_master() ? GFP_ATOMIC : GFP_KERNEL)
extern void *debug_kmalloc(size_t size, gfp_t flags);
extern void debug_kfree(void *);
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 08/93] MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 07/93] kdb: Make memory allocations more robust Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 09/93] Bluetooth: Fix initializing response id after clearing struct Greg Kroah-Hartman
` (88 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Lobakin, Kees Cook,
Nathan Chancellor, Thomas Bogendoerfer
From: Alexander Lobakin <alobakin@pm.me>
commit 8ac7c87acdcac156670f9920c8acbd84308ff4b1 upstream.
MIPS uses its own declaration of rwdata, and thus it should be kept
in sync with the asm-generic one. Currently PAGE_ALIGNED_DATA() is
missing from the linker script, which emits the following ld
warnings:
mips-alpine-linux-musl-ld: warning: orphan section
`.data..page_aligned' from `arch/mips/kernel/vdso.o' being placed
in section `.data..page_aligned'
mips-alpine-linux-musl-ld: warning: orphan section
`.data..page_aligned' from `arch/mips/vdso/vdso-image.o' being placed
in section `.data..page_aligned'
Add the necessary declaration, so the mentioned structures will be
placed in vmlinux as intended:
ffffffff80630580 D __end_once
ffffffff80630580 D __start___dyndbg
ffffffff80630580 D __start_once
ffffffff80630580 D __stop___dyndbg
ffffffff80634000 d mips_vdso_data
ffffffff80638000 d vdso_data
ffffffff80638580 D _gp
ffffffff8063c000 T __init_begin
ffffffff8063c000 D _edata
ffffffff8063c000 T _sinittext
->
ffffffff805a4000 D __end_init_task
ffffffff805a4000 D __nosave_begin
ffffffff805a4000 D __nosave_end
ffffffff805a4000 d mips_vdso_data
ffffffff805a8000 d vdso_data
ffffffff805ac000 D mmlist_lock
ffffffff805ac080 D tasklist_lock
Fixes: ebb5e78cc634 ("MIPS: Initial implementation of a VDSO")
Signed-off-by: Alexander Lobakin <alobakin@pm.me>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Cc: stable@vger.kernel.org # 4.4+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/vmlinux.lds.S | 1 +
1 file changed, 1 insertion(+)
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -90,6 +90,7 @@ SECTIONS
INIT_TASK_DATA(THREAD_SIZE)
NOSAVE_DATA
+ PAGE_ALIGNED_DATA(PAGE_SIZE)
CACHELINE_ALIGNED_DATA(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
READ_MOSTLY_DATA(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
DATA_DATA
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 09/93] Bluetooth: Fix initializing response id after clearing struct
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 08/93] MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 10/93] ARM: dts: exynos: correct PMIC interrupt trigger level on Spring Greg Kroah-Hartman
` (87 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christopher William Snowhill,
Marcel Holtmann, Sasha Levin
From: Christopher William Snowhill <chris@kode54.net>
[ Upstream commit a5687c644015a097304a2e47476c0ecab2065734 ]
Looks like this was missed when patching the source to clear the structures
throughout, causing this one instance to clear the struct after the response
id is assigned.
Fixes: eddb7732119d ("Bluetooth: A2MP: Fix not initializing all members")
Signed-off-by: Christopher William Snowhill <chris@kode54.net>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/a2mp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index 8f918155685db..242ef2abd0911 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -388,9 +388,9 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
hdev = hci_dev_get(req->id);
if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) {
struct a2mp_amp_assoc_rsp rsp;
- rsp.id = req->id;
memset(&rsp, 0, sizeof(rsp));
+ rsp.id = req->id;
if (tmp) {
rsp.status = A2MP_STATUS_COLLISION_OCCURED;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 10/93] ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 09/93] Bluetooth: Fix initializing response id after clearing struct Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 11/93] ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa Greg Kroah-Hartman
` (86 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Sasha Levin
From: Krzysztof Kozlowski <krzk@kernel.org>
[ Upstream commit 77e6a5467cb8657cf8b5e610a30a4c502085e4f9 ]
The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU. Without specifying the
interrupt type in Devicetree, kernel might apply some fixed
configuration, not necessarily working for this hardware.
Fixes: 53dd4138bb0a ("ARM: dts: Add exynos5250-spring device tree")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201210212903.216728-4-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/exynos5250-spring.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/exynos5250-spring.dts b/arch/arm/boot/dts/exynos5250-spring.dts
index c1edd6d038a90..4b3bd43f77213 100644
--- a/arch/arm/boot/dts/exynos5250-spring.dts
+++ b/arch/arm/boot/dts/exynos5250-spring.dts
@@ -112,7 +112,7 @@
compatible = "samsung,s5m8767-pmic";
reg = <0x66>;
interrupt-parent = <&gpx3>;
- interrupts = <2 IRQ_TYPE_NONE>;
+ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
pinctrl-names = "default";
pinctrl-0 = <&s5m8767_irq &s5m8767_dvs &s5m8767_ds>;
wakeup-source;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 11/93] ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 10/93] ARM: dts: exynos: correct PMIC interrupt trigger level on Spring Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 12/93] Bluetooth: drop HCI device reference before return Greg Kroah-Hartman
` (85 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
Marek Szyprowski, Sasha Levin
From: Krzysztof Kozlowski <krzk@kernel.org>
[ Upstream commit 1ac8893c4fa3d4a34915dc5cdab568a39db5086c ]
The Samsung PMIC datasheets describe the interrupt line as active low
with a requirement of acknowledge from the CPU. The falling edge
interrupt will mostly work but it's not correct.
Fixes: 1fed2252713e ("ARM: dts: fix pinctrl for s2mps11-irq on exynos5420-arndale-octa")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20201210212903.216728-5-krzk@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
index b54c0b8a5b346..5cf9bcc91c4ab 100644
--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
@@ -75,7 +75,7 @@
s2mps11,buck4-ramp-enable = <1>;
interrupt-parent = <&gpx3>;
- interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
+ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
pinctrl-names = "default";
pinctrl-0 = <&s2mps11_irq>;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 12/93] Bluetooth: drop HCI device reference before return
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 11/93] ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 13/93] Bluetooth: Put HCI device if inquiry procedure interrupts Greg Kroah-Hartman
` (84 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pan Bian, Marcel Holtmann, Sasha Levin
From: Pan Bian <bianpan2016@163.com>
[ Upstream commit 5a3ef03afe7e12982dc3b978f4c5077c907f7501 ]
Call hci_dev_put() to decrement reference count of HCI device hdev if
fails to duplicate memory.
Fixes: 0b26ab9dce74 ("Bluetooth: AMP: Handle Accept phylink command status evt")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/a2mp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index 242ef2abd0911..fcd819ffda108 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -519,6 +519,7 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL);
if (!assoc) {
amp_ctrl_put(ctrl);
+ hci_dev_put(hdev);
return -ENOMEM;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 13/93] Bluetooth: Put HCI device if inquiry procedure interrupts
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 12/93] Bluetooth: drop HCI device reference before return Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 14/93] usb: dwc2: Abort transaction after errors with unknown reason Greg Kroah-Hartman
` (83 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pan Bian, Marcel Holtmann, Sasha Levin
From: Pan Bian <bianpan2016@163.com>
[ Upstream commit 28a758c861ff290e39d4f1ee0aa5df0f0b9a45ee ]
Jump to the label done to decrement the reference count of HCI device
hdev on path that the Inquiry procedure is interrupted.
Fixes: 3e13fa1e1fab ("Bluetooth: Fix hci_inquiry ioctl usage")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 4bce3ef2c392a..cc905a4e57325 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1372,8 +1372,10 @@ int hci_inquiry(void __user *arg)
* cleared). If it is interrupted by a signal, return -EINTR.
*/
if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
- TASK_INTERRUPTIBLE))
- return -EINTR;
+ TASK_INTERRUPTIBLE)) {
+ err = -EINTR;
+ goto done;
+ }
}
/* for unlimited number of responses we will use buffer with
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 14/93] usb: dwc2: Abort transaction after errors with unknown reason
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 13/93] Bluetooth: Put HCI device if inquiry procedure interrupts Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 15/93] usb: dwc2: Make "trimming xfer length" a debug message Greg Kroah-Hartman
` (82 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Boris ARZUR, Douglas Anderson,
Nicolas Saenz Julienne, Guenter Roeck, Sasha Levin
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit f74b68c61cbc4b2245022fcce038509333d63f6f ]
In some situations, the following error messages are reported.
dwc2 ff540000.usb: dwc2_hc_chhltd_intr_dma: Channel 1 - ChHltd set, but reason is unknown
dwc2 ff540000.usb: hcint 0x00000002, intsts 0x04000021
This is sometimes followed by:
dwc2 ff540000.usb: dwc2_update_urb_state_abn(): trimming xfer length
and then:
WARNING: CPU: 0 PID: 0 at kernel/v4.19/drivers/usb/dwc2/hcd.c:2913
dwc2_assign_and_init_hc+0x98c/0x990
The warning suggests that an odd buffer address is to be used for DMA.
After an error is observed, the receive buffer may be full
(urb->actual_length >= urb->length). However, the urb is still left in
the queue unless three errors were observed in a row. When it is queued
again, the dwc2 hcd code translates this into a 1-block transfer.
If urb->actual_length (ie the total expected receive length) is not
DMA-aligned, the buffer pointer programmed into the chip will be
unaligned. This results in the observed warning.
To solve the problem, abort input transactions after an error with
unknown cause if the entire packet was already received. This may be
a bit drastic, but we don't really know why the transfer was aborted
even though the entire packet was received. Aborting the transfer in
this situation is less risky than accepting a potentially corrupted
packet.
With this patch in place, the 'ChHltd set' and 'trimming xfer length'
messages are still observed, but there are no more transfer attempts
with odd buffer addresses.
Fixes: 151d0cbdbe860 ("usb: dwc2: make the scheduler handle excessive NAKs better")
Cc: Boris ARZUR <boris@konbu.org>
Cc: Douglas Anderson <dianders@chromium.org>
Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Link: https://lore.kernel.org/r/20210113112052.17063-3-nsaenzjulienne@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc2/hcd_intr.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index 51866f3f20522..84487548918f9 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -1915,6 +1915,18 @@ error:
qtd->error_count++;
dwc2_update_urb_state_abn(hsotg, chan, chnum, qtd->urb,
qtd, DWC2_HC_XFER_XACT_ERR);
+ /*
+ * We can get here after a completed transaction
+ * (urb->actual_length >= urb->length) which was not reported
+ * as completed. If that is the case, and we do not abort
+ * the transfer, a transfer of size 0 will be enqueued
+ * subsequently. If urb->actual_length is not DMA-aligned,
+ * the buffer will then point to an unaligned address, and
+ * the resulting behavior is undefined. Bail out in that
+ * situation.
+ */
+ if (qtd->urb->actual_length >= qtd->urb->length)
+ qtd->error_count = 3;
dwc2_hcd_save_data_toggle(hsotg, chan, chnum, qtd);
dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_XACT_ERR);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 15/93] usb: dwc2: Make "trimming xfer length" a debug message
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 14/93] usb: dwc2: Abort transaction after errors with unknown reason Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 16/93] ARM: s3c: fix fiq for clang IAS Greg Kroah-Hartman
` (81 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicolas Saenz Julienne,
Douglas Anderson, Guenter Roeck, Sasha Levin
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit 1a9e38cabd80356ffb98c2c88fec528ea9644fd5 ]
With some USB network adapters, such as DM96xx, the following message
is seen for each maximum size receive packet.
dwc2 ff540000.usb: dwc2_update_urb_state(): trimming xfer length
This happens because the packet size requested by the driver is 1522
bytes, wMaxPacketSize is 64, the dwc2 driver configures the chip to
receive 24*64 = 1536 bytes, and the chip does indeed send more than
1522 bytes of data. Since the event does not indicate an error condition,
the message is just noise. Demote it to debug level.
Fixes: 7359d482eb4d3 ("staging: HCD files for the DWC2 driver")
Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Link: https://lore.kernel.org/r/20210113112052.17063-4-nsaenzjulienne@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc2/hcd_intr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index 84487548918f9..9c030e0033fe9 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -461,7 +461,7 @@ static int dwc2_update_urb_state(struct dwc2_hsotg *hsotg,
&short_read);
if (urb->actual_length + xfer_length > urb->length) {
- dev_warn(hsotg->dev, "%s(): trimming xfer length\n", __func__);
+ dev_dbg(hsotg->dev, "%s(): trimming xfer length\n", __func__);
xfer_length = urb->length - urb->actual_length;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 16/93] ARM: s3c: fix fiq for clang IAS
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 15/93] usb: dwc2: Make "trimming xfer length" a debug message Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 17/93] bnxt_en: reverse order of TX disable and carrier off Greg Kroah-Hartman
` (80 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Agner, Arnd Bergmann,
Nick Desaulniers, Nathan Chancellor, Krzysztof Kozlowski,
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 7f9942c61fa60eda7cc8e42f04bd25b7d175876e ]
Building with the clang integrated assembler produces a couple of
errors for the s3c24xx fiq support:
arch/arm/mach-s3c/irq-s3c24xx-fiq.S:52:2: error: instruction 'subne' can not set flags, but 's' suffix specified
subnes pc, lr, #4 @@ return, still have work to do
arch/arm/mach-s3c/irq-s3c24xx-fiq.S:64:1: error: invalid symbol redefinition
s3c24xx_spi_fiq_txrx:
There are apparently two problems: one with extraneous or duplicate
labels, and one with old-style opcode mnemonics. Stefan Agner has
previously fixed other problems like this, but missed this particular
file.
Fixes: bec0806cfec6 ("spi_s3c24xx: add FIQ pseudo-DMA support")
Cc: Stefan Agner <stefan@agner.ch>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20210204162416.3030114-1-arnd@kernel.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-s3c24xx-fiq.S | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/spi/spi-s3c24xx-fiq.S b/drivers/spi/spi-s3c24xx-fiq.S
index 059f2dc1fda2d..1565c792da079 100644
--- a/drivers/spi/spi-s3c24xx-fiq.S
+++ b/drivers/spi/spi-s3c24xx-fiq.S
@@ -36,7 +36,6 @@
@ and an offset to the irq acknowledgment word
ENTRY(s3c24xx_spi_fiq_rx)
-s3c24xx_spi_fix_rx:
.word fiq_rx_end - fiq_rx_start
.word fiq_rx_irq_ack - fiq_rx_start
fiq_rx_start:
@@ -50,7 +49,7 @@ fiq_rx_start:
strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
subs fiq_rcount, fiq_rcount, #1
- subnes pc, lr, #4 @@ return, still have work to do
+ subsne pc, lr, #4 @@ return, still have work to do
@@ set IRQ controller so that next op will trigger IRQ
mov fiq_rtmp, #0
@@ -62,7 +61,6 @@ fiq_rx_irq_ack:
fiq_rx_end:
ENTRY(s3c24xx_spi_fiq_txrx)
-s3c24xx_spi_fiq_txrx:
.word fiq_txrx_end - fiq_txrx_start
.word fiq_txrx_irq_ack - fiq_txrx_start
fiq_txrx_start:
@@ -77,7 +75,7 @@ fiq_txrx_start:
strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
subs fiq_rcount, fiq_rcount, #1
- subnes pc, lr, #4 @@ return, still have work to do
+ subsne pc, lr, #4 @@ return, still have work to do
mov fiq_rtmp, #0
str fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD - S3C24XX_VA_IRQ ]
@@ -89,7 +87,6 @@ fiq_txrx_irq_ack:
fiq_txrx_end:
ENTRY(s3c24xx_spi_fiq_tx)
-s3c24xx_spi_fix_tx:
.word fiq_tx_end - fiq_tx_start
.word fiq_tx_irq_ack - fiq_tx_start
fiq_tx_start:
@@ -102,7 +99,7 @@ fiq_tx_start:
strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
subs fiq_rcount, fiq_rcount, #1
- subnes pc, lr, #4 @@ return, still have work to do
+ subsne pc, lr, #4 @@ return, still have work to do
mov fiq_rtmp, #0
str fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD - S3C24XX_VA_IRQ ]
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 17/93] bnxt_en: reverse order of TX disable and carrier off
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 16/93] ARM: s3c: fix fiq for clang IAS Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 18/93] xen/netback: fix spurious event detection for common event case Greg Kroah-Hartman
` (79 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Edwin Peer, Michael Chan,
David S. Miller, Sasha Levin
From: Edwin Peer <edwin.peer@broadcom.com>
[ Upstream commit 132e0b65dc2b8bfa9721bfce834191f24fd1d7ed ]
A TX queue can potentially immediately timeout after it is stopped
and the last TX timestamp on that queue was more than 5 seconds ago with
carrier still up. Prevent these intermittent false TX timeouts
by bringing down carrier first before calling netif_tx_disable().
Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 250ecbcca019f..7444f17b9e050 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4313,9 +4313,10 @@ static void bnxt_tx_disable(struct bnxt *bp)
txr->dev_state = BNXT_DEV_STATE_CLOSING;
}
}
+ /* Drop carrier first to prevent TX timeout */
+ netif_carrier_off(bp->dev);
/* Stop all TX queues */
netif_tx_disable(bp->dev);
- netif_carrier_off(bp->dev);
}
static void bnxt_tx_enable(struct bnxt *bp)
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 18/93] xen/netback: fix spurious event detection for common event case
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 17/93] bnxt_en: reverse order of TX disable and carrier off Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 19/93] b43: N-PHY: Fix the update of coef for the PHY revision >= 3case Greg Kroah-Hartman
` (78 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Juergen Gross, Jan Beulich,
Paul Durrant, Wei Liu, David S. Miller, Sasha Levin
From: Juergen Gross <jgross@suse.com>
[ Upstream commit a3daf3d39132b405781be8d9ede0c449b244b64e ]
In case of a common event for rx and tx queue the event should be
regarded to be spurious if no rx and no tx requests are pending.
Unfortunately the condition for testing that is wrong causing to
decide a event being spurious if no rx OR no tx requests are
pending.
Fix that plus using local variables for rx/tx pending indicators in
order to split function calls and if condition.
Fixes: 23025393dbeb3b ("xen/netback: use lateeoi irq binding")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Reviewed-by: Wei Liu <wl@xen.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/xen-netback/interface.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index f9f4391ecee37..93f7659e75954 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -161,13 +161,15 @@ irqreturn_t xenvif_interrupt(int irq, void *dev_id)
{
struct xenvif_queue *queue = dev_id;
int old;
+ bool has_rx, has_tx;
old = xenvif_atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending);
WARN(old, "Interrupt while EOI pending\n");
- /* Use bitwise or as we need to call both functions. */
- if ((!xenvif_handle_tx_interrupt(queue) |
- !xenvif_handle_rx_interrupt(queue))) {
+ has_tx = xenvif_handle_tx_interrupt(queue);
+ has_rx = xenvif_handle_rx_interrupt(queue);
+
+ if (!has_rx && !has_tx) {
atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending);
xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 19/93] b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 18/93] xen/netback: fix spurious event detection for common event case Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 20/93] fbdev: aty: SPARC64 requires FB_ATY_CT Greg Kroah-Hartman
` (77 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Larry Finger,
David S. Miller, Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 4773acf3d4b50768bf08e9e97a204819e9ea0895 ]
The documentation for the PHY update [1] states:
Loop 4 times with index i
If PHY Revision >= 3
Copy table[i] to coef[i]
Otherwise
Set coef[i] to 0
the copy of the table to coef is currently implemented the wrong way
around, table is being updated from uninitialized values in coeff.
Fix this by swapping the assignment around.
[1] https://bcm-v4.sipsolutions.net/802.11/PHY/N/RestoreCal/
Fixes: 2f258b74d13c ("b43: N-PHY: implement restoring general configuration")
Addresses-Coverity: ("Uninitialized scalar variable")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/b43/phy_n.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 9f0bcf3b8414c..fa847ae5b5270 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -5320,7 +5320,7 @@ static void b43_nphy_restore_cal(struct b43_wldev *dev)
for (i = 0; i < 4; i++) {
if (dev->phy.rev >= 3)
- table[i] = coef[i];
+ coef[i] = table[i];
else
coef[i] = 0;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 20/93] fbdev: aty: SPARC64 requires FB_ATY_CT
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 19/93] b43: N-PHY: Fix the update of coef for the PHY revision >= 3case Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 21/93] drm/gma500: Fix error return code in psb_driver_load() Greg Kroah-Hartman
` (76 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Randy Dunlap,
David S. Miller, sparclinux, Tomi Valkeinen, dri-devel,
linux-fbdev, Daniel Vetter, David Airlie,
Bartlomiej Zolnierkiewicz, Geert Uytterhoeven, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit c6c90c70db4d9a0989111d6b994d545659410f7a ]
It looks like SPARC64 requires FB_ATY_CT to build without errors,
so have FB_ATY select FB_ATY_CT if both SPARC64 and PCI are enabled
instead of using "default y if SPARC64 && PCI", which is not strong
enough to prevent build errors.
As it currently is, FB_ATY_CT can be disabled, resulting in build
errors:
ERROR: modpost: "aty_postdividers" [drivers/video/fbdev/aty/atyfb.ko] undefined!
ERROR: modpost: "aty_ld_pll_ct" [drivers/video/fbdev/aty/atyfb.ko] undefined!
