* [PATCH 4.19 000/323] 4.19.218-rc1 review
@ 2021-11-24 11:53 Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 001/323] xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay Greg Kroah-Hartman
` (326 more replies)
0 siblings, 327 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, stable
This is the start of the stable review cycle for the 4.19.218 release.
There are 323 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 26 Nov 2021 11:56:36 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.218-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.19.218-rc1
Nadav Amit <namit@vmware.com>
hugetlbfs: flush TLBs correctly after huge_pmd_unshare
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
usb: max-3421: Use driver data instead of maintaining a list of bound devices
Takashi Iwai <tiwai@suse.de>
ASoC: DAPM: Cover regression by kctl change notification fix
Leon Romanovsky <leonro@nvidia.com>
RDMA/netlink: Add __maybe_unused to static inline in C file
Sven Eckelmann <sven@narfation.org>
batman-adv: Don't always reallocate the fragmentation skb head
Sven Eckelmann <sven@narfation.org>
batman-adv: Reserve needed_*room for fragments
Sven Eckelmann <sven@narfation.org>
batman-adv: Consider fragmentation for needed_headroom
Linus Lüssing <linus.luessing@c0d3.blue>
batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
Greg Thelen <gthelen@google.com>
perf/core: Avoid put_page() when GUP fails
hongao <hongao@uniontech.com>
drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors
Johan Hovold <johan@kernel.org>
drm/udl: fix control-message timeout
Nguyen Dinh Phi <phind.uet@gmail.com>
cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
Sven Schnelle <svens@stackframe.org>
parisc/sticon: fix reverse colors
Nikolay Borisov <nborisov@suse.com>
btrfs: fix memory ordering between normal and ordered work functions
Jan Kara <jack@suse.cz>
udf: Fix crash after seekdir
Sean Christopherson <seanjc@google.com>
x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
Rustam Kovhaev <rkovhaev@gmail.com>
mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
ipc: WARN if trying to remove ipc object which is absent
Nathan Chancellor <nathan@kernel.org>
hexagon: export raw I/O routines for modules
Nicolas Dichtel <nicolas.dichtel@6wind.com>
tun: fix bonding active backup with arp monitoring
Alexander Antonov <alexander.antonov@linux.intel.com>
perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
Alexander Antonov <alexander.antonov@linux.intel.com>
perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
Sohaib Mohamed <sohaib.amhmd@gmail.com>
perf bench: Fix two memory leaks detected with ASan
Lin Ma <linma@zju.edu.cn>
NFC: reorder the logic in nfc_{un,}register_device
Lin Ma <linma@zju.edu.cn>
NFC: reorganize the functions in nci_request
Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
i40e: Fix display error code in dmesg
Eryk Rybak <eryk.roch.rybak@intel.com>
i40e: Fix changing previously set num_queue_pairs for PFs
Michal Maloszewski <michal.maloszewski@intel.com>
i40e: Fix NULL ptr dereference on VSI filter sync
Eryk Rybak <eryk.roch.rybak@intel.com>
i40e: Fix correct max_pkt_size on VF RX queue
Jonathan Davies <jonathan.davies@nutanix.com>
net: virtio_net_hdr_to_skb: count transport header in UFO
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
Randy Dunlap <rdunlap@infradead.org>
mips: lantiq: add support for clk_get_parent()
Randy Dunlap <rdunlap@infradead.org>
mips: bcm63xx: add support for clk_get_parent()
Colin Ian King <colin.i.king@googlemail.com>
MIPS: generic/yamon-dt: fix uninitialized variable error
Surabhi Boob <surabhi.boob@intel.com>
iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
Nicholas Nunley <nicholas.d.nunley@intel.com>
iavf: check for null in iavf_fix_features
Pavel Skripkin <paskripkin@gmail.com>
net: bnx2x: fix variable dereferenced before check
Hans Verkuil <hverkuil-cisco@xs4all.nl>
drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame
Vincent Donnefort <vincent.donnefort@arm.com>
sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
Randy Dunlap <rdunlap@infradead.org>
mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
Randy Dunlap <rdunlap@infradead.org>
sh: define __BIG_ENDIAN for math-emu
Randy Dunlap <rdunlap@infradead.org>
sh: fix kconfig unmet dependency warning for FRAME_POINTER
Gao Xiang <hsiangkao@linux.alibaba.com>
f2fs: fix up f2fs_lookup tracepoints
Lu Wei <luwei32@huawei.com>
maple: fix wrong return value of maple_bus_init().
Nick Desaulniers <ndesaulniers@google.com>
sh: check return code of request_irq
Michael Ellerman <mpe@ellerman.id.au>
powerpc/dcr: Use cmplwi instead of 3-argument cmpli
Chengfeng Ye <cyeaa@connect.ust.hk>
ALSA: gus: fix null pointer dereference on pointer block
Anatolij Gustschin <agust@denx.de>
powerpc/5200: dts: fix memory node unit name
Mike Christie <michael.christie@oracle.com>
scsi: target: Fix alua_tg_pt_gps_count tracking
Mike Christie <michael.christie@oracle.com>
scsi: target: Fix ordered tag handling
Bart Van Assche <bvanassche@acm.org>
MIPS: sni: Fix the build
Guanghui Feng <guanghuifeng@linux.alibaba.com>
tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
Randy Dunlap <rdunlap@infradead.org>
ALSA: ISA: not for M68K
Yang Yingliang <yangyingliang@huawei.com>
usb: host: ohci-tmio: check return value after calling platform_get_resource()
Roger Quadros <rogerq@kernel.org>
ARM: dts: omap: fix gpmc,mux-add-data type
Luis Chamberlain <mcgrof@kernel.org>
firmware_loader: fix pre-allocated buf built-in firmware use
Guo Zhi <qtxuning1999@sjtu.edu.cn>
scsi: advansys: Fix kernel pointer leak
Hans de Goede <hdegoede@redhat.com>
ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect
Michael Walle <michael@walle.cc>
arm64: dts: freescale: fix arm,sp805 compatible string
Sven Peter <sven@svenpeter.dev>
usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
Yang Yingliang <yangyingliang@huawei.com>
usb: musb: tusb6010: check return value after calling platform_get_resource()
Michael Walle <michael@walle.cc>
arm64: dts: hisilicon: fix arm,sp805 compatible string
James Smart <jsmart2021@gmail.com>
scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
Michal Simek <michal.simek@xilinx.com>
arm64: zynqmp: Fix serial compatible string
Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
arm64: zynqmp: Do not duplicate flash partition label property
Gao Xiang <hsiangkao@linux.alibaba.com>
erofs: fix unsafe pagevec reuse of hooked pclusters
Yue Hu <huyue2@yulong.com>
erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
Marc Zyngier <maz@kernel.org>
PCI: Add MSI masking quirk for Nvidia ION AHCI
Marc Zyngier <maz@kernel.org>
PCI/MSI: Deal with devices lying about their MSI mask capability
Thomas Gleixner <tglx@linutronix.de>
PCI/MSI: Destroy sysfs before freeing entries
Sven Schnelle <svens@stackframe.org>
parisc/entry: fix trace test in syscall exit path
Kees Cook <keescook@chromium.org>
fortify: Explicitly disable Clang support
Shaoying Xu <shaoyi@amazon.com>
ext4: fix lazy initialization next schedule time computation in more granular unit
Jane Malalane <jane.malalane@citrix.com>
x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
Miklos Szeredi <mszeredi@redhat.com>
fuse: truncate pagecache on atomic_o_trunc
Pali Rohár <pali@kernel.org>
PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
Sven Schnelle <svens@linux.ibm.com>
s390/tape: fix timer initialization in tape_std_assign()
Vineeth Vijayan <vneethv@linux.ibm.com>
s390/cio: check the subchannel validity for dev_busid
Marek Vasut <marex@denx.de>
video: backlight: Drop maximum brightness override for brightness zero
Peter Ujfalusi <peter.ujfalusi@ti.com>
backlight: gpio-backlight: Correct initial power state handling
Michal Hocko <mhocko@suse.com>
mm, oom: do not trigger out_of_memory from the #PF
Vasily Averin <vvs@virtuozzo.com>
mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC
Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
powerpc/security: Add a helper to query stf_barrier type
Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
powerpc/bpf: Fix BPF_SUB when imm == 0x80000000
Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
powerpc/bpf: Validate branch ranges
Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
powerpc/lib: Add helper to check if offset is within conditional branch range
Dominique Martinet <asmadeus@codewreck.org>
9p/net: fix missing error check in p9_check_errors
Jaegeuk Kim <jaegeuk@kernel.org>
f2fs: should use GFP_NOFS for directory inodes
Arnd Bergmann <arnd@arndb.de>
ARM: 9156/1: drop cc-option fallbacks for architecture selection
Michał Mirosław <mirq-linux@rere.qmqm.pl>
ARM: 9155/1: fix early early_iounmap()
Johan Hovold <johan@kernel.org>
USB: chipidea: fix interrupt deadlock
Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
cxgb4: fix eeprom len when diagnostics not implemented
Eiichi Tsukata <eiichi.tsukata@nutanix.com>
vsock: prevent unnecessary refcnt inc for nonblocking connect
Arnd Bergmann <arnd@arndb.de>
arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
Chengfeng Ye <cyeaa@connect.ust.hk>
nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
Eric Dumazet <edumazet@google.com>
llc: fix out-of-bound array index in llc_sk_dev_hash()
Dan Carpenter <dan.carpenter@oracle.com>
zram: off by one in read_block_state()
Miaohe Lin <linmiaohe@huawei.com>
mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()
Huang Guobin <huangguobin4@huawei.com>
bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
Hans de Goede <hdegoede@redhat.com>
ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
Ziyang Xuan <william.xuanziyang@huawei.com>
net: vlan: fix a UAF in vlan_dev_real_dev()
Maxim Kiselev <bigunclemax@gmail.com>
net: davinci_emac: Fix interrupt pacing disable
YueHaibing <yuehaibing@huawei.com>
xen-pciback: Fix return in pm_ctrl_init()
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()'
Quinn Tran <qutran@marvell.com>
scsi: qla2xxx: Turn off target reset during issue_lip
Quinn Tran <qutran@marvell.com>
scsi: qla2xxx: Fix gnl list corruption
Jackie Liu <liuyun01@kylinos.cn>
ar7: fix kernel builds for compiler test
Ahmad Fatoum <a.fatoum@pengutronix.de>
watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
Randy Dunlap <rdunlap@infradead.org>
m68k: set a default value for MEMORY_RESERVE
Lars-Peter Clausen <lars@metafoo.de>
dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
Florian Westphal <fw@strlen.de>
netfilter: nfnetlink_queue: fix OOB when mac header was cleared
Geert Uytterhoeven <geert@linux-m68k.org>
auxdisplay: ht16k33: Fix frame buffer device blanking
Geert Uytterhoeven <geert@linux-m68k.org>
auxdisplay: ht16k33: Connect backlight to fbdev
Geert Uytterhoeven <geert@linux-m68k.org>
auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
Claudiu Beznea <claudiu.beznea@microchip.com>
dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
Evgeny Novikov <novikov@ispras.ru>
mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
Jia-Ju Bai <baijiaju1990@gmail.com>
fs: orangefs: fix error return code of orangefs_revalidate_lookup()
Trond Myklebust <trond.myklebust@hammerspace.com>
NFS: Fix deadlocks in nfs_scan_commit_list()
Marek Behún <kabel@kernel.org>
PCI: aardvark: Don't spam about PIO Response Status
Alex Xu (Hello71) <alex_y_xu@yahoo.ca>
drm/plane-helper: fix uninitialized variable reference
Baptiste Lepers <baptiste.lepers@gmail.com>
pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
Tom Rix <trix@redhat.com>
apparmor: fix error check
Hans de Goede <hdegoede@redhat.com>
power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
Geert Uytterhoeven <geert+renesas@glider.be>
mips: cm: Convert to bitfield API to fix out-of-bounds access
Anssi Hannula <anssi.hannula@bitwise.fi>
serial: xilinx_uartps: Fix race condition causing stuck TX
Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
phy: qcom-qusb2: Fix a memory leak on probe
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
Richard Fitzgerald <rf@opensource.cirrus.com>
ASoC: cs42l42: Correct some register default values
Leon Romanovsky <leonro@nvidia.com>
RDMA/mlx4: Return missed an error if device doesn't support steering
Dan Carpenter <dan.carpenter@oracle.com>
scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
Jakob Hauser <jahau@rocketmail.com>
power: supply: rt5033_battery: Change voltage values to µV
Dan Carpenter <dan.carpenter@oracle.com>
usb: gadget: hid: fix error code in do_config()
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
serial: 8250_dw: Drop wrong use of ACPI_PTR()
Christophe Leroy <christophe.leroy@csgroup.eu>
video: fbdev: chipsfb: use memset_io() instead of memset()
Dongliang Mu <mudongliangabcd@gmail.com>
memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
soc/tegra: Fix an error handling path in tegra_powergate_power_up()
Andreas Kemnade <andreas@kemnade.info>
arm: dts: omap3-gta04a4: accelerometer irq fix
Takashi Iwai <tiwai@suse.de>
ALSA: hda: Reduce udelay() at SKL+ position reporting
Dongliang Mu <mudongliangabcd@gmail.com>
JFS: fix memleak in jfs_mount
Jackie Liu <liuyun01@kylinos.cn>
MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
Tong Zhang <ztong0001@gmail.com>
scsi: dc395: Fix error case unwinding
Peter Rosin <peda@axentia.se>
ARM: dts: at91: tse850: the emac<->phy interface is rmii
Selvin Xavier <selvin.xavier@broadcom.com>
RDMA/bnxt_re: Fix query SRQ failure
Alex Bee <knaerzche@gmail.com>
arm64: dts: rockchip: Fix GPU register width for RK3328
Jackie Liu <liuyun01@kylinos.cn>
ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
Junji Wei <weijunji@bytedance.com>
RDMA/rxe: Fix wrong port_cap_flags
Sukadev Bhattiprolu <sukadev@linux.ibm.com>
ibmvnic: Process crqs after enabling interrupts
Andrea Righi <andrea.righi@canonical.com>
selftests/bpf: Fix fclose/pclose mismatch in test_progs
Daniel Jordan <daniel.m.jordan@oracle.com>
crypto: pcrypt - Delay write to padata->info
Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
net: phylink: avoid mvneta warning when setting pause parameters
Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
net: amd-xgbe: Toggle PLL settings during rate change
Benjamin Li <benl@squareup.com>
wcn36xx: add proper DMA memory barriers in rx path
Wang Hai <wanghai38@huawei.com>
libertas: Fix possible memory leak in probe and disconnect
Wang Hai <wanghai38@huawei.com>
libertas_tf: Fix possible memory leak in probe and disconnect
Janis Schoetterl-Glausch <scgl@linux.ibm.com>
KVM: s390: Fix handle_sske page fault handling
Tiezhu Yang <yangtiezhu@loongson.cn>
samples/kretprobes: Fix return value if register_kretprobe() failed
Jon Maxwell <jmaxwell37@gmail.com>
tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
Mark Rutland <mark.rutland@arm.com>
irq: mips: avoid nested irq_enter()
David Hildenbrand <david@redhat.com>
s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
Jessica Zhang <jesszhan@codeaurora.org>
drm/msm: Fix potential NULL dereference in DPU SSPP
Kees Cook <keescook@chromium.org>
clocksource/drivers/timer-ti-dm: Select TIMER_OF
Anders Roxell <anders.roxell@linaro.org>
PM: hibernate: fix sparse warnings
Max Gurtovoy <mgurtovoy@nvidia.com>
nvme-rdma: fix error code in nvme_rdma_setup_ctrl
Stefan Agner <stefan@agner.ch>
phy: micrel: ksz8041nl: do not use power down mode
Jonas Dreßler <verdre@v0yd.nl>
mwifiex: Send DELBA requests according to spec
Ziyang Xuan <william.xuanziyang@huawei.com>
rsi: stop thread firstly in rsi_91x_init() error handling
Nathan Chancellor <nathan@kernel.org>
platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
mmc: mxs-mmc: disable regulator on error and in the remove function
Jakub Kicinski <kuba@kernel.org>
net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
Dan Carpenter <dan.carpenter@oracle.com>
drm/msm: uninitialized variable in msm_gem_import()
Sven Eckelmann <seckelmann@datto.com>
ath10k: fix max antenna gain unit
Zev Weiss <zev@bewilderbeest.net>
hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff
Yang Yingliang <yangyingliang@huawei.com>
hwmon: Fix possible memleak in __hwmon_device_register()
Dan Carpenter <dan.carpenter@oracle.com>
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
Arnd Bergmann <arnd@arndb.de>
memstick: avoid out-of-range warning
Tony Lindgren <tony@atomide.com>
mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
Dan Carpenter <dan.carpenter@oracle.com>
b43: fix a lower bounds test
Dan Carpenter <dan.carpenter@oracle.com>
b43legacy: fix a lower bounds test
Markus Schneider-Pargmann <msp@baylibre.com>
hwrng: mtk - Force runtime pm ops for sleep ops
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - disregard spurious PFVF interrupts
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - detect PFVF collision after ACK
Evgeny Novikov <novikov@ispras.ru>
media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()
Linus Lüssing <ll@simonwunderlich.de>
ath9k: Fix potential interrupt storm on queue reset
Colin Ian King <colin.king@canonical.com>
media: em28xx: Don't use ops->suspend if it is NULL
Anel Orazgaliyeva <anelkz@amazon.de>
cpuidle: Fix kobject memory leaks in error paths
Colin Ian King <colin.king@canonical.com>
media: cx23885: Fix snd_card_free call on null card pointer
Kees Cook <keescook@chromium.org>
media: si470x: Avoid card name truncation
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()'
Pavel Skripkin <paskripkin@gmail.com>
media: dvb-usb: fix ununit-value in az6027_rc_query
Pavel Skripkin <paskripkin@gmail.com>
media: em28xx: add missing em28xx_close_extension
Arnd Bergmann <arnd@arndb.de>
drm/amdgpu: fix warning for overflow check
Linus Walleij <linus.walleij@linaro.org>
net: dsa: rtl8366rb: Fix off-by-one bug
Waiman Long <longman@redhat.com>
cgroup: Make rebind_subsystems() disable v2 controllers all at once
Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Bluetooth: fix init and cleanup of sco_conn.timeout_work
Sven Schnelle <svens@stackframe.org>
parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
Sven Schnelle <svens@stackframe.org>
parisc/unwind: fix unwinder when CONFIG_64BIT is enabled
Helge Deller <deller@gmx.de>
task_stack: Fix end_of_stack() for architectures with upwards-growing stack
Sven Schnelle <svens@stackframe.org>
parisc: fix warning in flush_tlb_all
Vitaly Kuznetsov <vkuznets@redhat.com>
x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted
Yang Yingliang <yangyingliang@huawei.com>
spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
Arnd Bergmann <arnd@arndb.de>
ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
Stephen Suryaputra <ssuryaextr@gmail.com>
gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE
Masami Hiramatsu <mhiramat@kernel.org>
ARM: clang: Do not rely on lr register for stacktrace
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
smackfs: use __GFP_NOFAIL for smk_cipso_doi()
Johannes Berg <johannes.berg@intel.com>
iwlwifi: mvm: disable RX-diversity in powersave
Ye Bin <yebin10@huawei.com>
PM: hibernate: Get block device exclusively in swsusp_check()
Zheyu Ma <zheyuma97@gmail.com>
mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
Kalesh Singh <kaleshsingh@google.com>
tracing/cfi: Fix cmp_entries_* functions signature mismatch
Menglong Dong <imagedong@tencent.com>
workqueue: make sysfs of unbound kworker cpumask more clever
Lasse Collin <lasse.collin@tukaani.org>
lib/xz: Validate the value before assigning it to an enum variable
Lasse Collin <lasse.collin@tukaani.org>
lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
Zheyu Ma <zheyuma97@gmail.com>
memstick: r592: Fix a UAF bug when removing the driver
Kees Cook <keescook@chromium.org>
leaking_addresses: Always print a trailing newline
André Almeida <andrealmeid@collabora.com>
ACPI: battery: Accept charges over the design capacity as full
Tuo Li <islituo@gmail.com>
ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
Steven Rostedt (VMware) <rostedt@goodmis.org>
tracefs: Have tracefs directories not set OTH permission bits by default
Anant Thazhemadam <anant.thazhemadam@gmail.com>
media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPICA: Avoid evaluating methods too early during system resume
Nadezda Lutovinova <lutovinova@ispras.ru>
media: rcar-csi2: Add checking to rcsi2_start_receiver()
Randy Dunlap <rdunlap@infradead.org>
ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
Rajat Asthana <rajatasthana4@gmail.com>
media: mceusb: return without resubmitting URB in case of -EPROTO error.
Nadezda Lutovinova <lutovinova@ispras.ru>
media: s5p-mfc: Add checking to s5p_mfc_probe().
Tuo Li <islituo@gmail.com>
media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Return -EIO for control errors
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Set capability in s_param
Zheyu Ma <zheyuma97@gmail.com>
media: netup_unidvb: handle interrupt properly according to the firmware
Dirk Bender <d.bender@phytec.de>
media: mt9p031: Fix corrupted frame after restarting stream
Jonas Dreßler <verdre@v0yd.nl>
mwifiex: Properly initialize private structure on interface type changes
Jonas Dreßler <verdre@v0yd.nl>
mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
Peter Zijlstra <peterz@infradead.org>
x86: Increase exception stack sizes
Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
smackfs: Fix use-after-free in netlbl_catmap_walk()
Jakub Kicinski <kuba@kernel.org>
net: sched: update default qdisc visibility after Tx queue cnt changes
Peter Zijlstra <peterz@infradead.org>
locking/lockdep: Avoid RCU-induced noinstr fail
Aleksander Jan Bajkowski <olek2@wp.pl>
MIPS: lantiq: dma: reset correct number of channel
Aleksander Jan Bajkowski <olek2@wp.pl>
MIPS: lantiq: dma: add small delay after reset
Barnabás Pőcze <pobrn@protonmail.com>
platform/x86: wmi: do not fail if disabling fails
Wang ShaoBo <bobo.shaobowang@huawei.com>
Bluetooth: fix use-after-free error in lock_sock_nested()
Takashi Iwai <tiwai@suse.de>
Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
Hans de Goede <hdegoede@redhat.com>
drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
Johan Hovold <johan@kernel.org>
USB: iowarrior: fix control-message timeouts
Wang Hai <wanghai38@huawei.com>
USB: serial: keyspan: fix memleak on probe errors
Pekka Korpinen <pekka.korpinen@iki.fi>
iio: dac: ad5446: Fix ad5622_write() return value
Yang Yingliang <yangyingliang@huawei.com>
pinctrl: core: fix possible memory leak in pinctrl_enable()
Zhang Yi <yi.zhang@huawei.com>
quota: correct error number in free_dqentry()
Zhang Yi <yi.zhang@huawei.com>
quota: check block number when reading the block in quota file
Marek Behún <kabel@kernel.org>
PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
Marek Behún <kabel@kernel.org>
PCI: aardvark: Fix return value of MSI domain .alloc() method
Pali Rohár <pali@kernel.org>
PCI: aardvark: Do not unmask unused interrupts
Pali Rohár <pali@kernel.org>
PCI: aardvark: Do not clear status bits of masked interrupts
Juergen Gross <jgross@suse.com>
xen/balloon: add late_initcall_sync() for initial ballooning done
Pavel Skripkin <paskripkin@gmail.com>
ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
Takashi Iwai <tiwai@suse.de>
ALSA: mixer: oss: Fix racy access to slots
Pali Rohár <pali@kernel.org>
serial: core: Fix initializing and restoring termios speed
Xiaoming Ni <nixiaoming@huawei.com>
powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
Henrik Grimler <henrik@grimler.se>
power: supply: max17042_battery: use VFSOC for capacity when no rsns
Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
Eric W. Biederman <ebiederm@xmission.com>
signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
Eric W. Biederman <ebiederm@xmission.com>
signal: Remove the bogus sigkill_pending in ptrace_stop
Alok Prasad <palok@marvell.com>
RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
Marek Vasut <marex@denx.de>
rsi: Fix module dev_oper_mode parameter description
Martin Fuzzey <martin.fuzzey@flowbird.group>
rsi: fix rate mask set leading to P2P failure
Martin Fuzzey <martin.fuzzey@flowbird.group>
rsi: fix key enabled check causing unwanted encryption for vap_id > 0
Martin Fuzzey <martin.fuzzey@flowbird.group>
rsi: fix occasional initialisation failure with BT coex
Benjamin Li <benl@squareup.com>
wcn36xx: handle connection loss indication
Reimar Döffinger <Reimar.Doeffinger@gmx.de>
libata: fix checking of DMA state
Jonas Dreßler <verdre@v0yd.nl>
mwifiex: Read a PCI register after writing the TX ring write pointer
Loic Poulain <loic.poulain@linaro.org>
wcn36xx: Fix HT40 capability for 2Ghz band
Austin Kim <austin.kim@lge.com>
evm: mark evm_fixmode as __ro_after_init
Johan Hovold <johan@kernel.org>
rtl8187: fix control-message timeouts
Ingmar Klein <ingmar_klein@web.de>
PCI: Mark Atheros QCA6174 to avoid bus reset
Johan Hovold <johan@kernel.org>
ath10k: fix division by zero in send path
Johan Hovold <johan@kernel.org>
ath10k: fix control-message timeout
Johan Hovold <johan@kernel.org>
ath6kl: fix control-message timeout
Johan Hovold <johan@kernel.org>
ath6kl: fix division by zero in send path
Johan Hovold <johan@kernel.org>
mwifiex: fix division by zero in fw download path
Eric Badger <ebadger@purestorage.com>
EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
Zev Weiss <zev@bewilderbeest.net>
hwmon: (pmbus/lm25066) Add offset coefficients
Masami Hiramatsu <mhiramat@kernel.org>
ia64: kprobes: Fix to pass correct trampoline address to the handler
Anand Jain <anand.jain@oracle.com>
btrfs: call btrfs_check_rw_degradable only if there is a missing device
Filipe Manana <fdmanana@suse.com>
btrfs: fix lost error handling when replaying directory deletes
Li Zhang <zhanglikernel@gmail.com>
btrfs: clear MISSING device status bit in btrfs_close_one_device
Dongli Zhang <dongli.zhang@oracle.com>
vmxnet3: do not stop tx queues after netif_device_detach()
Walter Stoll <walter.stoll@duagon.com>
watchdog: Fix OMAP watchdog early handling
Thomas Perrot <thomas.perrot@bootlin.com>
spi: spl022: fix Microwire full duplex mode
Dongli Zhang <dongli.zhang@oracle.com>
xen/netfront: stop tx queues during live migration
Lorenz Bauer <lmb@cloudflare.com>
bpf: Prevent increasing bpf_jit_limit above max
Bryant Mairs <bryant@mai.rs>
drm: panel-orientation-quirks: Add quirk for Aya Neo 2021
Randy Dunlap <rdunlap@infradead.org>
mmc: winbond: don't build on M68K
Arnd Bergmann <arnd@arndb.de>
hyperv/vmbus: include linux/bitops.h
Erik Ekman <erik@kryo.se>
sfc: Don't use netif_info before net_device setup
Zheyu Ma <zheyuma97@gmail.com>
cavium: Fix return values of the probe function
Dmitry Bogdanov <d.bogdanov@yadro.com>
scsi: qla2xxx: Fix unmap of already freed sgl
Zheyu Ma <zheyuma97@gmail.com>
cavium: Return negative value when pci_alloc_irq_vectors() fails
Sean Christopherson <seanjc@google.com>
x86/irq: Ensure PI wakeup handler is unregistered before module unload
Tom Lendacky <thomas.lendacky@amd.com>
x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c
Miklos Szeredi <mszeredi@redhat.com>
fuse: fix page stealing
Takashi Iwai <tiwai@suse.de>
ALSA: timer: Unconditionally unlink slave instances, too
Wang Wensheng <wangwensheng4@huawei.com>
ALSA: timer: Fix use-after-free problem
Austin Kim <austin.kim@lge.com>
ALSA: synth: missing check for possible NULL after the call to kstrdup
Alexander Tsoy <alexander@tsoy.me>
ALSA: usb-audio: Add registration quirk for JBL Quantum 400
Johan Hovold <johan@kernel.org>
ALSA: line6: fix control and interrupt message timeouts
Johan Hovold <johan@kernel.org>
ALSA: 6fire: fix control and bulk message timeouts
Johan Hovold <johan@kernel.org>
ALSA: ua101: fix division by zero at probe
Tim Crawford <tcrawford@system76.com>
ALSA: hda/realtek: Add quirk for Clevo PC70HS
Sean Young <sean@mess.org>
media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
Sean Young <sean@mess.org>
media: ite-cir: IR receiver stop working after receive overflow
Tang Bin <tangbin@cmss.chinamobile.com>
crypto: s5p-sss - Add error handling in s5p_aes_probe()
jing yangyang <cgel.zte@gmail.com>
firmware/psci: fix application of sizeof to pointer
Dan Carpenter <dan.carpenter@oracle.com>
tpm: Check for integer overflow in tpm2_map_response_body()
Helge Deller <deller@gmx.de>
parisc: Fix ptrace check on syscall return
Christian Löhle <CLoehle@hyperstone.com>
mmc: dw_mmc: Dont wait for DRTO on Write RSP error
Jan Kara <jack@suse.cz>
ocfs2: fix data corruption on truncate
Damien Le Moal <damien.lemoal@opensource.wdc.com>
libata: fix read log timeout value
Takashi Iwai <tiwai@suse.de>
Input: i8042 - Add quirk for Fujitsu Lifebook T725
Phoenix Huang <phoenix@emc.com.tw>
Input: elantench - fix misreporting trackpoint coordinates
Todd Kjos <tkjos@google.com>
binder: use cred instead of task for selinux checks
Todd Kjos <tkjos@google.com>
binder: use euid from cred instead of using task
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 7 ++
.../bindings/regulator/samsung,s5m8767.txt | 23 +++---
Makefile | 4 +-
arch/arm/Makefile | 22 ++---
arch/arm/boot/dts/at91-tse850-3.dts | 2 +-
arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 2 +-
arch/arm/boot/dts/omap3-gta04.dtsi | 2 +-
arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi | 2 +-
arch/arm/kernel/stacktrace.c | 3 +-
arch/arm/mm/Kconfig | 2 +-
arch/arm/mm/mmu.c | 4 +-
arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 16 ++--
arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 16 ++--
arch/arm64/boot/dts/hisilicon/hi3660.dtsi | 4 +-
arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 2 +-
arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +-
.../boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts | 4 +-
arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 +-
arch/arm64/include/asm/pgtable.h | 12 ++-
arch/hexagon/lib/io.c | 4 +
arch/ia64/Kconfig.debug | 2 +-
arch/ia64/kernel/kprobes.c | 9 ++-
arch/m68k/Kconfig.machine | 1 +
arch/mips/Kconfig | 4 +
arch/mips/bcm63xx/clk.c | 6 ++
arch/mips/generic/yamon-dt.c | 2 +-
arch/mips/include/asm/mips-cm.h | 12 +--
arch/mips/kernel/mips-cm.c | 21 +++--
arch/mips/kernel/r2300_fpu.S | 4 +-
arch/mips/kernel/syscall.c | 9 ---
arch/mips/lantiq/clk.c | 6 ++
arch/mips/lantiq/xway/dma.c | 14 ++--
arch/mips/sni/time.c | 4 +-
arch/parisc/kernel/entry.S | 4 +-
arch/parisc/kernel/smp.c | 19 ++++-
arch/parisc/kernel/unwind.c | 21 +++--
arch/parisc/mm/init.c | 4 +-
arch/powerpc/boot/dts/charon.dts | 2 +-
arch/powerpc/boot/dts/digsy_mtc.dts | 2 +-
arch/powerpc/boot/dts/lite5200.dts | 2 +-
arch/powerpc/boot/dts/lite5200b.dts | 2 +-
arch/powerpc/boot/dts/media5200.dts | 2 +-
arch/powerpc/boot/dts/mpc5200b.dtsi | 2 +-
arch/powerpc/boot/dts/o2d.dts | 2 +-
arch/powerpc/boot/dts/o2d.dtsi | 2 +-
arch/powerpc/boot/dts/o2dnt2.dts | 2 +-
arch/powerpc/boot/dts/o3dnt.dts | 2 +-
arch/powerpc/boot/dts/pcm032.dts | 2 +-
arch/powerpc/boot/dts/tqm5200.dts | 2 +-
arch/powerpc/include/asm/code-patching.h | 1 +
arch/powerpc/include/asm/security_features.h | 5 ++
arch/powerpc/kernel/security.c | 5 ++
arch/powerpc/lib/code-patching.c | 7 +-
arch/powerpc/net/bpf_jit.h | 33 +++++---
arch/powerpc/net/bpf_jit64.h | 8 +-
arch/powerpc/net/bpf_jit_comp64.c | 93 ++++++++++++++++++----
arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c | 3 +-
arch/powerpc/sysdev/dcr-low.S | 2 +-
arch/s390/kvm/priv.c | 2 +
arch/s390/mm/gmap.c | 5 +-
arch/sh/Kconfig.debug | 1 +
arch/sh/include/asm/sfp-machine.h | 8 ++
arch/sh/kernel/cpu/sh4a/smp-shx3.c | 5 +-
arch/x86/events/intel/uncore_snbep.c | 4 +
arch/x86/hyperv/hv_init.c | 8 +-
arch/x86/include/asm/page_64_types.h | 2 +-
arch/x86/kernel/cpu/amd.c | 2 +
arch/x86/kernel/cpu/common.c | 44 ++++++++--
arch/x86/kernel/cpu/cpu.h | 1 +
arch/x86/kernel/irq.c | 4 +-
arch/x86/mm/mem_encrypt_identity.c | 9 +++
crypto/pcrypt.c | 12 ++-
drivers/acpi/acpica/acglobal.h | 2 +
drivers/acpi/acpica/hwesleep.c | 8 +-
drivers/acpi/acpica/hwsleep.c | 11 +--
drivers/acpi/acpica/hwxfsleep.c | 7 ++
drivers/acpi/battery.c | 2 +-
drivers/acpi/pmic/intel_pmic.c | 51 ++++++------
drivers/android/binder.c | 20 +++--
drivers/ata/libata-core.c | 2 +-
drivers/ata/libata-eh.c | 8 ++
drivers/auxdisplay/ht16k33.c | 66 ++++++++-------
drivers/auxdisplay/img-ascii-lcd.c | 10 +++
drivers/base/firmware_loader/main.c | 13 +--
drivers/block/zram/zram_drv.c | 2 +-
drivers/char/hw_random/mtk-rng.c | 9 ++-
drivers/char/tpm/tpm2-space.c | 3 +
drivers/clocksource/Kconfig | 1 +
drivers/cpuidle/sysfs.c | 5 +-
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 13 +++
drivers/crypto/qat/qat_common/adf_vf_isr.c | 6 ++
drivers/crypto/s5p-sss.c | 2 +
drivers/dma/at_xdmac.c | 2 +-
drivers/dma/dmaengine.h | 2 +-
drivers/edac/sb_edac.c | 2 +-
drivers/firmware/psci_checker.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 1 +
drivers/gpu/drm/drm_panel_orientation_quirks.c | 13 +++
drivers/gpu/drm/drm_plane_helper.c | 1 -
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c | 8 +-
drivers/gpu/drm/msm/msm_gem.c | 4 +-
.../gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c | 1 -
drivers/gpu/drm/udl/udl_connector.c | 2 +-
drivers/hv/hyperv_vmbus.h | 1 +
drivers/hwmon/hwmon.c | 6 +-
drivers/hwmon/pmbus/lm25066.c | 25 +++++-
drivers/i2c/busses/i2c-xlr.c | 6 +-
drivers/iio/dac/ad5446.c | 9 ++-
drivers/infiniband/hw/bnxt_re/qplib_fp.c | 3 +-
drivers/infiniband/hw/mlx4/qp.c | 4 +-
drivers/infiniband/hw/qedr/verbs.c | 15 ++--
drivers/infiniband/sw/rxe/rxe_param.h | 2 +-
drivers/input/mouse/elantech.c | 13 +++
drivers/input/serio/i8042-x86ia64io.h | 14 ++++
drivers/irqchip/irq-bcm6345-l1.c | 2 +-
drivers/irqchip/irq-s3c24xx.c | 22 ++++-
drivers/media/dvb-frontends/mn88443x.c | 18 ++++-
drivers/media/i2c/ir-kbd-i2c.c | 1 +
drivers/media/i2c/mt9p031.c | 28 ++++++-
drivers/media/pci/cx23885/cx23885-alsa.c | 3 +-
drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 27 ++++---
drivers/media/platform/mtk-vpu/mtk_vpu.c | 5 +-
drivers/media/platform/rcar-vin/rcar-csi2.c | 2 +
drivers/media/platform/s5p-mfc/s5p_mfc.c | 6 +-
drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
drivers/media/radio/si470x/radio-si470x-usb.c | 2 +-
drivers/media/rc/ite-cir.c | 2 +-
drivers/media/rc/mceusb.c | 1 +
drivers/media/usb/dvb-usb/az6027.c | 1 +
drivers/media/usb/dvb-usb/dibusb-common.c | 2 +-
drivers/media/usb/em28xx/em28xx-cards.c | 5 +-
drivers/media/usb/em28xx/em28xx-core.c | 5 +-
drivers/media/usb/uvc/uvc_v4l2.c | 7 +-
drivers/media/usb/uvc/uvc_video.c | 5 ++
drivers/memory/fsl_ifc.c | 13 ++-
drivers/memstick/core/ms_block.c | 2 +-
drivers/memstick/host/jmb38x_ms.c | 2 +-
drivers/memstick/host/r592.c | 8 +-
drivers/mmc/host/Kconfig | 2 +-
drivers/mmc/host/dw_mmc.c | 3 +-
drivers/mmc/host/mxs-mmc.c | 10 +++
drivers/mmc/host/sdhci-omap.c | 3 +-
drivers/mtd/spi-nor/hisi-sfc.c | 1 -
drivers/net/bonding/bond_sysfs_slave.c | 36 +++------
drivers/net/dsa/rtl8366rb.c | 2 +-
drivers/net/ethernet/amd/xgbe/xgbe-common.h | 8 ++
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 20 ++++-
.../net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h | 4 +-
drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +-
drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 7 +-
drivers/net/ethernet/chelsio/cxgb4/t4_hw.h | 2 +
drivers/net/ethernet/ibm/ibmvnic.c | 3 +
drivers/net/ethernet/intel/i40e/i40e.h | 1 +
drivers/net/ethernet/intel/i40e/i40e_main.c | 45 +++++++----
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 53 +++---------
drivers/net/ethernet/intel/i40evf/i40evf_main.c | 5 +-
drivers/net/ethernet/sfc/ptp.c | 4 +-
drivers/net/ethernet/sfc/siena_sriov.c | 2 +-
drivers/net/ethernet/ti/davinci_emac.c | 16 +++-
drivers/net/phy/micrel.c | 5 +-
drivers/net/phy/phylink.c | 2 +-
drivers/net/tun.c | 5 ++
drivers/net/vmxnet3/vmxnet3_drv.c | 1 -
drivers/net/wireless/ath/ath10k/mac.c | 6 +-
drivers/net/wireless/ath/ath10k/usb.c | 7 +-
drivers/net/wireless/ath/ath10k/wmi.h | 3 +
drivers/net/wireless/ath/ath6kl/usb.c | 7 +-
drivers/net/wireless/ath/ath9k/main.c | 4 +-
drivers/net/wireless/ath/dfs_pattern_detector.c | 10 ++-
drivers/net/wireless/ath/wcn36xx/dxe.c | 12 ++-
drivers/net/wireless/ath/wcn36xx/main.c | 4 +-
drivers/net/wireless/ath/wcn36xx/smd.c | 44 +++++++---
drivers/net/wireless/broadcom/b43/phy_g.c | 2 +-
drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 3 +
drivers/net/wireless/marvell/libertas/if_usb.c | 2 +
drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +
drivers/net/wireless/marvell/mwifiex/11n.c | 5 +-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 +++-----
drivers/net/wireless/marvell/mwifiex/pcie.c | 8 ++
drivers/net/wireless/marvell/mwifiex/usb.c | 16 ++++
drivers/net/wireless/marvell/mwl8k.c | 2 +-
.../net/wireless/realtek/rtl818x/rtl8187/rtl8225.c | 14 ++--
drivers/net/wireless/rsi/rsi_91x_core.c | 2 +
drivers/net/wireless/rsi/rsi_91x_hal.c | 10 ++-
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 74 +++++------------
drivers/net/wireless/rsi/rsi_91x_main.c | 17 +++-
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 24 ++++--
drivers/net/wireless/rsi/rsi_91x_sdio.c | 5 +-
drivers/net/wireless/rsi/rsi_91x_usb.c | 5 +-
drivers/net/wireless/rsi/rsi_hal.h | 11 +++
drivers/net/wireless/rsi/rsi_main.h | 15 +++-
drivers/net/xen-netfront.c | 8 ++
drivers/nfc/pn533/pn533.c | 6 +-
drivers/nvme/host/rdma.c | 2 +
drivers/pci/controller/pci-aardvark.c | 23 +++---
drivers/pci/msi.c | 27 ++++---
drivers/pci/quirks.c | 7 ++
drivers/phy/qualcomm/phy-qcom-qusb2.c | 16 ++--
drivers/pinctrl/core.c | 2 +
drivers/platform/x86/hp_accel.c | 2 +
drivers/platform/x86/thinkpad_acpi.c | 2 +-
drivers/platform/x86/wmi.c | 9 ++-
drivers/power/supply/bq27xxx_battery_i2c.c | 3 +-
drivers/power/supply/max17042_battery.c | 8 +-
drivers/power/supply/rt5033_battery.c | 2 +-
drivers/regulator/s5m8767.c | 21 +++--
drivers/s390/char/tape_std.c | 3 +-
drivers/s390/cio/css.c | 4 +-
drivers/scsi/advansys.c | 4 +-
drivers/scsi/csiostor/csio_lnode.c | 2 +-
drivers/scsi/dc395x.c | 1 +
drivers/scsi/lpfc/lpfc_sli.c | 1 +
drivers/scsi/qla2xxx/qla_gbl.h | 2 -
drivers/scsi/qla2xxx/qla_init.c | 4 +-
drivers/scsi/qla2xxx/qla_mr.c | 23 ------
drivers/scsi/qla2xxx/qla_os.c | 27 +------
drivers/scsi/qla2xxx/qla_target.c | 14 ++--
drivers/sh/maple/maple.c | 5 +-
drivers/soc/tegra/pmc.c | 2 +-
drivers/spi/spi-bcm-qspi.c | 5 +-
drivers/spi/spi-pl022.c | 5 +-
drivers/staging/erofs/unzip_pagevec.h | 14 ++--
drivers/staging/erofs/unzip_vle.c | 19 +++--
drivers/target/target_core_alua.c | 1 -
drivers/target/target_core_device.c | 2 +
drivers/target/target_core_internal.h | 1 +
drivers/target/target_core_transport.c | 76 +++++++++++++-----
drivers/tty/serial/8250/8250_dw.c | 2 +-
drivers/tty/serial/serial_core.c | 16 +++-
drivers/tty/serial/xilinx_uartps.c | 3 +-
drivers/tty/tty_buffer.c | 3 +
drivers/usb/chipidea/core.c | 19 +++--
drivers/usb/gadget/legacy/hid.c | 4 +-
drivers/usb/host/max3421-hcd.c | 25 ++----
drivers/usb/host/ohci-tmio.c | 2 +-
drivers/usb/host/xhci-hub.c | 3 +-
drivers/usb/misc/iowarrior.c | 8 +-
drivers/usb/musb/tusb6010.c | 5 ++
drivers/usb/serial/keyspan.c | 15 ++--
drivers/usb/typec/tps6598x.c | 2 +-
drivers/video/backlight/backlight.c | 6 --
drivers/video/backlight/gpio_backlight.c | 24 +++++-
drivers/video/console/sticon.c | 12 +--
drivers/video/fbdev/chipsfb.c | 2 +-
drivers/watchdog/Kconfig | 2 +-
drivers/watchdog/f71808e_wdt.c | 4 +-
drivers/watchdog/omap_wdt.c | 6 +-
drivers/xen/balloon.c | 86 ++++++++++++++------
drivers/xen/xen-pciback/conf_space_capability.c | 2 +-
fs/btrfs/async-thread.c | 14 ++++
fs/btrfs/disk-io.c | 3 +-
fs/btrfs/tree-log.c | 4 +-
fs/btrfs/volumes.c | 4 +-
fs/ext4/super.c | 9 +--
fs/f2fs/inode.c | 2 +-
fs/f2fs/namei.c | 2 +-
fs/fuse/dev.c | 14 +++-
fs/fuse/file.c | 7 +-
fs/jfs/jfs_mount.c | 51 +++++-------
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 4 +-
fs/nfs/pnfs_nfs.c | 4 +-
fs/nfs/write.c | 17 +---
fs/ocfs2/file.c | 8 +-
fs/orangefs/dcache.c | 4 +-
fs/quota/quota_tree.c | 15 ++++
fs/tracefs/inode.c | 3 +-
fs/udf/dir.c | 32 +++++++-
fs/udf/namei.c | 3 +
fs/udf/super.c | 2 +
include/asm-generic/tlb.h | 6 ++
include/linux/console.h | 2 +
include/linux/filter.h | 1 +
include/linux/libata.h | 2 +-
include/linux/lsm_hooks.h | 28 +++----
include/linux/pci.h | 2 +
include/linux/rpmsg.h | 2 +-
include/linux/sched/task_stack.h | 4 +
include/linux/security.h | 28 +++----
include/linux/virtio_net.h | 7 +-
include/net/llc.h | 4 +-
include/net/sch_generic.h | 4 +
include/rdma/rdma_netlink.h | 2 +-
include/target/target_core_base.h | 6 +-
include/trace/events/f2fs.h | 12 +--
include/uapi/linux/pci_regs.h | 6 ++
ipc/util.c | 6 +-
kernel/bpf/core.c | 4 +-
kernel/cgroup/cgroup.c | 31 +++++++-
kernel/events/core.c | 10 +--
kernel/locking/lockdep.c | 2 +-
kernel/power/swap.c | 7 +-
kernel/sched/core.c | 3 +
kernel/signal.c | 18 +----
kernel/trace/tracing_map.c | 40 ++++++----
kernel/workqueue.c | 15 +++-
lib/decompress_unxz.c | 2 +-
lib/xz/xz_dec_lzma2.c | 21 ++++-
lib/xz/xz_dec_stream.c | 6 +-
mm/hugetlb.c | 23 +++++-
mm/oom_kill.c | 23 +++---
mm/slab.h | 2 +-
mm/zsmalloc.c | 7 +-
net/8021q/vlan.c | 3 -
net/8021q/vlan_dev.c | 3 +
net/9p/client.c | 2 +
net/batman-adv/fragmentation.c | 26 +++---
net/batman-adv/hard-interface.c | 3 +
net/batman-adv/multicast.c | 31 ++++++++
net/batman-adv/multicast.h | 15 ++++
net/batman-adv/soft-interface.c | 5 +-
net/bluetooth/l2cap_sock.c | 10 ++-
net/bluetooth/sco.c | 33 +++++---
net/core/dev.c | 2 +
net/core/stream.c | 3 -
net/core/sysctl_net_core.c | 2 +-
net/ipv4/tcp.c | 2 +-
net/ipv6/addrconf.c | 3 +
net/netfilter/nfnetlink_queue.c | 2 +-
net/nfc/core.c | 32 ++++----
net/nfc/nci/core.c | 11 ++-
net/sched/sch_generic.c | 9 +++
net/sched/sch_mq.c | 24 ++++++
net/sched/sch_mqprio.c | 23 ++++++
net/vmw_vsock/af_vsock.c | 2 +
net/wireless/util.c | 1 +
samples/kprobes/kretprobe_example.c | 2 +-
scripts/leaking_addresses.pl | 3 +-
security/Kconfig | 3 +
security/apparmor/label.c | 4 +-
security/integrity/evm/evm_main.c | 2 +-
security/security.c | 14 ++--
security/selinux/hooks.c | 36 ++++-----
security/smack/smackfs.c | 11 +--
sound/core/Makefile | 2 +
sound/core/oss/mixer_oss.c | 43 +++++++---
sound/core/timer.c | 17 ++--
sound/isa/Kconfig | 2 +-
sound/isa/gus/gus_dma.c | 2 +
sound/pci/Kconfig | 1 +
sound/pci/hda/hda_intel.c | 28 +++++--
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/codecs/cs42l42.c | 9 ++-
sound/soc/codecs/nau8824.c | 40 ++++++++++
sound/soc/soc-dapm.c | 29 +++++--
sound/synth/emux/emux.c | 2 +-
sound/usb/6fire/comm.c | 2 +-
sound/usb/6fire/firmware.c | 6 +-
sound/usb/line6/driver.c | 14 ++--
sound/usb/line6/driver.h | 2 +-
sound/usb/line6/podhd.c | 6 +-
sound/usb/line6/toneport.c | 2 +-
sound/usb/misc/ua101.c | 4 +-
sound/usb/quirks.c | 1 +
tools/perf/bench/sched-messaging.c | 4 +
tools/testing/selftests/bpf/test_progs.c | 4 +-
359 files changed, 2225 insertions(+), 1173 deletions(-)
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 001/323] xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 002/323] binder: use euid from cred instead of using task Greg Kroah-Hartman
` (325 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Walt Jr. Brake, Mathias Nyman
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit e1959faf085b004e6c3afaaaa743381f00e7c015 upstream.
Some USB 3.1 enumeration issues were reported after the hub driver removed
the minimum 100ms limit for the power-on-good delay.
Since commit 90d28fb53d4a ("usb: core: reduce power-on-good delay time of
root hub") the hub driver sets the power-on-delay based on the
bPwrOn2PwrGood value in the hub descriptor.
xhci driver has a 20ms bPwrOn2PwrGood value for both roothubs based
on xhci spec section 5.4.8, but it's clearly not enough for the
USB 3.1 devices, causing enumeration issues.
Tests indicate full 100ms delay is needed.
Reported-by: Walt Jr. Brake <mr.yming81@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Fixes: 90d28fb53d4a ("usb: core: reduce power-on-good delay time of root hub")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211105160036.549516-1-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-hub.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -171,7 +171,6 @@ static void xhci_common_hub_descriptor(s
{
u16 temp;
- desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.9 says 20ms max */
desc->bHubContrCurrent = 0;
desc->bNbrPorts = ports;
@@ -206,6 +205,7 @@ static void xhci_usb2_hub_descriptor(str
desc->bDescriptorType = USB_DT_HUB;
temp = 1 + (ports / 8);
desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * temp;
+ desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.8 says 20ms */
/* The Device Removable bits are reported on a byte granularity.
* If the port doesn't exist within that byte, the bit is set to 0.
@@ -258,6 +258,7 @@ static void xhci_usb3_hub_descriptor(str
xhci_common_hub_descriptor(xhci, desc, ports);
desc->bDescriptorType = USB_DT_SS_HUB;
desc->bDescLength = USB_DT_SS_HUB_SIZE;
+ desc->bPwrOn2PwrGood = 50; /* usb 3.1 may fail if less than 100ms */
/* header decode latency should be zero for roothubs,
* see section 4.23.5.2.
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 002/323] binder: use euid from cred instead of using task
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 001/323] xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 003/323] binder: use cred instead of task for selinux checks Greg Kroah-Hartman
` (324 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Todd Kjos, Stephen Smalley,
Jann Horn, Casey Schaufler, Paul Moore
From: Todd Kjos <tkjos@google.com>
commit 29bc22ac5e5bc63275e850f0c8fc549e3d0e306b upstream.
Save the 'struct cred' associated with a binder process
at initial open to avoid potential race conditions
when converting to an euid.
Set a transaction's sender_euid from the 'struct cred'
saved at binder_open() instead of looking up the euid
from the binder proc's 'struct task'. This ensures
the euid is associated with the security context that
of the task that opened binder.
Cc: stable@vger.kernel.org # 4.4+
Fixes: 457b9a6f09f0 ("Staging: android: add binder driver")
Signed-off-by: Todd Kjos <tkjos@google.com>
Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Suggested-by: Jann Horn <jannh@google.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -483,6 +483,9 @@ enum binder_deferred_state {
* @files files_struct for process
* (protected by @files_lock)
* @files_lock mutex to protect @files
+ * @cred struct cred associated with the `struct file`
+ * in binder_open()
+ * (invariant after initialized)
* @deferred_work_node: element for binder_deferred_list
* (protected by binder_deferred_lock)
* @deferred_work: bitmap of deferred work to perform
@@ -529,6 +532,7 @@ struct binder_proc {
struct task_struct *tsk;
struct files_struct *files;
struct mutex files_lock;
+ const struct cred *cred;
struct hlist_node deferred_work_node;
int deferred_work;
bool is_dead;
@@ -2962,7 +2966,7 @@ static void binder_transaction(struct bi
t->from = thread;
else
t->from = NULL;
- t->sender_euid = task_euid(proc->tsk);
+ t->sender_euid = proc->cred->euid;
t->to_proc = target_proc;
t->to_thread = target_thread;
t->code = tr->code;
@@ -4341,6 +4345,7 @@ static void binder_free_proc(struct bind
BUG_ON(!list_empty(&proc->delivered_death));
binder_alloc_deferred_release(&proc->alloc);
put_task_struct(proc->tsk);
+ put_cred(proc->cred);
binder_stats_deleted(BINDER_STAT_PROC);
kfree(proc);
}
@@ -4799,6 +4804,7 @@ static int binder_open(struct inode *nod
get_task_struct(current->group_leader);
proc->tsk = current->group_leader;
mutex_init(&proc->files_lock);
+ proc->cred = get_cred(filp->f_cred);
INIT_LIST_HEAD(&proc->todo);
proc->default_priority = task_nice(current);
binder_dev = container_of(filp->private_data, struct binder_device,
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 003/323] binder: use cred instead of task for selinux checks
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 001/323] xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 002/323] binder: use euid from cred instead of using task Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 004/323] Input: elantench - fix misreporting trackpoint coordinates Greg Kroah-Hartman
` (323 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jann Horn, Todd Kjos,
Casey Schaufler, Paul Moore
From: Todd Kjos <tkjos@google.com>
commit 52f88693378a58094c538662ba652aff0253c4fe upstream.
Since binder was integrated with selinux, it has passed
'struct task_struct' associated with the binder_proc
to represent the source and target of transactions.
The conversion of task to SID was then done in the hook
implementations. It turns out that there are race conditions
which can result in an incorrect security context being used.
Fix by using the 'struct cred' saved during binder_open and pass
it to the selinux subsystem.
Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables)
Fixes: 79af73079d75 ("Add security hooks to binder and implement the hooks for SELinux.")
Suggested-by: Jann Horn <jannh@google.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 12 ++++++------
include/linux/lsm_hooks.h | 28 ++++++++++++++--------------
include/linux/security.h | 28 ++++++++++++++--------------
security/security.c | 14 +++++++-------
security/selinux/hooks.c | 36 +++++++++++++++---------------------
5 files changed, 56 insertions(+), 62 deletions(-)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2337,7 +2337,7 @@ static int binder_translate_binder(struc
ret = -EINVAL;
goto done;
}
- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
+ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
ret = -EPERM;
goto done;
}
@@ -2383,7 +2383,7 @@ static int binder_translate_handle(struc
proc->pid, thread->pid, fp->handle);
return -EINVAL;
}
- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
+ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
ret = -EPERM;
goto done;
}
@@ -2467,7 +2467,7 @@ static int binder_translate_fd(int fd,
ret = -EBADF;
goto err_fget;
}
- ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file);
+ ret = security_binder_transfer_file(proc->cred, target_proc->cred, file);
if (ret < 0) {
ret = -EPERM;
goto err_security;
@@ -2851,8 +2851,8 @@ static void binder_transaction(struct bi
return_error_line = __LINE__;
goto err_invalid_target_handle;
}
- if (security_binder_transaction(proc->tsk,
- target_proc->tsk) < 0) {
+ if (security_binder_transaction(proc->cred,
+ target_proc->cred) < 0) {
return_error = BR_FAILED_REPLY;
return_error_param = -EPERM;
return_error_line = __LINE__;
@@ -4549,7 +4549,7 @@ static int binder_ioctl_set_ctx_mgr(stru
ret = -EBUSY;
goto out;
}
- ret = security_binder_set_context_mgr(proc->tsk);
+ ret = security_binder_set_context_mgr(proc->cred);
if (ret < 0)
goto out;
if (uid_valid(context->binder_context_mgr_uid)) {
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -1211,22 +1211,22 @@
*
* @binder_set_context_mgr:
* Check whether @mgr is allowed to be the binder context manager.
- * @mgr contains the task_struct for the task being registered.
+ * @mgr contains the struct cred for the current binder process.
* Return 0 if permission is granted.
* @binder_transaction:
* Check whether @from is allowed to invoke a binder transaction call
* to @to.
- * @from contains the task_struct for the sending task.
- * @to contains the task_struct for the receiving task.
+ * @from contains the struct cred for the sending process.
+ * @to contains the struct cred for the receiving process.
* @binder_transfer_binder:
* Check whether @from is allowed to transfer a binder reference to @to.
- * @from contains the task_struct for the sending task.
- * @to contains the task_struct for the receiving task.
+ * @from contains the struct cred for the sending process.
+ * @to contains the struct cred for the receiving process.
* @binder_transfer_file:
* Check whether @from is allowed to transfer @file to @to.
- * @from contains the task_struct for the sending task.
+ * @from contains the struct cred for the sending process.
* @file contains the struct file being transferred.
- * @to contains the task_struct for the receiving task.
+ * @to contains the struct cred for the receiving process.
*
* @ptrace_access_check:
* Check permission before allowing the current process to trace the
@@ -1428,13 +1428,13 @@
*
*/
union security_list_options {
- int (*binder_set_context_mgr)(struct task_struct *mgr);
- int (*binder_transaction)(struct task_struct *from,
- struct task_struct *to);
- int (*binder_transfer_binder)(struct task_struct *from,
- struct task_struct *to);
- int (*binder_transfer_file)(struct task_struct *from,
- struct task_struct *to,
+ int (*binder_set_context_mgr)(const struct cred *mgr);
+ int (*binder_transaction)(const struct cred *from,
+ const struct cred *to);
+ int (*binder_transfer_binder)(const struct cred *from,
+ const struct cred *to);
+ int (*binder_transfer_file)(const struct cred *from,
+ const struct cred *to,
struct file *file);
int (*ptrace_access_check)(struct task_struct *child,
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -219,13 +219,13 @@ static inline void security_free_mnt_opt
extern int security_init(void);
/* Security operations */
-int security_binder_set_context_mgr(struct task_struct *mgr);
-int security_binder_transaction(struct task_struct *from,
- struct task_struct *to);
-int security_binder_transfer_binder(struct task_struct *from,
- struct task_struct *to);
-int security_binder_transfer_file(struct task_struct *from,
- struct task_struct *to, struct file *file);
+int security_binder_set_context_mgr(const struct cred *mgr);
+int security_binder_transaction(const struct cred *from,
+ const struct cred *to);
+int security_binder_transfer_binder(const struct cred *from,
+ const struct cred *to);
+int security_binder_transfer_file(const struct cred *from,
+ const struct cred *to, struct file *file);
int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
int security_ptrace_traceme(struct task_struct *parent);
int security_capget(struct task_struct *target,
@@ -442,25 +442,25 @@ static inline int security_init(void)
return 0;
}
-static inline int security_binder_set_context_mgr(struct task_struct *mgr)
+static inline int security_binder_set_context_mgr(const struct cred *mgr)
{
return 0;
}
-static inline int security_binder_transaction(struct task_struct *from,
- struct task_struct *to)
+static inline int security_binder_transaction(const struct cred *from,
+ const struct cred *to)
{
return 0;
}
-static inline int security_binder_transfer_binder(struct task_struct *from,
- struct task_struct *to)
+static inline int security_binder_transfer_binder(const struct cred *from,
+ const struct cred *to)
{
return 0;
}
-static inline int security_binder_transfer_file(struct task_struct *from,
- struct task_struct *to,
+static inline int security_binder_transfer_file(const struct cred *from,
+ const struct cred *to,
struct file *file)
{
return 0;
--- a/security/security.c
+++ b/security/security.c
@@ -232,25 +232,25 @@ EXPORT_SYMBOL(unregister_lsm_notifier);
/* Security operations */
-int security_binder_set_context_mgr(struct task_struct *mgr)
+int security_binder_set_context_mgr(const struct cred *mgr)
{
return call_int_hook(binder_set_context_mgr, 0, mgr);
}
-int security_binder_transaction(struct task_struct *from,
- struct task_struct *to)
+int security_binder_transaction(const struct cred *from,
+ const struct cred *to)
{
return call_int_hook(binder_transaction, 0, from, to);
}
-int security_binder_transfer_binder(struct task_struct *from,
- struct task_struct *to)
+int security_binder_transfer_binder(const struct cred *from,
+ const struct cred *to)
{
return call_int_hook(binder_transfer_binder, 0, from, to);
}
-int security_binder_transfer_file(struct task_struct *from,
- struct task_struct *to, struct file *file)
+int security_binder_transfer_file(const struct cred *from,
+ const struct cred *to, struct file *file)
{
return call_int_hook(binder_transfer_file, 0, from, to, file);
}
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2218,22 +2218,19 @@ static inline u32 open_file_to_av(struct
/* Hook functions begin here. */
-static int selinux_binder_set_context_mgr(struct task_struct *mgr)
+static int selinux_binder_set_context_mgr(const struct cred *mgr)
{
- u32 mysid = current_sid();
- u32 mgrsid = task_sid(mgr);
-
return avc_has_perm(&selinux_state,
- mysid, mgrsid, SECCLASS_BINDER,
+ current_sid(), cred_sid(mgr), SECCLASS_BINDER,
BINDER__SET_CONTEXT_MGR, NULL);
}
-static int selinux_binder_transaction(struct task_struct *from,
- struct task_struct *to)
+static int selinux_binder_transaction(const struct cred *from,
+ const struct cred *to)
{
u32 mysid = current_sid();
- u32 fromsid = task_sid(from);
- u32 tosid = task_sid(to);
+ u32 fromsid = cred_sid(from);
+ u32 tosid = cred_sid(to);
int rc;
if (mysid != fromsid) {
@@ -2244,27 +2241,24 @@ static int selinux_binder_transaction(st
return rc;
}
- return avc_has_perm(&selinux_state,
- fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
- NULL);
+ return avc_has_perm(&selinux_state, fromsid, tosid,
+ SECCLASS_BINDER, BINDER__CALL, NULL);
}
-static int selinux_binder_transfer_binder(struct task_struct *from,
- struct task_struct *to)
+static int selinux_binder_transfer_binder(const struct cred *from,
+ const struct cred *to)
{
- u32 fromsid = task_sid(from);
- u32 tosid = task_sid(to);
-
return avc_has_perm(&selinux_state,
- fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
+ cred_sid(from), cred_sid(to),
+ SECCLASS_BINDER, BINDER__TRANSFER,
NULL);
}
-static int selinux_binder_transfer_file(struct task_struct *from,
- struct task_struct *to,
+static int selinux_binder_transfer_file(const struct cred *from,
+ const struct cred *to,
struct file *file)
{
- u32 sid = task_sid(to);
+ u32 sid = cred_sid(to);
struct file_security_struct *fsec = file->f_security;
struct dentry *dentry = file->f_path.dentry;
struct inode_security_struct *isec;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 004/323] Input: elantench - fix misreporting trackpoint coordinates
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 003/323] binder: use cred instead of task for selinux checks Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 005/323] Input: i8042 - Add quirk for Fujitsu Lifebook T725 Greg Kroah-Hartman
` (322 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Phoenix Huang, Yufei Du, Dmitry Torokhov
From: Phoenix Huang <phoenix@emc.com.tw>
commit be896bd3b72b44126c55768f14c22a8729b0992e upstream.
Some firmwares occasionally report bogus data from trackpoint, with X or Y
displacement being too large (outside of [-127, 127] range). Let's drop such
packets so that we do not generate jumps.
Signed-off-by: Phoenix Huang <phoenix@emc.com.tw>
Tested-by: Yufei Du <yufeidu@cs.unc.edu>
Link: https://lore.kernel.org/r/20210729010940.5752-1-phoenix@emc.com.tw
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/elantech.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -433,6 +433,19 @@ static void elantech_report_trackpoint(s
case 0x16008020U:
case 0x26800010U:
case 0x36808000U:
+
+ /*
+ * This firmware misreport coordinates for trackpoint
+ * occasionally. Discard packets outside of [-127, 127] range
+ * to prevent cursor jumps.
+ */
+ if (packet[4] == 0x80 || packet[5] == 0x80 ||
+ packet[1] >> 7 == packet[4] >> 7 ||
+ packet[2] >> 7 == packet[5] >> 7) {
+ elantech_debug("discarding packet [%6ph]\n", packet);
+ break;
+
+ }
x = packet[4] - (int)((packet[1]^0x80) << 1);
y = (int)((packet[2]^0x80) << 1) - packet[5];
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 005/323] Input: i8042 - Add quirk for Fujitsu Lifebook T725
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 004/323] Input: elantench - fix misreporting trackpoint coordinates Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 006/323] libata: fix read log timeout value Greg Kroah-Hartman
` (321 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Neal Gompa, Takashi Iwai, Dmitry Torokhov
From: Takashi Iwai <tiwai@suse.de>
commit 16e28abb7290c4ca3b3a0f333ba067f34bb18c86 upstream.
Fujitsu Lifebook T725 laptop requires, like a few other similar
models, the nomux and notimeout options to probe the touchpad
properly. This patch adds the corresponding quirk entries.
BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1191980
Tested-by: Neal Gompa <ngompa13@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20211103070019.13374-1-tiwai@suse.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-x86ia64io.h | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -277,6 +277,13 @@ static const struct dmi_system_id __init
},
},
{
+ /* Fujitsu Lifebook T725 laptop */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"),
+ },
+ },
+ {
/* Fujitsu Lifebook U745 */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
@@ -845,6 +852,13 @@ static const struct dmi_system_id __init
},
},
{
+ /* Fujitsu Lifebook T725 laptop */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"),
+ },
+ },
+ {
/* Fujitsu U574 laptop */
/* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
.matches = {
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 006/323] libata: fix read log timeout value
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 005/323] Input: i8042 - Add quirk for Fujitsu Lifebook T725 Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 007/323] ocfs2: fix data corruption on truncate Greg Kroah-Hartman
` (320 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven,
Geert Uytterhoeven, Damien Le Moal
From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
commit 68dbbe7d5b4fde736d104cbbc9a2fce875562012 upstream.
Some ATA drives are very slow to respond to READ_LOG_EXT and
READ_LOG_DMA_EXT commands issued from ata_dev_configure() when the
device is revalidated right after resuming a system or inserting the
ATA adapter driver (e.g. ahci). The default 5s timeout
(ATA_EH_CMD_DFL_TIMEOUT) used for these commands is too short, causing
errors during the device configuration. Ex:
...
ata9: SATA max UDMA/133 abar m524288@0x9d200000 port 0x9d200400 irq 209
ata9: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
ata9.00: ATA-9: XXX XXXXXXXXXXXXXXX, XXXXXXXX, max UDMA/133
ata9.00: qc timeout (cmd 0x2f)
ata9.00: Read log page 0x00 failed, Emask 0x4
ata9.00: Read log page 0x00 failed, Emask 0x40
ata9.00: NCQ Send/Recv Log not supported
ata9.00: Read log page 0x08 failed, Emask 0x40
ata9.00: 27344764928 sectors, multi 16: LBA48 NCQ (depth 32), AA
ata9.00: Read log page 0x00 failed, Emask 0x40
ata9.00: ATA Identify Device Log not supported
ata9.00: failed to set xfermode (err_mask=0x40)
ata9: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
ata9.00: configured for UDMA/133
...
The timeout error causes a soft reset of the drive link, followed in
most cases by a successful revalidation as that give enough time to the
drive to become fully ready to quickly process the read log commands.
However, in some cases, this also fails resulting in the device being
dropped.
Fix this by using adding the ata_eh_revalidate_timeouts entries for the
READ_LOG_EXT and READ_LOG_DMA_EXT commands. This defines a timeout
increased to 15s, retriable one time.
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-eh.c | 8 ++++++++
include/linux/libata.h | 2 +-
2 files changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -114,6 +114,12 @@ static const unsigned long ata_eh_identi
ULONG_MAX,
};
+static const unsigned long ata_eh_revalidate_timeouts[] = {
+ 15000, /* Some drives are slow to read log pages when waking-up */
+ 15000, /* combined time till here is enough even for media access */
+ ULONG_MAX,
+};
+
static const unsigned long ata_eh_flush_timeouts[] = {
15000, /* be generous with flush */
15000, /* ditto */
@@ -150,6 +156,8 @@ static const struct ata_eh_cmd_timeout_e
ata_eh_cmd_timeout_table[ATA_EH_CMD_TIMEOUT_TABLE_SIZE] = {
{ .commands = CMDS(ATA_CMD_ID_ATA, ATA_CMD_ID_ATAPI),
.timeouts = ata_eh_identify_timeouts, },
+ { .commands = CMDS(ATA_CMD_READ_LOG_EXT, ATA_CMD_READ_LOG_DMA_EXT),
+ .timeouts = ata_eh_revalidate_timeouts, },
{ .commands = CMDS(ATA_CMD_READ_NATIVE_MAX, ATA_CMD_READ_NATIVE_MAX_EXT),
.timeouts = ata_eh_other_timeouts, },
{ .commands = CMDS(ATA_CMD_SET_MAX, ATA_CMD_SET_MAX_EXT),
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -408,7 +408,7 @@ enum {
/* This should match the actual table size of
* ata_eh_cmd_timeout_table in libata-eh.c.
*/
- ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 6,
+ ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 7,
/* Horkage types. May be set by libata or controller on drives
(some horkage may be drive/controller pair dependent */
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 007/323] ocfs2: fix data corruption on truncate
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 006/323] libata: fix read log timeout value Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 008/323] mmc: dw_mmc: Dont wait for DRTO on Write RSP error Greg Kroah-Hartman
` (319 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Kara, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Gang He, Jun Piao,
Andrew Morton, Linus Torvalds
From: Jan Kara <jack@suse.cz>
commit 839b63860eb3835da165642923120d305925561d upstream.
Patch series "ocfs2: Truncate data corruption fix".
As further testing has shown, commit 5314454ea3f ("ocfs2: fix data
corruption after conversion from inline format") didn't fix all the data
corruption issues the customer started observing after 6dbf7bb55598
("fs: Don't invalidate page buffers in block_write_full_page()") This
time I have tracked them down to two bugs in ocfs2 truncation code.
One bug (truncating page cache before clearing tail cluster and setting
i_size) could cause data corruption even before 6dbf7bb55598, but before
that commit it needed a race with page fault, after 6dbf7bb55598 it
started to be pretty deterministic.
Another bug (zeroing pages beyond old i_size) used to be harmless
inefficiency before commit 6dbf7bb55598. But after commit 6dbf7bb55598
in combination with the first bug it resulted in deterministic data
corruption.
Although fixing only the first problem is needed to stop data
corruption, I've fixed both issues to make the code more robust.
This patch (of 2):
ocfs2_truncate_file() did unmap invalidate page cache pages before
zeroing partial tail cluster and setting i_size. Thus some pages could
be left (and likely have left if the cluster zeroing happened) in the
page cache beyond i_size after truncate finished letting user possibly
see stale data once the file was extended again. Also the tail cluster
zeroing was not guaranteed to finish before truncate finished causing
possible stale data exposure. The problem started to be particularly
easy to hit after commit 6dbf7bb55598 "fs: Don't invalidate page buffers
in block_write_full_page()" stopped invalidation of pages beyond i_size
from page writeback path.
Fix these problems by unmapping and invalidating pages in the page cache
after the i_size is reduced and tail cluster is zeroed out.
Link: https://lkml.kernel.org/r/20211025150008.29002-1-jack@suse.cz
Link: https://lkml.kernel.org/r/20211025151332.11301-1-jack@suse.cz
Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/file.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -492,10 +492,11 @@ int ocfs2_truncate_file(struct inode *in
* greater than page size, so we have to truncate them
* anyway.
*/
- unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
- truncate_inode_pages(inode->i_mapping, new_i_size);
if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+ unmap_mapping_range(inode->i_mapping,
+ new_i_size + PAGE_SIZE - 1, 0, 1);
+ truncate_inode_pages(inode->i_mapping, new_i_size);
status = ocfs2_truncate_inline(inode, di_bh, new_i_size,
i_size_read(inode), 1);
if (status)
@@ -514,6 +515,9 @@ int ocfs2_truncate_file(struct inode *in
goto bail_unlock_sem;
}
+ unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
+ truncate_inode_pages(inode->i_mapping, new_i_size);
+
status = ocfs2_commit_truncate(osb, inode, di_bh);
if (status < 0) {
mlog_errno(status);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 008/323] mmc: dw_mmc: Dont wait for DRTO on Write RSP error
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 007/323] ocfs2: fix data corruption on truncate Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 009/323] parisc: Fix ptrace check on syscall return Greg Kroah-Hartman
` (318 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Loehle, Jaehoon Chung, Ulf Hansson
From: Christian Löhle <CLoehle@hyperstone.com>
commit 43592c8736e84025d7a45e61a46c3fa40536a364 upstream.
Only wait for DRTO on reads, otherwise the driver hangs.
The driver prevents sending CMD12 on response errors like CRCs. According
to the comment this is because some cards have problems with this during
the UHS tuning sequence. Unfortunately this workaround currently also
applies for any command with data. On reads this will set the drto timer,
which then triggers after a while. On writes this will not set any timer
and the tasklet will not be scheduled again.
I cannot test for the UHS workarounds need, but even if so, it should at
most apply to reads. I have observed many hangs when CMD25 response
contained a CRC error. This patch fixes this without touching the actual
UHS tuning workaround.
Signed-off-by: Christian Loehle <cloehle@hyperstone.com>
Reviewed-by: Jaehoon Chung <jh80.chung@samsung.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/af8f8b8674ba4fcc9a781019e4aeb72c@hyperstone.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/dw_mmc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -2039,7 +2039,8 @@ static void dw_mci_tasklet_func(unsigned
* delayed. Allowing the transfer to take place
* avoids races and keeps things simple.
*/
- if (err != -ETIMEDOUT) {
+ if (err != -ETIMEDOUT &&
+ host->dir_status == DW_MCI_RECV_STATUS) {
state = STATE_SENDING_DATA;
continue;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 009/323] parisc: Fix ptrace check on syscall return
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 008/323] mmc: dw_mmc: Dont wait for DRTO on Write RSP error Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 010/323] tpm: Check for integer overflow in tpm2_map_response_body() Greg Kroah-Hartman
` (317 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Helge Deller, Kyle McMartin
From: Helge Deller <deller@gmx.de>
commit 8779e05ba8aaffec1829872ef9774a71f44f6580 upstream.
The TIF_XXX flags are stored in the flags field in the thread_info
struct (TI_FLAGS), not in the flags field of the task_struct structure
(TASK_FLAGS).
It seems this bug didn't generate any important side-effects, otherwise it
wouldn't have went unnoticed for 12 years (since v2.6.32).
Signed-off-by: Helge Deller <deller@gmx.de>
Fixes: ecd3d4bc06e48 ("parisc: stop using task->ptrace for {single,block}step flags")
Cc: Kyle McMartin <kyle@mcmartin.ca>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/kernel/entry.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -1851,7 +1851,7 @@ syscall_restore:
LDREG TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1
/* Are we being ptraced? */
- ldw TASK_FLAGS(%r1),%r19
+ LDREG TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19
ldi _TIF_SYSCALL_TRACE_MASK,%r2
and,COND(=) %r19,%r2,%r0
b,n syscall_restore_rfi
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 010/323] tpm: Check for integer overflow in tpm2_map_response_body()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 009/323] parisc: Fix ptrace check on syscall return Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 011/323] firmware/psci: fix application of sizeof to pointer Greg Kroah-Hartman
` (316 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jarkko Sakkinen
From: Dan Carpenter <dan.carpenter@oracle.com>
commit a0bcce2b2a169e10eb265c8f0ebdd5ae4c875670 upstream.