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Fixes: f7018c213502 ("video: move fbdev to drivers/video/fbdev")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: sparclinux@vger.kernel.org
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-fbdev@vger.kernel.org
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: David Airlie <airlied@linux.ie>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201127031752.10371-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index 6873be0344486..e24e77e31529e 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -1397,6 +1397,7 @@ config FB_ATY
select FB_CFB_IMAGEBLIT
select FB_BACKLIGHT if FB_ATY_BACKLIGHT
select FB_MACMODES if PPC
+ select FB_ATY_CT if SPARC64 && PCI
help
This driver supports graphics boards with the ATI Mach64 chips.
Say Y if you have such a graphics board.
@@ -1407,7 +1408,6 @@ config FB_ATY
config FB_ATY_CT
bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support"
depends on PCI && FB_ATY
- default y if SPARC64 && PCI
help
Say Y here to support use of ATI's 64-bit Rage boards (or other
boards based on the Mach64 CT, VT, GT, and LT chipsets) as a
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 21/93] drm/gma500: Fix error return code in psb_driver_load()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 20/93] fbdev: aty: SPARC64 requires FB_ATY_CT Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 22/93] gma500: clean up error handling in init Greg Kroah-Hartman
` (75 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Jialin Zhang,
Daniel Vetter, Sasha Levin
From: Jialin Zhang <zhangjialin11@huawei.com>
[ Upstream commit 6926872ae24452d4f2176a3ba2dee659497de2c4 ]
Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.
Fixes: 5c49fd3aa0ab ("gma500: Add the core DRM files and headers")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20201130020216.1906141-1-zhangjialin11@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/gma500/psb_drv.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index db98ab5cde3d8..15a909efe0c70 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -325,6 +325,8 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
if (ret)
goto out_err;
+ ret = -ENOMEM;
+
dev_priv->mmu = psb_mmu_driver_init(dev, 1, 0, 0);
if (!dev_priv->mmu)
goto out_err;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 22/93] gma500: clean up error handling in init
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 21/93] drm/gma500: Fix error return code in psb_driver_load() Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 23/93] MIPS: c-r4k: Fix section mismatch for loongson2_sc_init Greg Kroah-Hartman
` (74 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Patrik Jakobsson, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 15ccc39b3aab667c6fa131206f01f31bfbccdf6a ]
The main problem with this error handling was that it didn't clean up if
i2c_add_numbered_adapter() failed. This code is pretty old, and doesn't
match with today's checkpatch.pl standards so I took the opportunity to
tidy it up a bit. I changed the NULL comparison, and removed the
WARNING message if kzalloc() fails and updated the label names.
Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/X8ikkAqZfnDO2lu6@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
index e281070611480..fc9a34ed58bd1 100644
--- a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
+++ b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
@@ -279,11 +279,8 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
hdmi_dev = pci_get_drvdata(dev);
i2c_dev = kzalloc(sizeof(struct hdmi_i2c_dev), GFP_KERNEL);
- if (i2c_dev == NULL) {
- DRM_ERROR("Can't allocate interface\n");
- ret = -ENOMEM;
- goto exit;
- }
+ if (!i2c_dev)
+ return -ENOMEM;
i2c_dev->adap = &oaktrail_hdmi_i2c_adapter;
i2c_dev->status = I2C_STAT_INIT;
@@ -300,16 +297,23 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
oaktrail_hdmi_i2c_adapter.name, hdmi_dev);
if (ret) {
DRM_ERROR("Failed to request IRQ for I2C controller\n");
- goto err;
+ goto free_dev;
}
/* Adapter registration */
ret = i2c_add_numbered_adapter(&oaktrail_hdmi_i2c_adapter);
- return ret;
+ if (ret) {
+ DRM_ERROR("Failed to add I2C adapter\n");
+ goto free_irq;
+ }
-err:
+ return 0;
+
+free_irq:
+ free_irq(dev->irq, hdmi_dev);
+free_dev:
kfree(i2c_dev);
-exit:
+
return ret;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 23/93] MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 22/93] gma500: clean up error handling in init Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 24/93] MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0 Greg Kroah-Hartman
` (73 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Huacai Chen,
Thomas Bogendoerfer, Sasha Levin
From: Nathan Chancellor <natechancellor@gmail.com>
[ Upstream commit c58734eee6a2151ba033c0dcb31902c89e310374 ]
When building with clang, the following section mismatch warning occurs:
WARNING: modpost: vmlinux.o(.text+0x24490): Section mismatch in
reference from the function r4k_cache_init() to the function
.init.text:loongson2_sc_init()
This should have been fixed with commit ad4fddef5f23 ("mips: fix Section
mismatch in reference") but it was missed. Remove the improper __init
annotation like that commit did.
Fixes: 078a55fc824c ("MIPS: Delete __cpuinit/__CPUINIT usage from MIPS code")
Link: https://github.com/ClangBuiltLinux/linux/issues/787
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Reviewed-by: Huacai Chen <chenhuacai@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/mm/c-r4k.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 6c0147bd8e801..90f8d6d51f316 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -1401,7 +1401,7 @@ static int probe_scache(void)
return 1;
}
-static void __init loongson2_sc_init(void)
+static void loongson2_sc_init(void)
{
struct cpuinfo_mips *c = ¤t_cpu_data;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 24/93] MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 23/93] MIPS: c-r4k: Fix section mismatch for loongson2_sc_init Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 25/93] media: media/pci: Fix memleak in empress_init Greg Kroah-Hartman
` (72 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Golovin, Nathan Chancellor,
Thomas Bogendoerfer, Sasha Levin
From: Nathan Chancellor <natechancellor@gmail.com>
[ Upstream commit c6f2a9e17b9bef7677caddb1626c2402f3e9d2bd ]
When building xway_defconfig with clang:
arch/mips/lantiq/irq.c:305:48: error: use of logical '&&' with constant
operand [-Werror,-Wconstant-logical-operand]
if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
^ ~~~~~~~~~~~~~~~~~
arch/mips/lantiq/irq.c:305:48: note: use '&' for a bitwise operation
if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
^~
&
arch/mips/lantiq/irq.c:305:48: note: remove constant to silence this
warning
if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
~^~~~~~~~~~~~~~~~~~~~
1 error generated.
Explicitly compare the constant LTQ_EBU_PCC_ISTAT against 0 to fix the
warning. Additionally, remove the unnecessary parentheses as this is a
simple conditional statement and shorthand '== 0' to '!'.
Fixes: 3645da0276ae ("OF: MIPS: lantiq: implement irq_domain support")
Link: https://github.com/ClangBuiltLinux/linux/issues/807
Reported-by: Dmitry Golovin <dima@golovin.in>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/lantiq/irq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
index a7057a06c0961..5526b89a21a02 100644
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -245,7 +245,7 @@ static void ltq_hw_irqdispatch(int module)
do_IRQ((int)irq + MIPS_CPU_IRQ_CASCADE + (INT_NUM_IM_OFFSET * module));
/* if this is a EBU irq, we need to ack it or get a deadlock */
- if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
+ if (irq == LTQ_ICU_EBU_IRQ && !module && LTQ_EBU_PCC_ISTAT != 0)
ltq_ebu_w32(ltq_ebu_r32(LTQ_EBU_PCC_ISTAT) | 0x10,
LTQ_EBU_PCC_ISTAT);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 25/93] media: media/pci: Fix memleak in empress_init
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 24/93] MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0 Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 26/93] media: tm6000: Fix memleak in tm6000_start_stream Greg Kroah-Hartman
` (71 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
[ Upstream commit 15d0c52241ecb1c9d802506bff6f5c3f7872c0df ]
When vb2_queue_init() fails, dev->empress_dev
should be released just like other error handling
paths.
Fixes: 2ada815fc48bb ("[media] saa7134: convert to vb2")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/saa7134/saa7134-empress.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
index 56b932c97196d..ae3b96e9cff35 100644
--- a/drivers/media/pci/saa7134/saa7134-empress.c
+++ b/drivers/media/pci/saa7134/saa7134-empress.c
@@ -295,8 +295,11 @@ static int empress_init(struct saa7134_dev *dev)
q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
q->lock = &dev->lock;
err = vb2_queue_init(q);
- if (err)
+ if (err) {
+ video_device_release(dev->empress_dev);
+ dev->empress_dev = NULL;
return err;
+ }
dev->empress_dev->queue = q;
video_set_drvdata(dev->empress_dev, dev);
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 26/93] media: tm6000: Fix memleak in tm6000_start_stream
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 25/93] media: media/pci: Fix memleak in empress_init Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 27/93] ASoC: cs42l56: fix up error handling in probe Greg Kroah-Hartman
` (70 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dinghao Liu, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
[ Upstream commit 76aaf8a96771c16365b8510f1fb97738dc88026e ]
When usb_clear_halt() fails, dvb->bulk_urb->transfer_buffer
and dvb->bulk_urb should be freed just like when
usb_submit_urb() fails.
Fixes: 3169c9b26fffa ("V4L/DVB (12788): tm6000: Add initial DVB-T support")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/tm6000/tm6000-dvb.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c
index 87401b18d85a8..8afc7de1cf834 100644
--- a/drivers/media/usb/tm6000/tm6000-dvb.c
+++ b/drivers/media/usb/tm6000/tm6000-dvb.c
@@ -158,6 +158,10 @@ static int tm6000_start_stream(struct tm6000_core *dev)
if (ret < 0) {
printk(KERN_ERR "tm6000: error %i in %s during pipe reset\n",
ret, __func__);
+
+ kfree(dvb->bulk_urb->transfer_buffer);
+ usb_free_urb(dvb->bulk_urb);
+ dvb->bulk_urb = NULL;
return ret;
} else
printk(KERN_ERR "tm6000: pipe resetted\n");
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 27/93] ASoC: cs42l56: fix up error handling in probe
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 26/93] media: tm6000: Fix memleak in tm6000_start_stream Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 28/93] media: lmedm04: Fix misuse of comma Greg Kroah-Hartman
` (69 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mark Brown, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 856fe64da84c95a1d415564b981ae3908eea2a76 ]
There are two issues with this code. The first error path forgot to set
the error code and instead returns success. The second error path
doesn't clean up.
Fixes: 272b5edd3b8f ("ASoC: Add support for CS42L56 CODEC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X9NE/9nK9/TuxuL+@mwanda
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs42l56.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c
index 7cd5f769bb614..a22879ddda476 100644
--- a/sound/soc/codecs/cs42l56.c
+++ b/sound/soc/codecs/cs42l56.c
@@ -1269,6 +1269,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
dev_err(&i2c_client->dev,
"CS42L56 Device ID (%X). Expected %X\n",
devid, CS42L56_DEVID);
+ ret = -EINVAL;
goto err_enable;
}
alpha_rev = reg & CS42L56_AREV_MASK;
@@ -1324,7 +1325,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
ret = snd_soc_register_codec(&i2c_client->dev,
&soc_codec_dev_cs42l56, &cs42l56_dai, 1);
if (ret < 0)
- return ret;
+ goto err_enable;
return 0;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 28/93] media: lmedm04: Fix misuse of comma
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 27/93] ASoC: cs42l56: fix up error handling in probe Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 29/93] media: cx25821: Fix a bug when reallocating some dma memory Greg Kroah-Hartman
` (68 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joe Perches, Sean Young,
Mauro Carvalho Chehab, Sasha Levin
From: Joe Perches <joe@perches.com>
[ Upstream commit 59a3e78f8cc33901fe39035c1ab681374bba95ad ]
There's a comma used instead of a semicolon that causes multiple
statements to be executed after an if instead of just the intended
single statement.
Replace the comma with a semicolon.
Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb")
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
index 09c97847bf959..b586a23ab5887 100644
--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
@@ -445,7 +445,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
- lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa),
+ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa);
lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 29/93] media: cx25821: Fix a bug when reallocating some dma memory
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 28/93] media: lmedm04: Fix misuse of comma Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 30/93] media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values Greg Kroah-Hartman
` (67 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit b2de3643c5024fc4fd128ba7767c7fb8b714bea7 ]
This function looks like a realloc.
However, if 'risc->cpu != NULL', the memory will be freed, but never
reallocated with the bigger 'size'.
Explicitly set 'risc->cpu' to NULL, so that the reallocation is
correctly performed a few lines below.
[hverkuil: NULL != risc->cpu -> risc->cpu]
Fixes: 5ede94c70553 ("[media] cx25821: remove bogus btcx_risc dependency)
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx25821/cx25821-core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
index 54398d8a4696c..b43cf85ed5f05 100644
--- a/drivers/media/pci/cx25821/cx25821-core.c
+++ b/drivers/media/pci/cx25821/cx25821-core.c
@@ -990,8 +990,10 @@ int cx25821_riscmem_alloc(struct pci_dev *pci,
__le32 *cpu;
dma_addr_t dma = 0;
- if (NULL != risc->cpu && risc->size < size)
+ if (risc->cpu && risc->size < size) {
pci_free_consistent(pci, risc->size, risc->cpu, risc->dma);
+ risc->cpu = NULL;
+ }
if (NULL == risc->cpu) {
cpu = pci_zalloc_consistent(pci, size, &dma);
if (NULL == cpu)
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 30/93] media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 29/93] media: cx25821: Fix a bug when reallocating some dma memory Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 31/93] btrfs: clarify error returns values in __load_free_space_cache Greg Kroah-Hartman
` (66 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Till Dörges, Laurent Pinchart,
Mauro Carvalho Chehab, Sasha Levin
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
[ Upstream commit dc9455ffae02d7b7fb51ba1e007fffcb9dc5d890 ]
The Renkforce RF AC4K 300 Action Cam 4K reports invalid bFormatIndex and
bFrameIndex values when negotiating the video probe and commit controls.
The UVC descriptors report a single supported format and frame size,
with bFormatIndex and bFrameIndex both equal to 2, but the video probe
and commit controls report bFormatIndex and bFrameIndex set to 1.
The device otherwise operates correctly, but the driver rejects the
values and fails the format try operation. Fix it by ignoring the
invalid indices, and assuming that the format and frame requested by the
driver are accepted by the device.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=210767
Fixes: 8a652a17e3c0 ("media: uvcvideo: Ensure all probed info is returned to v4l2")
Reported-by: Till Dörges <doerges@pre-sense.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_v4l2.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index a0a544628053d..154f5bd45940e 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -243,7 +243,9 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
goto done;
/* After the probe, update fmt with the values returned from
- * negotiation with the device.
+ * negotiation with the device. Some devices return invalid bFormatIndex
+ * and bFrameIndex values, in which case we can only assume they have
+ * accepted the requested format as-is.
*/
for (i = 0; i < stream->nformats; ++i) {
if (probe->bFormatIndex == stream->format[i].index) {
@@ -252,11 +254,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
}
}
- if (i == stream->nformats) {
- uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n",
+ if (i == stream->nformats)
+ uvc_trace(UVC_TRACE_FORMAT,
+ "Unknown bFormatIndex %u, using default\n",
probe->bFormatIndex);
- return -EINVAL;
- }
for (i = 0; i < format->nframes; ++i) {
if (probe->bFrameIndex == format->frame[i].bFrameIndex) {
@@ -265,11 +266,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
}
}
- if (i == format->nframes) {
- uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n",
+ if (i == format->nframes)
+ uvc_trace(UVC_TRACE_FORMAT,
+ "Unknown bFrameIndex %u, using default\n",
probe->bFrameIndex);
- return -EINVAL;
- }
fmt->fmt.pix.width = frame->wWidth;
fmt->fmt.pix.height = frame->wHeight;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 31/93] btrfs: clarify error returns values in __load_free_space_cache
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 30/93] media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 32/93] fs/jfs: fix potential integer overflow on shift of a int Greg Kroah-Hartman
` (65 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhihao Cheng,
David Sterba, Sasha Levin
From: Zhihao Cheng <chengzhihao1@huawei.com>
[ Upstream commit 3cc64e7ebfb0d7faaba2438334c43466955a96e8 ]
Return value in __load_free_space_cache is not properly set after
(unlikely) memory allocation failures and 0 is returned instead.
This is not a problem for the caller load_free_space_cache because only
value 1 is considered as 'cache loaded' but for clarity it's better
to set the errors accordingly.
Fixes: a67509c30079 ("Btrfs: add a io_ctl struct and helpers for dealing with the space cache")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/free-space-cache.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 05b1b0f99f0bc..55d8020afc583 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -754,8 +754,10 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
while (num_entries) {
e = kmem_cache_zalloc(btrfs_free_space_cachep,
GFP_NOFS);
- if (!e)
+ if (!e) {
+ ret = -ENOMEM;
goto free_cache;
+ }
ret = io_ctl_read_entry(&io_ctl, e, &type);
if (ret) {
@@ -764,6 +766,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
}
if (!e->bytes) {
+ ret = -1;
kmem_cache_free(btrfs_free_space_cachep, e);
goto free_cache;
}
@@ -783,6 +786,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
num_bitmaps--;
e->bitmap = kzalloc(PAGE_CACHE_SIZE, GFP_NOFS);
if (!e->bitmap) {
+ ret = -ENOMEM;
kmem_cache_free(
btrfs_free_space_cachep, e);
goto free_cache;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 32/93] fs/jfs: fix potential integer overflow on shift of a int
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 31/93] btrfs: clarify error returns values in __load_free_space_cache Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 33/93] jffs2: fix use after free in jffs2_sum_write_data() Greg Kroah-Hartman
` (64 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Dave Kleikamp, Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 4208c398aae4c2290864ba15c3dab7111f32bec1 ]
The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
arithmetic and then assigned to a signed 64 bit integer. In the case where
l2nb is 32 or more this can lead to an overflow. Avoid this by shifting
the value 1LL instead.
Addresses-Coverity: ("Uninitentional integer overflow")
Fixes: b40c2e665cd5 ("fs/jfs: TRIM support for JFS Filesystem")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/jfs_dmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 2d514c7affc2a..9ff510a489cb1 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1669,7 +1669,7 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen)
} else if (rc == -ENOSPC) {
/* search for next smaller log2 block */
l2nb = BLKSTOL2(nblocks) - 1;
- nblocks = 1 << l2nb;
+ nblocks = 1LL << l2nb;
} else {
/* Trim any already allocated blocks */
jfs_error(bmp->db_ipbmap->i_sb, "-EIO\n");
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 33/93] jffs2: fix use after free in jffs2_sum_write_data()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 32/93] fs/jfs: fix potential integer overflow on shift of a int Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 34/93] clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL Greg Kroah-Hartman
` (63 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tom Rix, Nathan Chancellor,
Richard Weinberger, Sasha Levin
From: Tom Rix <trix@redhat.com>
[ Upstream commit 19646447ad3a680d2ab08c097585b7d96a66126b ]
clang static analysis reports this problem
fs/jffs2/summary.c:794:31: warning: Use of memory after it is freed
c->summary->sum_list_head = temp->u.next;
^~~~~~~~~~~~
In jffs2_sum_write_data(), in a loop summary data is handles a node at
a time. When it has written out the node it is removed the summary list,
and the node is deleted. In the corner case when a
JFFS2_FEATURE_RWCOMPAT_COPY is seen, a call is made to
jffs2_sum_disable_collecting(). jffs2_sum_disable_collecting() deletes
the whole list which conflicts with the loop's deleting the list by parts.
To preserve the old behavior of stopping the write midway, bail out of
the loop after disabling summary collection.
Fixes: 6171586a7ae5 ("[JFFS2] Correct handling of JFFS2_FEATURE_RWCOMPAT_COPY nodes.")
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jffs2/summary.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c
index bc5385471a6e3..c05d6f5f10ecd 100644
--- a/fs/jffs2/summary.c
+++ b/fs/jffs2/summary.c
@@ -783,6 +783,8 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
dbg_summary("Writing unknown RWCOMPAT_COPY node type %x\n",
je16_to_cpu(temp->u.nodetype));
jffs2_sum_disable_collecting(c->summary);
+ /* The above call removes the list, nothing more to do */
+ goto bail_rwcompat;
} else {
BUG(); /* unknown node in summary information */
}
@@ -794,6 +796,7 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
c->summary->sum_num--;
}
+ bail_rwcompat:
jffs2_sum_reset_collected(c->summary);
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 34/93] clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 33/93] jffs2: fix use after free in jffs2_sum_write_data() Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 35/93] HID: core: detect and skip invalid inputs to snto32() Greg Kroah-Hartman
` (62 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Jerome Brunet,
Sasha Levin
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[ Upstream commit 2f290b7c67adf6459a17a4c978102af35cd62e4a ]
The "rate" parameter in meson_clk_pll_set_rate() contains the new rate.
Retrieve the old rate with clk_hw_get_rate() so we don't inifinitely try
to switch from the new rate to the same rate again.
Fixes: 7a29a869434e8b ("clk: meson: Add support for Meson clock controller")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20201226121556.975418-2-martin.blumenstingl@googlemail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/meson/clk-pll.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
index 664edf0708ea7..50b1138aaad71 100644
--- a/drivers/clk/meson/clk-pll.c
+++ b/drivers/clk/meson/clk-pll.c
@@ -138,7 +138,7 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
if (parent_rate == 0 || rate == 0)
return -EINVAL;
- old_rate = rate;
+ old_rate = clk_hw_get_rate(hw);
rate_set = meson_clk_get_pll_settings(pll, rate);
if (!rate_set)
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 35/93] HID: core: detect and skip invalid inputs to snto32()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 34/93] clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 36/93] dmaengine: fsldma: Fix a resource leak in the remove function Greg Kroah-Hartman
` (61 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap,
syzbot+1e911ad71dd4ea72e04a, Jiri Kosina, Benjamin Tissoires,
linux-input, Jiri Kosina, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit a0312af1f94d13800e63a7d0a66e563582e39aec ]
Prevent invalid (0, 0) inputs to hid-core's snto32() function.
Maybe it is just the dummy device here that is causing this, but
there are hundreds of calls to snto32(0, 0). Having n (bits count)
of 0 is causing the current UBSAN trap with a shift value of
0xffffffff (-1, or n - 1 in this function).
Either of the value to shift being 0 or the bits count being 0 can be
handled by just returning 0 to the caller, avoiding the following
complex shift + OR operations:
return value & (1 << (n - 1)) ? value | (~0U << n) : value;
Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: syzbot+1e911ad71dd4ea72e04a@syzkaller.appspotmail.com
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 1495cf343d9f5..25544a08fa838 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1109,6 +1109,9 @@ EXPORT_SYMBOL_GPL(hid_open_report);
static s32 snto32(__u32 value, unsigned n)
{
+ if (!value || !n)
+ return 0;
+
switch (n) {
case 8: return ((__s8)value);
case 16: return ((__s16)value);
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 36/93] dmaengine: fsldma: Fix a resource leak in the remove function
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 35/93] HID: core: detect and skip invalid inputs to snto32() Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 37/93] dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function Greg Kroah-Hartman
` (60 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Vinod Koul, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit cbc0ad004c03ad7971726a5db3ec84dba3dcb857 ]
A 'irq_dispose_mapping()' call is missing in the remove function.
Add it.
This is needed to undo the 'irq_of_parse_and_map() call from the probe
function and already part of the error handling path of the probe function.
It was added in the probe function only in commit d3f620b2c4fe ("fsldma:
simplify IRQ probing and handling")
Fixes: 77cd62e8082b ("fsldma: allow Freescale Elo DMA driver to be compiled as a module")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201212160516.92515-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/fsldma.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 2209f75fdf05b..1a637104cc08e 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1436,6 +1436,7 @@ static int fsldma_of_remove(struct platform_device *op)
if (fdev->chan[i])
fsl_dma_chan_remove(fdev->chan[i]);
}
+ irq_dispose_mapping(fdev->irq);
iounmap(fdev->regs);
kfree(fdev);
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 37/93] dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 36/93] dmaengine: fsldma: Fix a resource leak in the remove function Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 38/93] clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined Greg Kroah-Hartman
` (59 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Vinod Koul, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit b202d4e82531a62a33a6b14d321dd2aad491578e ]
In case of error, the previous 'fsl_dma_chan_probe()' calls must be undone
by some 'fsl_dma_chan_remove()', as already done in the remove function.
It was added in the remove function in commit 77cd62e8082b ("fsldma: allow
Freescale Elo DMA driver to be compiled as a module")
Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201212160614.92576-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/fsldma.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 1a637104cc08e..7c4b4c71d3a0e 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1335,6 +1335,7 @@ static int fsldma_of_probe(struct platform_device *op)
{
struct fsldma_device *fdev;
struct device_node *child;
+ unsigned int i;
int err;
fdev = kzalloc(sizeof(*fdev), GFP_KERNEL);
@@ -1416,6 +1417,10 @@ static int fsldma_of_probe(struct platform_device *op)
return 0;
out_free_fdev:
+ for (i = 0; i < FSL_DMA_MAX_CHANS_PER_DEVICE; i++) {
+ if (fdev->chan[i])
+ fsl_dma_chan_remove(fdev->chan[i]);
+ }
irq_dispose_mapping(fdev->irq);
kfree(fdev);
out_return:
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 38/93] clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 37/93] dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 39/93] regulator: axp20x: Fix reference cout leak Greg Kroah-Hartman
` (58 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tom Rix, Daniel Lezcano, Sasha Levin
From: Tom Rix <trix@redhat.com>
[ Upstream commit 7da390694afbaed8e0f05717a541dfaf1077ba51 ]
When DEBUG is defined this error occurs
drivers/clocksource/mxs_timer.c:138:1: error:
expected ‘;’ before ‘}’ token
The preceding statement needs a semicolon.
Replace pr_info() with pr_debug() and remove the unneeded ifdef.
Fixes: eb8703e2ef7c ("clockevents/drivers/mxs: Migrate to new 'set-state' interface")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210118211955.763609-1-trix@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/mxs_timer.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/clocksource/mxs_timer.c b/drivers/clocksource/mxs_timer.c
index f5ce2961c0d62..23f125126fa81 100644
--- a/drivers/clocksource/mxs_timer.c
+++ b/drivers/clocksource/mxs_timer.c
@@ -154,10 +154,7 @@ static void mxs_irq_clear(char *state)
/* Clear pending interrupt */
timrot_irq_acknowledge();
-
-#ifdef DEBUG
- pr_info("%s: changing mode to %s\n", __func__, state)
-#endif /* DEBUG */
+ pr_debug("%s: changing mode to %s\n", __func__, state);
}
static int mxs_shutdown(struct clock_event_device *evt)
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 39/93] regulator: axp20x: Fix reference cout leak
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 38/93] clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 40/93] isofs: release buffer head before return Greg Kroah-Hartman
` (57 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pan Bian, Mark Brown, Sasha Levin
From: Pan Bian <bianpan2016@163.com>
[ Upstream commit e78bf6be7edaacb39778f3a89416caddfc6c6d70 ]
Decrements the reference count of device node and its child node.
Fixes: dfe7a1b058bb ("regulator: AXP20x: Add support for regulators subsystem")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Link: https://lore.kernel.org/r/20210120123313.107640-1-bianpan2016@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/axp20x-regulator.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
index 5cf4a97e03048..df235ac1a6b2b 100644
--- a/drivers/regulator/axp20x-regulator.c
+++ b/drivers/regulator/axp20x-regulator.c
@@ -279,7 +279,7 @@ static int axp20x_set_dcdc_freq(struct platform_device *pdev, u32 dcdcfreq)
static int axp20x_regulator_parse_dt(struct platform_device *pdev)
{
struct device_node *np, *regulators;
- int ret;
+ int ret = 0;
u32 dcdcfreq = 0;
np = of_node_get(pdev->dev.parent->of_node);
@@ -294,13 +294,12 @@ static int axp20x_regulator_parse_dt(struct platform_device *pdev)
ret = axp20x_set_dcdc_freq(pdev, dcdcfreq);
if (ret < 0) {
dev_err(&pdev->dev, "Error setting dcdc frequency: %d\n", ret);
- return ret;
}
-
of_node_put(regulators);
}
- return 0;
+ of_node_put(np);
+ return ret;
}
static int axp20x_set_dcdc_workmode(struct regulator_dev *rdev, int id, u32 workmode)
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 40/93] isofs: release buffer head before return
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 39/93] regulator: axp20x: Fix reference cout leak Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 41/93] IB/umad: Return EIO in case of when device disassociated Greg Kroah-Hartman
` (56 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pan Bian, Jan Kara, Sasha Levin
From: Pan Bian <bianpan2016@163.com>
[ Upstream commit 0a6dc67a6aa45f19bd4ff89b4f468fc50c4b8daa ]
Release the buffer_head before returning error code in
do_isofs_readdir() and isofs_find_entry().
Fixes: 2deb1acc653c ("isofs: fix access to unallocated memory when reading corrupted filesystem")
Link: https://lore.kernel.org/r/20210118120455.118955-1-bianpan2016@163.com
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/isofs/dir.c | 1 +
fs/isofs/namei.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c
index b943cbd963bb9..2e7d74c7beed8 100644
--- a/fs/isofs/dir.c
+++ b/fs/isofs/dir.c
@@ -151,6 +151,7 @@ static int do_isofs_readdir(struct inode *inode, struct file *file,
printk(KERN_NOTICE "iso9660: Corrupted directory entry"
" in block %lu of inode %lu\n", block,
inode->i_ino);
+ brelse(bh);
return -EIO;
}
diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
index 7b543e6b6526d..696f255d15325 100644
--- a/fs/isofs/namei.c
+++ b/fs/isofs/namei.c
@@ -101,6 +101,7 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
printk(KERN_NOTICE "iso9660: Corrupted directory entry"
" in block %lu of inode %lu\n", block,
dir->i_ino);
+ brelse(bh);
return 0;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 41/93] IB/umad: Return EIO in case of when device disassociated
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 40/93] isofs: release buffer head before return Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 42/93] powerpc/47x: Disable 256k page size Greg Kroah-Hartman
` (55 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shay Drory, Leon Romanovsky,
Jason Gunthorpe, Sasha Levin
From: Shay Drory <shayd@nvidia.com>
[ Upstream commit 4fc5461823c9cad547a9bdfbf17d13f0da0d6bb5 ]
MAD message received by the user has EINVAL error in all flows
including when the device is disassociated. That makes it impossible
for the applications to treat such flow differently.
Change it to return EIO, so the applications will be able to perform
disassociation recovery.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://lore.kernel.org/r/20210125121339.837518-2-leon@kernel.org
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/user_mad.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index e9e75f40714cb..27bc51409f559 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -342,6 +342,11 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
mutex_lock(&file->mutex);
+ if (file->agents_dead) {
+ mutex_unlock(&file->mutex);
+ return -EIO;
+ }
+
while (list_empty(&file->recv_list)) {
mutex_unlock(&file->mutex);
@@ -484,7 +489,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
agent = __get_agent(file, packet->mad.hdr.id);
if (!agent) {
- ret = -EINVAL;
+ ret = -EIO;
goto err_up;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 42/93] powerpc/47x: Disable 256k page size
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 41/93] IB/umad: Return EIO in case of when device disassociated Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 43/93] mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe Greg Kroah-Hartman
` (54 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Christophe Leroy,
Michael Ellerman, Sasha Levin
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 910a0cb6d259736a0c86e795d4c2f42af8d0d775 ]
PPC47x_TLBE_SIZE isn't defined for 256k pages, leading to a build
break if 256k pages is selected.
So change the kconfig so that 256k pages can't be selected for 47x.
Fixes: e7f75ad01d59 ("powerpc/47x: Base ppc476 support")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
[mpe: Expand change log to mention build break]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/2fed79b1154c872194f98bac4422c23918325e61.1611128938.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 4ece20178145d..735f99906a320 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -577,7 +577,7 @@ config PPC_64K_PAGES
config PPC_256K_PAGES
bool "256k page size"
- depends on 44x && !STDBINUTILS
+ depends on 44x && !STDBINUTILS && !PPC_47x
help
Make the page size 256k.
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 43/93] mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 42/93] powerpc/47x: Disable 256k page size Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 44/93] ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores Greg Kroah-Hartman
` (53 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Ulf Hansson, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 6052b3c370fb82dec28bcfff6d7ec0da84ac087a ]
A call to 'ausdhi6_dma_release()' to undo a previous call to
'usdhi6_dma_request()' is missing in the error handling path of the probe
function.
It is already present in the remove function.
Fixes: 75fa9ea6e3c0 ("mmc: add a driver for the Renesas usdhi6rol0 SD/SDIO host controller")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20201217210922.165340-1-christophe.jaillet@wanadoo.fr
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/usdhi6rol0.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c
index b47122d3e8d8c..2b6a9c6a6e965 100644
--- a/drivers/mmc/host/usdhi6rol0.c
+++ b/drivers/mmc/host/usdhi6rol0.c
@@ -1808,10 +1808,12 @@ static int usdhi6_probe(struct platform_device *pdev)
ret = mmc_add_host(mmc);
if (ret < 0)
- goto e_clk_off;
+ goto e_release_dma;
return 0;
+e_release_dma:
+ usdhi6_dma_release(host);
e_clk_off:
clk_disable_unprepare(host->clk);
e_free_mmc:
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 44/93] ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 43/93] mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 45/93] amba: Fix resource leak for drivers without .remove Greg Kroah-Hartman
` (52 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Murzin, Russell King, Sasha Levin
From: Vladimir Murzin <vladimir.murzin@arm.com>
[ Upstream commit 2acb909750431030b65a0a2a17fd8afcbd813a84 ]
It was observed that decompressor running on hardware implementing ARM v8.2
Load/Store Multiple Atomicity and Ordering Control (LSMAOC), say, as guest,
would stuck just after:
Uncompressing Linux... done, booting the kernel.
The reason is that it clears nTLSMD bit when disabling caches:
nTLSMD, bit [3]
When ARMv8.2-LSMAOC is implemented:
No Trap Load Multiple and Store Multiple to
Device-nGRE/Device-nGnRE/Device-nGnRnE memory.
0b0 All memory accesses by A32 and T32 Load Multiple and Store
Multiple at EL1 or EL0 that are marked at stage 1 as
Device-nGRE/Device-nGnRE/Device-nGnRnE memory are trapped and
generate a stage 1 Alignment fault.
0b1 All memory accesses by A32 and T32 Load Multiple and Store
Multiple at EL1 or EL0 that are marked at stage 1 as
Device-nGRE/Device-nGnRE/Device-nGnRnE memory are not trapped.
This bit is permitted to be cached in a TLB.
This field resets to 1.
Otherwise:
Reserved, RES1
So as effect we start getting traps we are not quite ready for.
Looking into history it seems that mask used for SCTLR clear came from
the similar code for ARMv4, where bit[3] is the enable/disable bit for
the write buffer. That not applicable to ARMv7 and onwards, so retire
that bit from the masks.
Fixes: 7d09e85448dfa78e3e58186c934449aaf6d49b50 ("[ARM] 4393/2: ARMv7: Add uncompressing code for the new CPU Id format")
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/compressed/head.S | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 856913705169f..082d036e95649 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -1074,9 +1074,9 @@ __armv4_mmu_cache_off:
__armv7_mmu_cache_off:
mrc p15, 0, r0, c1, c0
#ifdef CONFIG_MMU
- bic r0, r0, #0x000d
+ bic r0, r0, #0x0005
#else
- bic r0, r0, #0x000c
+ bic r0, r0, #0x0004
#endif
mcr p15, 0, r0, c1, c0 @ turn MMU and cache off
mov r12, lr
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 45/93] amba: Fix resource leak for drivers without .remove
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 44/93] ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 46/93] tracepoint: Do not fail unregistering a probe due to memory failure Greg Kroah-Hartman
` (51 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ulf Hansson, Arnd Bergmann,
Uwe Kleine-König, Sasha Levin
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit de5d7adb89367bbc87b4e5ce7afe7ae9bd86dc12 ]
Consider an amba driver with a .probe but without a .remove callback (e.g.
pl061_gpio_driver). The function amba_probe() is called to bind a device
and so dev_pm_domain_attach() and others are called. As there is no remove
callback amba_remove() isn't called at unbind time however and so calling
dev_pm_domain_detach() is missed and the pm domain keeps active.
To fix this always use the core driver callbacks and handle missing amba
callbacks there. For probe refuse registration as a driver without probe
doesn't make sense.
Fixes: 7cfe249475fd ("ARM: AMBA: Add pclk support to AMBA bus infrastructure")
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20210126165835.687514-2-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/amba/bus.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 1accc01fb0ca9..91c99cce22a4d 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -275,10 +275,11 @@ static int amba_remove(struct device *dev)
{
struct amba_device *pcdev = to_amba_device(dev);
struct amba_driver *drv = to_amba_driver(dev->driver);
- int ret;
+ int ret = 0;
pm_runtime_get_sync(dev);
- ret = drv->remove(pcdev);
+ if (drv->remove)
+ ret = drv->remove(pcdev);
pm_runtime_put_noidle(dev);
/* Undo the runtime PM settings in amba_probe() */
@@ -295,7 +296,9 @@ static int amba_remove(struct device *dev)
static void amba_shutdown(struct device *dev)
{
struct amba_driver *drv = to_amba_driver(dev->driver);
- drv->shutdown(to_amba_device(dev));
+
+ if (drv->shutdown)
+ drv->shutdown(to_amba_device(dev));
}
/**
@@ -308,12 +311,13 @@ static void amba_shutdown(struct device *dev)
*/
int amba_driver_register(struct amba_driver *drv)
{
- drv->drv.bus = &amba_bustype;
+ if (!drv->probe)
+ return -EINVAL;
-#define SETFN(fn) if (drv->fn) drv->drv.fn = amba_##fn
- SETFN(probe);
- SETFN(remove);
- SETFN(shutdown);
+ drv->drv.bus = &amba_bustype;
+ drv->drv.probe = amba_probe;
+ drv->drv.remove = amba_remove;
+ drv->drv.shutdown = amba_shutdown;
return driver_register(&drv->drv);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 46/93] tracepoint: Do not fail unregistering a probe due to memory failure
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 45/93] amba: Fix resource leak for drivers without .remove Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:12 ` [PATCH 4.4 47/93] mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq() Greg Kroah-Hartman
` (50 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra, Josh Poimboeuf,
Mathieu Desnoyers, Ingo Molnar, Alexei Starovoitov,
Daniel Borkmann, Dmitry Vyukov, Martin KaFai Lau, Song Liu,
Yonghong Song, Andrii Nakryiko, John Fastabend, KP Singh, netdev,
bpf, Kees Cook, Florian Weimer, syzbot+83aa762ef23b6f0d1991,
syzbot+d29e58bb557324e55e5e, Matt Mullins,
Steven Rostedt (VMware),
Sasha Levin
From: Steven Rostedt (VMware) <rostedt@goodmis.org>
[ Upstream commit befe6d946551d65cddbd32b9cb0170b0249fd5ed ]
The list of tracepoint callbacks is managed by an array that is protected
by RCU. To update this array, a new array is allocated, the updates are
copied over to the new array, and then the list of functions for the
tracepoint is switched over to the new array. After a completion of an RCU
grace period, the old array is freed.
This process happens for both adding a callback as well as removing one.
But on removing a callback, if the new array fails to be allocated, the
callback is not removed, and may be used after it is freed by the clients
of the tracepoint.
There's really no reason to fail if the allocation for a new array fails
when removing a function. Instead, the function can simply be replaced by a
stub function that could be cleaned up on the next modification of the
array. That is, instead of calling the function registered to the
tracepoint, it would call a stub function in its place.
Link: https://lore.kernel.org/r/20201115055256.65625-1-mmullins@mmlx.us
Link: https://lore.kernel.org/r/20201116175107.02db396d@gandalf.local.home
Link: https://lore.kernel.org/r/20201117211836.54acaef2@oasis.local.home
Link: https://lkml.kernel.org/r/20201118093405.7a6d2290@gandalf.local.home
[ Note, this version does use undefined compiler behavior (assuming that
a stub function with no parameters or return, can be called by a location
that thinks it has parameters but still no return value. Static calls
do the same thing, so this trick is not without precedent.
There's another solution that uses RCU tricks and is more complex, but
can be an alternative if this solution becomes an issue.
Link: https://lore.kernel.org/lkml/20210127170721.58bce7cc@gandalf.local.home/
]
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Yonghong Song <yhs@fb.com>
Cc: Andrii Nakryiko <andriin@fb.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: KP Singh <kpsingh@chromium.org>
Cc: netdev <netdev@vger.kernel.org>
Cc: bpf <bpf@vger.kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Florian Weimer <fw@deneb.enyo.de>
Fixes: 97e1c18e8d17b ("tracing: Kernel Tracepoints")
Reported-by: syzbot+83aa762ef23b6f0d1991@syzkaller.appspotmail.com
Reported-by: syzbot+d29e58bb557324e55e5e@syzkaller.appspotmail.com
Reported-by: Matt Mullins <mmullins@mmlx.us>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Tested-by: Matt Mullins <mmullins@mmlx.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/tracepoint.c | 80 ++++++++++++++++++++++++++++++++++++---------
1 file changed, 64 insertions(+), 16 deletions(-)
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index eda85bbf1c2e4..a1f9be7030021 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -59,6 +59,12 @@ struct tp_probes {
struct tracepoint_func probes[0];
};
+/* Called in removal of a func but failed to allocate a new tp_funcs */
+static void tp_stub_func(void)
+{
+ return;
+}
+
static inline void *allocate_probes(int count)
{
struct tp_probes *p = kmalloc(count * sizeof(struct tracepoint_func)
@@ -97,6 +103,7 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func,
{
struct tracepoint_func *old, *new;
int nr_probes = 0;
+ int stub_funcs = 0;
int pos = -1;
if (WARN_ON(!tp_func->func))
@@ -113,14 +120,34 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func,
if (old[nr_probes].func == tp_func->func &&
old[nr_probes].data == tp_func->data)
return ERR_PTR(-EEXIST);
+ if (old[nr_probes].func == tp_stub_func)
+ stub_funcs++;
}
}
- /* + 2 : one for new probe, one for NULL func */
- new = allocate_probes(nr_probes + 2);
+ /* + 2 : one for new probe, one for NULL func - stub functions */
+ new = allocate_probes(nr_probes + 2 - stub_funcs);
if (new == NULL)
return ERR_PTR(-ENOMEM);
if (old) {
- if (pos < 0) {
+ if (stub_funcs) {
+ /* Need to copy one at a time to remove stubs */
+ int probes = 0;
+
+ pos = -1;
+ for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
+ if (old[nr_probes].func == tp_stub_func)
+ continue;
+ if (pos < 0 && old[nr_probes].prio < prio)
+ pos = probes++;
+ new[probes++] = old[nr_probes];
+ }
+ nr_probes = probes;
+ if (pos < 0)
+ pos = probes;
+ else
+ nr_probes--; /* Account for insertion */
+
+ } else if (pos < 0) {
pos = nr_probes;
memcpy(new, old, nr_probes * sizeof(struct tracepoint_func));
} else {
@@ -154,8 +181,9 @@ static void *func_remove(struct tracepoint_func **funcs,
/* (N -> M), (N > 1, M >= 0) probes */
if (tp_func->func) {
for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
- if (old[nr_probes].func == tp_func->func &&
- old[nr_probes].data == tp_func->data)
+ if ((old[nr_probes].func == tp_func->func &&
+ old[nr_probes].data == tp_func->data) ||
+ old[nr_probes].func == tp_stub_func)
nr_del++;
}
}
@@ -174,14 +202,32 @@ static void *func_remove(struct tracepoint_func **funcs,
/* N -> M, (N > 1, M > 0) */
/* + 1 for NULL */
new = allocate_probes(nr_probes - nr_del + 1);
- if (new == NULL)
- return ERR_PTR(-ENOMEM);
- for (i = 0; old[i].func; i++)
- if (old[i].func != tp_func->func
- || old[i].data != tp_func->data)
- new[j++] = old[i];
- new[nr_probes - nr_del].func = NULL;
- *funcs = new;
+ if (new) {
+ for (i = 0; old[i].func; i++)
+ if ((old[i].func != tp_func->func
+ || old[i].data != tp_func->data)
+ && old[i].func != tp_stub_func)
+ new[j++] = old[i];
+ new[nr_probes - nr_del].func = NULL;
+ *funcs = new;
+ } else {
+ /*
+ * Failed to allocate, replace the old function
+ * with calls to tp_stub_func.