The "4 * be32_to_cpu(data->count)" multiplication can potentially
overflow which would lead to memory corruption. Add a check for that.
Cc: stable@vger.kernel.org
Fixes: 745b361e989a ("tpm: infrastructure for TPM spaces")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm2-space.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/char/tpm/tpm2-space.c
+++ b/drivers/char/tpm/tpm2-space.c
@@ -419,6 +419,9 @@ static int tpm2_map_response_body(struct
if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES)
return 0;
+ if (be32_to_cpu(data->count) > (UINT_MAX - TPM_HEADER_SIZE - 9) / 4)
+ return -EFAULT;
+
if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count))
return -EFAULT;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 011/323] firmware/psci: fix application of sizeof to pointer
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 010/323] tpm: Check for integer overflow in tpm2_map_response_body() Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 012/323] crypto: s5p-sss - Add error handling in s5p_aes_probe() Greg Kroah-Hartman
` (315 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zeal Robot, Mark Rutland,
Gustavo A. R. Silva, jing yangyang
From: jing yangyang <cgel.zte@gmail.com>
commit 2ac5fb35cd520ab1851c9a4816c523b65276052f upstream.
sizeof when applied to a pointer typed expression gives the size of
the pointer.
./drivers/firmware/psci/psci_checker.c:158:41-47: ERROR application of sizeof to pointer
This issue was detected with the help of Coccinelle.
Fixes: 7401056de5f8 ("drivers/firmware: psci_checker: stash and use topology_core_cpumask for hotplug tests")
Cc: stable@vger.kernel.org
Reported-by: Zeal Robot <zealci@zte.com.cn>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: jing yangyang <jing.yangyang@zte.com.cn>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/psci_checker.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/firmware/psci_checker.c
+++ b/drivers/firmware/psci_checker.c
@@ -162,7 +162,7 @@ static int alloc_init_cpu_groups(cpumask
if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
return -ENOMEM;
- cpu_groups = kcalloc(nb_available_cpus, sizeof(cpu_groups),
+ cpu_groups = kcalloc(nb_available_cpus, sizeof(*cpu_groups),
GFP_KERNEL);
if (!cpu_groups) {
free_cpumask_var(tmp);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 012/323] crypto: s5p-sss - Add error handling in s5p_aes_probe()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 011/323] firmware/psci: fix application of sizeof to pointer Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 013/323] media: ite-cir: IR receiver stop working after receive overflow Greg Kroah-Hartman
` (314 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tang Bin, Krzysztof Kozlowski, Herbert Xu
From: Tang Bin <tangbin@cmss.chinamobile.com>
commit a472cc0dde3eb057db71c80f102556eeced03805 upstream.
The function s5p_aes_probe() does not perform sufficient error
checking after executing platform_get_resource(), thus fix it.
Fixes: c2afad6c6105 ("crypto: s5p-sss - Add HASH support for Exynos")
Cc: <stable@vger.kernel.org>
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/s5p-sss.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/crypto/s5p-sss.c
+++ b/drivers/crypto/s5p-sss.c
@@ -2166,6 +2166,8 @@ static int s5p_aes_probe(struct platform
variant = find_s5p_sss_version(pdev);
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!res)
+ return -EINVAL;
/*
* Note: HASH and PRNG uses the same registers in secss, avoid
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 013/323] media: ite-cir: IR receiver stop working after receive overflow
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 012/323] crypto: s5p-sss - Add error handling in s5p_aes_probe() Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 014/323] media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers Greg Kroah-Hartman
` (313 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bryan Pass, Sean Young,
Mauro Carvalho Chehab
From: Sean Young <sean@mess.org>
commit fdc881783099c6343921ff017450831c8766d12a upstream.
On an Intel NUC6iSYK, no IR is reported after a receive overflow.
When a receiver overflow occurs, this condition is only cleared by
reading the fifo. Make sure we read anything in the fifo.
Fixes: 28c7afb07ccf ("media: ite-cir: check for receive overflow")
Suggested-by: Bryan Pass <bryan.pass@gmail.com>
Tested-by: Bryan Pass <bryan.pass@gmail.com>
Cc: stable@vger.kernel.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/ite-cir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/rc/ite-cir.c
+++ b/drivers/media/rc/ite-cir.c
@@ -292,7 +292,7 @@ static irqreturn_t ite_cir_isr(int irq,
}
/* check for the receive interrupt */
- if (iflags & ITE_IRQ_RX_FIFO) {
+ if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) {
/* read the FIFO bytes */
rx_bytes =
dev->params.get_rx_bytes(dev, rx_buf,
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 014/323] media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 013/323] media: ite-cir: IR receiver stop working after receive overflow Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 015/323] ALSA: hda/realtek: Add quirk for Clevo PC70HS Greg Kroah-Hartman
` (312 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable,
Joaquín Alberto Calderón Pozo, Sean Young,
Mauro Carvalho Chehab
From: Sean Young <sean@mess.org>
commit c73ba202a851c0b611ef2c25e568fadeff5e667f upstream.
The IR receiver has two issues:
- Sometimes there is no response to a button press
- Sometimes a button press is repeated when it should not have been
Hanging the polling interval fixes this behaviour.
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994050
Cc: stable@vger.kernel.org
Suggested-by: Joaquín Alberto Calderón Pozo <kini_calderon@hotmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ir-kbd-i2c.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/i2c/ir-kbd-i2c.c
+++ b/drivers/media/i2c/ir-kbd-i2c.c
@@ -801,6 +801,7 @@ static int ir_probe(struct i2c_client *c
rc_proto = RC_PROTO_BIT_RC5 | RC_PROTO_BIT_RC6_MCE |
RC_PROTO_BIT_RC6_6A_32;
ir_codes = RC_MAP_HAUPPAUGE;
+ ir->polling_interval = 125;
probe_tx = true;
break;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 015/323] ALSA: hda/realtek: Add quirk for Clevo PC70HS
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 014/323] media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 016/323] ALSA: ua101: fix division by zero at probe Greg Kroah-Hartman
` (311 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tim Crawford, Takashi Iwai
From: Tim Crawford <tcrawford@system76.com>
commit dbfe83507cf4ea66ce4efee2ac14c5ad420e31d3 upstream.
Apply the PB51ED PCI quirk to the Clevo PC70HS. Fixes audio output from
the internal speakers.
Signed-off-by: Tim Crawford <tcrawford@system76.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211101162134.5336-1-tcrawford@system76.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2525,6 +2525,7 @@ static const struct snd_pci_quirk alc882
SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67f1, "Clevo PC70H[PRS]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
SND_PCI_QUIRK(0x1558, 0x7715, "Clevo X170KM-G", ALC1220_FIXUP_CLEVO_PB51ED),
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 016/323] ALSA: ua101: fix division by zero at probe
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 015/323] ALSA: hda/realtek: Add quirk for Clevo PC70HS Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 017/323] ALSA: 6fire: fix control and bulk message timeouts Greg Kroah-Hartman
` (310 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Takashi Iwai
From: Johan Hovold <johan@kernel.org>
commit 55f261b73a7e1cb254577c3536cef8f415de220a upstream.
Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in alloc_stream_buffers() in case a malicious device
has broken descriptors (or when doing descriptor fuzz testing).
Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).
Fixes: 63978ab3e3e9 ("sound: add Edirol UA-101 support")
Cc: stable@vger.kernel.org # 2.6.34
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211026095401.26522-1-johan@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/misc/ua101.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/usb/misc/ua101.c
+++ b/sound/usb/misc/ua101.c
@@ -1030,7 +1030,7 @@ static int detect_usb_format(struct ua10
fmt_playback->bSubframeSize * ua->playback.channels;
epd = &ua->intf[INTF_CAPTURE]->altsetting[1].endpoint[0].desc;
- if (!usb_endpoint_is_isoc_in(epd)) {
+ if (!usb_endpoint_is_isoc_in(epd) || usb_endpoint_maxp(epd) == 0) {
dev_err(&ua->dev->dev, "invalid capture endpoint\n");
return -ENXIO;
}
@@ -1038,7 +1038,7 @@ static int detect_usb_format(struct ua10
ua->capture.max_packet_bytes = usb_endpoint_maxp(epd);
epd = &ua->intf[INTF_PLAYBACK]->altsetting[1].endpoint[0].desc;
- if (!usb_endpoint_is_isoc_out(epd)) {
+ if (!usb_endpoint_is_isoc_out(epd) || usb_endpoint_maxp(epd) == 0) {
dev_err(&ua->dev->dev, "invalid playback endpoint\n");
return -ENXIO;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 017/323] ALSA: 6fire: fix control and bulk message timeouts
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 016/323] ALSA: ua101: fix division by zero at probe Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 018/323] ALSA: line6: fix control and interrupt " Greg Kroah-Hartman
` (309 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Takashi Iwai
From: Johan Hovold <johan@kernel.org>
commit 9b371c6cc37f954360989eec41c2ddc5a6b83917 upstream.
USB control and bulk message timeouts are specified in milliseconds and
should specifically not vary with CONFIG_HZ.
Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB")
Cc: stable@vger.kernel.org # 2.6.39
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211025121142.6531-2-johan@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/6fire/comm.c | 2 +-
sound/usb/6fire/firmware.c | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/sound/usb/6fire/comm.c
+++ b/sound/usb/6fire/comm.c
@@ -99,7 +99,7 @@ static int usb6fire_comm_send_buffer(u8
int actual_len;
ret = usb_interrupt_msg(dev, usb_sndintpipe(dev, COMM_EP),
- buffer, buffer[1] + 2, &actual_len, HZ);
+ buffer, buffer[1] + 2, &actual_len, 1000);
if (ret < 0)
return ret;
else if (actual_len != buffer[1] + 2)
--- a/sound/usb/6fire/firmware.c
+++ b/sound/usb/6fire/firmware.c
@@ -166,7 +166,7 @@ static int usb6fire_fw_ezusb_write(struc
ret = usb_control_msg(device, usb_sndctrlpipe(device, 0), type,
USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- value, 0, data, len, HZ);
+ value, 0, data, len, 1000);
if (ret < 0)
return ret;
else if (ret != len)
@@ -179,7 +179,7 @@ static int usb6fire_fw_ezusb_read(struct
{
int ret = usb_control_msg(device, usb_rcvctrlpipe(device, 0), type,
USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, value,
- 0, data, len, HZ);
+ 0, data, len, 1000);
if (ret < 0)
return ret;
else if (ret != len)
@@ -194,7 +194,7 @@ static int usb6fire_fw_fpga_write(struct
int ret;
ret = usb_bulk_msg(device, usb_sndbulkpipe(device, FPGA_EP), data, len,
- &actual_len, HZ);
+ &actual_len, 1000);
if (ret < 0)
return ret;
else if (actual_len != len)
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 018/323] ALSA: line6: fix control and interrupt message timeouts
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 017/323] ALSA: 6fire: fix control and bulk message timeouts Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 019/323] ALSA: usb-audio: Add registration quirk for JBL Quantum 400 Greg Kroah-Hartman
` (308 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Takashi Iwai
From: Johan Hovold <johan@kernel.org>
commit f4000b58b64344871d7b27c05e73932f137cfef6 upstream.
USB control and interrupt message timeouts are specified in milliseconds
and should specifically not vary with CONFIG_HZ.
Fixes: 705ececd1c60 ("Staging: add line6 usb driver")
Cc: stable@vger.kernel.org # 2.6.30
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211025121142.6531-3-johan@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/line6/driver.c | 14 +++++++-------
sound/usb/line6/driver.h | 2 +-
sound/usb/line6/podhd.c | 6 +++---
sound/usb/line6/toneport.c | 2 +-
4 files changed, 12 insertions(+), 12 deletions(-)
--- a/sound/usb/line6/driver.c
+++ b/sound/usb/line6/driver.c
@@ -117,12 +117,12 @@ static int line6_send_raw_message(struct
retval = usb_interrupt_msg(line6->usbdev,
usb_sndintpipe(line6->usbdev, properties->ep_ctrl_w),
(char *)frag_buf, frag_size,
- &partial, LINE6_TIMEOUT * HZ);
+ &partial, LINE6_TIMEOUT);
} else {
retval = usb_bulk_msg(line6->usbdev,
usb_sndbulkpipe(line6->usbdev, properties->ep_ctrl_w),
(char *)frag_buf, frag_size,
- &partial, LINE6_TIMEOUT * HZ);
+ &partial, LINE6_TIMEOUT);
}
if (retval) {
@@ -365,7 +365,7 @@ int line6_read_data(struct usb_line6 *li
ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
(datalen << 8) | 0x21, address,
- NULL, 0, LINE6_TIMEOUT * HZ);
+ NULL, 0, LINE6_TIMEOUT);
if (ret < 0) {
dev_err(line6->ifcdev, "read request failed (error %d)\n", ret);
@@ -380,7 +380,7 @@ int line6_read_data(struct usb_line6 *li
USB_TYPE_VENDOR | USB_RECIP_DEVICE |
USB_DIR_IN,
0x0012, 0x0000, len, 1,
- LINE6_TIMEOUT * HZ);
+ LINE6_TIMEOUT);
if (ret < 0) {
dev_err(line6->ifcdev,
"receive length failed (error %d)\n", ret);
@@ -408,7 +408,7 @@ int line6_read_data(struct usb_line6 *li
ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
0x0013, 0x0000, data, datalen,
- LINE6_TIMEOUT * HZ);
+ LINE6_TIMEOUT);
if (ret < 0)
dev_err(line6->ifcdev, "read failed (error %d)\n", ret);
@@ -440,7 +440,7 @@ int line6_write_data(struct usb_line6 *l
ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
0x0022, address, data, datalen,
- LINE6_TIMEOUT * HZ);
+ LINE6_TIMEOUT);
if (ret < 0) {
dev_err(line6->ifcdev,
@@ -456,7 +456,7 @@ int line6_write_data(struct usb_line6 *l
USB_TYPE_VENDOR | USB_RECIP_DEVICE |
USB_DIR_IN,
0x0012, 0x0000,
- status, 1, LINE6_TIMEOUT * HZ);
+ status, 1, LINE6_TIMEOUT);
if (ret < 0) {
dev_err(line6->ifcdev,
--- a/sound/usb/line6/driver.h
+++ b/sound/usb/line6/driver.h
@@ -31,7 +31,7 @@
#define LINE6_FALLBACK_INTERVAL 10
#define LINE6_FALLBACK_MAXPACKETSIZE 16
-#define LINE6_TIMEOUT 1
+#define LINE6_TIMEOUT 1000
#define LINE6_BUFSIZE_LISTEN 64
#define LINE6_MIDI_MESSAGE_MAXLEN 256
--- a/sound/usb/line6/podhd.c
+++ b/sound/usb/line6/podhd.c
@@ -236,7 +236,7 @@ static int podhd_dev_start(struct usb_li
ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0),
0x67, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
0x11, 0,
- NULL, 0, LINE6_TIMEOUT * HZ);
+ NULL, 0, LINE6_TIMEOUT);
if (ret < 0) {
dev_err(pod->line6.ifcdev, "read request failed (error %d)\n", ret);
goto exit;
@@ -246,7 +246,7 @@ static int podhd_dev_start(struct usb_li
ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
0x11, 0x0,
- init_bytes, 3, LINE6_TIMEOUT * HZ);
+ init_bytes, 3, LINE6_TIMEOUT);
if (ret < 0) {
dev_err(pod->line6.ifcdev,
"receive length failed (error %d)\n", ret);
@@ -266,7 +266,7 @@ static int podhd_dev_start(struct usb_li
USB_REQ_SET_FEATURE,
USB_TYPE_STANDARD | USB_RECIP_DEVICE | USB_DIR_OUT,
1, 0,
- NULL, 0, LINE6_TIMEOUT * HZ);
+ NULL, 0, LINE6_TIMEOUT);
exit:
kfree(init_bytes);
return ret;
--- a/sound/usb/line6/toneport.c
+++ b/sound/usb/line6/toneport.c
@@ -130,7 +130,7 @@ static int toneport_send_cmd(struct usb_
ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
- cmd1, cmd2, NULL, 0, LINE6_TIMEOUT * HZ);
+ cmd1, cmd2, NULL, 0, LINE6_TIMEOUT);
if (ret < 0) {
dev_err(&usbdev->dev, "send failed (error %d)\n", ret);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 019/323] ALSA: usb-audio: Add registration quirk for JBL Quantum 400
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 018/323] ALSA: line6: fix control and interrupt " Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 020/323] ALSA: synth: missing check for possible NULL after the call to kstrdup Greg Kroah-Hartman
` (307 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Tsoy, Takashi Iwai
From: Alexander Tsoy <alexander@tsoy.me>
commit 763d92ed5dece7d439fc28a88b2d2728d525ffd9 upstream.
Add another device ID for JBL Quantum 400. It requires the same quirk as
other JBL Quantum devices.
Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211030174308.1011825-1-alexander@tsoy.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/quirks.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1555,6 +1555,7 @@ static const struct registration_quirk r
REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */
REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f4c, 2), /* JBL Quantum 400 */
REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */
REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */
REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 020/323] ALSA: synth: missing check for possible NULL after the call to kstrdup
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 019/323] ALSA: usb-audio: Add registration quirk for JBL Quantum 400 Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 021/323] ALSA: timer: Fix use-after-free problem Greg Kroah-Hartman
` (306 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Austin Kim, Takashi Iwai
From: Austin Kim <austin.kim@lge.com>
commit d159037abbe3412285c271bdfb9cdf19e62678ff upstream.
If kcalloc() return NULL due to memory starvation, it is possible for
kstrdup() to return NULL in similar case. So add null check after the call
to kstrdup() is made.
[ minor coding-style fix by tiwai ]
Signed-off-by: Austin Kim <austin.kim@lge.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211109003742.GA5423@raspberrypi
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/synth/emux/emux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/synth/emux/emux.c
+++ b/sound/synth/emux/emux.c
@@ -101,7 +101,7 @@ int snd_emux_register(struct snd_emux *e
emu->name = kstrdup(name, GFP_KERNEL);
emu->voices = kcalloc(emu->max_voices, sizeof(struct snd_emux_voice),
GFP_KERNEL);
- if (emu->voices == NULL)
+ if (emu->name == NULL || emu->voices == NULL)
return -ENOMEM;
/* create soundfont list */
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 021/323] ALSA: timer: Fix use-after-free problem
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 020/323] ALSA: synth: missing check for possible NULL after the call to kstrdup Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 022/323] ALSA: timer: Unconditionally unlink slave instances, too Greg Kroah-Hartman
` (305 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wang Wensheng, Takashi Iwai
From: Wang Wensheng <wangwensheng4@huawei.com>
commit c0317c0e87094f5b5782b6fdef5ae0a4b150496c upstream.
When the timer instance was add into ack_list but was not currently in
process, the user could stop it via snd_timer_stop1() without delete it
from the ack_list. Then the user could free the timer instance and when
it was actually processed UAF occurred.
This issue could be reproduced via testcase snd_timer01 in ltp - running
several instances of that testcase at the same time.
What I actually met was that the ack_list of the timer broken and the
kernel went into deadloop with irqoff. That could be detected by
hardlockup detector on board or when we run it on qemu, we could use gdb
to dump the ack_list when the console has no response.
To fix this issue, we delete the timer instance from ack_list and
active_list unconditionally in snd_timer_stop1().
Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
Suggested-by: Takashi Iwai <tiwai@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211103033517.80531-1-wangwensheng4@huawei.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/timer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -593,13 +593,13 @@ static int snd_timer_stop1(struct snd_ti
if (!timer)
return -EINVAL;
spin_lock_irqsave(&timer->lock, flags);
+ list_del_init(&timeri->ack_list);
+ list_del_init(&timeri->active_list);
if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
SNDRV_TIMER_IFLG_START))) {
result = -EBUSY;
goto unlock;
}
- list_del_init(&timeri->ack_list);
- list_del_init(&timeri->active_list);
if (timer->card && timer->card->shutdown)
goto unlock;
if (stop) {
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 022/323] ALSA: timer: Unconditionally unlink slave instances, too
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 021/323] ALSA: timer: Fix use-after-free problem Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 023/323] fuse: fix page stealing Greg Kroah-Hartman
` (304 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit ffdd98277f0a1d15a67a74ae09bee713df4c0dbc upstream.
Like the previous fix (commit c0317c0e8709 "ALSA: timer: Fix
use-after-free problem"), we have to unlink slave timer instances
immediately at snd_timer_stop(), too. Otherwise it may leave a stale
entry in the list if the slave instance is freed before actually
running.
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211105091517.21733-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/timer.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -634,23 +634,22 @@ static int snd_timer_stop1(struct snd_ti
static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop)
{
unsigned long flags;
+ bool running;
spin_lock_irqsave(&slave_active_lock, flags);
- if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) {
- spin_unlock_irqrestore(&slave_active_lock, flags);
- return -EBUSY;
- }
+ running = timeri->flags & SNDRV_TIMER_IFLG_RUNNING;
timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
if (timeri->timer) {
spin_lock(&timeri->timer->lock);
list_del_init(&timeri->ack_list);
list_del_init(&timeri->active_list);
- snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
- SNDRV_TIMER_EVENT_PAUSE);
+ if (running)
+ snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
+ SNDRV_TIMER_EVENT_PAUSE);
spin_unlock(&timeri->timer->lock);
}
spin_unlock_irqrestore(&slave_active_lock, flags);
- return 0;
+ return running ? 0 : -EBUSY;
}
/*
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 023/323] fuse: fix page stealing
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 022/323] ALSA: timer: Unconditionally unlink slave instances, too Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 024/323] x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c Greg Kroah-Hartman
` (303 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Frank Dinoff, Miklos Szeredi
From: Miklos Szeredi <mszeredi@redhat.com>
commit 712a951025c0667ff00b25afc360f74e639dfabe upstream.
It is possible to trigger a crash by splicing anon pipe bufs to the fuse
device.
The reason for this is that anon_pipe_buf_release() will reuse buf->page if
the refcount is 1, but that page might have already been stolen and its
flags modified (e.g. PG_lru added).
This happens in the unlikely case of fuse_dev_splice_write() getting around
to calling pipe_buf_release() after a page has been stolen, added to the
page cache and removed from the page cache.
Fix by calling pipe_buf_release() right after the page was inserted into
the page cache. In this case the page has an elevated refcount so any
release function will know that the page isn't reusable.
Reported-by: Frank Dinoff <fdinoff@google.com>
Link: https://lore.kernel.org/r/CAAmZXrsGg2xsP1CK+cbuEMumtrqdvD-NKnWzhNcvn71RV3c1yw@mail.gmail.com/
Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device")
Cc: <stable@vger.kernel.org> # v2.6.35
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/dev.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -905,6 +905,12 @@ static int fuse_try_move_page(struct fus
goto out_put_old;
}
+ /*
+ * Release while we have extra ref on stolen page. Otherwise
+ * anon_pipe_buf_release() might think the page can be reused.
+ */
+ pipe_buf_release(cs->pipe, buf);
+
get_page(newpage);
if (!(buf->flags & PIPE_BUF_FLAG_LRU))
@@ -2054,8 +2060,12 @@ static ssize_t fuse_dev_splice_write(str
pipe_lock(pipe);
out_free:
- for (idx = 0; idx < nbuf; idx++)
- pipe_buf_release(pipe, &bufs[idx]);
+ for (idx = 0; idx < nbuf; idx++) {
+ struct pipe_buffer *buf = &bufs[idx];
+
+ if (buf->ops)
+ pipe_buf_release(pipe, buf);
+ }
pipe_unlock(pipe);
kvfree(bufs);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 024/323] x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 023/323] fuse: fix page stealing Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 025/323] x86/irq: Ensure PI wakeup handler is unregistered before module unload Greg Kroah-Hartman
` (302 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tom Lendacky, Borislav Petkov,
Kirill A. Shutemov
From: Tom Lendacky <thomas.lendacky@amd.com>
commit e7d445ab26db833d6640d4c9a08bee176777cc82 upstream.
When runtime support for converting between 4-level and 5-level pagetables
was added to the kernel, the SME code that built pagetables was updated
to use the pagetable functions, e.g. p4d_offset(), etc., in order to
simplify the code. However, the use of the pagetable functions in early
boot code requires the use of the USE_EARLY_PGTABLE_L5 #define in order to
ensure that the proper definition of pgtable_l5_enabled() is used.
Without the #define, pgtable_l5_enabled() is #defined as
cpu_feature_enabled(X86_FEATURE_LA57). In early boot, the CPU features
have not yet been discovered and populated, so pgtable_l5_enabled() will
return false even when 5-level paging is enabled. This causes the SME code
to always build 4-level pagetables to perform the in-place encryption.
If 5-level paging is enabled, switching to the SME pagetables results in
a page-fault that kills the boot.
Adding the #define results in pgtable_l5_enabled() using the
__pgtable_l5_enabled variable set in early boot and the SME code building
pagetables for the proper paging level.
Fixes: aad983913d77 ("x86/mm/encrypt: Simplify sme_populate_pgd() and sme_populate_pgd_large()")
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: <stable@vger.kernel.org> # 4.18.x
Link: https://lkml.kernel.org/r/2cb8329655f5c753905812d951e212022a480475.1634318656.git.thomas.lendacky@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/mem_encrypt_identity.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -29,6 +29,15 @@
#undef CONFIG_PARAVIRT
#undef CONFIG_PARAVIRT_SPINLOCKS
+/*
+ * This code runs before CPU feature bits are set. By default, the
+ * pgtable_l5_enabled() function uses bit X86_FEATURE_LA57 to determine if
+ * 5-level paging is active, so that won't work here. USE_EARLY_PGTABLE_L5
+ * is provided to handle this situation and, instead, use a variable that
+ * has been set by the early boot code.
+ */
+#define USE_EARLY_PGTABLE_L5
+
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/mem_encrypt.h>
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 025/323] x86/irq: Ensure PI wakeup handler is unregistered before module unload
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 024/323] x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 026/323] cavium: Return negative value when pci_alloc_irq_vectors() fails Greg Kroah-Hartman
` (301 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sean Christopherson, Paolo Bonzini
From: Sean Christopherson <seanjc@google.com>
commit 6ff53f6a438f72998f56e82e76694a1df9d1ea2c upstream.
Add a synchronize_rcu() after clearing the posted interrupt wakeup handler
to ensure all readers, i.e. in-flight IRQ handlers, see the new handler
before returning to the caller. If the caller is an exiting module and
is unregistering its handler, failure to wait could result in the IRQ
handler jumping into an unloaded module.
The registration path doesn't require synchronization, as it's the
caller's responsibility to not generate interrupts it cares about until
after its handler is registered.
Fixes: f6b3c72c2366 ("x86/irq: Define a global vector for VT-d Posted-Interrupts")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20211009001107.3936588-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/irq.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -290,8 +290,10 @@ void kvm_set_posted_intr_wakeup_handler(
{
if (handler)
kvm_posted_intr_wakeup_handler = handler;
- else
+ else {
kvm_posted_intr_wakeup_handler = dummy_handler;
+ synchronize_rcu();
+ }
}
EXPORT_SYMBOL_GPL(kvm_set_posted_intr_wakeup_handler);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 026/323] cavium: Return negative value when pci_alloc_irq_vectors() fails
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 025/323] x86/irq: Ensure PI wakeup handler is unregistered before module unload Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 027/323] scsi: qla2xxx: Fix unmap of already freed sgl Greg Kroah-Hartman
` (300 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zheyu Ma, David S. Miller, Sasha Levin
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit b2cddb44bddc1a9c5949a978bb454bba863264db ]
During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 90497a27df184..7c0a67f1f43f7 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -1175,7 +1175,7 @@ static int nic_register_interrupts(struct nicpf *nic)
dev_err(&nic->pdev->dev,
"Request for #%d msix vectors failed, returned %d\n",
nic->num_vec, ret);
- return 1;
+ return ret;
}
/* Register mailbox interrupt handler */
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 027/323] scsi: qla2xxx: Fix unmap of already freed sgl
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 026/323] cavium: Return negative value when pci_alloc_irq_vectors() fails Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 028/323] cavium: Fix return values of the probe function Greg Kroah-Hartman
` (299 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Dmitry Bogdanov,
Martin K. Petersen, Sasha Levin
From: Dmitry Bogdanov <d.bogdanov@yadro.com>
[ Upstream commit 4a8f71014b4d56c4fb287607e844c0a9f68f46d9 ]
The sgl is freed in the target stack in target_release_cmd_kref() before
calling qlt_free_cmd() but there is an unmap of sgl in qlt_free_cmd() that
causes a panic if sgl is not yet DMA unmapped:
NIP dma_direct_unmap_sg+0xdc/0x180
LR dma_direct_unmap_sg+0xc8/0x180
Call Trace:
ql_dbg_prefix+0x68/0xc0 [qla2xxx] (unreliable)
dma_unmap_sg_attrs+0x54/0xf0
qlt_unmap_sg.part.19+0x54/0x1c0 [qla2xxx]
qlt_free_cmd+0x124/0x1d0 [qla2xxx]
tcm_qla2xxx_release_cmd+0x4c/0xa0 [tcm_qla2xxx]
target_put_sess_cmd+0x198/0x370 [target_core_mod]
transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod]
tcm_qla2xxx_complete_free+0x6c/0x90 [tcm_qla2xxx]
The sgl may be left unmapped in error cases of response sending. For
instance, qlt_rdy_to_xfer() maps sgl and exits when session is being
deleted keeping the sgl mapped.
This patch removes use-after-free of the sgl and ensures that the sgl is
unmapped for any command that was not sent to firmware.
Link: https://lore.kernel.org/r/20211018122650.11846-1-d.bogdanov@yadro.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_target.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index ec54c8f34bc84..5fbac85d7adfb 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3216,8 +3216,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
"RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n",
vha->flags.online, qla2x00_reset_active(vha),
cmd->reset_count, qpair->chip_reset);
- spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
- return 0;
+ goto out_unmap_unlock;
}
/* Does F/W have an IOCBs for this request */
@@ -3339,10 +3338,6 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
prm.sg = NULL;
prm.req_cnt = 1;
- /* Calculate number of entries and segments required */
- if (qlt_pci_map_calc_cnt(&prm) != 0)
- return -EAGAIN;
-
if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) ||
(cmd->sess && cmd->sess->deleted)) {
/*
@@ -3358,6 +3353,10 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
return 0;
}
+ /* Calculate number of entries and segments required */
+ if (qlt_pci_map_calc_cnt(&prm) != 0)
+ return -EAGAIN;
+
spin_lock_irqsave(qpair->qp_lock_ptr, flags);
/* Does F/W have an IOCBs for this request */
res = qlt_check_reserve_free_req(qpair, prm.req_cnt);
@@ -3785,9 +3784,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd)
BUG_ON(cmd->cmd_in_wq);
- if (cmd->sg_mapped)
- qlt_unmap_sg(cmd->vha, cmd);
-
if (!cmd->q_full)
qlt_decr_num_pend_cmds(cmd->vha);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 028/323] cavium: Fix return values of the probe function
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 027/323] scsi: qla2xxx: Fix unmap of already freed sgl Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 029/323] sfc: Dont use netif_info before net_device setup Greg Kroah-Hartman
` (298 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zheyu Ma, David S. Miller, Sasha Levin
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit c69b2f46876825c726bd8a97c7fa852d8932bc32 ]
During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 99eea9e6a8ea6..0fbb0dee2dcfd 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1223,7 +1223,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
if (ret < 0) {
netdev_err(nic->netdev,
"Req for #%d msix vectors failed\n", nic->num_vec);
- return 1;
+ return ret;
}
sprintf(nic->irq_name[irq], "%s Mbox", "NICVF");
@@ -1242,7 +1242,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
if (!nicvf_check_pf_ready(nic)) {
nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0);
nicvf_unregister_interrupts(nic);
- return 1;
+ return -EIO;
}
return 0;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 029/323] sfc: Dont use netif_info before net_device setup
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 028/323] cavium: Fix return values of the probe function Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 030/323] hyperv/vmbus: include linux/bitops.h Greg Kroah-Hartman
` (297 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Erik Ekman, Martin Habets,
David S. Miller, Sasha Levin
From: Erik Ekman <erik@kryo.se>
[ Upstream commit bf6abf345dfa77786aca554bc58c64bd428ecb1d ]
Use pci_info instead to avoid unnamed/uninitialized noise:
[197088.688729] sfc 0000:01:00.0: Solarflare NIC detected
[197088.690333] sfc 0000:01:00.0: Part Number : SFN5122F
[197088.729061] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no SR-IOV VFs probed
[197088.729071] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no PTP support
Inspired by fa44821a4ddd ("sfc: don't use netif_info et al before
net_device is registered") from Heiner Kallweit.
Signed-off-by: Erik Ekman <erik@kryo.se>
Acked-by: Martin Habets <habetsm.xilinx@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sfc/ptp.c | 4 ++--
drivers/net/ethernet/sfc/siena_sriov.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index d47151dbe804d..c0a810f740341 100644
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -651,7 +651,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx)
} else if (rc == -EINVAL) {
fmt = MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS;
} else if (rc == -EPERM) {
- netif_info(efx, probe, efx->net_dev, "no PTP support\n");
+ pci_info(efx->pci_dev, "no PTP support\n");
return rc;
} else {
efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf),
@@ -827,7 +827,7 @@ static int efx_ptp_disable(struct efx_nic *efx)
* should only have been called during probe.
*/
if (rc == -ENOSYS || rc == -EPERM)
- netif_info(efx, probe, efx->net_dev, "no PTP support\n");
+ pci_info(efx->pci_dev, "no PTP support\n");
else if (rc)
efx_mcdi_display_error(efx, MC_CMD_PTP,
MC_CMD_PTP_IN_DISABLE_LEN,
diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c
index da7b94f346049..30d58f72725df 100644
--- a/drivers/net/ethernet/sfc/siena_sriov.c
+++ b/drivers/net/ethernet/sfc/siena_sriov.c
@@ -1059,7 +1059,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx)
return;
if (efx_siena_sriov_cmd(efx, false, &efx->vi_scale, &count)) {
- netif_info(efx, probe, efx->net_dev, "no SR-IOV VFs probed\n");
+ pci_info(efx->pci_dev, "no SR-IOV VFs probed\n");
return;
}
if (count > 0 && count > max_vfs)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 030/323] hyperv/vmbus: include linux/bitops.h
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 029/323] sfc: Dont use netif_info before net_device setup Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 031/323] mmc: winbond: dont build on M68K Greg Kroah-Hartman
` (296 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Wei Liu, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 8017c99680fa65e1e8d999df1583de476a187830 ]
On arm64 randconfig builds, hyperv sometimes fails with this
error:
In file included from drivers/hv/hv_trace.c:3:
In file included from drivers/hv/hyperv_vmbus.h:16:
In file included from arch/arm64/include/asm/sync_bitops.h:5:
arch/arm64/include/asm/bitops.h:11:2: error: only <linux/bitops.h> can be included directly
In file included from include/asm-generic/bitops/hweight.h:5:
include/asm-generic/bitops/arch_hweight.h:9:9: error: implicit declaration of function '__sw_hweight32' [-Werror,-Wimplicit-function-declaration]
include/asm-generic/bitops/atomic.h:17:7: error: implicit declaration of function 'BIT_WORD' [-Werror,-Wimplicit-function-declaration]
Include the correct header first.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211018131929.2260087-1-arnd@kernel.org
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hv/hyperv_vmbus.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
index 87d3d7da78f87..7e7c8debbd285 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -26,6 +26,7 @@
#define _HYPERV_VMBUS_H
#include <linux/list.h>
+#include <linux/bitops.h>
#include <asm/sync_bitops.h>
#include <asm/hyperv-tlfs.h>
#include <linux/atomic.h>
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 031/323] mmc: winbond: dont build on M68K
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 030/323] hyperv/vmbus: include linux/bitops.h Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 032/323] drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 Greg Kroah-Hartman
` (295 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Pierre Ossman,
Geert Uytterhoeven, Arnd Bergmann, Ulf Hansson, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 162079f2dccd02cb4b6654defd32ca387dd6d4d4 ]
The Winbond MMC driver fails to build on ARCH=m68k so prevent
that build config. Silences these build errors:
../drivers/mmc/host/wbsd.c: In function 'wbsd_request_end':
../drivers/mmc/host/wbsd.c:212:28: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration]
212 | dmaflags = claim_dma_lock();
../drivers/mmc/host/wbsd.c:215:17: error: implicit declaration of function 'release_dma_lock'; did you mean 'release_task'? [-Werror=implicit-function-declaration]
215 | release_dma_lock(dmaflags);
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Pierre Ossman <pierre@ossman.eu>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211017175949.23838-1-rdunlap@infradead.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index b7f809aa40c2c..2c11944686cf9 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -421,7 +421,7 @@ config MMC_OMAP_HS
config MMC_WBSD
tristate "Winbond W83L51xD SD/MMC Card Interface support"
- depends on ISA_DMA_API
+ depends on ISA_DMA_API && !M68K
help
This selects the Winbond(R) W83L51xD Secure digital and
Multimedia card Interface.
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 032/323] drm: panel-orientation-quirks: Add quirk for Aya Neo 2021
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 031/323] mmc: winbond: dont build on M68K Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 033/323] bpf: Prevent increasing bpf_jit_limit above max Greg Kroah-Hartman
` (294 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bryant Mairs, Sam Ravnborg, Sasha Levin
From: Bryant Mairs <bryant@mai.rs>
[ Upstream commit def0c3697287f6e85d5ac68b21302966c95474f9 ]
Fixes screen orientation for the Aya Neo 2021 handheld gaming console.
Signed-off-by: Bryant Mairs <bryant@mai.rs>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211019142433.4295-1-bryant@mai.rs
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index 652de972c3aea..48be8590ebe81 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -113,6 +113,12 @@ static const struct dmi_system_id orientation_data[] = {
DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
},
.driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* AYA NEO 2021 */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYA NEO 2021"),
+ },
+ .driver_data = (void *)&lcd800x1280_rightside_up,
}, { /* GPD MicroPC (generic strings, also match on bios date) */
.matches = {
DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 033/323] bpf: Prevent increasing bpf_jit_limit above max
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 032/323] drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 034/323] xen/netfront: stop tx queues during live migration Greg Kroah-Hartman
` (293 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lorenz Bauer, Alexei Starovoitov,
Sasha Levin
From: Lorenz Bauer <lmb@cloudflare.com>
[ Upstream commit fadb7ff1a6c2c565af56b4aacdd086b067eed440 ]
Restrict bpf_jit_limit to the maximum supported by the arch's JIT.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211014142554.53120-4-lmb@cloudflare.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/filter.h | 1 +
kernel/bpf/core.c | 4 +++-
net/core/sysctl_net_core.c | 2 +-
3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index e981bd92a4e3a..89a6ef659b4ca 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -877,6 +877,7 @@ extern int bpf_jit_enable;
extern int bpf_jit_harden;
extern int bpf_jit_kallsyms;
extern long bpf_jit_limit;
+extern long bpf_jit_limit_max;
typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 341402bc1202d..4e5b5ae05406e 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -372,6 +372,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);
int bpf_jit_harden __read_mostly;
int bpf_jit_kallsyms __read_mostly;
long bpf_jit_limit __read_mostly;
+long bpf_jit_limit_max __read_mostly;
static __always_inline void
bpf_get_prog_addr_region(const struct bpf_prog *prog,
@@ -598,7 +599,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void)
static int __init bpf_jit_charge_init(void)
{
/* Only used as heuristic here to derive limit. */
- bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2,
+ bpf_jit_limit_max = bpf_jit_alloc_exec_limit();
+ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2,
PAGE_SIZE), LONG_MAX);
return 0;
}
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 2597449ae9b48..0a0bf80623658 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -417,7 +417,7 @@ static struct ctl_table net_core_table[] = {
.mode = 0600,
.proc_handler = proc_dolongvec_minmax_bpf_restricted,
.extra1 = &long_one,
- .extra2 = &long_max,
+ .extra2 = &bpf_jit_limit_max,
},
#endif
{
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 034/323] xen/netfront: stop tx queues during live migration
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 033/323] bpf: Prevent increasing bpf_jit_limit above max Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 035/323] spi: spl022: fix Microwire full duplex mode Greg Kroah-Hartman
` (292 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joe Jin, Dongli Zhang,
David S. Miller, Sasha Levin
From: Dongli Zhang <dongli.zhang@oracle.com>
[ Upstream commit 042b2046d0f05cf8124c26ff65dbb6148a4404fb ]
The tx queues are not stopped during the live migration. As a result, the
ndo_start_xmit() may access netfront_info->queues which is freed by
talk_to_netback()->xennet_destroy_queues().
This patch is to netif_device_detach() at the beginning of xen-netfront
resuming, and netif_device_attach() at the end of resuming.
CPU A CPU B
talk_to_netback()
-> if (info->queues)
xennet_destroy_queues(info);
to free netfront_info->queues
xennet_start_xmit()
to access netfront_info->queues
-> err = xennet_create_queues(info, &num_queues);
The idea is borrowed from virtio-net.
Cc: Joe Jin <joe.jin@oracle.com>
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/xen-netfront.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index c8e84276e6397..a1c828ffac8b7 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1442,6 +1442,10 @@ static int netfront_resume(struct xenbus_device *dev)
dev_dbg(&dev->dev, "%s\n", dev->nodename);
+ netif_tx_lock_bh(info->netdev);
+ netif_device_detach(info->netdev);
+ netif_tx_unlock_bh(info->netdev);
+
xennet_disconnect_backend(info);
return 0;
}
@@ -1990,6 +1994,10 @@ static int xennet_connect(struct net_device *dev)
* domain a kick because we've probably just requeued some
* packets.
*/
+ netif_tx_lock_bh(np->netdev);
+ netif_device_attach(np->netdev);
+ netif_tx_unlock_bh(np->netdev);
+
netif_carrier_on(np->netdev);
for (j = 0; j < num_queues; ++j) {
queue = &np->queues[j];
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 035/323] spi: spl022: fix Microwire full duplex mode
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 034/323] xen/netfront: stop tx queues during live migration Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 036/323] watchdog: Fix OMAP watchdog early handling Greg Kroah-Hartman
` (291 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Perrot, Mark Brown, Sasha Levin
From: Thomas Perrot <thomas.perrot@bootlin.com>
[ Upstream commit d81d0e41ed5fe7229a2c9a29d13bad288c7cf2d2 ]
There are missing braces in the function that verify controller parameters,
then an error is always returned when the parameter to select Microwire
frames operation is used on devices allowing it.
Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>
Link: https://lore.kernel.org/r/20211022142104.1386379-1-thomas.perrot@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-pl022.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 1af8c96b940e2..aa04ff6e01b9d 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1703,12 +1703,13 @@ static int verify_controller_parameters(struct pl022 *pl022,
return -EINVAL;
}
} else {
- if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX)
+ if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) {
dev_err(&pl022->adev->dev,
"Microwire half duplex mode requested,"
" but this is only available in the"
" ST version of PL022\n");
- return -EINVAL;
+ return -EINVAL;
+ }
}
}
return 0;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 036/323] watchdog: Fix OMAP watchdog early handling
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 035/323] spi: spl022: fix Microwire full duplex mode Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 037/323] vmxnet3: do not stop tx queues after netif_device_detach() Greg Kroah-Hartman
` (290 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Walter Stoll, Guenter Roeck,
Wim Van Sebroeck, Sasha Levin
From: Walter Stoll <walter.stoll@duagon.com>
[ Upstream commit cd004d8299f1dc6cfa6a4eea8f94cb45eaedf070 ]
TI's implementation does not service the watchdog even if the kernel
command line parameter omap_wdt.early_enable is set to 1. This patch
fixes the issue.
Signed-off-by: Walter Stoll <walter.stoll@duagon.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/88a8fe5229cd68fa0f1fd22f5d66666c1b7057a0.camel@duagon.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/omap_wdt.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
index cbd752f9ac563..7376ba56cdf2e 100644
--- a/drivers/watchdog/omap_wdt.c
+++ b/drivers/watchdog/omap_wdt.c
@@ -272,8 +272,12 @@ static int omap_wdt_probe(struct platform_device *pdev)
wdev->wdog.bootstatus = WDIOF_CARDRESET;
}
- if (!early_enable)
+ if (early_enable) {
+ omap_wdt_start(&wdev->wdog);
+ set_bit(WDOG_HW_RUNNING, &wdev->wdog.status);
+ } else {
omap_wdt_disable(wdev);
+ }
ret = watchdog_register_device(&wdev->wdog);
if (ret) {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 037/323] vmxnet3: do not stop tx queues after netif_device_detach()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 036/323] watchdog: Fix OMAP watchdog early handling Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 038/323] btrfs: clear MISSING device status bit in btrfs_close_one_device Greg Kroah-Hartman
` (289 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dongli Zhang, David S. Miller, Sasha Levin
From: Dongli Zhang <dongli.zhang@oracle.com>
[ Upstream commit 9159f102402a64ac85e676b75cc1f9c62c5b4b73 ]
The netif_device_detach() conditionally stops all tx queues if the queues
are running. There is no need to call netif_tx_stop_all_queues() again.
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/vmxnet3/vmxnet3_drv.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index e454dfc9ad8f2..c004819bebe35 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -3634,7 +3634,6 @@ vmxnet3_suspend(struct device *device)
vmxnet3_free_intr_resources(adapter);
netif_device_detach(netdev);
- netif_tx_stop_all_queues(netdev);
/* Create wake-up filters. */
pmConf = adapter->pm_conf;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 038/323] btrfs: clear MISSING device status bit in btrfs_close_one_device
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 037/323] vmxnet3: do not stop tx queues after netif_device_detach() Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 039/323] btrfs: fix lost error handling when replaying directory deletes Greg Kroah-Hartman
` (288 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Li Zhang, David Sterba
From: Li Zhang <zhanglikernel@gmail.com>
commit 5d03dbebba2594d2e6fbf3b5dd9060c5a835de3b upstream.
Reported bug: https://github.com/kdave/btrfs-progs/issues/389
There's a problem with scrub reporting aborted status but returning
error code 0, on a filesystem with missing and readded device.
Roughly these steps:
- mkfs -d raid1 dev1 dev2
- fill with data
- unmount
- make dev1 disappear
- mount -o degraded
- copy more data
- make dev1 appear again
Running scrub afterwards reports that the command was aborted, but the
system log message says the exit code was 0.
It seems that the cause of the error is decrementing
fs_devices->missing_devices but not clearing device->dev_state. Every
time we umount filesystem, it would call close_ctree, And it would
eventually involve btrfs_close_one_device to close the device, but it
only decrements fs_devices->missing_devices but does not clear the
device BTRFS_DEV_STATE_MISSING bit. Worse, this bug will cause Integer
Overflow, because every time umount, fs_devices->missing_devices will
decrease. If fs_devices->missing_devices value hit 0, it would overflow.
With added debugging:
loop1: detected capacity change from 0 to 20971520
BTRFS: device fsid 56ad51f1-5523-463b-8547-c19486c51ebb devid 1 transid 21 /dev/loop1 scanned by systemd-udevd (2311)
loop2: detected capacity change from 0 to 20971520
BTRFS: device fsid 56ad51f1-5523-463b-8547-c19486c51ebb devid 2 transid 17 /dev/loop2 scanned by systemd-udevd (2313)
BTRFS info (device loop1): flagging fs with big metadata feature
BTRFS info (device loop1): allowing degraded mounts
BTRFS info (device loop1): using free space tree
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): before clear_missing.00000000f706684d /dev/loop1 0
BTRFS warning (device loop1): devid 2 uuid 6635ac31-56dd-4852-873b-c60f5e2d53d2 is missing
BTRFS info (device loop1): before clear_missing.0000000000000000 /dev/loop2 1
BTRFS info (device loop1): flagging fs with big metadata feature
BTRFS info (device loop1): allowing degraded mounts
BTRFS info (device loop1): using free space tree
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): before clear_missing.00000000f706684d /dev/loop1 0
BTRFS warning (device loop1): devid 2 uuid 6635ac31-56dd-4852-873b-c60f5e2d53d2 is missing
BTRFS info (device loop1): before clear_missing.0000000000000000 /dev/loop2 0
BTRFS info (device loop1): flagging fs with big metadata feature
BTRFS info (device loop1): allowing degraded mounts
BTRFS info (device loop1): using free space tree
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): before clear_missing.00000000f706684d /dev/loop1 18446744073709551615
BTRFS warning (device loop1): devid 2 uuid 6635ac31-56dd-4852-873b-c60f5e2d53d2 is missing
BTRFS info (device loop1): before clear_missing.0000000000000000 /dev/loop2 18446744073709551615
If fs_devices->missing_devices is 0, next time it would be 18446744073709551615
After apply this patch, the fs_devices->missing_devices seems to be
right:
$ truncate -s 10g test1
$ truncate -s 10g test2
$ losetup /dev/loop1 test1
$ losetup /dev/loop2 test2
$ mkfs.btrfs -draid1 -mraid1 /dev/loop1 /dev/loop2 -f
$ losetup -d /dev/loop2
$ mount -o degraded /dev/loop1 /mnt/1
$ umount /mnt/1
$ mount -o degraded /dev/loop1 /mnt/1
$ umount /mnt/1
$ mount -o degraded /dev/loop1 /mnt/1
$ umount /mnt/1
$ dmesg
loop1: detected capacity change from 0 to 20971520
loop2: detected capacity change from 0 to 20971520
BTRFS: device fsid 15aa1203-98d3-4a66-bcae-ca82f629c2cd devid 1 transid 5 /dev/loop1 scanned by mkfs.btrfs (1863)
BTRFS: device fsid 15aa1203-98d3-4a66-bcae-ca82f629c2cd devid 2 transid 5 /dev/loop2 scanned by mkfs.btrfs (1863)
BTRFS info (device loop1): flagging fs with big metadata feature
BTRFS info (device loop1): allowing degraded mounts
BTRFS info (device loop1): disk space caching is enabled
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): before clear_missing.00000000975bd577 /dev/loop1 0
BTRFS warning (device loop1): devid 2 uuid 8b333791-0b3f-4f57-b449-1c1ab6b51f38 is missing
BTRFS info (device loop1): before clear_missing.0000000000000000 /dev/loop2 1
BTRFS info (device loop1): checking UUID tree
BTRFS info (device loop1): flagging fs with big metadata feature
BTRFS info (device loop1): allowing degraded mounts
BTRFS info (device loop1): disk space caching is enabled
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): before clear_missing.00000000975bd577 /dev/loop1 0
BTRFS warning (device loop1): devid 2 uuid 8b333791-0b3f-4f57-b449-1c1ab6b51f38 is missing
BTRFS info (device loop1): before clear_missing.0000000000000000 /dev/loop2 1
BTRFS info (device loop1): flagging fs with big metadata feature
BTRFS info (device loop1): allowing degraded mounts
BTRFS info (device loop1): disk space caching is enabled
BTRFS info (device loop1): has skinny extents
BTRFS info (device loop1): before clear_missing.00000000975bd577 /dev/loop1 0
BTRFS warning (device loop1): devid 2 uuid 8b333791-0b3f-4f57-b449-1c1ab6b51f38 is missing
BTRFS info (device loop1): before clear_missing.0000000000000000 /dev/loop2 1
CC: stable@vger.kernel.org # 4.19+
Signed-off-by: Li Zhang <zhanglikernel@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/volumes.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1051,8 +1051,10 @@ static void btrfs_close_one_device(struc
if (device->devid == BTRFS_DEV_REPLACE_DEVID)
clear_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state);
- if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
+ if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) {
+ clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state);
fs_devices->missing_devices--;
+ }
btrfs_close_bdev(device);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 039/323] btrfs: fix lost error handling when replaying directory deletes
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 038/323] btrfs: clear MISSING device status bit in btrfs_close_one_device Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 040/323] btrfs: call btrfs_check_rw_degradable only if there is a missing device Greg Kroah-Hartman
` (287 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josef Bacik, Filipe Manana, David Sterba
From: Filipe Manana <fdmanana@suse.com>
commit 10adb1152d957a4d570ad630f93a88bb961616c1 upstream.
At replay_dir_deletes(), if find_dir_range() returns an error we break out
of the main while loop and then assign a value of 0 (success) to the 'ret'
variable, resulting in completely ignoring that an error happened. Fix
that by jumping to the 'out' label when find_dir_range() returns an error
(negative value).
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/tree-log.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2412,7 +2412,9 @@ again:
else {
ret = find_dir_range(log, path, dirid, key_type,
&range_start, &range_end);
- if (ret != 0)
+ if (ret < 0)
+ goto out;
+ else if (ret > 0)
break;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 040/323] btrfs: call btrfs_check_rw_degradable only if there is a missing device
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 039/323] btrfs: fix lost error handling when replaying directory deletes Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 041/323] ia64: kprobes: Fix to pass correct trampoline address to the handler Greg Kroah-Hartman
` (286 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josef Bacik, Anand Jain, David Sterba
From: Anand Jain <anand.jain@oracle.com>
commit 5c78a5e7aa835c4f08a7c90fe02d19f95a776f29 upstream.
In open_ctree() in btrfs_check_rw_degradable() [1], we check each block
group individually if at least the minimum number of devices is available
for that profile. If all the devices are available, then we don't have to
check degradable.
[1]
open_ctree()
::
3559 if (!sb_rdonly(sb) && !btrfs_check_rw_degradable(fs_info, NULL)) {
Also before calling btrfs_check_rw_degradable() in open_ctee() at the
line number shown below [2] we call btrfs_read_chunk_tree() and down to
add_missing_dev() to record number of missing devices.
[2]
open_ctree()
::
3454 ret = btrfs_read_chunk_tree(fs_info);
btrfs_read_chunk_tree()
read_one_chunk() / read_one_dev()
add_missing_dev()
So, check if there is any missing device before btrfs_check_rw_degradable()
in open_ctree().
Also, with this the mount command could save ~16ms.[3] in the most
common case, that is no device is missing.
[3]
1) * 16934.96 us | btrfs_check_rw_degradable [btrfs]();
CC: stable@vger.kernel.org # 4.19+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/disk-io.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3095,7 +3095,8 @@ retry_root_backup:
goto fail_sysfs;
}
- if (!sb_rdonly(sb) && !btrfs_check_rw_degradable(fs_info, NULL)) {
+ if (!sb_rdonly(sb) && fs_info->fs_devices->missing_devices &&
+ !btrfs_check_rw_degradable(fs_info, NULL)) {
btrfs_warn(fs_info,
"writeable mount is not allowed due to too many missing devices");
goto fail_sysfs;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 041/323] ia64: kprobes: Fix to pass correct trampoline address to the handler
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 040/323] btrfs: call btrfs_check_rw_degradable only if there is a missing device Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 042/323] hwmon: (pmbus/lm25066) Add offset coefficients Greg Kroah-Hartman
` (285 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josh Poimboeuf, Ingo Molnar, X86 ML,
Daniel Xu, Thomas Gleixner, Borislav Petkov, Peter Zijlstra,
Abhishek Sagar, Andrii Nakryiko, Paul McKenney, Masami Hiramatsu,
Steven Rostedt (VMware)
From: Masami Hiramatsu <mhiramat@kernel.org>
commit a7fe2378454cf46cd5e2776d05e72bbe8f0a468c upstream.
The following commit:
Commit e792ff804f49 ("ia64: kprobes: Use generic kretprobe trampoline handler")
Passed the wrong trampoline address to __kretprobe_trampoline_handler(): it
passes the descriptor address instead of function entry address.
Pass the right parameter.
Also use correct symbol dereference function to get the function address
from 'kretprobe_trampoline' - an IA64 special.
Link: https://lkml.kernel.org/r/163163042696.489837.12551102356265354730.stgit@devnote2
Fixes: e792ff804f49 ("ia64: kprobes: Use generic kretprobe trampoline handler")
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: X86 ML <x86@kernel.org>
Cc: Daniel Xu <dxu@dxuuu.xyz>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Abhishek Sagar <sagar.abhishek@gmail.com>
Cc: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Cc: Paul McKenney <paulmck@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/ia64/kernel/kprobes.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/arch/ia64/kernel/kprobes.c
+++ b/arch/ia64/kernel/kprobes.c
@@ -411,7 +411,8 @@ static void kretprobe_trampoline(void)
int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
{
- regs->cr_iip = __kretprobe_trampoline_handler(regs, kretprobe_trampoline, NULL);
+ regs->cr_iip = __kretprobe_trampoline_handler(regs,
+ dereference_function_descriptor(kretprobe_trampoline), NULL);
/*
* By returning a non-zero value, we are telling
* kprobe_handler() that we don't want the post_handler
@@ -427,7 +428,7 @@ void __kprobes arch_prepare_kretprobe(st
ri->fp = NULL;
/* Replace the return addr with trampoline addr */
- regs->b0 = ((struct fnptr *)kretprobe_trampoline)->ip;
+ regs->b0 = (unsigned long)dereference_function_descriptor(kretprobe_trampoline);
}
/* Check the instruction in the slot is break */
@@ -957,14 +958,14 @@ static struct kprobe trampoline_p = {
int __init arch_init_kprobes(void)
{
trampoline_p.addr =
- (kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip;
+ dereference_function_descriptor(kretprobe_trampoline);
return register_kprobe(&trampoline_p);
}
int __kprobes arch_trampoline_kprobe(struct kprobe *p)
{
if (p->addr ==
- (kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip)
+ dereference_function_descriptor(kretprobe_trampoline))
return 1;
return 0;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 042/323] hwmon: (pmbus/lm25066) Add offset coefficients
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 041/323] ia64: kprobes: Fix to pass correct trampoline address to the handler Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 043/323] regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled Greg Kroah-Hartman
` (284 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zev Weiss, Guenter Roeck
From: Zev Weiss <zev@bewilderbeest.net>
commit ae59dc455a78fb73034dd1fbb337d7e59c27cbd8 upstream.
With the exception of the lm5066i, all the devices handled by this
driver had been missing their offset ('b') coefficients for direct
format readings.
Cc: stable@vger.kernel.org
Fixes: 58615a94f6a1 ("hwmon: (pmbus/lm25066) Add support for LM25056")
Fixes: e53e6497fc9f ("hwmon: (pmbus/lm25066) Refactor device specific coefficients")
Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
Link: https://lore.kernel.org/r/20210928092242.30036-2-zev@bewilderbeest.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/pmbus/lm25066.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
--- a/drivers/hwmon/pmbus/lm25066.c
+++ b/drivers/hwmon/pmbus/lm25066.c
@@ -64,22 +64,27 @@ static struct __coeff lm25066_coeff[6][P
[lm25056] = {
[PSC_VOLTAGE_IN] = {
.m = 16296,
+ .b = 1343,
.R = -2,
},
[PSC_CURRENT_IN] = {
.m = 13797,
+ .b = -1833,
.R = -2,
},
[PSC_CURRENT_IN_L] = {
.m = 6726,
+ .b = -537,
.R = -2,
},
[PSC_POWER] = {
.m = 5501,
+ .b = -2908,
.R = -3,
},
[PSC_POWER_L] = {
.m = 26882,
+ .b = -5646,
.R = -4,
},
[PSC_TEMPERATURE] = {
@@ -91,26 +96,32 @@ static struct __coeff lm25066_coeff[6][P
[lm25066] = {
[PSC_VOLTAGE_IN] = {
.m = 22070,
+ .b = -1800,
.R = -2,
},
[PSC_VOLTAGE_OUT] = {
.m = 22070,
+ .b = -1800,
.R = -2,
},
[PSC_CURRENT_IN] = {
.m = 13661,
+ .b = -5200,
.R = -2,
},
[PSC_CURRENT_IN_L] = {
.m = 6852,
+ .b = -3100,
.R = -2,
},
[PSC_POWER] = {
.m = 736,
+ .b = -3300,
.R = -2,
},
[PSC_POWER_L] = {
.m = 369,
+ .b = -1900,
.R = -2,
},
[PSC_TEMPERATURE] = {
@@ -120,26 +131,32 @@ static struct __coeff lm25066_coeff[6][P
[lm5064] = {
[PSC_VOLTAGE_IN] = {
.m = 4611,
+ .b = -642,
.R = -2,
},
[PSC_VOLTAGE_OUT] = {
.m = 4621,
+ .b = 423,
.R = -2,
},
[PSC_CURRENT_IN] = {
.m = 10742,
+ .b = 1552,
.R = -2,
},
[PSC_CURRENT_IN_L] = {
.m = 5456,
+ .b = 2118,
.R = -2,
},
[PSC_POWER] = {
.m = 1204,
+ .b = 8524,
.R = -3,
},
[PSC_POWER_L] = {
.m = 612,
+ .b = 11202,
.R = -3,
},
[PSC_TEMPERATURE] = {
@@ -149,26 +166,32 @@ static struct __coeff lm25066_coeff[6][P
[lm5066] = {
[PSC_VOLTAGE_IN] = {
.m = 4587,
+ .b = -1200,
.R = -2,
},
[PSC_VOLTAGE_OUT] = {
.m = 4587,
+ .b = -2400,
.R = -2,
},
[PSC_CURRENT_IN] = {
.m = 10753,
+ .b = -1200,
.R = -2,
},
[PSC_CURRENT_IN_L] = {
.m = 5405,
+ .b = -600,
.R = -2,
},
[PSC_POWER] = {
.m = 1204,
+ .b = -6000,
.R = -3,
},
[PSC_POWER_L] = {
.m = 605,
+ .b = -8000,
.R = -3,
},
[PSC_TEMPERATURE] = {
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 043/323] regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 042/323] hwmon: (pmbus/lm25066) Add offset coefficients Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 044/323] regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property Greg Kroah-Hartman
` (283 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Rob Herring, Mark Brown
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
commit b16bef60a9112b1e6daf3afd16484eb06e7ce792 upstream.
The driver and its bindings, before commit 04f9f068a619 ("regulator:
s5m8767: Modify parsing method of the voltage table of buck2/3/4") were
requiring to provide at least one safe/default voltage for DVS registers
if DVS GPIO is not being enabled.
IOW, if s5m8767,pmic-buck2-uses-gpio-dvs is missing, the
s5m8767,pmic-buck2-dvs-voltage should still be present and contain one
voltage.
This requirement was coming from driver behavior matching this condition
(none of DVS GPIO is enabled): it was always initializing the DVS
selector pins to 0 and keeping the DVS enable setting at reset value
(enabled). Therefore if none of DVS GPIO is enabled in devicetree,
driver was configuring the first DVS voltage for buck[234].
Mentioned commit 04f9f068a619 ("regulator: s5m8767: Modify parsing
method of the voltage table of buck2/3/4") broke it because DVS voltage
won't be parsed from devicetree if DVS GPIO is not enabled. After the
change, driver will configure bucks to use the register reset value as
voltage which might have unpleasant effects.
Fix this by relaxing the bindings constrain: if DVS GPIO is not enabled
in devicetree (therefore DVS voltage is also not parsed), explicitly
disable it.
Cc: <stable@vger.kernel.org>
Fixes: 04f9f068a619 ("regulator: s5m8767: Modify parsing method of the voltage table of buck2/3/4")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Acked-by: Rob Herring <robh@kernel.org>
Message-Id: <20211008113723.134648-2-krzysztof.kozlowski@canonical.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt | 21 +++-------
drivers/regulator/s5m8767.c | 21 ++++------
2 files changed, 17 insertions(+), 25 deletions(-)
--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
+++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
@@ -13,6 +13,14 @@ common regulator binding documented in:
Required properties of the main device node (the parent!):
+ - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used
+ for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines.
+
+ [1] If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional
+ property is specified, then all the eight voltage values for the
+ 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified.
+
+Optional properties of the main device node (the parent!):
- s5m8767,pmic-buck2-dvs-voltage: A set of 8 voltage values in micro-volt (uV)
units for buck2 when changing voltage using gpio dvs. Refer to [1] below
for additional information.
@@ -25,19 +33,6 @@ Required properties of the main device n
units for buck4 when changing voltage using gpio dvs. Refer to [1] below
for additional information.
- - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used
- for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines.
-
- [1] If none of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional
- property is specified, the 's5m8767,pmic-buck[2/3/4]-dvs-voltage'
- property should specify atleast one voltage level (which would be a
- safe operating voltage).
-
- If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional
- property is specified, then all the eight voltage values for the
- 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified.
-
-Optional properties of the main device node (the parent!):
- s5m8767,pmic-buck2-uses-gpio-dvs: 'buck2' can be controlled by gpio dvs.
- s5m8767,pmic-buck3-uses-gpio-dvs: 'buck3' can be controlled by gpio dvs.
- s5m8767,pmic-buck4-uses-gpio-dvs: 'buck4' can be controlled by gpio dvs.
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -849,18 +849,15 @@ static int s5m8767_pmic_probe(struct pla
/* DS4 GPIO */
gpio_direction_output(pdata->buck_ds[2], 0x0);
- if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs ||
- pdata->buck4_gpiodvs) {
- regmap_update_bits(s5m8767->iodev->regmap_pmic,
- S5M8767_REG_BUCK2CTRL, 1 << 1,
- (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1));
- regmap_update_bits(s5m8767->iodev->regmap_pmic,
- S5M8767_REG_BUCK3CTRL, 1 << 1,
- (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1));
- regmap_update_bits(s5m8767->iodev->regmap_pmic,
- S5M8767_REG_BUCK4CTRL, 1 << 1,
- (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1));
- }
+ regmap_update_bits(s5m8767->iodev->regmap_pmic,
+ S5M8767_REG_BUCK2CTRL, 1 << 1,
+ (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1));
+ regmap_update_bits(s5m8767->iodev->regmap_pmic,
+ S5M8767_REG_BUCK3CTRL, 1 << 1,
+ (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1));
+ regmap_update_bits(s5m8767->iodev->regmap_pmic,
+ S5M8767_REG_BUCK4CTRL, 1 << 1,
+ (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1));
/* Initialize GPIO DVS registers */
for (i = 0; i < 8; i++) {
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 044/323] regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 043/323] regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 045/323] EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell Greg Kroah-Hartman
` (282 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Rob Herring, Mark Brown
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
commit a7fda04bc9b6ad9da8e19c9e6e3b1dab773d068a upstream.
The driver was always parsing "s5m8767,pmic-buck-default-dvs-idx", not
"s5m8767,pmic-buck234-default-dvs-idx".
Cc: <stable@vger.kernel.org>
Fixes: 26aec009f6b6 ("regulator: add device tree support for s5m8767")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Acked-by: Rob Herring <robh@kernel.org>
Message-Id: <20211008113723.134648-3-krzysztof.kozlowski@canonical.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
+++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
@@ -39,7 +39,7 @@ Optional properties of the main device n
Additional properties required if either of the optional properties are used:
- - s5m8767,pmic-buck234-default-dvs-idx: Default voltage setting selected from
+ - s5m8767,pmic-buck-default-dvs-idx: Default voltage setting selected from
the possible 8 options selectable by the dvs gpios. The value of this
property should be between 0 and 7. If not specified or if out of range, the
default value of this property is set to 0.
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 045/323] EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 044/323] regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 046/323] mwifiex: fix division by zero in fw download path Greg Kroah-Hartman
` (281 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Meeta Saggi, Eric Badger, Tony Luck
From: Eric Badger <ebadger@purestorage.com>
commit 537bddd069c743759addf422d0b8f028ff0f8dbc upstream.
The computation of TOHM is off by one bit. This missed bit results in
too low a value for TOHM, which can cause errors in regular memory to
incorrectly report:
EDAC MC0: 1 CE Error at MMIOH area, on addr 0x000000207fffa680 on any memory
Fixes: 50d1bb93672f ("sb_edac: add support for Haswell based systems")
Cc: stable@vger.kernel.org
Reported-by: Meeta Saggi <msaggi@purestorage.com>
Signed-off-by: Eric Badger <ebadger@purestorage.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Link: https://lore.kernel.org/r/20211010170127.848113-1-ebadger@purestorage.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/sb_edac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -1021,7 +1021,7 @@ static u64 haswell_get_tohm(struct sbrid
pci_read_config_dword(pvt->info.pci_vtd, HASWELL_TOHM_1, ®);
rc = ((reg << 6) | rc) << 26;
- return rc | 0x1ffffff;
+ return rc | 0x3ffffff;
}
static u64 knl_get_tolm(struct sbridge_pvt *pvt)
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 046/323] mwifiex: fix division by zero in fw download path
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 045/323] EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 047/323] ath6kl: fix division by zero in send path Greg Kroah-Hartman
` (280 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Amitkumar Karwar, Johan Hovold,
Brian Norris, Kalle Valo
From: Johan Hovold <johan@kernel.org>
commit 89f8765a11d8df49296d92c404067f9b5c58ee26 upstream.
Add the missing endpoint sanity checks to probe() to avoid division by
zero in mwifiex_write_data_sync() in case a malicious device has broken
descriptors (or when doing descriptor fuzz testing).
Only add checks for the firmware-download boot stage, which require both
command endpoints, for now. The driver looks like it will handle a
missing endpoint during normal operation without oopsing, albeit not
very gracefully as it will try to submit URBs to the default pipe and
fail.
Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).
Fixes: 4daffe354366 ("mwifiex: add support for Marvell USB8797 chipset")
Cc: stable@vger.kernel.org # 3.5
Cc: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027080819.6675-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/marvell/mwifiex/usb.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -505,6 +505,22 @@ static int mwifiex_usb_probe(struct usb_
}
}
+ switch (card->usb_boot_state) {
+ case USB8XXX_FW_DNLD:
+ /* Reject broken descriptors. */
+ if (!card->rx_cmd_ep || !card->tx_cmd_ep)
+ return -ENODEV;
+ if (card->bulk_out_maxpktsize == 0)
+ return -ENODEV;
+ break;
+ case USB8XXX_FW_READY:
+ /* Assume the driver can handle missing endpoints for now. */
+ break;
+ default:
+ WARN_ON(1);
+ return -ENODEV;
+ }
+
usb_set_intfdata(intf, card);
ret = mwifiex_add_card(card, &card->fw_done, &usb_ops,
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 047/323] ath6kl: fix division by zero in send path
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 046/323] mwifiex: fix division by zero in fw download path Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 048/323] ath6kl: fix control-message timeout Greg Kroah-Hartman
` (279 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Kalle Valo
From: Johan Hovold <johan@kernel.org>
commit c1b9ca365deae667192be9fe24db244919971234 upstream.
Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in ath10k_usb_hif_tx_sg() in case a malicious device
has broken descriptors (or when doing descriptor fuzz testing).
Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).
Fixes: 9cbee358687e ("ath6kl: add full USB support")
Cc: stable@vger.kernel.org # 3.5
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027080819.6675-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath6kl/usb.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resourc
le16_to_cpu(endpoint->wMaxPacketSize),
endpoint->bInterval);
}
+
+ /* Ignore broken descriptors. */
+ if (usb_endpoint_maxp(endpoint) == 0)
+ continue;
+
urbcount = 0;
pipe_num =
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 048/323] ath6kl: fix control-message timeout
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 047/323] ath6kl: fix division by zero in send path Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 049/323] ath10k: " Greg Kroah-Hartman
` (278 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Kalle Valo
From: Johan Hovold <johan@kernel.org>
commit a066d28a7e729f808a3e6eff22e70c003091544e upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: 241b128b6b69 ("ath6kl: add back beginnings of USB support")
Cc: stable@vger.kernel.org # 3.4
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211025120522.6045-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath6kl/usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -912,7 +912,7 @@ static int ath6kl_usb_submit_ctrl_in(str
req,
USB_DIR_IN | USB_TYPE_VENDOR |
USB_RECIP_DEVICE, value, index, buf,
- size, 2 * HZ);
+ size, 2000);
if (ret < 0) {
ath6kl_warn("Failed to read usb control message: %d\n", ret);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 049/323] ath10k: fix control-message timeout
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 048/323] ath6kl: fix control-message timeout Greg Kroah-Hartman
@ 2021-11-24 11:53 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 050/323] ath10k: fix division by zero in send path Greg Kroah-Hartman
` (277 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Erik Stromdahl, Johan Hovold, Kalle Valo
From: Johan Hovold <johan@kernel.org>
commit 5286132324230168d3fab6ffc16bfd7de85bdfb4 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: 4db66499df91 ("ath10k: add initial USB support")
Cc: stable@vger.kernel.org # 4.14
Cc: Erik Stromdahl <erik.stromdahl@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211025120522.6045-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath10k/usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -536,7 +536,7 @@ static int ath10k_usb_submit_ctrl_in(str
req,
USB_DIR_IN | USB_TYPE_VENDOR |
USB_RECIP_DEVICE, value, index, buf,
- size, 2 * HZ);
+ size, 2000);
if (ret < 0) {
ath10k_warn(ar, "Failed to read usb control message: %d\n",
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 050/323] ath10k: fix division by zero in send path
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2021-11-24 11:53 ` [PATCH 4.19 049/323] ath10k: " Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 051/323] PCI: Mark Atheros QCA6174 to avoid bus reset Greg Kroah-Hartman
` (276 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Erik Stromdahl, Johan Hovold, Kalle Valo
From: Johan Hovold <johan@kernel.org>
commit a006acb931317aad3a8dd41333ebb0453caf49b8 upstream.
Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in ath10k_usb_hif_tx_sg() in case a malicious device
has broken descriptors (or when doing descriptor fuzz testing).
Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).
Fixes: 4db66499df91 ("ath10k: add initial USB support")
Cc: stable@vger.kernel.org # 4.14
Cc: Erik Stromdahl <erik.stromdahl@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027080819.6675-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath10k/usb.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -875,6 +875,11 @@ static int ath10k_usb_setup_pipe_resourc
le16_to_cpu(endpoint->wMaxPacketSize),
endpoint->bInterval);
}
+
+ /* Ignore broken descriptors. */
+ if (usb_endpoint_maxp(endpoint) == 0)
+ continue;
+
urbcount = 0;
pipe_num =
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 051/323] PCI: Mark Atheros QCA6174 to avoid bus reset
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 050/323] ath10k: fix division by zero in send path Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 052/323] rtl8187: fix control-message timeouts Greg Kroah-Hartman
` (275 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ingmar Klein, Bjorn Helgaas, Pali Rohár
From: Ingmar Klein <ingmar_klein@web.de>
commit e3f4bd3462f6f796594ecc0dda7144ed2d1e5a26 upstream.
When passing the Atheros QCA6174 through to a virtual machine, the VM hangs
at the point where the ath10k driver loads.
Add a quirk to avoid bus resets on this device, which avoids the hang.
[bhelgaas: commit log]
Link: https://lore.kernel.org/r/08982e05-b6e8-5a8d-24ab-da1488ee50a8@web.de
Signed-off-by: Ingmar Klein <ingmar_klein@web.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Pali Rohár <pali@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3490,6 +3490,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_A
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003e, quirk_no_bus_reset);
/*
* Root port on some Cavium CN8xxx chips do not successfully complete a bus
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 052/323] rtl8187: fix control-message timeouts
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 051/323] PCI: Mark Atheros QCA6174 to avoid bus reset Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 053/323] evm: mark evm_fixmode as __ro_after_init Greg Kroah-Hartman
` (274 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Kalle Valo
From: Johan Hovold <johan@kernel.org>
commit 2e9be536a213e838daed6ba42024dd68954ac061 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: 605bebe23bf6 ("[PATCH] Add rtl8187 wireless driver")
Cc: stable@vger.kernel.org # 2.6.23
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211025120522.6045-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c
+++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c
@@ -31,7 +31,7 @@ u8 rtl818x_ioread8_idx(struct rtl8187_pr
usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
(unsigned long)addr, idx & 0x03,
- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+ &priv->io_dmabuf->bits8, sizeof(val), 500);
val = priv->io_dmabuf->bits8;
mutex_unlock(&priv->io_mutex);
@@ -48,7 +48,7 @@ u16 rtl818x_ioread16_idx(struct rtl8187_
usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
(unsigned long)addr, idx & 0x03,
- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+ &priv->io_dmabuf->bits16, sizeof(val), 500);
val = priv->io_dmabuf->bits16;
mutex_unlock(&priv->io_mutex);
@@ -65,7 +65,7 @@ u32 rtl818x_ioread32_idx(struct rtl8187_
usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
(unsigned long)addr, idx & 0x03,
- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+ &priv->io_dmabuf->bits32, sizeof(val), 500);
val = priv->io_dmabuf->bits32;
mutex_unlock(&priv->io_mutex);
@@ -82,7 +82,7 @@ void rtl818x_iowrite8_idx(struct rtl8187
usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
(unsigned long)addr, idx & 0x03,
- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+ &priv->io_dmabuf->bits8, sizeof(val), 500);
mutex_unlock(&priv->io_mutex);
}
@@ -96,7 +96,7 @@ void rtl818x_iowrite16_idx(struct rtl818
usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
(unsigned long)addr, idx & 0x03,
- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+ &priv->io_dmabuf->bits16, sizeof(val), 500);
mutex_unlock(&priv->io_mutex);
}
@@ -110,7 +110,7 @@ void rtl818x_iowrite32_idx(struct rtl818
usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
(unsigned long)addr, idx & 0x03,
- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+ &priv->io_dmabuf->bits32, sizeof(val), 500);
mutex_unlock(&priv->io_mutex);
}
@@ -186,7 +186,7 @@ static void rtl8225_write_8051(struct ie
usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data),
- HZ / 2);
+ 500);
mutex_unlock(&priv->io_mutex);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 053/323] evm: mark evm_fixmode as __ro_after_init
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 052/323] rtl8187: fix control-message timeouts Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 054/323] wcn36xx: Fix HT40 capability for 2Ghz band Greg Kroah-Hartman
` (273 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Austin Kim, Mimi Zohar
From: Austin Kim <austin.kim@lge.com>
commit 32ba540f3c2a7ef61ed5a577ce25069a3d714fc9 upstream.
The evm_fixmode is only configurable by command-line option and it is never
modified outside initcalls, so declaring it with __ro_after_init is better.
Signed-off-by: Austin Kim <austin.kim@lge.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/integrity/evm/evm_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -59,7 +59,7 @@ static struct xattr_list evm_config_defa
LIST_HEAD(evm_config_xattrnames);
-static int evm_fixmode;
+static int evm_fixmode __ro_after_init;
static int __init evm_set_fixmode(char *str)
{
if (strncmp(str, "fix", 3) == 0)
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 054/323] wcn36xx: Fix HT40 capability for 2Ghz band
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 053/323] evm: mark evm_fixmode as __ro_after_init Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 055/323] mwifiex: Read a PCI register after writing the TX ring write pointer Greg Kroah-Hartman
` (272 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Loic Poulain, Kalle Valo
From: Loic Poulain <loic.poulain@linaro.org>
commit 960ae77f25631bbe4e3aafefe209b52e044baf31 upstream.
All wcn36xx controllers are supposed to support HT40 (and SGI40),
This doubles the maximum bitrate/throughput with compatible APs.
Tested with wcn3620 & wcn3680B.
Cc: stable@vger.kernel.org
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1634737133-22336-1-git-send-email-loic.poulain@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/wcn36xx/main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -134,7 +134,9 @@ static struct ieee80211_supported_band w
.cap = IEEE80211_HT_CAP_GRN_FLD |
IEEE80211_HT_CAP_SGI_20 |
IEEE80211_HT_CAP_DSSSCCK40 |
- IEEE80211_HT_CAP_LSIG_TXOP_PROT,
+ IEEE80211_HT_CAP_LSIG_TXOP_PROT |
+ IEEE80211_HT_CAP_SGI_40 |
+ IEEE80211_HT_CAP_SUP_WIDTH_20_40,
.ht_supported = true,
.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 055/323] mwifiex: Read a PCI register after writing the TX ring write pointer
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 054/323] wcn36xx: Fix HT40 capability for 2Ghz band Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 056/323] libata: fix checking of DMA state Greg Kroah-Hartman
` (271 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jonas Dreßler, Kalle Valo
From: Jonas Dreßler <verdre@v0yd.nl>
commit e5f4eb8223aa740237cd463246a7debcddf4eda1 upstream.
On the 88W8897 PCIe+USB card the firmware randomly crashes after setting
the TX ring write pointer. The issue is present in the latest firmware
version 15.68.19.p21 of the PCIe+USB card.
Those firmware crashes can be worked around by reading any PCI register
of the card after setting that register, so read the PCI_VENDOR_ID
register here. The reason this works is probably because we keep the bus
from entering an ASPM state for a bit longer, because that's what causes
the cards firmware to crash.
This fixes a bug where during RX/TX traffic and with ASPM L1 substates
enabled (the specific substates where the issue happens appear to be
platform dependent), the firmware crashes and eventually a command
timeout appears in the logs.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=109681
Cc: stable@vger.kernel.org
Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211011133224.15561-2-verdre@v0yd.nl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/marvell/mwifiex/pcie.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -1330,6 +1330,14 @@ mwifiex_pcie_send_data(struct mwifiex_ad
ret = -1;
goto done_unmap;
}
+
+ /* The firmware (latest version 15.68.19.p21) of the 88W8897 PCIe+USB card
+ * seems to crash randomly after setting the TX ring write pointer when
+ * ASPM powersaving is enabled. A workaround seems to be keeping the bus
+ * busy by reading a random register afterwards.
+ */
+ mwifiex_read_reg(adapter, PCI_VENDOR_ID, &rx_val);
+
if ((mwifiex_pcie_txbd_not_full(card)) &&
tx_param->next_pkt_len) {
/* have more packets and TxBD still can hold more */
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 056/323] libata: fix checking of DMA state
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 055/323] mwifiex: Read a PCI register after writing the TX ring write pointer Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 057/323] wcn36xx: handle connection loss indication Greg Kroah-Hartman
` (270 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Reimar Döffinger, Paul Menzel,
Damien Le Moal
From: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
commit f971a85439bd25dc7b4d597cf5e4e8dc7ffc884b upstream.
Checking if DMA is enabled should be done via the
ata_dma_enabled helper function, since the init state
0xff indicates disabled.
This meant that ATA_CMD_READ_LOG_DMA_EXT was used and probed
for before DMA was enabled, which caused hangs for some combinations
of controllers and devices.
It might also have caused it to be incorrectly disabled as broken,
but there have been no reports of that.
Cc: stable@vger.kernel.org
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195895
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Tested-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2073,7 +2073,7 @@ unsigned int ata_read_log_page(struct at
retry:
ata_tf_init(dev, &tf);
- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
+ if (ata_dma_enabled(dev) && ata_id_has_read_log_dma_ext(dev->id) &&
!(dev->horkage & ATA_HORKAGE_NO_DMA_LOG)) {
tf.command = ATA_CMD_READ_LOG_DMA_EXT;
tf.protocol = ATA_PROT_DMA;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 057/323] wcn36xx: handle connection loss indication
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 056/323] libata: fix checking of DMA state Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 058/323] rsi: fix occasional initialisation failure with BT coex Greg Kroah-Hartman
` (269 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Li, Bryan ODonoghue,
Loic Poulain, Kalle Valo
From: Benjamin Li <benl@squareup.com>
commit d6dbce453b19c64b96f3e927b10230f9a704b504 upstream.
Firmware sends delete_sta_context_ind when it detects the AP has gone
away in STA mode. Right now the handler for that indication only handles
AP mode; fix it to also handle STA mode.
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Li <benl@squareup.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210901180606.11686-1-benl@squareup.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/wcn36xx/smd.c | 44 ++++++++++++++++++++++++---------
1 file changed, 33 insertions(+), 11 deletions(-)
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2340,30 +2340,52 @@ static int wcn36xx_smd_delete_sta_contex
size_t len)
{
struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf;
- struct wcn36xx_vif *tmp;
+ struct wcn36xx_vif *vif_priv;
+ struct ieee80211_vif *vif;
+ struct ieee80211_bss_conf *bss_conf;
struct ieee80211_sta *sta;
+ bool found = false;
if (len != sizeof(*rsp)) {
wcn36xx_warn("Corrupted delete sta indication\n");
return -EIO;
}
- wcn36xx_dbg(WCN36XX_DBG_HAL, "delete station indication %pM index %d\n",
- rsp->addr2, rsp->sta_id);
+ wcn36xx_dbg(WCN36XX_DBG_HAL,
+ "delete station indication %pM index %d reason %d\n",
+ rsp->addr2, rsp->sta_id, rsp->reason_code);
- list_for_each_entry(tmp, &wcn->vif_list, list) {
+ list_for_each_entry(vif_priv, &wcn->vif_list, list) {
rcu_read_lock();
- sta = ieee80211_find_sta(wcn36xx_priv_to_vif(tmp), rsp->addr2);
- if (sta)
- ieee80211_report_low_ack(sta, 0);
+ vif = wcn36xx_priv_to_vif(vif_priv);
+
+ if (vif->type == NL80211_IFTYPE_STATION) {
+ /* We could call ieee80211_find_sta too, but checking
+ * bss_conf is clearer.
+ */
+ bss_conf = &vif->bss_conf;
+ if (vif_priv->sta_assoc &&
+ !memcmp(bss_conf->bssid, rsp->addr2, ETH_ALEN)) {
+ found = true;
+ wcn36xx_dbg(WCN36XX_DBG_HAL,
+ "connection loss bss_index %d\n",
+ vif_priv->bss_index);
+ ieee80211_connection_loss(vif);
+ }
+ } else {
+ sta = ieee80211_find_sta(vif, rsp->addr2);
+ if (sta) {
+ found = true;
+ ieee80211_report_low_ack(sta, 0);
+ }
+ }
+
rcu_read_unlock();
- if (sta)
+ if (found)
return 0;
}
- wcn36xx_warn("STA with addr %pM and index %d not found\n",
- rsp->addr2,
- rsp->sta_id);
+ wcn36xx_warn("BSS or STA with addr %pM not found\n", rsp->addr2);
return -ENOENT;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 058/323] rsi: fix occasional initialisation failure with BT coex
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 057/323] wcn36xx: handle connection loss indication Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 059/323] rsi: fix key enabled check causing unwanted encryption for vap_id > 0 Greg Kroah-Hartman
` (268 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Fuzzey, Kalle Valo
From: Martin Fuzzey <martin.fuzzey@flowbird.group>
commit 9b14ed6e11b72dd4806535449ca6c6962cb2369d upstream.
When BT coexistence is enabled (eg oper mode 13, which is the default)
the initialisation on startup sometimes silently fails.
In a normal initialisation we see
usb 1-1.3: Product: Wireless USB Network Module
usb 1-1.3: Manufacturer: Redpine Signals, Inc.
usb 1-1.3: SerialNumber: 000000000001
rsi_91x: rsi_probe: Initialized os intf ops
rsi_91x: rsi_load_9116_firmware: Loading chunk 0
rsi_91x: rsi_load_9116_firmware: Loading chunk 1
rsi_91x: rsi_load_9116_firmware: Loading chunk 2
rsi_91x: Max Stations Allowed = 1
But sometimes the last log is missing and the wlan net device is
not created.
Running a userspace loop that resets the hardware via a GPIO shows the
problem occurring ~5/100 resets.
The problem does not occur in oper mode 1 (wifi only).
Adding logs shows that the initialisation state machine requests a MAC
reset via rsi_send_reset_mac() but the firmware does not reply, leading
to the initialisation sequence being incomplete.
Fix this by delaying attaching the BT adapter until the wifi
initialisation has completed.
With this applied I have done > 300 reset loops with no errors.
Fixes: 716b840c7641 ("rsi: handle BT traffic in driver")
Signed-off-by: Martin Fuzzey <martin.fuzzey@flowbird.group>
CC: stable@vger.kernel.org
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1630337206-12410-2-git-send-email-martin.fuzzey@flowbird.group
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rsi/rsi_91x_main.c | 16 +++++++++++++---
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 3 +++
drivers/net/wireless/rsi/rsi_main.h | 2 ++
3 files changed, 18 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/rsi/rsi_91x_main.c
+++ b/drivers/net/wireless/rsi/rsi_91x_main.c
@@ -216,9 +216,10 @@ int rsi_read_pkt(struct rsi_common *comm
bt_pkt_type = frame_desc[offset + BT_RX_PKT_TYPE_OFST];
if (bt_pkt_type == BT_CARD_READY_IND) {
rsi_dbg(INFO_ZONE, "BT Card ready recvd\n");
- if (rsi_bt_ops.attach(common, &g_proto_ops))
- rsi_dbg(ERR_ZONE,
- "Failed to attach BT module\n");
+ if (common->fsm_state == FSM_MAC_INIT_DONE)
+ rsi_attach_bt(common);
+ else
+ common->bt_defer_attach = true;
} else {
if (common->bt_adapter)
rsi_bt_ops.recv_pkt(common->bt_adapter,
@@ -283,6 +284,15 @@ void rsi_set_bt_context(void *priv, void
}
#endif
+void rsi_attach_bt(struct rsi_common *common)
+{
+#ifdef CONFIG_RSI_COEX
+ if (rsi_bt_ops.attach(common, &g_proto_ops))
+ rsi_dbg(ERR_ZONE,
+ "Failed to attach BT module\n");
+#endif
+}
+
/**
* rsi_91x_init() - This function initializes os interface operations.
* @void: Void.
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -1761,6 +1761,9 @@ static int rsi_handle_ta_confirm_type(st
if (common->reinit_hw) {
complete(&common->wlan_init_completion);
} else {
+ if (common->bt_defer_attach)
+ rsi_attach_bt(common);
+
return rsi_mac80211_attach(common);
}
}
--- a/drivers/net/wireless/rsi/rsi_main.h
+++ b/drivers/net/wireless/rsi/rsi_main.h
@@ -287,6 +287,7 @@ struct rsi_common {
struct ieee80211_vif *roc_vif;
bool eapol4_confirm;
+ bool bt_defer_attach;
void *bt_adapter;
};
@@ -361,5 +362,6 @@ struct rsi_host_intf_ops {
enum rsi_host_intf rsi_get_host_intf(void *priv);
void rsi_set_bt_context(void *priv, void *bt_context);
+void rsi_attach_bt(struct rsi_common *common);
#endif
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 059/323] rsi: fix key enabled check causing unwanted encryption for vap_id > 0
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 058/323] rsi: fix occasional initialisation failure with BT coex Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 060/323] rsi: fix rate mask set leading to P2P failure Greg Kroah-Hartman
` (267 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Fuzzey, Kalle Valo
From: Martin Fuzzey <martin.fuzzey@flowbird.group>
commit 99ac6018821253ec67f466086afb63fc18ea48e2 upstream.
My previous patch checked if encryption should be enabled by directly
checking info->control.hw_key (like the downstream driver).
However that missed that the control and driver_info members of
struct ieee80211_tx_info are union fields.
Due to this when rsi_core_xmit() updates fields in "tx_params"
(driver_info) it can overwrite the control.hw_key, causing the result
of the later test to be incorrect.
With the current structure layout the first byte of control.hw_key is
overlayed with the vap_id so, since we only test if control.hw_key is
NULL / non NULL, a non zero vap_id will incorrectly enable encryption.
In basic STA and AP modes the vap_id is always zero so it works but in
P2P client mode a second VIF is created causing vap_id to be non zero
and hence encryption to be enabled before keys have been set.
Fix this by extracting the key presence flag to a new field in the driver
private tx_params structure and populating it first.
Fixes: 314538041b56 ("rsi: fix AP mode with WPA failure due to encrypted EAPOL")
Signed-off-by: Martin Fuzzey <martin.fuzzey@flowbird.group>
CC: stable@vger.kernel.org
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1630337206-12410-3-git-send-email-martin.fuzzey@flowbird.group
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rsi/rsi_91x_core.c | 2 ++
drivers/net/wireless/rsi/rsi_91x_hal.c | 2 +-
drivers/net/wireless/rsi/rsi_main.h | 1 +
3 files changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/rsi/rsi_91x_core.c
+++ b/drivers/net/wireless/rsi/rsi_91x_core.c
@@ -400,6 +400,8 @@ void rsi_core_xmit(struct rsi_common *co
info = IEEE80211_SKB_CB(skb);
tx_params = (struct skb_info *)info->driver_data;
+ /* info->driver_data and info->control part of union so make copy */
+ tx_params->have_key = !!info->control.hw_key;
wh = (struct ieee80211_hdr *)&skb->data[0];
tx_params->sta_id = 0;
--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -193,7 +193,7 @@ int rsi_prepare_data_desc(struct rsi_com
wh->frame_control |= cpu_to_le16(RSI_SET_PS_ENABLE);
if ((!(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) &&
- info->control.hw_key) {
+ tx_params->have_key) {
if (rsi_is_cipher_wep(common))
ieee80211_size += 4;
else
--- a/drivers/net/wireless/rsi/rsi_main.h
+++ b/drivers/net/wireless/rsi/rsi_main.h
@@ -135,6 +135,7 @@ struct skb_info {
u8 internal_hdr_size;
struct ieee80211_vif *vif;
u8 vap_id;
+ bool have_key;
};
enum edca_queue {
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 060/323] rsi: fix rate mask set leading to P2P failure
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 059/323] rsi: fix key enabled check causing unwanted encryption for vap_id > 0 Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 061/323] rsi: Fix module dev_oper_mode parameter description Greg Kroah-Hartman
` (266 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Fuzzey, Kalle Valo
From: Martin Fuzzey <martin.fuzzey@flowbird.group>
commit b515d097053a71d624e0c5840b42cd4caa653941 upstream.
P2P client mode was only working the first time.
On subsequent connection attempts the group was successfully created but
no data was sent (no transmitted data packets were seen with a sniffer).
The reason for this was that the hardware was being configured in fixed
rate mode with rate RSI_RATE_1 (1Mbps) which is not valid in the 5GHz band.
In P2P mode wpa_supplicant uses NL80211_CMD_SET_TX_BITRATE_MASK to disallow
the 11b rates in the 2.4GHz band which updated common->fixedrate_mask.
rsi_set_min_rate() then used the fixedrate_mask to calculate the minimum
allowed rate, or 0xffff = auto if none was found.
However that calculation did not account for the different rate sets
allowed in the different bands leading to the error.
Fixing set_min_rate() would result in 6Mb/s being used all the time
which is not what we want either.
The reason the problem did not occur on the first connection is that
rsi_mac80211_set_rate_mask() only updated the fixedrate_mask for
the *current* band. When it was called that was still 2.4GHz as the
switch is done later. So the when set_min_rate() was subsequently
called after the switch to 5GHz it still had a mask of zero, leading
to defaulting to auto mode.
Fix this by differentiating the case of a single rate being
requested, in which case the hardware will be used in fixed rate
mode with just that rate, and multiple rates being requested,
in which case we remain in auto mode but the firmware rate selection
algorithm is configured with a restricted set of rates.
Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Signed-off-by: Martin Fuzzey <martin.fuzzey@flowbird.group>
CC: stable@vger.kernel.org
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1630337206-12410-4-git-send-email-martin.fuzzey@flowbird.group
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rsi/rsi_91x_hal.c | 8 +--
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 74 ++++++++--------------------
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 21 +++++--
drivers/net/wireless/rsi/rsi_main.h | 12 +++-
4 files changed, 50 insertions(+), 65 deletions(-)
--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -204,15 +204,17 @@ int rsi_prepare_data_desc(struct rsi_com
RSI_WIFI_DATA_Q);
data_desc->header_len = ieee80211_size;
- if (common->min_rate != RSI_RATE_AUTO) {
+ if (common->rate_config[common->band].fixed_enabled) {
/* Send fixed rate */
+ u16 fixed_rate = common->rate_config[common->band].fixed_hw_rate;
+
data_desc->frame_info = cpu_to_le16(RATE_INFO_ENABLE);
- data_desc->rate_info = cpu_to_le16(common->min_rate);
+ data_desc->rate_info = cpu_to_le16(fixed_rate);
if (conf_is_ht40(&common->priv->hw->conf))
data_desc->bbp_info = cpu_to_le16(FULL40M_ENABLE);
- if ((common->vif_info[0].sgi) && (common->min_rate & 0x100)) {
+ if (common->vif_info[0].sgi && (fixed_rate & 0x100)) {
/* Only MCS rates */
data_desc->rate_info |=
cpu_to_le16(ENABLE_SHORTGI_RATE);
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -443,7 +443,6 @@ static int rsi_mac80211_add_interface(st
if ((vif->type == NL80211_IFTYPE_AP) ||
(vif->type == NL80211_IFTYPE_P2P_GO)) {
rsi_send_rx_filter_frame(common, DISALLOW_BEACONS);
- common->min_rate = RSI_RATE_AUTO;
for (i = 0; i < common->max_stations; i++)
common->stations[i].sta = NULL;
}
@@ -1143,20 +1142,32 @@ static int rsi_mac80211_set_rate_mask(st
struct ieee80211_vif *vif,
const struct cfg80211_bitrate_mask *mask)
{
+ const unsigned int mcs_offset = ARRAY_SIZE(rsi_rates);
struct rsi_hw *adapter = hw->priv;
struct rsi_common *common = adapter->priv;
- enum nl80211_band band = hw->conf.chandef.chan->band;
+ int i;
mutex_lock(&common->mutex);
- common->fixedrate_mask[band] = 0;
- if (mask->control[band].legacy == 0xfff) {
- common->fixedrate_mask[band] =
- (mask->control[band].ht_mcs[0] << 12);
- } else {
- common->fixedrate_mask[band] =
- mask->control[band].legacy;
+ for (i = 0; i < ARRAY_SIZE(common->rate_config); i++) {
+ struct rsi_rate_config *cfg = &common->rate_config[i];
+ u32 bm;
+
+ bm = mask->control[i].legacy | (mask->control[i].ht_mcs[0] << mcs_offset);
+ if (hweight32(bm) == 1) { /* single rate */
+ int rate_index = ffs(bm) - 1;
+
+ if (rate_index < mcs_offset)
+ cfg->fixed_hw_rate = rsi_rates[rate_index].hw_value;
+ else
+ cfg->fixed_hw_rate = rsi_mcsrates[rate_index - mcs_offset];
+ cfg->fixed_enabled = true;
+ } else {
+ cfg->configured_mask = bm;
+ cfg->fixed_enabled = false;
+ }
}
+
mutex_unlock(&common->mutex);
return 0;
@@ -1292,46 +1303,6 @@ void rsi_indicate_pkt_to_os(struct rsi_c
ieee80211_rx_irqsafe(hw, skb);
}
-static void rsi_set_min_rate(struct ieee80211_hw *hw,
- struct ieee80211_sta *sta,
- struct rsi_common *common)
-{
- u8 band = hw->conf.chandef.chan->band;
- u8 ii;
- u32 rate_bitmap;
- bool matched = false;
-
- common->bitrate_mask[band] = sta->supp_rates[band];
-
- rate_bitmap = (common->fixedrate_mask[band] & sta->supp_rates[band]);
-
- if (rate_bitmap & 0xfff) {
- /* Find out the min rate */
- for (ii = 0; ii < ARRAY_SIZE(rsi_rates); ii++) {
- if (rate_bitmap & BIT(ii)) {
- common->min_rate = rsi_rates[ii].hw_value;
- matched = true;
- break;
- }
- }
- }
-
- common->vif_info[0].is_ht = sta->ht_cap.ht_supported;
-
- if ((common->vif_info[0].is_ht) && (rate_bitmap >> 12)) {
- for (ii = 0; ii < ARRAY_SIZE(rsi_mcsrates); ii++) {
- if ((rate_bitmap >> 12) & BIT(ii)) {
- common->min_rate = rsi_mcsrates[ii];
- matched = true;
- break;
- }
- }
- }
-
- if (!matched)
- common->min_rate = 0xffff;
-}
-
/**
* rsi_mac80211_sta_add() - This function notifies driver about a peer getting
* connected.
@@ -1430,9 +1401,9 @@ static int rsi_mac80211_sta_add(struct i
if ((vif->type == NL80211_IFTYPE_STATION) ||
(vif->type == NL80211_IFTYPE_P2P_CLIENT)) {
- rsi_set_min_rate(hw, sta, common);
+ common->bitrate_mask[common->band] = sta->supp_rates[common->band];
+ common->vif_info[0].is_ht = sta->ht_cap.ht_supported;
if (sta->ht_cap.ht_supported) {
- common->vif_info[0].is_ht = true;
common->bitrate_mask[NL80211_BAND_2GHZ] =
sta->supp_rates[NL80211_BAND_2GHZ];
if ((sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ||
@@ -1506,7 +1477,6 @@ static int rsi_mac80211_sta_remove(struc
bss->qos = sta->wme;
common->bitrate_mask[NL80211_BAND_2GHZ] = 0;
common->bitrate_mask[NL80211_BAND_5GHZ] = 0;
- common->min_rate = 0xffff;
common->vif_info[0].is_ht = false;
common->vif_info[0].sgi = false;
common->vif_info[0].seq_start = 0;
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -222,7 +222,7 @@ static void rsi_set_default_parameters(s
common->channel_width = BW_20MHZ;
common->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
common->channel = 1;
- common->min_rate = 0xffff;
+ memset(&common->rate_config, 0, sizeof(common->rate_config));
common->fsm_state = FSM_CARD_NOT_READY;
common->iface_down = true;
common->endpoint = EP_2GHZ_20MHZ;
@@ -1172,7 +1172,7 @@ static int rsi_send_auto_rate_request(st
u8 band = hw->conf.chandef.chan->band;
u8 num_supported_rates = 0;
u8 rate_table_offset, rate_offset = 0;
- u32 rate_bitmap;
+ u32 rate_bitmap, configured_rates;
u16 *selected_rates, min_rate;
bool is_ht = false, is_sgi = false;
u16 frame_len = sizeof(struct rsi_auto_rate);
@@ -1222,6 +1222,10 @@ static int rsi_send_auto_rate_request(st
is_sgi = true;
}
+ /* Limit to any rates administratively configured by cfg80211 */
+ configured_rates = common->rate_config[band].configured_mask ?: 0xffffffff;
+ rate_bitmap &= configured_rates;
+
if (band == NL80211_BAND_2GHZ) {
if ((rate_bitmap == 0) && (is_ht))
min_rate = RSI_RATE_MCS0;
@@ -1247,10 +1251,13 @@ static int rsi_send_auto_rate_request(st
num_supported_rates = jj;
if (is_ht) {
- for (ii = 0; ii < ARRAY_SIZE(mcs); ii++)
- selected_rates[jj++] = mcs[ii];
- num_supported_rates += ARRAY_SIZE(mcs);
- rate_offset += ARRAY_SIZE(mcs);
+ for (ii = 0; ii < ARRAY_SIZE(mcs); ii++) {
+ if (configured_rates & BIT(ii + ARRAY_SIZE(rsi_rates))) {
+ selected_rates[jj++] = mcs[ii];
+ num_supported_rates++;
+ rate_offset++;
+ }
+ }
}
sort(selected_rates, jj, sizeof(u16), &rsi_compare, NULL);
@@ -1335,7 +1342,7 @@ void rsi_inform_bss_status(struct rsi_co
qos_enable,
aid, sta_id,
vif);
- if (common->min_rate == 0xffff)
+ if (!common->rate_config[common->band].fixed_enabled)
rsi_send_auto_rate_request(common, sta, sta_id, vif);
if (opmode == RSI_OPMODE_STA &&
!(assoc_cap & WLAN_CAPABILITY_PRIVACY) &&
--- a/drivers/net/wireless/rsi/rsi_main.h
+++ b/drivers/net/wireless/rsi/rsi_main.h
@@ -61,6 +61,7 @@ enum RSI_FSM_STATES {
extern u32 rsi_zone_enabled;
extern __printf(2, 3) void rsi_dbg(u32 zone, const char *fmt, ...);
+#define RSI_MAX_BANDS 2
#define RSI_MAX_VIFS 3
#define NUM_EDCA_QUEUES 4
#define IEEE80211_ADDR_LEN 6
@@ -197,6 +198,12 @@ enum rsi_dfs_regions {
RSI_REGION_WORLD
};
+struct rsi_rate_config {
+ u32 configured_mask; /* configured by mac80211 bits 0-11=legacy 12+ mcs */
+ u16 fixed_hw_rate;
+ bool fixed_enabled;
+};
+
struct rsi_common {
struct rsi_hw *priv;
struct vif_priv vif_info[RSI_MAX_VIFS];
@@ -222,8 +229,8 @@ struct rsi_common {
u8 channel_width;
u16 rts_threshold;
- u16 bitrate_mask[2];
- u32 fixedrate_mask[2];
+ u32 bitrate_mask[RSI_MAX_BANDS];
+ struct rsi_rate_config rate_config[RSI_MAX_BANDS];
u8 rf_reset;
struct transmit_q_stats tx_stats;
@@ -244,7 +251,6 @@ struct rsi_common {
u8 mac_id;
u8 radio_id;
u16 rate_pwr[20];
- u16 min_rate;
/* WMM algo related */
u8 selected_qnum;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 061/323] rsi: Fix module dev_oper_mode parameter description
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 060/323] rsi: fix rate mask set leading to P2P failure Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 062/323] RDMA/qedr: Fix NULL deref for query_qp on the GSI QP Greg Kroah-Hartman
` (265 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Vasut, Amitkumar Karwar,
Angus Ainslie, David S. Miller, Jakub Kicinski, Kalle Valo,
Karun Eagalapati, Martin Fuzzey, Martin Kepplinger,
Prameela Rani Garnepudi, Sebastian Krzyszkowiak,
Siva Rebbagondla, netdev
From: Marek Vasut <marex@denx.de>
commit 31f97cf9f0c31143a2a6fcc89c4a1286ce20157e upstream.
The module parameters are missing dev_oper_mode 12, BT classic alone,
add it. Moreover, the parameters encode newlines, which ends up being
printed malformed e.g. by modinfo, so fix that too.
However, the module parameter string is duplicated in both USB and SDIO
modules and the dev_oper_mode mode enumeration in those module parameters
is a duplicate of macros used by the driver. Furthermore, the enumeration
is confusing.
So, deduplicate the module parameter string and use __stringify() to
encode the correct mode enumeration values into the module parameter
string. Finally, replace 'Wi-Fi' with 'Wi-Fi alone' and 'BT' with
'BT classic alone' to clarify what those modes really mean.
Fixes: 898b255339310 ("rsi: add module parameter operating mode")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>
Cc: Angus Ainslie <angus@akkea.ca>
Cc: David S. Miller <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Karun Eagalapati <karun256@gmail.com>
Cc: Martin Fuzzey <martin.fuzzey@flowbird.group>
Cc: Martin Kepplinger <martink@posteo.de>
Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com>
Cc: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Cc: Siva Rebbagondla <siva8118@gmail.com>
Cc: netdev@vger.kernel.org
Cc: <stable@vger.kernel.org> # 4.17+
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210916144245.10181-1-marex@denx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rsi/rsi_91x_sdio.c | 5 +----
drivers/net/wireless/rsi/rsi_91x_usb.c | 5 +----
drivers/net/wireless/rsi/rsi_hal.h | 11 +++++++++++
3 files changed, 13 insertions(+), 8 deletions(-)
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -24,10 +24,7 @@
/* Default operating mode is wlan STA + BT */
static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL;
module_param(dev_oper_mode, ushort, 0444);
-MODULE_PARM_DESC(dev_oper_mode,
- "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n"
- "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n"
- "6[AP + BT classic], 14[AP + BT classic + BT LE]");
+MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC);
/**
* rsi_sdio_set_cmd52_arg() - This function prepares cmd 52 read/write arg.
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -25,10 +25,7 @@
/* Default operating mode is wlan STA + BT */
static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL;
module_param(dev_oper_mode, ushort, 0444);
-MODULE_PARM_DESC(dev_oper_mode,
- "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n"
- "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n"
- "6[AP + BT classic], 14[AP + BT classic + BT LE]");
+MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC);
static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t flags);
--- a/drivers/net/wireless/rsi/rsi_hal.h
+++ b/drivers/net/wireless/rsi/rsi_hal.h
@@ -28,6 +28,17 @@
#define DEV_OPMODE_AP_BT 6
#define DEV_OPMODE_AP_BT_DUAL 14
+#define DEV_OPMODE_PARAM_DESC \
+ __stringify(DEV_OPMODE_WIFI_ALONE) "[Wi-Fi alone], " \
+ __stringify(DEV_OPMODE_BT_ALONE) "[BT classic alone], " \
+ __stringify(DEV_OPMODE_BT_LE_ALONE) "[BT LE alone], " \
+ __stringify(DEV_OPMODE_BT_DUAL) "[BT classic + BT LE alone], " \
+ __stringify(DEV_OPMODE_STA_BT) "[Wi-Fi STA + BT classic], " \
+ __stringify(DEV_OPMODE_STA_BT_LE) "[Wi-Fi STA + BT LE], " \
+ __stringify(DEV_OPMODE_STA_BT_DUAL) "[Wi-Fi STA + BT classic + BT LE], " \
+ __stringify(DEV_OPMODE_AP_BT) "[Wi-Fi AP + BT classic], " \
+ __stringify(DEV_OPMODE_AP_BT_DUAL) "[Wi-Fi AP + BT classic + BT LE]"
+
#define FLASH_WRITE_CHUNK_SIZE (4 * 1024)
#define FLASH_SECTOR_SIZE (4 * 1024)
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 062/323] RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 061/323] rsi: Fix module dev_oper_mode parameter description Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 063/323] signal: Remove the bogus sigkill_pending in ptrace_stop Greg Kroah-Hartman
` (264 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ariel Elior, Shai Malin,
Prabhakar Kushwaha, Alok Prasad, Jason Gunthorpe
From: Alok Prasad <palok@marvell.com>
commit 4f960393a0ee9a39469ceb7c8077ae8db665cc12 upstream.
This patch fixes a crash caused by querying the QP via netlink, and
corrects the state of GSI qp. GSI qp's have a NULL qed_qp.
The call trace is generated by:
$ rdma res show
BUG: kernel NULL pointer dereference, address: 0000000000000034
Hardware name: Dell Inc. PowerEdge R720/0M1GCR, BIOS 1.2.6 05/10/2012
RIP: 0010:qed_rdma_query_qp+0x33/0x1a0 [qed]
RSP: 0018:ffffba560a08f580 EFLAGS: 00010206
RAX: 0000000200000000 RBX: ffffba560a08f5b8 RCX: 0000000000000000
RDX: ffffba560a08f5b8 RSI: 0000000000000000 RDI: ffff9807ee458090
RBP: ffffba560a08f5a0 R08: 0000000000000000 R09: ffff9807890e7048
R10: ffffba560a08f658 R11: 0000000000000000 R12: 0000000000000000
R13: ffff9807ee458090 R14: ffff9807f0afb000 R15: ffffba560a08f7ec
FS: 00007fbbf8bfe740(0000) GS:ffff980aafa00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000034 CR3: 00000001720ba001 CR4: 00000000000606f0
Call Trace:
qedr_query_qp+0x82/0x360 [qedr]
ib_query_qp+0x34/0x40 [ib_core]
? ib_query_qp+0x34/0x40 [ib_core]
fill_res_qp_entry_query.isra.26+0x47/0x1d0 [ib_core]
? __nla_put+0x20/0x30
? nla_put+0x33/0x40
fill_res_qp_entry+0xe3/0x120 [ib_core]
res_get_common_dumpit+0x3f8/0x5d0 [ib_core]
? fill_res_cm_id_entry+0x1f0/0x1f0 [ib_core]
nldev_res_get_qp_dumpit+0x1a/0x20 [ib_core]
netlink_dump+0x156/0x2f0
__netlink_dump_start+0x1ab/0x260
rdma_nl_rcv+0x1de/0x330 [ib_core]
? nldev_res_get_cm_id_dumpit+0x20/0x20 [ib_core]
netlink_unicast+0x1b8/0x270
netlink_sendmsg+0x33e/0x470
sock_sendmsg+0x63/0x70
__sys_sendto+0x13f/0x180
? setup_sgl.isra.12+0x70/0xc0
__x64_sys_sendto+0x28/0x30
do_syscall_64+0x3a/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
Cc: stable@vger.kernel.org
Fixes: cecbcddf6461 ("qedr: Add support for QP verbs")
Link: https://lore.kernel.org/r/20211027184329.18454-1-palok@marvell.com
Signed-off-by: Ariel Elior <aelior@marvell.com>
Signed-off-by: Shai Malin <smalin@marvell.com>
Signed-off-by: Prabhakar Kushwaha <pkushwaha@marvell.com>
Signed-off-by: Alok Prasad <palok@marvell.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/qedr/verbs.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -2500,15 +2500,18 @@ int qedr_query_qp(struct ib_qp *ibqp,
int rc = 0;
memset(¶ms, 0, sizeof(params));
-
- rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms);
- if (rc)
- goto err;
-
memset(qp_attr, 0, sizeof(*qp_attr));
memset(qp_init_attr, 0, sizeof(*qp_init_attr));
- qp_attr->qp_state = qedr_get_ibqp_state(params.state);
+ if (qp->qp_type != IB_QPT_GSI) {
+ rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms);
+ if (rc)
+ goto err;
+ qp_attr->qp_state = qedr_get_ibqp_state(params.state);
+ } else {
+ qp_attr->qp_state = qedr_get_ibqp_state(QED_ROCE_QP_STATE_RTS);
+ }
+
qp_attr->cur_qp_state = qedr_get_ibqp_state(params.state);
qp_attr->path_mtu = ib_mtu_int_to_enum(params.mtu);
qp_attr->path_mig_state = IB_MIG_MIGRATED;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 063/323] signal: Remove the bogus sigkill_pending in ptrace_stop
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 062/323] RDMA/qedr: Fix NULL deref for query_qp on the GSI QP Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 064/323] signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT Greg Kroah-Hartman
` (263 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kees Cook, Eric W. Biederman
From: Eric W. Biederman <ebiederm@xmission.com>
commit 7d613f9f72ec8f90ddefcae038fdae5adb8404b3 upstream.
The existence of sigkill_pending is a little silly as it is
functionally a duplicate of fatal_signal_pending that is used in
exactly one place.
Checking for pending fatal signals and returning early in ptrace_stop
is actively harmful. It casues the ptrace_stop called by
ptrace_signal to return early before setting current->exit_code.
Later when ptrace_signal reads the signal number from
current->exit_code is undefined, making it unpredictable what will
happen.
Instead rely on the fact that schedule will not sleep if there is a
pending signal that can awaken a task.
Removing the explict sigkill_pending test fixes fixes ptrace_signal
when ptrace_stop does not stop because current->exit_code is always
set to to signr.
Cc: stable@vger.kernel.org
Fixes: 3d749b9e676b ("ptrace: simplify ptrace_stop()->sigkill_pending() path")
Fixes: 1a669c2f16d4 ("Add arch_ptrace_stop")
Link: https://lkml.kernel.org/r/87pmsyx29t.fsf@disp2133
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/signal.c | 18 ++++--------------
1 file changed, 4 insertions(+), 14 deletions(-)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2003,15 +2003,6 @@ static inline bool may_ptrace_stop(void)
return true;
}
-/*
- * Return non-zero if there is a SIGKILL that should be waking us up.
- * Called with the siglock held.
- */
-static bool sigkill_pending(struct task_struct *tsk)
-{
- return sigismember(&tsk->pending.signal, SIGKILL) ||
- sigismember(&tsk->signal->shared_pending.signal, SIGKILL);
-}
/*
* This must be called with current->sighand->siglock held.
@@ -2038,17 +2029,16 @@ static void ptrace_stop(int exit_code, i
* calling arch_ptrace_stop, so we must release it now.
* To preserve proper semantics, we must do this before
* any signal bookkeeping like checking group_stop_count.
- * Meanwhile, a SIGKILL could come in before we retake the
- * siglock. That must prevent us from sleeping in TASK_TRACED.
- * So after regaining the lock, we must check for SIGKILL.
*/
spin_unlock_irq(¤t->sighand->siglock);
arch_ptrace_stop(exit_code, info);
spin_lock_irq(¤t->sighand->siglock);
- if (sigkill_pending(current))
- return;
}
+ /*
+ * schedule() will not sleep if there is a pending signal that
+ * can awaken the task.
+ */
set_special_state(TASK_TRACED);
/*
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 064/323] signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 063/323] signal: Remove the bogus sigkill_pending in ptrace_stop Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 065/323] power: supply: max17042_battery: Prevent int underflow in set_soc_threshold Greg Kroah-Hartman
` (262 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Bogendoerfer, Maciej Rozycki,
linux-mips, Eric W. Biederman
From: Eric W. Biederman <ebiederm@xmission.com>
commit 95bf9d646c3c3f95cb0be7e703b371db8da5be68 upstream.
When an instruction to save or restore a register from the stack fails
in _save_fp_context or _restore_fp_context return with -EFAULT. This
change was made to r2300_fpu.S[1] but it looks like it got lost with
the introduction of EX2[2]. This is also what the other implementation
of _save_fp_context and _restore_fp_context in r4k_fpu.S does, and
what is needed for the callers to be able to handle the error.
Furthermore calling do_exit(SIGSEGV) from bad_stack is wrong because
it does not terminate the entire process it just terminates a single
thread.
As the changed code was the only caller of arch/mips/kernel/syscall.c:bad_stack
remove the problematic and now unused helper function.
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Maciej Rozycki <macro@orcam.me.uk>
Cc: linux-mips@vger.kernel.org
[1] 35938a00ba86 ("MIPS: Fix ISA I FP sigcontext access violation handling")
[2] f92722dc4545 ("MIPS: Correct MIPS I FP sigcontext layout")
Cc: stable@vger.kernel.org
Fixes: f92722dc4545 ("MIPS: Correct MIPS I FP sigcontext layout")
Acked-by: Maciej W. Rozycki <macro@orcam.me.uk>
Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Link: https://lkml.kernel.org/r/20211020174406.17889-5-ebiederm@xmission.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/r2300_fpu.S | 4 ++--
arch/mips/kernel/syscall.c | 9 ---------
2 files changed, 2 insertions(+), 11 deletions(-)
--- a/arch/mips/kernel/r2300_fpu.S
+++ b/arch/mips/kernel/r2300_fpu.S
@@ -29,8 +29,8 @@
#define EX2(a,b) \
9: a,##b; \
.section __ex_table,"a"; \
- PTR 9b,bad_stack; \
- PTR 9b+4,bad_stack; \
+ PTR 9b,fault; \
+ PTR 9b+4,fault; \
.previous
.set mips1
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -235,12 +235,3 @@ SYSCALL_DEFINE3(cachectl, char *, addr,
{
return -ENOSYS;
}
-
-/*
- * If we ever come here the user sp is bad. Zap the process right away.
- * Due to the bad stack signaling wouldn't work.
- */
-asmlinkage void bad_stack(void)
-{
- do_exit(SIGSEGV);
-}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 065/323] power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 064/323] signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 066/323] power: supply: max17042_battery: use VFSOC for capacity when no rsns Greg Kroah-Hartman
` (261 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sebastian Krzyszkowiak,
Krzysztof Kozlowski, Sebastian Reichel
From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
commit e660dbb68c6b3f7b9eb8b9775846a44f9798b719 upstream.
max17042_set_soc_threshold gets called with offset set to 1, which means
that minimum threshold value would underflow once SOC got down to 0,
causing invalid alerts from the gauge.
Fixes: e5f3872d2044 ("max17042: Add support for signalling change in SOC")
Cc: <stable@vger.kernel.org>
Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/max17042_battery.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/power/supply/max17042_battery.c
+++ b/drivers/power/supply/max17042_battery.c
@@ -848,7 +848,8 @@ static void max17042_set_soc_threshold(s
regmap_read(map, MAX17042_RepSOC, &soc);
soc >>= 8;
soc_tr = (soc + off) << 8;
- soc_tr |= (soc - off);
+ if (off < soc)
+ soc_tr |= soc - off;
regmap_write(map, MAX17042_SALRT_Th, soc_tr);
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 066/323] power: supply: max17042_battery: use VFSOC for capacity when no rsns
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 065/323] power: supply: max17042_battery: Prevent int underflow in set_soc_threshold Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 067/323] powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found Greg Kroah-Hartman
` (260 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
Wolfgang Wiedmeyer, Henrik Grimler, Hans de Goede,
Sebastian Reichel
From: Henrik Grimler <henrik@grimler.se>
commit 223a3b82834f036a62aa831f67cbf1f1d644c6e2 upstream.
On Galaxy S3 (i9300/i9305), which has the max17047 fuel gauge and no
current sense resistor (rsns), the RepSOC register does not provide an
accurate state of charge value. The reported value is wrong, and does
not change over time. VFSOC however, which uses the voltage fuel gauge
to determine the state of charge, always shows an accurate value.
For devices without current sense, VFSOC is already used for the
soc-alert (0x0003 is written to MiscCFG register), so with this change
the source of the alert and the PROP_CAPACITY value match.
Fixes: 359ab9f5b154 ("power_supply: Add MAX17042 Fuel Gauge Driver")
Cc: <stable@vger.kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Suggested-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
Signed-off-by: Henrik Grimler <henrik@grimler.se>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/max17042_battery.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/power/supply/max17042_battery.c
+++ b/drivers/power/supply/max17042_battery.c
@@ -326,7 +326,10 @@ static int max17042_get_property(struct
val->intval = data * 625 / 8;
break;
case POWER_SUPPLY_PROP_CAPACITY:
- ret = regmap_read(map, MAX17042_RepSOC, &data);
+ if (chip->pdata->enable_current_sense)
+ ret = regmap_read(map, MAX17042_RepSOC, &data);
+ else
+ ret = regmap_read(map, MAX17042_VFSOC, &data);
if (ret < 0)
return ret;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 067/323] powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 066/323] power: supply: max17042_battery: use VFSOC for capacity when no rsns Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 068/323] serial: core: Fix initializing and restoring termios speed Greg Kroah-Hartman
` (259 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Xiaoming Ni, Michael Ellerman
From: Xiaoming Ni <nixiaoming@huawei.com>
commit 3c2172c1c47b4079c29f0e6637d764a99355ebcd upstream.
When the field described in mpc85xx_smp_guts_ids[] is not configured in
dtb, the mpc85xx_setup_pmc() does not assign a value to the "guts"
variable. As a result, the oops is triggered when
mpc85xx_freeze_time_base() is executed.
Fixes: 56f1ba280719 ("powerpc/mpc85xx: refactor the PM operations")
Cc: stable@vger.kernel.org # v4.6+
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210929033646.39630-2-nixiaoming@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
@@ -98,9 +98,8 @@ int __init mpc85xx_setup_pmc(void)
pr_err("Could not map guts node address\n");
return -ENOMEM;
}
+ qoriq_pm_ops = &mpc85xx_pm_ops;
}
- qoriq_pm_ops = &mpc85xx_pm_ops;
-
return 0;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 068/323] serial: core: Fix initializing and restoring termios speed
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 067/323] powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 069/323] ALSA: mixer: oss: Fix racy access to slots Greg Kroah-Hartman
` (258 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pali Rohár
From: Pali Rohár <pali@kernel.org>
commit 027b57170bf8bb6999a28e4a5f3d78bf1db0f90c upstream.
Since commit edc6afc54968 ("tty: switch to ktermios and new framework")
termios speed is no longer stored only in c_cflag member but also in new
additional c_ispeed and c_ospeed members. If BOTHER flag is set in c_cflag
then termios speed is stored only in these new members.
Therefore to correctly restore termios speed it is required to store also
ispeed and ospeed members, not only cflag member.
In case only cflag member with BOTHER flag is restored then functions
tty_termios_baud_rate() and tty_termios_input_baud_rate() returns baudrate
stored in c_ospeed / c_ispeed member, which is zero as it was not restored
too. If reported baudrate is invalid (e.g. zero) then serial core functions
report fallback baudrate value 9600. So it means that in this case original
baudrate is lost and kernel changes it to value 9600.
Simple reproducer of this issue is to boot kernel with following command
line argument: "console=ttyXXX,86400" (where ttyXXX is the device name).
For speed 86400 there is no Bnnn constant and therefore kernel has to
represent this speed via BOTHER c_cflag. Which means that speed is stored
only in c_ospeed and c_ispeed members, not in c_cflag anymore.
If bootloader correctly configures serial device to speed 86400 then kernel
prints boot log to early console at speed speed 86400 without any issue.
But after kernel starts initializing real console device ttyXXX then speed
is changed to fallback value 9600 because information about speed was lost.
This patch fixes above issue by storing and restoring also ispeed and
ospeed members, which are required for BOTHER flag.
Fixes: edc6afc54968 ("[PATCH] tty: switch to ktermios and new framework")
Cc: stable@vger.kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Link: https://lore.kernel.org/r/20211002130900.9518-1-pali@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/serial_core.c | 16 ++++++++++++++--
include/linux/console.h | 2 ++
2 files changed, 16 insertions(+), 2 deletions(-)
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -219,7 +219,11 @@ static int uart_port_startup(struct tty_
if (retval == 0) {
if (uart_console(uport) && uport->cons->cflag) {
tty->termios.c_cflag = uport->cons->cflag;
+ tty->termios.c_ispeed = uport->cons->ispeed;
+ tty->termios.c_ospeed = uport->cons->ospeed;
uport->cons->cflag = 0;
+ uport->cons->ispeed = 0;
+ uport->cons->ospeed = 0;
}
/*
* Initialise the hardware port settings.
@@ -287,8 +291,11 @@ static void uart_shutdown(struct tty_str
/*
* Turn off DTR and RTS early.
*/
- if (uport && uart_console(uport) && tty)
+ if (uport && uart_console(uport) && tty) {
uport->cons->cflag = tty->termios.c_cflag;
+ uport->cons->ispeed = tty->termios.c_ispeed;
+ uport->cons->ospeed = tty->termios.c_ospeed;
+ }
if (!tty || C_HUPCL(tty))
uart_port_dtr_rts(uport, 0);
@@ -2062,8 +2069,11 @@ uart_set_options(struct uart_port *port,
* Allow the setting of the UART parameters with a NULL console
* too:
*/
- if (co)
+ if (co) {
co->cflag = termios.c_cflag;
+ co->ispeed = termios.c_ispeed;
+ co->ospeed = termios.c_ospeed;
+ }
return 0;
}
@@ -2197,6 +2207,8 @@ int uart_resume_port(struct uart_driver
*/
memset(&termios, 0, sizeof(struct ktermios));
termios.c_cflag = uport->cons->cflag;
+ termios.c_ispeed = uport->cons->ispeed;
+ termios.c_ospeed = uport->cons->ospeed;
/*
* If that's unset, use the tty termios setting.
--- a/include/linux/console.h
+++ b/include/linux/console.h
@@ -153,6 +153,8 @@ struct console {
short flags;
short index;
int cflag;
+ uint ispeed;
+ uint ospeed;
void *data;
struct console *next;
};
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 069/323] ALSA: mixer: oss: Fix racy access to slots
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 068/323] serial: core: Fix initializing and restoring termios speed Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 070/323] ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume Greg Kroah-Hartman
` (257 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+9988f17cf72a1045a189,
Jaroslav Kysela, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit 411cef6adfb38a5bb6bd9af3941b28198e7fb680 upstream.
The OSS mixer can reassign the mapping slots dynamically via proc
file. Although the addition and deletion of those slots are protected
by mixer->reg_mutex, the access to slots aren't, hence this may cause
UAF when the slots in use are deleted concurrently.
This patch applies the mixer->reg_mutex in all appropriate code paths
(i.e. the ioctl functions) that may access slots.
Reported-by: syzbot+9988f17cf72a1045a189@syzkaller.appspotmail.com
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/00000000000036adc005ceca9175@google.com
Link: https://lore.kernel.org/r/20211020164846.922-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/oss/mixer_oss.c | 43 +++++++++++++++++++++++++++++++++----------
1 file changed, 33 insertions(+), 10 deletions(-)
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -145,11 +145,13 @@ static int snd_mixer_oss_devmask(struct
if (mixer == NULL)
return -EIO;
+ mutex_lock(&mixer->reg_mutex);
for (chn = 0; chn < 31; chn++) {
pslot = &mixer->slots[chn];
if (pslot->put_volume || pslot->put_recsrc)
result |= 1 << chn;
}
+ mutex_unlock(&mixer->reg_mutex);
return result;
}
@@ -161,11 +163,13 @@ static int snd_mixer_oss_stereodevs(stru
if (mixer == NULL)
return -EIO;
+ mutex_lock(&mixer->reg_mutex);
for (chn = 0; chn < 31; chn++) {
pslot = &mixer->slots[chn];
if (pslot->put_volume && pslot->stereo)
result |= 1 << chn;
}
+ mutex_unlock(&mixer->reg_mutex);
return result;
}
@@ -176,6 +180,7 @@ static int snd_mixer_oss_recmask(struct
if (mixer == NULL)
return -EIO;
+ mutex_lock(&mixer->reg_mutex);
if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */
result = mixer->mask_recsrc;
} else {
@@ -187,6 +192,7 @@ static int snd_mixer_oss_recmask(struct
result |= 1 << chn;
}
}
+ mutex_unlock(&mixer->reg_mutex);
return result;
}
@@ -197,11 +203,12 @@ static int snd_mixer_oss_get_recsrc(stru
if (mixer == NULL)
return -EIO;
+ mutex_lock(&mixer->reg_mutex);
if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */
- int err;
unsigned int index;
- if ((err = mixer->get_recsrc(fmixer, &index)) < 0)
- return err;
+ result = mixer->get_recsrc(fmixer, &index);
+ if (result < 0)
+ goto unlock;
result = 1 << index;
} else {
struct snd_mixer_oss_slot *pslot;
@@ -216,7 +223,10 @@ static int snd_mixer_oss_get_recsrc(stru
}
}
}
- return mixer->oss_recsrc = result;
+ mixer->oss_recsrc = result;
+ unlock:
+ mutex_unlock(&mixer->reg_mutex);
+ return result;
}
static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsrc)
@@ -229,6 +239,7 @@ static int snd_mixer_oss_set_recsrc(stru
if (mixer == NULL)
return -EIO;
+ mutex_lock(&mixer->reg_mutex);
if (mixer->get_recsrc && mixer->put_recsrc) { /* exclusive input */
if (recsrc & ~mixer->oss_recsrc)
recsrc &= ~mixer->oss_recsrc;
@@ -254,6 +265,7 @@ static int snd_mixer_oss_set_recsrc(stru
}
}
}
+ mutex_unlock(&mixer->reg_mutex);
return result;
}
@@ -265,6 +277,7 @@ static int snd_mixer_oss_get_volume(stru
if (mixer == NULL || slot > 30)
return -EIO;
+ mutex_lock(&mixer->reg_mutex);
pslot = &mixer->slots[slot];
left = pslot->volume[0];
right = pslot->volume[1];
@@ -272,15 +285,21 @@ static int snd_mixer_oss_get_volume(stru
result = pslot->get_volume(fmixer, pslot, &left, &right);
if (!pslot->stereo)
right = left;
- if (snd_BUG_ON(left < 0 || left > 100))
- return -EIO;
- if (snd_BUG_ON(right < 0 || right > 100))
- return -EIO;
+ if (snd_BUG_ON(left < 0 || left > 100)) {
+ result = -EIO;
+ goto unlock;
+ }
+ if (snd_BUG_ON(right < 0 || right > 100)) {
+ result = -EIO;
+ goto unlock;
+ }
if (result >= 0) {
pslot->volume[0] = left;
pslot->volume[1] = right;
result = (left & 0xff) | ((right & 0xff) << 8);
}
+ unlock:
+ mutex_unlock(&mixer->reg_mutex);
return result;
}
@@ -293,6 +312,7 @@ static int snd_mixer_oss_set_volume(stru
if (mixer == NULL || slot > 30)
return -EIO;
+ mutex_lock(&mixer->reg_mutex);
pslot = &mixer->slots[slot];
if (left > 100)
left = 100;
@@ -303,10 +323,13 @@ static int snd_mixer_oss_set_volume(stru
if (pslot->put_volume)
result = pslot->put_volume(fmixer, pslot, left, right);
if (result < 0)
- return result;
+ goto unlock;
pslot->volume[0] = left;
pslot->volume[1] = right;
- return (left & 0xff) | ((right & 0xff) << 8);
+ result = (left & 0xff) | ((right & 0xff) << 8);
+ unlock:
+ mutex_lock(&mixer->reg_mutex);
+ return result;
}
static int snd_mixer_oss_ioctl1(struct snd_mixer_oss_file *fmixer, unsigned int cmd, unsigned long arg)
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 070/323] ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 069/323] ALSA: mixer: oss: Fix racy access to slots Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 071/323] xen/balloon: add late_initcall_sync() for initial ballooning done Greg Kroah-Hartman
` (256 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+ace149a75a9a0a399ac7,
Pavel Skripkin, Takashi Iwai
From: Pavel Skripkin <paskripkin@gmail.com>
commit 3ab7992018455ac63c33e9b3eaa7264e293e40f4 upstream.
In commit 411cef6adfb3 ("ALSA: mixer: oss: Fix racy access to slots")
added mutex protection in snd_mixer_oss_set_volume(). Second
mutex_lock() in same function looks like typo, fix it.
Reported-by: syzbot+ace149a75a9a0a399ac7@syzkaller.appspotmail.com
Fixes: 411cef6adfb3 ("ALSA: mixer: oss: Fix racy access to slots")
Cc: <stable@vger.kernel.org>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20211024140315.16704-1-paskripkin@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/oss/mixer_oss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -328,7 +328,7 @@ static int snd_mixer_oss_set_volume(stru
pslot->volume[1] = right;
result = (left & 0xff) | ((right & 0xff) << 8);
unlock:
- mutex_lock(&mixer->reg_mutex);
+ mutex_unlock(&mixer->reg_mutex);
return result;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 071/323] xen/balloon: add late_initcall_sync() for initial ballooning done
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 070/323] ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 072/323] PCI: aardvark: Do not clear status bits of masked interrupts Greg Kroah-Hartman
` (255 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Marczykowski-Górecki,
Juergen Gross, Boris Ostrovsky
From: Juergen Gross <jgross@suse.com>
commit 40fdea0284bb20814399da0484a658a96c735d90 upstream.
When running as PVH or HVM guest with actual memory < max memory the
hypervisor is using "populate on demand" in order to allow the guest
to balloon down from its maximum memory size. For this to work
correctly the guest must not touch more memory pages than its target
memory size as otherwise the PoD cache will be exhausted and the guest
is crashed as a result of that.
In extreme cases ballooning down might not be finished today before
the init process is started, which can consume lots of memory.
In order to avoid random boot crashes in such cases, add a late init
call to wait for ballooning down having finished for PVH/HVM guests.
Warn on console if initial ballooning fails, panic() after stalling
for more than 3 minutes per default. Add a module parameter for
changing this timeout.
[boris: replaced pr_info() with pr_notice()]
Cc: <stable@vger.kernel.org>
Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20211102091944.17487-1-jgross@suse.com
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/kernel-parameters.txt | 7 +
drivers/xen/balloon.c | 86 +++++++++++++++++-------
2 files changed, 70 insertions(+), 23 deletions(-)
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -5284,6 +5284,13 @@
with /sys/devices/system/xen_memory/xen_memory0/scrub_pages.
Default value controlled with CONFIG_XEN_SCRUB_PAGES_DEFAULT.
+ xen.balloon_boot_timeout= [XEN]
+ The time (in seconds) to wait before giving up to boot
+ in case initial ballooning fails to free enough memory.
+ Applies only when running as HVM or PVH guest and
+ started with less memory configured than allowed at
+ max. Default is 180.
+
xen.event_eoi_delay= [XEN]
How long to delay EOI handling in case of event
storms (jiffies). Default is 10.
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -58,6 +58,7 @@
#include <linux/percpu-defs.h>
#include <linux/slab.h>
#include <linux/sysctl.h>
+#include <linux/moduleparam.h>
#include <asm/page.h>
#include <asm/pgalloc.h>
@@ -75,6 +76,12 @@
#include <xen/page.h>
#include <xen/mem-reservation.h>
+#undef MODULE_PARAM_PREFIX
+#define MODULE_PARAM_PREFIX "xen."
+
+static uint __read_mostly balloon_boot_timeout = 180;
+module_param(balloon_boot_timeout, uint, 0444);
+
static int xen_hotplug_unpopulated;
#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
@@ -130,12 +137,12 @@ static struct ctl_table xen_root[] = {
* BP_ECANCELED: error, balloon operation canceled.
*/
-enum bp_state {
+static enum bp_state {
BP_DONE,
BP_WAIT,
BP_EAGAIN,
BP_ECANCELED
-};
+} balloon_state = BP_DONE;
/* Main waiting point for xen-balloon thread. */
static DECLARE_WAIT_QUEUE_HEAD(balloon_thread_wq);
@@ -206,18 +213,15 @@ static struct page *balloon_next_page(st
return list_entry(next, struct page, lru);
}
-static enum bp_state update_schedule(enum bp_state state)
+static void update_schedule(void)
{
- if (state == BP_WAIT)
- return BP_WAIT;
-
- if (state == BP_ECANCELED)
- return BP_ECANCELED;
+ if (balloon_state == BP_WAIT || balloon_state == BP_ECANCELED)
+ return;
- if (state == BP_DONE) {
+ if (balloon_state == BP_DONE) {
balloon_stats.schedule_delay = 1;
balloon_stats.retry_count = 1;
- return BP_DONE;
+ return;
}
++balloon_stats.retry_count;
@@ -226,7 +230,8 @@ static enum bp_state update_schedule(enu
balloon_stats.retry_count > balloon_stats.max_retry_count) {
balloon_stats.schedule_delay = 1;
balloon_stats.retry_count = 1;
- return BP_ECANCELED;
+ balloon_state = BP_ECANCELED;
+ return;
}
balloon_stats.schedule_delay <<= 1;
@@ -234,7 +239,7 @@ static enum bp_state update_schedule(enu
if (balloon_stats.schedule_delay > balloon_stats.max_schedule_delay)
balloon_stats.schedule_delay = balloon_stats.max_schedule_delay;
- return BP_EAGAIN;
+ balloon_state = BP_EAGAIN;
}
#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
@@ -511,9 +516,9 @@ static enum bp_state decrease_reservatio
* Stop waiting if either state is BP_DONE and ballooning action is
* needed, or if the credit has changed while state is not BP_DONE.
*/
-static bool balloon_thread_cond(enum bp_state state, long credit)
+static bool balloon_thread_cond(long credit)
{
- if (state == BP_DONE)
+ if (balloon_state == BP_DONE)
credit = 0;
return current_credit() != credit || kthread_should_stop();
@@ -527,13 +532,12 @@ static bool balloon_thread_cond(enum bp_
*/
static int balloon_thread(void *unused)
{
- enum bp_state state = BP_DONE;
long credit;
unsigned long timeout;
set_freezable();
for (;;) {
- switch (state) {
+ switch (balloon_state) {
case BP_DONE:
case BP_ECANCELED:
timeout = 3600 * HZ;
@@ -549,7 +553,7 @@ static int balloon_thread(void *unused)
credit = current_credit();
wait_event_freezable_timeout(balloon_thread_wq,
- balloon_thread_cond(state, credit), timeout);
+ balloon_thread_cond(credit), timeout);
if (kthread_should_stop())
return 0;
@@ -560,22 +564,23 @@ static int balloon_thread(void *unused)
if (credit > 0) {
if (balloon_is_inflated())
- state = increase_reservation(credit);
+ balloon_state = increase_reservation(credit);
else
- state = reserve_additional_memory();
+ balloon_state = reserve_additional_memory();
}
if (credit < 0) {
long n_pages;
n_pages = min(-credit, si_mem_available());
- state = decrease_reservation(n_pages, GFP_BALLOON);
- if (state == BP_DONE && n_pages != -credit &&
+ balloon_state = decrease_reservation(n_pages,
+ GFP_BALLOON);
+ if (balloon_state == BP_DONE && n_pages != -credit &&
n_pages < totalreserve_pages)
- state = BP_EAGAIN;
+ balloon_state = BP_EAGAIN;
}
- state = update_schedule(state);
+ update_schedule();
mutex_unlock(&balloon_mutex);
@@ -784,3 +789,38 @@ static int __init balloon_init(void)
return 0;
}
subsys_initcall(balloon_init);
+
+static int __init balloon_wait_finish(void)
+{
+ long credit, last_credit = 0;
+ unsigned long last_changed = 0;
+
+ if (!xen_domain())
+ return -ENODEV;
+
+ /* PV guests don't need to wait. */
+ if (xen_pv_domain() || !current_credit())
+ return 0;
+
+ pr_notice("Waiting for initial ballooning down having finished.\n");
+
+ while ((credit = current_credit()) < 0) {
+ if (credit != last_credit) {
+ last_changed = jiffies;
+ last_credit = credit;
+ }
+ if (balloon_state == BP_ECANCELED) {
+ pr_warn_once("Initial ballooning failed, %ld pages need to be freed.\n",
+ -credit);
+ if (jiffies - last_changed >= HZ * balloon_boot_timeout)
+ panic("Initial ballooning failed!\n");
+ }
+
+ schedule_timeout_interruptible(HZ / 10);
+ }
+
+ pr_notice("Initial ballooning down finished.\n");
+
+ return 0;
+}
+late_initcall_sync(balloon_wait_finish);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 072/323] PCI: aardvark: Do not clear status bits of masked interrupts
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 071/323] xen/balloon: add late_initcall_sync() for initial ballooning done Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 073/323] PCI: aardvark: Do not unmask unused interrupts Greg Kroah-Hartman
` (254 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Marek Behún,
Lorenzo Pieralisi
From: Pali Rohár <pali@kernel.org>
commit a7ca6d7fa3c02c032db5440ff392d96c04684c21 upstream.
The PCIE_ISR1_REG says which interrupts are currently set / active,
including those which are masked.
The driver currently reads this register and looks if some unmasked
interrupts are active, and if not, it clears status bits of _all_
interrupts, including the masked ones.
This is incorrect, since, for example, some drivers may poll these bits.
Remove this clearing, and also remove this early return statement
completely, since it does not change functionality in any way.
Link: https://lore.kernel.org/r/20211005180952.6812-7-kabel@kernel.org
Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-aardvark.c | 6 ------
1 file changed, 6 deletions(-)
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -828,12 +828,6 @@ static void advk_pcie_handle_int(struct
isr1_mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
isr1_status = isr1_val & ((~isr1_mask) & PCIE_ISR1_ALL_MASK);
- if (!isr0_status && !isr1_status) {
- advk_writel(pcie, isr0_val, PCIE_ISR0_REG);
- advk_writel(pcie, isr1_val, PCIE_ISR1_REG);
- return;
- }
-
/* Process MSI interrupts */
if (isr0_status & PCIE_ISR0_MSI_INT_PENDING)
advk_pcie_handle_msi(pcie);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 073/323] PCI: aardvark: Do not unmask unused interrupts
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 072/323] PCI: aardvark: Do not clear status bits of masked interrupts Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 074/323] PCI: aardvark: Fix return value of MSI domain .alloc() method Greg Kroah-Hartman
` (253 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Marek Behún,
Lorenzo Pieralisi
From: Pali Rohár <pali@kernel.org>
commit 1fb95d7d3c7a926b002fe8a6bd27a1cb428b46dc upstream.
There are lot of undocumented interrupt bits. To prevent unwanted
spurious interrupts, fix all *_ALL_MASK macros to define all interrupt
bits, so that driver can properly mask all interrupts, including those
which are undocumented.
Link: https://lore.kernel.org/r/20211005180952.6812-8-kabel@kernel.org
Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-aardvark.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -99,13 +99,13 @@
#define PCIE_ISR0_MSI_INT_PENDING BIT(24)
#define PCIE_ISR0_INTX_ASSERT(val) BIT(16 + (val))
#define PCIE_ISR0_INTX_DEASSERT(val) BIT(20 + (val))
-#define PCIE_ISR0_ALL_MASK GENMASK(26, 0)
+#define PCIE_ISR0_ALL_MASK GENMASK(31, 0)
#define PCIE_ISR1_REG (CONTROL_BASE_ADDR + 0x48)
#define PCIE_ISR1_MASK_REG (CONTROL_BASE_ADDR + 0x4C)
#define PCIE_ISR1_POWER_STATE_CHANGE BIT(4)
#define PCIE_ISR1_FLUSH BIT(5)
#define PCIE_ISR1_INTX_ASSERT(val) BIT(8 + (val))
-#define PCIE_ISR1_ALL_MASK GENMASK(11, 4)
+#define PCIE_ISR1_ALL_MASK GENMASK(31, 0)
#define PCIE_MSI_ADDR_LOW_REG (CONTROL_BASE_ADDR + 0x50)
#define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54)
#define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58)
@@ -150,7 +150,7 @@
#define PCIE_IRQ_MSI_INT2_DET BIT(21)
#define PCIE_IRQ_RC_DBELL_DET BIT(22)
#define PCIE_IRQ_EP_STATUS BIT(23)
-#define PCIE_IRQ_ALL_MASK 0xfff0fb
+#define PCIE_IRQ_ALL_MASK GENMASK(31, 0)
#define PCIE_IRQ_ENABLE_INTS_MASK PCIE_IRQ_CORE_INT
/* Transaction types */
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 074/323] PCI: aardvark: Fix return value of MSI domain .alloc() method
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 073/323] PCI: aardvark: Do not unmask unused interrupts Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 075/323] PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG Greg Kroah-Hartman
` (252 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Marek Behún,
Lorenzo Pieralisi
From: Marek Behún <kabel@kernel.org>
commit e4313be1599d397625c14fb7826996813622decf upstream.
MSI domain callback .alloc() (implemented by advk_msi_irq_domain_alloc()
function) should return zero on success, since non-zero value indicates
failure.
When the driver was converted to generic MSI API in commit f21a8b1b6837
("PCI: aardvark: Move to MSI handling using generic MSI support"), it
was converted so that it returns hwirq number.
Fix this.
Link: https://lore.kernel.org/r/20211028185659.20329-3-kabel@kernel.org
Fixes: f21a8b1b6837 ("PCI: aardvark: Move to MSI handling using generic MSI support")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-aardvark.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -627,7 +627,7 @@ static int advk_msi_irq_domain_alloc(str
domain->host_data, handle_simple_irq,
NULL, NULL);
- return hwirq;
+ return 0;
}
static void advk_msi_irq_domain_free(struct irq_domain *domain,
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 075/323] PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 074/323] PCI: aardvark: Fix return value of MSI domain .alloc() method Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 076/323] quota: check block number when reading the block in quota file Greg Kroah-Hartman
` (251 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Marek Behún,
Lorenzo Pieralisi
From: Marek Behún <kabel@kernel.org>
commit 95997723b6402cd6c53e0f9e7ac640ec64eaaff8 upstream.
The PCIE_MSI_PAYLOAD_REG contains 16-bit MSI number, not only lower
8 bits. Fix reading content of this register and add a comment
describing the access to this register.
Link: https://lore.kernel.org/r/20211028185659.20329-4-kabel@kernel.org
Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-aardvark.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -111,6 +111,7 @@
#define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58)
#define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C)
#define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C)
+#define PCIE_MSI_DATA_MASK GENMASK(15, 0)
/* LMI registers base address and register offsets */
#define LMI_BASE_ADDR 0x6000
@@ -805,8 +806,12 @@ static void advk_pcie_handle_msi(struct
if (!(BIT(msi_idx) & msi_status))
continue;
+ /*
+ * msi_idx contains bits [4:0] of the msi_data and msi_data
+ * contains 16bit MSI interrupt number
+ */
advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG);
- msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & 0xFF;
+ msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK;
generic_handle_irq(msi_data);
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 076/323] quota: check block number when reading the block in quota file
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 075/323] PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 077/323] quota: correct error number in free_dqentry() Greg Kroah-Hartman
` (250 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Yi, stable, Jan Kara
From: Zhang Yi <yi.zhang@huawei.com>
commit 9bf3d20331295b1ecb81f4ed9ef358c51699a050 upstream.
The block number in the quota tree on disk should be smaller than the
v2_disk_dqinfo.dqi_blocks. If the quota file was corrupted, we may be
allocating an 'allocated' block and that would lead to a loop in a tree,
which will probably trigger oops later. This patch adds a check for the
block number in the quota tree to prevent such potential issue.
Link: https://lore.kernel.org/r/20211008093821.1001186-2-yi.zhang@huawei.com
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Cc: stable@kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/quota/quota_tree.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/fs/quota/quota_tree.c
+++ b/fs/quota/quota_tree.c
@@ -487,6 +487,13 @@ static int remove_tree(struct qtree_mem_
goto out_buf;
}
newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]);
+ if (newblk < QT_TREEOFF || newblk >= info->dqi_blocks) {
+ quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)",
+ newblk, info->dqi_blocks);
+ ret = -EUCLEAN;
+ goto out_buf;
+ }
+
if (depth == info->dqi_qtree_depth - 1) {
ret = free_dqentry(info, dquot, newblk);
newblk = 0;
@@ -586,6 +593,13 @@ static loff_t find_tree_dqentry(struct q
blk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]);
if (!blk) /* No reference? */
goto out_buf;
+ if (blk < QT_TREEOFF || blk >= info->dqi_blocks) {
+ quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)",
+ blk, info->dqi_blocks);
+ ret = -EUCLEAN;
+ goto out_buf;
+ }
+
if (depth < info->dqi_qtree_depth - 1)
ret = find_tree_dqentry(info, dquot, blk, depth+1);
else
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 077/323] quota: correct error number in free_dqentry()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 076/323] quota: check block number when reading the block in quota file Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 078/323] pinctrl: core: fix possible memory leak in pinctrl_enable() Greg Kroah-Hartman
` (249 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhang Yi, stable, Jan Kara
From: Zhang Yi <yi.zhang@huawei.com>
commit d0e36a62bd4c60c09acc40e06ba4831a4d0bc75b upstream.
Fix the error path in free_dqentry(), pass out the error number if the
block to free is not correct.
Fixes: 1ccd14b9c271 ("quota: Split off quota tree handling into a separate file")
Link: https://lore.kernel.org/r/20211008093821.1001186-3-yi.zhang@huawei.com
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Cc: stable@kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/quota/quota_tree.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/quota/quota_tree.c
+++ b/fs/quota/quota_tree.c
@@ -422,6 +422,7 @@ static int free_dqentry(struct qtree_mem
quota_error(dquot->dq_sb, "Quota structure has offset to "
"other block (%u) than it should (%u)", blk,
(uint)(dquot->dq_off >> info->dqi_blocksize_bits));
+ ret = -EIO;
goto out_buf;
}
ret = read_blk(info, blk, buf);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 078/323] pinctrl: core: fix possible memory leak in pinctrl_enable()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 077/323] quota: correct error number in free_dqentry() Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 079/323] iio: dac: ad5446: Fix ad5622_write() return value Greg Kroah-Hartman
` (248 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang, Linus Walleij
From: Yang Yingliang <yangyingliang@huawei.com>
commit c7892ae13e461ed20154321eb792e07ebe38f5b3 upstream.
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff888020a7a680 (size 64):
comm "i2c-mcp23018-41", pid 23090, jiffies 4295160544 (age 8.680s)
hex dump (first 32 bytes):
00 48 d3 1e 80 88 ff ff 00 1a 56 c1 ff ff ff ff .H........V.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000083c79b35>] kmem_cache_alloc_trace+0x16d/0x360
[<0000000051803c95>] pinctrl_init_controller+0x6ed/0xb70
[<0000000064346707>] pinctrl_register+0x27/0x80
[<0000000029b0e186>] devm_pinctrl_register+0x5b/0xe0
[<00000000391f5a3e>] mcp23s08_probe_one+0x968/0x118a [pinctrl_mcp23s08]
[<000000006112c039>] mcp230xx_probe+0x266/0x560 [pinctrl_mcp23s08_i2c]
If pinctrl_claim_hogs() fails, the 'pindesc' allocated in pinctrl_register_one_pin()
need be freed.