+ */
+ for (i = 0; old[i].func; i++)
+ if (old[i].func == tp_func->func &&
+ old[i].data == tp_func->data) {
+ old[i].func = tp_stub_func;
+ /* Set the prio to the next event. */
+ if (old[i + 1].func)
+ old[i].prio =
+ old[i + 1].prio;
+ else
+ old[i].prio = -1;
+ }
+ *funcs = old;
+ }
}
debug_print_probes(*funcs);
return old;
@@ -234,10 +280,12 @@ static int tracepoint_remove_func(struct tracepoint *tp,
tp_funcs = rcu_dereference_protected(tp->funcs,
lockdep_is_held(&tracepoints_mutex));
old = func_remove(&tp_funcs, func);
- if (IS_ERR(old)) {
- WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM);
+ if (WARN_ON_ONCE(IS_ERR(old)))
return PTR_ERR(old);
- }
+
+ if (tp_funcs == old)
+ /* Failed allocating new tp_funcs, replaced func with stub */
+ return 0;
if (!tp_funcs) {
/* Removed last function */
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 47/93] mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 46/93] tracepoint: Do not fail unregistering a probe due to memory failure Greg Kroah-Hartman
@ 2021-03-01 16:12 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 48/93] powerpc/pseries/dlpar: handle ibm, configure-connector delay status Greg Kroah-Hartman
` (49 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:12 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Charles Keepax,
Lee Jones, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 26783d74cc6a440ee3ef9836a008a697981013d0 ]
The "req" struct is always added to the "wm831x->auxadc_pending" list,
but it's only removed from the list on the success path. If a failure
occurs then the "req" struct is freed but it's still on the list,
leading to a use after free.
Fixes: 78bb3688ea18 ("mfd: Support multiple active WM831x AUXADC conversions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/wm831x-auxadc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/mfd/wm831x-auxadc.c b/drivers/mfd/wm831x-auxadc.c
index fd789d2eb0f52..9f7ae1e1ebcd6 100644
--- a/drivers/mfd/wm831x-auxadc.c
+++ b/drivers/mfd/wm831x-auxadc.c
@@ -98,11 +98,10 @@ static int wm831x_auxadc_read_irq(struct wm831x *wm831x,
wait_for_completion_timeout(&req->done, msecs_to_jiffies(500));
mutex_lock(&wm831x->auxadc_lock);
-
- list_del(&req->list);
ret = req->val;
out:
+ list_del(&req->list);
mutex_unlock(&wm831x->auxadc_lock);
kfree(req);
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 48/93] powerpc/pseries/dlpar: handle ibm, configure-connector delay status
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2021-03-01 16:12 ` [PATCH 4.4 47/93] mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq() Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 49/93] perf intel-pt: Fix missing CYC processing in PSB Greg Kroah-Hartman
` (48 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Tyrel Datwyler,
Michael Ellerman, Sasha Levin
From: Nathan Lynch <nathanl@linux.ibm.com>
[ Upstream commit 768d70e19ba525debd571b36e6d0ab19956c63d7 ]
dlpar_configure_connector() has two problems in its handling of
ibm,configure-connector's return status:
1. When the status is -2 (busy, call again), we call
ibm,configure-connector again immediately without checking whether
to schedule, which can result in monopolizing the CPU.
2. Extended delay status (9900..9905) goes completely unhandled,
causing the configuration to unnecessarily terminate.
Fix both of these issues by using rtas_busy_delay().
Fixes: ab519a011caa ("powerpc/pseries: Kernel DLPAR Infrastructure")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210107025900.410369-1-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/dlpar.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index 551ba5b35df9d..91a667d8b1e90 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -131,7 +131,6 @@ void dlpar_free_cc_nodes(struct device_node *dn)
#define NEXT_PROPERTY 3
#define PREV_PARENT 4
#define MORE_MEMORY 5
-#define CALL_AGAIN -2
#define ERR_CFG_USE -9003
struct device_node *dlpar_configure_connector(__be32 drc_index,
@@ -173,6 +172,9 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
spin_unlock(&rtas_data_buf_lock);
+ if (rtas_busy_delay(rc))
+ continue;
+
switch (rc) {
case COMPLETE:
break;
@@ -225,9 +227,6 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
parent_path = last_dn->parent->full_name;
break;
- case CALL_AGAIN:
- break;
-
case MORE_MEMORY:
case ERR_CFG_USE:
default:
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 49/93] perf intel-pt: Fix missing CYC processing in PSB
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 48/93] powerpc/pseries/dlpar: handle ibm, configure-connector delay status Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 50/93] perf test: Fix unaligned access in sample parsing test Greg Kroah-Hartman
` (47 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Andi Kleen, Jiri Olsa,
Arnaldo Carvalho de Melo, Sasha Levin
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 03fb0f859b45d1eb05c984ab4bd3bef67e45ede2 ]
Add missing CYC packet processing when walking through PSB+. This
improves the accuracy of timestamps that follow PSB+, until the next
MTC.
Fixes: 3d49807870f08 ("perf tools: Add new Intel PT packet definitions")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Link: https://lore.kernel.org/r/20210205175350.23817-2-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
index c1944765533c8..28f9e88c65bac 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -1478,6 +1478,9 @@ static int intel_pt_walk_psbend(struct intel_pt_decoder *decoder)
break;
case INTEL_PT_CYC:
+ intel_pt_calc_cyc_timestamp(decoder);
+ break;
+
case INTEL_PT_VMCS:
case INTEL_PT_MNT:
case INTEL_PT_PAD:
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 50/93] perf test: Fix unaligned access in sample parsing test
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 49/93] perf intel-pt: Fix missing CYC processing in PSB Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 51/93] Input: elo - fix an error code in elo_connect() Greg Kroah-Hartman
` (46 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Namhyung Kim, Adrian Hunter,
Alexander Shishkin, Andi Kleen, Ian Rogers, Ingo Molnar,
Jiri Olsa, Mark Rutland, Peter Zijlstra, Stephane Eranian,
Arnaldo Carvalho de Melo, Sasha Levin
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit c5c97cadd7ed13381cb6b4bef5c841a66938d350 ]
The ubsan reported the following error. It was because sample's raw
data missed u32 padding at the end. So it broke the alignment of the
array after it.
The raw data contains an u32 size prefix so the data size should have
an u32 padding after 8-byte aligned data.
27: Sample parsing :util/synthetic-events.c:1539:4:
runtime error: store to misaligned address 0x62100006b9bc for type
'__u64' (aka 'unsigned long long'), which requires 8 byte alignment
0x62100006b9bc: note: pointer points here
00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
#0 0x561532a9fc96 in perf_event__synthesize_sample util/synthetic-events.c:1539:13
#1 0x5615327f4a4f in do_test tests/sample-parsing.c:284:8
#2 0x5615327f3f50 in test__sample_parsing tests/sample-parsing.c:381:9
#3 0x56153279d3a1 in run_test tests/builtin-test.c:424:9
#4 0x56153279c836 in test_and_print tests/builtin-test.c:454:9
#5 0x56153279b7eb in __cmd_test tests/builtin-test.c:675:4
#6 0x56153279abf0 in cmd_test tests/builtin-test.c:821:9
#7 0x56153264e796 in run_builtin perf.c:312:11
#8 0x56153264cf03 in handle_internal_command perf.c:364:8
#9 0x56153264e47d in run_argv perf.c:408:2
#10 0x56153264c9a9 in main perf.c:538:3
#11 0x7f137ab6fbbc in __libc_start_main (/lib64/libc.so.6+0x38bbc)
#12 0x561532596828 in _start ...
SUMMARY: UndefinedBehaviorSanitizer: misaligned-pointer-use
util/synthetic-events.c:1539:4 in
Fixes: 045f8cd8542d ("perf tests: Add a sample parsing test")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: https://lore.kernel.org/r/20210214091638.519643-1-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/sample-parsing.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/tests/sample-parsing.c b/tools/perf/tests/sample-parsing.c
index 30c02181e78b2..bdef02599b4e3 100644
--- a/tools/perf/tests/sample-parsing.c
+++ b/tools/perf/tests/sample-parsing.c
@@ -167,7 +167,7 @@ static int do_test(u64 sample_type, u64 sample_regs, u64 read_format)
.data = {1, 211, 212, 213},
};
u64 regs[64];
- const u64 raw_data[] = {0x123456780a0b0c0dULL, 0x1102030405060708ULL};
+ const u32 raw_data[] = {0x12345678, 0x0a0b0c0d, 0x11020304, 0x05060708, 0 };
const u64 data[] = {0x2211443366558877ULL, 0, 0xaabbccddeeff4321ULL};
struct perf_sample sample = {
.ip = 101,
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 51/93] Input: elo - fix an error code in elo_connect()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 50/93] perf test: Fix unaligned access in sample parsing test Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 52/93] sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set Greg Kroah-Hartman
` (45 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Dmitry Torokhov, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 0958351e93fa0ac142f6dd8bd844441594f30a57 ]
If elo_setup_10() fails then this should return an error code instead
of success.
Fixes: fae3006e4b42 ("Input: elo - add support for non-pressure-sensitive touchscreens")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YBKFd5CvDu+jVmfW@mwanda
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/touchscreen/elo.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/input/touchscreen/elo.c b/drivers/input/touchscreen/elo.c
index 8051a4b704ea3..e2e31cbd6b2c3 100644
--- a/drivers/input/touchscreen/elo.c
+++ b/drivers/input/touchscreen/elo.c
@@ -345,8 +345,10 @@ static int elo_connect(struct serio *serio, struct serio_driver *drv)
switch (elo->id) {
case 0: /* 10-byte protocol */
- if (elo_setup_10(elo))
+ if (elo_setup_10(elo)) {
+ err = -EIO;
goto fail3;
+ }
break;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 52/93] sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 51/93] Input: elo - fix an error code in elo_connect() Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 53/93] misc: eeprom_93xx46: Fix module alias to enable module autoprobe Greg Kroah-Hartman
` (44 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, David S. Miller,
sparclinux, Sam Ravnborg, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 80bddf5c93a99e11fc9faf7e4b575d01cecd45d3 ]
Currently COMPAT on SPARC64 selects COMPAT_BINFMT_ELF unconditionally,
even when BINFMT_ELF is not enabled. This causes a kconfig warning.
Instead, just select COMPAT_BINFMT_ELF if BINFMT_ELF is enabled.
This builds cleanly with no kconfig warnings.
WARNING: unmet direct dependencies detected for COMPAT_BINFMT_ELF
Depends on [n]: COMPAT [=y] && BINFMT_ELF [=n]
Selected by [y]:
- COMPAT [=y] && SPARC64 [=y]
Fixes: 26b4c912185a ("sparc,sparc64: unify Kconfig files")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: sparclinux@vger.kernel.org
Cc: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 94f4ac21761bf..f42973685fd2c 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -539,7 +539,7 @@ config COMPAT
bool
depends on SPARC64
default y
- select COMPAT_BINFMT_ELF
+ select COMPAT_BINFMT_ELF if BINFMT_ELF
select HAVE_UID16
select ARCH_WANT_OLD_COMPAT_IPC
select COMPAT_OLD_SIGACTION
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 53/93] misc: eeprom_93xx46: Fix module alias to enable module autoprobe
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 52/93] sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 54/93] misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users Greg Kroah-Hartman
` (43 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aswath Govindraju, Sasha Levin
From: Aswath Govindraju <a-govindraju@ti.com>
[ Upstream commit 13613a2246bf531f5fc04e8e62e8f21a3d39bf1c ]
Fix module autoprobe by correcting module alias to match the string from
/sys/class/.../spi1.0/modalias content.
Fixes: 06b4501e88ad ("misc/eeprom: add driver for microwire 93xx46 EEPROMs")
Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
Link: https://lore.kernel.org/r/20210107163957.28664-2-a-govindraju@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/eeprom/eeprom_93xx46.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
index ff63f05edc763..15c7e3574bcb2 100644
--- a/drivers/misc/eeprom/eeprom_93xx46.c
+++ b/drivers/misc/eeprom/eeprom_93xx46.c
@@ -380,4 +380,4 @@ module_spi_driver(eeprom_93xx46_driver);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs");
MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
-MODULE_ALIAS("spi:93xx46");
+MODULE_ALIAS("spi:eeprom-93xx46");
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 54/93] misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 53/93] misc: eeprom_93xx46: Fix module alias to enable module autoprobe Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 55/93] VMCI: Use set_page_dirty_lock() when unregistering guest memory Greg Kroah-Hartman
` (42 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aswath Govindraju, Sasha Levin
From: Aswath Govindraju <a-govindraju@ti.com>
[ Upstream commit 4540b9fbd8ebb21bb3735796d300a1589ee5fbf2 ]
Module alias "spi:93xx46" is used by non device tree users like
drivers/misc/eeprom/digsy_mtc_eeprom.c and removing it will
break support for them.
Fix this by adding back the module alias "spi:93xx46".
Fixes: 13613a2246bf ("misc: eeprom_93xx46: Fix module alias to enable module autoprobe")
Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
Link: https://lore.kernel.org/r/20210113051253.15061-1-a-govindraju@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/eeprom/eeprom_93xx46.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
index 15c7e3574bcb2..22c1f06728a9c 100644
--- a/drivers/misc/eeprom/eeprom_93xx46.c
+++ b/drivers/misc/eeprom/eeprom_93xx46.c
@@ -380,4 +380,5 @@ module_spi_driver(eeprom_93xx46_driver);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs");
MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
+MODULE_ALIAS("spi:93xx46");
MODULE_ALIAS("spi:eeprom-93xx46");
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 55/93] VMCI: Use set_page_dirty_lock() when unregistering guest memory
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 54/93] misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 56/93] PCI: Align checking of syscall user config accessors Greg Kroah-Hartman
` (41 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vishnu Dasa, Jorgen Hansen, Sasha Levin
From: Jorgen Hansen <jhansen@vmware.com>
[ Upstream commit 5a16c535409f8dcb7568e20737309e3027ae3e49 ]
When the VMCI host support releases guest memory in the case where
the VM was killed, the pinned guest pages aren't locked. Use
set_page_dirty_lock() instead of set_page_dirty().
Testing done: Killed VM while having an active VMCI based vSocket
connection and observed warning from ext4. With this fix, no
warning was observed. Ran various vSocket tests without issues.
Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
Signed-off-by: Jorgen Hansen <jhansen@vmware.com>
Link: https://lore.kernel.org/r/1611160360-30299-1-git-send-email-jhansen@vmware.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/vmw_vmci/vmci_queue_pair.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index e57340e980c4b..44e29d835e246 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -732,7 +732,7 @@ static void qp_release_pages(struct page **pages,
for (i = 0; i < num_pages; i++) {
if (dirty)
- set_page_dirty(pages[i]);
+ set_page_dirty_lock(pages[i]);
page_cache_release(pages[i]);
pages[i] = NULL;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 56/93] PCI: Align checking of syscall user config accessors
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 55/93] VMCI: Use set_page_dirty_lock() when unregistering guest memory Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 57/93] Take mmap lock in cacheflush syscall Greg Kroah-Hartman
` (40 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heiner Kallweit, Bjorn Helgaas, Sasha Levin
From: Heiner Kallweit <hkallweit1@gmail.com>
[ Upstream commit ef9e4005cbaf022c6251263aa27836acccaef65d ]
After 34e3207205ef ("PCI: handle positive error codes"),
pci_user_read_config_*() and pci_user_write_config_*() return 0 or negative
errno values, not PCIBIOS_* values like PCIBIOS_SUCCESSFUL or
PCIBIOS_BAD_REGISTER_NUMBER.
Remove comparisons with PCIBIOS_SUCCESSFUL and check only for non-zero. It
happens that PCIBIOS_SUCCESSFUL is zero, so this is not a functional
change, but it aligns this code with the user accessors.
[bhelgaas: commit log]
Fixes: 34e3207205ef ("PCI: handle positive error codes")
Link: https://lore.kernel.org/r/f1220314-e518-1e18-bf94-8e6f8c703758@gmail.com
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/syscall.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
index b91c4da683657..7958250856d36 100644
--- a/drivers/pci/syscall.c
+++ b/drivers/pci/syscall.c
@@ -21,7 +21,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
u16 word;
u32 dword;
long err;
- long cfg_ret;
+ int cfg_ret;
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
@@ -47,7 +47,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
}
err = -EIO;
- if (cfg_ret != PCIBIOS_SUCCESSFUL)
+ if (cfg_ret)
goto error;
switch (len) {
@@ -105,7 +105,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
if (err)
break;
err = pci_user_write_config_byte(dev, off, byte);
- if (err != PCIBIOS_SUCCESSFUL)
+ if (err)
err = -EIO;
break;
@@ -114,7 +114,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
if (err)
break;
err = pci_user_write_config_word(dev, off, word);
- if (err != PCIBIOS_SUCCESSFUL)
+ if (err)
err = -EIO;
break;
@@ -123,7 +123,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
if (err)
break;
err = pci_user_write_config_dword(dev, off, dword);
- if (err != PCIBIOS_SUCCESSFUL)
+ if (err)
err = -EIO;
break;
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 57/93] Take mmap lock in cacheflush syscall
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 56/93] PCI: Align checking of syscall user config accessors Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 58/93] mm/memory.c: fix potential pte_unmap_unlock pte error Greg Kroah-Hartman
` (39 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jann Horn, Ley Foon Tan, Sasha Levin
From: Jann Horn <jannh@google.com>
[ Upstream commit c26958cb5a0d9053d1358258827638773f3d36ed ]
We need to take the mmap lock around find_vma() and subsequent use of the
VMA. Otherwise, we can race with concurrent operations like munmap(), which
can lead to use-after-free accesses to freed VMAs.
Fixes: 1000197d8013 ("nios2: System calls handling")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/nios2/kernel/sys_nios2.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/arch/nios2/kernel/sys_nios2.c b/arch/nios2/kernel/sys_nios2.c
index cd390ec4f88bf..b1ca856999521 100644
--- a/arch/nios2/kernel/sys_nios2.c
+++ b/arch/nios2/kernel/sys_nios2.c
@@ -22,6 +22,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len,
unsigned int op)
{
struct vm_area_struct *vma;
+ struct mm_struct *mm = current->mm;
if (len == 0)
return 0;
@@ -34,16 +35,22 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len,
if (addr + len < addr)
return -EFAULT;
+ if (mmap_read_lock_killable(mm))
+ return -EINTR;
+
/*
* Verify that the specified address region actually belongs
* to this process.
*/
- vma = find_vma(current->mm, addr);
- if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end)
+ vma = find_vma(mm, addr);
+ if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) {
+ mmap_read_unlock(mm);
return -EFAULT;
+ }
flush_cache_range(vma, addr, addr + len);
+ mmap_read_unlock(mm);
return 0;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 58/93] mm/memory.c: fix potential pte_unmap_unlock pte error
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 57/93] Take mmap lock in cacheflush syscall Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 59/93] mm/hugetlb: fix potential double free in hugetlb_register_node() error path Greg Kroah-Hartman
` (38 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hongxiang Lou, Miaohe Lin,
Thomas Gleixner, Dave Hansen, Andi Kleen, Josh Poimboeuf,
Andrew Morton, Linus Torvalds, Sasha Levin
From: Miaohe Lin <linmiaohe@huawei.com>
[ Upstream commit 90a3e375d324b2255b83e3dd29e99e2b05d82aaf ]
Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
we would break the loop with pte unchanged. Then the wrong pte - 1 would
be passed to pte_unmap_unlock.
Andi said:
"While the fix is correct, I'm not sure if it actually is a real bug.