Cc: stable@vger.kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 950b0d91dc10 ("pinctrl: core: Fix regression caused by delayed work for hogs")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20211022014323.1156924-1-yangyingliang@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -2038,6 +2038,8 @@ int pinctrl_enable(struct pinctrl_dev *p
if (error) {
dev_err(pctldev->dev, "could not claim hogs: %i\n",
error);
+ pinctrl_free_pindescs(pctldev, pctldev->desc->pins,
+ pctldev->desc->npins);
mutex_destroy(&pctldev->mutex);
kfree(pctldev);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 079/323] iio: dac: ad5446: Fix ad5622_write() return value
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 078/323] pinctrl: core: fix possible memory leak in pinctrl_enable() Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 080/323] USB: serial: keyspan: fix memleak on probe errors Greg Kroah-Hartman
` (247 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pekka Korpinen, Stable, Jonathan Cameron
From: Pekka Korpinen <pekka.korpinen@iki.fi>
commit 558df982d4ead9cac628153d0d7b60feae05ddc8 upstream.
On success i2c_master_send() returns the number of bytes written. The
call from iio_write_channel_info(), however, expects the return value to
be zero on success.
This bug causes incorrect consumption of the sysfs buffer in
iio_write_channel_info(). When writing more than two characters to
out_voltage0_raw, the ad5446 write handler is called multiple times
causing unexpected behavior.
Fixes: 3ec36a2cf0d5 ("iio:ad5446: Add support for I2C based DACs")
Signed-off-by: Pekka Korpinen <pekka.korpinen@iki.fi>
Link: https://lore.kernel.org/r/20210929185755.2384-1-pekka.korpinen@iki.fi
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/dac/ad5446.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/iio/dac/ad5446.c
+++ b/drivers/iio/dac/ad5446.c
@@ -528,8 +528,15 @@ static int ad5622_write(struct ad5446_st
{
struct i2c_client *client = to_i2c_client(st->dev);
__be16 data = cpu_to_be16(val);
+ int ret;
- return i2c_master_send(client, (char *)&data, sizeof(data));
+ ret = i2c_master_send(client, (char *)&data, sizeof(data));
+ if (ret < 0)
+ return ret;
+ if (ret != sizeof(data))
+ return -EIO;
+
+ return 0;
}
/**
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 080/323] USB: serial: keyspan: fix memleak on probe errors
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 079/323] iio: dac: ad5446: Fix ad5622_write() return value Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 081/323] USB: iowarrior: fix control-message timeouts Greg Kroah-Hartman
` (246 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Johan Hovold
From: Wang Hai <wanghai38@huawei.com>
commit 910c996335c37552ee30fcb837375b808bb4f33b upstream.
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff888258228440 (size 64):
comm "kworker/7:2", pid 2005, jiffies 4294989509 (age 824.540s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8167939c>] slab_post_alloc_hook+0x9c/0x490
[<ffffffff8167f627>] kmem_cache_alloc_trace+0x1f7/0x470
[<ffffffffa02ac0e4>] keyspan_port_probe+0xa4/0x5d0 [keyspan]
[<ffffffffa0294c07>] usb_serial_device_probe+0x97/0x1d0 [usbserial]
[<ffffffff82b50ca7>] really_probe+0x167/0x460
[<ffffffff82b51099>] __driver_probe_device+0xf9/0x180
[<ffffffff82b51173>] driver_probe_device+0x53/0x130
[<ffffffff82b516f5>] __device_attach_driver+0x105/0x130
[<ffffffff82b4cfe9>] bus_for_each_drv+0x129/0x190
[<ffffffff82b50a69>] __device_attach+0x1c9/0x270
[<ffffffff82b518d0>] device_initial_probe+0x20/0x30
[<ffffffff82b4f062>] bus_probe_device+0x142/0x160
[<ffffffff82b4a4e9>] device_add+0x829/0x1300
[<ffffffffa0295fda>] usb_serial_probe.cold+0xc9b/0x14ac [usbserial]
[<ffffffffa02266aa>] usb_probe_interface+0x1aa/0x3c0 [usbcore]
[<ffffffff82b50ca7>] really_probe+0x167/0x460
If keyspan_port_probe() fails to allocate memory for an out_buffer[i] or
in_buffer[i], the previously allocated memory for out_buffer or
in_buffer needs to be freed on the error handling path, otherwise a
memory leak will result.
Fixes: bad41a5bf177 ("USB: keyspan: fix port DMA-buffer allocations")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20211015085543.1203011-1-wanghai38@huawei.com
Cc: stable@vger.kernel.org # 3.12
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/keyspan.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -2910,22 +2910,22 @@ static int keyspan_port_probe(struct usb
for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) {
p_priv->in_buffer[i] = kzalloc(IN_BUFLEN, GFP_KERNEL);
if (!p_priv->in_buffer[i])
- goto err_in_buffer;
+ goto err_free_in_buffer;
}
for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) {
p_priv->out_buffer[i] = kzalloc(OUT_BUFLEN, GFP_KERNEL);
if (!p_priv->out_buffer[i])
- goto err_out_buffer;
+ goto err_free_out_buffer;
}
p_priv->inack_buffer = kzalloc(INACK_BUFLEN, GFP_KERNEL);
if (!p_priv->inack_buffer)
- goto err_inack_buffer;
+ goto err_free_out_buffer;
p_priv->outcont_buffer = kzalloc(OUTCONT_BUFLEN, GFP_KERNEL);
if (!p_priv->outcont_buffer)
- goto err_outcont_buffer;
+ goto err_free_inack_buffer;
p_priv->device_details = d_details;
@@ -2971,15 +2971,14 @@ static int keyspan_port_probe(struct usb
return 0;
-err_outcont_buffer:
+err_free_inack_buffer:
kfree(p_priv->inack_buffer);
-err_inack_buffer:
+err_free_out_buffer:
for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i)
kfree(p_priv->out_buffer[i]);
-err_out_buffer:
+err_free_in_buffer:
for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i)
kfree(p_priv->in_buffer[i]);
-err_in_buffer:
kfree(p_priv);
return -ENOMEM;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 081/323] USB: iowarrior: fix control-message timeouts
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 080/323] USB: serial: keyspan: fix memleak on probe errors Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 082/323] drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 Greg Kroah-Hartman
` (245 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit 79a4479a17b83310deb0b1a2a274fe5be12d2318 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Use the common control-message timeout define for the five-second
timeout and drop the driver-specific one.
Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Cc: stable@vger.kernel.org # 2.6.21
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211025115159.4954-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/iowarrior.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -103,10 +103,6 @@ struct iowarrior {
/* globals */
/*--------------*/
-/*
- * USB spec identifies 5 second timeouts.
- */
-#define GET_TIMEOUT 5
#define USB_REQ_GET_REPORT 0x01
//#if 0
static int usb_get_report(struct usb_device *dev,
@@ -118,7 +114,7 @@ static int usb_get_report(struct usb_dev
USB_DIR_IN | USB_TYPE_CLASS |
USB_RECIP_INTERFACE, (type << 8) + id,
inter->desc.bInterfaceNumber, buf, size,
- GET_TIMEOUT*HZ);
+ USB_CTRL_GET_TIMEOUT);
}
//#endif
@@ -133,7 +129,7 @@ static int usb_set_report(struct usb_int
USB_TYPE_CLASS | USB_RECIP_INTERFACE,
(type << 8) + id,
intf->cur_altsetting->desc.bInterfaceNumber, buf,
- size, HZ);
+ size, 1000);
}
/*---------------------*/
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 082/323] drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 081/323] USB: iowarrior: fix control-message timeouts Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 083/323] Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Greg Kroah-Hartman
` (244 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Simon Ser, Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit a53f1dd3ab9fec715c6c2e8e01bf4d3c07eef8e5 ]
The KD Kurio Smart C15200 2-in-1 uses a panel which has been mounted 90
degrees rotated. Add a quirk for this.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Simon Ser <contact@emersion.fr>
Link: https://patchwork.freedesktop.org/patch/msgid/20210530110428.12994-3-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panel_orientation_quirks.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index 48be8590ebe81..3b70a338e5b47 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -170,6 +170,13 @@ static const struct dmi_system_id orientation_data[] = {
DMI_EXACT_MATCH(DMI_BOARD_NAME, "TW891"),
},
.driver_data = (void *)&itworks_tw891,
+ }, { /* KD Kurio Smart C15200 2-in-1 */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "KD Interactive"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Kurio Smart"),
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "KDM960BCP"),
+ },
+ .driver_data = (void *)&lcd800x1280_rightside_up,
}, { /*
* Lenovo Ideapad Miix 310 laptop, only some production batches
* have a portrait screen, the resolution checks makes the quirk
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 083/323] Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 082/323] drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 084/323] Bluetooth: fix use-after-free error in lock_sock_nested() Greg Kroah-Hartman
` (243 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Marcel Holtmann, Sasha Levin
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 99c23da0eed4fd20cae8243f2b51e10e66aa0951 ]
The sco_send_frame() also takes lock_sock() during memcpy_from_msg()
call that may be endlessly blocked by a task with userfaultd
technique, and this will result in a hung task watchdog trigger.
Just like the similar fix for hci_sock_sendmsg() in commit
92c685dc5de0 ("Bluetooth: reorganize functions..."), this patch moves
the memcpy_from_msg() out of lock_sock() for addressing the hang.
This should be the last piece for fixing CVE-2021-3640 after a few
already queued fixes.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/sco.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 007a01b08dbe9..d052b454dc4e1 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -280,7 +280,8 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk)
return err;
}
-static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
+static int sco_send_frame(struct sock *sk, void *buf, int len,
+ unsigned int msg_flags)
{
struct sco_conn *conn = sco_pi(sk)->conn;
struct sk_buff *skb;
@@ -292,15 +293,11 @@ static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
BT_DBG("sk %p len %d", sk, len);
- skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
+ skb = bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err);
if (!skb)
return err;
- if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
- kfree_skb(skb);
- return -EFAULT;
- }
-
+ memcpy(skb_put(skb, len), buf, len);
hci_send_sco(conn->hcon, skb);
return len;
@@ -714,6 +711,7 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
size_t len)
{
struct sock *sk = sock->sk;
+ void *buf;
int err;
BT_DBG("sock %p, sk %p", sock, sk);
@@ -725,14 +723,24 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
if (msg->msg_flags & MSG_OOB)
return -EOPNOTSUPP;
+ buf = kmalloc(len, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ if (memcpy_from_msg(buf, msg, len)) {
+ kfree(buf);
+ return -EFAULT;
+ }
+
lock_sock(sk);
if (sk->sk_state == BT_CONNECTED)
- err = sco_send_frame(sk, msg, len);
+ err = sco_send_frame(sk, buf, len, msg->msg_flags);
else
err = -ENOTCONN;
release_sock(sk);
+ kfree(buf);
return err;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 084/323] Bluetooth: fix use-after-free error in lock_sock_nested()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 083/323] Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 085/323] platform/x86: wmi: do not fail if disabling fails Greg Kroah-Hartman
` (242 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wang ShaoBo, Luiz Augusto von Dentz,
Marcel Holtmann, Sasha Levin
From: Wang ShaoBo <bobo.shaobowang@huawei.com>
[ Upstream commit 1bff51ea59a9afb67d2dd78518ab0582a54a472c ]
use-after-free error in lock_sock_nested is reported:
[ 179.140137][ T3731] =====================================================
[ 179.142675][ T3731] BUG: KMSAN: use-after-free in lock_sock_nested+0x280/0x2c0
[ 179.145494][ T3731] CPU: 4 PID: 3731 Comm: kworker/4:2 Not tainted 5.12.0-rc6+ #54
[ 179.148432][ T3731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
[ 179.151806][ T3731] Workqueue: events l2cap_chan_timeout
[ 179.152730][ T3731] Call Trace:
[ 179.153301][ T3731] dump_stack+0x24c/0x2e0
[ 179.154063][ T3731] kmsan_report+0xfb/0x1e0
[ 179.154855][ T3731] __msan_warning+0x5c/0xa0
[ 179.155579][ T3731] lock_sock_nested+0x280/0x2c0
[ 179.156436][ T3731] ? kmsan_get_metadata+0x116/0x180
[ 179.157257][ T3731] l2cap_sock_teardown_cb+0xb8/0x890
[ 179.158154][ T3731] ? __msan_metadata_ptr_for_load_8+0x10/0x20
[ 179.159141][ T3731] ? kmsan_get_metadata+0x116/0x180
[ 179.159994][ T3731] ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[ 179.160959][ T3731] ? l2cap_sock_recv_cb+0x420/0x420
[ 179.161834][ T3731] l2cap_chan_del+0x3e1/0x1d50
[ 179.162608][ T3731] ? kmsan_get_metadata+0x116/0x180
[ 179.163435][ T3731] ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[ 179.164406][ T3731] l2cap_chan_close+0xeea/0x1050
[ 179.165189][ T3731] ? kmsan_internal_unpoison_shadow+0x42/0x70
[ 179.166180][ T3731] l2cap_chan_timeout+0x1da/0x590
[ 179.167066][ T3731] ? __msan_metadata_ptr_for_load_8+0x10/0x20
[ 179.168023][ T3731] ? l2cap_chan_create+0x560/0x560
[ 179.168818][ T3731] process_one_work+0x121d/0x1ff0
[ 179.169598][ T3731] worker_thread+0x121b/0x2370
[ 179.170346][ T3731] kthread+0x4ef/0x610
[ 179.171010][ T3731] ? process_one_work+0x1ff0/0x1ff0
[ 179.171828][ T3731] ? kthread_blkcg+0x110/0x110
[ 179.172587][ T3731] ret_from_fork+0x1f/0x30
[ 179.173348][ T3731]
[ 179.173752][ T3731] Uninit was created at:
[ 179.174409][ T3731] kmsan_internal_poison_shadow+0x5c/0xf0
[ 179.175373][ T3731] kmsan_slab_free+0x76/0xc0
[ 179.176060][ T3731] kfree+0x3a5/0x1180
[ 179.176664][ T3731] __sk_destruct+0x8af/0xb80
[ 179.177375][ T3731] __sk_free+0x812/0x8c0
[ 179.178032][ T3731] sk_free+0x97/0x130
[ 179.178686][ T3731] l2cap_sock_release+0x3d5/0x4d0
[ 179.179457][ T3731] sock_close+0x150/0x450
[ 179.180117][ T3731] __fput+0x6bd/0xf00
[ 179.180787][ T3731] ____fput+0x37/0x40
[ 179.181481][ T3731] task_work_run+0x140/0x280
[ 179.182219][ T3731] do_exit+0xe51/0x3e60
[ 179.182930][ T3731] do_group_exit+0x20e/0x450
[ 179.183656][ T3731] get_signal+0x2dfb/0x38f0
[ 179.184344][ T3731] arch_do_signal_or_restart+0xaa/0xe10
[ 179.185266][ T3731] exit_to_user_mode_prepare+0x2d2/0x560
[ 179.186136][ T3731] syscall_exit_to_user_mode+0x35/0x60
[ 179.186984][ T3731] do_syscall_64+0xc5/0x140
[ 179.187681][ T3731] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 179.188604][ T3731] =====================================================
In our case, there are two Thread A and B:
Context: Thread A: Context: Thread B:
l2cap_chan_timeout() __se_sys_shutdown()
l2cap_chan_close() l2cap_sock_shutdown()
l2cap_chan_del() l2cap_chan_close()
l2cap_sock_teardown_cb() l2cap_sock_teardown_cb()
Once l2cap_sock_teardown_cb() excuted, this sock will be marked as SOCK_ZAPPED,
and can be treated as killable in l2cap_sock_kill() if sock_orphan() has
excuted, at this time we close sock through sock_close() which end to call
l2cap_sock_kill() like Thread C:
Context: Thread C:
sock_close()
l2cap_sock_release()
sock_orphan()
l2cap_sock_kill() #free sock if refcnt is 1
If C completed, Once A or B reaches l2cap_sock_teardown_cb() again,
use-after-free happened.
We should set chan->data to NULL if sock is destructed, for telling teardown
operation is not allowed in l2cap_sock_teardown_cb(), and also we should
avoid killing an already killed socket in l2cap_sock_close_cb().
Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_sock.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 967a9bb144157..d938311c58a8d 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1328,6 +1328,9 @@ static void l2cap_sock_close_cb(struct l2cap_chan *chan)
{
struct sock *sk = chan->data;
+ if (!sk)
+ return;
+
l2cap_sock_kill(sk);
}
@@ -1336,6 +1339,9 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
struct sock *sk = chan->data;
struct sock *parent;
+ if (!sk)
+ return;
+
BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
/* This callback can be called both for server (BT_LISTEN)
@@ -1519,8 +1525,10 @@ static void l2cap_sock_destruct(struct sock *sk)
{
BT_DBG("sk %p", sk);
- if (l2cap_pi(sk)->chan)
+ if (l2cap_pi(sk)->chan) {
+ l2cap_pi(sk)->chan->data = NULL;
l2cap_chan_put(l2cap_pi(sk)->chan);
+ }
if (l2cap_pi(sk)->rx_busy_skb) {
kfree_skb(l2cap_pi(sk)->rx_busy_skb);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 085/323] platform/x86: wmi: do not fail if disabling fails
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 084/323] Bluetooth: fix use-after-free error in lock_sock_nested() Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 086/323] MIPS: lantiq: dma: add small delay after reset Greg Kroah-Hartman
` (241 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Barnabás Pőcze,
Hans de Goede, Sasha Levin
From: Barnabás Pőcze <pobrn@protonmail.com>
[ Upstream commit 1975718c488a39128f1f515b23ae61a5a214cc3d ]
Previously, `__query_block()` would fail if the
second WCxx method call failed. However, the
WQxx method might have succeeded, and potentially
allocated memory for the result. Instead of
throwing away the result and potentially
leaking memory, ignore the result of
the second WCxx call.
Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
Link: https://lore.kernel.org/r/20210904175450.156801-25-pobrn@protonmail.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/wmi.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 35cdc3998eb59..387358af685c5 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -350,7 +350,14 @@ static acpi_status __query_block(struct wmi_block *wblock, u8 instance,
* the WQxx method failed - we should disable collection anyway.
*/
if ((block->flags & ACPI_WMI_EXPENSIVE) && ACPI_SUCCESS(wc_status)) {
- status = acpi_execute_simple_method(handle, wc_method, 0);
+ /*
+ * Ignore whether this WCxx call succeeds or not since
+ * the previously executed WQxx method call might have
+ * succeeded, and returning the failing status code
+ * of this call would throw away the result of the WQxx
+ * call, potentially leaking memory.
+ */
+ acpi_execute_simple_method(handle, wc_method, 0);
}
return status;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 086/323] MIPS: lantiq: dma: add small delay after reset
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 085/323] platform/x86: wmi: do not fail if disabling fails Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 087/323] MIPS: lantiq: dma: reset correct number of channel Greg Kroah-Hartman
` (240 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aleksander Jan Bajkowski,
David S. Miller, Sasha Levin
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit c12aa581f6d5e80c3c3675ab26a52c2b3b62f76e ]
Reading the DMA registers immediately after the reset causes
Data Bus Error. Adding a small delay fixes this issue.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/lantiq/xway/dma.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c
index 664f2f7f55c1c..45a622b72cd13 100644
--- a/arch/mips/lantiq/xway/dma.c
+++ b/arch/mips/lantiq/xway/dma.c
@@ -22,6 +22,7 @@
#include <linux/export.h>
#include <linux/spinlock.h>
#include <linux/clk.h>
+#include <linux/delay.h>
#include <linux/err.h>
#include <lantiq_soc.h>
@@ -233,6 +234,8 @@ ltq_dma_init(struct platform_device *pdev)
clk_enable(clk);
ltq_dma_w32_mask(0, DMA_RESET, LTQ_DMA_CTRL);
+ usleep_range(1, 10);
+
/* disable all interrupts */
ltq_dma_w32(0, LTQ_DMA_IRNEN);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 087/323] MIPS: lantiq: dma: reset correct number of channel
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 086/323] MIPS: lantiq: dma: add small delay after reset Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail Greg Kroah-Hartman
` (239 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aleksander Jan Bajkowski,
David S. Miller, Sasha Levin
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit 5ca9ce2ba4d5884cd94d1a856c675ab1242cd242 ]
Different SoCs have a different number of channels, e.g .:
* amazon-se has 10 channels,
* danube+ar9 have 20 channels,
* vr9 has 28 channels,
* ar10 has 24 channels.
We can read the ID register and, depending on the reported
number of channels, reset the appropriate number of channels.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/lantiq/xway/dma.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c
index 45a622b72cd13..efee1c538a518 100644
--- a/arch/mips/lantiq/xway/dma.c
+++ b/arch/mips/lantiq/xway/dma.c
@@ -41,6 +41,7 @@
#define LTQ_DMA_PCTRL 0x44
#define LTQ_DMA_IRNEN 0xf4
+#define DMA_ID_CHNR GENMASK(26, 20) /* channel number */
#define DMA_DESCPT BIT(3) /* descriptor complete irq */
#define DMA_TX BIT(8) /* TX channel direction */
#define DMA_CHAN_ON BIT(0) /* channel on / off bit */
@@ -51,7 +52,6 @@
#define DMA_POLL BIT(31) /* turn on channel polling */
#define DMA_CLK_DIV4 BIT(6) /* polling clock divider */
#define DMA_2W_BURST BIT(1) /* 2 word burst length */
-#define DMA_MAX_CHANNEL 20 /* the soc has 20 channels */
#define DMA_ETOP_ENDIANNESS (0xf << 8) /* endianness swap etop channels */
#define DMA_WEIGHT (BIT(17) | BIT(16)) /* default channel wheight */
@@ -218,7 +218,7 @@ ltq_dma_init(struct platform_device *pdev)
{
struct clk *clk;
struct resource *res;
- unsigned id;
+ unsigned int id, nchannels;
int i;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -240,17 +240,18 @@ ltq_dma_init(struct platform_device *pdev)
ltq_dma_w32(0, LTQ_DMA_IRNEN);
/* reset/configure each channel */
- for (i = 0; i < DMA_MAX_CHANNEL; i++) {
+ id = ltq_dma_r32(LTQ_DMA_ID);
+ nchannels = ((id & DMA_ID_CHNR) >> 20);
+ for (i = 0; i < nchannels; i++) {
ltq_dma_w32(i, LTQ_DMA_CS);
ltq_dma_w32(DMA_CHAN_RST, LTQ_DMA_CCTRL);
ltq_dma_w32(DMA_POLL | DMA_CLK_DIV4, LTQ_DMA_CPOLL);
ltq_dma_w32_mask(DMA_CHAN_ON, 0, LTQ_DMA_CCTRL);
}
- id = ltq_dma_r32(LTQ_DMA_ID);
dev_info(&pdev->dev,
"Init done - hw rev: %X, ports: %d, channels: %d\n",
- id & 0x1f, (id >> 16) & 0xf, id >> 20);
+ id & 0x1f, (id >> 16) & 0xf, nchannels);
return 0;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 087/323] MIPS: lantiq: dma: reset correct number of channel Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-28 9:46 ` Salvatore Bonaccorso
2021-11-24 11:54 ` [PATCH 4.19 089/323] net: sched: update default qdisc visibility after Tx queue cnt changes Greg Kroah-Hartman
` (238 subsequent siblings)
326 siblings, 1 reply; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel), Sasha Levin
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]
vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20210624095148.311980536@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/lockdep.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 126c6d524a0f2..4dc79f57af827 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -689,7 +689,7 @@ look_up_lock_class(const struct lockdep_map *lock, unsigned int subclass)
if (DEBUG_LOCKS_WARN_ON(!irqs_disabled()))
return NULL;
- hlist_for_each_entry_rcu(class, hash_head, hash_entry) {
+ hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
if (class->key == key) {
/*
* Huh! same key, different name? Did someone trample
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 089/323] net: sched: update default qdisc visibility after Tx queue cnt changes
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 090/323] smackfs: Fix use-after-free in netlbl_catmap_walk() Greg Kroah-Hartman
` (237 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matthew Massey, Dave Taht,
Jakub Kicinski, David S. Miller, Sasha Levin
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 1e080f17750d1083e8a32f7b350584ae1cd7ff20 ]
mq / mqprio make the default child qdiscs visible. They only do
so for the qdiscs which are within real_num_tx_queues when the
device is registered. Depending on order of calls in the driver,
or if user space changes config via ethtool -L the number of
qdiscs visible under tc qdisc show will differ from the number
of queues. This is confusing to users and potentially to system
configuration scripts which try to make sure qdiscs have the
right parameters.
Add a new Qdisc_ops callback and make relevant qdiscs TTRT.
Note that this uncovers the "shortcut" created by
commit 1f27cde313d7 ("net: sched: use pfifo_fast for non real queues")
The default child qdiscs beyond initial real_num_tx are always
pfifo_fast, no matter what the sysfs setting is. Fixing this
gets a little tricky because we'd need to keep a reference
on whatever the default qdisc was at the time of creation.
In practice this is likely an non-issue the qdiscs likely have
to be configured to non-default settings, so whatever user space
is doing such configuration can replace the pfifos... now that
it will see them.
Reported-by: Matthew Massey <matthewmassey@fb.com>
Reviewed-by: Dave Taht <dave.taht@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sch_generic.h | 4 ++++
net/core/dev.c | 2 ++
net/sched/sch_generic.c | 9 +++++++++
net/sched/sch_mq.c | 24 ++++++++++++++++++++++++
net/sched/sch_mqprio.c | 23 +++++++++++++++++++++++
5 files changed, 62 insertions(+)
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index d737a6a2600be..286bc674a6e79 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -216,6 +216,8 @@ struct Qdisc_ops {
struct netlink_ext_ack *extack);
void (*attach)(struct Qdisc *sch);
int (*change_tx_queue_len)(struct Qdisc *, unsigned int);
+ void (*change_real_num_tx)(struct Qdisc *sch,
+ unsigned int new_real_tx);
int (*dump)(struct Qdisc *, struct sk_buff *);
int (*dump_stats)(struct Qdisc *, struct gnet_dump *);
@@ -547,6 +549,8 @@ void qdisc_class_hash_grow(struct Qdisc *, struct Qdisc_class_hash *);
void qdisc_class_hash_destroy(struct Qdisc_class_hash *);
int dev_qdisc_change_tx_queue_len(struct net_device *dev);
+void dev_qdisc_change_real_num_tx(struct net_device *dev,
+ unsigned int new_real_tx);
void dev_init_scheduler(struct net_device *dev);
void dev_shutdown(struct net_device *dev);
void dev_activate(struct net_device *dev);
diff --git a/net/core/dev.c b/net/core/dev.c
index 397bc2f50de08..2519a90a14827 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2648,6 +2648,8 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
if (dev->num_tc)
netif_setup_tc(dev, txq);
+ dev_qdisc_change_real_num_tx(dev, txq);
+
dev->real_num_tx_queues = txq;
if (disabling) {
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 4e15913e7519e..2128b77d5cb33 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -1256,6 +1256,15 @@ static int qdisc_change_tx_queue_len(struct net_device *dev,
return 0;
}
+void dev_qdisc_change_real_num_tx(struct net_device *dev,
+ unsigned int new_real_tx)
+{
+ struct Qdisc *qdisc = dev->qdisc;
+
+ if (qdisc->ops->change_real_num_tx)
+ qdisc->ops->change_real_num_tx(qdisc, new_real_tx);
+}
+
int dev_qdisc_change_tx_queue_len(struct net_device *dev)
{
bool up = dev->flags & IFF_UP;
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index c008a316e9436..699b6bb444cea 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -130,6 +130,29 @@ static void mq_attach(struct Qdisc *sch)
priv->qdiscs = NULL;
}
+static void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx)
+{
+#ifdef CONFIG_NET_SCHED
+ struct net_device *dev = qdisc_dev(sch);
+ struct Qdisc *qdisc;
+ unsigned int i;
+
+ for (i = new_real_tx; i < dev->real_num_tx_queues; i++) {
+ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
+ /* Only update the default qdiscs we created,
+ * qdiscs with handles are always hashed.
+ */
+ if (qdisc != &noop_qdisc && !qdisc->handle)
+ qdisc_hash_del(qdisc);
+ }
+ for (i = dev->real_num_tx_queues; i < new_real_tx; i++) {
+ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
+ if (qdisc != &noop_qdisc && !qdisc->handle)
+ qdisc_hash_add(qdisc, false);
+ }
+#endif
+}
+
static int mq_dump(struct Qdisc *sch, struct sk_buff *skb)
{
struct net_device *dev = qdisc_dev(sch);
@@ -285,6 +308,7 @@ struct Qdisc_ops mq_qdisc_ops __read_mostly = {
.init = mq_init,
.destroy = mq_destroy,
.attach = mq_attach,
+ .change_real_num_tx = mq_change_real_num_tx,
.dump = mq_dump,
.owner = THIS_MODULE,
};
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index fcfe41a954733..3fd0e5dd7ae3e 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -308,6 +308,28 @@ static void mqprio_attach(struct Qdisc *sch)
priv->qdiscs = NULL;
}
+static void mqprio_change_real_num_tx(struct Qdisc *sch,
+ unsigned int new_real_tx)
+{
+ struct net_device *dev = qdisc_dev(sch);
+ struct Qdisc *qdisc;
+ unsigned int i;
+
+ for (i = new_real_tx; i < dev->real_num_tx_queues; i++) {
+ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
+ /* Only update the default qdiscs we created,
+ * qdiscs with handles are always hashed.
+ */
+ if (qdisc != &noop_qdisc && !qdisc->handle)
+ qdisc_hash_del(qdisc);
+ }
+ for (i = dev->real_num_tx_queues; i < new_real_tx; i++) {
+ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
+ if (qdisc != &noop_qdisc && !qdisc->handle)
+ qdisc_hash_add(qdisc, false);
+ }
+}
+
static struct netdev_queue *mqprio_queue_get(struct Qdisc *sch,
unsigned long cl)
{
@@ -632,6 +654,7 @@ static struct Qdisc_ops mqprio_qdisc_ops __read_mostly = {
.init = mqprio_init,
.destroy = mqprio_destroy,
.attach = mqprio_attach,
+ .change_real_num_tx = mqprio_change_real_num_tx,
.dump = mqprio_dump,
.owner = THIS_MODULE,
};
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 090/323] smackfs: Fix use-after-free in netlbl_catmap_walk()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 089/323] net: sched: update default qdisc visibility after Tx queue cnt changes Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 091/323] x86: Increase exception stack sizes Greg Kroah-Hartman
` (236 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+3f91de0b813cc3d19a80,
Pawan Gupta, Casey Schaufler, Sasha Levin
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
[ Upstream commit 0817534ff9ea809fac1322c5c8c574be8483ea57 ]
Syzkaller reported use-after-free bug as described in [1]. The bug is
triggered when smk_set_cipso() tries to free stale category bitmaps
while there are concurrent reader(s) using the same bitmaps.
Wait for RCU grace period to finish before freeing the category bitmaps
in smk_set_cipso(). This makes sure that there are no more readers using
the stale bitmaps and freeing them should be safe.
[1] https://lore.kernel.org/netdev/000000000000a814c505ca657a4e@google.com/
Reported-by: syzbot+3f91de0b813cc3d19a80@syzkaller.appspotmail.com
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smackfs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 009e83ee2d002..25705a72d31bc 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -859,6 +859,7 @@ static int smk_open_cipso(struct inode *inode, struct file *file)
static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
size_t count, loff_t *ppos, int format)
{
+ struct netlbl_lsm_catmap *old_cat;
struct smack_known *skp;
struct netlbl_lsm_secattr ncats;
char mapcatset[SMK_CIPSOLEN];
@@ -948,9 +949,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
if (rc >= 0) {
- netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat);
+ old_cat = skp->smk_netlabel.attr.mls.cat;
skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
+ synchronize_rcu();
+ netlbl_catmap_free(old_cat);
rc = count;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 091/323] x86: Increase exception stack sizes
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 090/323] smackfs: Fix use-after-free in netlbl_catmap_walk() Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 092/323] mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type Greg Kroah-Hartman
` (235 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Wang, Peter Zijlstra (Intel),
Sasha Levin
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit 7fae4c24a2b84a66c7be399727aca11e7a888462 ]
It turns out that a single page of stack is trivial to overflow with
all the tracing gunk enabled. Raise the exception stacks to 2 pages,
which is still half the interrupt stacks, which are at 4 pages.
Reported-by: Michael Wang <yun.wang@linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/YUIO9Ye98S5Eb68w@hirez.programming.kicks-ass.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/page_64_types.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
index 0b6352aabbd3d..b16fb3e185134 100644
--- a/arch/x86/include/asm/page_64_types.h
+++ b/arch/x86/include/asm/page_64_types.h
@@ -20,7 +20,7 @@
#define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER)
#define CURRENT_MASK (~(THREAD_SIZE - 1))
-#define EXCEPTION_STACK_ORDER (0 + KASAN_STACK_ORDER)
+#define EXCEPTION_STACK_ORDER (1 + KASAN_STACK_ORDER)
#define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER)
#define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 092/323] mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 091/323] x86: Increase exception stack sizes Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 093/323] mwifiex: Properly initialize private structure on interface type changes Greg Kroah-Hartman
` (234 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonas Dreßler, Kalle Valo, Sasha Levin
From: Jonas Dreßler <verdre@v0yd.nl>
[ Upstream commit c2e9666cdffd347460a2b17988db4cfaf2a68fb9 ]
We currently handle changing from the P2P to the STATION virtual
interface type slightly different than changing from P2P to ADHOC: When
changing to STATION, we don't send the SET_BSS_MODE command. We do send
that command on all other type-changes though, and it probably makes
sense to send the command since after all we just changed our BSS_MODE.
Looking at prior changes to this part of the code, it seems that this is
simply a leftover from old refactorings.
Since sending the SET_BSS_MODE command is the only difference between
mwifiex_change_vif_to_sta_adhoc() and the current code, we can now use
mwifiex_change_vif_to_sta_adhoc() for both switching to ADHOC and
STATION interface type.
This does not fix any particular bug and just "looked right", so there's
a small chance it might be a regression.
Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210914195909.36035-4-verdre@v0yd.nl
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/marvell/mwifiex/cfg80211.c | 22 ++++---------------
1 file changed, 4 insertions(+), 18 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 650191db25cbe..becde7c254de2 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -1233,29 +1233,15 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
break;
case NL80211_IFTYPE_P2P_CLIENT:
case NL80211_IFTYPE_P2P_GO:
+ if (mwifiex_cfg80211_deinit_p2p(priv))
+ return -EFAULT;
+
switch (type) {
- case NL80211_IFTYPE_STATION:
- if (mwifiex_cfg80211_deinit_p2p(priv))
- return -EFAULT;
- priv->adapter->curr_iface_comb.p2p_intf--;
- priv->adapter->curr_iface_comb.sta_intf++;
- dev->ieee80211_ptr->iftype = type;
- if (mwifiex_deinit_priv_params(priv))
- return -1;
- if (mwifiex_init_new_priv_params(priv, dev, type))
- return -1;
- if (mwifiex_sta_init_cmd(priv, false, false))
- return -1;
- break;
case NL80211_IFTYPE_ADHOC:
- if (mwifiex_cfg80211_deinit_p2p(priv))
- return -EFAULT;
+ case NL80211_IFTYPE_STATION:
return mwifiex_change_vif_to_sta_adhoc(dev, curr_iftype,
type, params);
- break;
case NL80211_IFTYPE_AP:
- if (mwifiex_cfg80211_deinit_p2p(priv))
- return -EFAULT;
return mwifiex_change_vif_to_ap(dev, curr_iftype, type,
params);
case NL80211_IFTYPE_UNSPECIFIED:
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 093/323] mwifiex: Properly initialize private structure on interface type changes
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 092/323] mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 094/323] media: mt9p031: Fix corrupted frame after restarting stream Greg Kroah-Hartman
` (233 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonas Dreßler, Kalle Valo, Sasha Levin
From: Jonas Dreßler <verdre@v0yd.nl>
[ Upstream commit c606008b70627a2fc485732a53cc22f0f66d0981 ]
When creating a new virtual interface in mwifiex_add_virtual_intf(), we
update our internal driver states like bss_type, bss_priority, bss_role
and bss_mode to reflect the mode the firmware will be set to.
When switching virtual interface mode using
mwifiex_init_new_priv_params() though, we currently only update bss_mode
and bss_role. In order for the interface mode switch to actually work,
we also need to update bss_type to its proper value, so do that.
This fixes a crash of the firmware (because the driver tries to execute
commands that are invalid in AP mode) when switching from station mode
to AP mode.
Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210914195909.36035-9-verdre@v0yd.nl
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index becde7c254de2..892247145f428 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -912,16 +912,20 @@ mwifiex_init_new_priv_params(struct mwifiex_private *priv,
switch (type) {
case NL80211_IFTYPE_STATION:
case NL80211_IFTYPE_ADHOC:
- priv->bss_role = MWIFIEX_BSS_ROLE_STA;
+ priv->bss_role = MWIFIEX_BSS_ROLE_STA;
+ priv->bss_type = MWIFIEX_BSS_TYPE_STA;
break;
case NL80211_IFTYPE_P2P_CLIENT:
- priv->bss_role = MWIFIEX_BSS_ROLE_STA;
+ priv->bss_role = MWIFIEX_BSS_ROLE_STA;
+ priv->bss_type = MWIFIEX_BSS_TYPE_P2P;
break;
case NL80211_IFTYPE_P2P_GO:
- priv->bss_role = MWIFIEX_BSS_ROLE_UAP;
+ priv->bss_role = MWIFIEX_BSS_ROLE_UAP;
+ priv->bss_type = MWIFIEX_BSS_TYPE_P2P;
break;
case NL80211_IFTYPE_AP:
priv->bss_role = MWIFIEX_BSS_ROLE_UAP;
+ priv->bss_type = MWIFIEX_BSS_TYPE_UAP;
break;
default:
mwifiex_dbg(adapter, ERROR,
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 094/323] media: mt9p031: Fix corrupted frame after restarting stream
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 093/323] mwifiex: Properly initialize private structure on interface type changes Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 095/323] media: netup_unidvb: handle interrupt properly according to the firmware Greg Kroah-Hartman
` (232 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dirk Bender, Stefan Riedmueller,
Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
From: Dirk Bender <d.bender@phytec.de>
[ Upstream commit 0961ba6dd211a4a52d1dd4c2d59be60ac2dc08c7 ]
To prevent corrupted frames after starting and stopping the sensor its
datasheet specifies a specific pause sequence to follow:
Stopping:
Set Pause_Restart Bit -> Set Restart Bit -> Set Chip_Enable Off
Restarting:
Set Chip_Enable On -> Clear Pause_Restart Bit
The Restart Bit is cleared automatically and must not be cleared
manually as this would cause undefined behavior.
Signed-off-by: Dirk Bender <d.bender@phytec.de>
Signed-off-by: Stefan Riedmueller <s.riedmueller@phytec.de>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/mt9p031.c | 28 +++++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
index 715be3632b01a..eb08acf43e3a2 100644
--- a/drivers/media/i2c/mt9p031.c
+++ b/drivers/media/i2c/mt9p031.c
@@ -81,7 +81,9 @@
#define MT9P031_PIXEL_CLOCK_INVERT (1 << 15)
#define MT9P031_PIXEL_CLOCK_SHIFT(n) ((n) << 8)
#define MT9P031_PIXEL_CLOCK_DIVIDE(n) ((n) << 0)
-#define MT9P031_FRAME_RESTART 0x0b
+#define MT9P031_RESTART 0x0b
+#define MT9P031_FRAME_PAUSE_RESTART (1 << 1)
+#define MT9P031_FRAME_RESTART (1 << 0)
#define MT9P031_SHUTTER_DELAY 0x0c
#define MT9P031_RST 0x0d
#define MT9P031_RST_ENABLE 1
@@ -448,9 +450,23 @@ static int mt9p031_set_params(struct mt9p031 *mt9p031)
static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable)
{
struct mt9p031 *mt9p031 = to_mt9p031(subdev);
+ struct i2c_client *client = v4l2_get_subdevdata(subdev);
+ int val;
int ret;
if (!enable) {
+ /* enable pause restart */
+ val = MT9P031_FRAME_PAUSE_RESTART;
+ ret = mt9p031_write(client, MT9P031_RESTART, val);
+ if (ret < 0)
+ return ret;
+
+ /* enable restart + keep pause restart set */
+ val |= MT9P031_FRAME_RESTART;
+ ret = mt9p031_write(client, MT9P031_RESTART, val);
+ if (ret < 0)
+ return ret;
+
/* Stop sensor readout */
ret = mt9p031_set_output_control(mt9p031,
MT9P031_OUTPUT_CONTROL_CEN, 0);
@@ -470,6 +486,16 @@ static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable)
if (ret < 0)
return ret;
+ /*
+ * - clear pause restart
+ * - don't clear restart as clearing restart manually can cause
+ * undefined behavior
+ */
+ val = MT9P031_FRAME_RESTART;
+ ret = mt9p031_write(client, MT9P031_RESTART, val);
+ if (ret < 0)
+ return ret;
+
return mt9p031_pll_enable(mt9p031);
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 095/323] media: netup_unidvb: handle interrupt properly according to the firmware
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 094/323] media: mt9p031: Fix corrupted frame after restarting stream Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 096/323] media: uvcvideo: Set capability in s_param Greg Kroah-Hartman
` (231 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zheyu Ma, Sean Young,
Mauro Carvalho Chehab, Sasha Levin
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit dbb4cfea6efe979ed153bd59a6a527a90d3d0ab3 ]
The interrupt handling should be related to the firmware version. If
the driver matches an old firmware, then the driver should not handle
interrupt such as i2c or dma, otherwise it will cause some errors.
This log reveals it:
[ 27.708641] INFO: trying to register non-static key.
[ 27.710851] The code is fine but needs lockdep annotation, or maybe
[ 27.712010] you didn't initialize this object before use?
[ 27.712396] turning off the locking correctness validator.
[ 27.712787] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.12.4-g70e7f0549188-dirty #169
[ 27.713349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 27.714149] Call Trace:
[ 27.714329] <IRQ>
[ 27.714480] dump_stack+0xba/0xf5
[ 27.714737] register_lock_class+0x873/0x8f0
[ 27.715052] ? __lock_acquire+0x323/0x1930
[ 27.715353] __lock_acquire+0x75/0x1930
[ 27.715636] lock_acquire+0x1dd/0x3e0
[ 27.715905] ? netup_i2c_interrupt+0x19/0x310
[ 27.716226] _raw_spin_lock_irqsave+0x4b/0x60
[ 27.716544] ? netup_i2c_interrupt+0x19/0x310
[ 27.716863] netup_i2c_interrupt+0x19/0x310
[ 27.717178] netup_unidvb_isr+0xd3/0x160
[ 27.717467] __handle_irq_event_percpu+0x53/0x3e0
[ 27.717808] handle_irq_event_percpu+0x35/0x90
[ 27.718129] handle_irq_event+0x39/0x60
[ 27.718409] handle_fasteoi_irq+0xc2/0x1d0
[ 27.718707] __common_interrupt+0x7f/0x150
[ 27.719008] common_interrupt+0xb4/0xd0
[ 27.719289] </IRQ>
[ 27.719446] asm_common_interrupt+0x1e/0x40
[ 27.719747] RIP: 0010:native_safe_halt+0x17/0x20
[ 27.720084] Code: 07 0f 00 2d 8b ee 4c 00 f4 5d c3 0f 1f 84 00 00 00 00 00 8b 05 72 95 17 02 55 48 89 e5 85 c0 7e 07 0f 00 2d 6b ee 4c 00 fb f4 <5d> c3 cc cc cc cc cc cc cc 55 48 89 e5 e8 67 53 ff ff 8b 0d 29 f6
[ 27.721386] RSP: 0018:ffffc9000008fe90 EFLAGS: 00000246
[ 27.721758] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000
[ 27.722262] RDX: 0000000000000000 RSI: ffffffff85f7c054 RDI: ffffffff85ded4e6
[ 27.722770] RBP: ffffc9000008fe90 R08: 0000000000000001 R09: 0000000000000001
[ 27.723277] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff86a75408
[ 27.723781] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888100260000
[ 27.724289] default_idle+0x9/0x10
[ 27.724537] arch_cpu_idle+0xa/0x10
[ 27.724791] default_idle_call+0x6e/0x250
[ 27.725082] do_idle+0x1f0/0x2d0
[ 27.725326] cpu_startup_entry+0x18/0x20
[ 27.725613] start_secondary+0x11f/0x160
[ 27.725902] secondary_startup_64_no_verify+0xb0/0xbb
[ 27.726272] BUG: kernel NULL pointer dereference, address: 0000000000000002
[ 27.726768] #PF: supervisor read access in kernel mode
[ 27.727138] #PF: error_code(0x0000) - not-present page
[ 27.727507] PGD 8000000118688067 P4D 8000000118688067 PUD 10feab067 PMD 0
[ 27.727999] Oops: 0000 [#1] PREEMPT SMP PTI
[ 27.728302] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.12.4-g70e7f0549188-dirty #169
[ 27.728861] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 27.729660] RIP: 0010:netup_i2c_interrupt+0x23/0x310
[ 27.730019] Code: 0f 1f 80 00 00 00 00 55 48 89 e5 41 55 41 54 53 48 89 fb e8 af 6e 95 fd 48 89 df e8 e7 9f 1c 01 49 89 c5 48 8b 83 48 08 00 00 <66> 44 8b 60 02 44 89 e0 48 8b 93 48 08 00 00 83 e0 f8 66 89 42 02
[ 27.731339] RSP: 0018:ffffc90000118e90 EFLAGS: 00010046
[ 27.731716] RAX: 0000000000000000 RBX: ffff88810803c4d8 RCX: 0000000000000000
[ 27.732223] RDX: 0000000000000001 RSI: ffffffff85d37b94 RDI: ffff88810803c4d8
[ 27.732727] RBP: ffffc90000118ea8 R08: 0000000000000000 R09: 0000000000000001
[ 27.733239] R10: ffff88810803c4f0 R11: 61646e6f63657320 R12: 0000000000000000
[ 27.733745] R13: 0000000000000046 R14: ffff888101041000 R15: ffff8881081b2400
[ 27.734251] FS: 0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000
[ 27.734821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 27.735228] CR2: 0000000000000002 CR3: 0000000108194000 CR4: 00000000000006e0
[ 27.735735] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 27.736241] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 27.736744] Call Trace:
[ 27.736924] <IRQ>
[ 27.737074] netup_unidvb_isr+0xd3/0x160
[ 27.737363] __handle_irq_event_percpu+0x53/0x3e0
[ 27.737706] handle_irq_event_percpu+0x35/0x90
[ 27.738028] handle_irq_event+0x39/0x60
[ 27.738306] handle_fasteoi_irq+0xc2/0x1d0
[ 27.738602] __common_interrupt+0x7f/0x150
[ 27.738899] common_interrupt+0xb4/0xd0
[ 27.739176] </IRQ>
[ 27.739331] asm_common_interrupt+0x1e/0x40
[ 27.739633] RIP: 0010:native_safe_halt+0x17/0x20
[ 27.739967] Code: 07 0f 00 2d 8b ee 4c 00 f4 5d c3 0f 1f 84 00 00 00 00 00 8b 05 72 95 17 02 55 48 89 e5 85 c0 7e 07 0f 00 2d 6b ee 4c 00 fb f4 <5d> c3 cc cc cc cc cc cc cc 55 48 89 e5 e8 67 53 ff ff 8b 0d 29 f6
[ 27.741275] RSP: 0018:ffffc9000008fe90 EFLAGS: 00000246
[ 27.741647] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000
[ 27.742148] RDX: 0000000000000000 RSI: ffffffff85f7c054 RDI: ffffffff85ded4e6
[ 27.742652] RBP: ffffc9000008fe90 R08: 0000000000000001 R09: 0000000000000001
[ 27.743154] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff86a75408
[ 27.743652] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888100260000
[ 27.744157] default_idle+0x9/0x10
[ 27.744405] arch_cpu_idle+0xa/0x10
[ 27.744658] default_idle_call+0x6e/0x250
[ 27.744948] do_idle+0x1f0/0x2d0
[ 27.745190] cpu_startup_entry+0x18/0x20
[ 27.745475] start_secondary+0x11f/0x160
[ 27.745761] secondary_startup_64_no_verify+0xb0/0xbb
[ 27.746123] Modules linked in:
[ 27.746348] Dumping ftrace buffer:
[ 27.746596] (ftrace buffer empty)
[ 27.746852] CR2: 0000000000000002
[ 27.747094] ---[ end trace ebafd46f83ab946d ]---
[ 27.747424] RIP: 0010:netup_i2c_interrupt+0x23/0x310
[ 27.747778] Code: 0f 1f 80 00 00 00 00 55 48 89 e5 41 55 41 54 53 48 89 fb e8 af 6e 95 fd 48 89 df e8 e7 9f 1c 01 49 89 c5 48 8b 83 48 08 00 00 <66> 44 8b 60 02 44 89 e0 48 8b 93 48 08 00 00 83 e0 f8 66 89 42 02
[ 27.749082] RSP: 0018:ffffc90000118e90 EFLAGS: 00010046
[ 27.749461] RAX: 0000000000000000 RBX: ffff88810803c4d8 RCX: 0000000000000000
[ 27.749966] RDX: 0000000000000001 RSI: ffffffff85d37b94 RDI: ffff88810803c4d8
[ 27.750471] RBP: ffffc90000118ea8 R08: 0000000000000000 R09: 0000000000000001
[ 27.750976] R10: ffff88810803c4f0 R11: 61646e6f63657320 R12: 0000000000000000
[ 27.751480] R13: 0000000000000046 R14: ffff888101041000 R15: ffff8881081b2400
[ 27.751986] FS: 0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000
[ 27.752560] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 27.752970] CR2: 0000000000000002 CR3: 0000000108194000 CR4: 00000000000006e0
[ 27.753481] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 27.753984] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 27.754487] Kernel panic - not syncing: Fatal exception in interrupt
[ 27.755033] Dumping ftrace buffer:
[ 27.755279] (ftrace buffer empty)
[ 27.755534] Kernel Offset: disabled
[ 27.755785] Rebooting in 1 seconds..
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../pci/netup_unidvb/netup_unidvb_core.c | 27 +++++++++++--------
1 file changed, 16 insertions(+), 11 deletions(-)
diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
index ead59fabd15ff..de3fc62810e6c 100644
--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
@@ -267,19 +267,24 @@ static irqreturn_t netup_unidvb_isr(int irq, void *dev_id)
if ((reg40 & AVL_IRQ_ASSERTED) != 0) {
/* IRQ is being signaled */
reg_isr = readw(ndev->bmmio0 + REG_ISR);
- if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) {
- iret = netup_i2c_interrupt(&ndev->i2c[0]);
- } else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) {
- iret = netup_i2c_interrupt(&ndev->i2c[1]);
- } else if (reg_isr & NETUP_UNIDVB_IRQ_SPI) {
+ if (reg_isr & NETUP_UNIDVB_IRQ_SPI)
iret = netup_spi_interrupt(ndev->spi);
- } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) {
- iret = netup_dma_interrupt(&ndev->dma[0]);
- } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) {
- iret = netup_dma_interrupt(&ndev->dma[1]);
- } else if (reg_isr & NETUP_UNIDVB_IRQ_CI) {
- iret = netup_ci_interrupt(ndev);
+ else if (!ndev->old_fw) {
+ if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) {
+ iret = netup_i2c_interrupt(&ndev->i2c[0]);
+ } else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) {
+ iret = netup_i2c_interrupt(&ndev->i2c[1]);
+ } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) {
+ iret = netup_dma_interrupt(&ndev->dma[0]);
+ } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) {
+ iret = netup_dma_interrupt(&ndev->dma[1]);
+ } else if (reg_isr & NETUP_UNIDVB_IRQ_CI) {
+ iret = netup_ci_interrupt(ndev);
+ } else {
+ goto err;
+ }
} else {
+err:
dev_err(&pci_dev->dev,
"%s(): unknown interrupt 0x%x\n",
__func__, reg_isr);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 096/323] media: uvcvideo: Set capability in s_param
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 095/323] media: netup_unidvb: handle interrupt properly according to the firmware Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 097/323] media: uvcvideo: Return -EIO for control errors Greg Kroah-Hartman
` (230 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Ricardo Ribalda,
Laurent Pinchart, Mauro Carvalho Chehab, Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 97a2777a96070afb7da5d587834086c0b586c8cc ]
Fixes v4l2-compliance:
Format ioctls (Input 0):
warn: v4l2-test-formats.cpp(1339): S_PARM is supported but doesn't report V4L2_CAP_TIMEPERFRAME
fail: v4l2-test-formats.cpp(1241): node->has_frmintervals && !cap->capability
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_v4l2.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 2ca1e8ce6159d..e858f4f189ed9 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -474,10 +474,13 @@ static int uvc_v4l2_set_streamparm(struct uvc_streaming *stream,
uvc_simplify_fraction(&timeperframe.numerator,
&timeperframe.denominator, 8, 333);
- if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+ if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
parm->parm.capture.timeperframe = timeperframe;
- else
+ parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME;
+ } else {
parm->parm.output.timeperframe = timeperframe;
+ parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
+ }
return 0;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 097/323] media: uvcvideo: Return -EIO for control errors
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 096/323] media: uvcvideo: Set capability in s_param Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 098/323] media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() Greg Kroah-Hartman
` (229 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Ricardo Ribalda,
Laurent Pinchart, Mauro Carvalho Chehab, Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit ffccdde5f0e17d2f0d788a9d831a027187890eaa ]
The device is doing something unexpected with the control. Either because
the protocol is not properly implemented or there has been a HW error.
Fixes v4l2-compliance:
Control ioctls (Input 0):
fail: v4l2-test-controls.cpp(448): s_ctrl returned an error (22)
test VIDIOC_G/S_CTRL: FAIL
fail: v4l2-test-controls.cpp(698): s_ext_ctrls returned an error (22)
test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_video.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 56b058d60a0dc..9c26e586bb01d 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -117,6 +117,11 @@ int uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit,
case 5: /* Invalid unit */
case 6: /* Invalid control */
case 7: /* Invalid Request */
+ /*
+ * The firmware has not properly implemented
+ * the control or there has been a HW error.
+ */
+ return -EIO;
case 8: /* Invalid value within range */
return -EINVAL;
default: /* reserved or unknown */
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 098/323] media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 097/323] media: uvcvideo: Return -EIO for control errors Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 099/323] media: s5p-mfc: Add checking to s5p_mfc_probe() Greg Kroah-Hartman
` (228 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, TOTE Robot, Tuo Li, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Tuo Li <islituo@gmail.com>
[ Upstream commit 8515965e5e33f4feb56134348c95953f3eadfb26 ]
The variable pdev is assigned to dev->plat_dev, and dev->plat_dev is
checked in:
if (!dev->plat_dev)
This indicates both dev->plat_dev and pdev can be NULL. If so, the
function dev_err() is called to print error information.
dev_err(&pdev->dev, "No platform data specified\n");
However, &pdev->dev is an illegal address, and it is dereferenced in
dev_err().
To fix this possible null-pointer dereference, replace dev_err() with
mfc_err().
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/s5p-mfc/s5p_mfc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 4b8516c35bc20..80bb58d31c3f6 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -1276,7 +1276,7 @@ static int s5p_mfc_probe(struct platform_device *pdev)
spin_lock_init(&dev->condlock);
dev->plat_dev = pdev;
if (!dev->plat_dev) {
- dev_err(&pdev->dev, "No platform data specified\n");
+ mfc_err("No platform data specified\n");
return -ENODEV;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 099/323] media: s5p-mfc: Add checking to s5p_mfc_probe().
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 098/323] media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 100/323] media: mceusb: return without resubmitting URB in case of -EPROTO error Greg Kroah-Hartman
` (227 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nadezda Lutovinova, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Nadezda Lutovinova <lutovinova@ispras.ru>
[ Upstream commit cdfaf4752e6915a4b455ad4400133e540e4dc965 ]
If of_device_get_match_data() return NULL,
then null pointer dereference occurs in s5p_mfc_init_pm().
The patch adds checking if dev->variant is NULL.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/s5p-mfc/s5p_mfc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 80bb58d31c3f6..0fc101bc58d67 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -1281,6 +1281,10 @@ static int s5p_mfc_probe(struct platform_device *pdev)
}
dev->variant = of_device_get_match_data(&pdev->dev);
+ if (!dev->variant) {
+ dev_err(&pdev->dev, "Failed to get device MFC hardware variant information\n");
+ return -ENOENT;
+ }
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
dev->regs_base = devm_ioremap_resource(&pdev->dev, res);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 100/323] media: mceusb: return without resubmitting URB in case of -EPROTO error.
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 099/323] media: s5p-mfc: Add checking to s5p_mfc_probe() Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 101/323] ia64: dont do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK Greg Kroah-Hartman
` (226 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+4d3749e9612c2cfab956,
Rajat Asthana, Sean Young, Mauro Carvalho Chehab, Sasha Levin
From: Rajat Asthana <rajatasthana4@gmail.com>
[ Upstream commit 476db72e521983ecb847e4013b263072bb1110fc ]
Syzkaller reported a warning called "rcu detected stall in dummy_timer".
The error seems to be an error in mceusb_dev_recv(). In the case of
-EPROTO error, the routine immediately resubmits the URB. Instead it
should return without resubmitting URB.
Reported-by: syzbot+4d3749e9612c2cfab956@syzkaller.appspotmail.com
Signed-off-by: Rajat Asthana <rajatasthana4@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/mceusb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 845583e2af4d5..cf4bcf7c62f2e 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -1323,6 +1323,7 @@ static void mceusb_dev_recv(struct urb *urb)
case -ECONNRESET:
case -ENOENT:
case -EILSEQ:
+ case -EPROTO:
case -ESHUTDOWN:
usb_unlink_urb(urb);
return;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 101/323] ia64: dont do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 100/323] media: mceusb: return without resubmitting URB in case of -EPROTO error Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 102/323] media: rcar-csi2: Add checking to rcsi2_start_receiver() Greg Kroah-Hartman
` (225 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, linux-ia64, Andrew Morton, Tony Luck,
Chris Down, Paul Gortmaker, John Paul Adrian Glaubitz,
Randy Dunlap, Petr Mladek, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit c15b5fc054c3d6c97e953617605235c5cb8ce979 ]
When CONFIG_PRINTK is not set, the CMPXCHG_BUGCHECK() macro calls
_printk(), but _printk() is a static inline function, not available
as an extern.
Since the purpose of the macro is to print the BUGCHECK info,
make this config option depend on PRINTK.
Fixes multiple occurrences of this build error:
../include/linux/printk.h:208:5: error: static declaration of '_printk' follows non-static declaration
208 | int _printk(const char *s, ...)
| ^~~~~~~
In file included from ../arch/ia64/include/asm/cmpxchg.h:5,
../arch/ia64/include/uapi/asm/cmpxchg.h:146:28: note: previous declaration of '_printk' with type 'int(const char *, ...)'
146 | extern int _printk(const char *fmt, ...);
Cc: linux-ia64@vger.kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Chris Down <chris@chrisdown.name>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/ia64/Kconfig.debug | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/ia64/Kconfig.debug b/arch/ia64/Kconfig.debug
index 1371efc9b0055..637ac79c29b6d 100644
--- a/arch/ia64/Kconfig.debug
+++ b/arch/ia64/Kconfig.debug
@@ -39,7 +39,7 @@ config DISABLE_VHPT
config IA64_DEBUG_CMPXCHG
bool "Turn on compare-and-exchange bug checking (slow!)"
- depends on DEBUG_KERNEL
+ depends on DEBUG_KERNEL && PRINTK
help
Selecting this option turns on bug checking for the IA-64
compare-and-exchange instructions. This is slow! Itaniums
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 102/323] media: rcar-csi2: Add checking to rcsi2_start_receiver()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 101/323] ia64: dont do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 103/323] ACPICA: Avoid evaluating methods too early during system resume Greg Kroah-Hartman
` (224 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nadezda Lutovinova, Jacopo Mondi,
Niklas Söderlund, Hans Verkuil, Mauro Carvalho Chehab,
Sasha Levin
From: Nadezda Lutovinova <lutovinova@ispras.ru>
[ Upstream commit fc41665498332ad394b7db37f23e9394096ddc71 ]
If rcsi2_code_to_fmt() return NULL, then null pointer dereference occurs
in the next cycle. That should not be possible now but adding checking
protects from future bugs.
The patch adds checking if format is NULL.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rcar-vin/rcar-csi2.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c
index dc5ae8025832a..23f55514b002a 100644
--- a/drivers/media/platform/rcar-vin/rcar-csi2.c
+++ b/drivers/media/platform/rcar-vin/rcar-csi2.c
@@ -474,6 +474,8 @@ static int rcsi2_start(struct rcar_csi2 *priv)
/* Code is validated in set_fmt. */
format = rcsi2_code_to_fmt(priv->mf.code);
+ if (!format)
+ return -EINVAL;
/*
* Enable all Virtual Channels.
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 103/323] ACPICA: Avoid evaluating methods too early during system resume
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 102/323] media: rcar-csi2: Add checking to rcsi2_start_receiver() Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 104/323] media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() Greg Kroah-Hartman
` (223 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Reik Keutterling, Rafael J. Wysocki,
Sasha Levin
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit d3c4b6f64ad356c0d9ddbcf73fa471e6a841cc5c ]
ACPICA commit 0762982923f95eb652cf7ded27356b247c9774de
During wakeup from system-wide sleep states, acpi_get_sleep_type_data()
is called and it tries to get memory from the slab allocator in order
to evaluate a control method, but if KFENCE is enabled in the kernel,
the memory allocation attempt causes an IRQ work to be queued and a
self-IPI to be sent to the CPU running the code which requires the
memory controller to be ready, so if that happens too early in the
wakeup path, it doesn't work.
Prevent that from taking place by calling acpi_get_sleep_type_data()
for S0 upfront, when preparing to enter a given sleep state, and
saving the data obtained by it for later use during system wakeup.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214271
Reported-by: Reik Keutterling <spielkind@gmail.com>
Tested-by: Reik Keutterling <spielkind@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/acglobal.h | 2 ++
drivers/acpi/acpica/hwesleep.c | 8 ++------
drivers/acpi/acpica/hwsleep.c | 11 ++++-------
drivers/acpi/acpica/hwxfsleep.c | 7 +++++++
4 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h
index 1e6204518496c..38712fa4dd9d2 100644
--- a/drivers/acpi/acpica/acglobal.h
+++ b/drivers/acpi/acpica/acglobal.h
@@ -224,6 +224,8 @@ extern struct acpi_bit_register_info
acpi_gbl_bit_register_info[ACPI_NUM_BITREG];
ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a);
ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b);
+ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a_s0);
+ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b_s0);
/*****************************************************************************
*
diff --git a/drivers/acpi/acpica/hwesleep.c b/drivers/acpi/acpica/hwesleep.c
index e0ad3f11142e4..9516966124ae3 100644
--- a/drivers/acpi/acpica/hwesleep.c
+++ b/drivers/acpi/acpica/hwesleep.c
@@ -147,17 +147,13 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state)
acpi_status acpi_hw_extended_wake_prep(u8 sleep_state)
{
- acpi_status status;
u8 sleep_type_value;
ACPI_FUNCTION_TRACE(hw_extended_wake_prep);
- status = acpi_get_sleep_type_data(ACPI_STATE_S0,
- &acpi_gbl_sleep_type_a,
- &acpi_gbl_sleep_type_b);
- if (ACPI_SUCCESS(status)) {
+ if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) {
sleep_type_value =
- ((acpi_gbl_sleep_type_a << ACPI_X_SLEEP_TYPE_POSITION) &
+ ((acpi_gbl_sleep_type_a_s0 << ACPI_X_SLEEP_TYPE_POSITION) &
ACPI_X_SLEEP_TYPE_MASK);
(void)acpi_write((u64)(sleep_type_value | ACPI_X_SLEEP_ENABLE),
diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c
index d8b8fc2ff5633..f4282370947c8 100644
--- a/drivers/acpi/acpica/hwsleep.c
+++ b/drivers/acpi/acpica/hwsleep.c
@@ -179,7 +179,7 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state)
acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)
{
- acpi_status status;
+ acpi_status status = AE_OK;
struct acpi_bit_register_info *sleep_type_reg_info;
struct acpi_bit_register_info *sleep_enable_reg_info;
u32 pm1a_control;
@@ -192,10 +192,7 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)
* This is unclear from the ACPI Spec, but it is required
* by some machines.
*/
- status = acpi_get_sleep_type_data(ACPI_STATE_S0,
- &acpi_gbl_sleep_type_a,
- &acpi_gbl_sleep_type_b);
- if (ACPI_SUCCESS(status)) {
+ if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) {
sleep_type_reg_info =
acpi_hw_get_bit_register_info(ACPI_BITREG_SLEEP_TYPE);
sleep_enable_reg_info =
@@ -216,9 +213,9 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)
/* Insert the SLP_TYP bits */
- pm1a_control |= (acpi_gbl_sleep_type_a <<
+ pm1a_control |= (acpi_gbl_sleep_type_a_s0 <<
sleep_type_reg_info->bit_position);
- pm1b_control |= (acpi_gbl_sleep_type_b <<
+ pm1b_control |= (acpi_gbl_sleep_type_b_s0 <<
sleep_type_reg_info->bit_position);
/* Write the control registers and ignore any errors */
diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
index 3f22f7dd4556d..dc1e44ccaae20 100644
--- a/drivers/acpi/acpica/hwxfsleep.c
+++ b/drivers/acpi/acpica/hwxfsleep.c
@@ -288,6 +288,13 @@ acpi_status acpi_enter_sleep_state_prep(u8 sleep_state)
return_ACPI_STATUS(status);
}
+ status = acpi_get_sleep_type_data(ACPI_STATE_S0,
+ &acpi_gbl_sleep_type_a_s0,
+ &acpi_gbl_sleep_type_b_s0);
+ if (ACPI_FAILURE(status)) {
+ acpi_gbl_sleep_type_a_s0 = ACPI_SLEEP_TYPE_INVALID;
+ }
+
/* Execute the _PTS method (Prepare To Sleep) */
arg_list.count = 1;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 104/323] media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 103/323] ACPICA: Avoid evaluating methods too early during system resume Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 105/323] tracefs: Have tracefs directories not set OTH permission bits by default Greg Kroah-Hartman
` (222 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+e27b4fd589762b0b9329,
Anant Thazhemadam, Sean Young, Mauro Carvalho Chehab,
Sasha Levin
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
[ Upstream commit 899a61a3305d49e8a712e9ab20d0db94bde5929f ]
In dibusb_read_eeprom_byte(), if dibusb_i2c_msg() fails, val gets
assigned an value that's not properly initialized.
Using kzalloc() in place of kmalloc() for the buffer fixes this issue,
as the val can now be set to 0 in the event dibusb_i2c_msg() fails.
Reported-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com
Tested-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/dibusb-common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
index fb1b4f2d5f9de..85b7838b3ede3 100644
--- a/drivers/media/usb/dvb-usb/dibusb-common.c
+++ b/drivers/media/usb/dvb-usb/dibusb-common.c
@@ -226,7 +226,7 @@ int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val)
u8 *buf;
int rc;
- buf = kmalloc(2, GFP_KERNEL);
+ buf = kzalloc(2, GFP_KERNEL);
if (!buf)
return -ENOMEM;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 105/323] tracefs: Have tracefs directories not set OTH permission bits by default
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 104/323] media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 106/323] ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() Greg Kroah-Hartman
` (221 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Steven Rostedt (VMware), Sasha Levin
From: Steven Rostedt (VMware) <rostedt@goodmis.org>
[ Upstream commit 49d67e445742bbcb03106b735b2ab39f6e5c56bc ]
The tracefs file system is by default mounted such that only root user can
access it. But there are legitimate reasons to create a group and allow
those added to the group to have access to tracing. By changing the
permissions of the tracefs mount point to allow access, it will allow
group access to the tracefs directory.
There should not be any real reason to allow all access to the tracefs
directory as it contains sensitive information. Have the default
permission of directories being created not have any OTH (other) bits set,
such that an admin that wants to give permission to a group has to first
disable all OTH bits in the file system.
Link: https://lkml.kernel.org/r/20210818153038.664127804@goodmis.org
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/tracefs/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index 7098c49f36934..990f794b1dd0a 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c
@@ -427,7 +427,8 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent,
if (unlikely(!inode))
return failed_creating(dentry);
- inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
+ /* Do not set bits for OTH */
+ inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP;
inode->i_op = ops;
inode->i_fop = &simple_dir_operations;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 106/323] ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 105/323] tracefs: Have tracefs directories not set OTH permission bits by default Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 107/323] ACPI: battery: Accept charges over the design capacity as full Greg Kroah-Hartman
` (220 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, TOTE Robot, Tuo Li, Kalle Valo, Sasha Levin
From: Tuo Li <islituo@gmail.com>
[ Upstream commit 4b6012a7830b813799a7faf40daa02a837e0fd5b ]
kzalloc() is used to allocate memory for cd->detectors, and if it fails,
channel_detector_exit() behind the label fail will be called:
channel_detector_exit(dpd, cd);
In channel_detector_exit(), cd->detectors is dereferenced through:
struct pri_detector *de = cd->detectors[i];
To fix this possible null-pointer dereference, check cd->detectors before
the for loop to dereference cd->detectors.
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210805153854.154066-1-islituo@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/dfs_pattern_detector.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
index a274eb0d19688..a0ad6e48a35b4 100644
--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
@@ -182,10 +182,12 @@ static void channel_detector_exit(struct dfs_pattern_detector *dpd,
if (cd == NULL)
return;
list_del(&cd->head);
- for (i = 0; i < dpd->num_radar_types; i++) {
- struct pri_detector *de = cd->detectors[i];
- if (de != NULL)
- de->exit(de);
+ if (cd->detectors) {
+ for (i = 0; i < dpd->num_radar_types; i++) {
+ struct pri_detector *de = cd->detectors[i];
+ if (de != NULL)
+ de->exit(de);
+ }
}
kfree(cd->detectors);
kfree(cd);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 107/323] ACPI: battery: Accept charges over the design capacity as full
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 106/323] ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 108/323] leaking_addresses: Always print a trailing newline Greg Kroah-Hartman
` (219 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, André Almeida, Hans de Goede,
Sebastian Reichel, Rafael J. Wysocki, Sasha Levin
From: André Almeida <andrealmeid@collabora.com>
[ Upstream commit 2835f327bd1240508db2c89fe94a056faa53c49a ]
Some buggy firmware and/or brand new batteries can support a charge that's
slightly over the reported design capacity. In such cases, the kernel will
report to userspace that the charging state of the battery is "Unknown",
when in reality the battery charge is "Full", at least from the design
capacity point of view. Make the fallback condition accepts capacities
over the designed capacity so userspace knows that is full.
Signed-off-by: André Almeida <andrealmeid@collabora.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 674a0e92b798f..0bbf8b453ebf2 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -198,7 +198,7 @@ static int acpi_battery_is_charged(struct acpi_battery *battery)
return 1;
/* fallback to using design values for broken batteries */
- if (battery->design_capacity == battery->capacity_now)
+ if (battery->design_capacity <= battery->capacity_now)
return 1;
/* we don't do any sort of metric based on percentages */
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 108/323] leaking_addresses: Always print a trailing newline
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 107/323] ACPI: battery: Accept charges over the design capacity as full Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 109/323] memstick: r592: Fix a UAF bug when removing the driver Greg Kroah-Hartman
` (218 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kees Cook, Peter Zijlstra (Intel),
Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit cf2a85efdade117e2169d6e26641016cbbf03ef0 ]
For files that lack trailing newlines and match a leaking address (e.g.
wchan[1]), the leaking_addresses.pl report would run together with the
next line, making things look corrupted.
Unconditionally remove the newline on input, and write it back out on
output.
[1] https://lore.kernel.org/all/20210103142726.GC30643@xsang-OptiPlex-9020/
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20211008111626.151570317@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/leaking_addresses.pl | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/scripts/leaking_addresses.pl b/scripts/leaking_addresses.pl
index 6a897788f5a7e..6e4b0f7ae38cf 100755
--- a/scripts/leaking_addresses.pl
+++ b/scripts/leaking_addresses.pl
@@ -456,8 +456,9 @@ sub parse_file
open my $fh, "<", $file or return;
while ( <$fh> ) {
+ chomp;
if (may_leak_address($_)) {
- print $file . ': ' . $_;
+ printf("$file: $_\n");
}
}
close $fh;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 109/323] memstick: r592: Fix a UAF bug when removing the driver
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 108/323] leaking_addresses: Always print a trailing newline Greg Kroah-Hartman
@ 2021-11-24 11:54 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 110/323] lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression Greg Kroah-Hartman
` (217 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zheyu Ma, Ulf Hansson, Sasha Levin
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit 738216c1953e802aa9f930c5d15b8f9092c847ff ]
In r592_remove(), the driver will free dma after freeing the host, which
may cause a UAF bug.
The following log reveals it:
[ 45.361796 ] BUG: KASAN: use-after-free in r592_remove+0x269/0x350 [r592]
[ 45.364286 ] Call Trace:
[ 45.364472 ] dump_stack_lvl+0xa8/0xd1
[ 45.364751 ] print_address_description+0x87/0x3b0
[ 45.365137 ] kasan_report+0x172/0x1c0
[ 45.365415 ] ? r592_remove+0x269/0x350 [r592]
[ 45.365834 ] ? r592_remove+0x269/0x350 [r592]
[ 45.366168 ] __asan_report_load8_noabort+0x14/0x20
[ 45.366531 ] r592_remove+0x269/0x350 [r592]
[ 45.378785 ]
[ 45.378903 ] Allocated by task 4674:
[ 45.379162 ] ____kasan_kmalloc+0xb5/0xe0
[ 45.379455 ] __kasan_kmalloc+0x9/0x10
[ 45.379730 ] __kmalloc+0x150/0x280
[ 45.379984 ] memstick_alloc_host+0x2a/0x190
[ 45.380664 ]
[ 45.380781 ] Freed by task 5509:
[ 45.381014 ] kasan_set_track+0x3d/0x70
[ 45.381293 ] kasan_set_free_info+0x23/0x40
[ 45.381635 ] ____kasan_slab_free+0x10b/0x140
[ 45.381950 ] __kasan_slab_free+0x11/0x20
[ 45.382241 ] slab_free_freelist_hook+0x81/0x150
[ 45.382575 ] kfree+0x13e/0x290
[ 45.382805 ] memstick_free+0x1c/0x20
[ 45.383070 ] device_release+0x9c/0x1d0
[ 45.383349 ] kobject_put+0x2ef/0x4c0
[ 45.383616 ] put_device+0x1f/0x30
[ 45.383865 ] memstick_free_host+0x24/0x30
[ 45.384162 ] r592_remove+0x242/0x350 [r592]
[ 45.384473 ] pci_device_remove+0xa9/0x250
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Link: https://lore.kernel.org/r/1634383581-11055-1-git-send-email-zheyuma97@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memstick/host/r592.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
index 4559593ecd5a9..4728a42d54b88 100644
--- a/drivers/memstick/host/r592.c
+++ b/drivers/memstick/host/r592.c
@@ -840,15 +840,15 @@ static void r592_remove(struct pci_dev *pdev)
}
memstick_remove_host(dev->host);
+ if (dev->dummy_dma_page)
+ dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page,
+ dev->dummy_dma_page_physical_address);
+
free_irq(dev->irq, dev);
iounmap(dev->mmio);
pci_release_regions(pdev);
pci_disable_device(pdev);
memstick_free_host(dev->host);
-
- if (dev->dummy_dma_page)
- dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page,
- dev->dummy_dma_page_physical_address);
}
#ifdef CONFIG_PM_SLEEP
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 110/323] lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2021-11-24 11:54 ` [PATCH 4.19 109/323] memstick: r592: Fix a UAF bug when removing the driver Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 111/323] lib/xz: Validate the value before assigning it to an enum variable Greg Kroah-Hartman
` (216 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lasse Collin, Gao Xiang, Sasha Levin
From: Lasse Collin <lasse.collin@tukaani.org>
[ Upstream commit 83d3c4f22a36d005b55f44628f46cc0d319a75e8 ]
With valid files, the safety margin described in lib/decompress_unxz.c
ensures that these buffers cannot overlap. But if the uncompressed size
of the input is larger than the caller thought, which is possible when
the input file is invalid/corrupt, the buffers can overlap. Obviously
the result will then be garbage (and usually the decoder will return
an error too) but no other harm will happen when such an over-run occurs.