Is there any architecture that would do something else than unlocking
the underlying page? If it's just the underlying page then it should
be always the same page, so no bug"
Link: https://lkml.kernel.org/r/20210109080118.20885-1-linmiaohe@huawei.com
Fixes: 42e4089c789 ("x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings")
Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com>
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/memory.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mm/memory.c b/mm/memory.c
index fa752df6dc857..86ca97c24f1d9 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1686,11 +1686,11 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
unsigned long addr, unsigned long end,
unsigned long pfn, pgprot_t prot)
{
- pte_t *pte;
+ pte_t *pte, *mapped_pte;
spinlock_t *ptl;
int err = 0;
- pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
+ mapped_pte = pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
if (!pte)
return -ENOMEM;
arch_enter_lazy_mmu_mode();
@@ -1704,7 +1704,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
pfn++;
} while (pte++, addr += PAGE_SIZE, addr != end);
arch_leave_lazy_mmu_mode();
- pte_unmap_unlock(pte - 1, ptl);
+ pte_unmap_unlock(mapped_pte, ptl);
return err;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 59/93] mm/hugetlb: fix potential double free in hugetlb_register_node() error path
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 58/93] mm/memory.c: fix potential pte_unmap_unlock pte error Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 60/93] i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition Greg Kroah-Hartman
` (37 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Miaohe Lin, Mike Kravetz,
Muchun Song, Andrew Morton, Linus Torvalds, Sasha Levin
From: Miaohe Lin <linmiaohe@huawei.com>
[ Upstream commit cc2205a67dec5a700227a693fc113441e73e4641 ]
In hugetlb_sysfs_add_hstate(), we would do kobject_put() on hstate_kobjs
when failed to create sysfs group but forget to set hstate_kobjs to NULL.
Then in hugetlb_register_node() error path, we may free it again via
hugetlb_unregister_node().
Link: https://lkml.kernel.org/r/20210107123249.36964-1-linmiaohe@huawei.com
Fixes: a3437870160c ("hugetlb: new sysfs interface")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Muchun Song <smuchun@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index dc877712ef1f3..7c3ecac8aeb3f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2485,8 +2485,10 @@ static int hugetlb_sysfs_add_hstate(struct hstate *h, struct kobject *parent,
return -ENOMEM;
retval = sysfs_create_group(hstate_kobjs[hi], hstate_attr_group);
- if (retval)
+ if (retval) {
kobject_put(hstate_kobjs[hi]);
+ hstate_kobjs[hi] = NULL;
+ }
return retval;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 60/93] i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 59/93] mm/hugetlb: fix potential double free in hugetlb_register_node() error path Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 61/93] scsi: bnx2fc: Fix Kconfig warning & CNIC build errors Greg Kroah-Hartman
` (36 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Stevenson, Maxime Ripard,
Florian Fainelli, Wolfram Sang, Sasha Levin
From: Maxime Ripard <maxime@cerno.tech>
[ Upstream commit a1858ce0cfe31368b23ba55794e409fb57ced4a4 ]
The brcmstb_send_i2c_cmd currently has a condition that is (CMD_RD ||
CMD_WR) which always evaluates to true, while the obvious fix is to test
whether the cmd variable passed as parameter holds one of these two
values.
Fixes: dd1aa2524bc5 ("i2c: brcmstb: Add Broadcom settop SoC i2c controller driver")
Reported-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-brcmstb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
index 81115abf3c1f5..6e9007adad849 100644
--- a/drivers/i2c/busses/i2c-brcmstb.c
+++ b/drivers/i2c/busses/i2c-brcmstb.c
@@ -304,7 +304,7 @@ static int brcmstb_send_i2c_cmd(struct brcmstb_i2c_dev *dev,
goto cmd_out;
}
- if ((CMD_RD || CMD_WR) &&
+ if ((cmd == CMD_RD || cmd == CMD_WR) &&
bsc_readl(dev, iic_enable) & BSC_IIC_EN_NOACK_MASK) {
rc = -EREMOTEIO;
dev_dbg(dev->device, "controller received NOACK intr for %s\n",
--
2.27.0
^ permalink raw reply related [flat|nested] 99+ messages in thread* [PATCH 4.4 61/93] scsi: bnx2fc: Fix Kconfig warning & CNIC build errors
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 60/93] i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 62/93] block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h> Greg Kroah-Hartman
` (35 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Saurav Kashyap, Javed Hasan,
GR-QLogic-Storage-Upstream, James E.J. Bottomley,
Martin K. Petersen, linux-scsi, kernel test robot, Randy Dunlap,
Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit eefb816acb0162e94a85a857f3a55148f671d5a5 ]
CNIC depends on MMU, but since 'select' does not follow any dependency
chains, SCSI_BNX2X_FCOE also needs to depend on MMU, so that erroneous
configs are not generated, which cause build errors in cnic.
WARNING: unmet direct dependencies detected for CNIC
Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=n] || IPV6 [=n]=n) && MMU [=n]
Selected by [y]:
- SCSI_BNX2X_FCOE [=y] && SCSI_LOWLEVEL [=y] && SCSI [=y] && PCI [=y] && (IPV6 [=n] || IPV6 [=n]=n) && LIBFC [=y] && LIBFCOE [=y]
riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L154':
cnic.c:(.text+0x1094): undefined reference to `uio_event_notify'
riscv64-linux-ld: cnic.c:(.text+0x10bc): undefined reference to `uio_event_notify'
riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L1442':
cnic.c:(.text+0x96a8): undefined reference to `__uio_register_device'
riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L0 ':
cnic.c:(.text.unlikely+0x68): undefined reference to `uio_unregister_device'
Link: https://lore.kernel.org/r/20210213192428.22537-1-rdunlap@infradead.org
Fixes: 853e2bd2103a ("[SCSI] bnx2fc: Broadcom FCoE offload driver")
Cc: Saurav Kashyap <skashyap@marvell.com>
Cc: Javed Hasan <jhasan@marvell.com>
Cc: GR-QLogic-Storage-Upstream@marvell.com
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/bnx2fc/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/scsi/bnx2fc/Kconfig
+++ b/drivers/scsi/bnx2fc/Kconfig
@@ -4,6 +4,7 @@ config SCSI_BNX2X_FCOE
depends on (IPV6 || IPV6=n)
depends on LIBFC
depends on LIBFCOE
+ depends on MMU
select NETDEVICES
select ETHERNET
select NET_VENDOR_BROADCOM
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 62/93] block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 61/93] scsi: bnx2fc: Fix Kconfig warning & CNIC build errors Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 63/93] blk-settings: align max_sectors on "logical_block_size" boundary Greg Kroah-Hartman
` (34 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David S. Miller, Mike Snitzer,
Dan Williams, Minchan Kim, Nitin Gupta, Sergey Senozhatsky,
Christoph Hellwig, Johannes Thumshirn, Martin K. Petersen,
Bart Van Assche, Jens Axboe
From: Bart Van Assche <bart.vanassche@wdc.com>
commit 233bde21aa43516baa013ef7ac33f3427056db3e upstream.
It happens often while I'm preparing a patch for a block driver that
I'm wondering: is a definition of SECTOR_SIZE and/or SECTOR_SHIFT
available for this driver? Do I have to introduce definitions of these
constants before I can use these constants? To avoid this confusion,
move the existing definitions of SECTOR_SIZE and SECTOR_SHIFT into the
<linux/blkdev.h> header file such that these become available for all
block drivers. Make the SECTOR_SIZE definition in the uapi msdos_fs.h
header file conditional to avoid that including that header file after
<linux/blkdev.h> causes the compiler to complain about a SECTOR_SIZE
redefinition.
Note: the SECTOR_SIZE / SECTOR_SHIFT / SECTOR_BITS definitions have
not been removed from uapi header files nor from NAND drivers in
which these constants are used for another purpose than converting
block layer offsets and sizes into a number of sectors.
Cc: David S. Miller <davem@davemloft.net>
Cc: Mike Snitzer <snitzer@redhat.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Nitin Gupta <ngupta@vflare.org>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/xtensa/platforms/iss/simdisk.c | 1
drivers/block/brd.c | 1
drivers/block/rbd.c | 9 -------
drivers/block/zram/zram_drv.h | 1
drivers/ide/ide-cd.c | 8 +++---
drivers/ide/ide-cd.h | 6 -----
drivers/nvdimm/nd.h | 1
drivers/scsi/gdth.h | 3 --
include/linux/blkdev.h | 42 ++++++++++++++++++++++++++----------
include/linux/device-mapper.h | 2 -
include/linux/ide.h | 1
include/uapi/linux/msdos_fs.h | 2 +
12 files changed, 38 insertions(+), 39 deletions(-)
--- a/arch/xtensa/platforms/iss/simdisk.c
+++ b/arch/xtensa/platforms/iss/simdisk.c
@@ -21,7 +21,6 @@
#include <platform/simcall.h>
#define SIMDISK_MAJOR 240
-#define SECTOR_SHIFT 9
#define SIMDISK_MINORS 1
#define MAX_SIMDISK_COUNT 10
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -22,7 +22,6 @@
#include <asm/uaccess.h>
-#define SECTOR_SHIFT 9
#define PAGE_SECTORS_SHIFT (PAGE_SHIFT - SECTOR_SHIFT)
#define PAGE_SECTORS (1 << PAGE_SECTORS_SHIFT)
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -50,15 +50,6 @@
#define RBD_DEBUG /* Activate rbd_assert() calls */
/*
- * The basic unit of block I/O is a sector. It is interpreted in a
- * number of contexts in Linux (blk, bio, genhd), but the default is
- * universally 512 bytes. These symbols are just slightly more
- * meaningful than the bare numbers they represent.
- */
-#define SECTOR_SHIFT 9
-#define SECTOR_SIZE (1ULL << SECTOR_SHIFT)
-
-/*
* Increment the given counter and return its updated value.
* If the counter is already 0 it will not be incremented.
* If the counter is already at its maximum value returns
--- a/drivers/block/zram/zram_drv.h
+++ b/drivers/block/zram/zram_drv.h
@@ -36,7 +36,6 @@ static const size_t max_zpage_size = PAG
/*-- End of configurable params */
-#define SECTOR_SHIFT 9
#define SECTORS_PER_PAGE_SHIFT (PAGE_SHIFT - SECTOR_SHIFT)
#define SECTORS_PER_PAGE (1 << SECTORS_PER_PAGE_SHIFT)
#define ZRAM_LOGICAL_BLOCK_SHIFT 12
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -704,7 +704,7 @@ static ide_startstop_t cdrom_start_rw(id
struct request_queue *q = drive->queue;
int write = rq_data_dir(rq) == WRITE;
unsigned short sectors_per_frame =
- queue_logical_block_size(q) >> SECTOR_BITS;
+ queue_logical_block_size(q) >> SECTOR_SHIFT;
ide_debug_log(IDE_DBG_RQ, "rq->cmd[0]: 0x%x, rq->cmd_flags: 0x%x, "
"secs_per_frame: %u",
@@ -900,7 +900,7 @@ static int cdrom_read_capacity(ide_drive
* end up being bogus.
*/
blocklen = be32_to_cpu(capbuf.blocklen);
- blocklen = (blocklen >> SECTOR_BITS) << SECTOR_BITS;
+ blocklen = (blocklen >> SECTOR_SHIFT) << SECTOR_SHIFT;
switch (blocklen) {
case 512:
case 1024:
@@ -916,7 +916,7 @@ static int cdrom_read_capacity(ide_drive
}
*capacity = 1 + be32_to_cpu(capbuf.lba);
- *sectors_per_frame = blocklen >> SECTOR_BITS;
+ *sectors_per_frame = blocklen >> SECTOR_SHIFT;
ide_debug_log(IDE_DBG_PROBE, "cap: %lu, sectors_per_frame: %lu",
*capacity, *sectors_per_frame);
@@ -993,7 +993,7 @@ int ide_cd_read_toc(ide_drive_t *drive,
drive->probed_capacity = toc->capacity * sectors_per_frame;
blk_queue_logical_block_size(drive->queue,
- sectors_per_frame << SECTOR_BITS);
+ sectors_per_frame << SECTOR_SHIFT);
/* first read just the header, so we know how long the TOC is */
stat = cdrom_read_tocentry(drive, 0, 1, 0, (char *) &toc->hdr,
--- a/drivers/ide/ide-cd.h
+++ b/drivers/ide/ide-cd.h
@@ -20,11 +20,7 @@
/************************************************************************/
-#define SECTOR_BITS 9
-#ifndef SECTOR_SIZE
-#define SECTOR_SIZE (1 << SECTOR_BITS)
-#endif
-#define SECTORS_PER_FRAME (CD_FRAMESIZE >> SECTOR_BITS)
+#define SECTORS_PER_FRAME (CD_FRAMESIZE >> SECTOR_SHIFT)
#define SECTOR_BUFFER_SIZE (CD_FRAMESIZE * 32)
/* Capabilities Page size including 8 bytes of Mode Page Header */
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -27,7 +27,6 @@ enum {
* BTT instance
*/
ND_MAX_LANES = 256,
- SECTOR_SHIFT = 9,
INT_LBASIZE_ALIGNMENT = 64,
#if IS_ENABLED(CONFIG_NVDIMM_PFN)
ND_PFN_ALIGN = PAGES_PER_SECTION * PAGE_SIZE,
--- a/drivers/scsi/gdth.h
+++ b/drivers/scsi/gdth.h
@@ -177,9 +177,6 @@
#define MSG_SIZE 34 /* size of message structure */
#define MSG_REQUEST 0 /* async. event: message */
-/* cacheservice defines */
-#define SECTOR_SIZE 0x200 /* always 512 bytes per sec. */
-
/* DPMEM constants */
#define DPMEM_MAGIC 0xC0FFEE11
#define IC_HEADER_BYTES 48
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -833,6 +833,19 @@ static inline struct request_queue *bdev
}
/*
+ * The basic unit of block I/O is a sector. It is used in a number of contexts
+ * in Linux (blk, bio, genhd). The size of one sector is 512 = 2**9
+ * bytes. Variables of type sector_t represent an offset or size that is a
+ * multiple of 512 bytes. Hence these two constants.
+ */
+#ifndef SECTOR_SHIFT
+#define SECTOR_SHIFT 9
+#endif
+#ifndef SECTOR_SIZE
+#define SECTOR_SIZE (1 << SECTOR_SHIFT)
+#endif
+
+/*
* blk_rq_pos() : the current sector
* blk_rq_bytes() : bytes left in the entire request
* blk_rq_cur_bytes() : bytes left in the current segment
@@ -859,19 +872,20 @@ extern unsigned int blk_rq_err_bytes(con
static inline unsigned int blk_rq_sectors(const struct request *rq)
{
- return blk_rq_bytes(rq) >> 9;
+ return blk_rq_bytes(rq) >> SECTOR_SHIFT;
}
static inline unsigned int blk_rq_cur_sectors(const struct request *rq)
{
- return blk_rq_cur_bytes(rq) >> 9;
+ return blk_rq_cur_bytes(rq) >> SECTOR_SHIFT;
}
static inline unsigned int blk_queue_get_max_sectors(struct request_queue *q,
unsigned int cmd_flags)
{
if (unlikely(cmd_flags & REQ_DISCARD))
- return min(q->limits.max_discard_sectors, UINT_MAX >> 9);
+ return min(q->limits.max_discard_sectors,
+ UINT_MAX >> SECTOR_SHIFT);
if (unlikely(cmd_flags & REQ_WRITE_SAME))
return q->limits.max_write_same_sectors;
@@ -1134,16 +1148,21 @@ extern int blkdev_issue_zeroout(struct b
static inline int sb_issue_discard(struct super_block *sb, sector_t block,
sector_t nr_blocks, gfp_t gfp_mask, unsigned long flags)
{
- return blkdev_issue_discard(sb->s_bdev, block << (sb->s_blocksize_bits - 9),
- nr_blocks << (sb->s_blocksize_bits - 9),
+ return blkdev_issue_discard(sb->s_bdev,
+ block << (sb->s_blocksize_bits -
+ SECTOR_SHIFT),
+ nr_blocks << (sb->s_blocksize_bits -
+ SECTOR_SHIFT),
gfp_mask, flags);
}
static inline int sb_issue_zeroout(struct super_block *sb, sector_t block,
sector_t nr_blocks, gfp_t gfp_mask)
{
return blkdev_issue_zeroout(sb->s_bdev,
- block << (sb->s_blocksize_bits - 9),
- nr_blocks << (sb->s_blocksize_bits - 9),
+ block << (sb->s_blocksize_bits -
+ SECTOR_SHIFT),
+ nr_blocks << (sb->s_blocksize_bits -
+ SECTOR_SHIFT),
gfp_mask, true);
}
@@ -1250,7 +1269,8 @@ static inline int queue_alignment_offset
static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t sector)
{
unsigned int granularity = max(lim->physical_block_size, lim->io_min);
- unsigned int alignment = sector_div(sector, granularity >> 9) << 9;
+ unsigned int alignment = sector_div(sector, granularity >> SECTOR_SHIFT)
+ << SECTOR_SHIFT;
return (granularity + lim->alignment_offset - alignment) % granularity;
}
@@ -1284,8 +1304,8 @@ static inline int queue_limit_discard_al
return 0;
/* Why are these in bytes, not sectors? */
- alignment = lim->discard_alignment >> 9;
- granularity = lim->discard_granularity >> 9;
+ alignment = lim->discard_alignment >> SECTOR_SHIFT;
+ granularity = lim->discard_granularity >> SECTOR_SHIFT;
if (!granularity)
return 0;
@@ -1296,7 +1316,7 @@ static inline int queue_limit_discard_al
offset = (granularity + alignment - offset) % granularity;
/* Turn it back into bytes, gaah */
- return offset << 9;
+ return offset << SECTOR_SHIFT;
}
static inline int bdev_discard_alignment(struct block_device *bdev)
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -543,8 +543,6 @@ extern struct ratelimit_state dm_ratelim
#define DMEMIT(x...) sz += ((sz >= maxlen) ? \
0 : scnprintf(result + sz, maxlen - sz, x))
-#define SECTOR_SHIFT 9
-
/*
* Definitions of return values from target end_io function.
*/
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -128,7 +128,6 @@ struct ide_io_ports {
*/
#define PARTN_BITS 6 /* number of minor dev bits for partitions */
#define MAX_DRIVES 2 /* per interface; 2 assumed by lots of code */
-#define SECTOR_SIZE 512
/*
* Timeouts for various operations:
--- a/include/uapi/linux/msdos_fs.h
+++ b/include/uapi/linux/msdos_fs.h
@@ -9,7 +9,9 @@
* The MS-DOS filesystem constants/structures
*/
+#ifndef SECTOR_SIZE
#define SECTOR_SIZE 512 /* sector size (bytes) */
+#endif
#define SECTOR_BITS 9 /* log2(SECTOR_SIZE) */
#define MSDOS_DPB (MSDOS_DPS) /* dir entries per block */
#define MSDOS_DPB_BITS 4 /* log2(MSDOS_DPB) */
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 63/93] blk-settings: align max_sectors on "logical_block_size" boundary
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 62/93] block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h> Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 64/93] Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S Greg Kroah-Hartman
` (33 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ming Lei, Mikulas Patocka, Jens Axboe
From: Mikulas Patocka <mpatocka@redhat.com>
commit 97f433c3601a24d3513d06f575a389a2ca4e11e4 upstream.
We get I/O errors when we run md-raid1 on the top of dm-integrity on the
top of ramdisk.
device-mapper: integrity: Bio not aligned on 8 sectors: 0xff00, 0xff
device-mapper: integrity: Bio not aligned on 8 sectors: 0xff00, 0xff
device-mapper: integrity: Bio not aligned on 8 sectors: 0xffff, 0x1
device-mapper: integrity: Bio not aligned on 8 sectors: 0xffff, 0x1
device-mapper: integrity: Bio not aligned on 8 sectors: 0x8048, 0xff
device-mapper: integrity: Bio not aligned on 8 sectors: 0x8147, 0xff
device-mapper: integrity: Bio not aligned on 8 sectors: 0x8246, 0xff
device-mapper: integrity: Bio not aligned on 8 sectors: 0x8345, 0xbb
The ramdisk device has logical_block_size 512 and max_sectors 255. The
dm-integrity device uses logical_block_size 4096 and it doesn't affect the
"max_sectors" value - thus, it inherits 255 from the ramdisk. So, we have
a device with max_sectors not aligned on logical_block_size.
The md-raid device sees that the underlying leg has max_sectors 255 and it
will split the bios on 255-sector boundary, making the bios unaligned on
logical_block_size.
In order to fix the bug, we round down max_sectors to logical_block_size.
Cc: stable@vger.kernel.org
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-settings.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -494,6 +494,14 @@ void blk_queue_stack_limits(struct reque
}
EXPORT_SYMBOL(blk_queue_stack_limits);
+static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lbs)
+{
+ sectors = round_down(sectors, lbs >> SECTOR_SHIFT);
+ if (sectors < PAGE_SIZE >> SECTOR_SHIFT)
+ sectors = PAGE_SIZE >> SECTOR_SHIFT;
+ return sectors;
+}
+
/**
* blk_stack_limits - adjust queue_limits for stacked devices
* @t: the stacking driver limits (top device)
@@ -606,6 +614,10 @@ int blk_stack_limits(struct queue_limits
ret = -1;
}
+ t->max_sectors = blk_round_down_sectors(t->max_sectors, t->logical_block_size);
+ t->max_hw_sectors = blk_round_down_sectors(t->max_hw_sectors, t->logical_block_size);
+ t->max_dev_sectors = blk_round_down_sectors(t->max_dev_sectors, t->logical_block_size);
+
/* Discard alignment and granularity */
if (b->discard_granularity) {
alignment = queue_limit_discard_alignment(b, start);
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 64/93] Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 63/93] blk-settings: align max_sectors on "logical_block_size" boundary Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 65/93] Input: joydev - prevent potential read overflow in ioctl Greg Kroah-Hartman
` (32 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Olivier Crête, Dmitry Torokhov
From: Olivier Crête <olivier.crete@ocrete.ca>
commit 42ffcd1dba1796bcda386eb6f260df9fc23c90af upstream.