This change only affects uncompressed LZMA2 chunks and so this
should have no effect on performance.
Link: https://lore.kernel.org/r/20211010213145.17462-2-xiang@kernel.org
Signed-off-by: Lasse Collin <lasse.collin@tukaani.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/decompress_unxz.c | 2 +-
lib/xz/xz_dec_lzma2.c | 21 +++++++++++++++++++--
2 files changed, 20 insertions(+), 3 deletions(-)
diff --git a/lib/decompress_unxz.c b/lib/decompress_unxz.c
index 25d59a95bd668..abea25310ac73 100644
--- a/lib/decompress_unxz.c
+++ b/lib/decompress_unxz.c
@@ -167,7 +167,7 @@
* memeq and memzero are not used much and any remotely sane implementation
* is fast enough. memcpy/memmove speed matters in multi-call mode, but
* the kernel image is decompressed in single-call mode, in which only
- * memcpy speed can matter and only if there is a lot of uncompressible data
+ * memmove speed can matter and only if there is a lot of uncompressible data
* (LZMA2 stores uncompressible chunks in uncompressed form). Thus, the
* functions below should just be kept small; it's probably not worth
* optimizing for speed.
diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c
index 08c3c80499983..2c5197d6b944d 100644
--- a/lib/xz/xz_dec_lzma2.c
+++ b/lib/xz/xz_dec_lzma2.c
@@ -387,7 +387,14 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b,
*left -= copy_size;
- memcpy(dict->buf + dict->pos, b->in + b->in_pos, copy_size);
+ /*
+ * If doing in-place decompression in single-call mode and the
+ * uncompressed size of the file is larger than the caller
+ * thought (i.e. it is invalid input!), the buffers below may
+ * overlap and cause undefined behavior with memcpy().
+ * With valid inputs memcpy() would be fine here.
+ */
+ memmove(dict->buf + dict->pos, b->in + b->in_pos, copy_size);
dict->pos += copy_size;
if (dict->full < dict->pos)
@@ -397,7 +404,11 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b,
if (dict->pos == dict->end)
dict->pos = 0;
- memcpy(b->out + b->out_pos, b->in + b->in_pos,
+ /*
+ * Like above but for multi-call mode: use memmove()
+ * to avoid undefined behavior with invalid input.
+ */
+ memmove(b->out + b->out_pos, b->in + b->in_pos,
copy_size);
}
@@ -421,6 +432,12 @@ static uint32_t dict_flush(struct dictionary *dict, struct xz_buf *b)
if (dict->pos == dict->end)
dict->pos = 0;
+ /*
+ * These buffers cannot overlap even if doing in-place
+ * decompression because in multi-call mode dict->buf
+ * has been allocated by us in this file; it's not
+ * provided by the caller like in single-call mode.
+ */
memcpy(b->out + b->out_pos, dict->buf + dict->start,
copy_size);
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 111/323] lib/xz: Validate the value before assigning it to an enum variable
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 110/323] lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 112/323] workqueue: make sysfs of unbound kworker cpumask more clever Greg Kroah-Hartman
` (215 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lasse Collin, Gao Xiang, Sasha Levin
From: Lasse Collin <lasse.collin@tukaani.org>
[ Upstream commit 4f8d7abaa413c34da9d751289849dbfb7c977d05 ]
This might matter, for example, if the underlying type of enum xz_check
was a signed char. In such a case the validation wouldn't have caught an
unsupported header. I don't know if this problem can occur in the kernel
on any arch but it's still good to fix it because some people might copy
the XZ code to their own projects from Linux instead of the upstream
XZ Embedded repository.
This change may increase the code size by a few bytes. An alternative
would have been to use an unsigned int instead of enum xz_check but
using an enumeration looks cleaner.
Link: https://lore.kernel.org/r/20211010213145.17462-3-xiang@kernel.org
Signed-off-by: Lasse Collin <lasse.collin@tukaani.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/xz/xz_dec_stream.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lib/xz/xz_dec_stream.c b/lib/xz/xz_dec_stream.c
index bd1d182419d7e..0b161f90d8d80 100644
--- a/lib/xz/xz_dec_stream.c
+++ b/lib/xz/xz_dec_stream.c
@@ -402,12 +402,12 @@ static enum xz_ret dec_stream_header(struct xz_dec *s)
* we will accept other check types too, but then the check won't
* be verified and a warning (XZ_UNSUPPORTED_CHECK) will be given.
*/
+ if (s->temp.buf[HEADER_MAGIC_SIZE + 1] > XZ_CHECK_MAX)
+ return XZ_OPTIONS_ERROR;
+
s->check_type = s->temp.buf[HEADER_MAGIC_SIZE + 1];
#ifdef XZ_DEC_ANY_CHECK
- if (s->check_type > XZ_CHECK_MAX)
- return XZ_OPTIONS_ERROR;
-
if (s->check_type > XZ_CHECK_CRC32)
return XZ_UNSUPPORTED_CHECK;
#else
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 112/323] workqueue: make sysfs of unbound kworker cpumask more clever
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 111/323] lib/xz: Validate the value before assigning it to an enum variable Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 113/323] tracing/cfi: Fix cmp_entries_* functions signature mismatch Greg Kroah-Hartman
` (214 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mengen Sun, Menglong Dong, Tejun Heo,
Sasha Levin
From: Menglong Dong <imagedong@tencent.com>
[ Upstream commit d25302e46592c97d29f70ccb1be558df31a9a360 ]
Some unfriendly component, such as dpdk, write the same mask to
unbound kworker cpumask again and again. Every time it write to
this interface some work is queue to cpu, even though the mask
is same with the original mask.
So, fix it by return success and do nothing if the cpumask is
equal with the old one.
Signed-off-by: Mengen Sun <mengensun@tencent.com>
Signed-off-by: Menglong Dong <imagedong@tencent.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/workqueue.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 1573d1bf63007..b1bb6cb5802ec 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5125,9 +5125,6 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
int ret = -EINVAL;
cpumask_var_t saved_cpumask;
- if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL))
- return -ENOMEM;
-
/*
* Not excluding isolated cpus on purpose.
* If the user wishes to include them, we allow that.
@@ -5135,6 +5132,15 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
cpumask_and(cpumask, cpumask, cpu_possible_mask);
if (!cpumask_empty(cpumask)) {
apply_wqattrs_lock();
+ if (cpumask_equal(cpumask, wq_unbound_cpumask)) {
+ ret = 0;
+ goto out_unlock;
+ }
+
+ if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL)) {
+ ret = -ENOMEM;
+ goto out_unlock;
+ }
/* save the old wq_unbound_cpumask. */
cpumask_copy(saved_cpumask, wq_unbound_cpumask);
@@ -5147,10 +5153,11 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
if (ret < 0)
cpumask_copy(wq_unbound_cpumask, saved_cpumask);
+ free_cpumask_var(saved_cpumask);
+out_unlock:
apply_wqattrs_unlock();
}
- free_cpumask_var(saved_cpumask);
return ret;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 113/323] tracing/cfi: Fix cmp_entries_* functions signature mismatch
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 112/323] workqueue: make sysfs of unbound kworker cpumask more clever Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 114/323] mwl8k: Fix use-after-free in mwl8k_fw_state_machine() Greg Kroah-Hartman
` (213 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kalesh Singh, kernel test robot,
Steven Rostedt (VMware),
Sasha Levin
From: Kalesh Singh <kaleshsingh@google.com>
[ Upstream commit 7ce1bb83a14019f8c396d57ec704d19478747716 ]
If CONFIG_CFI_CLANG=y, attempting to read an event histogram will cause
the kernel to panic due to failed CFI check.
1. echo 'hist:keys=common_pid' >> events/sched/sched_switch/trigger
2. cat events/sched/sched_switch/hist
3. kernel panics on attempting to read hist
This happens because the sort() function expects a generic
int (*)(const void *, const void *) pointer for the compare function.
To prevent this CFI failure, change tracing map cmp_entries_* function
signatures to match this.
Also, fix the build error reported by the kernel test robot [1].
[1] https://lore.kernel.org/r/202110141140.zzi4dRh4-lkp@intel.com/
Link: https://lkml.kernel.org/r/20211014045217.3265162-1-kaleshsingh@google.com
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/tracing_map.c | 40 ++++++++++++++++++++++----------------
1 file changed, 23 insertions(+), 17 deletions(-)
diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
index 9e31bfc818ff8..10657b8dc2c2d 100644
--- a/kernel/trace/tracing_map.c
+++ b/kernel/trace/tracing_map.c
@@ -834,29 +834,35 @@ int tracing_map_init(struct tracing_map *map)
return err;
}
-static int cmp_entries_dup(const struct tracing_map_sort_entry **a,
- const struct tracing_map_sort_entry **b)
+static int cmp_entries_dup(const void *A, const void *B)
{
+ const struct tracing_map_sort_entry *a, *b;
int ret = 0;
- if (memcmp((*a)->key, (*b)->key, (*a)->elt->map->key_size))
+ a = *(const struct tracing_map_sort_entry **)A;
+ b = *(const struct tracing_map_sort_entry **)B;
+
+ if (memcmp(a->key, b->key, a->elt->map->key_size))
ret = 1;
return ret;
}
-static int cmp_entries_sum(const struct tracing_map_sort_entry **a,
- const struct tracing_map_sort_entry **b)
+static int cmp_entries_sum(const void *A, const void *B)
{
const struct tracing_map_elt *elt_a, *elt_b;
+ const struct tracing_map_sort_entry *a, *b;
struct tracing_map_sort_key *sort_key;
struct tracing_map_field *field;
tracing_map_cmp_fn_t cmp_fn;
void *val_a, *val_b;
int ret = 0;
- elt_a = (*a)->elt;
- elt_b = (*b)->elt;
+ a = *(const struct tracing_map_sort_entry **)A;
+ b = *(const struct tracing_map_sort_entry **)B;
+
+ elt_a = a->elt;
+ elt_b = b->elt;
sort_key = &elt_a->map->sort_key;
@@ -873,18 +879,21 @@ static int cmp_entries_sum(const struct tracing_map_sort_entry **a,
return ret;
}
-static int cmp_entries_key(const struct tracing_map_sort_entry **a,
- const struct tracing_map_sort_entry **b)
+static int cmp_entries_key(const void *A, const void *B)
{
const struct tracing_map_elt *elt_a, *elt_b;
+ const struct tracing_map_sort_entry *a, *b;
struct tracing_map_sort_key *sort_key;
struct tracing_map_field *field;
tracing_map_cmp_fn_t cmp_fn;
void *val_a, *val_b;
int ret = 0;
- elt_a = (*a)->elt;
- elt_b = (*b)->elt;
+ a = *(const struct tracing_map_sort_entry **)A;
+ b = *(const struct tracing_map_sort_entry **)B;
+
+ elt_a = a->elt;
+ elt_b = b->elt;
sort_key = &elt_a->map->sort_key;
@@ -989,10 +998,8 @@ static void sort_secondary(struct tracing_map *map,
struct tracing_map_sort_key *primary_key,
struct tracing_map_sort_key *secondary_key)
{
- int (*primary_fn)(const struct tracing_map_sort_entry **,
- const struct tracing_map_sort_entry **);
- int (*secondary_fn)(const struct tracing_map_sort_entry **,
- const struct tracing_map_sort_entry **);
+ int (*primary_fn)(const void *, const void *);
+ int (*secondary_fn)(const void *, const void *);
unsigned i, start = 0, n_sub = 1;
if (is_key(map, primary_key->field_idx))
@@ -1061,8 +1068,7 @@ int tracing_map_sort_entries(struct tracing_map *map,
unsigned int n_sort_keys,
struct tracing_map_sort_entry ***sort_entries)
{
- int (*cmp_entries_fn)(const struct tracing_map_sort_entry **,
- const struct tracing_map_sort_entry **);
+ int (*cmp_entries_fn)(const void *, const void *);
struct tracing_map_sort_entry *sort_entry, **entries;
int i, n_entries, ret;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 114/323] mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 113/323] tracing/cfi: Fix cmp_entries_* functions signature mismatch Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 115/323] PM: hibernate: Get block device exclusively in swsusp_check() Greg Kroah-Hartman
` (212 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zheyu Ma, Kalle Valo, Sasha Levin
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit 257051a235c17e33782b6e24a4b17f2d7915aaec ]
When the driver fails to request the firmware, it calls its error
handler. In the error handler, the driver detaches device from driver
first before releasing the firmware, which can cause a use-after-free bug.
Fix this by releasing firmware first.
The following log reveals it:
[ 9.007301 ] BUG: KASAN: use-after-free in mwl8k_fw_state_machine+0x320/0xba0
[ 9.010143 ] Workqueue: events request_firmware_work_func
[ 9.010830 ] Call Trace:
[ 9.010830 ] dump_stack_lvl+0xa8/0xd1
[ 9.010830 ] print_address_description+0x87/0x3b0
[ 9.010830 ] kasan_report+0x172/0x1c0
[ 9.010830 ] ? mutex_unlock+0xd/0x10
[ 9.010830 ] ? mwl8k_fw_state_machine+0x320/0xba0
[ 9.010830 ] ? mwl8k_fw_state_machine+0x320/0xba0
[ 9.010830 ] __asan_report_load8_noabort+0x14/0x20
[ 9.010830 ] mwl8k_fw_state_machine+0x320/0xba0
[ 9.010830 ] ? mwl8k_load_firmware+0x5f0/0x5f0
[ 9.010830 ] request_firmware_work_func+0x172/0x250
[ 9.010830 ] ? read_lock_is_recursive+0x20/0x20
[ 9.010830 ] ? process_one_work+0x7a1/0x1100
[ 9.010830 ] ? request_firmware_nowait+0x460/0x460
[ 9.010830 ] ? __this_cpu_preempt_check+0x13/0x20
[ 9.010830 ] process_one_work+0x9bb/0x1100
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1634356979-6211-1-git-send-email-zheyuma97@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwl8k.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
index 6769b0c5a5cde..ee842797570b7 100644
--- a/drivers/net/wireless/marvell/mwl8k.c
+++ b/drivers/net/wireless/marvell/mwl8k.c
@@ -5793,8 +5793,8 @@ static void mwl8k_fw_state_machine(const struct firmware *fw, void *context)
fail:
priv->fw_state = FW_STATE_ERROR;
complete(&priv->firmware_loading_complete);
- device_release_driver(&priv->pdev->dev);
mwl8k_release_firmware(priv);
+ device_release_driver(&priv->pdev->dev);
}
#define MAX_RESTART_ATTEMPTS 1
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 115/323] PM: hibernate: Get block device exclusively in swsusp_check()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 114/323] mwl8k: Fix use-after-free in mwl8k_fw_state_machine() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 116/323] iwlwifi: mvm: disable RX-diversity in powersave Greg Kroah-Hartman
` (211 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ye Bin, Rafael J. Wysocki, Sasha Levin
From: Ye Bin <yebin10@huawei.com>
[ Upstream commit 39fbef4b0f77f9c89c8f014749ca533643a37c9f ]
The following kernel crash can be triggered:
[ 89.266592] ------------[ cut here ]------------
[ 89.267427] kernel BUG at fs/buffer.c:3020!
[ 89.268264] invalid opcode: 0000 [#1] SMP KASAN PTI
[ 89.269116] CPU: 7 PID: 1750 Comm: kmmpd-loop0 Not tainted 5.10.0-862.14.0.6.x86_64-08610-gc932cda3cef4-dirty #20
[ 89.273169] RIP: 0010:submit_bh_wbc.isra.0+0x538/0x6d0
[ 89.277157] RSP: 0018:ffff888105ddfd08 EFLAGS: 00010246
[ 89.278093] RAX: 0000000000000005 RBX: ffff888124231498 RCX: ffffffffb2772612
[ 89.279332] RDX: 1ffff11024846293 RSI: 0000000000000008 RDI: ffff888124231498
[ 89.280591] RBP: ffff8881248cc000 R08: 0000000000000001 R09: ffffed1024846294
[ 89.281851] R10: ffff88812423149f R11: ffffed1024846293 R12: 0000000000003800
[ 89.283095] R13: 0000000000000001 R14: 0000000000000000 R15: ffff8881161f7000
[ 89.284342] FS: 0000000000000000(0000) GS:ffff88839b5c0000(0000) knlGS:0000000000000000
[ 89.285711] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 89.286701] CR2: 00007f166ebc01a0 CR3: 0000000435c0e000 CR4: 00000000000006e0
[ 89.287919] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 89.289138] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 89.290368] Call Trace:
[ 89.290842] write_mmp_block+0x2ca/0x510
[ 89.292218] kmmpd+0x433/0x9a0
[ 89.294902] kthread+0x2dd/0x3e0
[ 89.296268] ret_from_fork+0x22/0x30
[ 89.296906] Modules linked in:
by running the following commands:
1. mkfs.ext4 -O mmp /dev/sda -b 1024
2. mount /dev/sda /home/test
3. echo "/dev/sda" > /sys/power/resume
That happens because swsusp_check() calls set_blocksize() on the
target partition which confuses the file system:
Thread1 Thread2
mount /dev/sda /home/test
get s_mmp_bh --> has mapped flag
start kmmpd thread
echo "/dev/sda" > /sys/power/resume
resume_store
software_resume
swsusp_check
set_blocksize
truncate_inode_pages_range
truncate_cleanup_page
block_invalidatepage
discard_buffer --> clean mapped flag
write_mmp_block
submit_bh
submit_bh_wbc
BUG_ON(!buffer_mapped(bh))
To address this issue, modify swsusp_check() to open the target block
device with exclusive access.
Signed-off-by: Ye Bin <yebin10@huawei.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/power/swap.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index e9494c29f1ca4..b5b97df142d26 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -1512,9 +1512,10 @@ end:
int swsusp_check(void)
{
int error;
+ void *holder;
hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device,
- FMODE_READ, NULL);
+ FMODE_READ | FMODE_EXCL, &holder);
if (!IS_ERR(hib_resume_bdev)) {
set_blocksize(hib_resume_bdev, PAGE_SIZE);
clear_page(swsusp_header);
@@ -1536,7 +1537,7 @@ int swsusp_check(void)
put:
if (error)
- blkdev_put(hib_resume_bdev, FMODE_READ);
+ blkdev_put(hib_resume_bdev, FMODE_READ | FMODE_EXCL);
else
pr_debug("Image signature found, resuming\n");
} else {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 116/323] iwlwifi: mvm: disable RX-diversity in powersave
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 115/323] PM: hibernate: Get block device exclusively in swsusp_check() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 117/323] smackfs: use __GFP_NOFAIL for smk_cipso_doi() Greg Kroah-Hartman
` (210 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho, Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit e5322b9ab5f63536c41301150b7ce64605ce52cc ]
Just like we have default SMPS mode as dynamic in powersave,
we should not enable RX-diversity in powersave, to reduce
power consumption when connected to a non-MIMO AP.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017113927.fc896bc5cdaa.I1d11da71b8a5cbe921a37058d5f578f1b14a2023@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
index 00712205c05f2..bc3f67e0bf334 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
@@ -1018,6 +1018,9 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
lockdep_assert_held(&mvm->mutex);
+ if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
+ return false;
+
if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1)
return false;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 117/323] smackfs: use __GFP_NOFAIL for smk_cipso_doi()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 116/323] iwlwifi: mvm: disable RX-diversity in powersave Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 118/323] ARM: clang: Do not rely on lr register for stacktrace Greg Kroah-Hartman
` (209 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot, Tetsuo Handa,
Casey Schaufler, Sasha Levin
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
[ Upstream commit f91488ee15bd3cac467e2d6a361fc2d34d1052ae ]
syzbot is reporting kernel panic at smk_cipso_doi() due to memory
allocation fault injection [1]. The reason for need to use panic() was
not explained. But since no fix was proposed for 18 months, for now
let's use __GFP_NOFAIL for utilizing syzbot resource on other bugs.
Link: https://syzkaller.appspot.com/bug?extid=89731ccb6fec15ce1c22 [1]
Reported-by: syzbot <syzbot+89731ccb6fec15ce1c22@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smackfs.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 25705a72d31bc..9fdf404a318f9 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -721,9 +721,7 @@ static void smk_cipso_doi(void)
printk(KERN_WARNING "%s:%d remove rc = %d\n",
__func__, __LINE__, rc);
- doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
- if (doip == NULL)
- panic("smack: Failed to initialize cipso DOI.\n");
+ doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL | __GFP_NOFAIL);
doip->map.std = NULL;
doip->doi = smk_cipso_doi_value;
doip->type = CIPSO_V4_MAP_PASS;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 118/323] ARM: clang: Do not rely on lr register for stacktrace
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 117/323] smackfs: use __GFP_NOFAIL for smk_cipso_doi() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 119/323] gre/sit: Dont generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE Greg Kroah-Hartman
` (208 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masami Hiramatsu, Nick Desaulniers,
Steven Rostedt (VMware),
Sasha Levin
From: Masami Hiramatsu <mhiramat@kernel.org>
[ Upstream commit b3ea5d56f212ad81328c82454829a736197ebccc ]
Currently the stacktrace on clang compiled arm kernel uses the 'lr'
register to find the first frame address from pt_regs. However, that
is wrong after calling another function, because the 'lr' register
is used by 'bl' instruction and never be recovered.
As same as gcc arm kernel, directly use the frame pointer (r11) of
the pt_regs to find the first frame address.
Note that this fixes kretprobe stacktrace issue only with
CONFIG_UNWINDER_FRAME_POINTER=y. For the CONFIG_UNWINDER_ARM,
we need another fix.
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/stacktrace.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
index d23ab9ec130a3..a452b859f485f 100644
--- a/arch/arm/kernel/stacktrace.c
+++ b/arch/arm/kernel/stacktrace.c
@@ -53,8 +53,7 @@ int notrace unwind_frame(struct stackframe *frame)
frame->sp = frame->fp;
frame->fp = *(unsigned long *)(fp);
- frame->pc = frame->lr;
- frame->lr = *(unsigned long *)(fp + 4);
+ frame->pc = *(unsigned long *)(fp + 4);
#else
/* check current frame pointer is within bounds */
if (fp < low + 12 || fp > high - 4)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 119/323] gre/sit: Dont generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 118/323] ARM: clang: Do not rely on lr register for stacktrace Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 120/323] ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 Greg Kroah-Hartman
` (207 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stephen Suryaputra,
Antonio Quartulli, Jakub Kicinski, Sasha Levin
From: Stephen Suryaputra <ssuryaextr@gmail.com>
[ Upstream commit 61e18ce7348bfefb5688a8bcd4b4d6b37c0f9b2a ]
When addr_gen_mode is set to IN6_ADDR_GEN_MODE_NONE, the link-local addr
should not be generated. But it isn't the case for GRE (as well as GRE6)
and SIT tunnels. Make it so that tunnels consider the addr_gen_mode,
especially for IN6_ADDR_GEN_MODE_NONE.
Do this in add_v4_addrs() to cover both GRE and SIT only if the addr
scope is link.
Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Acked-by: Antonio Quartulli <a@unstable.cc>
Link: https://lore.kernel.org/r/20211020200618.467342-1-ssuryaextr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 76c097552ea74..9d8b791f63efc 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3054,6 +3054,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4);
if (idev->dev->flags&IFF_POINTOPOINT) {
+ if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE)
+ return;
+
addr.s6_addr32[0] = htonl(0xfe800000);
scope = IFA_LINK;
plen = 64;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 120/323] ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 119/323] gre/sit: Dont generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 121/323] spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() Greg Kroah-Hartman
` (206 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Murzin, Arnd Bergmann,
Russell King (Oracle),
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 345dac33f58894a56d17b92a41be10e16585ceff ]
When configuring the kernel for big-endian, we set either BE-8 or BE-32
based on the CPU architecture level. Until linux-4.4, we did not have
any ARMv7-M platform allowing big-endian builds, but now i.MX/Vybrid
is in that category, adn we get a build error because of this:
arch/arm/kernel/module-plts.c: In function 'get_module_plt':
arch/arm/kernel/module-plts.c:60:46: error: implicit declaration of function '__opcode_to_mem_thumb32' [-Werror=implicit-function-declaration]
This comes down to picking the wrong default, ARMv7-M uses BE8
like ARMv7-A does. Changing the default gets the kernel to compile
and presumably works.
https://lore.kernel.org/all/1455804123-2526139-2-git-send-email-arnd@arndb.de/
Tested-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mm/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index b169e580bf829..9738c1f9737c9 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -751,7 +751,7 @@ config CPU_BIG_ENDIAN
config CPU_ENDIAN_BE8
bool
depends on CPU_BIG_ENDIAN
- default CPU_V6 || CPU_V6K || CPU_V7
+ default CPU_V6 || CPU_V6K || CPU_V7 || CPU_V7M
help
Support for the BE-8 (big-endian) mode on ARMv6 and ARMv7 processors.
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 121/323] spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 120/323] ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 122/323] x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted Greg Kroah-Hartman
` (205 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
Mark Brown, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit ca9b8f56ec089d3a436050afefd17b7237301f47 ]
Fix the missing clk_disable_unprepare() before return
from bcm_qspi_probe() in the error handling case.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20211018073413.2029081-1-yangyingliang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-bcm-qspi.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index 4ee92f7ca20bd..b2fd7a3691964 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -1305,7 +1305,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
&qspi->dev_ids[val]);
if (ret < 0) {
dev_err(&pdev->dev, "IRQ %s not found\n", name);
- goto qspi_probe_err;
+ goto qspi_unprepare_err;
}
qspi->dev_ids[val].dev = qspi;
@@ -1320,7 +1320,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
if (!num_ints) {
dev_err(&pdev->dev, "no IRQs registered, cannot init driver\n");
ret = -EINVAL;
- goto qspi_probe_err;
+ goto qspi_unprepare_err;
}
/*
@@ -1371,6 +1371,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
qspi_reg_err:
bcm_qspi_hw_uninit(qspi);
+qspi_unprepare_err:
clk_disable_unprepare(qspi->clk);
qspi_probe_err:
kfree(qspi->dev_ids);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 122/323] x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 121/323] spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 123/323] parisc: fix warning in flush_tlb_all Greg Kroah-Hartman
` (204 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Kelley, Vitaly Kuznetsov,
Wei Liu, Sasha Levin
From: Vitaly Kuznetsov <vkuznets@redhat.com>
[ Upstream commit 285f68afa8b20f752b0b7194d54980b5e0e27b75 ]
The following issue is observed with CONFIG_DEBUG_PREEMPT when KVM loads:
KVM: vmx: using Hyper-V Enlightened VMCS
BUG: using smp_processor_id() in preemptible [00000000] code: systemd-udevd/488
caller is set_hv_tscchange_cb+0x16/0x80
CPU: 1 PID: 488 Comm: systemd-udevd Not tainted 5.15.0-rc5+ #396
Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019
Call Trace:
dump_stack_lvl+0x6a/0x9a
check_preemption_disabled+0xde/0xe0
? kvm_gen_update_masterclock+0xd0/0xd0 [kvm]
set_hv_tscchange_cb+0x16/0x80
kvm_arch_init+0x23f/0x290 [kvm]
kvm_init+0x30/0x310 [kvm]
vmx_init+0xaf/0x134 [kvm_intel]
...
set_hv_tscchange_cb() can get preempted in between acquiring
smp_processor_id() and writing to HV_X64_MSR_REENLIGHTENMENT_CONTROL. This
is not an issue by itself: HV_X64_MSR_REENLIGHTENMENT_CONTROL is a
partition-wide MSR and it doesn't matter which particular CPU will be
used to receive reenlightenment notifications. The only real problem can
(in theory) be observed if the CPU whose id was acquired with
smp_processor_id() goes offline before we manage to write to the MSR,
the logic in hv_cpu_die() won't be able to reassign it correctly.
Reported-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://lore.kernel.org/r/20211012155005.1613352-1-vkuznets@redhat.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/hyperv/hv_init.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index 1663ad84778ba..bd4b6951b1483 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -192,7 +192,6 @@ void set_hv_tscchange_cb(void (*cb)(void))
struct hv_reenlightenment_control re_ctrl = {
.vector = HYPERV_REENLIGHTENMENT_VECTOR,
.enabled = 1,
- .target_vp = hv_vp_index[smp_processor_id()]
};
struct hv_tsc_emulation_control emu_ctrl = {.enabled = 1};
@@ -206,8 +205,12 @@ void set_hv_tscchange_cb(void (*cb)(void))
/* Make sure callback is registered before we write to MSRs */
wmb();
+ re_ctrl.target_vp = hv_vp_index[get_cpu()];
+
wrmsrl(HV_X64_MSR_REENLIGHTENMENT_CONTROL, *((u64 *)&re_ctrl));
wrmsrl(HV_X64_MSR_TSC_EMULATION_CONTROL, *((u64 *)&emu_ctrl));
+
+ put_cpu();
}
EXPORT_SYMBOL_GPL(set_hv_tscchange_cb);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 123/323] parisc: fix warning in flush_tlb_all
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 122/323] x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 124/323] task_stack: Fix end_of_stack() for architectures with upwards-growing stack Greg Kroah-Hartman
` (203 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Helge Deller, Sasha Levin
From: Sven Schnelle <svens@stackframe.org>
[ Upstream commit 1030d681319b43869e0d5b568b9d0226652d1a6f ]
I've got the following splat after enabling preemption:
[ 3.724721] BUG: using __this_cpu_add() in preemptible [00000000] code: swapper/0/1
[ 3.734630] caller is __this_cpu_preempt_check+0x38/0x50
[ 3.740635] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc4-64bit+ #324
[ 3.744605] Hardware name: 9000/785/C8000
[ 3.744605] Backtrace:
[ 3.744605] [<00000000401d9d58>] show_stack+0x74/0xb0
[ 3.744605] [<0000000040c27bd4>] dump_stack_lvl+0x10c/0x188
[ 3.744605] [<0000000040c27c84>] dump_stack+0x34/0x48
[ 3.744605] [<0000000040c33438>] check_preemption_disabled+0x178/0x1b0
[ 3.744605] [<0000000040c334f8>] __this_cpu_preempt_check+0x38/0x50
[ 3.744605] [<00000000401d632c>] flush_tlb_all+0x58/0x2e0
[ 3.744605] [<00000000401075c0>] 0x401075c0
[ 3.744605] [<000000004010b8fc>] 0x4010b8fc
[ 3.744605] [<00000000401080fc>] 0x401080fc
[ 3.744605] [<00000000401d5224>] do_one_initcall+0x128/0x378
[ 3.744605] [<0000000040102de8>] 0x40102de8
[ 3.744605] [<0000000040c33864>] kernel_init+0x60/0x3a8
[ 3.744605] [<00000000401d1020>] ret_from_kernel_thread+0x20/0x28
[ 3.744605]
Fix this by moving the __inc_irq_stat() into the locked section.
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/parisc/mm/init.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index 10a52664e29f0..038fcb6c76dc1 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -895,9 +895,9 @@ void flush_tlb_all(void)
{
int do_recycle;
- __inc_irq_stat(irq_tlb_count);
do_recycle = 0;
spin_lock(&sid_lock);
+ __inc_irq_stat(irq_tlb_count);
if (dirty_space_ids > RECYCLE_THRESHOLD) {
BUG_ON(recycle_inuse); /* FIXME: Use a semaphore/wait queue here */
get_dirty_sids(&recycle_ndirty,recycle_dirty_array);
@@ -916,8 +916,8 @@ void flush_tlb_all(void)
#else
void flush_tlb_all(void)
{
- __inc_irq_stat(irq_tlb_count);
spin_lock(&sid_lock);
+ __inc_irq_stat(irq_tlb_count);
flush_tlb_all_local(NULL);
recycle_sids();
spin_unlock(&sid_lock);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 124/323] task_stack: Fix end_of_stack() for architectures with upwards-growing stack
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 123/323] parisc: fix warning in flush_tlb_all Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 125/323] parisc/unwind: fix unwinder when CONFIG_64BIT is enabled Greg Kroah-Hartman
` (202 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Helge Deller, Sasha Levin
From: Helge Deller <deller@gmx.de>
[ Upstream commit 9cc2fa4f4a92ccc6760d764e7341be46ee8aaaa1 ]
The function end_of_stack() returns a pointer to the last entry of a
stack. For architectures like parisc where the stack grows upwards
return the pointer to the highest address in the stack.
Without this change I faced a crash on parisc, because the stackleak
functionality wrote STACKLEAK_POISON to the lowest address and thus
overwrote the first 4 bytes of the task_struct which included the
TIF_FLAGS.
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/sched/task_stack.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h
index 6a841929073f9..4f099d3fed3a9 100644
--- a/include/linux/sched/task_stack.h
+++ b/include/linux/sched/task_stack.h
@@ -25,7 +25,11 @@ static inline void *task_stack_page(const struct task_struct *task)
static inline unsigned long *end_of_stack(const struct task_struct *task)
{
+#ifdef CONFIG_STACK_GROWSUP
+ return (unsigned long *)((unsigned long)task->stack + THREAD_SIZE) - 1;
+#else
return task->stack;
+#endif
}
#elif !defined(__HAVE_THREAD_FUNCTIONS)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 125/323] parisc/unwind: fix unwinder when CONFIG_64BIT is enabled
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 124/323] task_stack: Fix end_of_stack() for architectures with upwards-growing stack Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 126/323] parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling Greg Kroah-Hartman
` (201 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Helge Deller, Sasha Levin
From: Sven Schnelle <svens@stackframe.org>
[ Upstream commit 8e0ba125c2bf1030af3267058019ba86da96863f ]
With 64 bit kernels unwind_special() is not working because
it compares the pc to the address of the function descriptor.
Add a helper function that compares pc with the dereferenced
address. This fixes all of the backtraces on my c8000. Without
this changes, a lot of backtraces are missing in kdb or the
show-all-tasks command from /proc/sysrq-trigger.
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/parisc/kernel/unwind.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c
index 2d14f17838d23..fa52c939e8a3b 100644
--- a/arch/parisc/kernel/unwind.c
+++ b/arch/parisc/kernel/unwind.c
@@ -21,6 +21,8 @@
#include <asm/ptrace.h>
#include <asm/unwind.h>
+#include <asm/switch_to.h>
+#include <asm/sections.h>
/* #define DEBUG 1 */
#ifdef DEBUG
@@ -203,6 +205,11 @@ int __init unwind_init(void)
return 0;
}
+static bool pc_is_kernel_fn(unsigned long pc, void *fn)
+{
+ return (unsigned long)dereference_kernel_function_descriptor(fn) == pc;
+}
+
static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int frame_size)
{
/*
@@ -221,7 +228,7 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int
extern void * const _call_on_stack;
#endif /* CONFIG_IRQSTACKS */
- if (pc == (unsigned long) &handle_interruption) {
+ if (pc_is_kernel_fn(pc, handle_interruption)) {
struct pt_regs *regs = (struct pt_regs *)(info->sp - frame_size - PT_SZ_ALGN);
dbg("Unwinding through handle_interruption()\n");
info->prev_sp = regs->gr[30];
@@ -229,13 +236,13 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int
return 1;
}
- if (pc == (unsigned long) &ret_from_kernel_thread ||
- pc == (unsigned long) &syscall_exit) {
+ if (pc_is_kernel_fn(pc, ret_from_kernel_thread) ||
+ pc_is_kernel_fn(pc, syscall_exit)) {
info->prev_sp = info->prev_ip = 0;
return 1;
}
- if (pc == (unsigned long) &intr_return) {
+ if (pc_is_kernel_fn(pc, intr_return)) {
struct pt_regs *regs;
dbg("Found intr_return()\n");
@@ -246,20 +253,20 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int
return 1;
}
- if (pc == (unsigned long) &_switch_to_ret) {
+ if (pc_is_kernel_fn(pc, _switch_to) ||
+ pc_is_kernel_fn(pc, _switch_to_ret)) {
info->prev_sp = info->sp - CALLEE_SAVE_FRAME_SIZE;
info->prev_ip = *(unsigned long *)(info->prev_sp - RP_OFFSET);
return 1;
}
#ifdef CONFIG_IRQSTACKS
- if (pc == (unsigned long) &_call_on_stack) {
+ if (pc_is_kernel_fn(pc, _call_on_stack)) {
info->prev_sp = *(unsigned long *)(info->sp - FRAME_SIZE - REG_SZ);
info->prev_ip = *(unsigned long *)(info->sp - FRAME_SIZE - RP_OFFSET);
return 1;
}
#endif
-
return 0;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 126/323] parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 125/323] parisc/unwind: fix unwinder when CONFIG_64BIT is enabled Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 127/323] Bluetooth: fix init and cleanup of sco_conn.timeout_work Greg Kroah-Hartman
` (200 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Helge Deller, Sasha Levin
From: Sven Schnelle <svens@stackframe.org>
[ Upstream commit 66e29fcda1824f0427966fbee2bd2c85bf362c82 ]
With idle polling, IPIs are not sent when a CPU idle, but queued
and run later from do_idle(). The default kgdb_call_nmi_hook()
implementation gets the pointer to struct pt_regs from get_irq_reqs(),
which doesn't work in that case because it was not called from the
IPI interrupt handler. Fix it by defining our own kgdb_roundup()
function which sents an IPI_ENTER_KGDB. When that IPI is received
on the target CPU kgdb_nmicallback() is called.
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/parisc/kernel/smp.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c
index 5e26dbede5fc2..ae4fc8769c38b 100644
--- a/arch/parisc/kernel/smp.c
+++ b/arch/parisc/kernel/smp.c
@@ -32,6 +32,7 @@
#include <linux/bitops.h>
#include <linux/ftrace.h>
#include <linux/cpu.h>
+#include <linux/kgdb.h>
#include <linux/atomic.h>
#include <asm/current.h>
@@ -74,7 +75,10 @@ enum ipi_message_type {
IPI_CALL_FUNC,
IPI_CPU_START,
IPI_CPU_STOP,
- IPI_CPU_TEST
+ IPI_CPU_TEST,
+#ifdef CONFIG_KGDB
+ IPI_ENTER_KGDB,
+#endif
};
@@ -170,7 +174,12 @@ ipi_interrupt(int irq, void *dev_id)
case IPI_CPU_TEST:
smp_debug(100, KERN_DEBUG "CPU%d is alive!\n", this_cpu);
break;
-
+#ifdef CONFIG_KGDB
+ case IPI_ENTER_KGDB:
+ smp_debug(100, KERN_DEBUG "CPU%d ENTER_KGDB\n", this_cpu);
+ kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs());
+ break;
+#endif
default:
printk(KERN_CRIT "Unknown IPI num on CPU%d: %lu\n",
this_cpu, which);
@@ -226,6 +235,12 @@ send_IPI_allbutself(enum ipi_message_type op)
}
}
+#ifdef CONFIG_KGDB
+void kgdb_roundup_cpus(void)
+{
+ send_IPI_allbutself(IPI_ENTER_KGDB);
+}
+#endif
inline void
smp_send_stop(void) { send_IPI_allbutself(IPI_CPU_STOP); }
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 127/323] Bluetooth: fix init and cleanup of sco_conn.timeout_work
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 126/323] parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 128/323] cgroup: Make rebind_subsystems() disable v2 controllers all at once Greg Kroah-Hartman
` (199 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Desmond Cheong Zhi Xi,
Luiz Augusto von Dentz, Sasha Levin
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
[ Upstream commit 49d8a5606428ca0962d09050a5af81461ff90fbb ]
Before freeing struct sco_conn, all delayed timeout work should be
cancelled. Otherwise, sco_sock_timeout could potentially use the
sco_conn after it has been freed.
Additionally, sco_conn.timeout_work should be initialized when the
connection is allocated, not when the channel is added. This is
because an sco_conn can create channels with multiple sockets over its
lifetime, which happens if sockets are released but the connection
isn't deleted.
Fixes: ba316be1b6a0 ("Bluetooth: schedule SCO timeouts with delayed_work")
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/sco.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index d052b454dc4e1..1e0a1c0a56b57 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -133,6 +133,7 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
return NULL;
spin_lock_init(&conn->lock);
+ INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
hcon->sco_data = conn;
conn->hcon = hcon;
@@ -196,11 +197,11 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
sco_chan_del(sk, err);
bh_unlock_sock(sk);
sock_put(sk);
-
- /* Ensure no more work items will run before freeing conn. */
- cancel_delayed_work_sync(&conn->timeout_work);
}
+ /* Ensure no more work items will run before freeing conn. */
+ cancel_delayed_work_sync(&conn->timeout_work);
+
hcon->sco_data = NULL;
kfree(conn);
}
@@ -213,8 +214,6 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
sco_pi(sk)->conn = conn;
conn->sk = sk;
- INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
-
if (parent)
bt_accept_enqueue(parent, sk, true);
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 128/323] cgroup: Make rebind_subsystems() disable v2 controllers all at once
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 127/323] Bluetooth: fix init and cleanup of sco_conn.timeout_work Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 129/323] net: dsa: rtl8366rb: Fix off-by-one bug Greg Kroah-Hartman
` (198 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Waiman Long, Tejun Heo, Sasha Levin
From: Waiman Long <longman@redhat.com>
[ Upstream commit 7ee285395b211cad474b2b989db52666e0430daf ]
It was found that the following warning was displayed when remounting
controllers from cgroup v2 to v1:
[ 8042.997778] WARNING: CPU: 88 PID: 80682 at kernel/cgroup/cgroup.c:3130 cgroup_apply_control_disable+0x158/0x190
:
[ 8043.091109] RIP: 0010:cgroup_apply_control_disable+0x158/0x190
[ 8043.096946] Code: ff f6 45 54 01 74 39 48 8d 7d 10 48 c7 c6 e0 46 5a a4 e8 7b 67 33 00 e9 41 ff ff ff 49 8b 84 24 e8 01 00 00 0f b7 40 08 eb 95 <0f> 0b e9 5f ff ff ff 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3
[ 8043.115692] RSP: 0018:ffffba8a47c23d28 EFLAGS: 00010202
[ 8043.120916] RAX: 0000000000000036 RBX: ffffffffa624ce40 RCX: 000000000000181a
[ 8043.128047] RDX: ffffffffa63c43e0 RSI: ffffffffa63c43e0 RDI: ffff9d7284ee1000
[ 8043.135180] RBP: ffff9d72874c5800 R08: ffffffffa624b090 R09: 0000000000000004
[ 8043.142314] R10: ffffffffa624b080 R11: 0000000000002000 R12: ffff9d7284ee1000
[ 8043.149447] R13: ffff9d7284ee1000 R14: ffffffffa624ce70 R15: ffffffffa6269e20
[ 8043.156576] FS: 00007f7747cff740(0000) GS:ffff9d7a5fc00000(0000) knlGS:0000000000000000
[ 8043.164663] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8043.170409] CR2: 00007f7747e96680 CR3: 0000000887d60001 CR4: 00000000007706e0
[ 8043.177539] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8043.184673] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8043.191804] PKRU: 55555554
[ 8043.194517] Call Trace:
[ 8043.196970] rebind_subsystems+0x18c/0x470
[ 8043.201070] cgroup_setup_root+0x16c/0x2f0
[ 8043.205177] cgroup1_root_to_use+0x204/0x2a0
[ 8043.209456] cgroup1_get_tree+0x3e/0x120
[ 8043.213384] vfs_get_tree+0x22/0xb0
[ 8043.216883] do_new_mount+0x176/0x2d0
[ 8043.220550] __x64_sys_mount+0x103/0x140
[ 8043.224474] do_syscall_64+0x38/0x90
[ 8043.228063] entry_SYSCALL_64_after_hwframe+0x44/0xae
It was caused by the fact that rebind_subsystem() disables
controllers to be rebound one by one. If more than one disabled
controllers are originally from the default hierarchy, it means that
cgroup_apply_control_disable() will be called multiple times for the
same default hierarchy. A controller may be killed by css_kill() in
the first round. In the second round, the killed controller may not be
completely dead yet leading to the warning.
To avoid this problem, we collect all the ssid's of controllers that
needed to be disabled from the default hierarchy and then disable them
in one go instead of one by one.
Fixes: 334c3679ec4b ("cgroup: reimplement rebind_subsystems() using cgroup_apply_control() and friends")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/cgroup.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index a74549693e7f5..63eff85f251f3 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1650,6 +1650,7 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
struct cgroup *dcgrp = &dst_root->cgrp;
struct cgroup_subsys *ss;
int ssid, i, ret;
+ u16 dfl_disable_ss_mask = 0;
lockdep_assert_held(&cgroup_mutex);
@@ -1666,8 +1667,28 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
/* can't move between two non-dummy roots either */
if (ss->root != &cgrp_dfl_root && dst_root != &cgrp_dfl_root)
return -EBUSY;
+
+ /*
+ * Collect ssid's that need to be disabled from default
+ * hierarchy.
+ */
+ if (ss->root == &cgrp_dfl_root)
+ dfl_disable_ss_mask |= 1 << ssid;
+
} while_each_subsys_mask();
+ if (dfl_disable_ss_mask) {
+ struct cgroup *scgrp = &cgrp_dfl_root.cgrp;
+
+ /*
+ * Controllers from default hierarchy that need to be rebound
+ * are all disabled together in one go.
+ */
+ cgrp_dfl_root.subsys_mask &= ~dfl_disable_ss_mask;
+ WARN_ON(cgroup_apply_control(scgrp));
+ cgroup_finalize_control(scgrp, 0);
+ }
+
do_each_subsys_mask(ss, ssid, ss_mask) {
struct cgroup_root *src_root = ss->root;
struct cgroup *scgrp = &src_root->cgrp;
@@ -1676,10 +1697,12 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
WARN_ON(!css || cgroup_css(dcgrp, ss));
- /* disable from the source */
- src_root->subsys_mask &= ~(1 << ssid);
- WARN_ON(cgroup_apply_control(scgrp));
- cgroup_finalize_control(scgrp, 0);
+ if (src_root != &cgrp_dfl_root) {
+ /* disable from the source */
+ src_root->subsys_mask &= ~(1 << ssid);
+ WARN_ON(cgroup_apply_control(scgrp));
+ cgroup_finalize_control(scgrp, 0);
+ }
/* rebind */
RCU_INIT_POINTER(scgrp->subsys[ssid], NULL);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 129/323] net: dsa: rtl8366rb: Fix off-by-one bug
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 128/323] cgroup: Make rebind_subsystems() disable v2 controllers all at once Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 130/323] drm/amdgpu: fix warning for overflow check Greg Kroah-Hartman
` (197 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mauri Sandberg, DENG Qingfang,
Florian Fainelli, Alvin Šipraga, Vladimir Oltean,
Linus Walleij, David S. Miller, Sasha Levin
From: Linus Walleij <linus.walleij@linaro.org>
[ Upstream commit 5f5f12f5d4b108399130bb5c11f07765851d9cdb ]
The max VLAN number with non-4K VLAN activated is 15, and the
range is 0..15. Not 16.
The impact should be low since we by default have 4K VLAN and
thus have 4095 VLANs to play with in this switch. There will
not be a problem unless the code is rewritten to only use
16 VLANs.
Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver")
Cc: Mauri Sandberg <sandberg@mailfence.com>
Cc: DENG Qingfang <dqfext@gmail.com>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Alvin Šipraga <alsi@bang-olufsen.dk>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/rtl8366rb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c
index 5aefd7a4696a5..87832e36c3d5a 100644
--- a/drivers/net/dsa/rtl8366rb.c
+++ b/drivers/net/dsa/rtl8366rb.c
@@ -1265,7 +1265,7 @@ static int rtl8366rb_set_mc_index(struct realtek_smi *smi, int port, int index)
static bool rtl8366rb_is_vlan_valid(struct realtek_smi *smi, unsigned int vlan)
{
- unsigned int max = RTL8366RB_NUM_VLANS;
+ unsigned int max = RTL8366RB_NUM_VLANS - 1;
if (smi->vlan4k_enabled)
max = RTL8366RB_NUM_VIDS - 1;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 130/323] drm/amdgpu: fix warning for overflow check
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 129/323] net: dsa: rtl8366rb: Fix off-by-one bug Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 131/323] media: em28xx: add missing em28xx_close_extension Greg Kroah-Hartman
` (196 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian König, Arnd Bergmann,
Alex Deucher, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 335aea75b0d95518951cad7c4c676e6f1c02c150 ]
The overflow check in amdgpu_bo_list_create() causes a warning with
clang-14 on 64-bit architectures, since the limit can never be
exceeded.
drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c:74:18: error: result of comparison of constant 256204778801521549 with expression of type 'unsigned int' is always false [-Werror,-Wtautological-constant-out-of-range-compare]
if (num_entries > (SIZE_MAX - sizeof(struct amdgpu_bo_list))
~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The check remains useful for 32-bit architectures, so just avoid the
warning by using size_t as the type for the count.
Fixes: 920990cb080a ("drm/amdgpu: allocate the bo_list array after the list")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
index ce7f18c5ccb26..fda8d68a87fd6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
@@ -57,7 +57,7 @@ static void amdgpu_bo_list_free(struct kref *ref)
int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp,
struct drm_amdgpu_bo_list_entry *info,
- unsigned num_entries, struct amdgpu_bo_list **result)
+ size_t num_entries, struct amdgpu_bo_list **result)
{
unsigned last_entry = 0, first_userptr = num_entries;
struct amdgpu_bo_list_entry *array;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h
index 61b089768e1ce..64c8195426ac8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h
@@ -61,7 +61,7 @@ int amdgpu_bo_create_list_entry_array(struct drm_amdgpu_bo_list_in *in,
int amdgpu_bo_list_create(struct amdgpu_device *adev,
struct drm_file *filp,
struct drm_amdgpu_bo_list_entry *info,
- unsigned num_entries,
+ size_t num_entries,
struct amdgpu_bo_list **list);
static inline struct amdgpu_bo_list_entry *
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 131/323] media: em28xx: add missing em28xx_close_extension
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 130/323] drm/amdgpu: fix warning for overflow check Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 132/323] media: dvb-usb: fix ununit-value in az6027_rc_query Greg Kroah-Hartman
` (195 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin, syzbot+a6969ef522a36d3344c9
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit 2c98b8a3458df03abdc6945bbef67ef91d181938 ]
If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
corrupted list bugs, since driver frees this pointer on disconnect.
Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com
Fixes: 1a23f81b7dc3 ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/em28xx/em28xx-cards.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index 3f59a98dbf9a1..ec608f60d2c75 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -4030,8 +4030,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)
em28xx_close_extension(dev);
- if (dev->dev_next)
+ if (dev->dev_next) {
+ em28xx_close_extension(dev->dev_next);
em28xx_release_resources(dev->dev_next);
+ }
+
em28xx_release_resources(dev);
if (dev->dev_next) {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 132/323] media: dvb-usb: fix ununit-value in az6027_rc_query
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 131/323] media: em28xx: add missing em28xx_close_extension Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 133/323] media: mtk-vpu: Fix a resource leak in the error handling path of mtk_vpu_probe() Greg Kroah-Hartman
` (194 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Sean Young,
Mauro Carvalho Chehab, Sasha Levin, syzbot+2cd8c5db4a85f0a04142
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit afae4ef7d5ad913cab1316137854a36bea6268a5 ]
Syzbot reported ununit-value bug in az6027_rc_query(). The problem was
in missing state pointer initialization. Since this function does nothing
we can simply initialize state to REMOTE_NO_KEY_PRESSED.
Reported-and-tested-by: syzbot+2cd8c5db4a85f0a04142@syzkaller.appspotmail.com
Fixes: 76f9a820c867 ("V4L/DVB: AZ6027: Initial import of the driver")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/az6027.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c
index 6321b8e302612..990719727dc37 100644
--- a/drivers/media/usb/dvb-usb/az6027.c
+++ b/drivers/media/usb/dvb-usb/az6027.c
@@ -394,6 +394,7 @@ static struct rc_map_table rc_map_az6027_table[] = {
/* remote control stuff (does not work with my box) */
static int az6027_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
{
+ *state = REMOTE_NO_KEY_PRESSED;
return 0;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 133/323] media: mtk-vpu: Fix a resource leak in the error handling path of mtk_vpu_probe()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 132/323] media: dvb-usb: fix ununit-value in az6027_rc_query Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 134/323] media: si470x: Avoid card name truncation Greg Kroah-Hartman
` (193 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Houlong Wei,
Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 2143ad413c05c7be24c3a92760e367b7f6aaac92 ]
A successful 'clk_prepare()' call should be balanced by a corresponding
'clk_unprepare()' call in the error handling path of the probe, as already
done in the remove function.
Update the error handling path accordingly.
Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Houlong Wei <houlong.wei@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mtk-vpu/mtk_vpu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c
index f8d35e3ac1dcc..9b57fb2857285 100644
--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c
+++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c
@@ -818,7 +818,8 @@ static int mtk_vpu_probe(struct platform_device *pdev)
vpu->wdt.wq = create_singlethread_workqueue("vpu_wdt");
if (!vpu->wdt.wq) {
dev_err(dev, "initialize wdt workqueue failed\n");
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto clk_unprepare;
}
INIT_WORK(&vpu->wdt.ws, vpu_wdt_reset_func);
mutex_init(&vpu->vpu_mutex);
@@ -917,6 +918,8 @@ disable_vpu_clk:
vpu_clock_disable(vpu);
workqueue_destroy:
destroy_workqueue(vpu->wdt.wq);
+clk_unprepare:
+ clk_unprepare(vpu->clk);
return ret;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 134/323] media: si470x: Avoid card name truncation
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 133/323] media: mtk-vpu: Fix a resource leak in the error handling path of mtk_vpu_probe() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 135/323] media: cx23885: Fix snd_card_free call on null card pointer Greg Kroah-Hartman
` (192 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Kees Cook,
Mauro Carvalho Chehab, Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit 2908249f3878a591f7918368fdf0b7b0a6c3158c ]
The "card" string only holds 31 characters (and the terminating NUL).
In order to avoid truncation, use a shorter card description instead of
the current result, "Silicon Labs Si470x FM Radio Re".
Suggested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 78656acdcf48 ("V4L/DVB (7038): USB radio driver for Silicon Labs Si470x FM Radio Receivers")
Fixes: cc35bbddfe10 ("V4L/DVB (12416): radio-si470x: add i2c driver for si470x")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
drivers/media/radio/si470x/radio-si470x-usb.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index aa12fd2663895..cc68bdac0c367 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -20,7 +20,7 @@
/* driver definitions */
#define DRIVER_AUTHOR "Joonyoung Shim <jy0922.shim@samsung.com>";
-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver"
+#define DRIVER_CARD "Silicon Labs Si470x FM Radio"
#define DRIVER_DESC "I2C radio driver for Si470x FM Radio Receivers"
#define DRIVER_VERSION "1.0.2"
diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
index 19e381dd58089..ba43a727c0b95 100644
--- a/drivers/media/radio/si470x/radio-si470x-usb.c
+++ b/drivers/media/radio/si470x/radio-si470x-usb.c
@@ -25,7 +25,7 @@
/* driver definitions */
#define DRIVER_AUTHOR "Tobias Lorenz <tobias.lorenz@gmx.net>"
-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver"
+#define DRIVER_CARD "Silicon Labs Si470x FM Radio"
#define DRIVER_DESC "USB radio driver for Si470x FM Radio Receivers"
#define DRIVER_VERSION "1.0.10"
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 135/323] media: cx23885: Fix snd_card_free call on null card pointer
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 134/323] media: si470x: Avoid card name truncation Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 136/323] cpuidle: Fix kobject memory leaks in error paths Greg Kroah-Hartman
` (191 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 7266dda2f1dfe151b12ef0c14eb4d4e622fb211c ]
Currently a call to snd_card_new that fails will set card with a NULL
pointer, this causes a null pointer dereference on the error cleanup
path when card it passed to snd_card_free. Fix this by adding a new
error exit path that does not call snd_card_free and exiting via this
new path.
Addresses-Coverity: ("Explicit null dereference")
Fixes: 9e44d63246a9 ("[media] cx23885: Add ALSA support")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx23885/cx23885-alsa.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/cx23885/cx23885-alsa.c b/drivers/media/pci/cx23885/cx23885-alsa.c
index db1e8ff35474a..150106eb36052 100644
--- a/drivers/media/pci/cx23885/cx23885-alsa.c
+++ b/drivers/media/pci/cx23885/cx23885-alsa.c
@@ -559,7 +559,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev)
SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1,
THIS_MODULE, sizeof(struct cx23885_audio_dev), &card);
if (err < 0)
- goto error;
+ goto error_msg;
chip = (struct cx23885_audio_dev *) card->private_data;
chip->dev = dev;
@@ -585,6 +585,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev)
error:
snd_card_free(card);
+error_msg:
pr_err("%s(): Failed to register analog audio adapter\n",
__func__);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 136/323] cpuidle: Fix kobject memory leaks in error paths
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 135/323] media: cx23885: Fix snd_card_free call on null card pointer Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 137/323] media: em28xx: Dont use ops->suspend if it is NULL Greg Kroah-Hartman
` (190 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anel Orazgaliyeva, Aman Priyadarshi,
Rafael J. Wysocki, Sasha Levin
From: Anel Orazgaliyeva <anelkz@amazon.de>
[ Upstream commit e5f5a66c9aa9c331da5527c2e3fd9394e7091e01 ]
Commit c343bf1ba5ef ("cpuidle: Fix three reference count leaks")
fixes the cleanup of kobjects; however, it removes kfree() calls
altogether, leading to memory leaks.
Fix those and also defer the initialization of dev->kobj_dev until
after the error check, so that we do not end up with a dangling
pointer.
Fixes: c343bf1ba5ef ("cpuidle: Fix three reference count leaks")
Signed-off-by: Anel Orazgaliyeva <anelkz@amazon.de>
Suggested-by: Aman Priyadarshi <apeureka@amazon.de>
[ rjw: Subject edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpuidle/sysfs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index 66979dc336807..d9b917529abaf 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -468,6 +468,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device)
&kdev->kobj, "state%d", i);
if (ret) {
kobject_put(&kobj->kobj);
+ kfree(kobj);
goto error_state;
}
cpuidle_add_s2idle_attr_group(kobj);
@@ -599,6 +600,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev)
&kdev->kobj, "driver");
if (ret) {
kobject_put(&kdrv->kobj);
+ kfree(kdrv);
return ret;
}
@@ -685,7 +687,6 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
if (!kdev)
return -ENOMEM;
kdev->dev = dev;
- dev->kobj_dev = kdev;
init_completion(&kdev->kobj_unregister);
@@ -693,9 +694,11 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
"cpuidle");
if (error) {
kobject_put(&kdev->kobj);
+ kfree(kdev);
return error;
}
+ dev->kobj_dev = kdev;
kobject_uevent(&kdev->kobj, KOBJ_ADD);
return 0;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 137/323] media: em28xx: Dont use ops->suspend if it is NULL
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 136/323] cpuidle: Fix kobject memory leaks in error paths Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 138/323] ath9k: Fix potential interrupt storm on queue reset Greg Kroah-Hartman
` (189 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 51fa3b70d27342baf1ea8aaab3e96e5f4f26d5b2 ]
The call to ops->suspend for the dev->dev_next case can currently
trigger a call on a null function pointer if ops->suspend is null.
Skip over the use of function ops->suspend if it is null.
Addresses-Coverity: ("Dereference after null check")
Fixes: be7fd3c3a8c5 ("media: em28xx: Hauppauge DualHD second tuner functionality")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/em28xx/em28xx-core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index d0f95a5cb4d23..437651307056f 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -1151,8 +1151,9 @@ int em28xx_suspend_extension(struct em28xx *dev)
dev_info(&dev->intf->dev, "Suspending extensions\n");
mutex_lock(&em28xx_devlist_mutex);
list_for_each_entry(ops, &em28xx_extension_devlist, next) {
- if (ops->suspend)
- ops->suspend(dev);
+ if (!ops->suspend)
+ continue;
+ ops->suspend(dev);
if (dev->dev_next)
ops->suspend(dev->dev_next);
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 138/323] ath9k: Fix potential interrupt storm on queue reset
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 137/323] media: em28xx: Dont use ops->suspend if it is NULL Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 139/323] media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() Greg Kroah-Hartman
` (188 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Simon Wunderlich,
Linus Lüssing, Linus Lüssing, Kalle Valo, Sasha Levin
From: Linus Lüssing <ll@simonwunderlich.de>
[ Upstream commit 4925642d541278575ad1948c5924d71ffd57ef14 ]
In tests with two Lima boards from 8devices (QCA4531 based) on OpenWrt
19.07 we could force a silent restart of a device with no serial
output when we were sending a high amount of UDP traffic (iperf3 at 80
MBit/s in both directions from external hosts, saturating the wifi and
causing a load of about 4.5 to 6) and were then triggering an
ath9k_queue_reset().
Further debugging showed that the restart was caused by the ath79
watchdog. With disabled watchdog we could observe that the device was
constantly going into ath_isr() interrupt handler and was returning
early after the ATH_OP_HW_RESET flag test, without clearing any
interrupts. Even though ath9k_queue_reset() calls
ath9k_hw_kill_interrupts().
With JTAG we could observe the following race condition:
1) ath9k_queue_reset()
...
-> ath9k_hw_kill_interrupts()
-> set_bit(ATH_OP_HW_RESET, &common->op_flags);
...
<- returns
2) ath9k_tasklet()
...
-> ath9k_hw_resume_interrupts()
...
<- returns
3) loops around:
...
handle_int()
-> ath_isr()
...
-> if (test_bit(ATH_OP_HW_RESET,
&common->op_flags))
return IRQ_HANDLED;
x) ath_reset_internal():
=> never reached <=
And in ath_isr() we would typically see the following interrupts /
interrupt causes:
* status: 0x00111030 or 0x00110030
* async_cause: 2 (AR_INTR_MAC_IPQ)
* sync_cause: 0
So the ath9k_tasklet() reenables the ath9k interrupts
through ath9k_hw_resume_interrupts() which ath9k_queue_reset() had just
disabled. And ath_isr() then keeps firing because it returns IRQ_HANDLED
without actually clearing the interrupt.
To fix this IRQ storm also clear/disable the interrupts again when we
are in reset state.
Cc: Sven Eckelmann <sven@narfation.org>
Cc: Simon Wunderlich <sw@simonwunderlich.de>
Cc: Linus Lüssing <linus.luessing@c0d3.blue>
Fixes: 872b5d814f99 ("ath9k: do not access hardware on IRQs during reset")
Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210914192515.9273-3-linus.luessing@c0d3.blue
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index a0097bebcba3b..ee1b9c39bad7a 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -530,8 +530,10 @@ irqreturn_t ath_isr(int irq, void *dev)
ath9k_debug_sync_cause(sc, sync_cause);
status &= ah->imask; /* discard unasked-for bits */
- if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
+ if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) {
+ ath9k_hw_kill_interrupts(sc->sc_ah);
return IRQ_HANDLED;
+ }
/*
* If there are no status bits set, then this interrupt was not
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 139/323] media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 138/323] ath9k: Fix potential interrupt storm on queue reset Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 140/323] crypto: qat - detect PFVF collision after ACK Greg Kroah-Hartman
` (187 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Evgeny Novikov, Kirill Shilimanov,
Sean Young, Mauro Carvalho Chehab, Sasha Levin
From: Evgeny Novikov <novikov@ispras.ru>
[ Upstream commit 69a10678e2fba3d182e78ea041f2d1b1a6058764 ]
mn88443x_cmn_power_on() did not handle possible errors of
clk_prepare_enable() and always finished successfully so that its caller
mn88443x_probe() did not care about failed preparing/enabling of clocks
as well.
Add missed error handling in both mn88443x_cmn_power_on() and
mn88443x_probe(). This required to change the return value of the former
from "void" to "int".
Found by Linux Driver Verification project (linuxtesting.org).
Fixes: 0f408ce8941f ("media: dvb-frontends: add Socionext MN88443x ISDB-S/T demodulator driver")
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Co-developed-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
Signed-off-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/mn88443x.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/media/dvb-frontends/mn88443x.c b/drivers/media/dvb-frontends/mn88443x.c
index 9ec1aeef03d5a..53981ff9422e0 100644
--- a/drivers/media/dvb-frontends/mn88443x.c
+++ b/drivers/media/dvb-frontends/mn88443x.c
@@ -204,11 +204,18 @@ struct mn88443x_priv {
struct regmap *regmap_t;
};
-static void mn88443x_cmn_power_on(struct mn88443x_priv *chip)
+static int mn88443x_cmn_power_on(struct mn88443x_priv *chip)
{
+ struct device *dev = &chip->client_s->dev;
struct regmap *r_t = chip->regmap_t;
+ int ret;
- clk_prepare_enable(chip->mclk);
+ ret = clk_prepare_enable(chip->mclk);
+ if (ret) {
+ dev_err(dev, "Failed to prepare and enable mclk: %d\n",
+ ret);
+ return ret;
+ }
gpiod_set_value_cansleep(chip->reset_gpio, 1);
usleep_range(100, 1000);
@@ -222,6 +229,8 @@ static void mn88443x_cmn_power_on(struct mn88443x_priv *chip)
} else {
regmap_write(r_t, HIZSET3, 0x8f);
}
+
+ return 0;
}
static void mn88443x_cmn_power_off(struct mn88443x_priv *chip)
@@ -738,7 +747,10 @@ static int mn88443x_probe(struct i2c_client *client,
chip->fe.demodulator_priv = chip;
i2c_set_clientdata(client, chip);
- mn88443x_cmn_power_on(chip);
+ ret = mn88443x_cmn_power_on(chip);
+ if (ret)
+ goto err_i2c_t;
+
mn88443x_s_sleep(chip);
mn88443x_t_sleep(chip);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 140/323] crypto: qat - detect PFVF collision after ACK
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 139/323] media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 141/323] crypto: qat - disregard spurious PFVF interrupts Greg Kroah-Hartman
` (186 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Marco Chiappero,
Herbert Xu, Sasha Levin
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit 9b768e8a3909ac1ab39ed44a3933716da7761a6f ]
Detect a PFVF collision between the local and the remote function by
checking if the message on the PFVF CSR has been overwritten.
This is done after the remote function confirms that the message has
been received, by clearing the interrupt bit, or the maximum number of
attempts (ADF_IOV_MSG_ACK_MAX_RETRY) to check the CSR has been exceeded.
Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Co-developed-by: Marco Chiappero <marco.chiappero@intel.com>
Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index c64481160b711..72fd2bbbe704e 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -195,6 +195,13 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
val = ADF_CSR_RD(pmisc_bar_addr, pf2vf_offset);
} while ((val & int_bit) && (count++ < ADF_IOV_MSG_ACK_MAX_RETRY));
+ if (val != msg) {
+ dev_dbg(&GET_DEV(accel_dev),
+ "Collision - PFVF CSR overwritten by remote function\n");
+ ret = -EIO;
+ goto out;
+ }
+
if (val & int_bit) {
dev_dbg(&GET_DEV(accel_dev), "ACK not received from remote\n");
val &= ~int_bit;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 141/323] crypto: qat - disregard spurious PFVF interrupts
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 140/323] crypto: qat - detect PFVF collision after ACK Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 142/323] hwrng: mtk - Force runtime pm ops for sleep ops Greg Kroah-Hartman
` (185 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Marco Chiappero,
Herbert Xu, Sasha Levin
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit 18fcba469ba5359c1de7e3fb16f7b9e8cd1b8e02 ]
Upon receiving a PFVF message, check if the interrupt bit is set in the
message. If it is not, that means that the interrupt was probably
triggered by a collision. In this case, disregard the message and
re-enable the interrupts.
Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 6 ++++++
drivers/crypto/qat/qat_common/adf_vf_isr.c | 6 ++++++
2 files changed, 12 insertions(+)
diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index 72fd2bbbe704e..180016e157771 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -250,6 +250,11 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)
/* Read message from the VF */
msg = ADF_CSR_RD(pmisc_addr, hw_data->get_pf2vf_offset(vf_nr));
+ if (!(msg & ADF_VF2PF_INT)) {
+ dev_info(&GET_DEV(accel_dev),
+ "Spurious VF2PF interrupt, msg %X. Ignored\n", msg);
+ goto out;
+ }
/* To ACK, clear the VF2PFINT bit */
msg &= ~ADF_VF2PF_INT;
@@ -333,6 +338,7 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)
if (resp && adf_iov_putmsg(accel_dev, resp, vf_nr))
dev_err(&GET_DEV(accel_dev), "Failed to send response to VF\n");
+out:
/* re-enable interrupt on PF from this VF */
adf_enable_vf2pf_interrupts(accel_dev, (1 << vf_nr));
return;
diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
index ef90902c8200d..86274e3c6781d 100644
--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
@@ -123,6 +123,11 @@ static void adf_pf2vf_bh_handler(void *data)
/* Read the message from PF */
msg = ADF_CSR_RD(pmisc_bar_addr, hw_data->get_pf2vf_offset(0));
+ if (!(msg & ADF_PF2VF_INT)) {
+ dev_info(&GET_DEV(accel_dev),
+ "Spurious PF2VF interrupt, msg %X. Ignored\n", msg);
+ goto out;
+ }
if (!(msg & ADF_PF2VF_MSGORIGIN_SYSTEM))
/* Ignore legacy non-system (non-kernel) PF2VF messages */
@@ -171,6 +176,7 @@ static void adf_pf2vf_bh_handler(void *data)
msg &= ~ADF_PF2VF_INT;
ADF_CSR_WR(pmisc_bar_addr, hw_data->get_pf2vf_offset(0), msg);
+out:
/* Re-enable PF2VF interrupts */
adf_enable_pf2vf_interrupts(accel_dev);
return;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 142/323] hwrng: mtk - Force runtime pm ops for sleep ops
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 141/323] crypto: qat - disregard spurious PFVF interrupts Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 143/323] b43legacy: fix a lower bounds test Greg Kroah-Hartman
` (184 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Markus Schneider-Pargmann,
Herbert Xu, Sasha Levin
From: Markus Schneider-Pargmann <msp@baylibre.com>
[ Upstream commit b6f5f0c8f72d348b2d07b20d7b680ef13a7ffe98 ]
Currently mtk_rng_runtime_suspend/resume is called for both runtime pm
and system sleep operations.
This is wrong as these should only be runtime ops as the name already
suggests. Currently freezing the system will lead to a call to
mtk_rng_runtime_suspend even if the device currently isn't active. This
leads to a clock warning because it is disabled/unprepared although it
isn't enabled/prepared currently.
This patch fixes this by only setting the runtime pm ops and forces to
call the runtime pm ops from the system sleep ops as well if active but
not otherwise.
Fixes: 81d2b34508c6 ("hwrng: mtk - add runtime PM support")
Signed-off-by: Markus Schneider-Pargmann <msp@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/mtk-rng.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/char/hw_random/mtk-rng.c b/drivers/char/hw_random/mtk-rng.c
index 7f99cd52b40ef..8dc256c761137 100644
--- a/drivers/char/hw_random/mtk-rng.c
+++ b/drivers/char/hw_random/mtk-rng.c
@@ -182,8 +182,13 @@ static int mtk_rng_runtime_resume(struct device *dev)
return mtk_rng_init(&priv->rng);
}
-static UNIVERSAL_DEV_PM_OPS(mtk_rng_pm_ops, mtk_rng_runtime_suspend,
- mtk_rng_runtime_resume, NULL);
+static const struct dev_pm_ops mtk_rng_pm_ops = {
+ SET_RUNTIME_PM_OPS(mtk_rng_runtime_suspend,
+ mtk_rng_runtime_resume, NULL)
+ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+ pm_runtime_force_resume)
+};
+
#define MTK_RNG_PM_OPS (&mtk_rng_pm_ops)
#else /* CONFIG_PM */
#define MTK_RNG_PM_OPS NULL
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 143/323] b43legacy: fix a lower bounds test
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 142/323] hwrng: mtk - Force runtime pm ops for sleep ops Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 144/323] b43: " Greg Kroah-Hartman
` (183 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Michael Büsch,
Kalle Valo, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit c1c8380b0320ab757e60ed90efc8b1992a943256 ]
The problem is that "channel" is an unsigned int, when it's less 5 the
value of "channel - 5" is not a negative number as one would expect but
is very high positive value instead.
This means that "start" becomes a very high positive value. The result
of that is that we never enter the "for (i = start; i <= end; i++) {"
loop. Instead of storing the result from b43legacy_radio_aci_detect()
it just uses zero.
Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Michael Büsch <m@bues.ch>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211006073542.GD8404@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c
index eab1c93878468..8f845db23766b 100644
--- a/drivers/net/wireless/broadcom/b43legacy/radio.c
+++ b/drivers/net/wireless/broadcom/b43legacy/radio.c
@@ -299,7 +299,7 @@ u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev)
& 0x7FFF);
b43legacy_set_all_gains(dev, 3, 8, 1);
- start = (channel - 5 > 0) ? channel - 5 : 1;
+ start = (channel > 5) ? channel - 5 : 1;
end = (channel + 5 < 14) ? channel + 5 : 13;
for (i = start; i <= end; i++) {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 144/323] b43: fix a lower bounds test
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 143/323] b43legacy: fix a lower bounds test Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 145/323] mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured Greg Kroah-Hartman
` (182 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Michael Büsch,
Kalle Valo, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 9b793db5fca44d01f72d3564a168171acf7c4076 ]
The problem is that "channel" is an unsigned int, when it's less 5 the
value of "channel - 5" is not a negative number as one would expect but
is very high positive value instead.
This means that "start" becomes a very high positive value. The result
of that is that we never enter the "for (i = start; i <= end; i++) {"
loop. Instead of storing the result from b43legacy_radio_aci_detect()
it just uses zero.
Fixes: ef1a628d83fc ("b43: Implement dynamic PHY API")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Michael Büsch <m@bues.ch>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211006073621.GE8404@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/b43/phy_g.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/b43/phy_g.c b/drivers/net/wireless/broadcom/b43/phy_g.c
index f59c021664626..40e10d0b7cd73 100644
--- a/drivers/net/wireless/broadcom/b43/phy_g.c
+++ b/drivers/net/wireless/broadcom/b43/phy_g.c
@@ -2310,7 +2310,7 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev)
b43_phy_mask(dev, B43_PHY_G_CRS, 0x7FFF);
b43_set_all_gains(dev, 3, 8, 1);
- start = (channel - 5 > 0) ? channel - 5 : 1;
+ start = (channel > 5) ? channel - 5 : 1;
end = (channel + 5 < 14) ? channel + 5 : 13;
for (i = start; i <= end; i++) {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 145/323] mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 144/323] b43: " Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 146/323] memstick: avoid out-of-range warning Greg Kroah-Hartman
` (181 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tony Lindgren, Ulf Hansson, Sasha Levin
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 8e0e7bd38b1ec7f9e5d18725ad41828be4e09859 ]
If sdhci-omap is configured for an unused device instance and the device
is not set as disabled, we can get a NULL pointer dereference:
Unable to handle kernel NULL pointer dereference at virtual address
00000045
...
(regulator_set_voltage) from [<c07d7008>] (mmc_regulator_set_ocr+0x44/0xd0)
(mmc_regulator_set_ocr) from [<c07e2d80>] (sdhci_set_ios+0xa4/0x490)
(sdhci_set_ios) from [<c07ea690>] (sdhci_omap_set_ios+0x124/0x160)
(sdhci_omap_set_ios) from [<c07c8e94>] (mmc_power_up.part.0+0x3c/0x154)
(mmc_power_up.part.0) from [<c07c9d20>] (mmc_start_host+0x88/0x9c)
(mmc_start_host) from [<c07cad34>] (mmc_add_host+0x58/0x7c)
(mmc_add_host) from [<c07e2574>] (__sdhci_add_host+0xf0/0x22c)
(__sdhci_add_host) from [<c07eaf68>] (sdhci_omap_probe+0x318/0x72c)
(sdhci_omap_probe) from [<c06a39d8>] (platform_probe+0x58/0xb8)
AFAIK we are not seeing this with the devices configured in the mainline
kernel but this can cause issues for folks bringing up their boards.
Fixes: 7d326930d352 ("mmc: sdhci-omap: Add OMAP SDHCI driver")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210921110029.21944-2-tony@atomide.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/sdhci-omap.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
index 05ade7a2dd243..f5bff9e710fb2 100644
--- a/drivers/mmc/host/sdhci-omap.c
+++ b/drivers/mmc/host/sdhci-omap.c
@@ -690,7 +690,8 @@ static void sdhci_omap_set_power(struct sdhci_host *host, unsigned char mode,
{
struct mmc_host *mmc = host->mmc;
- mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+ if (!IS_ERR(mmc->supply.vmmc))
+ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
}
static int sdhci_omap_enable_dma(struct sdhci_host *host)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 146/323] memstick: avoid out-of-range warning
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 145/323] mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 147/323] memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() Greg Kroah-Hartman
` (180 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Ulf Hansson, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 4853396f03c3019eccf5cd113e464231e9ddf0b3 ]
clang-14 complains about a sanity check that always passes when the
page size is 64KB or larger:
drivers/memstick/core/ms_block.c:1739:21: error: result of comparison of constant 65536 with expression of type 'unsigned short' is always false [-Werror,-Wtautological-constant-out-of-range-compare]
if (msb->page_size > PAGE_SIZE) {
~~~~~~~~~~~~~~ ^ ~~~~~~~~~
This is fine, it will still work on all architectures, so just shut
up that warning with a cast.
Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20210927094520.696665-1-arnd@kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memstick/core/ms_block.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index 8a02f11076f9a..7aab26128f6d9 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1731,7 +1731,7 @@ static int msb_init_card(struct memstick_dev *card)
msb->pages_in_block = boot_block->attr.block_size * 2;
msb->block_size = msb->page_size * msb->pages_in_block;
- if (msb->page_size > PAGE_SIZE) {
+ if ((size_t)msb->page_size > PAGE_SIZE) {
/* this isn't supported by linux at all, anyway*/
dbg("device page %d size isn't supported", msb->page_size);
return -EINVAL;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 147/323] memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 146/323] memstick: avoid out-of-range warning Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 148/323] hwmon: Fix possible memleak in __hwmon_device_register() Greg Kroah-Hartman
` (179 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Ulf Hansson, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit beae4a6258e64af609ad5995cc6b6056eb0d898e ]
The "msh" pointer is device managed, meaning that memstick_alloc_host()
calls device_initialize() on it. That means that it can't be free
using kfree() but must instead be freed with memstick_free_host().
Otherwise it leads to a tiny memory leak of device resources.
Fixes: 60fdd931d577 ("memstick: add support for JMicron jmb38x MemoryStick host controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20211011123912.GD15188@kili
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memstick/host/jmb38x_ms.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c
index 29f5021d21ea6..0610d3c9f1318 100644
--- a/drivers/memstick/host/jmb38x_ms.c
+++ b/drivers/memstick/host/jmb38x_ms.c
@@ -907,7 +907,7 @@ static struct memstick_host *jmb38x_ms_alloc_host(struct jmb38x_ms *jm, int cnt)
iounmap(host->addr);
err_out_free:
- kfree(msh);
+ memstick_free_host(msh);
return NULL;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 148/323] hwmon: Fix possible memleak in __hwmon_device_register()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 147/323] memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 149/323] hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff Greg Kroah-Hartman
` (178 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
Guenter Roeck, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit ada61aa0b1184a8fda1a89a340c7d6cc4e59aee5 ]
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff888102740438 (size 8):
comm "27", pid 859, jiffies 4295031351 (age 143.992s)
hex dump (first 8 bytes):
68 77 6d 6f 6e 30 00 00 hwmon0..
backtrace:
[<00000000544b5996>] __kmalloc_track_caller+0x1a6/0x300
[<00000000df0d62b9>] kvasprintf+0xad/0x140
[<00000000d3d2a3da>] kvasprintf_const+0x62/0x190
[<000000005f8f0f29>] kobject_set_name_vargs+0x56/0x140
[<00000000b739e4b9>] dev_set_name+0xb0/0xe0
[<0000000095b69c25>] __hwmon_device_register+0xf19/0x1e50 [hwmon]
[<00000000a7e65b52>] hwmon_device_register_with_info+0xcb/0x110 [hwmon]
[<000000006f181e86>] devm_hwmon_device_register_with_info+0x85/0x100 [hwmon]
[<0000000081bdc567>] tmp421_probe+0x2d2/0x465 [tmp421]
[<00000000502cc3f8>] i2c_device_probe+0x4e1/0xbb0
[<00000000f90bda3b>] really_probe+0x285/0xc30
[<000000007eac7b77>] __driver_probe_device+0x35f/0x4f0
[<000000004953d43d>] driver_probe_device+0x4f/0x140
[<000000002ada2d41>] __device_attach_driver+0x24c/0x330
[<00000000b3977977>] bus_for_each_drv+0x15d/0x1e0
[<000000005bf2a8e3>] __device_attach+0x267/0x410
When device_register() returns an error, the name allocated in
dev_set_name() will be leaked, the put_device() should be used
instead of calling hwmon_dev_release() to give up the device
reference, then the name will be freed in kobject_cleanup().
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: bab2243ce189 ("hwmon: Introduce hwmon_device_register_with_groups")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20211012112758.2681084-1-yangyingliang@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/hwmon.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
index d34de21d43adb..c4051a3e63c29 100644
--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -631,8 +631,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
dev_set_drvdata(hdev, drvdata);
dev_set_name(hdev, HWMON_ID_FORMAT, id);
err = device_register(hdev);
- if (err)
- goto free_hwmon;
+ if (err) {
+ put_device(hdev);
+ goto ida_remove;
+ }
if (dev && dev->of_node && chip && chip->ops->read &&
chip->info[0]->type == hwmon_chip &&
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 149/323] hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 148/323] hwmon: Fix possible memleak in __hwmon_device_register() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 150/323] ath10k: fix max antenna gain unit Greg Kroah-Hartman
` (177 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zev Weiss, Guenter Roeck, Sasha Levin
From: Zev Weiss <zev@bewilderbeest.net>
[ Upstream commit b7931a7b0e0df4d2a25fedd895ad32c746b77bc1 ]
Maintaining this manually is error prone (there are currently only
five chips supported, not six); gcc can do it for us automatically.
Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
Fixes: 666c14906b49 ("hwmon: (pmbus/lm25066) Drop support for LM25063")
Link: https://lore.kernel.org/r/20210928092242.30036-5-zev@bewilderbeest.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/pmbus/lm25066.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c
index 6eafcbb75dcd9..e25b801490862 100644
--- a/drivers/hwmon/pmbus/lm25066.c
+++ b/drivers/hwmon/pmbus/lm25066.c
@@ -60,7 +60,7 @@ struct __coeff {
#define PSC_CURRENT_IN_L (PSC_NUM_CLASSES)
#define PSC_POWER_L (PSC_NUM_CLASSES + 1)
-static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = {
+static struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = {
[lm25056] = {
[PSC_VOLTAGE_IN] = {
.m = 16296,
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 150/323] ath10k: fix max antenna gain unit
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 149/323] hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 151/323] drm/msm: uninitialized variable in msm_gem_import() Greg Kroah-Hartman
` (176 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Kalle Valo, Sasha Levin
From: Sven Eckelmann <seckelmann@datto.com>
[ Upstream commit 0a491167fe0cf9f26062462de2a8688b96125d48 ]
Most of the txpower for the ath10k firmware is stored as twicepower (0.5 dB
steps). This isn't the case for max_antenna_gain - which is still expected
by the firmware as dB.
The firmware is converting it from dB to the internal (twicepower)
representation when it calculates the limits of a channel. This can be seen
in tpc_stats when configuring "12" as max_antenna_gain. Instead of the
expected 12 (6 dB), the tpc_stats shows 24 (12 dB).
Tested on QCA9888 and IPQ4019 with firmware 10.4-3.5.3-00057.
Fixes: 02256930d9b8 ("ath10k: use proper tx power unit")
Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20190611172131.6064-1-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/mac.c | 6 +++---
drivers/net/wireless/ath/ath10k/wmi.h | 3 +++
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 8102d684be594..6e4096fd66334 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -1003,7 +1003,7 @@ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
arg.channel.min_power = 0;
arg.channel.max_power = channel->max_power * 2;
arg.channel.max_reg_power = channel->max_reg_power * 2;
- arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
+ arg.channel.max_antenna_gain = channel->max_antenna_gain;
reinit_completion(&ar->vdev_setup_done);
@@ -1445,7 +1445,7 @@ static int ath10k_vdev_start_restart(struct ath10k_vif *arvif,
arg.channel.min_power = 0;
arg.channel.max_power = chandef->chan->max_power * 2;
arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
- arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2;
+ arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain;
if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
arg.ssid = arvif->u.ap.ssid;
@@ -3104,7 +3104,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
ch->min_power = 0;
ch->max_power = channel->max_power * 2;
ch->max_reg_power = channel->max_reg_power * 2;
- ch->max_antenna_gain = channel->max_antenna_gain * 2;
+ ch->max_antenna_gain = channel->max_antenna_gain;
ch->reg_class_id = 0; /* FIXME */
/* FIXME: why use only legacy modes, why not any
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 6bd63d1cd0395..1292f3235e32c 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -1988,7 +1988,9 @@ struct wmi_channel {
union {
__le32 reginfo1;
struct {
+ /* note: power unit is 1 dBm */
u8 antenna_max;
+ /* note: power unit is 0.5 dBm */
u8 max_tx_power;
} __packed;
} __packed;
@@ -2008,6 +2010,7 @@ struct wmi_channel_arg {
u32 min_power;
u32 max_power;
u32 max_reg_power;
+ /* note: power unit is 1 dBm */
u32 max_antenna_gain;
u32 reg_class_id;
enum wmi_phy_mode mode;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 151/323] drm/msm: uninitialized variable in msm_gem_import()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 150/323] ath10k: fix max antenna gain unit Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 152/323] net: stream: dont purge sk_error_queue in sk_stream_kill_queues() Greg Kroah-Hartman
` (175 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Rob Clark, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 2203bd0e5c12ffc53ffdd4fbd7b12d6ba27e0424 ]
The msm_gem_new_impl() function cleans up after itself so there is no
need to call drm_gem_object_put(). Conceptually, it does not make sense
to call a kref_put() function until after the reference counting has
been initialized which happens immediately after this call in the
drm_gem_(private_)object_init() functions.
In the msm_gem_import() function the "obj" pointer is uninitialized, so
it will lead to a crash.
Fixes: 05b849111c07 ("drm/msm: prime support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20211013081315.GG6010@kili
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_gem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 7c0b30c955c39..c551d84444976 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -965,7 +965,7 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
ret = msm_gem_new_impl(dev, size, flags, NULL, &obj, struct_mutex_locked);
if (ret)
- goto fail;
+ return ERR_PTR(ret);
if (use_vram) {
struct msm_gem_vma *vma;
@@ -1035,7 +1035,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
ret = msm_gem_new_impl(dev, size, MSM_BO_WC, dmabuf->resv, &obj, false);
if (ret)
- goto fail;
+ return ERR_PTR(ret);
drm_gem_private_object_init(dev, obj, size);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 152/323] net: stream: dont purge sk_error_queue in sk_stream_kill_queues()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 151/323] drm/msm: uninitialized variable in msm_gem_import() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 153/323] mmc: mxs-mmc: disable regulator on error and in the remove function Greg Kroah-Hartman
` (174 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jakub Kicinski, Eric Dumazet,
David S. Miller, Sasha Levin
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 ]
sk_stream_kill_queues() can be called on close when there are
still outstanding skbs to transmit. Those skbs may try to queue
notifications to the error queue (e.g. timestamps).
If sk_stream_kill_queues() purges the queue without taking
its lock the queue may get corrupted, and skbs leaked.
This shows up as a warning about an rmem leak:
WARNING: CPU: 24 PID: 0 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x...
The leak is always a multiple of 0x300 bytes (the value is in
%rax on my builds, so RAX: 0000000000000300). 0x300 is truesize of
an empty sk_buff. Indeed if we dump the socket state at the time
of the warning the sk_error_queue is often (but not always)
corrupted. The ->next pointer points back at the list head,
but not the ->prev pointer. Indeed we can find the leaked skb
by scanning the kernel memory for something that looks like
an skb with ->sk = socket in question, and ->truesize = 0x300.
The contents of ->cb[] of the skb confirms the suspicion that
it is indeed a timestamp notification (as generated in
__skb_complete_tx_timestamp()).
Removing purging of sk_error_queue should be okay, since
inet_sock_destruct() does it again once all socket refs
are gone. Eric suggests this may cause sockets that go
thru disconnect() to maintain notifications from the
previous incarnations of the socket, but that should be
okay since the race was there anyway, and disconnect()
is not exactly dependable.
Thanks to Jonathan Lemon and Omar Sandoval for help at various
stages of tracing the issue.
Fixes: cb9eff097831 ("net: new user space API for time stamping of incoming and outgoing packets")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/stream.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/net/core/stream.c b/net/core/stream.c
index 7f5eaa95a6756..3d98774cf1285 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -195,9 +195,6 @@ void sk_stream_kill_queues(struct sock *sk)
/* First the read buffer. */
__skb_queue_purge(&sk->sk_receive_queue);
- /* Next, the error queue. */
- __skb_queue_purge(&sk->sk_error_queue);
-
/* Next, the write queue. */
WARN_ON(!skb_queue_empty(&sk->sk_write_queue));
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 153/323] mmc: mxs-mmc: disable regulator on error and in the remove function
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 152/323] net: stream: dont purge sk_error_queue in sk_stream_kill_queues() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 154/323] platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning Greg Kroah-Hartman
` (173 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Ulf Hansson, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit ce5f6c2c9b0fcb4094f8e162cfd37fb4294204f7 ]
The 'reg_vmmc' regulator is enabled in the probe. It is never disabled.
Neither in the error handling path of the probe nor in the remove
function.
Register a devm_action to disable it when needed.
Fixes: 4dc5a79f1350 ("mmc: mxs-mmc: enable regulator for mmc slot")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/4aadb3c97835f7b80f00819c3d549e6130384e67.1634365151.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/mxs-mmc.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
index 7125687faf76a..d7601dc5e85dc 100644
--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -579,6 +579,11 @@ static const struct of_device_id mxs_mmc_dt_ids[] = {
};
MODULE_DEVICE_TABLE(of, mxs_mmc_dt_ids);
+static void mxs_mmc_regulator_disable(void *regulator)
+{
+ regulator_disable(regulator);
+}
+
static int mxs_mmc_probe(struct platform_device *pdev)
{
const struct of_device_id *of_id =
@@ -622,6 +627,11 @@ static int mxs_mmc_probe(struct platform_device *pdev)
"Failed to enable vmmc regulator: %d\n", ret);
goto out_mmc_free;
}
+
+ ret = devm_add_action_or_reset(&pdev->dev, mxs_mmc_regulator_disable,
+ reg_vmmc);
+ if (ret)
+ goto out_mmc_free;
}
ssp->clk = devm_clk_get(&pdev->dev, NULL);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 154/323] platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 153/323] mmc: mxs-mmc: disable regulator on error and in the remove function Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 155/323] rsi: stop thread firstly in rsi_91x_init() error handling Greg Kroah-Hartman
` (172 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tor Vic, Nathan Chancellor,
Nick Desaulniers, Hans de Goede, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit fd96e35ea7b95f1e216277805be89d66e4ae962d ]
A new warning in clang points out a use of bitwise OR with boolean
expressions in this driver:
drivers/platform/x86/thinkpad_acpi.c:9061:11: error: use of bitwise '|' with boolean operands [-Werror,-Wbitwise-instead-of-logical]
else if ((strlencmp(cmd, "level disengaged") == 0) |
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
||
drivers/platform/x86/thinkpad_acpi.c:9061:11: note: cast one or both operands to int to silence this warning
1 error generated.
This should clearly be a logical OR so change it to fix the warning.
Fixes: fe98a52ce754 ("ACPI: thinkpad-acpi: add sysfs support to fan subdriver")
Link: https://github.com/ClangBuiltLinux/linux/issues/1476
Reported-by: Tor Vic <torvic9@mailbox.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/r/20211018182537.2316800-1-nathan@kernel.org
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/thinkpad_acpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 35c7d3185fea3..fa8bcbe3d2762 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -9124,7 +9124,7 @@ static int fan_write_cmd_level(const char *cmd, int *rc)
if (strlencmp(cmd, "level auto") == 0)
level = TP_EC_FAN_AUTO;
- else if ((strlencmp(cmd, "level disengaged") == 0) |
+ else if ((strlencmp(cmd, "level disengaged") == 0) ||
(strlencmp(cmd, "level full-speed") == 0))
level = TP_EC_FAN_FULLSPEED;
else if (sscanf(cmd, "level %d", &level) != 1)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 155/323] rsi: stop thread firstly in rsi_91x_init() error handling
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 154/323] platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 156/323] mwifiex: Send DELBA requests according to spec Greg Kroah-Hartman
` (171 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ziyang Xuan, Kalle Valo, Sasha Levin
From: Ziyang Xuan <william.xuanziyang@huawei.com>
[ Upstream commit 515e7184bdf0a3ebf1757cc77fb046b4fe282189 ]
When fail to init coex module, free 'common' and 'adapter' directly, but
common->tx_thread which will access 'common' and 'adapter' is running at
the same time. That will trigger the UAF bug.
==================================================================
BUG: KASAN: use-after-free in rsi_tx_scheduler_thread+0x50f/0x520 [rsi_91x]
Read of size 8 at addr ffff8880076dc000 by task Tx-Thread/124777
CPU: 0 PID: 124777 Comm: Tx-Thread Not tainted 5.15.0-rc5+ #19
Call Trace:
dump_stack_lvl+0xe2/0x152
print_address_description.constprop.0+0x21/0x140
? rsi_tx_scheduler_thread+0x50f/0x520
kasan_report.cold+0x7f/0x11b
? rsi_tx_scheduler_thread+0x50f/0x520
rsi_tx_scheduler_thread+0x50f/0x520
...
Freed by task 111873:
kasan_save_stack+0x1b/0x40
kasan_set_track+0x1c/0x30
kasan_set_free_info+0x20/0x30
__kasan_slab_free+0x109/0x140
kfree+0x117/0x4c0
rsi_91x_init+0x741/0x8a0 [rsi_91x]
rsi_probe+0x9f/0x1750 [rsi_usb]
Stop thread before free 'common' and 'adapter' to fix it.
Fixes: 2108df3c4b18 ("rsi: add coex support")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211015040335.1021546-1-william.xuanziyang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/rsi/rsi_91x_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c
index a376d3d78e42c..d90d8ab56fa28 100644
--- a/drivers/net/wireless/rsi/rsi_91x_main.c
+++ b/drivers/net/wireless/rsi/rsi_91x_main.c
@@ -373,6 +373,7 @@ struct rsi_hw *rsi_91x_init(u16 oper_mode)
if (common->coex_mode > 1) {
if (rsi_coex_attach(common)) {
rsi_dbg(ERR_ZONE, "Failed to init coex module\n");
+ rsi_kill_thread(&common->tx_thread);
goto err;
}
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 156/323] mwifiex: Send DELBA requests according to spec
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 155/323] rsi: stop thread firstly in rsi_91x_init() error handling Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 157/323] phy: micrel: ksz8041nl: do not use power down mode Greg Kroah-Hartman
` (170 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonas Dreßler, Pali Rohár,
Kalle Valo, Sasha Levin
From: Jonas Dreßler <verdre@v0yd.nl>
[ Upstream commit cc8a8bc37466f79b24d972555237f3d591150602 ]
While looking at on-air packets using Wireshark, I noticed we're never
setting the initiator bit when sending DELBA requests to the AP: While
we set the bit on our del_ba_param_set bitmask, we forget to actually
copy that bitmask over to the command struct, which means we never
actually set the initiator bit.
Fix that and copy the bitmask over to the host_cmd_ds_11n_delba command
struct.
Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
Acked-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211016153244.24353-5-verdre@v0yd.nl
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/11n.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
index 5d75c971004b4..5dcc305cc8127 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n.c
@@ -664,14 +664,15 @@ int mwifiex_send_delba(struct mwifiex_private *priv, int tid, u8 *peer_mac,
uint16_t del_ba_param_set;
memset(&delba, 0, sizeof(delba));
- delba.del_ba_param_set = cpu_to_le16(tid << DELBA_TID_POS);
- del_ba_param_set = le16_to_cpu(delba.del_ba_param_set);
+ del_ba_param_set = tid << DELBA_TID_POS;
+
if (initiator)
del_ba_param_set |= IEEE80211_DELBA_PARAM_INITIATOR_MASK;
else
del_ba_param_set &= ~IEEE80211_DELBA_PARAM_INITIATOR_MASK;
+ delba.del_ba_param_set = cpu_to_le16(del_ba_param_set);
memcpy(&delba.peer_mac_addr, peer_mac, ETH_ALEN);
/* We don't wait for the response of this command */
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 157/323] phy: micrel: ksz8041nl: do not use power down mode
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 156/323] mwifiex: Send DELBA requests according to spec Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 158/323] nvme-rdma: fix error code in nvme_rdma_setup_ctrl Greg Kroah-Hartman
` (169 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Agner, Marcel Ziswiler,
Francesco Dolcini, David S. Miller, Sasha Levin
From: Stefan Agner <stefan@agner.ch>
[ Upstream commit 2641b62d2fab52648e34cdc6994b2eacde2d27c1 ]
Some Micrel KSZ8041NL PHY chips exhibit continuous RX errors after using
the power down mode bit (0.11). If the PHY is taken out of power down
mode in a certain temperature range, the PHY enters a weird state which
leads to continuously reporting RX errors. In that state, the MAC is not
able to receive or send any Ethernet frames and the activity LED is
constantly blinking. Since Linux is using the suspend callback when the
interface is taken down, ending up in that state can easily happen
during a normal startup.
Micrel confirmed the issue in errata DS80000700A [*], caused by abnormal
clock recovery when using power down mode. Even the latest revision (A4,
Revision ID 0x1513) seems to suffer that problem, and according to the
errata is not going to be fixed.
Remove the suspend/resume callback to avoid using the power down mode
completely.
[*] https://ww1.microchip.com/downloads/en/DeviceDoc/80000700A.pdf
Fixes: 1a5465f5d6a2 ("phy/micrel: Add suspend/resume support to Micrel PHYs")
Signed-off-by: Stefan Agner <stefan@agner.ch>
Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/micrel.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 55caaaf969da5..0135903300595 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -880,8 +880,9 @@ static struct phy_driver ksphy_driver[] = {
.get_sset_count = kszphy_get_sset_count,
.get_strings = kszphy_get_strings,
.get_stats = kszphy_get_stats,
- .suspend = genphy_suspend,
- .resume = genphy_resume,
+ /* No suspend/resume callbacks because of errata DS80000700A,
+ * receiver error following software power down.
+ */
}, {
.phy_id = PHY_ID_KSZ8041RNLI,
.phy_id_mask = MICREL_PHY_ID_MASK,
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 158/323] nvme-rdma: fix error code in nvme_rdma_setup_ctrl
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 157/323] phy: micrel: ksz8041nl: do not use power down mode Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 159/323] PM: hibernate: fix sparse warnings Greg Kroah-Hartman
` (168 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Max Gurtovoy, Sagi Grimberg,
Christoph Hellwig, Sasha Levin
From: Max Gurtovoy <mgurtovoy@nvidia.com>
[ Upstream commit 09748122009aed7bfaa7acc33c10c083a4758322 ]
In case that icdoff is not zero or mandatory keyed sgls are not
supported by the NVMe/RDMA target, we'll go to error flow but we'll
return 0 to the caller. Fix it by returning an appropriate error code.
Fixes: c66e2998c8ca ("nvme-rdma: centralize controller setup sequence")
Signed-off-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/rdma.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index ffd6a7204509a..1f41cf80f827c 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -967,11 +967,13 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new)
return ret;
if (ctrl->ctrl.icdoff) {
+ ret = -EOPNOTSUPP;
dev_err(ctrl->ctrl.device, "icdoff is not supported!\n");
goto destroy_admin;
}
if (!(ctrl->ctrl.sgls & (1 << 2))) {
+ ret = -EOPNOTSUPP;
dev_err(ctrl->ctrl.device,
"Mandatory keyed sgls are not supported!\n");
goto destroy_admin;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 159/323] PM: hibernate: fix sparse warnings
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 158/323] nvme-rdma: fix error code in nvme_rdma_setup_ctrl Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 160/323] clocksource/drivers/timer-ti-dm: Select TIMER_OF Greg Kroah-Hartman
` (167 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anders Roxell, Rafael J. Wysocki,
Sasha Levin
From: Anders Roxell <anders.roxell@linaro.org>
[ Upstream commit 01de5fcd8b1ac0ca28d2bb0921226a54fdd62684 ]
When building the kernel with sparse enabled 'C=1' the following
warnings shows up:
kernel/power/swap.c:390:29: warning: incorrect type in assignment (different base types)
kernel/power/swap.c:390:29: expected int ret
kernel/power/swap.c:390:29: got restricted blk_status_t
This is due to function hib_wait_io() returns a 'blk_status_t' which is
a bitwise u8. Commit 5416da01ff6e ("PM: hibernate: Remove
blk_status_to_errno in hib_wait_io") seemed to have mixed up the return
type. However, the 4e4cbee93d56 ("block: switch bios to blk_status_t")
actually broke the behaviour by returning the wrong type.
Rework so function hib_wait_io() returns a 'int' instead of
'blk_status_t' and make sure to call function
blk_status_to_errno(hb->error)' when returning from function
hib_wait_io() a int gets returned.
Fixes: 4e4cbee93d56 ("block: switch bios to blk_status_t")
Fixes: 5416da01ff6e ("PM: hibernate: Remove blk_status_to_errno in hib_wait_io")
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/power/swap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index b5b97df142d26..9db7f2f93fae3 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -294,7 +294,7 @@ static int hib_submit_io(int op, int op_flags, pgoff_t page_off, void *addr,
return error;
}
-static blk_status_t hib_wait_io(struct hib_bio_batch *hb)
+static int hib_wait_io(struct hib_bio_batch *hb)
{
wait_event(hb->wait, atomic_read(&hb->count) == 0);
return blk_status_to_errno(hb->error);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 160/323] clocksource/drivers/timer-ti-dm: Select TIMER_OF
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 159/323] PM: hibernate: fix sparse warnings Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 161/323] drm/msm: Fix potential NULL dereference in DPU SSPP Greg Kroah-Hartman
` (166 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Tony Lindgren,
Daniel Lezcano, Keerthy, Sebastian Reichel, Ladislav Michl,
Grygorii Strashko, linux-omap, Kees Cook, Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit eda9a4f7af6ee47e9e131f20e4f8a41a97379293 ]
When building OMAP_DM_TIMER without TIMER_OF, there are orphan sections
due to the use of TIMER_OF_DELCARE() without CONFIG_TIMER_OF. Select
CONFIG_TIMER_OF when enaling OMAP_DM_TIMER:
arm-linux-gnueabi-ld: warning: orphan section `__timer_of_table' from `drivers/clocksource/timer-ti-dm-systimer.o' being placed in section `__timer_of_table'
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/lkml/202108282255.tkdt4ani-lkp@intel.com/
Cc: Tony Lindgren <tony@atomide.com>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: Keerthy <j-keerthy@ti.com>
Cc: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Cc: Ladislav Michl <ladis@linux-mips.org>
Cc: Grygorii Strashko <grygorii.strashko@ti.com>
Cc: linux-omap@vger.kernel.org
Fixes: 52762fbd1c47 ("clocksource/drivers/timer-ti-dm: Add clockevent and clocksource support")
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210828175747.3777891-1-keescook@chromium.org
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 4d37f018d846c..06504384c3765 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -23,6 +23,7 @@ config I8253_LOCK
config OMAP_DM_TIMER
bool
+ select TIMER_OF
config CLKBLD_I8253
def_bool y if CLKSRC_I8253 || CLKEVT_I8253 || I8253_LOCK
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 161/323] drm/msm: Fix potential NULL dereference in DPU SSPP
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 160/323] clocksource/drivers/timer-ti-dm: Select TIMER_OF Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 162/323] smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi Greg Kroah-Hartman
` (165 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jessica Zhang,
Rob Clark, Sasha Levin
From: Jessica Zhang <jesszhan@codeaurora.org>
[ Upstream commit 8bf71a5719b6cc5b6ba358096081e5d50ea23ab6 ]
Move initialization of sblk in _sspp_subblk_offset() after NULL check to
avoid potential NULL pointer dereference.
Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jessica Zhang <jesszhan@codeaurora.org>
Link: https://lore.kernel.org/r/20211020175733.3379-1-jesszhan@codeaurora.org
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c
index c25b52a6b2198..7db24e9df4b9b 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c
@@ -146,11 +146,13 @@ static inline int _sspp_subblk_offset(struct dpu_hw_pipe *ctx,
u32 *idx)
{
int rc = 0;
- const struct dpu_sspp_sub_blks *sblk = ctx->cap->sblk;
+ const struct dpu_sspp_sub_blks *sblk;
- if (!ctx)
+ if (!ctx || !ctx->cap || !ctx->cap->sblk)
return -EINVAL;
+ sblk = ctx->cap->sblk;
+
switch (s_id) {
case DPU_SSPP_SRC:
*idx = sblk->src_blk.base;
@@ -413,7 +415,7 @@ static void _dpu_hw_sspp_setup_scaler3(struct dpu_hw_pipe *ctx,
(void)pe;
if (_sspp_subblk_offset(ctx, DPU_SSPP_SCALER_QSEED3, &idx) || !sspp
- || !scaler3_cfg || !ctx || !ctx->cap || !ctx->cap->sblk)
+ || !scaler3_cfg)
return;
dpu_hw_setup_scaler3(&ctx->hw, scaler3_cfg, idx,
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 162/323] smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 161/323] drm/msm: Fix potential NULL dereference in DPU SSPP Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 163/323] s390/gmap: dont unconditionally call pte_unmap_unlock() in __gmap_zap() Greg Kroah-Hartman
` (164 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot, Tetsuo Handa,
Casey Schaufler, Sasha Levin
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
[ Upstream commit 0934ad42bb2c5df90a1b9de690f93de735b622fe ]
syzbot is reporting UAF at cipso_v4_doi_search() [1], for smk_cipso_doi()
is calling kfree() without removing from the cipso_v4_doi_list list after
netlbl_cfg_cipsov4_map_add() returned an error. We need to use
netlbl_cfg_cipsov4_del() in order to remove from the list and wait for
RCU grace period before kfree().
Link: https://syzkaller.appspot.com/bug?extid=93dba5b91f0fed312cbd [1]
Reported-by: syzbot <syzbot+93dba5b91f0fed312cbd@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6c2e8ac0953fccdd ("netlabel: Update kernel configuration API")
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smackfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 9fdf404a318f9..a9c516362170a 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -740,7 +740,7 @@ static void smk_cipso_doi(void)
if (rc != 0) {
printk(KERN_WARNING "%s:%d map add rc = %d\n",
__func__, __LINE__, rc);
- kfree(doip);
+ netlbl_cfg_cipsov4_del(doip->doi, &nai);
return;
}
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 163/323] s390/gmap: dont unconditionally call pte_unmap_unlock() in __gmap_zap()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 162/323] smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 164/323] irq: mips: avoid nested irq_enter() Greg Kroah-Hartman
` (163 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Hildenbrand, Claudio Imbrenda,
Heiko Carstens, Christian Borntraeger, Sasha Levin
From: David Hildenbrand <david@redhat.com>
[ Upstream commit b159f94c86b43cf7e73e654bc527255b1f4eafc4 ]
... otherwise we will try unlocking a spinlock that was never locked via a
garbage pointer.
At the time we reach this code path, we usually successfully looked up
a PGSTE already; however, evil user space could have manipulated the VMA
layout in the meantime and triggered removal of the page table.
Fixes: 1e133ab296f3 ("s390/mm: split arch/s390/mm/pgtable.c")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Link: https://lore.kernel.org/r/20210909162248.14969-3-david@redhat.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/mm/gmap.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
index 7cde0f2f52e14..65ccb9d797270 100644
--- a/arch/s390/mm/gmap.c
+++ b/arch/s390/mm/gmap.c
@@ -684,9 +684,10 @@ void __gmap_zap(struct gmap *gmap, unsigned long gaddr)
vmaddr |= gaddr & ~PMD_MASK;
/* Get pointer to the page table entry */
ptep = get_locked_pte(gmap->mm, vmaddr, &ptl);
- if (likely(ptep))
+ if (likely(ptep)) {
ptep_zap_unused(gmap->mm, vmaddr, ptep, 0);
- pte_unmap_unlock(ptep, ptl);
+ pte_unmap_unlock(ptep, ptl);
+ }
}
}
EXPORT_SYMBOL_GPL(__gmap_zap);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 164/323] irq: mips: avoid nested irq_enter()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 163/323] s390/gmap: dont unconditionally call pte_unmap_unlock() in __gmap_zap() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 165/323] tcp: dont free a FIN sk_buff in tcp_remove_empty_skb() Greg Kroah-Hartman
` (162 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Rutland, Marc Zyngier,
Thomas Bogendoerfer, Thomas Gleixner, Sasha Levin
From: Mark Rutland <mark.rutland@arm.com>
[ Upstream commit c65b52d02f6c1a06ddb20cba175ad49eccd6410d ]
As bcm6345_l1_irq_handle() is a chained irqchip handler, it will be
invoked within the context of the root irqchip handler, which must have
entered IRQ context already.
When bcm6345_l1_irq_handle() calls arch/mips's do_IRQ() , this will nest
another call to irq_enter(), and the resulting nested increment to
`rcu_data.dynticks_nmi_nesting` will cause rcu_is_cpu_rrupt_from_idle()
to fail to identify wakeups from idle, resulting in failure to preempt,
and RCU stalls.
Chained irqchip handlers must invoke IRQ handlers by way of thee core
irqchip code, i.e. generic_handle_irq() or generic_handle_domain_irq()
and should not call do_IRQ(), which is intended only for root irqchip
handlers.
Fix bcm6345_l1_irq_handle() by calling generic_handle_irq() directly.
Fixes: c7c42ec2baa1de7a ("irqchips/bmips: Add bcm6345-l1 interrupt controller")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-bcm6345-l1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-bcm6345-l1.c b/drivers/irqchip/irq-bcm6345-l1.c
index 43f8abe40878a..31ea6332ecb83 100644
--- a/drivers/irqchip/irq-bcm6345-l1.c
+++ b/drivers/irqchip/irq-bcm6345-l1.c
@@ -143,7 +143,7 @@ static void bcm6345_l1_irq_handle(struct irq_desc *desc)
for_each_set_bit(hwirq, &pending, IRQS_PER_WORD) {
irq = irq_linear_revmap(intc->domain, base + hwirq);
if (irq)
- do_IRQ(irq);
+ generic_handle_irq(irq);
else
spurious_interrupt();
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 165/323] tcp: dont free a FIN sk_buff in tcp_remove_empty_skb()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 164/323] irq: mips: avoid nested irq_enter() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 166/323] samples/kretprobes: Fix return value if register_kretprobe() failed Greg Kroah-Hartman
` (161 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jon Maxwell, Monir Zouaoui,
Simon Stier, Eric Dumazet, David S. Miller, Sasha Levin
From: Jon Maxwell <jmaxwell37@gmail.com>
[ Upstream commit cf12e6f9124629b18a6182deefc0315f0a73a199 ]
v1: Implement a more general statement as recommended by Eric Dumazet. The
sequence number will be advanced, so this check will fix the FIN case and
other cases.
A customer reported sockets stuck in the CLOSING state. A Vmcore revealed that
the write_queue was not empty as determined by tcp_write_queue_empty() but the
sk_buff containing the FIN flag had been freed and the socket was zombied in
that state. Corresponding pcaps show no FIN from the Linux kernel on the wire.
Some instrumentation was added to the kernel and it was found that there is a
timing window where tcp_sendmsg() can run after tcp_send_fin().
tcp_sendmsg() will hit an error, for example:
1269 ▹ if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))↩
1270 ▹ ▹ goto do_error;↩
tcp_remove_empty_skb() will then free the FIN sk_buff as "skb->len == 0". The
TCP socket is now wedged in the FIN-WAIT-1 state because the FIN is never sent.
If the other side sends a FIN packet the socket will transition to CLOSING and
remain that way until the system is rebooted.
Fix this by checking for the FIN flag in the sk_buff and don't free it if that
is the case. Testing confirmed that fixed the issue.
Fixes: fdfc5c8594c2 ("tcp: remove empty skb from write queue in error cases")
Signed-off-by: Jon Maxwell <jmaxwell37@gmail.com>
Reported-by: Monir Zouaoui <Monir.Zouaoui@mail.schwarz>
Reported-by: Simon Stier <simon.stier@mail.schwarz>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 769e1f683471a..4dce1b418acc2 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -952,7 +952,7 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags)
*/
static void tcp_remove_empty_skb(struct sock *sk, struct sk_buff *skb)
{
- if (skb && !skb->len) {
+ if (skb && TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) {
tcp_unlink_write_queue(skb, sk);
if (tcp_write_queue_empty(sk))
tcp_chrono_stop(sk, TCP_CHRONO_BUSY);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 166/323] samples/kretprobes: Fix return value if register_kretprobe() failed
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 165/323] tcp: dont free a FIN sk_buff in tcp_remove_empty_skb() Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 167/323] KVM: s390: Fix handle_sske page fault handling Greg Kroah-Hartman
` (160 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tiezhu Yang, Masami Hiramatsu,
Steven Rostedt (VMware),
Sasha Levin
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit f76fbbbb5061fe14824ba5807c44bd7400a6b4e1 ]
Use the actual return value instead of always -1 if register_kretprobe()
failed.
E.g. without this patch:
# insmod samples/kprobes/kretprobe_example.ko func=no_such_func
insmod: ERROR: could not insert module samples/kprobes/kretprobe_example.ko: Operation not permitted
With this patch:
# insmod samples/kprobes/kretprobe_example.ko func=no_such_func
insmod: ERROR: could not insert module samples/kprobes/kretprobe_example.ko: Unknown symbol in module
Link: https://lkml.kernel.org/r/1635213091-24387-2-git-send-email-yangtiezhu@loongson.cn
Fixes: 804defea1c02 ("Kprobes: move kprobe examples to samples/")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
samples/kprobes/kretprobe_example.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/samples/kprobes/kretprobe_example.c b/samples/kprobes/kretprobe_example.c
index 7f9060f435cde..da6de5e78e1dd 100644
--- a/samples/kprobes/kretprobe_example.c
+++ b/samples/kprobes/kretprobe_example.c
@@ -83,7 +83,7 @@ static int __init kretprobe_init(void)
ret = register_kretprobe(&my_kretprobe);
if (ret < 0) {
pr_err("register_kretprobe failed, returned %d\n", ret);
- return -1;
+ return ret;
}
pr_info("Planted return probe at %s: %p\n",
my_kretprobe.kp.symbol_name, my_kretprobe.kp.addr);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 167/323] KVM: s390: Fix handle_sske page fault handling
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 166/323] samples/kretprobes: Fix return value if register_kretprobe() failed Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 168/323] libertas_tf: Fix possible memory leak in probe and disconnect Greg Kroah-Hartman
` (159 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Janis Schoetterl-Glausch,
Christian Borntraeger, Claudio Imbrenda, Sasha Levin
From: Janis Schoetterl-Glausch <scgl@linux.ibm.com>
[ Upstream commit 85f517b29418158d3e6e90c3f0fc01b306d2f1a1 ]
If handle_sske cannot set the storage key, because there is no
page table entry or no present large page entry, it calls
fixup_user_fault.
However, currently, if the call succeeds, handle_sske returns
-EAGAIN, without having set the storage key.
Instead, retry by continue'ing the loop without incrementing the
address.
The same issue in handle_pfmf was fixed by
a11bdb1a6b78 ("KVM: s390: Fix pfmf and conditional skey emulation").
Fixes: bd096f644319 ("KVM: s390: Add skey emulation fault handling")
Signed-off-by: Janis Schoetterl-Glausch <scgl@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Link: https://lore.kernel.org/r/20211022152648.26536-1-scgl@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kvm/priv.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index 8679bd74d337a..9abdfb8b1a1ea 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -397,6 +397,8 @@ static int handle_sske(struct kvm_vcpu *vcpu)
up_read(¤t->mm->mmap_sem);
if (rc == -EFAULT)
return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+ if (rc == -EAGAIN)
+ continue;
if (rc < 0)
return rc;
start += PAGE_SIZE;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 168/323] libertas_tf: Fix possible memory leak in probe and disconnect
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 167/323] KVM: s390: Fix handle_sske page fault handling Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 169/323] libertas: " Greg Kroah-Hartman
` (158 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Kalle Valo,
Sasha Levin
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit d549107305b4634c81223a853701c06bcf657bc3 ]
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff88810a2ddc00 (size 512):
comm "kworker/6:1", pid 176, jiffies 4295009893 (age 757.220s)
hex dump (first 32 bytes):
00 50 05 18 81 88 ff ff 00 00 00 00 00 00 00 00 .P..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8167939c>] slab_post_alloc_hook+0x9c/0x490
[<ffffffff8167f627>] kmem_cache_alloc_trace+0x1f7/0x470
[<ffffffffa02a1530>] if_usb_probe+0x60/0x37c [libertas_tf_usb]
[<ffffffffa022668a>] usb_probe_interface+0x1aa/0x3c0 [usbcore]
[<ffffffff82b59630>] really_probe+0x190/0x480
[<ffffffff82b59a19>] __driver_probe_device+0xf9/0x180
[<ffffffff82b59af3>] driver_probe_device+0x53/0x130
[<ffffffff82b5a075>] __device_attach_driver+0x105/0x130
[<ffffffff82b55949>] bus_for_each_drv+0x129/0x190
[<ffffffff82b593c9>] __device_attach+0x1c9/0x270
[<ffffffff82b5a250>] device_initial_probe+0x20/0x30
[<ffffffff82b579c2>] bus_probe_device+0x142/0x160
[<ffffffff82b52e49>] device_add+0x829/0x1300
[<ffffffffa02229b1>] usb_set_configuration+0xb01/0xcc0 [usbcore]
[<ffffffffa0235c4e>] usb_generic_driver_probe+0x6e/0x90 [usbcore]
[<ffffffffa022641f>] usb_probe_device+0x6f/0x130 [usbcore]
cardp is missing being freed in the error handling path of the probe
and the path of the disconnect, which will cause memory leak.
This patch adds the missing kfree().
Fixes: c305a19a0d0a ("libertas_tf: usb specific functions")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211020120345.2016045-2-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
index 6ede6168bd85a..60941c319b421 100644
--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
@@ -234,6 +234,7 @@ static int if_usb_probe(struct usb_interface *intf,
dealloc:
if_usb_free(cardp);
+ kfree(cardp);
error:
lbtf_deb_leave(LBTF_DEB_MAIN);
return -ENOMEM;
@@ -258,6 +259,7 @@ static void if_usb_disconnect(struct usb_interface *intf)
/* Unlink and free urb */
if_usb_free(cardp);
+ kfree(cardp);
usb_set_intfdata(intf, NULL);
usb_put_dev(interface_to_usbdev(intf));
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 169/323] libertas: Fix possible memory leak in probe and disconnect
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 168/323] libertas_tf: Fix possible memory leak in probe and disconnect Greg Kroah-Hartman
@ 2021-11-24 11:55 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 170/323] wcn36xx: add proper DMA memory barriers in rx path Greg Kroah-Hartman
` (157 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:55 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Kalle Valo,
Sasha Levin
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit 9692151e2fe7a326bafe99836fd1f20a2cc3a049 ]
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff88812c7d7400 (size 512):
comm "kworker/6:1", pid 176, jiffies 4295003332 (age 822.830s)
hex dump (first 32 bytes):
00 68 1e 04 81 88 ff ff 01 00 00 00 00 00 00 00 .h..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8167939c>] slab_post_alloc_hook+0x9c/0x490
[<ffffffff8167f627>] kmem_cache_alloc_trace+0x1f7/0x470
[<ffffffffa02c9873>] if_usb_probe+0x63/0x446 [usb8xxx]
[<ffffffffa022668a>] usb_probe_interface+0x1aa/0x3c0 [usbcore]
[<ffffffff82b59630>] really_probe+0x190/0x480
[<ffffffff82b59a19>] __driver_probe_device+0xf9/0x180
[<ffffffff82b59af3>] driver_probe_device+0x53/0x130
[<ffffffff82b5a075>] __device_attach_driver+0x105/0x130
[<ffffffff82b55949>] bus_for_each_drv+0x129/0x190
[<ffffffff82b593c9>] __device_attach+0x1c9/0x270
[<ffffffff82b5a250>] device_initial_probe+0x20/0x30
[<ffffffff82b579c2>] bus_probe_device+0x142/0x160
[<ffffffff82b52e49>] device_add+0x829/0x1300
[<ffffffffa02229b1>] usb_set_configuration+0xb01/0xcc0 [usbcore]
[<ffffffffa0235c4e>] usb_generic_driver_probe+0x6e/0x90 [usbcore]
[<ffffffffa022641f>] usb_probe_device+0x6f/0x130 [usbcore]
cardp is missing being freed in the error handling path of the probe
and the path of the disconnect, which will cause memory leak.
This patch adds the missing kfree().
Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211020120345.2016045-3-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
index 9e82ec12564bb..f29a154d995c8 100644
--- a/drivers/net/wireless/marvell/libertas/if_usb.c
+++ b/drivers/net/wireless/marvell/libertas/if_usb.c
@@ -288,6 +288,7 @@ err_add_card:
if_usb_reset_device(cardp);
dealloc:
if_usb_free(cardp);
+ kfree(cardp);
error:
return r;
@@ -312,6 +313,7 @@ static void if_usb_disconnect(struct usb_interface *intf)
/* Unlink and free urb */
if_usb_free(cardp);
+ kfree(cardp);
usb_set_intfdata(intf, NULL);
usb_put_dev(interface_to_usbdev(intf));
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 170/323] wcn36xx: add proper DMA memory barriers in rx path
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2021-11-24 11:55 ` [PATCH 4.19 169/323] libertas: " Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 171/323] net: amd-xgbe: Toggle PLL settings during rate change Greg Kroah-Hartman
` (156 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Li, Kalle Valo, Sasha Levin
From: Benjamin Li <benl@squareup.com>
[ Upstream commit 9bfe38e064af5decba2ffce66a2958ab8b10eaa4 ]
This is essentially exactly following the dma_wmb()/dma_rmb() usage
instructions in Documentation/memory-barriers.txt.
The theoretical races here are:
1. DXE (the DMA Transfer Engine in the Wi-Fi subsystem) seeing the
dxe->ctrl & WCN36xx_DXE_CTRL_VLD write before the dxe->dst_addr_l
write, thus performing DMA into the wrong address.
2. CPU reading dxe->dst_addr_l before DXE unsets dxe->ctrl &
WCN36xx_DXE_CTRL_VLD. This should generally be harmless since DXE
doesn't write dxe->dst_addr_l (no risk of freeing the wrong skb).
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Benjamin Li <benl@squareup.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211023001528.3077822-1-benl@squareup.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/dxe.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 06cfe8d311f39..657525988d1ee 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -565,6 +565,10 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
dxe = ctl->desc;
while (!(READ_ONCE(dxe->ctrl) & WCN36xx_DXE_CTRL_VLD)) {
+ /* do not read until we own DMA descriptor */
+ dma_rmb();
+
+ /* read/modify DMA descriptor */
skb = ctl->skb;
dma_addr = dxe->dst_addr_l;
ret = wcn36xx_dxe_fill_skb(wcn->dev, ctl, GFP_ATOMIC);
@@ -575,9 +579,15 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
dma_unmap_single(wcn->dev, dma_addr, WCN36XX_PKT_SIZE,
DMA_FROM_DEVICE);
wcn36xx_rx_skb(wcn, skb);
- } /* else keep old skb not submitted and use it for rx DMA */
+ }
+ /* else keep old skb not submitted and reuse it for rx DMA
+ * (dropping the packet that it contained)
+ */
+ /* flush descriptor changes before re-marking as valid */
+ dma_wmb();
dxe->ctrl = ctrl;
+
ctl = ctl->next;
dxe = ctl->desc;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 171/323] net: amd-xgbe: Toggle PLL settings during rate change
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 170/323] wcn36xx: add proper DMA memory barriers in rx path Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 172/323] net: phylink: avoid mvneta warning when setting pause parameters Greg Kroah-Hartman
` (155 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudheesh Mavila, Shyam Sundar S K,
Tom Lendacky, David S. Miller, Sasha Levin
From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
[ Upstream commit daf182d360e509a494db18666799f4e85d83dda0 ]
For each rate change command submission, the FW has to do a phy
power off sequence internally. For this to happen correctly, the
PLL re-initialization control setting has to be turned off before
sending mailbox commands and re-enabled once the command submission
is complete.
Without the PLL control setting, the link up takes longer time in a
fixed phy configuration.
Fixes: 47f164deab22 ("amd-xgbe: Add PCI device support")
Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/amd/xgbe/xgbe-common.h | 8 ++++++++
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 20 +++++++++++++++++++-
2 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index b2cd3bdba9f89..533b8519ec352 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -1331,6 +1331,10 @@
#define MDIO_VEND2_PMA_CDR_CONTROL 0x8056
#endif
+#ifndef MDIO_VEND2_PMA_MISC_CTRL0
+#define MDIO_VEND2_PMA_MISC_CTRL0 0x8090
+#endif
+
#ifndef MDIO_CTRL1_SPEED1G
#define MDIO_CTRL1_SPEED1G (MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100)
#endif
@@ -1389,6 +1393,10 @@
#define XGBE_PMA_RX_RST_0_RESET_ON 0x10
#define XGBE_PMA_RX_RST_0_RESET_OFF 0x00
+#define XGBE_PMA_PLL_CTRL_MASK BIT(15)
+#define XGBE_PMA_PLL_CTRL_ENABLE BIT(15)
+#define XGBE_PMA_PLL_CTRL_DISABLE 0x0000
+
/* Bit setting and getting macros
* The get macro will extract the current bit field value from within
* the variable
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
index 54753c8a6a9d7..714aead72c579 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
@@ -1966,12 +1966,26 @@ static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata)
}
}
+static void xgbe_phy_pll_ctrl(struct xgbe_prv_data *pdata, bool enable)
+{
+ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_MISC_CTRL0,
+ XGBE_PMA_PLL_CTRL_MASK,
+ enable ? XGBE_PMA_PLL_CTRL_ENABLE
+ : XGBE_PMA_PLL_CTRL_DISABLE);
+
+ /* Wait for command to complete */
+ usleep_range(100, 200);
+}
+
static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
unsigned int cmd, unsigned int sub_cmd)
{
unsigned int s0 = 0;
unsigned int wait;
+ /* Disable PLL re-initialization during FW command processing */
+ xgbe_phy_pll_ctrl(pdata, false);
+
/* Log if a previous command did not complete */
if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) {
netif_dbg(pdata, link, pdata->netdev,
@@ -1992,7 +2006,7 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
wait = XGBE_RATECHANGE_COUNT;
while (wait--) {
if (!XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS))
- return;
+ goto reenable_pll;
usleep_range(1000, 2000);
}
@@ -2002,6 +2016,10 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
/* Reset on error */
xgbe_phy_rx_reset(pdata);
+
+reenable_pll:
+ /* Enable PLL re-initialization */
+ xgbe_phy_pll_ctrl(pdata, true);
}
static void xgbe_phy_rrc(struct xgbe_prv_data *pdata)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 172/323] net: phylink: avoid mvneta warning when setting pause parameters
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 171/323] net: amd-xgbe: Toggle PLL settings during rate change Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 173/323] crypto: pcrypt - Delay write to padata->info Greg Kroah-Hartman
` (154 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Russell King (Oracle),
David S. Miller, Sasha Levin
From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
[ Upstream commit fd8d9731bcdfb22d28e45bce789bcb211c868c78 ]
mvneta does not support asymetric pause modes, and it flags this by the
lack of AsymPause in the supported field. When setting pause modes, we
check that pause->rx_pause == pause->tx_pause, but only when pause
autoneg is enabled. When pause autoneg is disabled, we still allow
pause->rx_pause != pause->tx_pause, which is incorrect when the MAC
does not support asymetric pause, and causes mvneta to issue a warning.
Fix this by removing the test for pause->autoneg, so we always check
that pause->rx_pause == pause->tx_pause for network devices that do not
support AsymPause.
Fixes: 9525ae83959b ("phylink: add phylink infrastructure")
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/phylink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 723611ac91027..e808efd762122 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -1259,7 +1259,7 @@ int phylink_ethtool_set_pauseparam(struct phylink *pl,
return -EOPNOTSUPP;
if (!phylink_test(pl->supported, Asym_Pause) &&
- !pause->autoneg && pause->rx_pause != pause->tx_pause)
+ pause->rx_pause != pause->tx_pause)
return -EINVAL;
config->pause &= ~(MLO_PAUSE_AN | MLO_PAUSE_TXRX_MASK);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 173/323] crypto: pcrypt - Delay write to padata->info
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 172/323] net: phylink: avoid mvneta warning when setting pause parameters Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 174/323] selftests/bpf: Fix fclose/pclose mismatch in test_progs Greg Kroah-Hartman
` (153 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+b187b77c8474f9648fae,
Daniel Jordan, Herbert Xu, Sasha Levin
From: Daniel Jordan <daniel.m.jordan@oracle.com>
[ Upstream commit 68b6dea802cea0dbdd8bd7ccc60716b5a32a5d8a ]
These three events can race when pcrypt is used multiple times in a
template ("pcrypt(pcrypt(...))"):
1. [taskA] The caller makes the crypto request via crypto_aead_encrypt()
2. [kworkerB] padata serializes the inner pcrypt request
3. [kworkerC] padata serializes the outer pcrypt request
3 might finish before the call to crypto_aead_encrypt() returns in 1,
resulting in two possible issues.
First, a use-after-free of the crypto request's memory when, for
example, taskA writes to the outer pcrypt request's padata->info in
pcrypt_aead_enc() after kworkerC completes the request.
Second, the outer pcrypt request overwrites the inner pcrypt request's
return code with -EINPROGRESS, making a successful request appear to
fail. For instance, kworkerB writes the outer pcrypt request's
padata->info in pcrypt_aead_done() and then taskA overwrites it
in pcrypt_aead_enc().
Avoid both situations by delaying the write of padata->info until after
the inner crypto request's return code is checked. This prevents the
use-after-free by not touching the crypto request's memory after the
next-inner crypto request is made, and stops padata->info from being
overwritten.
Fixes: 5068c7a883d16 ("crypto: pcrypt - Add pcrypt crypto parallelization wrapper")
Reported-by: syzbot+b187b77c8474f9648fae@syzkaller.appspotmail.com
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/pcrypt.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index 85082574c5154..62e11835f220e 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -138,12 +138,14 @@ static void pcrypt_aead_enc(struct padata_priv *padata)
{
struct pcrypt_request *preq = pcrypt_padata_request(padata);
struct aead_request *req = pcrypt_request_ctx(preq);
+ int ret;
- padata->info = crypto_aead_encrypt(req);
+ ret = crypto_aead_encrypt(req);
- if (padata->info == -EINPROGRESS)
+ if (ret == -EINPROGRESS)
return;
+ padata->info = ret;
padata_do_serial(padata);
}
@@ -180,12 +182,14 @@ static void pcrypt_aead_dec(struct padata_priv *padata)
{
struct pcrypt_request *preq = pcrypt_padata_request(padata);
struct aead_request *req = pcrypt_request_ctx(preq);
+ int ret;
- padata->info = crypto_aead_decrypt(req);
+ ret = crypto_aead_decrypt(req);
- if (padata->info == -EINPROGRESS)
+ if (ret == -EINPROGRESS)
return;
+ padata->info = ret;
padata_do_serial(padata);
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 174/323] selftests/bpf: Fix fclose/pclose mismatch in test_progs
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 173/323] crypto: pcrypt - Delay write to padata->info Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 175/323] ibmvnic: Process crqs after enabling interrupts Greg Kroah-Hartman
` (152 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrea Righi, Daniel Borkmann,
Shuah Khan, Martin KaFai Lau, Sasha Levin
From: Andrea Righi <andrea.righi@canonical.com>
[ Upstream commit f48ad69097fe79d1de13c4d8fef556d4c11c5e68 ]
Make sure to use pclose() to properly close the pipe opened by popen().
Fixes: 81f77fd0deeb ("bpf: add selftest for stackmap with BPF_F_STACK_BUILD_ID")
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20211026143409.42666-1-andrea.righi@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/test_progs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index bad3505d66e05..0fcd38ffcc24c 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1112,7 +1112,7 @@ static int extract_build_id(char *build_id, size_t size)
if (getline(&line, &len, fp) == -1)
goto err;
- fclose(fp);
+ pclose(fp);
if (len > size)
len = size;
@@ -1121,7 +1121,7 @@ static int extract_build_id(char *build_id, size_t size)
free(line);
return 0;
err:
- fclose(fp);
+ pclose(fp);
return -1;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 175/323] ibmvnic: Process crqs after enabling interrupts
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 174/323] selftests/bpf: Fix fclose/pclose mismatch in test_progs Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 176/323] RDMA/rxe: Fix wrong port_cap_flags Greg Kroah-Hartman
` (151 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vaishnavi Bhat, Sukadev Bhattiprolu,
Dany Madden, David S. Miller, Sasha Levin
From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
[ Upstream commit 6e20d00158f31f7631d68b86996b7e951c4451c8 ]
Soon after registering a CRQ it is possible that we get a fail over or
maybe a CRQ_INIT from the VIOS while interrupts were disabled.
Look for any such CRQs after enabling interrupts.
Otherwise we can intermittently fail to bring up ibmvnic adapters during
boot, specially in kexec/kdump kernels.
Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
Reported-by: Vaishnavi Bhat <vaish123@in.ibm.com>
Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
Reviewed-by: Dany Madden <drt@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index d97641b9928bb..c52c26fc44e59 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -4603,6 +4603,9 @@ static int init_crq_queue(struct ibmvnic_adapter *adapter)
crq->cur = 0;
spin_lock_init(&crq->lock);
+ /* process any CRQs that were queued before we enabled interrupts */
+ tasklet_schedule(&adapter->tasklet);
+
return retrc;
req_irq_failed:
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 176/323] RDMA/rxe: Fix wrong port_cap_flags
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 175/323] ibmvnic: Process crqs after enabling interrupts Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 177/323] ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() Greg Kroah-Hartman
` (150 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Junji Wei, Leon Romanovsky,
Jason Gunthorpe, Sasha Levin
From: Junji Wei <weijunji@bytedance.com>
[ Upstream commit dcd3f985b20ffcc375f82ca0ca9f241c7025eb5e ]
The port->attr.port_cap_flags should be set to enum
ib_port_capability_mask_bits in ib_mad.h, not
RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP.
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20210831083223.65797-1-weijunji@bytedance.com
Signed-off-by: Junji Wei <weijunji@bytedance.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_param.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h
index 4555510d86c42..154c92c0e0cd7 100644
--- a/drivers/infiniband/sw/rxe/rxe_param.h
+++ b/drivers/infiniband/sw/rxe/rxe_param.h
@@ -143,7 +143,7 @@ enum rxe_port_param {
RXE_PORT_MAX_MTU = IB_MTU_4096,
RXE_PORT_ACTIVE_MTU = IB_MTU_256,
RXE_PORT_GID_TBL_LEN = 1024,
- RXE_PORT_PORT_CAP_FLAGS = RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP,
+ RXE_PORT_PORT_CAP_FLAGS = IB_PORT_CM_SUP,
RXE_PORT_MAX_MSG_SZ = 0x800000,
RXE_PORT_BAD_PKEY_CNTR = 0,
RXE_PORT_QKEY_VIOL_CNTR = 0,
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 177/323] ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 176/323] RDMA/rxe: Fix wrong port_cap_flags Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 178/323] arm64: dts: rockchip: Fix GPU register width for RK3328 Greg Kroah-Hartman
` (149 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jackie Liu, Krzysztof Kozlowski, Sasha Levin
From: Jackie Liu <liuyun01@kylinos.cn>
[ Upstream commit 2aa717473ce96c93ae43a5dc8c23cedc8ce7dd9f ]
The s3c24xx_init_intc() returns an error pointer upon failure, not NULL.
let's add an error pointer check in s3c24xx_handle_irq.
s3c_intc[0] is not NULL or ERR, we can simplify the code.
Fixes: 1f629b7a3ced ("ARM: S3C24XX: transform irq handling into a declarative form")
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Link: https://lore.kernel.org/r/20210901123557.1043953-1-liu.yun@linux.dev
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-s3c24xx.c | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
diff --git a/drivers/irqchip/irq-s3c24xx.c b/drivers/irqchip/irq-s3c24xx.c
index c19766fe8a1ae..c11fbd8f1225d 100644
--- a/drivers/irqchip/irq-s3c24xx.c
+++ b/drivers/irqchip/irq-s3c24xx.c
@@ -368,11 +368,25 @@ static inline int s3c24xx_handle_intc(struct s3c_irq_intc *intc,
asmlinkage void __exception_irq_entry s3c24xx_handle_irq(struct pt_regs *regs)
{
do {
- if (likely(s3c_intc[0]))
- if (s3c24xx_handle_intc(s3c_intc[0], regs, 0))
- continue;
+ /*
+ * For platform based machines, neither ERR nor NULL can happen here.
+ * The s3c24xx_handle_irq() will be set as IRQ handler iff this succeeds:
+ *
+ * s3c_intc[0] = s3c24xx_init_intc()
+ *
+ * If this fails, the next calls to s3c24xx_init_intc() won't be executed.
+ *
+ * For DT machine, s3c_init_intc_of() could set the IRQ handler without
+ * setting s3c_intc[0] only if it was called with num_ctrl=0. There is no
+ * such code path, so again the s3c_intc[0] will have a valid pointer if
+ * set_handle_irq() is called.
+ *
+ * Therefore in s3c24xx_handle_irq(), the s3c_intc[0] is always something.
+ */
+ if (s3c24xx_handle_intc(s3c_intc[0], regs, 0))
+ continue;
- if (s3c_intc[2])
+ if (!IS_ERR_OR_NULL(s3c_intc[2]))
if (s3c24xx_handle_intc(s3c_intc[2], regs, 64))
continue;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 178/323] arm64: dts: rockchip: Fix GPU register width for RK3328
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 177/323] ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 179/323] RDMA/bnxt_re: Fix query SRQ failure Greg Kroah-Hartman
` (148 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Bee, Heiko Stuebner, Sasha Levin
From: Alex Bee <knaerzche@gmail.com>
[ Upstream commit 932b4610f55b49f3a158b0db451137bab7ed0e1f ]
As can be seen in RK3328's TRM the register range for the GPU is
0xff300000 to 0xff330000.
It would (and does in vendor kernel) overlap with the registers of
the HEVC encoder (node/driver do not exist yet in upstream kernel).
See already existing h265e_mmu node.
Fixes: 752fbc0c8da7 ("arm64: dts: rockchip: add rk3328 mali gpu node")
Signed-off-by: Alex Bee <knaerzche@gmail.com>
Link: https://lore.kernel.org/r/20210623115926.164861-1-knaerzche@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index 05fa0dcb4c690..f6931f8d36f6d 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -536,7 +536,7 @@
gpu: gpu@ff300000 {
compatible = "rockchip,rk3328-mali", "arm,mali-450";
- reg = <0x0 0xff300000 0x0 0x40000>;
+ reg = <0x0 0xff300000 0x0 0x30000>;
interrupts = <GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>,
<GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>,
<GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>,
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 179/323] RDMA/bnxt_re: Fix query SRQ failure
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 178/323] arm64: dts: rockchip: Fix GPU register width for RK3328 Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 180/323] ARM: dts: at91: tse850: the emac<->phy interface is rmii Greg Kroah-Hartman
` (147 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Selvin Xavier, Leon Romanovsky,
Jason Gunthorpe, Sasha Levin
From: Selvin Xavier <selvin.xavier@broadcom.com>
[ Upstream commit 598d16fa1bf93431ad35bbab3ed1affe4fb7b562 ]
Fill the missing parameters for the FW command while querying SRQ.
Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters")
Link: https://lore.kernel.org/r/1631709163-2287-8-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/qplib_fp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 60f2fb7e7dbfe..d52ae7259e62d 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -637,12 +637,13 @@ int bnxt_qplib_query_srq(struct bnxt_qplib_res *res,
int rc = 0;
RCFW_CMD_PREP(req, QUERY_SRQ, cmd_flags);
- req.srq_cid = cpu_to_le32(srq->id);
/* Configure the request */
sbuf = bnxt_qplib_rcfw_alloc_sbuf(rcfw, sizeof(*sb));
if (!sbuf)
return -ENOMEM;
+ req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
+ req.srq_cid = cpu_to_le32(srq->id);
sb = sbuf->sb;
rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
(void *)sbuf, 0);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 180/323] ARM: dts: at91: tse850: the emac<->phy interface is rmii
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 179/323] RDMA/bnxt_re: Fix query SRQ failure Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 181/323] scsi: dc395: Fix error case unwinding Greg Kroah-Hartman
` (146 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Rosin, Nicolas Ferre, Sasha Levin
From: Peter Rosin <peda@axentia.se>
[ Upstream commit dcdbc335a91a26e022a803e1a6b837266989c032 ]
This went unnoticed until commit 7897b071ac3b ("net: macb: convert
to phylink") which tickled the problem. The sama5d3 emac has never
been capable of rgmii, and it all just happened to work before that
commit.
Fixes: 21dd0ece34c2 ("ARM: dts: at91: add devicetree for the Axentia TSE-850")
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/ea781f5e-422f-6cbf-3cf4-d5a7bac9392d@axentia.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/at91-tse850-3.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/at91-tse850-3.dts b/arch/arm/boot/dts/at91-tse850-3.dts
index 2fbec69d9cd68..6b2be520066e2 100644
--- a/arch/arm/boot/dts/at91-tse850-3.dts
+++ b/arch/arm/boot/dts/at91-tse850-3.dts
@@ -269,7 +269,7 @@
&macb1 {
status = "okay";
- phy-mode = "rgmii";
+ phy-mode = "rmii";
#address-cells = <1>;
#size-cells = <0>;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 181/323] scsi: dc395: Fix error case unwinding
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 180/323] ARM: dts: at91: tse850: the emac<->phy interface is rmii Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 182/323] MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT Greg Kroah-Hartman
` (145 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Finn Thain, Tong Zhang,
Martin K. Petersen, Sasha Levin
From: Tong Zhang <ztong0001@gmail.com>
[ Upstream commit cbd9a3347c757383f3d2b50cf7cfd03eb479c481 ]
dc395x_init_one()->adapter_init() might fail. In this case, the acb is
already cleaned up by adapter_init(), no need to do that in
adapter_uninit(acb) again.
[ 1.252251] dc395x: adapter init failed
[ 1.254900] RIP: 0010:adapter_uninit+0x94/0x170 [dc395x]
[ 1.260307] Call Trace:
[ 1.260442] dc395x_init_one.cold+0x72a/0x9bb [dc395x]
Link: https://lore.kernel.org/r/20210907040702.1846409-1-ztong0001@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Finn Thain <fthain@linux-m68k.org>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/dc395x.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index 3943347ec3c7c..16b9dc2fff6bd 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -4805,6 +4805,7 @@ static int dc395x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
/* initialise the adapter and everything we need */
if (adapter_init(acb, io_port_base, io_port_len, irq)) {
dprintkl(KERN_INFO, "adapter init failed\n");
+ acb = NULL;
goto fail;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 182/323] MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 181/323] scsi: dc395: Fix error case unwinding Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 183/323] JFS: fix memleak in jfs_mount Greg Kroah-Hartman
` (144 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Huacai Chen, k2ci robot, Jackie Liu,
Thomas Bogendoerfer, Sasha Levin
From: Jackie Liu <liuyun01@kylinos.cn>
[ Upstream commit 7f3b3c2bfa9c93ab9b5595543496f570983dc330 ]
mach/loongson64 fails to build when the FPU support is disabled:
arch/mips/loongson64/cop2-ex.c:45:15: error: implicit declaration of function ‘__is_fpu_owner’; did you mean ‘is_fpu_owner’? [-Werror=implicit-function-declaration]
arch/mips/loongson64/cop2-ex.c:98:30: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:99:30: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:131:43: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:137:38: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:203:30: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:219:30: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:283:38: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:301:38: error: ‘struct thread_struct’ has no member named ‘fpu’
Fixes: ef2f826c8f2f ("MIPS: Loongson-3: Enable the COP2 usage")
Suggested-by: Huacai Chen <chenhuacai@kernel.org>
Reviewed-by: Huacai Chen <chenhuacai@kernel.org>
Reported-by: k2ci robot <kernel-bot@kylinos.cn>
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index cc8c8d22afaf5..fb8554c41e803 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1375,6 +1375,7 @@ config CPU_LOONGSON3
select WEAK_REORDERING_BEYOND_LLSC
select MIPS_PGD_C0_CONTEXT
select MIPS_L1_CACHE_SHIFT_6
+ select MIPS_FP_SUPPORT
select GPIOLIB
select SWIOTLB
help
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 183/323] JFS: fix memleak in jfs_mount
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 182/323] MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 184/323] ALSA: hda: Reduce udelay() at SKL+ position reporting Greg Kroah-Hartman
` (143 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dongliang Mu, Dave Kleikamp, Sasha Levin
From: Dongliang Mu <mudongliangabcd@gmail.com>
[ Upstream commit c48a14dca2cb57527dde6b960adbe69953935f10 ]
In jfs_mount, when diMount(ipaimap2) fails, it goes to errout35. However,
the following code does not free ipaimap2 allocated by diReadSpecial.
Fix this by refactoring the error handling code of jfs_mount. To be
specific, modify the lable name and free ipaimap2 when the above error
ocurrs.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/jfs_mount.c | 51 ++++++++++++++++++++--------------------------
1 file changed, 22 insertions(+), 29 deletions(-)
diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
index b5214c9ac47ac..f1a705d159043 100644
--- a/fs/jfs/jfs_mount.c
+++ b/fs/jfs/jfs_mount.c
@@ -93,14 +93,14 @@ int jfs_mount(struct super_block *sb)
* (initialize mount inode from the superblock)
*/
if ((rc = chkSuper(sb))) {
- goto errout20;
+ goto out;
}
ipaimap = diReadSpecial(sb, AGGREGATE_I, 0);
if (ipaimap == NULL) {
jfs_err("jfs_mount: Failed to read AGGREGATE_I");
rc = -EIO;
- goto errout20;
+ goto out;
}
sbi->ipaimap = ipaimap;
@@ -111,7 +111,7 @@ int jfs_mount(struct super_block *sb)
*/
if ((rc = diMount(ipaimap))) {
jfs_err("jfs_mount: diMount(ipaimap) failed w/rc = %d", rc);
- goto errout21;
+ goto err_ipaimap;
}
/*
@@ -120,7 +120,7 @@ int jfs_mount(struct super_block *sb)
ipbmap = diReadSpecial(sb, BMAP_I, 0);
if (ipbmap == NULL) {
rc = -EIO;
- goto errout22;
+ goto err_umount_ipaimap;
}
jfs_info("jfs_mount: ipbmap:0x%p", ipbmap);
@@ -132,7 +132,7 @@ int jfs_mount(struct super_block *sb)
*/
if ((rc = dbMount(ipbmap))) {
jfs_err("jfs_mount: dbMount failed w/rc = %d", rc);
- goto errout22;
+ goto err_ipbmap;
}
/*
@@ -151,7 +151,7 @@ int jfs_mount(struct super_block *sb)
if (!ipaimap2) {
jfs_err("jfs_mount: Failed to read AGGREGATE_I");
rc = -EIO;
- goto errout35;
+ goto err_umount_ipbmap;
}
sbi->ipaimap2 = ipaimap2;
@@ -163,7 +163,7 @@ int jfs_mount(struct super_block *sb)
if ((rc = diMount(ipaimap2))) {
jfs_err("jfs_mount: diMount(ipaimap2) failed, rc = %d",
rc);
- goto errout35;
+ goto err_ipaimap2;
}
} else
/* Secondary aggregate inode table is not valid */
@@ -180,7 +180,7 @@ int jfs_mount(struct super_block *sb)
jfs_err("jfs_mount: Failed to read FILESYSTEM_I");
/* open fileset secondary inode allocation map */
rc = -EIO;
- goto errout40;
+ goto err_umount_ipaimap2;
}
jfs_info("jfs_mount: ipimap:0x%p", ipimap);
@@ -190,41 +190,34 @@ int jfs_mount(struct super_block *sb)
/* initialize fileset inode allocation map */
if ((rc = diMount(ipimap))) {
jfs_err("jfs_mount: diMount failed w/rc = %d", rc);
- goto errout41;
+ goto err_ipimap;
}
- goto out;
+ return rc;
/*
* unwind on error
*/
- errout41: /* close fileset inode allocation map inode */
+err_ipimap:
+ /* close fileset inode allocation map inode */
diFreeSpecial(ipimap);
-
- errout40: /* fileset closed */
-
+err_umount_ipaimap2:
/* close secondary aggregate inode allocation map */
- if (ipaimap2) {
+ if (ipaimap2)
diUnmount(ipaimap2, 1);
+err_ipaimap2:
+ /* close aggregate inodes */
+ if (ipaimap2)
diFreeSpecial(ipaimap2);
- }
-
- errout35:
-
- /* close aggregate block allocation map */
+err_umount_ipbmap: /* close aggregate block allocation map */
dbUnmount(ipbmap, 1);
+err_ipbmap: /* close aggregate inodes */
diFreeSpecial(ipbmap);
-
- errout22: /* close aggregate inode allocation map */
-
+err_umount_ipaimap: /* close aggregate inode allocation map */
diUnmount(ipaimap, 1);
-
- errout21: /* close aggregate inodes */
+err_ipaimap: /* close aggregate inodes */
diFreeSpecial(ipaimap);
- errout20: /* aggregate closed */
-
- out:
-
+out:
if (rc)
jfs_err("Mount JFS Failure: %d", rc);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 184/323] ALSA: hda: Reduce udelay() at SKL+ position reporting
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 183/323] JFS: fix memleak in jfs_mount Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 185/323] arm: dts: omap3-gta04a4: accelerometer irq fix Greg Kroah-Hartman
` (142 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jens Axboe, Pierre-Louis Bossart,
Takashi Iwai, Sasha Levin
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 46243b85b0ec5d2cee7545e5ce18c015ce91957e ]
The position reporting on Intel Skylake and later chips via
azx_get_pos_skl() contains a udelay(20) call for the capture streams.
A call for this alone doesn't sound too harmful. However, as the
pointer PCM ops is one of the hottest path in the PCM operations --
especially for the timer-scheduled operations like PulseAudio -- such
a delay hogs CPU usage significantly in the total performance.
The code there was taken from the original code in ASoC SST Skylake
driver blindly. The udelay() is a workaround for the case where the
reported position is behind the period boundary at the timing
triggered from interrupts; applications often expect that the full
data is available for the whole period when returned (and also that's
the definition of the ALSA PCM period).
OTOH, HD-audio (legacy) driver has already some workarounds for the
delayed position reporting due to its relatively large FIFO, such as
the BDL position adjustment and the delayed period-elapsed call in the
work. That said, the udelay() is almost superfluous for HD-audio
driver unlike SST, and we can drop the udelay().
Though, the current code doesn't guarantee the full period readiness
as mentioned in the above, but rather it checks the wallclock and
detects the unexpected jump. That's one missing piece, and the drop
of udelay() needs a bit more sanity checks for the delayed handling.
This patch implements those: the drop of udelay() call in
azx_get_pos_skl() and the more proper check of hwptr in
azx_position_ok(). The latter change is applied only for the case
where the stream is running in the normal mode without
no_period_wakeup flag. When no_period_wakeup is set, it essentially
ignores the period handling and rather concentrates only on the
current position; which implies that we don't need to care about the
period boundary at all.