Signed-off-by: Olivier Crête <olivier.crete@ocrete.ca>
Link: https://lore.kernel.org/r/20210204005318.615647-1-olivier.crete@collabora.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/xpad.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -322,6 +322,7 @@ static const struct xpad_device {
{ 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 },
{ 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 },
{ 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
+ { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE },
{ 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 },
{ 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
{ 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 65/93] Input: joydev - prevent potential read overflow in ioctl
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 64/93] Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 66/93] Input: i8042 - add ASUS Zenbook Flip to noselftest list Greg Kroah-Hartman
` (31 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Dmitry Torokhov
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream.
The problem here is that "len" might be less than "joydev->nabs" so the
loops which verfy abspam[i] and keypam[] might read beyond the buffer.
Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda
[dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP]
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joydev.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -448,7 +448,7 @@ static int joydev_handle_JSIOCSAXMAP(str
if (IS_ERR(abspam))
return PTR_ERR(abspam);
- for (i = 0; i < joydev->nabs; i++) {
+ for (i = 0; i < len && i < joydev->nabs; i++) {
if (abspam[i] > ABS_MAX) {
retval = -EINVAL;
goto out;
@@ -472,6 +472,9 @@ static int joydev_handle_JSIOCSBTNMAP(st
int i;
int retval = 0;
+ if (len % sizeof(*keypam))
+ return -EINVAL;
+
len = min(len, sizeof(joydev->keypam));
/* Validate the map. */
@@ -479,7 +482,7 @@ static int joydev_handle_JSIOCSBTNMAP(st
if (IS_ERR(keypam))
return PTR_ERR(keypam);
- for (i = 0; i < joydev->nkey; i++) {
+ for (i = 0; i < (len / 2) && i < joydev->nkey; i++) {
if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) {
retval = -EINVAL;
goto out;
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 66/93] Input: i8042 - add ASUS Zenbook Flip to noselftest list
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 65/93] Input: joydev - prevent potential read overflow in ioctl Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 67/93] USB: serial: option: update interface mapping for ZTE P685M Greg Kroah-Hartman
` (30 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ludvig Norgren Guldhag,
Marcos Paulo de Souza, Dmitry Torokhov
From: Marcos Paulo de Souza <mpdesouza@suse.com>
commit b5d6e7ab7fe7d186878142e9fc1a05e4c3b65eb9 upstream.
After commit 77b425399f6d ("Input: i8042 - use chassis info to skip
selftest on Asus laptops"), all modern Asus laptops have the i8042
selftest disabled. It has done by using chassys type "10" (laptop).
The Asus Zenbook Flip suffers from similar suspend/resume issues, but
it _sometimes_ work and sometimes it doesn't. Setting noselftest makes
it work reliably. In this case, we need to add chassis type "31"
(convertible) in order to avoid selftest in this device.
Reported-by: Ludvig Norgren Guldhag <ludvigng@gmail.com>
Signed-off-by: Marcos Paulo de Souza <mpdesouza@suse.com>
Link: https://lore.kernel.org/r/20210219164638.761-1-mpdesouza@suse.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-x86ia64io.h | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -579,6 +579,10 @@ static const struct dmi_system_id i8042_
DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"),
},
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
+ },
},
{ }
};
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 67/93] USB: serial: option: update interface mapping for ZTE P685M
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 66/93] Input: i8042 - add ASUS Zenbook Flip to noselftest list Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 68/93] USB: serial: mos7840: fix error code in mos7840_write() Greg Kroah-Hartman
` (29 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Bjørn Mork, Lech Perczak
From: Lech Perczak <lech.perczak@gmail.com>
commit 6420a569504e212d618d4a4736e2c59ed80a8478 upstream.
This patch prepares for qmi_wwan driver support for the device.
Previously "option" driver mapped itself to interfaces 0 and 3 (matching
ff/ff/ff), while interface 3 is in fact a QMI port.
Interfaces 1 and 2 (matching ff/00/00) expose AT commands,
and weren't supported previously at all.
Without this patch, a possible conflict would exist if device ID was
added to qmi_wwan driver for interface 3.
Update and simplify device ID to match interfaces 0-2 directly,
to expose QCDM (0), PCUI (1), and modem (2) ports and avoid conflict
with QMI (3), and ADB (4).
The modem is used inside ZTE MF283+ router and carriers identify it as
such.
Interface mapping is:
0: QCDM, 1: AT (PCUI), 2: AT (Modem), 3: QMI, 4: ADB
T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=19d2 ProdID=1275 Rev=f0.00
S: Manufacturer=ZTE,Incorporated
S: Product=ZTE Technologies MSM
S: SerialNumber=P685M510ZTED0000CP&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&0
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E: Ad=87(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Cc: Johan Hovold <johan@kernel.org>
Cc: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://lore.kernel.org/r/20210207005443.12936-1-lech.perczak@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1551,7 +1551,8 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) },
- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1275, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ZTE_VENDOR_ID, 0x1275), /* ZTE P685M */
+ .driver_info = RSVD(3) | RSVD(4) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) },
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 68/93] USB: serial: mos7840: fix error code in mos7840_write()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 67/93] USB: serial: option: update interface mapping for ZTE P685M Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 69/93] USB: serial: mos7720: fix error code in mos7720_write() Greg Kroah-Hartman
` (28 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Johan Hovold
From: Dan Carpenter <dan.carpenter@oracle.com>
commit a70aa7dc60099bbdcbd6faca42a915d80f31161e upstream.
This should return -ENOMEM instead of 0 if the kmalloc() fails.
Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/mos7840.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1362,8 +1362,10 @@ static int mos7840_write(struct tty_stru
if (urb->transfer_buffer == NULL) {
urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
GFP_ATOMIC);
- if (!urb->transfer_buffer)
+ if (!urb->transfer_buffer) {
+ bytes_sent = -ENOMEM;
goto exit;
+ }
}
transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 69/93] USB: serial: mos7720: fix error code in mos7720_write()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 68/93] USB: serial: mos7840: fix error code in mos7840_write() Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 70/93] usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1 Greg Kroah-Hartman
` (27 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Johan Hovold
From: Dan Carpenter <dan.carpenter@oracle.com>
commit fea7372cbc40869876df0f045e367f6f97a1666c upstream.
This code should return -ENOMEM if the kmalloc() fails but instead
it returns success.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 0f64478cbc7a ("USB: add USB serial mos7720 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/mos7720.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -1239,8 +1239,10 @@ static int mos7720_write(struct tty_stru
if (urb->transfer_buffer == NULL) {
urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
GFP_ATOMIC);
- if (!urb->transfer_buffer)
+ if (!urb->transfer_buffer) {
+ bytes_sent = -ENOMEM;
goto exit;
+ }
}
transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 70/93] usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 69/93] USB: serial: mos7720: fix error code in mos7720_write() Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 71/93] usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt Greg Kroah-Hartman
` (26 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thinh Nguyen
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit a1679af85b2ae35a2b78ad04c18bb069c37330cc upstream.
Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it must be set
to 0 when the controller operates in full-speed. See the programming
guide for DEPCFG command section 3.2.2.1 (v3.30a).
Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/3f57026f993c0ce71498dbb06e49b3a47c4d0265.1612820995.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/gadget.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -521,7 +521,17 @@ static int dwc3_gadget_set_ep_config(str
params.param0 |= DWC3_DEPCFG_FIFO_NUMBER(dep->number >> 1);
if (desc->bInterval) {
- params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(desc->bInterval - 1);
+ u8 bInterval_m1;
+
+ /*
+ * Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it
+ * must be set to 0 when the controller operates in full-speed.
+ */
+ bInterval_m1 = min_t(u8, desc->bInterval - 1, 13);
+ if (dwc->gadget.speed == USB_SPEED_FULL)
+ bInterval_m1 = 0;
+
+ params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1);
dep->interval = 1 << (desc->bInterval - 1);
}
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 71/93] usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 70/93] usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1 Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 72/93] KEYS: trusted: Fix migratable=1 failing Greg Kroah-Hartman
` (25 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thinh Nguyen
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit 4b049f55ed95cd889bcdb3034fd75e1f01852b38 upstream.
The dep->interval captures the number of frames/microframes per interval
from bInterval. Fullspeed interrupt endpoint bInterval is the number of
frames per interval and not 2^(bInterval - 1). So fix it here. This
change is only for debugging purpose and should not affect the interrupt
endpoint operation.
Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/1263b563dedc4ab8b0fb854fba06ce4bc56bd495.1612820995.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/gadget.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -531,8 +531,13 @@ static int dwc3_gadget_set_ep_config(str
if (dwc->gadget.speed == USB_SPEED_FULL)
bInterval_m1 = 0;
+ if (usb_endpoint_type(desc) == USB_ENDPOINT_XFER_INT &&
+ dwc->gadget.speed == USB_SPEED_FULL)
+ dep->interval = desc->bInterval;
+ else
+ dep->interval = 1 << (desc->bInterval - 1);
+
params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1);
- dep->interval = 1 << (desc->bInterval - 1);
}
return dwc3_send_gadget_ep_cmd(dwc, dep->number,
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 72/93] KEYS: trusted: Fix migratable=1 failing
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 71/93] usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 73/93] btrfs: fix reloc root leak with 0 ref reloc roots on recovery Greg Kroah-Hartman
` (24 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James E.J. Bottomley, Mimi Zohar,
David Howells, Jarkko Sakkinen
From: Jarkko Sakkinen <jarkko@kernel.org>
commit 8da7520c80468c48f981f0b81fc1be6599e3b0ad upstream.
Consider the following transcript:
$ keyctl add trusted kmk "new 32 blobauth=helloworld keyhandle=80000000 migratable=1" @u
add_key: Invalid argument
The documentation has the following description:
migratable= 0|1 indicating permission to reseal to new PCR values,
default 1 (resealing allowed)
The consequence is that "migratable=1" should succeed. Fix this by
allowing this condition to pass instead of return -EINVAL.
[*] Documentation/security/keys/trusted-encrypted.rst
Cc: stable@vger.kernel.org
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: Mimi Zohar <zohar@linux.ibm.com>
Cc: David Howells <dhowells@redhat.com>
Fixes: d00a1c72f7f4 ("keys: add new trusted key-type")
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/keys/trusted.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -778,7 +778,7 @@ static int getoptions(char *c, struct tr
case Opt_migratable:
if (*args[0].from == '0')
pay->migratable = 0;
- else
+ else if (*args[0].from != '1')
return -EINVAL;
break;
case Opt_pcrlock:
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 73/93] btrfs: fix reloc root leak with 0 ref reloc roots on recovery
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 72/93] KEYS: trusted: Fix migratable=1 failing Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 74/93] drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue Greg Kroah-Hartman
` (23 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Josef Bacik, David Sterba
From: Josef Bacik <josef@toxicpanda.com>
commit c78a10aebb275c38d0cfccae129a803fe622e305 upstream.
When recovering a relocation, if we run into a reloc root that has 0
refs we simply add it to the reloc_control->reloc_roots list, and then
clean it up later. The problem with this is __del_reloc_root() doesn't
do anything if the root isn't in the radix tree, which in this case it
won't be because we never call __add_reloc_root() on the reloc_root.
This exit condition simply isn't correct really. During normal
operation we can remove ourselves from the rb tree and then we're meant
to clean up later at merge_reloc_roots() time, and this happens
correctly. During recovery we're depending on free_reloc_roots() to
drop our references, but we're short-circuiting.
Fix this by continuing to check if we're on the list and dropping
ourselves from the reloc_control root list and dropping our reference
appropriately. Change the corresponding BUG_ON() to an ASSERT() that
does the correct thing if we aren't in the rb tree.
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/relocation.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1328,9 +1328,7 @@ static void __del_reloc_root(struct btrf
RB_CLEAR_NODE(&node->rb_node);
}
spin_unlock(&rc->reloc_root_tree.lock);
- if (!node)
- return;
- BUG_ON((struct btrfs_root *)node->data != root);
+ ASSERT(!node || (struct btrfs_root *)node->data == root);
}
spin_lock(&root->fs_info->trans_lock);
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 74/93] drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 73/93] btrfs: fix reloc root leak with 0 ref reloc roots on recovery Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 75/93] staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table Greg Kroah-Hartman
` (22 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+15ec7391f3d6a1a7cc7d,
Sabyrzhan Tasbolatov
From: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
commit 2fd10bcf0310b9525b2af9e1f7aa9ddd87c3772e upstream.
syzbot found WARNING in qp_broker_alloc[1] in qp_host_alloc_queue()
when num_pages is 0x100001, giving queue_size + queue_page_size
bigger than KMALLOC_MAX_SIZE for kzalloc(), resulting order >= MAX_ORDER
condition.
queue_size + queue_page_size=0x8000d8, where KMALLOC_MAX_SIZE=0x400000.
[1]
Call Trace:
alloc_pages include/linux/gfp.h:547 [inline]
kmalloc_order+0x40/0x130 mm/slab_common.c:837
kmalloc_order_trace+0x15/0x70 mm/slab_common.c:853
kmalloc_large include/linux/slab.h:481 [inline]
__kmalloc+0x257/0x330 mm/slub.c:3959
kmalloc include/linux/slab.h:557 [inline]
kzalloc include/linux/slab.h:682 [inline]
qp_host_alloc_queue drivers/misc/vmw_vmci/vmci_queue_pair.c:540 [inline]
qp_broker_create drivers/misc/vmw_vmci/vmci_queue_pair.c:1351 [inline]
qp_broker_alloc+0x936/0x2740 drivers/misc/vmw_vmci/vmci_queue_pair.c:1739
Reported-by: syzbot+15ec7391f3d6a1a7cc7d@syzkaller.appspotmail.com
Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
Link: https://lore.kernel.org/r/20210209102612.2112247-1-snovitoll@gmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/vmw_vmci/vmci_queue_pair.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -639,6 +639,9 @@ static struct vmci_queue *qp_host_alloc_
queue_page_size = num_pages * sizeof(*queue->kernel_if->u.h.page);
+ if (queue_size + queue_page_size > KMALLOC_MAX_SIZE)
+ return NULL;
+
queue = kzalloc(queue_size + queue_page_size, GFP_KERNEL);
if (queue) {
queue->q_header = NULL;
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 75/93] staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 74/93] drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 76/93] x86/reboot: Force all cpus to exit VMX root if VMX is supported Greg Kroah-Hartman
` (21 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Kaiser
From: Martin Kaiser <martin@kaiser.cx>
commit 7a8d2f1908a59003e55ef8691d09efb7fbc51625 upstream.
The Edimax EW-7811UN V2 uses an RTL8188EU chipset and works with this
driver.
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210204085217.9743-1-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -53,6 +53,7 @@ static struct usb_device_id rtw_usb_id_t
{USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
{USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */
{USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
+ {USB_DEVICE(0x7392, 0xb811)}, /* Edimax EW-7811UN V2 */
{USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
{} /* Terminating entry */
};
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 76/93] x86/reboot: Force all cpus to exit VMX root if VMX is supported
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 75/93] staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 77/93] floppy: reintroduce O_NDELAY fix Greg Kroah-Hartman
` (20 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sean Christopherson, David P. Reed,
Paolo Bonzini
From: Sean Christopherson <seanjc@google.com>
commit ed72736183c45a413a8d6974dd04be90f514cb6b upstream.
Force all CPUs to do VMXOFF (via NMI shootdown) during an emergency
reboot if VMX is _supported_, as VMX being off on the current CPU does
not prevent other CPUs from being in VMX root (post-VMXON). This fixes
a bug where a crash/panic reboot could leave other CPUs in VMX root and
prevent them from being woken via INIT-SIPI-SIPI in the new kernel.
Fixes: d176720d34c7 ("x86: disable VMX on all CPUs on reboot")
Cc: stable@vger.kernel.org
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: David P. Reed <dpreed@deepplum.com>
[sean: reworked changelog and further tweaked comment]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20201231002702.2223707-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/reboot.c | 29 ++++++++++-------------------
1 file changed, 10 insertions(+), 19 deletions(-)
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -479,29 +479,20 @@ static void emergency_vmx_disable_all(vo
local_irq_disable();
/*
- * We need to disable VMX on all CPUs before rebooting, otherwise
- * we risk hanging up the machine, because the CPU ignore INIT
- * signals when VMX is enabled.
+ * Disable VMX on all CPUs before rebooting, otherwise we risk hanging
+ * the machine, because the CPU blocks INIT when it's in VMX root.
*
- * We can't take any locks and we may be on an inconsistent
- * state, so we use NMIs as IPIs to tell the other CPUs to disable
- * VMX and halt.
+ * We can't take any locks and we may be on an inconsistent state, so
+ * use NMIs as IPIs to tell the other CPUs to exit VMX root and halt.
*
- * For safety, we will avoid running the nmi_shootdown_cpus()
- * stuff unnecessarily, but we don't have a way to check
- * if other CPUs have VMX enabled. So we will call it only if the
- * CPU we are running on has VMX enabled.
- *
- * We will miss cases where VMX is not enabled on all CPUs. This
- * shouldn't do much harm because KVM always enable VMX on all
- * CPUs anyway. But we can miss it on the small window where KVM
- * is still enabling VMX.
+ * Do the NMI shootdown even if VMX if off on _this_ CPU, as that
+ * doesn't prevent a different CPU from being in VMX root operation.
*/
- if (cpu_has_vmx() && cpu_vmx_enabled()) {
- /* Disable VMX on this CPU. */
- cpu_vmxoff();
+ if (cpu_has_vmx()) {
+ /* Safely force _this_ CPU out of VMX root operation. */
+ __cpu_emergency_vmxoff();
- /* Halt and disable VMX on the other CPUs */
+ /* Halt and exit VMX root operation on the other CPUs. */
nmi_shootdown_cpus(vmxoff_nmi);
}
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 77/93] floppy: reintroduce O_NDELAY fix
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 76/93] x86/reboot: Force all cpus to exit VMX root if VMX is supported Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 78/93] mm: hugetlb: fix a race between freeing and dissolving the page Greg Kroah-Hartman
` (19 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wim Osterholt, Jiri Kosina,
Denis Efremov, Kurt Garloff
From: Jiri Kosina <jkosina@suse.cz>
commit 8a0c014cd20516ade9654fc13b51345ec58e7be8 upstream.
This issue was originally fixed in 09954bad4 ("floppy: refactor open()
flags handling").
The fix as a side-effect, however, introduce issue for open(O_ACCMODE)
that is being used for ioctl-only open. I wrote a fix for that, but
instead of it being merged, full revert of 09954bad4 was performed,
re-introducing the O_NDELAY / O_NONBLOCK issue, and it strikes again.
This is a forward-port of the original fix to current codebase; the
original submission had the changelog below:
====
Commit 09954bad4 ("floppy: refactor open() flags handling"), as a
side-effect, causes open(/dev/fdX, O_ACCMODE) to fail. It turns out that
this is being used setfdprm userspace for ioctl-only open().
Reintroduce back the original behavior wrt !(FMODE_READ|FMODE_WRITE)
modes, while still keeping the original O_NDELAY bug fixed.
Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2101221209060.5622@cbobk.fhfr.pm
Cc: stable@vger.kernel.org
Reported-by: Wim Osterholt <wim@djo.tudelft.nl>
Tested-by: Wim Osterholt <wim@djo.tudelft.nl>
Reported-and-tested-by: Kurt Garloff <kurt@garloff.de>
Fixes: 09954bad4 ("floppy: refactor open() flags handling")
Fixes: f2791e7ead ("Revert "floppy: refactor open() flags handling"")
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/floppy.c | 27 ++++++++++++++-------------
1 file changed, 14 insertions(+), 13 deletions(-)
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4066,21 +4066,22 @@ static int floppy_open(struct block_devi
if (UFDCS->rawcmd == 1)
UFDCS->rawcmd = 2;
- if (!(mode & FMODE_NDELAY)) {
- if (mode & (FMODE_READ|FMODE_WRITE)) {
- UDRS->last_checked = 0;
- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
- check_disk_change(bdev);
- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
- goto out;
- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
- goto out;
- }
- res = -EROFS;
- if ((mode & FMODE_WRITE) &&
- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
+ if (mode & (FMODE_READ|FMODE_WRITE)) {
+ UDRS->last_checked = 0;
+ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+ check_disk_change(bdev);
+ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+ goto out;
+ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
goto out;
}
+
+ res = -EROFS;
+
+ if ((mode & FMODE_WRITE) &&
+ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
+ goto out;
+
mutex_unlock(&open_lock);
mutex_unlock(&floppy_mutex);
return 0;
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 78/93] mm: hugetlb: fix a race between freeing and dissolving the page
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 77/93] floppy: reintroduce O_NDELAY fix Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 79/93] usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop() Greg Kroah-Hartman
` (18 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Muchun Song, Mike Kravetz,
Oscar Salvador, Michal Hocko, David Hildenbrand, Yang Shi,
Andrew Morton, Linus Torvalds, Sudip Mukherjee
From: Muchun Song <songmuchun@bytedance.com>
commit 7ffddd499ba6122b1a07828f023d1d67629aa017 upstream
There is a race condition between __free_huge_page()
and dissolve_free_huge_page().