Fixes: f87e7f25893d ("ALSA: hda - Improved position reporting on SKL+")
Reported-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210929072934.6809-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/hda_intel.c | 28 +++++++++++++++++++++++-----
1 file changed, 23 insertions(+), 5 deletions(-)
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 2cd8bfd5293b9..7d4b6c31dfe70 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -743,13 +743,17 @@ static int azx_intel_link_power(struct azx *chip, bool enable)
* the update-IRQ timing. The IRQ is issued before actually the
* data is processed. So, we need to process it afterwords in a
* workqueue.
+ *
+ * Returns 1 if OK to proceed, 0 for delay handling, -1 for skipping update
*/
static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
{
struct snd_pcm_substream *substream = azx_dev->core.substream;
+ struct snd_pcm_runtime *runtime = substream->runtime;
int stream = substream->stream;
u32 wallclk;
unsigned int pos;
+ snd_pcm_uframes_t hwptr, target;
wallclk = azx_readl(chip, WALLCLK) - azx_dev->core.start_wallclk;
if (wallclk < (azx_dev->core.period_wallclk * 2) / 3)
@@ -786,6 +790,24 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
/* NG - it's below the first next period boundary */
return chip->bdl_pos_adj ? 0 : -1;
azx_dev->core.start_wallclk += wallclk;
+
+ if (azx_dev->core.no_period_wakeup)
+ return 1; /* OK, no need to check period boundary */
+
+ if (runtime->hw_ptr_base != runtime->hw_ptr_interrupt)
+ return 1; /* OK, already in hwptr updating process */
+
+ /* check whether the period gets really elapsed */
+ pos = bytes_to_frames(runtime, pos);
+ hwptr = runtime->hw_ptr_base + pos;
+ if (hwptr < runtime->status->hw_ptr)
+ hwptr += runtime->buffer_size;
+ target = runtime->hw_ptr_interrupt + runtime->period_size;
+ if (hwptr < target) {
+ /* too early wakeup, process it later */
+ return chip->bdl_pos_adj ? 0 : -1;
+ }
+
return 1; /* OK, it's fine */
}
@@ -983,11 +1005,7 @@ static unsigned int azx_get_pos_skl(struct azx *chip, struct azx_dev *azx_dev)
if (azx_dev->core.substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
return azx_skl_get_dpib_pos(chip, azx_dev);
- /* For capture, we need to read posbuf, but it requires a delay
- * for the possible boundary overlap; the read of DPIB fetches the
- * actual posbuf
- */
- udelay(20);
+ /* read of DPIB fetches the actual posbuf */
azx_skl_get_dpib_pos(chip, azx_dev);
return azx_get_pos_posbuf(chip, azx_dev);
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 185/323] arm: dts: omap3-gta04a4: accelerometer irq fix
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 184/323] ALSA: hda: Reduce udelay() at SKL+ position reporting Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 186/323] soc/tegra: Fix an error handling path in tegra_powergate_power_up() Greg Kroah-Hartman
` (141 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Kemnade, Tony Lindgren, Sasha Levin
From: Andreas Kemnade <andreas@kemnade.info>
[ Upstream commit 884ea75d79a36faf3731ad9d6b9c29f58697638d ]
Fix typo in pinctrl. It did only work because the bootloader
seems to have initialized it.
Fixes: ee327111953b ("ARM: dts: omap3-gta04: Define and use bma180 irq pin")
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/omap3-gta04.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
index 0c39a2340030b..a5aed92ab54b1 100644
--- a/arch/arm/boot/dts/omap3-gta04.dtsi
+++ b/arch/arm/boot/dts/omap3-gta04.dtsi
@@ -364,7 +364,7 @@
compatible = "bosch,bma180";
reg = <0x41>;
pinctrl-names = "default";
- pintcrl-0 = <&bma180_pins>;
+ pinctrl-0 = <&bma180_pins>;
interrupt-parent = <&gpio4>;
interrupts = <19 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_115 */
};
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 186/323] soc/tegra: Fix an error handling path in tegra_powergate_power_up()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 185/323] arm: dts: omap3-gta04a4: accelerometer irq fix Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 187/323] memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe Greg Kroah-Hartman
` (140 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Jon Hunter,
Thierry Reding, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 986b5094708e508baa452a23ffe809870934a7df ]
If an error occurs after a successful tegra_powergate_enable_clocks()
call, it must be undone by a tegra_powergate_disable_clocks() call, as
already done in the below and above error handling paths of this function.
Update the 'goto' to branch at the correct place of the error handling
path.
Fixes: a38045121bf4 ("soc/tegra: pmc: Add generic PM domain support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/tegra/pmc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
index f17a678154047..6c57e43787cbf 100644
--- a/drivers/soc/tegra/pmc.c
+++ b/drivers/soc/tegra/pmc.c
@@ -408,7 +408,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg,
err = reset_control_deassert(pg->reset);
if (err)
- goto powergate_off;
+ goto disable_clks;
usleep_range(10, 20);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 187/323] memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 186/323] soc/tegra: Fix an error handling path in tegra_powergate_power_up() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 188/323] video: fbdev: chipsfb: use memset_io() instead of memset() Greg Kroah-Hartman
` (139 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dongliang Mu, Krzysztof Kozlowski,
Sasha Levin
From: Dongliang Mu <mudongliangabcd@gmail.com>
[ Upstream commit 4ed2f3545c2e5acfbccd7f85fea5b1a82e9862d7 ]
The error handling code of fsl_ifc_ctrl_probe is problematic. When
fsl_ifc_ctrl_init fails or request_irq of fsl_ifc_ctrl_dev->irq fails,
it forgets to free the irq and nand_irq. Meanwhile, if request_irq of
fsl_ifc_ctrl_dev->nand_irq fails, it will still free nand_irq even if
the request_irq is not successful.
Fix this by refactoring the error handling code.
Fixes: d2ae2e20fbdd ("driver/memory:Move Freescale IFC driver to a common driver")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Link: https://lore.kernel.org/r/20210925151434.8170-1-mudongliangabcd@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/fsl_ifc.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
index 38b945eb410f3..9c0e70b047c39 100644
--- a/drivers/memory/fsl_ifc.c
+++ b/drivers/memory/fsl_ifc.c
@@ -276,7 +276,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
ret = fsl_ifc_ctrl_init(fsl_ifc_ctrl_dev);
if (ret < 0)
- goto err;
+ goto err_unmap_nandirq;
init_waitqueue_head(&fsl_ifc_ctrl_dev->nand_wait);
@@ -285,7 +285,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
if (ret != 0) {
dev_err(&dev->dev, "failed to install irq (%d)\n",
fsl_ifc_ctrl_dev->irq);
- goto err_irq;
+ goto err_unmap_nandirq;
}
if (fsl_ifc_ctrl_dev->nand_irq) {
@@ -294,17 +294,16 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
if (ret != 0) {
dev_err(&dev->dev, "failed to install irq (%d)\n",
fsl_ifc_ctrl_dev->nand_irq);
- goto err_nandirq;
+ goto err_free_irq;
}
}
return 0;
-err_nandirq:
- free_irq(fsl_ifc_ctrl_dev->nand_irq, fsl_ifc_ctrl_dev);
- irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq);
-err_irq:
+err_free_irq:
free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev);
+err_unmap_nandirq:
+ irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq);
irq_dispose_mapping(fsl_ifc_ctrl_dev->irq);
err:
iounmap(fsl_ifc_ctrl_dev->gregs);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 188/323] video: fbdev: chipsfb: use memset_io() instead of memset()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 187/323] memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 189/323] serial: 8250_dw: Drop wrong use of ACPI_PTR() Greg Kroah-Hartman
` (138 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stan Johnson, Christophe Leroy,
Michael Ellerman, Sasha Levin
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit f2719b26ae27282c145202ffd656d5ff1fe737cc ]
While investigating a lockup at startup on Powerbook 3400C, it was
identified that the fbdev driver generates alignment exception at
startup:
--- interrupt: 600 at memset+0x60/0xc0
NIP: c0021414 LR: c03fc49c CTR: 00007fff
REGS: ca021c10 TRAP: 0600 Tainted: G W (5.14.2-pmac-00727-g12a41fa69492)
MSR: 00009032 <EE,ME,IR,DR,RI> CR: 44008442 XER: 20000100
DAR: cab80020 DSISR: 00017c07
GPR00: 00000007 ca021cd0 c14412e0 cab80000 00000000 00100000 cab8001c 00000004
GPR08: 00100000 00007fff 00000000 00000000 84008442 00000000 c0006fb4 00000000
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00100000
GPR24: 00000000 81800000 00000320 c15fa400 c14d1878 00000000 c14d1800 c094e19c
NIP [c0021414] memset+0x60/0xc0
LR [c03fc49c] chipsfb_pci_init+0x160/0x580
--- interrupt: 600
[ca021cd0] [c03fc46c] chipsfb_pci_init+0x130/0x580 (unreliable)
[ca021d20] [c03a3a70] pci_device_probe+0xf8/0x1b8
[ca021d50] [c043d584] really_probe.part.0+0xac/0x388
[ca021d70] [c043d914] __driver_probe_device+0xb4/0x170
[ca021d90] [c043da18] driver_probe_device+0x48/0x144
[ca021dc0] [c043e318] __driver_attach+0x11c/0x1c4
[ca021de0] [c043ad30] bus_for_each_dev+0x88/0xf0
[ca021e10] [c043c724] bus_add_driver+0x190/0x22c
[ca021e40] [c043ee94] driver_register+0x9c/0x170
[ca021e60] [c0006c28] do_one_initcall+0x54/0x1ec
[ca021ed0] [c08246e4] kernel_init_freeable+0x1c0/0x270
[ca021f10] [c0006fdc] kernel_init+0x28/0x11c
[ca021f30] [c0017148] ret_from_kernel_thread+0x14/0x1c
Instruction dump:
7d4601a4 39490777 7d4701a4 39490888 7d4801a4 39490999 7d4901a4 39290aaa
7d2a01a4 4c00012c 4bfffe88 0fe00000 <4bfffe80> 9421fff0 38210010 48001970
This is due to 'dcbz' instruction being used on non-cached memory.
'dcbz' instruction is used by memset() to zeroize a complete
cacheline at once, and memset() is not expected to be used on non
cached memory.
When performing a 'sparse' check on fbdev driver, it also appears
that the use of memset() is unexpected:
drivers/video/fbdev/chipsfb.c:334:17: warning: incorrect type in argument 1 (different address spaces)
drivers/video/fbdev/chipsfb.c:334:17: expected void *
drivers/video/fbdev/chipsfb.c:334:17: got char [noderef] __iomem *screen_base
drivers/video/fbdev/chipsfb.c:334:15: warning: memset with byte count of 1048576
Use fb_memset() instead of memset(). fb_memset() is defined as
memset_io() for powerpc.
Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK")
Reported-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/884a54f1e5cb774c1d9b4db780209bee5d4f6718.1631712563.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/chipsfb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
index f9b366d175875..413b465e69d8e 100644
--- a/drivers/video/fbdev/chipsfb.c
+++ b/drivers/video/fbdev/chipsfb.c
@@ -332,7 +332,7 @@ static const struct fb_var_screeninfo chipsfb_var = {
static void init_chips(struct fb_info *p, unsigned long addr)
{
- memset(p->screen_base, 0, 0x100000);
+ fb_memset(p->screen_base, 0, 0x100000);
p->fix = chipsfb_fix;
p->fix.smem_start = addr;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 189/323] serial: 8250_dw: Drop wrong use of ACPI_PTR()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 188/323] video: fbdev: chipsfb: use memset_io() instead of memset() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 190/323] usb: gadget: hid: fix error code in do_config() Greg Kroah-Hartman
` (137 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Palmer, Andy Shevchenko, Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit ebabb77a2a115b6c5e68f7364b598310b5f61fb2 ]
ACPI_PTR() is more harmful than helpful. For example, in this case
if CONFIG_ACPI=n, the ID table left unused which is not what we want.
Instead of adding ifdeffery here and there, drop ACPI_PTR().
Fixes: 6a7320c4669f ("serial: 8250_dw: Add ACPI 5.0 support")
Reported-by: Daniel Palmer <daniel@0x0f.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211005134516.23218-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_dw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 284e8d052fc3c..c73d0eddd9b8d 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -769,7 +769,7 @@ static struct platform_driver dw8250_platform_driver = {
.name = "dw-apb-uart",
.pm = &dw8250_pm_ops,
.of_match_table = dw8250_of_match,
- .acpi_match_table = ACPI_PTR(dw8250_acpi_match),
+ .acpi_match_table = dw8250_acpi_match,
},
.probe = dw8250_probe,
.remove = dw8250_remove,
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 190/323] usb: gadget: hid: fix error code in do_config()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 189/323] serial: 8250_dw: Drop wrong use of ACPI_PTR() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 191/323] =?UTF-8?q?power:=20supply:=20rt5033=5Fbattery:=20Change=20voltage?= =?UTF-8?q?=20values=20to=20=C2=B5V?= Greg Kroah-Hartman
` (136 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Dan Carpenter, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 68e7c510fdf4f6167404609da52e1979165649f6 ]
Return an error code if usb_get_function() fails. Don't return success.
Fixes: 4bc8a33f2407 ("usb: gadget: hid: convert to new interface of f_hid")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20211011123739.GC15188@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/legacy/hid.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c
index 5b27d289443fe..3912cc805f3af 100644
--- a/drivers/usb/gadget/legacy/hid.c
+++ b/drivers/usb/gadget/legacy/hid.c
@@ -99,8 +99,10 @@ static int do_config(struct usb_configuration *c)
list_for_each_entry(e, &hidg_func_list, node) {
e->f = usb_get_function(e->fi);
- if (IS_ERR(e->f))
+ if (IS_ERR(e->f)) {
+ status = PTR_ERR(e->f);
goto put;
+ }
status = usb_add_function(c, e->f);
if (status < 0) {
usb_put_function(e->f);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 191/323] =?UTF-8?q?power:=20supply:=20rt5033=5Fbattery:=20Change=20voltage?= =?UTF-8?q?=20values=20to=20=C2=B5V?=
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 190/323] usb: gadget: hid: fix error code in do_config() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 192/323] scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() Greg Kroah-Hartman
` (135 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Beomho Seo, Chanwoo Choi,
Jakob Hauser, Sebastian Reichel, Sasha Levin
From: Jakob Hauser <jahau@rocketmail.com>
[ Upstream commit bf895295e9a73411889816f1a0c1f4f1a2d9c678 ]
Currently the rt5033_battery driver provides voltage values in mV. It
should be µV as stated in Documentation/power/power_supply_class.rst.
Fixes: b847dd96e659 ("power: rt5033_battery: Add RT5033 Fuel gauge device driver")
Cc: Beomho Seo <beomho.seo@samsung.com>
Cc: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Jakob Hauser <jahau@rocketmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/rt5033_battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c
index 9310b85f3405e..7eec7014086d8 100644
--- a/drivers/power/supply/rt5033_battery.c
+++ b/drivers/power/supply/rt5033_battery.c
@@ -63,7 +63,7 @@ static int rt5033_battery_get_watt_prop(struct i2c_client *client,
regmap_read(battery->regmap, regh, &msb);
regmap_read(battery->regmap, regl, &lsb);
- ret = ((msb << 4) + (lsb >> 4)) * 1250 / 1000;
+ ret = ((msb << 4) + (lsb >> 4)) * 1250;
return ret;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 192/323] scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 191/323] =?UTF-8?q?power:=20supply:=20rt5033=5Fbattery:=20Change=20voltage?= =?UTF-8?q?=20values=20to=20=C2=B5V?= Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 193/323] RDMA/mlx4: Return missed an error if device doesnt support steering Greg Kroah-Hartman
` (134 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Martin K. Petersen,
Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit f4875d509a0a78ad294a1a538d534b5ba94e685a ]
This variable is just a temporary variable, used to do an endian
conversion. The problem is that the last byte is not initialized. After
the conversion is completely done, the last byte is discarded so it doesn't
cause a problem. But static checkers and the KMSan runtime checker can
detect the uninitialized read and will complain about it.
Link: https://lore.kernel.org/r/20211006073242.GA8404@kili
Fixes: 5036f0a0ecd3 ("[SCSI] csiostor: Fix sparse warnings.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/csiostor/csio_lnode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c
index a8e29e3d35726..98944fb3f0b85 100644
--- a/drivers/scsi/csiostor/csio_lnode.c
+++ b/drivers/scsi/csiostor/csio_lnode.c
@@ -619,7 +619,7 @@ csio_ln_vnp_read_cbfn(struct csio_hw *hw, struct csio_mb *mbp)
struct fc_els_csp *csp;
struct fc_els_cssp *clsp;
enum fw_retval retval;
- __be32 nport_id;
+ __be32 nport_id = 0;
retval = FW_CMD_RETVAL_G(ntohl(rsp->alloc_to_len16));
if (retval != FW_SUCCESS) {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 193/323] RDMA/mlx4: Return missed an error if device doesnt support steering
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 192/323] scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 194/323] ASoC: cs42l42: Correct some register default values Greg Kroah-Hartman
` (133 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Leon Romanovsky,
Jason Gunthorpe, Sasha Levin
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit f4e56ec4452f48b8292dcf0e1c4bdac83506fb8b ]
The error flow fixed in this patch is not possible because all kernel
users of create QP interface check that device supports steering before
set IB_QP_CREATE_NETIF_QP flag.
Fixes: c1c98501121e ("IB/mlx4: Add support for steerable IB UD QPs")
Link: https://lore.kernel.org/r/91c61f6e60eb0240f8bbc321fda7a1d2986dd03c.1634023677.git.leonro@nvidia.com
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx4/qp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 73bd35d34a257..7209b8a9b0dd2 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1057,8 +1057,10 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
if (dev->steering_support ==
MLX4_STEERING_MODE_DEVICE_MANAGED)
qp->flags |= MLX4_IB_QP_NETIF;
- else
+ else {
+ err = -EINVAL;
goto err;
+ }
}
err = set_kernel_sq_size(dev, &init_attr->cap, qp_type, qp);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 194/323] ASoC: cs42l42: Correct some register default values
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 193/323] RDMA/mlx4: Return missed an error if device doesnt support steering Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 195/323] ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER Greg Kroah-Hartman
` (132 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Fitzgerald, Mark Brown, Sasha Levin
From: Richard Fitzgerald <rf@opensource.cirrus.com>
[ Upstream commit d591d4b32aa9552af14a0c7c586a2d3fe9ecc6e0 ]
Some registers had wrong default values in cs42l42_reg_defaults[].
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Fixes: 2c394ca79604 ("ASoC: Add support for CS42L42 codec")
Link: https://lore.kernel.org/r/20211015133619.4698-4-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs42l42.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index 4cb3e11c66af7..f9d6534d4632d 100644
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -95,7 +95,7 @@ static const struct reg_default cs42l42_reg_defaults[] = {
{ CS42L42_ASP_RX_INT_MASK, 0x1F },
{ CS42L42_ASP_TX_INT_MASK, 0x0F },
{ CS42L42_CODEC_INT_MASK, 0x03 },
- { CS42L42_SRCPL_INT_MASK, 0xFF },
+ { CS42L42_SRCPL_INT_MASK, 0x7F },
{ CS42L42_VPMON_INT_MASK, 0x01 },
{ CS42L42_PLL_LOCK_INT_MASK, 0x01 },
{ CS42L42_TSRS_PLUG_INT_MASK, 0x0F },
@@ -132,7 +132,7 @@ static const struct reg_default cs42l42_reg_defaults[] = {
{ CS42L42_MIXER_CHA_VOL, 0x3F },
{ CS42L42_MIXER_ADC_VOL, 0x3F },
{ CS42L42_MIXER_CHB_VOL, 0x3F },
- { CS42L42_EQ_COEF_IN0, 0x22 },
+ { CS42L42_EQ_COEF_IN0, 0x00 },
{ CS42L42_EQ_COEF_IN1, 0x00 },
{ CS42L42_EQ_COEF_IN2, 0x00 },
{ CS42L42_EQ_COEF_IN3, 0x00 },
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 195/323] ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 194/323] ASoC: cs42l42: Correct some register default values Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 196/323] phy: qcom-qusb2: Fix a memory leak on probe Greg Kroah-Hartman
` (131 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Fitzgerald, Mark Brown, Sasha Levin
From: Richard Fitzgerald <rf@opensource.cirrus.com>
[ Upstream commit 0306988789d9d91a18ff70bd2bf165d3ae0ef1dd ]
The driver can run without an interrupt so if devm_request_threaded_irq()
failed, the probe() just carried on. But if this was EPROBE_DEFER the
driver would continue without an interrupt instead of deferring to wait
for the interrupt to become available.
Fixes: 2c394ca79604 ("ASoC: Add support for CS42L42 codec")
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20211015133619.4698-6-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs42l42.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index f9d6534d4632d..9471ba17e371b 100644
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -1799,8 +1799,9 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
NULL, cs42l42_irq_thread,
IRQF_ONESHOT | IRQF_TRIGGER_LOW,
"cs42l42", cs42l42);
-
- if (ret != 0)
+ if (ret == -EPROBE_DEFER)
+ goto err_disable;
+ else if (ret != 0)
dev_err(&i2c_client->dev,
"Failed to request IRQ: %d\n", ret);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 196/323] phy: qcom-qusb2: Fix a memory leak on probe
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 195/323] ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 197/323] serial: xilinx_uartps: Fix race condition causing stuck TX Greg Kroah-Hartman
` (130 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Bjorn Andersson,
Vinod Koul, Sasha Levin
From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
[ Upstream commit bf7ffcd0069d30e2e7ba2b827f08c89f471cd1f3 ]
On success nvmem_cell_read() returns a pointer to a dynamically allocated
buffer, and therefore it shall be freed after usage.
The issue is reported by kmemleak:
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff3b3803e4b280 (size 128):
comm "kworker/u16:1", pid 107, jiffies 4294892861 (age 94.120s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000007739afdc>] __kmalloc+0x27c/0x41c
[<0000000071c0fbf8>] nvmem_cell_read+0x40/0xe0
[<00000000e803ef1f>] qusb2_phy_init+0x258/0x5bc
[<00000000fc81fcfa>] phy_init+0x70/0x110
[<00000000e3d48a57>] dwc3_core_soft_reset+0x4c/0x234
[<0000000027d1dbd4>] dwc3_core_init+0x68/0x990
[<000000001965faf9>] dwc3_probe+0x4f4/0x730
[<000000002f7617ca>] platform_probe+0x74/0xf0
[<00000000a2576cac>] really_probe+0xc4/0x470
[<00000000bc77f2c5>] __driver_probe_device+0x11c/0x190
[<00000000130db71f>] driver_probe_device+0x48/0x110
[<0000000019f36c2b>] __device_attach_driver+0xa4/0x140
[<00000000e5812ff7>] bus_for_each_drv+0x84/0xe0
[<00000000f4bac574>] __device_attach+0xe4/0x1c0
[<00000000d3beb631>] device_initial_probe+0x20/0x30
[<000000008019b9db>] bus_probe_device+0xa4/0xb0
Fixes: ca04d9d3e1b1 ("phy: qcom-qusb2: New driver for QUSB2 PHY on Qcom chips")
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20210922233548.2150244-1-vladimir.zapolskiy@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/qualcomm/phy-qcom-qusb2.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c
index 9b7ae93e9df1e..901f525c86e2b 100644
--- a/drivers/phy/qualcomm/phy-qcom-qusb2.c
+++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c
@@ -395,7 +395,7 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
{
struct device *dev = &qphy->phy->dev;
const struct qusb2_phy_cfg *cfg = qphy->cfg;
- u8 *val;
+ u8 *val, hstx_trim;
/* efuse register is optional */
if (!qphy->cell)
@@ -409,7 +409,13 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
* set while configuring the phy.
*/
val = nvmem_cell_read(qphy->cell, NULL);
- if (IS_ERR(val) || !val[0]) {
+ if (IS_ERR(val)) {
+ dev_dbg(dev, "failed to read a valid hs-tx trim value\n");
+ return;
+ }
+ hstx_trim = val[0];
+ kfree(val);
+ if (!hstx_trim) {
dev_dbg(dev, "failed to read a valid hs-tx trim value\n");
return;
}
@@ -417,12 +423,10 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
/* Fused TUNE1/2 value is the higher nibble only */
if (cfg->update_tune1_with_efuse)
qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1],
- val[0] << HSTX_TRIM_SHIFT,
- HSTX_TRIM_MASK);
+ hstx_trim << HSTX_TRIM_SHIFT, HSTX_TRIM_MASK);
else
qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2],
- val[0] << HSTX_TRIM_SHIFT,
- HSTX_TRIM_MASK);
+ hstx_trim << HSTX_TRIM_SHIFT, HSTX_TRIM_MASK);
}
static int qusb2_phy_set_mode(struct phy *phy, enum phy_mode mode)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 197/323] serial: xilinx_uartps: Fix race condition causing stuck TX
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 196/323] phy: qcom-qusb2: Fix a memory leak on probe Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 198/323] mips: cm: Convert to bitfield API to fix out-of-bounds access Greg Kroah-Hartman
` (129 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Anssi Hannula, Sasha Levin
From: Anssi Hannula <anssi.hannula@bitwise.fi>
[ Upstream commit 88b20f84f0fe47409342669caf3e58a3fc64c316 ]
xilinx_uartps .start_tx() clears TXEMPTY when enabling TXEMPTY to avoid
any previous TXEVENT event asserting the UART interrupt. This clear
operation is done immediately after filling the TX FIFO.
However, if the bytes inserted by cdns_uart_handle_tx() are consumed by
the UART before the TXEMPTY is cleared, the clear operation eats the new
TXEMPTY event as well, causing cdns_uart_isr() to never receive the
TXEMPTY event. If there are bytes still queued in circbuf, TX will get
stuck as they will never get transferred to FIFO (unless new bytes are
queued to circbuf in which case .start_tx() is called again).
While the racy missed TXEMPTY occurs fairly often with short data
sequences (e.g. write 1 byte), in those cases circbuf is usually empty
so no action on TXEMPTY would have been needed anyway. On the other
hand, longer data sequences make the race much more unlikely as UART
takes longer to consume the TX FIFO. Therefore it is rare for this race
to cause visible issues in general.
Fix the race by clearing the TXEMPTY bit in ISR *before* filling the
FIFO.
The TXEMPTY bit in ISR will only get asserted at the exact moment the
TX FIFO *becomes* empty, so clearing the bit before filling FIFO does
not cause an extra immediate assertion even if the FIFO is initially
empty.
This is hard to reproduce directly on a normal system, but inserting
e.g. udelay(200) after cdns_uart_handle_tx(port), setting 4000000 baud,
and then running "dd if=/dev/zero bs=128 of=/dev/ttyPS0 count=50"
reliably reproduces the issue on my ZynqMP test system unless this fix
is applied.
Fixes: 85baf542d54e ("tty: xuartps: support 64 byte FIFO size")
Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
Link: https://lore.kernel.org/r/20211026102741.2910441-1-anssi.hannula@bitwise.fi
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/xilinx_uartps.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index 23f9b0cdff086..c22bd40fc6f0b 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -591,9 +591,10 @@ static void cdns_uart_start_tx(struct uart_port *port)
if (uart_circ_empty(&port->state->xmit))
return;
+ writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR);
+
cdns_uart_handle_tx(port);
- writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR);
/* Enable the TX Empty interrupt */
writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_IER);
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 198/323] mips: cm: Convert to bitfield API to fix out-of-bounds access
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 197/323] serial: xilinx_uartps: Fix race condition causing stuck TX Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 199/323] power: supply: bq27xxx: Fix kernel crash on IRQ handler register error Greg Kroah-Hartman
` (128 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Jiaxun Yang,
Thomas Bogendoerfer, Sasha Levin
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 18b8f5b6fc53d097cadb94a93d8d6566ba88e389 ]
mips_cm_error_report() extracts the cause and other cause from the error
register using shifts. This works fine for the former, as it is stored
in the top bits, and the shift will thus remove all non-related bits.
However, the latter is stored in the bottom bits, hence thus needs masking
to get rid of non-related bits. Without such masking, using it as an
index into the cm2_causes[] array will lead to an out-of-bounds access,
probably causing a crash.
Fix this by using FIELD_GET() instead. Bite the bullet and convert all
MIPS CM handling to the bitfield API, to improve readability and safety.
Fixes: 3885c2b463f6a236 ("MIPS: CM: Add support for reporting CM cache errors")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/include/asm/mips-cm.h | 12 ++++++------
arch/mips/kernel/mips-cm.c | 21 ++++++++++-----------
2 files changed, 16 insertions(+), 17 deletions(-)
diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h
index 8bc5df49b0e1d..890e51b159e06 100644
--- a/arch/mips/include/asm/mips-cm.h
+++ b/arch/mips/include/asm/mips-cm.h
@@ -15,6 +15,7 @@
#ifndef __MIPS_ASM_MIPS_CM_H__
#define __MIPS_ASM_MIPS_CM_H__
+#include <linux/bitfield.h>
#include <linux/bitops.h>
#include <linux/errno.h>
@@ -157,8 +158,8 @@ GCR_ACCESSOR_RO(32, 0x030, rev)
#define CM_GCR_REV_MINOR GENMASK(7, 0)
#define CM_ENCODE_REV(major, minor) \
- (((major) << __ffs(CM_GCR_REV_MAJOR)) | \
- ((minor) << __ffs(CM_GCR_REV_MINOR)))
+ (FIELD_PREP(CM_GCR_REV_MAJOR, major) | \
+ FIELD_PREP(CM_GCR_REV_MINOR, minor))
#define CM_REV_CM2 CM_ENCODE_REV(6, 0)
#define CM_REV_CM2_5 CM_ENCODE_REV(7, 0)
@@ -366,10 +367,10 @@ static inline int mips_cm_revision(void)
static inline unsigned int mips_cm_max_vp_width(void)
{
extern int smp_num_siblings;
- uint32_t cfg;
if (mips_cm_revision() >= CM_REV_CM3)
- return read_gcr_sys_config2() & CM_GCR_SYS_CONFIG2_MAXVPW;
+ return FIELD_GET(CM_GCR_SYS_CONFIG2_MAXVPW,
+ read_gcr_sys_config2());
if (mips_cm_present()) {
/*
@@ -377,8 +378,7 @@ static inline unsigned int mips_cm_max_vp_width(void)
* number of VP(E)s, and if that ever changes then this will
* need revisiting.
*/
- cfg = read_gcr_cl_config() & CM_GCR_Cx_CONFIG_PVPE;
- return (cfg >> __ffs(CM_GCR_Cx_CONFIG_PVPE)) + 1;
+ return FIELD_GET(CM_GCR_Cx_CONFIG_PVPE, read_gcr_cl_config()) + 1;
}
if (IS_ENABLED(CONFIG_SMP))
diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
index 50d3d74001cbe..51cfcb44e6703 100644
--- a/arch/mips/kernel/mips-cm.c
+++ b/arch/mips/kernel/mips-cm.c
@@ -183,8 +183,7 @@ static void mips_cm_probe_l2sync(void)
phys_addr_t addr;
/* L2-only sync was introduced with CM major revision 6 */
- major_rev = (read_gcr_rev() & CM_GCR_REV_MAJOR) >>
- __ffs(CM_GCR_REV_MAJOR);
+ major_rev = FIELD_GET(CM_GCR_REV_MAJOR, read_gcr_rev());
if (major_rev < 6)
return;
@@ -267,13 +266,13 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core,
preempt_disable();
if (cm_rev >= CM_REV_CM3) {
- val = core << __ffs(CM3_GCR_Cx_OTHER_CORE);
- val |= vp << __ffs(CM3_GCR_Cx_OTHER_VP);
+ val = FIELD_PREP(CM3_GCR_Cx_OTHER_CORE, core) |
+ FIELD_PREP(CM3_GCR_Cx_OTHER_VP, vp);
if (cm_rev >= CM_REV_CM3_5) {
val |= CM_GCR_Cx_OTHER_CLUSTER_EN;
- val |= cluster << __ffs(CM_GCR_Cx_OTHER_CLUSTER);
- val |= block << __ffs(CM_GCR_Cx_OTHER_BLOCK);
+ val |= FIELD_PREP(CM_GCR_Cx_OTHER_CLUSTER, cluster);
+ val |= FIELD_PREP(CM_GCR_Cx_OTHER_BLOCK, block);
} else {
WARN_ON(cluster != 0);
WARN_ON(block != CM_GCR_Cx_OTHER_BLOCK_LOCAL);
@@ -303,7 +302,7 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core,
spin_lock_irqsave(&per_cpu(cm_core_lock, curr_core),
per_cpu(cm_core_lock_flags, curr_core));
- val = core << __ffs(CM_GCR_Cx_OTHER_CORENUM);
+ val = FIELD_PREP(CM_GCR_Cx_OTHER_CORENUM, core);
}
write_gcr_cl_other(val);
@@ -347,8 +346,8 @@ void mips_cm_error_report(void)
cm_other = read_gcr_error_mult();
if (revision < CM_REV_CM3) { /* CM2 */
- cause = cm_error >> __ffs(CM_GCR_ERROR_CAUSE_ERRTYPE);
- ocause = cm_other >> __ffs(CM_GCR_ERROR_MULT_ERR2ND);
+ cause = FIELD_GET(CM_GCR_ERROR_CAUSE_ERRTYPE, cm_error);
+ ocause = FIELD_GET(CM_GCR_ERROR_MULT_ERR2ND, cm_other);
if (!cause)
return;
@@ -390,8 +389,8 @@ void mips_cm_error_report(void)
ulong core_id_bits, vp_id_bits, cmd_bits, cmd_group_bits;
ulong cm3_cca_bits, mcp_bits, cm3_tr_bits, sched_bit;
- cause = cm_error >> __ffs64(CM3_GCR_ERROR_CAUSE_ERRTYPE);
- ocause = cm_other >> __ffs(CM_GCR_ERROR_MULT_ERR2ND);
+ cause = FIELD_GET(CM3_GCR_ERROR_CAUSE_ERRTYPE, cm_error);
+ ocause = FIELD_GET(CM_GCR_ERROR_MULT_ERR2ND, cm_other);
if (!cause)
return;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 199/323] power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 198/323] mips: cm: Convert to bitfield API to fix out-of-bounds access Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 200/323] apparmor: fix error check Greg Kroah-Hartman
` (127 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrew F. Davis, Hans de Goede,
Andy Shevchenko, Sebastian Reichel, Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit cdf10ffe8f626d8a2edc354abf063df0078b2d71 ]
When registering the IRQ handler fails, do not just return the error code,
this will free the devm_kzalloc()-ed data struct while leaving the queued
work queued and the registered power_supply registered with both of them
now pointing to free-ed memory, resulting in various kernel crashes
soon afterwards.
Instead properly tear-down things on IRQ handler register errors.
Fixes: 703df6c09795 ("power: bq27xxx_battery: Reorganize I2C into a module")
Cc: Andrew F. Davis <afd@ti.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/bq27xxx_battery_i2c.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c
index 40069128ad44f..06dd5077104cc 100644
--- a/drivers/power/supply/bq27xxx_battery_i2c.c
+++ b/drivers/power/supply/bq27xxx_battery_i2c.c
@@ -195,7 +195,8 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client,
dev_err(&client->dev,
"Unable to register IRQ %d error %d\n",
client->irq, ret);
- return ret;
+ bq27xxx_battery_teardown(di);
+ goto err_failed;
}
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 200/323] apparmor: fix error check
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 199/323] power: supply: bq27xxx: Fix kernel crash on IRQ handler register error Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 201/323] rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined Greg Kroah-Hartman
` (126 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tom Rix, Nick Desaulniers,
John Johansen, Sasha Levin
From: Tom Rix <trix@redhat.com>
[ Upstream commit d108370c644b153382632b3e5511ade575c91c86 ]
clang static analysis reports this representative problem:
label.c:1463:16: warning: Assigned value is garbage or undefined
label->hname = name;
^ ~~~~
In aa_update_label_name(), this the problem block of code
if (aa_label_acntsxprint(&name, ...) == -1)
return res;
On failure, aa_label_acntsxprint() has a more complicated return
that just -1. So check for a negative return.
It was also noted that the aa_label_acntsxprint() main comment refers
to a nonexistent parameter, so clean up the comment.
Fixes: f1bd904175e8 ("apparmor: add the base fns() for domain labels")
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/label.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 6727e6fb69df2..5a80a16a7f751 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -1463,7 +1463,7 @@ bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
if (label->hname || labels_ns(label) != ns)
return res;
- if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
+ if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
return res;
ls = labels_set(label);
@@ -1713,7 +1713,7 @@ int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
/**
* aa_label_acntsxprint - allocate a __counted string buffer and print label
- * @strp: buffer to write to. (MAY BE NULL if @size == 0)
+ * @strp: buffer to write to.
* @ns: namespace profile is being viewed from
* @label: label to view (NOT NULL)
* @flags: flags controlling what label info is printed
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 201/323] rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 200/323] apparmor: fix error check Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 202/323] pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds Greg Kroah-Hartman
` (125 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnaud Pouliquen, Mathieu Poirier,
Bjorn Andersson, Sasha Levin
From: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
[ Upstream commit 537d3af1bee8ad1415fda9b622d1ea6d1ae76dfa ]
According to the description of the rpmsg_create_ept in rpmsg_core.c
the function should return NULL on error.
Fixes: 2c8a57088045 ("rpmsg: Provide function stubs for API")
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20210712123912.10672-1-arnaud.pouliquen@foss.st.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/rpmsg.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
index 9fe156d1c018e..a68972b097b72 100644
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -177,7 +177,7 @@ static inline struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *rpdev
/* This shouldn't be possible */
WARN_ON(1);
- return ERR_PTR(-ENXIO);
+ return NULL;
}
static inline int rpmsg_send(struct rpmsg_endpoint *ept, void *data, int len)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 202/323] pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 201/323] rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 203/323] drm/plane-helper: fix uninitialized variable reference Greg Kroah-Hartman
` (124 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Baptiste Lepers, Trond Myklebust,
Sasha Levin
From: Baptiste Lepers <baptiste.lepers@gmail.com>
[ Upstream commit a2915fa06227b056a8f9b0d79b61dca08ad5cfc6 ]
_nfs4_pnfs_v3/v4_ds_connect do
some work
smp_wmb
ds->ds_clp = clp;
And nfs4_ff_layout_prepare_ds currently does
smp_rmb
if(ds->ds_clp)
...
This patch places the smp_rmb after the if. This ensures that following
reads only happen once nfs4_ff_layout_prepare_ds has checked that data
has been properly initialized.
Fixes: d67ae825a59d6 ("pnfs/flexfiles: Add the FlexFile Layout Driver")
Signed-off-by: Baptiste Lepers <baptiste.lepers@gmail.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 4 ++--
fs/nfs/pnfs_nfs.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 8da239b6cc16f..f1f0519f1ecef 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -429,10 +429,10 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
goto out_fail;
ds = mirror->mirror_ds->ds;
+ if (READ_ONCE(ds->ds_clp))
+ goto out;
/* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */
smp_rmb();
- if (ds->ds_clp)
- goto out;
/* FIXME: For now we assume the server sent only one version of NFS
* to use for the DS.
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index 3f0c2436254ac..bd6190d794c49 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -635,7 +635,7 @@ static int _nfs4_pnfs_v3_ds_connect(struct nfs_server *mds_srv,
}
smp_wmb();
- ds->ds_clp = clp;
+ WRITE_ONCE(ds->ds_clp, clp);
dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr);
out:
return status;
@@ -708,7 +708,7 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv,
}
smp_wmb();
- ds->ds_clp = clp;
+ WRITE_ONCE(ds->ds_clp, clp);
dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr);
out:
return status;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 203/323] drm/plane-helper: fix uninitialized variable reference
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 202/323] pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 204/323] PCI: aardvark: Dont spam about PIO Response Status Greg Kroah-Hartman
` (123 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Simon Ser, Alex Xu (Hello71), Sasha Levin
From: Alex Xu (Hello71) <alex_y_xu@yahoo.ca>
[ Upstream commit 7be28bd73f23e53d6e7f5fe891ba9503fc0c7210 ]
drivers/gpu/drm/drm_plane_helper.c: In function 'drm_primary_helper_update':
drivers/gpu/drm/drm_plane_helper.c:113:32: error: 'visible' is used uninitialized [-Werror=uninitialized]
113 | struct drm_plane_state plane_state = {
| ^~~~~~~~~~~
drivers/gpu/drm/drm_plane_helper.c:178:14: note: 'visible' was declared here
178 | bool visible;
| ^~~~~~~
cc1: all warnings being treated as errors
visible is an output, not an input. in practice this use might turn out
OK but it's still UB.
Fixes: df86af9133b4 ("drm/plane-helper: Add drm_plane_helper_check_state()")
Reviewed-by: Simon Ser <contact@emersion.fr>
Signed-off-by: Alex Xu (Hello71) <alex_y_xu@yahoo.ca>
Signed-off-by: Simon Ser <contact@emersion.fr>
Link: https://patchwork.freedesktop.org/patch/msgid/20211007063706.305984-1-alex_y_xu@yahoo.ca
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_plane_helper.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c
index 621f17643bb07..1f3362ce47ae2 100644
--- a/drivers/gpu/drm/drm_plane_helper.c
+++ b/drivers/gpu/drm/drm_plane_helper.c
@@ -150,7 +150,6 @@ int drm_plane_helper_check_update(struct drm_plane *plane,
.crtc_w = drm_rect_width(dst),
.crtc_h = drm_rect_height(dst),
.rotation = rotation,
- .visible = *visible,
};
struct drm_crtc_state crtc_state = {
.crtc = crtc,
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 204/323] PCI: aardvark: Dont spam about PIO Response Status
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 203/323] drm/plane-helper: fix uninitialized variable reference Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 205/323] NFS: Fix deadlocks in nfs_scan_commit_list() Greg Kroah-Hartman
` (122 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Behún, Lorenzo Pieralisi,
Sasha Levin
From: Marek Behún <kabel@kernel.org>
[ Upstream commit 464de7e7fff767e87429cd7be09c4f2cb50a6ccb ]
Use dev_dbg() instead of dev_err() in advk_pcie_check_pio_status().
For example CRS is not an error status, it just says that the request
should be retried.
Link: https://lore.kernel.org/r/20211005180952.6812-4-kabel@kernel.org
Fixes: 8c39d710363c1 ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pci-aardvark.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index e5ac846e2a20f..98fb3c1f45e4d 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -404,7 +404,7 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val)
else
str_posted = "Posted";
- dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n",
+ dev_dbg(dev, "%s PIO Response Status: %s, %#x @ %#x\n",
str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS));
return -EFAULT;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 205/323] NFS: Fix deadlocks in nfs_scan_commit_list()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 204/323] PCI: aardvark: Dont spam about PIO Response Status Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 206/323] fs: orangefs: fix error return code of orangefs_revalidate_lookup() Greg Kroah-Hartman
` (121 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Sasha Levin
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 64a93dbf25d3a1368bb58ddf0f61d0a92d7479e3 ]
Partially revert commit 2ce209c42c01 ("NFS: Wait for requests that are
locked on the commit list"), since it can lead to deadlocks between
commit requests and nfs_join_page_group().
For now we should assume that any locked requests on the commit list are
either about to be removed and committed by another task, or the writes
they describe are about to be retransmitted. In either case, we should
not need to worry.
Fixes: 2ce209c42c01 ("NFS: Wait for requests that are locked on the commit list")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/write.c | 17 ++---------------
1 file changed, 2 insertions(+), 15 deletions(-)
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index d419d89b91f7c..ec0fd6b3d185a 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1045,25 +1045,11 @@ nfs_scan_commit_list(struct list_head *src, struct list_head *dst,
struct nfs_page *req, *tmp;
int ret = 0;
-restart:
list_for_each_entry_safe(req, tmp, src, wb_list) {
kref_get(&req->wb_kref);
if (!nfs_lock_request(req)) {
- int status;
-
- /* Prevent deadlock with nfs_lock_and_join_requests */
- if (!list_empty(dst)) {
- nfs_release_request(req);
- continue;
- }
- /* Ensure we make progress to prevent livelock */
- mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
- status = nfs_wait_on_request(req);
nfs_release_request(req);
- mutex_lock(&NFS_I(cinfo->inode)->commit_mutex);
- if (status < 0)
- break;
- goto restart;
+ continue;
}
nfs_request_remove_commit_list(req, cinfo);
clear_bit(PG_COMMIT_TO_DS, &req->wb_flags);
@@ -1911,6 +1897,7 @@ static int __nfs_commit_inode(struct inode *inode, int how,
int may_wait = how & FLUSH_SYNC;
int ret, nscan;
+ how &= ~FLUSH_SYNC;
nfs_init_cinfo_from_inode(&cinfo, inode);
nfs_commit_begin(cinfo.mds);
for (;;) {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 206/323] fs: orangefs: fix error return code of orangefs_revalidate_lookup()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 205/323] NFS: Fix deadlocks in nfs_scan_commit_list() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 207/323] mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() Greg Kroah-Hartman
` (120 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, TOTE Robot, Jia-Ju Bai,
Mike Marshall, Sasha Levin
From: Jia-Ju Bai <baijiaju1990@gmail.com>
[ Upstream commit 4c2b46c824a78fc8190d8eafaaea5a9078fe7479 ]
When op_alloc() returns NULL to new_op, no error return code of
orangefs_revalidate_lookup() is assigned.
To fix this bug, ret is assigned with -ENOMEM in this case.
Fixes: 8bb8aefd5afb ("OrangeFS: Change almost all instances of the string PVFS2 to OrangeFS.")
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/orangefs/dcache.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/orangefs/dcache.c b/fs/orangefs/dcache.c
index fe484cf93e5cd..8bbe9486e3a62 100644
--- a/fs/orangefs/dcache.c
+++ b/fs/orangefs/dcache.c
@@ -26,8 +26,10 @@ static int orangefs_revalidate_lookup(struct dentry *dentry)
gossip_debug(GOSSIP_DCACHE_DEBUG, "%s: attempting lookup.\n", __func__);
new_op = op_alloc(ORANGEFS_VFS_OP_LOOKUP);
- if (!new_op)
+ if (!new_op) {
+ ret = -ENOMEM;
goto out_put_parent;
+ }
new_op->upcall.req.lookup.sym_follow = ORANGEFS_LOOKUP_LINK_NO_FOLLOW;
new_op->upcall.req.lookup.parent_refn = parent->refn;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 207/323] mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 206/323] fs: orangefs: fix error return code of orangefs_revalidate_lookup() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 208/323] dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro Greg Kroah-Hartman
` (119 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Evgeny Novikov, Tudor Ambarus,
Pratyush Yadav, Sasha Levin
From: Evgeny Novikov <novikov@ispras.ru>
[ Upstream commit 78e4d342187625585932bb437ec26e1060f7fc6f ]
hisi_spi_nor_probe() invokes clk_disable_unprepare() on all paths after
successful call of clk_prepare_enable(). Besides, the clock is enabled by
hispi_spi_nor_prep() and disabled by hispi_spi_nor_unprep(). So at remove
time it is not possible to have the clock enabled. The patch removes
excessive clk_disable_unprepare() from hisi_spi_nor_remove().
Found by Linux Driver Verification project (linuxtesting.org).
Fixes: e523f11141bd ("mtd: spi-nor: add hisilicon spi-nor flash controller driver")
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Reviewed-by: Pratyush Yadav <p.yadav@ti.com>
Link: https://lore.kernel.org/r/20210709144529.31379-1-novikov@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/spi-nor/hisi-sfc.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/mtd/spi-nor/hisi-sfc.c b/drivers/mtd/spi-nor/hisi-sfc.c
index 184ba5069ac51..36d2eb0918d9f 100644
--- a/drivers/mtd/spi-nor/hisi-sfc.c
+++ b/drivers/mtd/spi-nor/hisi-sfc.c
@@ -485,7 +485,6 @@ static int hisi_spi_nor_remove(struct platform_device *pdev)
hisi_spi_nor_unregister_all(host);
mutex_destroy(&host->lock);
- clk_disable_unprepare(host->clk);
return 0;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 208/323] dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 207/323] mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 209/323] auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string Greg Kroah-Hartman
` (118 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Tudor Ambarus,
Vinod Koul, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 320c88a3104dc955f928a1eecebd551ff89530c0 ]
AT_XDMAC_CC_PERID() should be used to setup bits 24..30 of XDMAC_CC
register. Using it without parenthesis around 0x7f & (i) will lead to
setting all the time zero for bits 24..30 of XDMAC_CC as the << operator
has higher precedence over bitwise &. Thus, add paranthesis around
0x7f & (i).
Fixes: 15a03850ab8f ("dmaengine: at_xdmac: fix macro typo")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20211007111230.2331837-3-claudiu.beznea@microchip.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/at_xdmac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 7db66f974041e..1624eee76f96a 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -156,7 +156,7 @@
#define AT_XDMAC_CC_WRIP (0x1 << 23) /* Write in Progress (read only) */
#define AT_XDMAC_CC_WRIP_DONE (0x0 << 23)
#define AT_XDMAC_CC_WRIP_IN_PROGRESS (0x1 << 23)
-#define AT_XDMAC_CC_PERID(i) (0x7f & (i) << 24) /* Channel Peripheral Identifier */
+#define AT_XDMAC_CC_PERID(i) ((0x7f & (i)) << 24) /* Channel Peripheral Identifier */
#define AT_XDMAC_CDS_MSP 0x2C /* Channel Data Stride Memory Set Pattern */
#define AT_XDMAC_CSUS 0x30 /* Channel Source Microblock Stride */
#define AT_XDMAC_CDUS 0x34 /* Channel Destination Microblock Stride */
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 209/323] auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 208/323] dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 210/323] auxdisplay: ht16k33: Connect backlight to fbdev Greg Kroah-Hartman
` (117 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Miguel Ojeda,
Sasha Levin
From: Geert Uytterhoeven <geert@linux-m68k.org>
[ Upstream commit afcb5a811ff3ab3969f09666535eb6018a160358 ]
While writing an empty string to a device attribute is a no-op, and thus
does not need explicit safeguards, the user can still write a single
newline to an attribute file:
echo > .../message
If that happens, img_ascii_lcd_display() trims the newline, yielding an
empty string, and causing an infinite loop in img_ascii_lcd_scroll().
Fix this by adding a check for empty strings. Clear the display in case
one is encountered.
Fixes: 0cad855fbd083ee5 ("auxdisplay: img-ascii-lcd: driver for simple ASCII LCD displays")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/auxdisplay/img-ascii-lcd.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index 834509506ef64..c4bc6723acfa5 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -284,6 +284,16 @@ static int img_ascii_lcd_display(struct img_ascii_lcd_ctx *ctx,
if (msg[count - 1] == '\n')
count--;
+ if (!count) {
+ /* clear the LCD */
+ devm_kfree(&ctx->pdev->dev, ctx->message);
+ ctx->message = NULL;
+ ctx->message_len = 0;
+ memset(ctx->curr, ' ', ctx->cfg->num_chars);
+ ctx->cfg->update(ctx);
+ return 0;
+ }
+
new_msg = devm_kmalloc(&ctx->pdev->dev, count + 1, GFP_KERNEL);
if (!new_msg)
return -ENOMEM;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 210/323] auxdisplay: ht16k33: Connect backlight to fbdev
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 209/323] auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 211/323] auxdisplay: ht16k33: Fix frame buffer device blanking Greg Kroah-Hartman
` (116 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven,
Robin van der Gracht, Miguel Ojeda, Sasha Levin
From: Geert Uytterhoeven <geert@linux-m68k.org>
[ Upstream commit 80f9eb70fd9276938f0a131f76d438021bfd8b34 ]
Currently /sys/class/graphics/fb0/bl_curve is not accessible (-ENODEV),
as the driver does not connect the backlight to the frame buffer device.
Fix this moving backlight initialization up, and filling in
fb_info.bl_dev.
Fixes: 8992da44c6805d53 ("auxdisplay: ht16k33: Driver for LED controller")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/auxdisplay/ht16k33.c | 56 ++++++++++++++++++------------------
1 file changed, 28 insertions(+), 28 deletions(-)
diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
index 194370ae37dd0..f6927871fa4e8 100644
--- a/drivers/auxdisplay/ht16k33.c
+++ b/drivers/auxdisplay/ht16k33.c
@@ -418,6 +418,33 @@ static int ht16k33_probe(struct i2c_client *client,
if (err)
return err;
+ /* Backlight */
+ memset(&bl_props, 0, sizeof(struct backlight_properties));
+ bl_props.type = BACKLIGHT_RAW;
+ bl_props.max_brightness = MAX_BRIGHTNESS;
+
+ bl = devm_backlight_device_register(&client->dev, DRIVER_NAME"-bl",
+ &client->dev, priv,
+ &ht16k33_bl_ops, &bl_props);
+ if (IS_ERR(bl)) {
+ dev_err(&client->dev, "failed to register backlight\n");
+ return PTR_ERR(bl);
+ }
+
+ err = of_property_read_u32(node, "default-brightness-level",
+ &dft_brightness);
+ if (err) {
+ dft_brightness = MAX_BRIGHTNESS;
+ } else if (dft_brightness > MAX_BRIGHTNESS) {
+ dev_warn(&client->dev,
+ "invalid default brightness level: %u, using %u\n",
+ dft_brightness, MAX_BRIGHTNESS);
+ dft_brightness = MAX_BRIGHTNESS;
+ }
+
+ bl->props.brightness = dft_brightness;
+ ht16k33_bl_update_status(bl);
+
/* Framebuffer (2 bytes per column) */
BUILD_BUG_ON(PAGE_SIZE < HT16K33_FB_SIZE);
fbdev->buffer = (unsigned char *) get_zeroed_page(GFP_KERNEL);
@@ -450,6 +477,7 @@ static int ht16k33_probe(struct i2c_client *client,
fbdev->info->screen_size = HT16K33_FB_SIZE;
fbdev->info->fix = ht16k33_fb_fix;
fbdev->info->var = ht16k33_fb_var;
+ fbdev->info->bl_dev = bl;
fbdev->info->pseudo_palette = NULL;
fbdev->info->flags = FBINFO_FLAG_DEFAULT;
fbdev->info->par = priv;
@@ -462,34 +490,6 @@ static int ht16k33_probe(struct i2c_client *client,
if (err)
goto err_fbdev_unregister;
- /* Backlight */
- memset(&bl_props, 0, sizeof(struct backlight_properties));
- bl_props.type = BACKLIGHT_RAW;
- bl_props.max_brightness = MAX_BRIGHTNESS;
-
- bl = devm_backlight_device_register(&client->dev, DRIVER_NAME"-bl",
- &client->dev, priv,
- &ht16k33_bl_ops, &bl_props);
- if (IS_ERR(bl)) {
- dev_err(&client->dev, "failed to register backlight\n");
- err = PTR_ERR(bl);
- goto err_fbdev_unregister;
- }
-
- err = of_property_read_u32(node, "default-brightness-level",
- &dft_brightness);
- if (err) {
- dft_brightness = MAX_BRIGHTNESS;
- } else if (dft_brightness > MAX_BRIGHTNESS) {
- dev_warn(&client->dev,
- "invalid default brightness level: %u, using %u\n",
- dft_brightness, MAX_BRIGHTNESS);
- dft_brightness = MAX_BRIGHTNESS;
- }
-
- bl->props.brightness = dft_brightness;
- ht16k33_bl_update_status(bl);
-
ht16k33_fb_queue(priv);
return 0;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 211/323] auxdisplay: ht16k33: Fix frame buffer device blanking
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 210/323] auxdisplay: ht16k33: Connect backlight to fbdev Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 212/323] netfilter: nfnetlink_queue: fix OOB when mac header was cleared Greg Kroah-Hartman
` (115 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robin van der Gracht,
Geert Uytterhoeven, Miguel Ojeda, Sasha Levin
From: Geert Uytterhoeven <geert@linux-m68k.org>
[ Upstream commit 840fe258332544aa7321921e1723d37b772af7a9 ]
As the ht16k33 frame buffer sub-driver does not register an
fb_ops.fb_blank() handler, blanking does not work:
$ echo 1 > /sys/class/graphics/fb0/blank
sh: write error: Invalid argument
Fix this by providing a handler that always returns zero, to make sure
blank events will be sent to the actual device handling the backlight.
Reported-by: Robin van der Gracht <robin@protonic.nl>
Suggested-by: Robin van der Gracht <robin@protonic.nl>
Fixes: 8992da44c6805d53 ("auxdisplay: ht16k33: Driver for LED controller")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/auxdisplay/ht16k33.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
index f6927871fa4e8..03a87dd1f625e 100644
--- a/drivers/auxdisplay/ht16k33.c
+++ b/drivers/auxdisplay/ht16k33.c
@@ -219,6 +219,15 @@ static const struct backlight_ops ht16k33_bl_ops = {
.check_fb = ht16k33_bl_check_fb,
};
+/*
+ * Blank events will be passed to the actual device handling the backlight when
+ * we return zero here.
+ */
+static int ht16k33_blank(int blank, struct fb_info *info)
+{
+ return 0;
+}
+
static int ht16k33_mmap(struct fb_info *info, struct vm_area_struct *vma)
{
struct ht16k33_priv *priv = info->par;
@@ -231,6 +240,7 @@ static struct fb_ops ht16k33_fb_ops = {
.owner = THIS_MODULE,
.fb_read = fb_sys_read,
.fb_write = fb_sys_write,
+ .fb_blank = ht16k33_blank,
.fb_fillrect = sys_fillrect,
.fb_copyarea = sys_copyarea,
.fb_imageblit = sys_imageblit,
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 212/323] netfilter: nfnetlink_queue: fix OOB when mac header was cleared
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 211/323] auxdisplay: ht16k33: Fix frame buffer device blanking Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 213/323] dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` Greg Kroah-Hartman
` (114 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 5648b5e1169ff1d6d6a46c35c0b5fbebd2a5cbb2 ]
On 64bit platforms the MAC header is set to 0xffff on allocation and
also when a helper like skb_unset_mac_header() is called.
dev_parse_header may call skb_mac_header() which assumes valid mac offset:
BUG: KASAN: use-after-free in eth_header_parse+0x75/0x90
Read of size 6 at addr ffff8881075a5c05 by task nf-queue/1364
Call Trace:
memcpy+0x20/0x60
eth_header_parse+0x75/0x90
__nfqnl_enqueue_packet+0x1a61/0x3380
__nf_queue+0x597/0x1300
nf_queue+0xf/0x40
nf_hook_slow+0xed/0x190
nf_hook+0x184/0x440
ip_output+0x1c0/0x2a0
nf_reinject+0x26f/0x700
nfqnl_recv_verdict+0xa16/0x18b0
nfnetlink_rcv_msg+0x506/0xe70
The existing code only works if the skb has a mac header.
Fixes: 2c38de4c1f8da7 ("netfilter: fix looped (broad|multi)cast's MAC handling")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nfnetlink_queue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index f81a3ce0fe48e..eb5a052d3b252 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -566,7 +566,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
goto nla_put_failure;
if (indev && entskb->dev &&
- entskb->mac_header != entskb->network_header) {
+ skb_mac_header_was_set(entskb)) {
struct nfqnl_msg_packet_hw phw;
int len;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 213/323] dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 212/323] netfilter: nfnetlink_queue: fix OOB when mac header was cleared Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 214/323] m68k: set a default value for MEMORY_RESERVE Greg Kroah-Hartman
` (113 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lars-Peter Clausen, Dave Jiang,
Vinod Koul, Sasha Levin
From: Lars-Peter Clausen <lars@metafoo.de>
[ Upstream commit e7e1e880b114ca640a2f280b0d5d38aed98f98c6 ]
Before the `callback_result` callback was introduced drivers coded their
invocation to the callback in a similar way to:
if (cb->callback) {
spin_unlock(&dma->lock);
cb->callback(cb->callback_param);
spin_lock(&dma->lock);
}
With the introduction of `callback_result` two helpers where introduced to
transparently handle both types of callbacks. And drivers where updated to
look like this:
if (dmaengine_desc_callback_valid(cb)) {
spin_unlock(&dma->lock);
dmaengine_desc_callback_invoke(cb, ...);
spin_lock(&dma->lock);
}
dmaengine_desc_callback_invoke() correctly handles both `callback_result`
and `callback`. But we forgot to update the dmaengine_desc_callback_valid()
function to check for `callback_result`. As a result DMA descriptors that
use the `callback_result` rather than `callback` don't have their callback
invoked by drivers that follow the pattern above.
Fix this by checking for both `callback` and `callback_result` in
dmaengine_desc_callback_valid().
Fixes: f067025bc676 ("dmaengine: add support to provide error result from a DMA transation")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/20211023134101.28042-1-lars@metafoo.de
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dmaengine.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/dmaengine.h b/drivers/dma/dmaengine.h
index 501c0b063f852..302f13efd35d9 100644
--- a/drivers/dma/dmaengine.h
+++ b/drivers/dma/dmaengine.h
@@ -168,7 +168,7 @@ dmaengine_desc_get_callback_invoke(struct dma_async_tx_descriptor *tx,
static inline bool
dmaengine_desc_callback_valid(struct dmaengine_desc_callback *cb)
{
- return (cb->callback) ? true : false;
+ return cb->callback || cb->callback_result;
}
#endif
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 214/323] m68k: set a default value for MEMORY_RESERVE
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 213/323] dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 215/323] watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT Greg Kroah-Hartman
` (112 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Geert Uytterhoeven,
Greg Ungerer, linux-m68k, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 1aaa557b2db95c9506ed0981bc34505c32d6b62b ]
'make randconfig' can produce a .config file with
"CONFIG_MEMORY_RESERVE=" (no value) since it has no default.
When a subsequent 'make all' is done, kconfig restarts the config
and prompts for a value for MEMORY_RESERVE. This breaks
scripting/automation where there is no interactive user input.
Add a default value for MEMORY_RESERVE. (Any integer value will
work here for kconfig.)
Fixes a kconfig warning:
.config:214:warning: symbol value '' invalid for MEMORY_RESERVE
* Restart config...
Memory reservation (MiB) (MEMORY_RESERVE) [] (NEW)
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") # from beginning of git history
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Greg Ungerer <gerg@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/m68k/Kconfig.machine | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/m68k/Kconfig.machine b/arch/m68k/Kconfig.machine
index 64a6414677360..0c451081432ab 100644
--- a/arch/m68k/Kconfig.machine
+++ b/arch/m68k/Kconfig.machine
@@ -185,6 +185,7 @@ config INIT_LCD
config MEMORY_RESERVE
int "Memory reservation (MiB)"
depends on (UCSIMM || UCDIMM)
+ default 0
help
Reserve certain memory regions on 68x328 based boards.
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 215/323] watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 214/323] m68k: set a default value for MEMORY_RESERVE Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 216/323] ar7: fix kernel builds for compiler test Greg Kroah-Hartman
` (111 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Ahmad Fatoum,
Wim Van Sebroeck, Sasha Levin
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
[ Upstream commit 164483c735190775f29d0dcbac0363adc51a068d ]
The fintek watchdog timer can configure timeouts of second granularity
only up to 255 seconds. Beyond that, the timeout needs to be configured
with minute granularity. WDIOC_GETTIMEOUT should report the actual
timeout configured, not just echo back the timeout configured by the
user. Do so.
Fixes: 96cb4eb019ce ("watchdog: f71808e_wdt: new watchdog driver for Fintek F71808E and F71882FG")
Suggested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.kernel.org/r/5e17960fe8cc0e3cb2ba53de4730b75d9a0f33d5.1628525954.git-series.a.fatoum@pengutronix.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/f71808e_wdt.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
index 5d0ea419070dc..6b751d1aab084 100644
--- a/drivers/watchdog/f71808e_wdt.c
+++ b/drivers/watchdog/f71808e_wdt.c
@@ -237,15 +237,17 @@ static int watchdog_set_timeout(int timeout)
mutex_lock(&watchdog.lock);
- watchdog.timeout = timeout;
if (timeout > 0xff) {
watchdog.timer_val = DIV_ROUND_UP(timeout, 60);
watchdog.minutes_mode = true;
+ timeout = watchdog.timer_val * 60;
} else {
watchdog.timer_val = timeout;
watchdog.minutes_mode = false;
}
+ watchdog.timeout = timeout;
+
mutex_unlock(&watchdog.lock);
return 0;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 216/323] ar7: fix kernel builds for compiler test
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 215/323] watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 217/323] scsi: qla2xxx: Fix gnl list corruption Greg Kroah-Hartman
` (110 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jackie Liu, Guenter Roeck,
Wim Van Sebroeck, Sasha Levin
From: Jackie Liu <liuyun01@kylinos.cn>
[ Upstream commit 28b7ee33a2122569ac065cad578bf23f50cc65c3 ]
TI AR7 Watchdog Timer is only build for 32bit.
Avoid error like:
In file included from drivers/watchdog/ar7_wdt.c:29:
./arch/mips/include/asm/mach-ar7/ar7.h: In function ‘ar7_is_titan’:
./arch/mips/include/asm/mach-ar7/ar7.h:111:24: error: implicit declaration of function ‘KSEG1ADDR’; did you mean ‘CKSEG1ADDR’? [-Werror=implicit-function-declaration]
111 | return (readl((void *)KSEG1ADDR(AR7_REGS_GPIO + 0x24)) & 0xffff) ==
| ^~~~~~~~~
| CKSEG1ADDR
Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20210907024904.4127611-1-liu.yun@linux.dev
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index fa7f4c61524d9..92fdc7dc2ede5 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -1524,7 +1524,7 @@ config SIBYTE_WDOG
config AR7_WDT
tristate "TI AR7 Watchdog Timer"
- depends on AR7 || (MIPS && COMPILE_TEST)
+ depends on AR7 || (MIPS && 32BIT && COMPILE_TEST)
help
Hardware driver for the TI AR7 Watchdog Timer.
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 217/323] scsi: qla2xxx: Fix gnl list corruption
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 216/323] ar7: fix kernel builds for compiler test Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 218/323] scsi: qla2xxx: Turn off target reset during issue_lip Greg Kroah-Hartman
` (109 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Quinn Tran,
Nilesh Javali, Martin K. Petersen, Sasha Levin
From: Quinn Tran <qutran@marvell.com>
[ Upstream commit c98c5daaa24b583cba1369b7d167f93c6ae7299c ]
Current code does list element deletion and addition in and out of lock
protection. This patch moves deletion behind lock.
list_add double add: new=ffff9130b5eb89f8, prev=ffff9130b5eb89f8,
next=ffff9130c6a715f0.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:31!
invalid opcode: 0000 [#1] SMP PTI
CPU: 1 PID: 182395 Comm: kworker/1:37 Kdump: loaded Tainted: G W OE
--------- - - 4.18.0-193.el8.x86_64 #1
Hardware name: HP ProLiant DL160 Gen8, BIOS J03 02/10/2014
Workqueue: qla2xxx_wq qla2x00_iocb_work_fn [qla2xxx]
RIP: 0010:__list_add_valid+0x41/0x50
Code: 85 94 00 00 00 48 39 c7 74 0b 48 39 d7 74 06 b8 01 00 00 00 c3 48 89 f2
4c 89 c1 48 89 fe 48 c7 c7 60 83 ad 97 e8 4d bd ce ff <0f> 0b 0f 1f 00 66 2e
0f 1f 84 00 00 00 00 00 48 8b 07 48 8b 57 08
RSP: 0018:ffffaba306f47d68 EFLAGS: 00010046
RAX: 0000000000000058 RBX: ffff9130b5eb8800 RCX: 0000000000000006
RDX: 0000000000000000 RSI: 0000000000000096 RDI: ffff9130b7456a00
RBP: ffff9130c6a70a58 R08: 000000000008d7be R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: ffff9130c6a715f0
R13: ffff9130b5eb8824 R14: ffff9130b5eb89f8 R15: ffff9130b5eb89f8
FS: 0000000000000000(0000) GS:ffff9130b7440000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efcaaef11a0 CR3: 000000005200a002 CR4: 00000000000606e0
Call Trace:
qla24xx_async_gnl+0x113/0x3c0 [qla2xxx]
? qla2x00_iocb_work_fn+0x53/0x80 [qla2xxx]
? process_one_work+0x1a7/0x3b0
? worker_thread+0x30/0x390
? create_worker+0x1a0/0x1a0
? kthread+0x112/0x130
Link: https://lore.kernel.org/r/20211026115412.27691-3-njavali@marvell.com
Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery")
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_init.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 2ebf4e4e02344..613e5467b4bc2 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -797,8 +797,6 @@ qla24xx_async_gnl_sp_done(void *s, int res)
sp->name, res, sp->u.iocb_cmd.u.mbx.in_mb[1],
sp->u.iocb_cmd.u.mbx.in_mb[2]);
- if (res == QLA_FUNCTION_TIMEOUT)
- return;
sp->fcport->flags &= ~(FCF_ASYNC_SENT|FCF_ASYNC_ACTIVE);
memset(&ea, 0, sizeof(ea));
@@ -837,8 +835,8 @@ qla24xx_async_gnl_sp_done(void *s, int res)
spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
list_for_each_entry_safe(fcport, tf, &h, gnl_entry) {
- list_del_init(&fcport->gnl_entry);
spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+ list_del_init(&fcport->gnl_entry);
fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
ea.fcport = fcport;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 218/323] scsi: qla2xxx: Turn off target reset during issue_lip
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 217/323] scsi: qla2xxx: Fix gnl list corruption Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 219/323] i2c: xlr: Fix a resource leak in the error handling path of xlr_i2c_probe() Greg Kroah-Hartman
` (108 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Himanshu Madhani, Quinn Tran,
Nilesh Javali, Martin K. Petersen, Sasha Levin
From: Quinn Tran <qutran@marvell.com>
[ Upstream commit 0b7a9fd934a68ebfc1019811b7bdc1742072ad7b ]
When user uses issue_lip to do link bounce, driver sends additional target
reset to remote device before resetting the link. The target reset would
affect other paths with active I/Os. This patch will remove the unnecessary
target reset.
Link: https://lore.kernel.org/r/20211026115412.27691-4-njavali@marvell.com
Fixes: 5854771e314e ("[SCSI] qla2xxx: Add ISPFX00 specific bus reset routine")
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_gbl.h | 2 --
drivers/scsi/qla2xxx/qla_mr.c | 23 -----------------------
drivers/scsi/qla2xxx/qla_os.c | 27 ++-------------------------
3 files changed, 2 insertions(+), 50 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index b8e4abe804d5d..5b98a00bfc178 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -144,7 +144,6 @@ extern int ql2xasynctmfenable;
extern int ql2xgffidenable;
extern int ql2xenabledif;
extern int ql2xenablehba_err_chk;
-extern int ql2xtargetreset;
extern int ql2xdontresethba;
extern uint64_t ql2xmaxlun;
extern int ql2xmdcapmask;
@@ -754,7 +753,6 @@ extern void qlafx00_abort_iocb(srb_t *, struct abort_iocb_entry_fx00 *);
extern void qlafx00_fxdisc_iocb(srb_t *, struct fxdisc_entry_fx00 *);
extern void qlafx00_timer_routine(scsi_qla_host_t *);
extern int qlafx00_rescan_isp(scsi_qla_host_t *);
-extern int qlafx00_loop_reset(scsi_qla_host_t *vha);
/* qla82xx related functions */
diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c
index 521a513705549..0c00aaea9768b 100644
--- a/drivers/scsi/qla2xxx/qla_mr.c
+++ b/drivers/scsi/qla2xxx/qla_mr.c
@@ -739,29 +739,6 @@ qlafx00_lun_reset(fc_port_t *fcport, uint64_t l, int tag)
return qla2x00_async_tm_cmd(fcport, TCF_LUN_RESET, l, tag);
}
-int
-qlafx00_loop_reset(scsi_qla_host_t *vha)
-{
- int ret;
- struct fc_port *fcport;
- struct qla_hw_data *ha = vha->hw;
-
- if (ql2xtargetreset) {
- list_for_each_entry(fcport, &vha->vp_fcports, list) {
- if (fcport->port_type != FCT_TARGET)
- continue;
-
- ret = ha->isp_ops->target_reset(fcport, 0, 0);
- if (ret != QLA_SUCCESS) {
- ql_dbg(ql_dbg_taskm, vha, 0x803d,
- "Bus Reset failed: Reset=%d "
- "d_id=%x.\n", ret, fcport->d_id.b24);
- }
- }
- }
- return QLA_SUCCESS;
-}
-
int
qlafx00_iospace_config(struct qla_hw_data *ha)
{
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 7cbdd32a238d4..207af1d5ed292 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -188,12 +188,6 @@ MODULE_PARM_DESC(ql2xdbwr,
" 0 -- Regular doorbell.\n"
" 1 -- CAMRAM doorbell (faster).\n");
-int ql2xtargetreset = 1;
-module_param(ql2xtargetreset, int, S_IRUGO);
-MODULE_PARM_DESC(ql2xtargetreset,
- "Enable target reset."
- "Default is 1 - use hw defaults.");
-
int ql2xgffidenable;
module_param(ql2xgffidenable, int, S_IRUGO);
MODULE_PARM_DESC(ql2xgffidenable,
@@ -1662,27 +1656,10 @@ int
qla2x00_loop_reset(scsi_qla_host_t *vha)
{
int ret;
- struct fc_port *fcport;
struct qla_hw_data *ha = vha->hw;
- if (IS_QLAFX00(ha)) {
- return qlafx00_loop_reset(vha);
- }
-
- if (ql2xtargetreset == 1 && ha->flags.enable_target_reset) {
- list_for_each_entry(fcport, &vha->vp_fcports, list) {
- if (fcport->port_type != FCT_TARGET)
- continue;
-
- ret = ha->isp_ops->target_reset(fcport, 0, 0);
- if (ret != QLA_SUCCESS) {
- ql_dbg(ql_dbg_taskm, vha, 0x802c,
- "Bus Reset failed: Reset=%d "
- "d_id=%x.\n", ret, fcport->d_id.b24);
- }
- }
- }
-
+ if (IS_QLAFX00(ha))
+ return QLA_SUCCESS;
if (ha->flags.enable_lip_full_login && !IS_CNA_CAPABLE(ha)) {
atomic_set(&vha->loop_state, LOOP_DOWN);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 219/323] i2c: xlr: Fix a resource leak in the error handling path of xlr_i2c_probe()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 218/323] scsi: qla2xxx: Turn off target reset during issue_lip Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 220/323] xen-pciback: Fix return in pm_ctrl_init() Greg Kroah-Hartman
` (107 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Wolfram Sang,
Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 7f98960c046ee1136e7096aee168eda03aef8a5d ]
A successful 'clk_prepare()' call should be balanced by a corresponding
'clk_unprepare()' call in the error handling path of the probe, as already
done in the remove function.
More specifically, 'clk_prepare_enable()' is used, but 'clk_disable()' is
also already called. So just the unprepare step has still to be done.
Update the error handling path accordingly.