CPU0: CPU1:
// page_count(page) == 1
put_page(page)
__free_huge_page(page)
dissolve_free_huge_page(page)
spin_lock(&hugetlb_lock)
// PageHuge(page) && !page_count(page)
update_and_free_page(page)
// page is freed to the buddy
spin_unlock(&hugetlb_lock)
spin_lock(&hugetlb_lock)
clear_page_huge_active(page)
enqueue_huge_page(page)
// It is wrong, the page is already freed
spin_unlock(&hugetlb_lock)
The race window is between put_page() and dissolve_free_huge_page().
We should make sure that the page is already on the free list when it is
dissolved.
As a result __free_huge_page would corrupt page(s) already in the buddy
allocator.
Link: https://lkml.kernel.org/r/20210115124942.46403-4-songmuchun@bytedance.com
Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Yang Shi <shy828301@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 39 +++++++++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -66,6 +66,21 @@ DEFINE_SPINLOCK(hugetlb_lock);
static int num_fault_mutexes;
struct mutex *hugetlb_fault_mutex_table ____cacheline_aligned_in_smp;
+static inline bool PageHugeFreed(struct page *head)
+{
+ return page_private(head + 4) == -1UL;
+}
+
+static inline void SetPageHugeFreed(struct page *head)
+{
+ set_page_private(head + 4, -1UL);
+}
+
+static inline void ClearPageHugeFreed(struct page *head)
+{
+ set_page_private(head + 4, 0);
+}
+
/* Forward declaration */
static int hugetlb_acct_memory(struct hstate *h, long delta);
@@ -841,6 +856,7 @@ static void enqueue_huge_page(struct hst
list_move(&page->lru, &h->hugepage_freelists[nid]);
h->free_huge_pages++;
h->free_huge_pages_node[nid]++;
+ SetPageHugeFreed(page);
}
static struct page *dequeue_huge_page_node(struct hstate *h, int nid)
@@ -858,6 +874,7 @@ static struct page *dequeue_huge_page_no
return NULL;
list_move(&page->lru, &h->hugepage_activelist);
set_page_refcounted(page);
+ ClearPageHugeFreed(page);
h->free_huge_pages--;
h->free_huge_pages_node[nid]--;
return page;
@@ -1266,6 +1283,7 @@ static void prep_new_huge_page(struct hs
set_hugetlb_cgroup(page, NULL);
h->nr_huge_pages++;
h->nr_huge_pages_node[nid]++;
+ ClearPageHugeFreed(page);
spin_unlock(&hugetlb_lock);
put_page(page); /* free it into the hugepage allocator */
}
@@ -1424,11 +1442,32 @@ static int free_pool_huge_page(struct hs
*/
static void dissolve_free_huge_page(struct page *page)
{
+retry:
spin_lock(&hugetlb_lock);
if (PageHuge(page) && !page_count(page)) {
struct page *head = compound_head(page);
struct hstate *h = page_hstate(head);
int nid = page_to_nid(head);
+
+ /*
+ * We should make sure that the page is already on the free list
+ * when it is dissolved.
+ */
+ if (unlikely(!PageHugeFreed(head))) {
+ spin_unlock(&hugetlb_lock);
+ cond_resched();
+
+ /*
+ * Theoretically, we should return -EBUSY when we
+ * encounter this race. In fact, we have a chance
+ * to successfully dissolve the page if we do a
+ * retry. Because the race window is quite small.
+ * If we seize this opportunity, it is an optimization
+ * for increasing the success rate of dissolving page.
+ */
+ goto retry;
+ }
+
list_del(&head->lru);
h->free_huge_pages--;
h->free_huge_pages_node[nid]--;
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 79/93] usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 78/93] mm: hugetlb: fix a race between freeing and dissolving the page Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 80/93] libnvdimm/dimm: Avoid race between probe and available_slots_show() Greg Kroah-Hartman
` (17 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tho Vu, Yoshihiro Shimoda, Sudip Mukherjee
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
commit 9917f0e3cdba7b9f1a23f70e3f70b1a106be54a8 upstream
Should clear the pipe running flag in usbhs_pkt_pop(). Otherwise,
we cannot use this pipe after dequeue was called while the pipe was
running.
Fixes: 8355b2b3082d ("usb: renesas_usbhs: fix the behavior of some usbhs_pkt_handle")
Reported-by: Tho Vu <tho.vu.wh@renesas.com>
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1612183640-8898-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/renesas_usbhs/fifo.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -140,6 +140,8 @@ struct usbhs_pkt *usbhs_pkt_pop(struct u
usbhsf_dma_unmap(pkt);
}
+ usbhs_pipe_running(pipe, 0);
+
__usbhsf_pkt_del(pkt);
}
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 80/93] libnvdimm/dimm: Avoid race between probe and available_slots_show()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 79/93] usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop() Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 81/93] module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols Greg Kroah-Hartman
` (16 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vishal Verma, Dave Jiang, Ira Weiny,
Coly Li, Richard Palethorpe, Dan Williams, Sudip Mukherjee
From: Dan Williams <dan.j.williams@intel.com>
commit 7018c897c2f243d4b5f1b94bc6b4831a7eab80fb upstream
Richard reports that the following test:
(while true; do
cat /sys/bus/nd/devices/nmem*/available_slots 2>&1 > /dev/null
done) &
while true; do
for i in $(seq 0 4); do
echo nmem$i > /sys/bus/nd/drivers/nvdimm/bind
done
for i in $(seq 0 4); do
echo nmem$i > /sys/bus/nd/drivers/nvdimm/unbind
done
done
...fails with a crash signature like:
divide error: 0000 [#1] SMP KASAN PTI
RIP: 0010:nd_label_nfree+0x134/0x1a0 [libnvdimm]
[..]
Call Trace:
available_slots_show+0x4e/0x120 [libnvdimm]
dev_attr_show+0x42/0x80
? memset+0x20/0x40
sysfs_kf_seq_show+0x218/0x410
The root cause is that available_slots_show() consults driver-data, but
fails to synchronize against device-unbind setting up a TOCTOU race to
access uninitialized memory.
Validate driver-data under the device-lock.
Fixes: 4d88a97aa9e8 ("libnvdimm, nvdimm: dimm driver and base libnvdimm device-driver infrastructure")
Cc: <stable@vger.kernel.org>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Cc: Coly Li <colyli@suse.com>
Reported-by: Richard Palethorpe <rpalethorpe@suse.com>
Acked-by: Richard Palethorpe <rpalethorpe@suse.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
[sudip: use device_lock()]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/dimm_devs.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -303,16 +303,16 @@ static ssize_t state_show(struct device
}
static DEVICE_ATTR_RO(state);
-static ssize_t available_slots_show(struct device *dev,
- struct device_attribute *attr, char *buf)
+static ssize_t __available_slots_show(struct nvdimm_drvdata *ndd, char *buf)
{
- struct nvdimm_drvdata *ndd = dev_get_drvdata(dev);
+ struct device *dev;
ssize_t rc;
u32 nfree;
if (!ndd)
return -ENXIO;
+ dev = ndd->dev;
nvdimm_bus_lock(dev);
nfree = nd_label_nfree(ndd);
if (nfree - 1 > nfree) {
@@ -324,6 +324,18 @@ static ssize_t available_slots_show(stru
nvdimm_bus_unlock(dev);
return rc;
}
+
+static ssize_t available_slots_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+{
+ ssize_t rc;
+
+ device_lock(dev);
+ rc = __available_slots_show(dev_get_drvdata(dev), buf);
+ device_unlock(dev);
+
+ return rc;
+}
static DEVICE_ATTR_RO(available_slots);
static struct attribute *nvdimm_attributes[] = {
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 81/93] module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 80/93] libnvdimm/dimm: Avoid race between probe and available_slots_show() Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 82/93] gpio: pcf857x: Fix missing first interrupt Greg Kroah-Hartman
` (15 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marco Elver, Nick Desaulniers,
Nathan Chancellor, Fangrui Song, Jessica Yu
From: Fangrui Song <maskray@google.com>
commit ebfac7b778fac8b0e8e92ec91d0b055f046b4604 upstream.
clang-12 -fno-pic (since
https://github.com/llvm/llvm-project/commit/a084c0388e2a59b9556f2de0083333232da3f1d6)
can emit `call __stack_chk_fail@PLT` instead of `call __stack_chk_fail`
on x86. The two forms should have identical behaviors on x86-64 but the
former causes GNU as<2.37 to produce an unreferenced undefined symbol
_GLOBAL_OFFSET_TABLE_.
(On x86-32, there is an R_386_PC32 vs R_386_PLT32 difference but the
linker behavior is identical as far as Linux kernel is concerned.)
Simply ignore _GLOBAL_OFFSET_TABLE_ for now, like what
scripts/mod/modpost.c:ignore_undef_symbol does. This also fixes the
problem for gcc/clang -fpie and -fpic, which may emit `call foo@PLT` for
external function calls on x86.
Note: ld -z defs and dynamic loaders do not error for unreferenced
undefined symbols so the module loader is reading too much. If we ever
need to ignore more symbols, the code should be refactored to ignore
unreferenced symbols.
Cc: <stable@vger.kernel.org>
Link: https://github.com/ClangBuiltLinux/linux/issues/1250
Link: https://sourceware.org/bugzilla/show_bug.cgi?id=27178
Reported-by: Marco Elver <elver@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Marco Elver <elver@google.com>
Signed-off-by: Fangrui Song <maskray@google.com>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/module.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2107,6 +2107,21 @@ static int verify_export_symbols(struct
return 0;
}
+static bool ignore_undef_symbol(Elf_Half emachine, const char *name)
+{
+ /*
+ * On x86, PIC code and Clang non-PIC code may have call foo@PLT. GNU as
+ * before 2.37 produces an unreferenced _GLOBAL_OFFSET_TABLE_ on x86-64.
+ * i386 has a similar problem but may not deserve a fix.
+ *
+ * If we ever have to ignore many symbols, consider refactoring the code to
+ * only warn if referenced by a relocation.
+ */
+ if (emachine == EM_386 || emachine == EM_X86_64)
+ return !strcmp(name, "_GLOBAL_OFFSET_TABLE_");
+ return false;
+}
+
/* Change all symbols so that st_value encodes the pointer directly. */
static int simplify_symbols(struct module *mod, const struct load_info *info)
{
@@ -2148,8 +2163,10 @@ static int simplify_symbols(struct modul
break;
}
- /* Ok if weak. */
- if (!ksym && ELF_ST_BIND(sym[i].st_info) == STB_WEAK)
+ /* Ok if weak or ignored. */
+ if (!ksym &&
+ (ELF_ST_BIND(sym[i].st_info) == STB_WEAK ||
+ ignore_undef_symbol(info->hdr->e_machine, name)))
break;
pr_warn("%s: Unknown symbol %s (err %li)\n",
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 82/93] gpio: pcf857x: Fix missing first interrupt
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 81/93] module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 83/93] f2fs: fix out-of-repair __setattr_copy() Greg Kroah-Hartman
` (14 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxim Kiselev, Bartosz Golaszewski
From: Maxim Kiselev <bigunclemax@gmail.com>
commit a8002a35935aaefcd6a42ad3289f62bab947f2ca upstream.
If no n_latch value will be provided at driver probe then all pins will
be used as an input:
gpio->out = ~n_latch;
In that case initial state for all pins is "one":
gpio->status = gpio->out;
So if pcf857x IRQ happens with change pin value from "zero" to "one"
then we miss it, because of "one" from IRQ and "one" from initial state
leaves corresponding pin unchanged:
change = (gpio->status ^ status) & gpio->irq_enabled;
The right solution will be to read actual state at driver probe.
Cc: stable@vger.kernel.org
Fixes: 6e20a0a429bd ("gpio: pcf857x: enable gpio_to_irq() support")
Signed-off-by: Maxim Kiselev <bigunclemax@gmail.com>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-pcf857x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpio/gpio-pcf857x.c
+++ b/drivers/gpio/gpio-pcf857x.c
@@ -370,7 +370,7 @@ static int pcf857x_probe(struct i2c_clie
* reset state. Otherwise it flags pins to be driven low.
*/
gpio->out = ~n_latch;
- gpio->status = gpio->out;
+ gpio->status = gpio->read(gpio->client);
status = gpiochip_add(&gpio->chip);
if (status < 0)
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 83/93] f2fs: fix out-of-repair __setattr_copy()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 82/93] gpio: pcf857x: Fix missing first interrupt Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 84/93] sparc32: fix a user-triggerable oops in clear_user() Greg Kroah-Hartman
` (13 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim
From: Chao Yu <yuchao0@huawei.com>
commit 2562515f0ad7342bde6456602c491b64c63fe950 upstream.
__setattr_copy() was copied from setattr_copy() in fs/attr.c, there is
two missing patches doesn't cover this inner function, fix it.
Commit 7fa294c8991c ("userns: Allow chown and setgid preservation")
Commit 23adbe12ef7d ("fs,userns: Change inode_capable to capable_wrt_inode_uidgid")
Fixes: fbfa2cc58d53 ("f2fs: add file operations")
Cc: stable@vger.kernel.org
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/file.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -666,7 +666,8 @@ static void __setattr_copy(struct inode
if (ia_valid & ATTR_MODE) {
umode_t mode = attr->ia_mode;
- if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
+ if (!in_group_p(inode->i_gid) &&
+ !capable_wrt_inode_uidgid(inode, CAP_FSETID))
mode &= ~S_ISGID;
set_acl_inode(fi, mode);
}
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 84/93] sparc32: fix a user-triggerable oops in clear_user()
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 83/93] f2fs: fix out-of-repair __setattr_copy() Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 85/93] gfs2: Dont skip dlm unlock if glock has an lvb Greg Kroah-Hartman
` (12 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, stable, Al Viro, David S. Miller
From: Al Viro <viro@zeniv.linux.org.uk>
commit 7780918b36489f0b2f9a3749d7be00c2ceaec513 upstream.
Back in 2.1.29 the clear_user() guts (__bzero()) had been merged
with memset(). Unfortunately, while all exception handlers had been
copied, one of the exception table entries got lost. As the result,
clear_user() starting at 128*n bytes before the end of page and
spanning between 8 and 127 bytes into the next page would oops when
the second page is unmapped. It's trivial to reproduce - all
it takes is
main()
{
int fd = open("/dev/zero", O_RDONLY);
char *p = mmap(NULL, 16384, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANON, -1, 0);
munmap(p + 8192, 8192);
read(fd, p + 8192 - 128, 192);
}
which had been oopsing since March 1997. Says something about
the quality of test coverage... ;-/ And while today sparc32 port
is nearly dead, back in '97 it had been very much alive; in fact,
sparc64 had only been in mainline for 3 months by that point...
Cc: stable@kernel.org
Fixes: v2.1.29
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/sparc/lib/memset.S | 1 +
1 file changed, 1 insertion(+)
--- a/arch/sparc/lib/memset.S
+++ b/arch/sparc/lib/memset.S
@@ -137,6 +137,7 @@ __bzero:
ZERO_LAST_BLOCKS(%o0, 0x48, %g2)
ZERO_LAST_BLOCKS(%o0, 0x08, %g2)
13:
+ EXT(12b, 13b, 21f)
be 8f
andcc %o1, 4, %g0
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 85/93] gfs2: Dont skip dlm unlock if glock has an lvb
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 84/93] sparc32: fix a user-triggerable oops in clear_user() Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 86/93] dm era: Recover committed writeset after crash Greg Kroah-Hartman
` (11 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bob Peterson, Andreas Gruenbacher
From: Bob Peterson <rpeterso@redhat.com>
commit 78178ca844f0eb88f21f31c7fde969384be4c901 upstream.
Patch fb6791d100d1 was designed to allow gfs2 to unmount quicker by
skipping the step where it tells dlm to unlock glocks in EX with lvbs.
This was done because when gfs2 unmounts a file system, it destroys the
dlm lockspace shortly after it destroys the glocks so it doesn't need to
unlock them all: the unlock is implied when the lockspace is destroyed
by dlm.
However, that patch introduced a use-after-free in dlm: as part of its
normal dlm_recoverd process, it can call ls_recovery to recover dead
locks. In so doing, it can call recover_rsbs which calls recover_lvb for
any mastered rsbs. Func recover_lvb runs through the list of lkbs queued
to the given rsb (if the glock is cached but unlocked, it will still be
queued to the lkb, but in NL--Unlocked--mode) and if it has an lvb,
copies it to the rsb, thus trying to preserve the lkb. However, when
gfs2 skips the dlm unlock step, it frees the glock and its lvb, which
means dlm's function recover_lvb references the now freed lvb pointer,
copying the freed lvb memory to the rsb.
This patch changes the check in gdlm_put_lock so that it calls
dlm_unlock for all glocks that contain an lvb pointer.
Fixes: fb6791d100d1 ("GFS2: skip dlm_unlock calls in unmount")
Cc: stable@vger.kernel.org # v3.8+
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/gfs2/lock_dlm.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -284,7 +284,6 @@ static void gdlm_put_lock(struct gfs2_gl
{
struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
struct lm_lockstruct *ls = &sdp->sd_lockstruct;
- int lvb_needs_unlock = 0;
int error;
if (gl->gl_lksb.sb_lkid == 0) {
@@ -297,13 +296,10 @@ static void gdlm_put_lock(struct gfs2_gl
gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
gfs2_update_request_times(gl);
- /* don't want to skip dlm_unlock writing the lvb when lock is ex */
-
- if (gl->gl_lksb.sb_lvbptr && (gl->gl_state == LM_ST_EXCLUSIVE))
- lvb_needs_unlock = 1;
+ /* don't want to skip dlm_unlock writing the lvb when lock has one */
if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
- !lvb_needs_unlock) {
+ !gl->gl_lksb.sb_lvbptr) {
gfs2_glock_free(gl);
return;
}
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 86/93] dm era: Recover committed writeset after crash
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 85/93] gfs2: Dont skip dlm unlock if glock has an lvb Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 87/93] dm era: Verify the data block size hasnt changed Greg Kroah-Hartman
` (10 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nikos Tsironis, Mike Snitzer
From: Nikos Tsironis <ntsironis@arrikto.com>
commit de89afc1e40fdfa5f8b666e5d07c43d21a1d3be0 upstream.
Following a system crash, dm-era fails to recover the committed writeset
for the current era, leading to lost writes. That is, we lose the
information about what blocks were written during the affected era.
dm-era assumes that the writeset of the current era is archived when the
device is suspended. So, when resuming the device, it just moves on to
the next era, ignoring the committed writeset.
This assumption holds when the device is properly shut down. But, when
the system crashes, the code that suspends the target never runs, so the
writeset for the current era is not archived.
There are three issues that cause the committed writeset to get lost:
1. dm-era doesn't load the committed writeset when opening the metadata
2. The code that resizes the metadata wipes the information about the
committed writeset (assuming it was loaded at step 1)
3. era_preresume() starts a new era, without taking into account that
the current era might not have been archived, due to a system crash.
To fix this:
1. Load the committed writeset when opening the metadata
2. Fix the code that resizes the metadata to make sure it doesn't wipe
the loaded writeset
3. Fix era_preresume() to check for a loaded writeset and archive it,
before starting a new era.
Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-era-target.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -70,8 +70,6 @@ static size_t bitset_size(unsigned nr_bi
*/
static int writeset_alloc(struct writeset *ws, dm_block_t nr_blocks)
{
- ws->md.nr_bits = nr_blocks;
- ws->md.root = INVALID_WRITESET_ROOT;
ws->bits = vzalloc(bitset_size(nr_blocks));
if (!ws->bits) {
DMERR("%s: couldn't allocate in memory bitset", __func__);
@@ -84,12 +82,14 @@ static int writeset_alloc(struct writese
/*
* Wipes the in-core bitset, and creates a new on disk bitset.
*/
-static int writeset_init(struct dm_disk_bitset *info, struct writeset *ws)
+static int writeset_init(struct dm_disk_bitset *info, struct writeset *ws,
+ dm_block_t nr_blocks)
{
int r;
- memset(ws->bits, 0, bitset_size(ws->md.nr_bits));
+ memset(ws->bits, 0, bitset_size(nr_blocks));
+ ws->md.nr_bits = nr_blocks;
r = setup_on_disk_bitset(info, ws->md.nr_bits, &ws->md.root);
if (r) {
DMERR("%s: setup_on_disk_bitset failed", __func__);
@@ -579,6 +579,7 @@ static int open_metadata(struct era_meta
md->nr_blocks = le32_to_cpu(disk->nr_blocks);
md->current_era = le32_to_cpu(disk->current_era);
+ ws_unpack(&disk->current_writeset, &md->current_writeset->md);
md->writeset_tree_root = le64_to_cpu(disk->writeset_tree_root);
md->era_array_root = le64_to_cpu(disk->era_array_root);
md->metadata_snap = le64_to_cpu(disk->metadata_snap);
@@ -871,7 +872,6 @@ static int metadata_era_archive(struct e
}
ws_pack(&md->current_writeset->md, &value);
- md->current_writeset->md.root = INVALID_WRITESET_ROOT;
keys[0] = md->current_era;
__dm_bless_for_disk(&value);
@@ -883,6 +883,7 @@ static int metadata_era_archive(struct e
return r;
}
+ md->current_writeset->md.root = INVALID_WRITESET_ROOT;
md->archived_writesets = true;
return 0;
@@ -899,7 +900,7 @@ static int metadata_new_era(struct era_m
int r;
struct writeset *new_writeset = next_writeset(md);
- r = writeset_init(&md->bitset_info, new_writeset);
+ r = writeset_init(&md->bitset_info, new_writeset, md->nr_blocks);
if (r) {
DMERR("%s: writeset_init failed", __func__);
return r;
@@ -952,7 +953,7 @@ static int metadata_commit(struct era_me
int r;
struct dm_block *sblock;
- if (md->current_writeset->md.root != SUPERBLOCK_LOCATION) {
+ if (md->current_writeset->md.root != INVALID_WRITESET_ROOT) {
r = dm_bitset_flush(&md->bitset_info, md->current_writeset->md.root,
&md->current_writeset->md.root);
if (r) {
@@ -1582,7 +1583,7 @@ static int era_preresume(struct dm_targe
start_worker(era);
- r = in_worker0(era, metadata_new_era);
+ r = in_worker0(era, metadata_era_rollover);
if (r) {
DMERR("%s: metadata_era_rollover failed", __func__);
return r;
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 87/93] dm era: Verify the data block size hasnt changed
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 86/93] dm era: Recover committed writeset after crash Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 88/93] dm era: Fix bitset memory leaks Greg Kroah-Hartman
` (9 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nikos Tsironis, Ming-Hung Tsai, Mike Snitzer
From: Nikos Tsironis <ntsironis@arrikto.com>
commit c8e846ff93d5eaa5384f6f325a1687ac5921aade upstream.
dm-era doesn't support changing the data block size of existing devices,
so check explicitly that the requested block size for a new target
matches the one stored in the metadata.
Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-era-target.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -564,6 +564,15 @@ static int open_metadata(struct era_meta
}
disk = dm_block_data(sblock);
+
+ /* Verify the data block size hasn't changed */
+ if (le32_to_cpu(disk->data_block_size) != md->block_size) {
+ DMERR("changing the data block size (from %u to %llu) is not supported",
+ le32_to_cpu(disk->data_block_size), md->block_size);
+ r = -EINVAL;
+ goto bad;
+ }
+
r = dm_tm_open_with_sm(md->bm, SUPERBLOCK_LOCATION,
disk->metadata_space_map_root,
sizeof(disk->metadata_space_map_root),
@@ -575,7 +584,6 @@ static int open_metadata(struct era_meta
setup_infos(md);
- md->block_size = le32_to_cpu(disk->data_block_size);
md->nr_blocks = le32_to_cpu(disk->nr_blocks);
md->current_era = le32_to_cpu(disk->current_era);
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 88/93] dm era: Fix bitset memory leaks
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 87/93] dm era: Verify the data block size hasnt changed Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 89/93] dm era: Use correct value size in equality function of writeset tree Greg Kroah-Hartman
` (8 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nikos Tsironis, Ming-Hung Tsai, Mike Snitzer
From: Nikos Tsironis <ntsironis@arrikto.com>
commit 904e6b266619c2da5c58b5dce14ae30629e39645 upstream.
Deallocate the memory allocated for the in-core bitsets when destroying
the target and in error paths.
Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-era-target.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -46,6 +46,7 @@ struct writeset {
static void writeset_free(struct writeset *ws)
{
vfree(ws->bits);
+ ws->bits = NULL;
}
static int setup_on_disk_bitset(struct dm_disk_bitset *info,
@@ -812,6 +813,8 @@ static struct era_metadata *metadata_ope
static void metadata_close(struct era_metadata *md)
{
+ writeset_free(&md->writesets[0]);
+ writeset_free(&md->writesets[1]);
destroy_persistent_data_objects(md);
kfree(md);
}
@@ -849,6 +852,7 @@ static int metadata_resize(struct era_me
r = writeset_alloc(&md->writesets[1], *new_size);
if (r) {
DMERR("%s: writeset_alloc failed for writeset 1", __func__);
+ writeset_free(&md->writesets[0]);
return r;
}
@@ -859,6 +863,8 @@ static int metadata_resize(struct era_me
&value, &md->era_array_root);
if (r) {
DMERR("%s: dm_array_resize failed", __func__);
+ writeset_free(&md->writesets[0]);
+ writeset_free(&md->writesets[1]);
return r;
}
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 89/93] dm era: Use correct value size in equality function of writeset tree
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 88/93] dm era: Fix bitset memory leaks Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 90/93] dm era: Reinitialize bitset cache before digesting a new writeset Greg Kroah-Hartman
` (7 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nikos Tsironis, Ming-Hung Tsai, Mike Snitzer
From: Nikos Tsironis <ntsironis@arrikto.com>
commit 64f2d15afe7b336aafebdcd14cc835ecf856df4b upstream.
Fix the writeset tree equality test function to use the right value size
when comparing two btree values.
Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-era-target.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -389,7 +389,7 @@ static void ws_dec(void *context, const
static int ws_eq(void *context, const void *value1, const void *value2)
{
- return !memcmp(value1, value2, sizeof(struct writeset_metadata));
+ return !memcmp(value1, value2, sizeof(struct writeset_disk));
}
/*----------------------------------------------------------------*/
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 90/93] dm era: Reinitialize bitset cache before digesting a new writeset
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 89/93] dm era: Use correct value size in equality function of writeset tree Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 91/93] dm era: only resize metadata in preresume Greg Kroah-Hartman
` (6 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nikos Tsironis, Mike Snitzer
From: Nikos Tsironis <ntsironis@arrikto.com>
commit 2524933307fd0036d5c32357c693c021ab09a0b0 upstream.
In case of devices with at most 64 blocks, the digestion of consecutive
eras uses the writeset of the first era as the writeset of all eras to
digest, leading to lost writes. That is, we lose the information about
what blocks were written during the affected eras.
The digestion code uses a dm_disk_bitset object to access the archived
writesets. This structure includes a one word (64-bit) cache to reduce
the number of array lookups.
This structure is initialized only once, in metadata_digest_start(),
when we kick off digestion.
But, when we insert a new writeset into the writeset tree, before the
digestion of the previous writeset is done, or equivalently when there
are multiple writesets in the writeset tree to digest, then all these
writesets are digested using the same cache and the cache is not
re-initialized when moving from one writeset to the next.
For devices with more than 64 blocks, i.e., the size of the cache, the
cache is indirectly invalidated when we move to a next set of blocks, so
we avoid the bug.
But for devices with at most 64 blocks we end up using the same cached
data for digesting all archived writesets, i.e., the cache is loaded
when digesting the first writeset and it never gets reloaded, until the
digestion is done.
As a result, the writeset of the first era to digest is used as the
writeset of all the following archived eras, leading to lost writes.
Fix this by reinitializing the dm_disk_bitset structure, and thus
invalidating the cache, every time the digestion code starts digesting a
new writeset.
Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-era-target.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -757,6 +757,12 @@ static int metadata_digest_lookup_writes
ws_unpack(&disk, &d->writeset);
d->value = cpu_to_le32(key);
+ /*
+ * We initialise another bitset info to avoid any caching side effects
+ * with the previous one.
+ */
+ dm_disk_bitset_init(md->tm, &d->info);
+
d->nr_bits = min(d->writeset.nr_bits, md->nr_blocks);
d->current_bit = 0;
d->step = metadata_digest_transcribe_writeset;
@@ -770,12 +776,6 @@ static int metadata_digest_start(struct
return 0;
memset(d, 0, sizeof(*d));
-
- /*
- * We initialise another bitset info to avoid any caching side
- * effects with the previous one.
- */
- dm_disk_bitset_init(md->tm, &d->info);
d->step = metadata_digest_lookup_writeset;
return 0;
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 91/93] dm era: only resize metadata in preresume
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 90/93] dm era: Reinitialize bitset cache before digesting a new writeset Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 92/93] futex: Fix OWNER_DEAD fixup Greg Kroah-Hartman
` (5 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nikos Tsironis, Mike Snitzer
From: Nikos Tsironis <ntsironis@arrikto.com>
commit cca2c6aebe86f68103a8615074b3578e854b5016 upstream.
Metadata resize shouldn't happen in the ctr. The ctr loads a temporary
(inactive) table that will only become active upon resume. That is why
resize should always be done in terms of resume. Otherwise a load (ctr)
whose inactive table never becomes active will incorrectly resize the
metadata.
Also, perform the resize directly in preresume, instead of using the
worker to do it.
The worker might run other metadata operations, e.g., it could start
digestion, before resizing the metadata. These operations will end up
using the old size.
This could lead to errors, like:
device-mapper: era: metadata_digest_transcribe_writeset: dm_array_set_value failed
device-mapper: era: process_old_eras: digest step failed, stopping digestion
The reason of the above error is that the worker started the digestion
of the archived writeset using the old, larger size.
As a result, metadata_digest_transcribe_writeset tried to write beyond
the end of the era array.
Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-era-target.c | 21 ++++++++++-----------
1 file changed, 10 insertions(+), 11 deletions(-)
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -1502,15 +1502,6 @@ static int era_ctr(struct dm_target *ti,
}
era->md = md;
- era->nr_blocks = calc_nr_blocks(era);
-
- r = metadata_resize(era->md, &era->nr_blocks);
- if (r) {
- ti->error = "couldn't resize metadata";
- era_destroy(era);
- return -ENOMEM;
- }
-
era->wq = alloc_ordered_workqueue("dm-" DM_MSG_PREFIX, WQ_MEM_RECLAIM);
if (!era->wq) {
ti->error = "could not create workqueue for metadata object";
@@ -1588,9 +1579,17 @@ static int era_preresume(struct dm_targe
dm_block_t new_size = calc_nr_blocks(era);
if (era->nr_blocks != new_size) {
- r = in_worker1(era, metadata_resize, &new_size);
- if (r)
+ r = metadata_resize(era->md, &new_size);
+ if (r) {
+ DMERR("%s: metadata_resize failed", __func__);
+ return r;
+ }
+
+ r = metadata_commit(era->md);
+ if (r) {
+ DMERR("%s: metadata_commit failed", __func__);
return r;
+ }
era->nr_blocks = new_size;
}
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 92/93] futex: Fix OWNER_DEAD fixup
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 91/93] dm era: only resize metadata in preresume Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 16:13 ` [PATCH 4.4 93/93] dm era: Update in-core bitset after committing the metadata Greg Kroah-Hartman
` (4 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Dave Jones,
Peter Zijlstra (Intel),
Andrew Morton, Linus Torvalds, Paul E. McKenney, Thomas Gleixner,
Ingo Molnar, Zheng Yejian, Lee Jones
From: Peter Zijlstra <peterz@infradead.org>
commit a97cb0e7b3f4c6297fd857055ae8e895f402f501 upstream.
Both Geert and DaveJ reported that the recent futex commit:
c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex")
introduced a problem with setting OWNER_DEAD. We set the bit on an
uninitialized variable and then entirely optimize it away as a
dead-store.
Move the setting of the bit to where it is more useful.
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@us.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex")
Link: http://lkml.kernel.org/r/20180122103947.GD2228@hirez.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Reviewed-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/futex.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2248,10 +2248,6 @@ static int __fixup_pi_state_owner(u32 __
oldowner = pi_state->owner;
- /* Owner died? */
- if (!pi_state->owner)
- newtid |= FUTEX_OWNER_DIED;
-
/*
* We are here because either:
*
@@ -2309,6 +2305,9 @@ retry:
}
newtid = task_pid_vnr(newowner) | FUTEX_WAITERS;
+ /* Owner died? */
+ if (!pi_state->owner)
+ newtid |= FUTEX_OWNER_DIED;
if (get_futex_value_locked(&uval, uaddr))
goto handle_fault;
^ permalink raw reply [flat|nested] 99+ messages in thread* [PATCH 4.4 93/93] dm era: Update in-core bitset after committing the metadata
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 92/93] futex: Fix OWNER_DEAD fixup Greg Kroah-Hartman
@ 2021-03-01 16:13 ` Greg Kroah-Hartman
2021-03-01 21:16 ` [PATCH 4.4 00/93] 4.4.259-rc1 review Pavel Machek
` (3 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-01 16:13 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nikos Tsironis, Mike Snitzer
From: Nikos Tsironis <ntsironis@arrikto.com>
commit 2099b145d77c1d53f5711f029c37cc537897cee6 upstream.
In case of a system crash, dm-era might fail to mark blocks as written
in its metadata, although the corresponding writes to these blocks were
passed down to the origin device and completed successfully.
Consider the following sequence of events:
1. We write to a block that has not been yet written in the current era
2. era_map() checks the in-core bitmap for the current era and sees
that the block is not marked as written.
3. The write is deferred for submission after the metadata have been
updated and committed.
4. The worker thread processes the deferred write
(process_deferred_bios()) and marks the block as written in the
in-core bitmap, **before** committing the metadata.
5. The worker thread starts committing the metadata.
6. We do more writes that map to the same block as the write of step (1)
7. era_map() checks the in-core bitmap and sees that the block is marked
as written, **although the metadata have not been committed yet**.
8. These writes are passed down to the origin device immediately and the
device reports them as completed.
9. The system crashes, e.g., power failure, before the commit from step
(5) finishes.
When the system recovers and we query the dm-era target for the list of
written blocks it doesn't report the aforementioned block as written,
although the writes of step (6) completed successfully.
The issue is that era_map() decides whether to defer or not a write
based on non committed information. The root cause of the bug is that we
update the in-core bitmap, **before** committing the metadata.
Fix this by updating the in-core bitmap **after** successfully
committing the metadata.
Fixes: eec40579d84873 ("dm: add era target")
Cc: stable@vger.kernel.org # v3.15+
Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-era-target.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -134,7 +134,7 @@ static int writeset_test_and_set(struct
{
int r;
- if (!test_and_set_bit(block, ws->bits)) {
+ if (!test_bit(block, ws->bits)) {
r = dm_bitset_set_bit(info, ws->md.root, block, &ws->md.root);
if (r) {
/* FIXME: fail mode */
@@ -1242,8 +1242,10 @@ static void process_deferred_bios(struct
int r;
struct bio_list deferred_bios, marked_bios;
struct bio *bio;
+ struct blk_plug plug;
bool commit_needed = false;
bool failed = false;
+ struct writeset *ws = era->md->current_writeset;
bio_list_init(&deferred_bios);
bio_list_init(&marked_bios);
@@ -1253,9 +1255,11 @@ static void process_deferred_bios(struct
bio_list_init(&era->deferred_bios);
spin_unlock(&era->deferred_lock);
+ if (bio_list_empty(&deferred_bios))
+ return;
+
while ((bio = bio_list_pop(&deferred_bios))) {
- r = writeset_test_and_set(&era->md->bitset_info,
- era->md->current_writeset,
+ r = writeset_test_and_set(&era->md->bitset_info, ws,
get_block(era, bio));
if (r < 0) {
/*
@@ -1263,7 +1267,6 @@ static void process_deferred_bios(struct
* FIXME: finish.
*/
failed = true;
-
} else if (r == 0)
commit_needed = true;
@@ -1279,9 +1282,19 @@ static void process_deferred_bios(struct
if (failed)
while ((bio = bio_list_pop(&marked_bios)))
bio_io_error(bio);
- else
- while ((bio = bio_list_pop(&marked_bios)))
+ else {
+ blk_start_plug(&plug);
+ while ((bio = bio_list_pop(&marked_bios))) {
+ /*
+ * Only update the in-core writeset if the on-disk one
+ * was updated too.
+ */
+ if (commit_needed)
+ set_bit(get_block(era, bio), ws->bits);
generic_make_request(bio);
+ }
+ blk_finish_plug(&plug);
+ }
}
static void process_rpc_calls(struct era *era)
^ permalink raw reply [flat|nested] 99+ messages in thread* Re: [PATCH 4.4 00/93] 4.4.259-rc1 review
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2021-03-01 16:13 ` [PATCH 4.4 93/93] dm era: Update in-core bitset after committing the metadata Greg Kroah-Hartman
@ 2021-03-01 21:16 ` Pavel Machek
2021-03-01 21:45 ` Shuah Khan
` (2 subsequent siblings)
96 siblings, 0 replies; 99+ messages in thread
From: Pavel Machek @ 2021-03-01 21:16 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches, lkft-triage,
pavel, jonathanh, f.fainelli, stable
[-- Attachment #1: Type: text/plain, Size: 729 bytes --]
Hi!
> This is the start of the stable review cycle for the 4.4.259 release.
> There are 93 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 03 Mar 2021 16:09:49 +0000.
> Anything received after that time might be too late.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.4.y
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 99+ messages in thread* Re: [PATCH 4.4 00/93] 4.4.259-rc1 review
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2021-03-01 21:16 ` [PATCH 4.4 00/93] 4.4.259-rc1 review Pavel Machek
@ 2021-03-01 21:45 ` Shuah Khan
2021-03-02 15:52 ` Naresh Kamboju
2021-03-02 18:40 ` Guenter Roeck
96 siblings, 0 replies; 99+ messages in thread
From: Shuah Khan @ 2021-03-01 21:45 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, stable, Shuah Khan
On 3/1/21 9:12 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.259 release.
> There are 93 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 03 Mar 2021 16:09:49 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.259-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 99+ messages in thread* Re: [PATCH 4.4 00/93] 4.4.259-rc1 review
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2021-03-01 21:45 ` Shuah Khan
@ 2021-03-02 15:52 ` Naresh Kamboju
2021-03-02 18:40 ` Guenter Roeck
96 siblings, 0 replies; 99+ messages in thread
From: Naresh Kamboju @ 2021-03-02 15:52 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: open list, Shuah Khan, Florian Fainelli, patches, lkft-triage,
Jon Hunter, linux-stable, pavel, Andrew Morton, Linus Torvalds,
Guenter Roeck
On Mon, 1 Mar 2021 at 21:47, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 4.4.259 release.
> There are 93 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 03 Mar 2021 16:09:49 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.259-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Summary
------------------------------------------------------------------------
kernel: 4.4.259-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.4.y
git commit: 9c6543652027bdd932b512863425cee455274d83
git describe: v4.4.258-94-g9c6543652027
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.4.y/build/v4.4.258-94-g9c6543652027
No regressions (compared to build v4.4.258)
No fixes (compared to build v4.4.258)
Ran 17073 total tests in the following environments and test suites.
Environments
--------------
- arm
- arm64
- i386
- juno-r2 - arm64
- mips
- qemu-arm64-kasan
- qemu-x86_64-kasan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- sparc
- x15 - arm
- x86_64
- x86_64
Test Suites
-----------
* build
* linux-log-parser
* kselftest-android
* kselftest-bpf
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* network-basic-tests
* perf
* kvm-unit-tests
* libhugetlbfs
* ltp-controllers-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-securebits-tests
* v4l2-compliance
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-sched-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* install-android-platform-tools-r2600
* fwts
Summary
------------------------------------------------------------------------
kernel: 4.4.259-rc1
git repo: https://git.linaro.org/lkft/arm64-stable-rc.git
git tag: 4.4.259-rc1-hikey-20210301-944
git commit: 12d629517b548857827a6d2c13ae8ba6c8708c63
git describe: 4.4.259-rc1-hikey-20210301-944
Test details: https://qa-reports.linaro.org/lkft/linaro-hikey-stable-rc-4.4-oe/build/4.4.259-rc1-hikey-20210301-944
No regressions (compared to build 4.4.259-rc1-hikey-20210228-942)
No fixes (compared to build 4.4.259-rc1-hikey-20210228-942)
Ran 1897 total tests in the following environments and test suites.
Environments
--------------
- hi6220-hikey - arm64
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
* kselftest-android
* kselftest-bpf
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 99+ messages in thread* Re: [PATCH 4.4 00/93] 4.4.259-rc1 review
2021-03-01 16:12 [PATCH 4.4 00/93] 4.4.259-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2021-03-02 15:52 ` Naresh Kamboju
@ 2021-03-02 18:40 ` Guenter Roeck
2021-03-02 19:02 ` Greg Kroah-Hartman
96 siblings, 1 reply; 99+ messages in thread
From: Guenter Roeck @ 2021-03-02 18:40 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah, patches, lkft-triage, pavel, jonathanh,
f.fainelli, stable
On 3/1/21 8:12 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.259 release.
> There are 93 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 03 Mar 2021 16:09:49 +0000.
> Anything received after that time might be too late.
>
Building nios2:allnoconfig ... failed
--------------
Error log:
arch/nios2/kernel/sys_nios2.c: In function 'sys_cacheflush':
arch/nios2/kernel/sys_nios2.c:38:6: error: implicit declaration of function 'mmap_read_lock_killable'; did you mean 'mutex_lock_killable'?
This problem affects all nios2 builds in v4.4.y ... v5.4.y.
Guenter
^ permalink raw reply [flat|nested] 99+ messages in thread* Re: [PATCH 4.4 00/93] 4.4.259-rc1 review
2021-03-02 18:40 ` Guenter Roeck
@ 2021-03-02 19:02 ` Greg Kroah-Hartman
0 siblings, 0 replies; 99+ messages in thread
From: Greg Kroah-Hartman @ 2021-03-02 19:02 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, stable
On Tue, Mar 02, 2021 at 10:40:35AM -0800, Guenter Roeck wrote:
> On 3/1/21 8:12 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.4.259 release.
> > There are 93 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 03 Mar 2021 16:09:49 +0000.
> > Anything received after that time might be too late.
> >
>
>
> Building nios2:allnoconfig ... failed
> --------------
> Error log:
> arch/nios2/kernel/sys_nios2.c: In function 'sys_cacheflush':
> arch/nios2/kernel/sys_nios2.c:38:6: error: implicit declaration of function 'mmap_read_lock_killable'; did you mean 'mutex_lock_killable'?
>
>
> This problem affects all nios2 builds in v4.4.y ... v5.4.y.
Ugh, thanks, will go drop that patch from all of those queues now,
thanks.
greg k-h
^ permalink raw reply [flat|nested] 99+ messages in thread