Fixes: 75d31c2372e4 ("i2c: xlr: add support for Sigma Designs controller variant")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-xlr.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/i2c/busses/i2c-xlr.c b/drivers/i2c/busses/i2c-xlr.c
index 34cd4b3085402..dda6cb848405b 100644
--- a/drivers/i2c/busses/i2c-xlr.c
+++ b/drivers/i2c/busses/i2c-xlr.c
@@ -433,11 +433,15 @@ static int xlr_i2c_probe(struct platform_device *pdev)
i2c_set_adapdata(&priv->adap, priv);
ret = i2c_add_numbered_adapter(&priv->adap);
if (ret < 0)
- return ret;
+ goto err_unprepare_clk;
platform_set_drvdata(pdev, priv);
dev_info(&priv->adap.dev, "Added I2C Bus.\n");
return 0;
+
+err_unprepare_clk:
+ clk_unprepare(clk);
+ return ret;
}
static int xlr_i2c_remove(struct platform_device *pdev)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 220/323] xen-pciback: Fix return in pm_ctrl_init()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 219/323] i2c: xlr: Fix a resource leak in the error handling path of xlr_i2c_probe() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 221/323] net: davinci_emac: Fix interrupt pacing disable Greg Kroah-Hartman
` (106 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, YueHaibing, Juergen Gross,
Boris Ostrovsky, Sasha Levin
From: YueHaibing <yuehaibing@huawei.com>
[ Upstream commit 4745ea2628bb43a7ec34b71763b5a56407b33990 ]
Return NULL instead of passing to ERR_PTR while err is zero,
this fix smatch warnings:
drivers/xen/xen-pciback/conf_space_capability.c:163
pm_ctrl_init() warn: passing zero to 'ERR_PTR'
Fixes: a92336a1176b ("xen/pciback: Drop two backends, squash and cleanup some code.")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20211008074417.8260-1-yuehaibing@huawei.com
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/xen-pciback/conf_space_capability.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c
index e5694133ebe57..42f0f64fcba47 100644
--- a/drivers/xen/xen-pciback/conf_space_capability.c
+++ b/drivers/xen/xen-pciback/conf_space_capability.c
@@ -160,7 +160,7 @@ static void *pm_ctrl_init(struct pci_dev *dev, int offset)
}
out:
- return ERR_PTR(err);
+ return err ? ERR_PTR(err) : NULL;
}
static const struct config_field caplist_pm[] = {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 221/323] net: davinci_emac: Fix interrupt pacing disable
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 220/323] xen-pciback: Fix return in pm_ctrl_init() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 222/323] net: vlan: fix a UAF in vlan_dev_real_dev() Greg Kroah-Hartman
` (105 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maxim Kiselev, Grygorii Strashko,
Jakub Kicinski, Sasha Levin
From: Maxim Kiselev <bigunclemax@gmail.com>
[ Upstream commit d52bcb47bdf971a59a2467975d2405fcfcb2fa19 ]
This patch allows to use 0 for `coal->rx_coalesce_usecs` param to
disable rx irq coalescing.
Previously we could enable rx irq coalescing via ethtool
(For ex: `ethtool -C eth0 rx-usecs 2000`) but we couldn't disable
it because this part rejects 0 value:
if (!coal->rx_coalesce_usecs)
return -EINVAL;
Fixes: 84da2658a619 ("TI DaVinci EMAC : Implement interrupt pacing functionality.")
Signed-off-by: Maxim Kiselev <bigunclemax@gmail.com>
Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Link: https://lore.kernel.org/r/20211101152343.4193233-1-bigunclemax@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/davinci_emac.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 56130cf293f37..566da1e3cfbcc 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -426,8 +426,20 @@ static int emac_set_coalesce(struct net_device *ndev,
u32 int_ctrl, num_interrupts = 0;
u32 prescale = 0, addnl_dvdr = 1, coal_intvl = 0;
- if (!coal->rx_coalesce_usecs)
- return -EINVAL;
+ if (!coal->rx_coalesce_usecs) {
+ priv->coal_intvl = 0;
+
+ switch (priv->version) {
+ case EMAC_VERSION_2:
+ emac_ctrl_write(EMAC_DM646X_CMINTCTRL, 0);
+ break;
+ default:
+ emac_ctrl_write(EMAC_CTRL_EWINTTCNT, 0);
+ break;
+ }
+
+ return 0;
+ }
coal_intvl = coal->rx_coalesce_usecs;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 222/323] net: vlan: fix a UAF in vlan_dev_real_dev()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 221/323] net: davinci_emac: Fix interrupt pacing disable Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 223/323] ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses Greg Kroah-Hartman
` (104 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+e4df4e1389e28972e955,
Ziyang Xuan, Jason Gunthorpe, David S. Miller, Sasha Levin
From: Ziyang Xuan <william.xuanziyang@huawei.com>
[ Upstream commit 563bcbae3ba233c275c244bfce2efe12938f5363 ]
The real_dev of a vlan net_device may be freed after
unregister_vlan_dev(). Access the real_dev continually by
vlan_dev_real_dev() will trigger the UAF problem for the
real_dev like following:
==================================================================
BUG: KASAN: use-after-free in vlan_dev_real_dev+0xf9/0x120
Call Trace:
kasan_report.cold+0x83/0xdf
vlan_dev_real_dev+0xf9/0x120
is_eth_port_of_netdev_filter.part.0+0xb1/0x2c0
is_eth_port_of_netdev_filter+0x28/0x40
ib_enum_roce_netdev+0x1a3/0x300
ib_enum_all_roce_netdevs+0xc7/0x140
netdevice_event_work_handler+0x9d/0x210
...
Freed by task 9288:
kasan_save_stack+0x1b/0x40
kasan_set_track+0x1c/0x30
kasan_set_free_info+0x20/0x30
__kasan_slab_free+0xfc/0x130
slab_free_freelist_hook+0xdd/0x240
kfree+0xe4/0x690
kvfree+0x42/0x50
device_release+0x9f/0x240
kobject_put+0x1c8/0x530
put_device+0x1b/0x30
free_netdev+0x370/0x540
ppp_destroy_interface+0x313/0x3d0
...
Move the put_device(real_dev) to vlan_dev_free(). Ensure
real_dev not be freed before vlan_dev unregistered.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+e4df4e1389e28972e955@syzkaller.appspotmail.com
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/8021q/vlan.c | 3 ---
net/8021q/vlan_dev.c | 3 +++
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 512ada90657b2..64ad86419b08d 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -112,9 +112,6 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
}
vlan_vid_del(real_dev, vlan->vlan_proto, vlan_id);
-
- /* Get rid of the vlan's reference to real_dev */
- dev_put(real_dev);
}
int vlan_check_real_dev(struct net_device *real_dev,
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 84ef837721141..52428d9c93b06 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -816,6 +816,9 @@ static void vlan_dev_free(struct net_device *dev)
free_percpu(vlan->vlan_pcpu_stats);
vlan->vlan_pcpu_stats = NULL;
+
+ /* Get rid of the vlan's reference to real_dev */
+ dev_put(vlan->real_dev);
}
void vlan_setup(struct net_device *dev)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 223/323] ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 222/323] net: vlan: fix a UAF in vlan_dev_real_dev() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 224/323] bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed Greg Kroah-Hartman
` (103 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 009a789443fe4c8e6b1ecb7c16b4865c026184cd ]
The handling of PMIC register reads through writing 0 to address 4
of the OpRegion is wrong. Instead of returning the read value
through the value64, which is a no-op for function == ACPI_WRITE calls,
store the value and then on a subsequent function == ACPI_READ with
address == 3 (the address for the value field of the OpRegion)
return the stored value.
This has been tested on a Xiaomi Mi Pad 2 and makes the ACPI battery dev
there mostly functional (unfortunately there are still other issues).
Here are the SET() / GET() functions of the PMIC ACPI device,
which use this OpRegion, which clearly show the new behavior to
be correct:
OperationRegion (REGS, 0x8F, Zero, 0x50)
Field (REGS, ByteAcc, NoLock, Preserve)
{
CLNT, 8,
SA, 8,
OFF, 8,
VAL, 8,
RWM, 8
}
Method (GET, 3, Serialized)
{
If ((AVBE == One))
{
CLNT = Arg0
SA = Arg1
OFF = Arg2
RWM = Zero
If ((AVBG == One))
{
GPRW = Zero
}
}
Return (VAL) /* \_SB_.PCI0.I2C7.PMI5.VAL_ */
}
Method (SET, 4, Serialized)
{
If ((AVBE == One))
{
CLNT = Arg0
SA = Arg1
OFF = Arg2
VAL = Arg3
RWM = One
If ((AVBG == One))
{
GPRW = One
}
}
}
Fixes: 0afa877a5650 ("ACPI / PMIC: intel: add REGS operation region support")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/pmic/intel_pmic.c | 51 +++++++++++++++++++---------------
1 file changed, 28 insertions(+), 23 deletions(-)
diff --git a/drivers/acpi/pmic/intel_pmic.c b/drivers/acpi/pmic/intel_pmic.c
index ca18e0d23df97..db63d3463617a 100644
--- a/drivers/acpi/pmic/intel_pmic.c
+++ b/drivers/acpi/pmic/intel_pmic.c
@@ -216,31 +216,36 @@ static acpi_status intel_pmic_regs_handler(u32 function,
void *handler_context, void *region_context)
{
struct intel_pmic_opregion *opregion = region_context;
- int result = 0;
+ int result = -EINVAL;
+
+ if (function == ACPI_WRITE) {
+ switch (address) {
+ case 0:
+ return AE_OK;
+ case 1:
+ opregion->ctx.addr |= (*value64 & 0xff) << 8;
+ return AE_OK;
+ case 2:
+ opregion->ctx.addr |= *value64 & 0xff;
+ return AE_OK;
+ case 3:
+ opregion->ctx.val = *value64 & 0xff;
+ return AE_OK;
+ case 4:
+ if (*value64) {
+ result = regmap_write(opregion->regmap, opregion->ctx.addr,
+ opregion->ctx.val);
+ } else {
+ result = regmap_read(opregion->regmap, opregion->ctx.addr,
+ &opregion->ctx.val);
+ }
+ opregion->ctx.addr = 0;
+ }
+ }
- switch (address) {
- case 0:
- return AE_OK;
- case 1:
- opregion->ctx.addr |= (*value64 & 0xff) << 8;
+ if (function == ACPI_READ && address == 3) {
+ *value64 = opregion->ctx.val;
return AE_OK;
- case 2:
- opregion->ctx.addr |= *value64 & 0xff;
- return AE_OK;
- case 3:
- opregion->ctx.val = *value64 & 0xff;
- return AE_OK;
- case 4:
- if (*value64) {
- result = regmap_write(opregion->regmap, opregion->ctx.addr,
- opregion->ctx.val);
- } else {
- result = regmap_read(opregion->regmap, opregion->ctx.addr,
- &opregion->ctx.val);
- if (result == 0)
- *value64 = opregion->ctx.val;
- }
- memset(&opregion->ctx, 0x00, sizeof(opregion->ctx));
}
if (result < 0) {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 224/323] bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 223/323] ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 225/323] mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() Greg Kroah-Hartman
` (102 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Huang Guobin, Jakub Kicinski,
David S. Miller, Sasha Levin
From: Huang Guobin <huangguobin4@huawei.com>
[ Upstream commit b93c6a911a3fe926b00add28f3b932007827c4ca ]
When I do fuzz test for bonding device interface, I got the following
use-after-free Calltrace:
==================================================================
BUG: KASAN: use-after-free in bond_enslave+0x1521/0x24f0
Read of size 8 at addr ffff88825bc11c00 by task ifenslave/7365
CPU: 5 PID: 7365 Comm: ifenslave Tainted: G E 5.15.0-rc1+ #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
Call Trace:
dump_stack_lvl+0x6c/0x8b
print_address_description.constprop.0+0x48/0x70
kasan_report.cold+0x82/0xdb
__asan_load8+0x69/0x90
bond_enslave+0x1521/0x24f0
bond_do_ioctl+0x3e0/0x450
dev_ifsioc+0x2ba/0x970
dev_ioctl+0x112/0x710
sock_do_ioctl+0x118/0x1b0
sock_ioctl+0x2e0/0x490
__x64_sys_ioctl+0x118/0x150
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f19159cf577
Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 78
RSP: 002b:00007ffeb3083c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffeb3084bca RCX: 00007f19159cf577
RDX: 00007ffeb3083ce0 RSI: 0000000000008990 RDI: 0000000000000003
RBP: 00007ffeb3084bc4 R08: 0000000000000040 R09: 0000000000000000
R10: 00007ffeb3084bc0 R11: 0000000000000246 R12: 00007ffeb3083ce0
R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffeb3083cb0
Allocated by task 7365:
kasan_save_stack+0x23/0x50
__kasan_kmalloc+0x83/0xa0
kmem_cache_alloc_trace+0x22e/0x470
bond_enslave+0x2e1/0x24f0
bond_do_ioctl+0x3e0/0x450
dev_ifsioc+0x2ba/0x970
dev_ioctl+0x112/0x710
sock_do_ioctl+0x118/0x1b0
sock_ioctl+0x2e0/0x490
__x64_sys_ioctl+0x118/0x150
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
Freed by task 7365:
kasan_save_stack+0x23/0x50
kasan_set_track+0x20/0x30
kasan_set_free_info+0x24/0x40
__kasan_slab_free+0xf2/0x130
kfree+0xd1/0x5c0
slave_kobj_release+0x61/0x90
kobject_put+0x102/0x180
bond_sysfs_slave_add+0x7a/0xa0
bond_enslave+0x11b6/0x24f0
bond_do_ioctl+0x3e0/0x450
dev_ifsioc+0x2ba/0x970
dev_ioctl+0x112/0x710
sock_do_ioctl+0x118/0x1b0
sock_ioctl+0x2e0/0x490
__x64_sys_ioctl+0x118/0x150
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
Last potentially related work creation:
kasan_save_stack+0x23/0x50
kasan_record_aux_stack+0xb7/0xd0
insert_work+0x43/0x190
__queue_work+0x2e3/0x970
delayed_work_timer_fn+0x3e/0x50
call_timer_fn+0x148/0x470
run_timer_softirq+0x8a8/0xc50
__do_softirq+0x107/0x55f
Second to last potentially related work creation:
kasan_save_stack+0x23/0x50
kasan_record_aux_stack+0xb7/0xd0
insert_work+0x43/0x190
__queue_work+0x2e3/0x970
__queue_delayed_work+0x130/0x180
queue_delayed_work_on+0xa7/0xb0
bond_enslave+0xe25/0x24f0
bond_do_ioctl+0x3e0/0x450
dev_ifsioc+0x2ba/0x970
dev_ioctl+0x112/0x710
sock_do_ioctl+0x118/0x1b0
sock_ioctl+0x2e0/0x490
__x64_sys_ioctl+0x118/0x150
do_syscall_64+0x35/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
The buggy address belongs to the object at ffff88825bc11c00
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
1024-byte region [ffff88825bc11c00, ffff88825bc12000)
The buggy address belongs to the page:
page:ffffea00096f0400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25bc10
head:ffffea00096f0400 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000010200 ffffea0009a71c08 ffff888240001968 ffff88810004dbc0
raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88825bc11b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88825bc11b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88825bc11c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88825bc11c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88825bc11d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Put new_slave in bond_sysfs_slave_add() will cause use-after-free problems
when new_slave is accessed in the subsequent error handling process. Since
new_slave will be put in the subsequent error handling process, remove the
unnecessary put to fix it.
In addition, when sysfs_create_file() fails, if some files have been crea-
ted successfully, we need to call sysfs_remove_file() to remove them.
Since there are sysfs_create_files() & sysfs_remove_files() can be used,
use these two functions instead.
Fixes: 7afcaec49696 (bonding: use kobject_put instead of _del after kobject_add)
Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_sysfs_slave.c | 36 ++++++++------------------
1 file changed, 11 insertions(+), 25 deletions(-)
diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
index 9ec0498d7d54e..1bc20de8e57be 100644
--- a/drivers/net/bonding/bond_sysfs_slave.c
+++ b/drivers/net/bonding/bond_sysfs_slave.c
@@ -112,15 +112,15 @@ static ssize_t ad_partner_oper_port_state_show(struct slave *slave, char *buf)
}
static SLAVE_ATTR_RO(ad_partner_oper_port_state);
-static const struct slave_attribute *slave_attrs[] = {
- &slave_attr_state,
- &slave_attr_mii_status,
- &slave_attr_link_failure_count,
- &slave_attr_perm_hwaddr,
- &slave_attr_queue_id,
- &slave_attr_ad_aggregator_id,
- &slave_attr_ad_actor_oper_port_state,
- &slave_attr_ad_partner_oper_port_state,
+static const struct attribute *slave_attrs[] = {
+ &slave_attr_state.attr,
+ &slave_attr_mii_status.attr,
+ &slave_attr_link_failure_count.attr,
+ &slave_attr_perm_hwaddr.attr,
+ &slave_attr_queue_id.attr,
+ &slave_attr_ad_aggregator_id.attr,
+ &slave_attr_ad_actor_oper_port_state.attr,
+ &slave_attr_ad_partner_oper_port_state.attr,
NULL
};
@@ -141,24 +141,10 @@ const struct sysfs_ops slave_sysfs_ops = {
int bond_sysfs_slave_add(struct slave *slave)
{
- const struct slave_attribute **a;
- int err;
-
- for (a = slave_attrs; *a; ++a) {
- err = sysfs_create_file(&slave->kobj, &((*a)->attr));
- if (err) {
- kobject_put(&slave->kobj);
- return err;
- }
- }
-
- return 0;
+ return sysfs_create_files(&slave->kobj, slave_attrs);
}
void bond_sysfs_slave_del(struct slave *slave)
{
- const struct slave_attribute **a;
-
- for (a = slave_attrs; *a; ++a)
- sysfs_remove_file(&slave->kobj, &((*a)->attr));
+ sysfs_remove_files(&slave->kobj, slave_attrs);
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 225/323] mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 224/323] bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 226/323] zram: off by one in read_block_state() Greg Kroah-Hartman
` (101 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Miaohe Lin, Minchan Kim,
Sergey Senozhatsky, Henry Burns, Andrew Morton, Linus Torvalds,
Sasha Levin
From: Miaohe Lin <linmiaohe@huawei.com>
[ Upstream commit afe8605ca45424629fdddfd85984b442c763dc47 ]
There is one possible race window between zs_pool_dec_isolated() and
zs_unregister_migration() because wait_for_isolated_drain() checks the
isolated count without holding class->lock and there is no order inside
zs_pool_dec_isolated(). Thus the below race window could be possible:
zs_pool_dec_isolated zs_unregister_migration
check pool->destroying != 0
pool->destroying = true;
smp_mb();
wait_for_isolated_drain()
wait for pool->isolated_pages == 0
atomic_long_dec(&pool->isolated_pages);
atomic_long_read(&pool->isolated_pages) == 0
Since we observe the pool->destroying (false) before atomic_long_dec()
for pool->isolated_pages, waking pool->migration_wait up is missed.
Fix this by ensure checking pool->destroying happens after the
atomic_long_dec(&pool->isolated_pages).
Link: https://lkml.kernel.org/r/20210708115027.7557-1-linmiaohe@huawei.com
Fixes: 701d678599d0 ("mm/zsmalloc.c: fix race condition in zs_destroy_pool")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Henry Burns <henryburns@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/zsmalloc.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index d52c005a060f1..11e81b3ff0cf3 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -1904,10 +1904,11 @@ static inline void zs_pool_dec_isolated(struct zs_pool *pool)
VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
atomic_long_dec(&pool->isolated_pages);
/*
- * There's no possibility of racing, since wait_for_isolated_drain()
- * checks the isolated count under &class->lock after enqueuing
- * on migration_wait.
+ * Checking pool->destroying must happen after atomic_long_dec()
+ * for pool->isolated_pages above. Paired with the smp_mb() in
+ * zs_unregister_migration().
*/
+ smp_mb__after_atomic();
if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
wake_up_all(&pool->migration_wait);
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 226/323] zram: off by one in read_block_state()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 225/323] mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 227/323] llc: fix out-of-bound array index in llc_sk_dev_hash() Greg Kroah-Hartman
` (100 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Minchan Kim,
Sergey Senozhatsky, Andrew Morton, Linus Torvalds, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit a88e03cf3d190cf46bc4063a9b7efe87590de5f4 ]
snprintf() returns the number of bytes it would have printed if there
were space. But it does not count the NUL terminator. So that means
that if "count == copied" then this has already overflowed by one
character.
This bug likely isn't super harmful in real life.
Link: https://lkml.kernel.org/r/20210916130404.GA25094@kili
Fixes: c0265342bff4 ("zram: introduce zram memory tracking")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/zram/zram_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 104206a795015..5e05bfcecd7b7 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -699,7 +699,7 @@ static ssize_t read_block_state(struct file *file, char __user *buf,
zram_test_flag(zram, index, ZRAM_WB) ? 'w' : '.',
zram_test_flag(zram, index, ZRAM_HUGE) ? 'h' : '.');
- if (count < copied) {
+ if (count <= copied) {
zram_slot_unlock(zram, index);
break;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 227/323] llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 226/323] zram: off by one in read_block_state() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 228/323] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails Greg Kroah-Hartman
` (99 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot,
David S. Miller, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 8ac9dfd58b138f7e82098a4e0a0d46858b12215b ]
Both ifindex and LLC_SK_DEV_HASH_ENTRIES are signed.
This means that (ifindex % LLC_SK_DEV_HASH_ENTRIES) is negative
if @ifindex is negative.
We could simply make LLC_SK_DEV_HASH_ENTRIES unsigned.
In this patch I chose to use hash_32() to get more entropy
from @ifindex, like llc_sk_laddr_hashfn().
UBSAN: array-index-out-of-bounds in ./include/net/llc.h:75:26
index -43 is out of range for type 'hlist_head [64]'
CPU: 1 PID: 20999 Comm: syz-executor.3 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
ubsan_epilogue+0xb/0x5a lib/ubsan.c:151
__ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:291
llc_sk_dev_hash include/net/llc.h:75 [inline]
llc_sap_add_socket+0x49c/0x520 net/llc/llc_conn.c:697
llc_ui_bind+0x680/0xd70 net/llc/af_llc.c:404
__sys_bind+0x1e9/0x250 net/socket.c:1693
__do_sys_bind net/socket.c:1704 [inline]
__se_sys_bind net/socket.c:1702 [inline]
__x64_sys_bind+0x6f/0xb0 net/socket.c:1702
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fa503407ae9
Fixes: 6d2e3ea28446 ("llc: use a device based hash table to speed up multicast delivery")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/llc.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/include/net/llc.h b/include/net/llc.h
index df282d9b40170..9c10b121b49b0 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -72,7 +72,9 @@ struct llc_sap {
static inline
struct hlist_head *llc_sk_dev_hash(struct llc_sap *sap, int ifindex)
{
- return &sap->sk_dev_hash[ifindex % LLC_SK_DEV_HASH_ENTRIES];
+ u32 bucket = hash_32(ifindex, LLC_SK_DEV_HASH_BITS);
+
+ return &sap->sk_dev_hash[bucket];
}
static inline
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 228/323] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 227/323] llc: fix out-of-bound array index in llc_sk_dev_hash() Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 229/323] arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions Greg Kroah-Hartman
` (98 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chengfeng Ye, Dan Carpenter,
Krzysztof Kozlowski, David S. Miller, Sasha Levin
From: Chengfeng Ye <cyeaa@connect.ust.hk>
[ Upstream commit 9fec40f850658e00a14a7dd9e06f7fbc7e59cc4a ]
skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs,
but follow error handler branch when pn533_fill_fragment_skbs()
fails, skb is freed again, results in double free issue. Fix this
by not free skb in error path of pn533_fill_fragment_skbs.
Fixes: 963a82e07d4e ("NFC: pn533: Split large Tx frames in chunks")
Fixes: 93ad42020c2d ("NFC: pn533: Target mode Tx fragmentation support")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nfc/pn533/pn533.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index 01da9331f4cb6..79bf8e1bd39c2 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -2084,7 +2084,7 @@ static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
frag = pn533_alloc_skb(dev, frag_size);
if (!frag) {
skb_queue_purge(&dev->fragment_skb);
- break;
+ return -ENOMEM;
}
if (!dev->tgt_mode) {
@@ -2154,7 +2154,7 @@ static int pn533_transceive(struct nfc_dev *nfc_dev,
/* jumbo frame ? */
if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
rc = pn533_fill_fragment_skbs(dev, skb);
- if (rc <= 0)
+ if (rc < 0)
goto error;
skb = skb_dequeue(&dev->fragment_skb);
@@ -2226,7 +2226,7 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
/* let's split in multiple chunks if size's too big */
if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
rc = pn533_fill_fragment_skbs(dev, skb);
- if (rc <= 0)
+ if (rc < 0)
goto error;
/* get the first skb */
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 229/323] arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 228/323] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails Greg Kroah-Hartman
@ 2021-11-24 11:56 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 230/323] vsock: prevent unnecessary refcnt inc for nonblocking connect Greg Kroah-Hartman
` (97 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:56 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Matthew Wilcox, Arnd Bergmann,
Will Deacon, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit c7c386fbc20262c1d911c615c65db6a58667d92c ]
gcc warns about undefined behavior the vmalloc code when building
with CONFIG_ARM64_PA_BITS_52, when the 'idx++' in the argument to
__phys_to_pte_val() is evaluated twice:
mm/vmalloc.c: In function 'vmap_pfn_apply':
mm/vmalloc.c:2800:58: error: operation on 'data->idx' may be undefined [-Werror=sequence-point]
2800 | *pte = pte_mkspecial(pfn_pte(data->pfns[data->idx++], data->prot));
| ~~~~~~~~~^~
arch/arm64/include/asm/pgtable-types.h:25:37: note: in definition of macro '__pte'
25 | #define __pte(x) ((pte_t) { (x) } )
| ^
arch/arm64/include/asm/pgtable.h:80:15: note: in expansion of macro '__phys_to_pte_val'
80 | __pte(__phys_to_pte_val((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot))
| ^~~~~~~~~~~~~~~~~
mm/vmalloc.c:2800:30: note: in expansion of macro 'pfn_pte'
2800 | *pte = pte_mkspecial(pfn_pte(data->pfns[data->idx++], data->prot));
| ^~~~~~~
I have no idea why this never showed up earlier, but the safest
workaround appears to be changing those macros into inline functions
so the arguments get evaluated only once.
Cc: Matthew Wilcox <willy@infradead.org>
Fixes: 75387b92635e ("arm64: handle 52-bit physical addresses in page table entries")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211105075414.2553155-1-arnd@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/pgtable.h | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index f43519b710610..71a73ca1e2b05 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -64,9 +64,15 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
* page table entry, taking care of 52-bit addresses.
*/
#ifdef CONFIG_ARM64_PA_BITS_52
-#define __pte_to_phys(pte) \
- ((pte_val(pte) & PTE_ADDR_LOW) | ((pte_val(pte) & PTE_ADDR_HIGH) << 36))
-#define __phys_to_pte_val(phys) (((phys) | ((phys) >> 36)) & PTE_ADDR_MASK)
+static inline phys_addr_t __pte_to_phys(pte_t pte)
+{
+ return (pte_val(pte) & PTE_ADDR_LOW) |
+ ((pte_val(pte) & PTE_ADDR_HIGH) << 36);
+}
+static inline pteval_t __phys_to_pte_val(phys_addr_t phys)
+{
+ return (phys | (phys >> 36)) & PTE_ADDR_MASK;
+}
#else
#define __pte_to_phys(pte) (pte_val(pte) & PTE_ADDR_MASK)
#define __phys_to_pte_val(phys) (phys)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 230/323] vsock: prevent unnecessary refcnt inc for nonblocking connect
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2021-11-24 11:56 ` [PATCH 4.19 229/323] arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 231/323] cxgb4: fix eeprom len when diagnostics not implemented Greg Kroah-Hartman
` (96 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefano Garzarella, Eiichi Tsukata,
David S. Miller, Sasha Levin
From: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
[ Upstream commit c7cd82b90599fa10915f41e3dd9098a77d0aa7b6 ]
Currently vosck_connect() increments sock refcount for nonblocking
socket each time it's called, which can lead to memory leak if
it's called multiple times because connect timeout function decrements
sock refcount only once.
Fixes it by making vsock_connect() return -EALREADY immediately when
sock state is already SS_CONNECTING.
Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/vmw_vsock/af_vsock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 2d31fce5c2185..37329e11dc3cc 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1159,6 +1159,8 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
* non-blocking call.
*/
err = -EALREADY;
+ if (flags & O_NONBLOCK)
+ goto out;
break;
default:
if ((sk->sk_state == TCP_LISTEN) ||
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 231/323] cxgb4: fix eeprom len when diagnostics not implemented
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 230/323] vsock: prevent unnecessary refcnt inc for nonblocking connect Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 232/323] USB: chipidea: fix interrupt deadlock Greg Kroah-Hartman
` (95 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Manoj Malviya, Rahul Lakkireddy,
David S. Miller, Sasha Levin
From: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
[ Upstream commit 4ca110bf8d9b31a60f8f8ff6706ea147d38ad97c ]
Ensure diagnostics monitoring support is implemented for the SFF 8472
compliant port module and set the correct length for ethtool port
module eeprom read.
Fixes: f56ec6766dcf ("cxgb4: Add support for ethtool i2c dump")
Signed-off-by: Manoj Malviya <manojmalviya@chelsio.com>
Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 7 +++++--
drivers/net/ethernet/chelsio/cxgb4/t4_hw.h | 2 ++
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
index d07230c892a54..db0248ab7fe4a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
@@ -1304,12 +1304,15 @@ static int cxgb4_get_module_info(struct net_device *dev,
if (ret)
return ret;
- if (!sff8472_comp || (sff_diag_type & 4)) {
+ if (!sff8472_comp || (sff_diag_type & SFP_DIAG_ADDRMODE)) {
modinfo->type = ETH_MODULE_SFF_8079;
modinfo->eeprom_len = ETH_MODULE_SFF_8079_LEN;
} else {
modinfo->type = ETH_MODULE_SFF_8472;
- modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
+ if (sff_diag_type & SFP_DIAG_IMPLEMENTED)
+ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
+ else
+ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN / 2;
}
break;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h
index 361d5032c2884..91603639ac428 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h
@@ -292,6 +292,8 @@ enum {
#define I2C_PAGE_SIZE 0x100
#define SFP_DIAG_TYPE_ADDR 0x5c
#define SFP_DIAG_TYPE_LEN 0x1
+#define SFP_DIAG_ADDRMODE BIT(2)
+#define SFP_DIAG_IMPLEMENTED BIT(6)
#define SFF_8472_COMP_ADDR 0x5e
#define SFF_8472_COMP_LEN 0x1
#define SFF_REV_ADDR 0x1
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 232/323] USB: chipidea: fix interrupt deadlock
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 231/323] cxgb4: fix eeprom len when diagnostics not implemented Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 233/323] ARM: 9155/1: fix early early_iounmap() Greg Kroah-Hartman
` (94 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Chen, Johan Hovold
From: Johan Hovold <johan@kernel.org>
commit 9aaa81c3366e8393a62374e3a1c67c69edc07b8a upstream.
Chipidea core was calling the interrupt handler from non-IRQ context
with interrupts enabled, something which can lead to a deadlock if
there's an actual interrupt trying to take a lock that's already held
(e.g. the controller lock in udc_irq()).
Add a wrapper that can be used to fake interrupts instead of calling the
handler directly.
Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect")
Fixes: 876d4e1e8298 ("usb: chipidea: core: add wakeup support for extcon")
Cc: Peter Chen <peter.chen@kernel.org>
Cc: stable@vger.kernel.org # 4.4
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211021083447.20078-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/chipidea/core.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -532,7 +532,7 @@ int hw_device_reset(struct ci_hdrc *ci)
return 0;
}
-static irqreturn_t ci_irq(int irq, void *data)
+static irqreturn_t ci_irq_handler(int irq, void *data)
{
struct ci_hdrc *ci = data;
irqreturn_t ret = IRQ_NONE;
@@ -585,6 +585,15 @@ static irqreturn_t ci_irq(int irq, void
return ret;
}
+static void ci_irq(struct ci_hdrc *ci)
+{
+ unsigned long flags;
+
+ local_irq_save(flags);
+ ci_irq_handler(ci->irq, ci);
+ local_irq_restore(flags);
+}
+
static int ci_cable_notifier(struct notifier_block *nb, unsigned long event,
void *ptr)
{
@@ -594,7 +603,7 @@ static int ci_cable_notifier(struct noti
cbl->connected = event;
cbl->changed = true;
- ci_irq(ci->irq, ci);
+ ci_irq(ci);
return NOTIFY_DONE;
}
@@ -1048,7 +1057,7 @@ static int ci_hdrc_probe(struct platform
}
}
- ret = devm_request_irq(dev, ci->irq, ci_irq, IRQF_SHARED,
+ ret = devm_request_irq(dev, ci->irq, ci_irq_handler, IRQF_SHARED,
ci->platdata->name, ci);
if (ret)
goto stop;
@@ -1170,11 +1179,11 @@ static void ci_extcon_wakeup_int(struct
if (!IS_ERR(cable_id->edev) && ci->is_otg &&
(otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS))
- ci_irq(ci->irq, ci);
+ ci_irq(ci);
if (!IS_ERR(cable_vbus->edev) && ci->is_otg &&
(otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS))
- ci_irq(ci->irq, ci);
+ ci_irq(ci);
}
static int ci_controller_resume(struct device *dev)
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 233/323] ARM: 9155/1: fix early early_iounmap()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 232/323] USB: chipidea: fix interrupt deadlock Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 234/323] ARM: 9156/1: drop cc-option fallbacks for architecture selection Greg Kroah-Hartman
` (93 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel,
Michał Mirosław, Russell King (Oracle)
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
commit 0d08e7bf0d0d1a29aff7b16ef516f7415eb1aa05 upstream.
Currently __set_fixmap() bails out with a warning when called in early boot
from early_iounmap(). Fix it, and while at it, make the comment a bit easier
to understand.
Cc: <stable@vger.kernel.org>
Fixes: b089c31c519c ("ARM: 8667/3: Fix memory attribute inconsistencies when using fixmap")
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/mmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -416,9 +416,9 @@ void __set_fixmap(enum fixed_addresses i
FIXADDR_END);
BUG_ON(idx >= __end_of_fixed_addresses);
- /* we only support device mappings until pgprot_kernel has been set */
+ /* We support only device mappings before pgprot_kernel is set. */
if (WARN_ON(pgprot_val(prot) != pgprot_val(FIXMAP_PAGE_IO) &&
- pgprot_val(pgprot_kernel) == 0))
+ pgprot_val(prot) && pgprot_val(pgprot_kernel) == 0))
return;
if (pgprot_val(prot))
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 234/323] ARM: 9156/1: drop cc-option fallbacks for architecture selection
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 233/323] ARM: 9155/1: fix early early_iounmap() Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 235/323] f2fs: should use GFP_NOFS for directory inodes Greg Kroah-Hartman
` (92 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Antonio Terceiro, Naresh Kamboju,
Sebastian Andrzej Siewior, Sebastian Reichel, Klaus Kudielka,
Matthias Klose, Arnd Bergmann, Russell King (Oracle)
From: Arnd Bergmann <arnd@arndb.de>
commit 418ace9992a7647c446ed3186df40cf165b67298 upstream.
Naresh and Antonio ran into a build failure with latest Debian
armhf compilers, with lots of output like
tmp/ccY3nOAs.s:2215: Error: selected processor does not support `cpsid i' in ARM mode
As it turns out, $(cc-option) fails early here when the FPU is not
selected before CPU architecture is selected, as the compiler
option check runs before enabling -msoft-float, which causes
a problem when testing a target architecture level without an FPU:
cc1: error: '-mfloat-abi=hard': selected architecture lacks an FPU
Passing e.g. -march=armv6k+fp in place of -march=armv6k would avoid this
issue, but the fallback logic is already broken because all supported
compilers (gcc-5 and higher) are much more recent than these options,
and building with -march=armv5t as a fallback no longer works.
The best way forward that I see is to just remove all the checks, which
also has the nice side-effect of slightly improving the startup time for
'make'.
The -mtune=marvell-f option was apparently never supported by any mainline
compiler, and the custom Codesourcery gcc build that did support is
now too old to build kernels, so just use -mtune=xscale unconditionally
for those.
This should be safe to apply on all stable kernels, and will be required
in order to keep building them with gcc-11 and higher.
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=996419
Reported-by: Antonio Terceiro <antonio.terceiro@linaro.org>
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Reported-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Tested-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Tested-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Cc: Matthias Klose <doko@debian.org>
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/Makefile | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -63,15 +63,15 @@ KBUILD_CFLAGS += $(call cc-option,-fno-i
# Note that GCC does not numerically define an architecture version
# macro, but instead defines a whole series of macros which makes
# testing for a specific architecture or later rather impossible.
-arch-$(CONFIG_CPU_32v7M) =-D__LINUX_ARM_ARCH__=7 -march=armv7-m -Wa,-march=armv7-m
-arch-$(CONFIG_CPU_32v7) =-D__LINUX_ARM_ARCH__=7 $(call cc-option,-march=armv7-a,-march=armv5t -Wa$(comma)-march=armv7-a)
-arch-$(CONFIG_CPU_32v6) =-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6,-march=armv5t -Wa$(comma)-march=armv6)
+arch-$(CONFIG_CPU_32v7M) =-D__LINUX_ARM_ARCH__=7 -march=armv7-m
+arch-$(CONFIG_CPU_32v7) =-D__LINUX_ARM_ARCH__=7 -march=armv7-a
+arch-$(CONFIG_CPU_32v6) =-D__LINUX_ARM_ARCH__=6 -march=armv6
# Only override the compiler option if ARMv6. The ARMv6K extensions are
# always available in ARMv7
ifeq ($(CONFIG_CPU_32v6),y)
-arch-$(CONFIG_CPU_32v6K) =-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6k,-march=armv5t -Wa$(comma)-march=armv6k)
+arch-$(CONFIG_CPU_32v6K) =-D__LINUX_ARM_ARCH__=6 -march=armv6k
endif
-arch-$(CONFIG_CPU_32v5) =-D__LINUX_ARM_ARCH__=5 $(call cc-option,-march=armv5te,-march=armv4t)
+arch-$(CONFIG_CPU_32v5) =-D__LINUX_ARM_ARCH__=5 -march=armv5te
arch-$(CONFIG_CPU_32v4T) =-D__LINUX_ARM_ARCH__=4 -march=armv4t
arch-$(CONFIG_CPU_32v4) =-D__LINUX_ARM_ARCH__=4 -march=armv4
arch-$(CONFIG_CPU_32v3) =-D__LINUX_ARM_ARCH__=3 -march=armv3
@@ -85,7 +85,7 @@ tune-$(CONFIG_CPU_ARM720T) =-mtune=arm7t
tune-$(CONFIG_CPU_ARM740T) =-mtune=arm7tdmi
tune-$(CONFIG_CPU_ARM9TDMI) =-mtune=arm9tdmi
tune-$(CONFIG_CPU_ARM940T) =-mtune=arm9tdmi
-tune-$(CONFIG_CPU_ARM946E) =$(call cc-option,-mtune=arm9e,-mtune=arm9tdmi)
+tune-$(CONFIG_CPU_ARM946E) =-mtune=arm9e
tune-$(CONFIG_CPU_ARM920T) =-mtune=arm9tdmi
tune-$(CONFIG_CPU_ARM922T) =-mtune=arm9tdmi
tune-$(CONFIG_CPU_ARM925T) =-mtune=arm9tdmi
@@ -93,11 +93,11 @@ tune-$(CONFIG_CPU_ARM926T) =-mtune=arm9t
tune-$(CONFIG_CPU_FA526) =-mtune=arm9tdmi
tune-$(CONFIG_CPU_SA110) =-mtune=strongarm110
tune-$(CONFIG_CPU_SA1100) =-mtune=strongarm1100
-tune-$(CONFIG_CPU_XSCALE) =$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale
-tune-$(CONFIG_CPU_XSC3) =$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale
-tune-$(CONFIG_CPU_FEROCEON) =$(call cc-option,-mtune=marvell-f,-mtune=xscale)
-tune-$(CONFIG_CPU_V6) =$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm)
-tune-$(CONFIG_CPU_V6K) =$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm)
+tune-$(CONFIG_CPU_XSCALE) =-mtune=xscale
+tune-$(CONFIG_CPU_XSC3) =-mtune=xscale
+tune-$(CONFIG_CPU_FEROCEON) =-mtune=xscale
+tune-$(CONFIG_CPU_V6) =-mtune=arm1136j-s
+tune-$(CONFIG_CPU_V6K) =-mtune=arm1136j-s
# Evaluate tune cc-option calls now
tune-y := $(tune-y)
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 235/323] f2fs: should use GFP_NOFS for directory inodes
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 234/323] ARM: 9156/1: drop cc-option fallbacks for architecture selection Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 236/323] 9p/net: fix missing error check in p9_check_errors Greg Kroah-Hartman
` (91 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chao Yu, Stanley Chu, Light Hsieh,
Jaegeuk Kim
From: Jaegeuk Kim <jaegeuk@kernel.org>
commit 92d602bc7177325e7453189a22e0c8764ed3453e upstream.
We use inline_dentry which requires to allocate dentry page when adding a link.
If we allow to reclaim memory from filesystem, we do down_read(&sbi->cp_rwsem)
twice by f2fs_lock_op(). I think this should be okay, but how about stopping
the lockdep complaint [1]?
f2fs_create()
- f2fs_lock_op()
- f2fs_do_add_link()
- __f2fs_find_entry
- f2fs_get_read_data_page()
-> kswapd
- shrink_node
- f2fs_evict_inode
- f2fs_lock_op()
[1]
fs_reclaim
){+.+.}-{0:0}
:
kswapd0: lock_acquire+0x114/0x394
kswapd0: __fs_reclaim_acquire+0x40/0x50
kswapd0: prepare_alloc_pages+0x94/0x1ec
kswapd0: __alloc_pages_nodemask+0x78/0x1b0
kswapd0: pagecache_get_page+0x2e0/0x57c
kswapd0: f2fs_get_read_data_page+0xc0/0x394
kswapd0: f2fs_find_data_page+0xa4/0x23c
kswapd0: find_in_level+0x1a8/0x36c
kswapd0: __f2fs_find_entry+0x70/0x100
kswapd0: f2fs_do_add_link+0x84/0x1ec
kswapd0: f2fs_mkdir+0xe4/0x1e4
kswapd0: vfs_mkdir+0x110/0x1c0
kswapd0: do_mkdirat+0xa4/0x160
kswapd0: __arm64_sys_mkdirat+0x24/0x34
kswapd0: el0_svc_common.llvm.17258447499513131576+0xc4/0x1e8
kswapd0: do_el0_svc+0x28/0xa0
kswapd0: el0_svc+0x24/0x38
kswapd0: el0_sync_handler+0x88/0xec
kswapd0: el0_sync+0x1c0/0x200
kswapd0:
-> #1
(
&sbi->cp_rwsem
){++++}-{3:3}
:
kswapd0: lock_acquire+0x114/0x394
kswapd0: down_read+0x7c/0x98
kswapd0: f2fs_do_truncate_blocks+0x78/0x3dc
kswapd0: f2fs_truncate+0xc8/0x128
kswapd0: f2fs_evict_inode+0x2b8/0x8b8
kswapd0: evict+0xd4/0x2f8
kswapd0: iput+0x1c0/0x258
kswapd0: do_unlinkat+0x170/0x2a0
kswapd0: __arm64_sys_unlinkat+0x4c/0x68
kswapd0: el0_svc_common.llvm.17258447499513131576+0xc4/0x1e8
kswapd0: do_el0_svc+0x28/0xa0
kswapd0: el0_svc+0x24/0x38
kswapd0: el0_sync_handler+0x88/0xec
kswapd0: el0_sync+0x1c0/0x200
Cc: stable@vger.kernel.org
Fixes: bdbc90fa55af ("f2fs: don't put dentry page in pagecache into highmem")
Reviewed-by: Chao Yu <chao@kernel.org>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Reviewed-by: Light Hsieh <light.hsieh@mediatek.com>
Tested-by: Light Hsieh <light.hsieh@mediatek.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/inode.c | 2 +-
fs/f2fs/namei.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -454,7 +454,7 @@ make_now:
inode->i_op = &f2fs_dir_inode_operations;
inode->i_fop = &f2fs_dir_operations;
inode->i_mapping->a_ops = &f2fs_dblock_aops;
- inode_nohighmem(inode);
+ mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
} else if (S_ISLNK(inode->i_mode)) {
if (f2fs_encrypted_inode(inode))
inode->i_op = &f2fs_encrypted_symlink_inode_operations;
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -656,7 +656,7 @@ static int f2fs_mkdir(struct inode *dir,
inode->i_op = &f2fs_dir_inode_operations;
inode->i_fop = &f2fs_dir_operations;
inode->i_mapping->a_ops = &f2fs_dblock_aops;
- inode_nohighmem(inode);
+ mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
set_inode_flag(inode, FI_INC_LINK);
f2fs_lock_op(sbi);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 236/323] 9p/net: fix missing error check in p9_check_errors
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 235/323] f2fs: should use GFP_NOFS for directory inodes Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 237/323] powerpc/lib: Add helper to check if offset is within conditional branch range Greg Kroah-Hartman
` (90 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+06472778c97ed94af66d,
Dominique Martinet
From: Dominique Martinet <asmadeus@codewreck.org>
commit 27eb4c3144f7a5ebef3c9a261d80cb3e1fa784dc upstream.
Link: https://lkml.kernel.org/r/99338965-d36c-886e-cd0e-1d8fff2b4746@gmail.com
Reported-by: syzbot+06472778c97ed94af66d@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/9p/client.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -553,6 +553,8 @@ static int p9_check_errors(struct p9_cli
kfree(ename);
} else {
err = p9pdu_readf(&req->rc, c->proto_version, "d", &ecode);
+ if (err)
+ goto out_err;
err = -ecode;
p9_debug(P9_DEBUG_9P, "<<< RLERROR (%d)\n", -ecode);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 237/323] powerpc/lib: Add helper to check if offset is within conditional branch range
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 236/323] 9p/net: fix missing error check in p9_check_errors Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 238/323] powerpc/bpf: Validate branch ranges Greg Kroah-Hartman
` (89 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, Naveen N. Rao, Christophe Leroy, Song Liu,
Michael Ellerman
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
upstream commit 4549c3ea3160fa8b3f37dfe2f957657bb265eda9
Add a helper to check if a given offset is within the branch range for a
powerpc conditional branch instruction, and update some sites to use the
new helper.
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/442b69a34ced32ca346a0d9a855f3f6cfdbbbd41.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/code-patching.h | 1 +
arch/powerpc/lib/code-patching.c | 7 ++++++-
arch/powerpc/net/bpf_jit.h | 7 +------
3 files changed, 8 insertions(+), 7 deletions(-)
--- a/arch/powerpc/include/asm/code-patching.h
+++ b/arch/powerpc/include/asm/code-patching.h
@@ -26,6 +26,7 @@
#define BRANCH_ABSOLUTE 0x2
bool is_offset_in_branch_range(long offset);
+bool is_offset_in_cond_branch_range(long offset);
unsigned int create_branch(const unsigned int *addr,
unsigned long target, int flags);
unsigned int create_cond_branch(const unsigned int *addr,
--- a/arch/powerpc/lib/code-patching.c
+++ b/arch/powerpc/lib/code-patching.c
@@ -243,6 +243,11 @@ bool is_offset_in_branch_range(long offs
return (offset >= -0x2000000 && offset <= 0x1fffffc && !(offset & 0x3));
}
+bool is_offset_in_cond_branch_range(long offset)
+{
+ return offset >= -0x8000 && offset <= 0x7fff && !(offset & 0x3);
+}
+
/*
* Helper to check if a given instruction is a conditional branch
* Derived from the conditional checks in analyse_instr()
@@ -296,7 +301,7 @@ unsigned int create_cond_branch(const un
offset = offset - (unsigned long)addr;
/* Check we can represent the target in the instruction format */
- if (offset < -0x8000 || offset > 0x7FFF || offset & 0x3)
+ if (!is_offset_in_cond_branch_range(offset))
return 0;
/* Mask out the flags and target, so they don't step on each other. */
--- a/arch/powerpc/net/bpf_jit.h
+++ b/arch/powerpc/net/bpf_jit.h
@@ -221,11 +221,6 @@
#define PPC_FUNC_ADDR(d,i) do { PPC_LI32(d, i); } while(0)
#endif
-static inline bool is_nearbranch(int offset)
-{
- return (offset < 32768) && (offset >= -32768);
-}
-
/*
* The fly in the ointment of code size changing from pass to pass is
* avoided by padding the short branch case with a NOP. If code size differs
@@ -234,7 +229,7 @@ static inline bool is_nearbranch(int off
* state.
*/
#define PPC_BCC(cond, dest) do { \
- if (is_nearbranch((dest) - (ctx->idx * 4))) { \
+ if (is_offset_in_cond_branch_range((long)(dest) - (ctx->idx * 4))) { \
PPC_BCC_SHORT(cond, dest); \
PPC_NOP(); \
} else { \
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 238/323] powerpc/bpf: Validate branch ranges
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 237/323] powerpc/lib: Add helper to check if offset is within conditional branch range Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 239/323] powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 Greg Kroah-Hartman
` (88 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, Michael Ellerman, Naveen N. Rao,
Johan Almbladh, Christophe Leroy, Song Liu
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
upstream commit 3832ba4e283d7052b783dab8311df7e3590fed93
Add checks to ensure that we never emit branch instructions with
truncated branch offsets.
Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Tested-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Song Liu <songliubraving@fb.com>
Acked-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/71d33a6b7603ec1013c9734dd8bdd4ff5e929142.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
[include header, drop ppc32 changes]
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/net/bpf_jit.h | 26 ++++++++++++++++++++------
arch/powerpc/net/bpf_jit_comp64.c | 10 +++++++---
2 files changed, 27 insertions(+), 9 deletions(-)
--- a/arch/powerpc/net/bpf_jit.h
+++ b/arch/powerpc/net/bpf_jit.h
@@ -15,6 +15,7 @@
#ifndef __ASSEMBLY__
#include <asm/types.h>
+#include <asm/code-patching.h>
#ifdef PPC64_ELF_ABI_v1
#define FUNCTION_DESCR_SIZE 24
@@ -176,13 +177,26 @@
#define PPC_NEG(d, a) EMIT(PPC_INST_NEG | ___PPC_RT(d) | ___PPC_RA(a))
/* Long jump; (unconditional 'branch') */
-#define PPC_JMP(dest) EMIT(PPC_INST_BRANCH | \
- (((dest) - (ctx->idx * 4)) & 0x03fffffc))
+#define PPC_JMP(dest) \
+ do { \
+ long offset = (long)(dest) - (ctx->idx * 4); \
+ if (!is_offset_in_branch_range(offset)) { \
+ pr_err_ratelimited("Branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \
+ return -ERANGE; \
+ } \
+ EMIT(PPC_INST_BRANCH | (offset & 0x03fffffc)); \
+ } while (0)
/* "cond" here covers BO:BI fields. */
-#define PPC_BCC_SHORT(cond, dest) EMIT(PPC_INST_BRANCH_COND | \
- (((cond) & 0x3ff) << 16) | \
- (((dest) - (ctx->idx * 4)) & \
- 0xfffc))
+#define PPC_BCC_SHORT(cond, dest) \
+ do { \
+ long offset = (long)(dest) - (ctx->idx * 4); \
+ if (!is_offset_in_cond_branch_range(offset)) { \
+ pr_err_ratelimited("Conditional branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \
+ return -ERANGE; \
+ } \
+ EMIT(PPC_INST_BRANCH_COND | (((cond) & 0x3ff) << 16) | (offset & 0xfffc)); \
+ } while (0)
+
/* Sign-extended 32-bit immediate load */
#define PPC_LI32(d, i) do { \
if ((int)(uintptr_t)(i) >= -32768 && \
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -202,7 +202,7 @@ static void bpf_jit_emit_func_call(u32 *
PPC_BLRL();
}
-static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)
+static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)
{
/*
* By now, the eBPF program has already setup parameters in r3, r4 and r5
@@ -263,7 +263,9 @@ static void bpf_jit_emit_tail_call(u32 *
bpf_jit_emit_common_epilogue(image, ctx);
PPC_BCTR();
+
/* out: */
+ return 0;
}
/* Assemble the body code between the prologue & epilogue */
@@ -273,7 +275,7 @@ static int bpf_jit_build_body(struct bpf
{
const struct bpf_insn *insn = fp->insnsi;
int flen = fp->len;
- int i;
+ int i, ret;
/* Start of epilogue code - will only be valid 2nd pass onwards */
u32 exit_addr = addrs[flen];
@@ -863,7 +865,9 @@ cond_branch:
*/
case BPF_JMP | BPF_TAIL_CALL:
ctx->seen |= SEEN_TAILCALL;
- bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);
+ ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);
+ if (ret < 0)
+ return ret;
break;
default:
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 239/323] powerpc/bpf: Fix BPF_SUB when imm == 0x80000000
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 238/323] powerpc/bpf: Validate branch ranges Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 240/323] powerpc/security: Add a helper to query stf_barrier type Greg Kroah-Hartman
` (87 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, Naveen N. Rao, Christophe Leroy, Michael Ellerman
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
upstream commit 5855c4c1f415ca3ba1046e77c0b3d3dfc96c9025
We aren't handling subtraction involving an immediate value of
0x80000000 properly. Fix the same.
Fixes: 156d0e290e969c ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
[mpe: Fold in fix from Naveen to use imm <= 32768]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/fc4b1276eb10761fd7ce0814c8dd089da2815251.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
[adjust macros to account for commits 0654186510a40e and 3a181237916310]
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/net/bpf_jit_comp64.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -326,18 +326,25 @@ static int bpf_jit_build_body(struct bpf
PPC_SUB(dst_reg, dst_reg, src_reg);
goto bpf_alu32_trunc;
case BPF_ALU | BPF_ADD | BPF_K: /* (u32) dst += (u32) imm */
- case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */
case BPF_ALU64 | BPF_ADD | BPF_K: /* dst += imm */
+ if (!imm) {
+ goto bpf_alu32_trunc;
+ } else if (imm >= -32768 && imm < 32768) {
+ PPC_ADDI(dst_reg, dst_reg, IMM_L(imm));
+ } else {
+ PPC_LI32(b2p[TMP_REG_1], imm);
+ PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]);
+ }
+ goto bpf_alu32_trunc;
+ case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */
case BPF_ALU64 | BPF_SUB | BPF_K: /* dst -= imm */
- if (BPF_OP(code) == BPF_SUB)
- imm = -imm;
- if (imm) {
- if (imm >= -32768 && imm < 32768)
- PPC_ADDI(dst_reg, dst_reg, IMM_L(imm));
- else {
- PPC_LI32(b2p[TMP_REG_1], imm);
- PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]);
- }
+ if (!imm) {
+ goto bpf_alu32_trunc;
+ } else if (imm > -32768 && imm <= 32768) {
+ PPC_ADDI(dst_reg, dst_reg, IMM_L(-imm));
+ } else {
+ PPC_LI32(b2p[TMP_REG_1], imm);
+ PPC_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]);
}
goto bpf_alu32_trunc;
case BPF_ALU | BPF_MUL | BPF_X: /* (u32) dst *= (u32) src */
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 240/323] powerpc/security: Add a helper to query stf_barrier type
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 239/323] powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 241/323] powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC Greg Kroah-Hartman
` (86 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, Naveen N. Rao, Michael Ellerman
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
upstream commit 030905920f32e91a52794937f67434ac0b3ea41a
Add a helper to return the stf_barrier type for the current processor.
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/3bd5d7f96ea1547991ac2ce3137dc2b220bae285.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/security_features.h | 5 +++++
arch/powerpc/kernel/security.c | 5 +++++
2 files changed, 10 insertions(+)
--- a/arch/powerpc/include/asm/security_features.h
+++ b/arch/powerpc/include/asm/security_features.h
@@ -39,6 +39,11 @@ static inline bool security_ftr_enabled(
return !!(powerpc_security_features & feature);
}
+#ifdef CONFIG_PPC_BOOK3S_64
+enum stf_barrier_type stf_barrier_type_get(void);
+#else
+static inline enum stf_barrier_type stf_barrier_type_get(void) { return STF_BARRIER_NONE; }
+#endif
// Features indicating support for Spectre/Meltdown mitigations
--- a/arch/powerpc/kernel/security.c
+++ b/arch/powerpc/kernel/security.c
@@ -248,6 +248,11 @@ static int __init handle_no_stf_barrier(
early_param("no_stf_barrier", handle_no_stf_barrier);
+enum stf_barrier_type stf_barrier_type_get(void)
+{
+ return stf_enabled_flush_types;
+}
+
/* This is the generic flag used by other architectures */
static int __init handle_ssbd(char *p)
{
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 241/323] powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 240/323] powerpc/security: Add a helper to query stf_barrier type Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 242/323] mm, oom: pagefault_out_of_memory: dont force global OOM for dying tasks Greg Kroah-Hartman
` (85 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, Naveen N. Rao, Michael Ellerman
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
upstream commit b7540d62509453263604a155bf2d5f0ed450cba2
Emit similar instruction sequences to commit a048a07d7f4535
("powerpc/64s: Add support for a store forwarding barrier at kernel
entry/exit") when encountering BPF_NOSPEC.
Mitigations are enabled depending on what the firmware advertises. In
particular, we do not gate these mitigations based on current settings,
just like in x86. Due to this, we don't need to take any action if
mitigations are enabled or disabled at runtime.
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/956570cbc191cd41f8274bed48ee757a86dac62a.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
[adjust macros to account for commits 0654186510a40e, 3a181237916310 and ef909ba954145e.
adjust security feature checks to account for commit 84ed26fd00c514]
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/net/bpf_jit64.h | 8 ++---
arch/powerpc/net/bpf_jit_comp64.c | 56 +++++++++++++++++++++++++++++++++++---
2 files changed, 56 insertions(+), 8 deletions(-)
--- a/arch/powerpc/net/bpf_jit64.h
+++ b/arch/powerpc/net/bpf_jit64.h
@@ -20,18 +20,18 @@
* with our redzone usage.
*
* [ prev sp ] <-------------
- * [ nv gpr save area ] 6*8 |
+ * [ nv gpr save area ] 5*8 |
* [ tail_call_cnt ] 8 |
- * [ local_tmp_var ] 8 |
+ * [ local_tmp_var ] 16 |
* fp (r31) --> [ ebpf stack space ] upto 512 |
* [ frame header ] 32/112 |
* sp (r1) ---> [ stack pointer ] --------------
*/
/* for gpr non volatile registers BPG_REG_6 to 10 */
-#define BPF_PPC_STACK_SAVE (6*8)
+#define BPF_PPC_STACK_SAVE (5*8)
/* for bpf JIT code internal usage */
-#define BPF_PPC_STACK_LOCALS 16
+#define BPF_PPC_STACK_LOCALS 24
/* stack frame excluding BPF stack, ensure this is quadword aligned */
#define BPF_PPC_STACKFRAME (STACK_FRAME_MIN_SIZE + \
BPF_PPC_STACK_LOCALS + BPF_PPC_STACK_SAVE)
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -19,6 +19,7 @@
#include <linux/if_vlan.h>
#include <asm/kprobes.h>
#include <linux/bpf.h>
+#include <asm/security_features.h>
#include "bpf_jit64.h"
@@ -60,9 +61,9 @@ static inline bool bpf_has_stack_frame(s
* [ prev sp ] <-------------
* [ ... ] |
* sp (r1) ---> [ stack pointer ] --------------
- * [ nv gpr save area ] 6*8
+ * [ nv gpr save area ] 5*8
* [ tail_call_cnt ] 8
- * [ local_tmp_var ] 8
+ * [ local_tmp_var ] 16
* [ unused red zone ] 208 bytes protected
*/
static int bpf_jit_stack_local(struct codegen_context *ctx)
@@ -70,12 +71,12 @@ static int bpf_jit_stack_local(struct co
if (bpf_has_stack_frame(ctx))
return STACK_FRAME_MIN_SIZE + ctx->stack_size;
else
- return -(BPF_PPC_STACK_SAVE + 16);
+ return -(BPF_PPC_STACK_SAVE + 24);
}
static int bpf_jit_stack_tailcallcnt(struct codegen_context *ctx)
{
- return bpf_jit_stack_local(ctx) + 8;
+ return bpf_jit_stack_local(ctx) + 16;
}
static int bpf_jit_stack_offsetof(struct codegen_context *ctx, int reg)
@@ -268,11 +269,34 @@ static int bpf_jit_emit_tail_call(u32 *i
return 0;
}
+/*
+ * We spill into the redzone always, even if the bpf program has its own stackframe.
+ * Offsets hardcoded based on BPF_PPC_STACK_SAVE -- see bpf_jit_stack_local()
+ */
+void bpf_stf_barrier(void);
+
+asm (
+" .global bpf_stf_barrier ;"
+" bpf_stf_barrier: ;"
+" std 21,-64(1) ;"
+" std 22,-56(1) ;"
+" sync ;"
+" ld 21,-64(1) ;"
+" ld 22,-56(1) ;"
+" ori 31,31,0 ;"
+" .rept 14 ;"
+" b 1f ;"
+" 1: ;"
+" .endr ;"
+" blr ;"
+);
+
/* Assemble the body code between the prologue & epilogue */
static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
struct codegen_context *ctx,
u32 *addrs, bool extra_pass)
{
+ enum stf_barrier_type stf_barrier = stf_barrier_type_get();
const struct bpf_insn *insn = fp->insnsi;
int flen = fp->len;
int i, ret;
@@ -615,6 +639,30 @@ emit_clear:
* BPF_ST NOSPEC (speculation barrier)
*/
case BPF_ST | BPF_NOSPEC:
+ if (!security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) ||
+ (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR) &&
+ (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) || !cpu_has_feature(CPU_FTR_HVMODE))))
+ break;
+
+ switch (stf_barrier) {
+ case STF_BARRIER_EIEIO:
+ EMIT(0x7c0006ac | 0x02000000);
+ break;
+ case STF_BARRIER_SYNC_ORI:
+ EMIT(PPC_INST_SYNC);
+ PPC_LD(b2p[TMP_REG_1], 13, 0);
+ PPC_ORI(31, 31, 0);
+ break;
+ case STF_BARRIER_FALLBACK:
+ EMIT(PPC_INST_MFLR | ___PPC_RT(b2p[TMP_REG_1]));
+ PPC_LI64(12, dereference_kernel_function_descriptor(bpf_stf_barrier));
+ PPC_MTCTR(12);
+ EMIT(PPC_INST_BCTR | 0x1);
+ PPC_MTLR(b2p[TMP_REG_1]);
+ break;
+ case STF_BARRIER_NONE:
+ break;
+ }
break;
/*
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 242/323] mm, oom: pagefault_out_of_memory: dont force global OOM for dying tasks
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 241/323] powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 243/323] mm, oom: do not trigger out_of_memory from the #PF Greg Kroah-Hartman
` (84 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vasily Averin, Michal Hocko,
Johannes Weiner, Mel Gorman, Roman Gushchin, Shakeel Butt,
Tetsuo Handa, Uladzislau Rezki, Vladimir Davydov,
Vlastimil Babka, Andrew Morton, Linus Torvalds
From: Vasily Averin <vvs@virtuozzo.com>
commit 0b28179a6138a5edd9d82ad2687c05b3773c387b upstream.
Patch series "memcg: prohibit unconditional exceeding the limit of dying tasks", v3.
Memory cgroup charging allows killed or exiting tasks to exceed the hard
limit. It can be misused and allowed to trigger global OOM from inside
a memcg-limited container. On the other hand if memcg fails allocation,
called from inside #PF handler it triggers global OOM from inside
pagefault_out_of_memory().
To prevent these problems this patchset:
(a) removes execution of out_of_memory() from
pagefault_out_of_memory(), becasue nobody can explain why it is
necessary.
(b) allow memcg to fail allocation of dying/killed tasks.
This patch (of 3):
Any allocation failure during the #PF path will return with VM_FAULT_OOM
which in turn results in pagefault_out_of_memory which in turn executes
out_out_memory() and can kill a random task.
An allocation might fail when the current task is the oom victim and
there are no memory reserves left. The OOM killer is already handled at
the page allocator level for the global OOM and at the charging level
for the memcg one. Both have much more information about the scope of
allocation/charge request. This means that either the OOM killer has
been invoked properly and didn't lead to the allocation success or it
has been skipped because it couldn't have been invoked. In both cases
triggering it from here is pointless and even harmful.
It makes much more sense to let the killed task die rather than to wake
up an eternally hungry oom-killer and send him to choose a fatter victim
for breakfast.
Link: https://lkml.kernel.org/r/0828a149-786e-7c06-b70a-52d086818ea3@virtuozzo.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Suggested-by: Michal Hocko <mhocko@suse.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Roman Gushchin <guro@fb.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Uladzislau Rezki <urezki@gmail.com>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/oom_kill.c | 3 +++
1 file changed, 3 insertions(+)
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -1152,6 +1152,9 @@ void pagefault_out_of_memory(void)
if (mem_cgroup_oom_synchronize(true))
return;
+ if (fatal_signal_pending(current))
+ return;
+
if (!mutex_trylock(&oom_lock))
return;
out_of_memory(&oc);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 243/323] mm, oom: do not trigger out_of_memory from the #PF
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 242/323] mm, oom: pagefault_out_of_memory: dont force global OOM for dying tasks Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 244/323] backlight: gpio-backlight: Correct initial power state handling Greg Kroah-Hartman
` (83 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michal Hocko, Vasily Averin,
Johannes Weiner, Mel Gorman, Roman Gushchin, Shakeel Butt,
Tetsuo Handa, Uladzislau Rezki, Vladimir Davydov,
Vlastimil Babka, Andrew Morton, Linus Torvalds
From: Michal Hocko <mhocko@suse.com>
commit 60e2793d440a3ec95abb5d6d4fc034a4b480472d upstream.
Any allocation failure during the #PF path will return with VM_FAULT_OOM
which in turn results in pagefault_out_of_memory. This can happen for 2
different reasons. a) Memcg is out of memory and we rely on
mem_cgroup_oom_synchronize to perform the memcg OOM handling or b)
normal allocation fails.
The latter is quite problematic because allocation paths already trigger
out_of_memory and the page allocator tries really hard to not fail
allocations. Anyway, if the OOM killer has been already invoked there
is no reason to invoke it again from the #PF path. Especially when the
OOM condition might be gone by that time and we have no way to find out
other than allocate.
Moreover if the allocation failed and the OOM killer hasn't been invoked
then we are unlikely to do the right thing from the #PF context because
we have already lost the allocation context and restictions and
therefore might oom kill a task from a different NUMA domain.
This all suggests that there is no legitimate reason to trigger
out_of_memory from pagefault_out_of_memory so drop it. Just to be sure
that no #PF path returns with VM_FAULT_OOM without allocation print a
warning that this is happening before we restart the #PF.
[VvS: #PF allocation can hit into limit of cgroup v1 kmem controller.
This is a local problem related to memcg, however, it causes unnecessary
global OOM kills that are repeated over and over again and escalate into a
real disaster. This has been broken since kmem accounting has been
introduced for cgroup v1 (3.8). There was no kmem specific reclaim for
the separate limit so the only way to handle kmem hard limit was to return
with ENOMEM. In upstream the problem will be fixed by removing the
outdated kmem limit, however stable and LTS kernels cannot do it and are
still affected. This patch fixes the problem and should be backported
into stable/LTS.]
Link: https://lkml.kernel.org/r/f5fd8dd8-0ad4-c524-5f65-920b01972a42@virtuozzo.com
Signed-off-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Roman Gushchin <guro@fb.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Uladzislau Rezki <urezki@gmail.com>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/oom_kill.c | 22 ++++++++--------------
1 file changed, 8 insertions(+), 14 deletions(-)
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -1135,19 +1135,15 @@ bool out_of_memory(struct oom_control *o
}
/*
- * The pagefault handler calls here because it is out of memory, so kill a
- * memory-hogging task. If oom_lock is held by somebody else, a parallel oom
- * killing is already in progress so do nothing.
+ * The pagefault handler calls here because some allocation has failed. We have
+ * to take care of the memcg OOM here because this is the only safe context without
+ * any locks held but let the oom killer triggered from the allocation context care
+ * about the global OOM.
*/
void pagefault_out_of_memory(void)
{
- struct oom_control oc = {
- .zonelist = NULL,
- .nodemask = NULL,
- .memcg = NULL,
- .gfp_mask = 0,
- .order = 0,
- };
+ static DEFINE_RATELIMIT_STATE(pfoom_rs, DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
if (mem_cgroup_oom_synchronize(true))
return;
@@ -1155,8 +1151,6 @@ void pagefault_out_of_memory(void)
if (fatal_signal_pending(current))
return;
- if (!mutex_trylock(&oom_lock))
- return;
- out_of_memory(&oc);
- mutex_unlock(&oom_lock);
+ if (__ratelimit(&pfoom_rs))
+ pr_warn("Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF\n");
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 244/323] backlight: gpio-backlight: Correct initial power state handling
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 243/323] mm, oom: do not trigger out_of_memory from the #PF Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 245/323] video: backlight: Drop maximum brightness override for brightness zero Greg Kroah-Hartman
` (82 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Daniel Thompson, Lee Jones
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit ec665b756e6f79c60078b00dbdabea3aa8a4b787 upstream.
The default-on property - or the def_value via legacy pdata) should be
handled as:
if it is 1, the backlight must be enabled (kept enabled)
if it is 0, the backlight must be disabled (kept disabled)
This only works for the case when default-on is set. If it is not set then
the brightness of the backlight is set to 0. Now if the backlight is
enabled by external driver (graphics) the backlight will stay disabled since
the brightness is configured as 0. The backlight will not turn on.
In order to minimize screen flickering during device boot:
The initial brightness should be set to 1.
If booted in non DT mode or no phandle link to the backlight node:
follow the def_value/default-on to select UNBLANK or POWERDOWN
If in DT boot we have phandle link then leave the GPIO in a state which the
bootloader left it and let the user of the backlight to configure it
further.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/gpio_backlight.c | 24 ++++++++++++++++++++----
1 file changed, 20 insertions(+), 4 deletions(-)
--- a/drivers/video/backlight/gpio_backlight.c
+++ b/drivers/video/backlight/gpio_backlight.c
@@ -62,13 +62,11 @@ static int gpio_backlight_probe_dt(struc
{
struct device *dev = &pdev->dev;
struct device_node *np = dev->of_node;
- enum gpiod_flags flags;
int ret;
gbl->def_value = of_property_read_bool(np, "default-on");
- flags = gbl->def_value ? GPIOD_OUT_HIGH : GPIOD_OUT_LOW;
- gbl->gpiod = devm_gpiod_get(dev, NULL, flags);
+ gbl->gpiod = devm_gpiod_get(dev, NULL, GPIOD_ASIS);
if (IS_ERR(gbl->gpiod)) {
ret = PTR_ERR(gbl->gpiod);
@@ -82,6 +80,22 @@ static int gpio_backlight_probe_dt(struc
return 0;
}
+static int gpio_backlight_initial_power_state(struct gpio_backlight *gbl)
+{
+ struct device_node *node = gbl->dev->of_node;
+
+ /* Not booted with device tree or no phandle link to the node */
+ if (!node || !node->phandle)
+ return gbl->def_value ? FB_BLANK_UNBLANK : FB_BLANK_POWERDOWN;
+
+ /* if the enable GPIO is disabled, do not enable the backlight */
+ if (gpiod_get_value_cansleep(gbl->gpiod) == 0)
+ return FB_BLANK_POWERDOWN;
+
+ return FB_BLANK_UNBLANK;
+}
+
+
static int gpio_backlight_probe(struct platform_device *pdev)
{
struct gpio_backlight_platform_data *pdata =
@@ -142,7 +156,9 @@ static int gpio_backlight_probe(struct p
return PTR_ERR(bl);
}
- bl->props.brightness = gbl->def_value;
+ bl->props.power = gpio_backlight_initial_power_state(gbl);
+ bl->props.brightness = 1;
+
backlight_update_status(bl);
platform_set_drvdata(pdev, bl);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 245/323] video: backlight: Drop maximum brightness override for brightness zero
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 244/323] backlight: gpio-backlight: Correct initial power state handling Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 246/323] s390/cio: check the subchannel validity for dev_busid Greg Kroah-Hartman
` (81 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Vasut, Noralf Trønnes,
Daniel Thompson, Lee Jones
From: Marek Vasut <marex@denx.de>
commit 33a5471f8da976bf271a1ebbd6b9d163cb0cb6aa upstream.
The note in c2adda27d202f ("video: backlight: Add of_find_backlight helper
in backlight.c") says that gpio-backlight uses brightness as power state.
This has been fixed since in ec665b756e6f7 ("backlight: gpio-backlight:
Correct initial power state handling") and other backlight drivers do not
require this workaround. Drop the workaround.
This fixes the case where e.g. pwm-backlight can perfectly well be set to
brightness 0 on boot in DT, which without this patch leads to the display
brightness to be max instead of off.
Fixes: c2adda27d202f ("video: backlight: Add of_find_backlight helper in backlight.c")
Cc: <stable@vger.kernel.org> # 5.4+
Cc: <stable@vger.kernel.org> # 4.19.x: ec665b756e6f7: backlight: gpio-backlight: Correct initial power state handling
Signed-off-by: Marek Vasut <marex@denx.de>
Acked-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/backlight.c | 6 ------
1 file changed, 6 deletions(-)
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -610,12 +610,6 @@ struct backlight_device *of_find_backlig
of_node_put(np);
if (!bd)
return ERR_PTR(-EPROBE_DEFER);
- /*
- * Note: gpio_backlight uses brightness as
- * power state during probe
- */
- if (!bd->props.brightness)
- bd->props.brightness = bd->props.max_brightness;
}
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 246/323] s390/cio: check the subchannel validity for dev_busid
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 245/323] video: backlight: Drop maximum brightness override for brightness zero Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 247/323] s390/tape: fix timer initialization in tape_std_assign() Greg Kroah-Hartman
` (80 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cornelia Huck, Vineeth Vijayan,
Vasily Gorbik
From: Vineeth Vijayan <vneethv@linux.ibm.com>
commit a4751f157c194431fae9e9c493f456df8272b871 upstream.
Check the validity of subchanel before reading other fields in
the schib.
Fixes: d3683c055212 ("s390/cio: add dev_busid sysfs entry for each subchannel")
CC: <stable@vger.kernel.org>
Reported-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Link: https://lore.kernel.org/r/20211105154451.847288-1-vneethv@linux.ibm.com
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/cio/css.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -371,8 +371,8 @@ static ssize_t dev_busid_show(struct dev
struct subchannel *sch = to_subchannel(dev);
struct pmcw *pmcw = &sch->schib.pmcw;
- if ((pmcw->st == SUBCHANNEL_TYPE_IO ||
- pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv)
+ if ((pmcw->st == SUBCHANNEL_TYPE_IO && pmcw->dnv) ||
+ (pmcw->st == SUBCHANNEL_TYPE_MSG && pmcw->w))
return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid,
pmcw->dev);
else
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 247/323] s390/tape: fix timer initialization in tape_std_assign()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 246/323] s390/cio: check the subchannel validity for dev_busid Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 248/323] PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros Greg Kroah-Hartman
` (79 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Vasily Gorbik
From: Sven Schnelle <svens@linux.ibm.com>
commit 213fca9e23b59581c573d558aa477556f00b8198 upstream.
commit 9c6c273aa424 ("timer: Remove init_timer_on_stack() in favor
of timer_setup_on_stack()") changed the timer setup from
init_timer_on_stack(() to timer_setup(), but missed to change the
mod_timer() call. And while at it, use msecs_to_jiffies() instead
of the open coded timeout calculation.
Cc: stable@vger.kernel.org
Fixes: 9c6c273aa424 ("timer: Remove init_timer_on_stack() in favor of timer_setup_on_stack()")
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/char/tape_std.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/s390/char/tape_std.c
+++ b/drivers/s390/char/tape_std.c
@@ -53,7 +53,6 @@ int
tape_std_assign(struct tape_device *device)
{
int rc;
- struct timer_list timeout;
struct tape_request *request;
request = tape_alloc_request(2, 11);
@@ -70,7 +69,7 @@ tape_std_assign(struct tape_device *devi
* So we set up a timeout for this call.
*/
timer_setup(&request->timer, tape_std_assign_timeout, 0);
- mod_timer(&timeout, jiffies + 2 * HZ);
+ mod_timer(&request->timer, jiffies + msecs_to_jiffies(2000));
rc = tape_do_io_interruptible(device, request);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 248/323] PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 247/323] s390/tape: fix timer initialization in tape_std_assign() Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 249/323] fuse: truncate pagecache on atomic_o_trunc Greg Kroah-Hartman
` (78 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pali Rohár, Marek Behún,
Lorenzo Pieralisi, Bjorn Helgaas
From: Pali Rohár <pali@kernel.org>
commit 460275f124fb072dca218a6b43b6370eebbab20d upstream.
Define a macro PCI_EXP_DEVCTL_PAYLOAD_* for every possible Max Payload
Size in linux/pci_regs.h, in the same style as PCI_EXP_DEVCTL_READRQ_*.
Link: https://lore.kernel.org/r/20211005180952.6812-2-kabel@kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/uapi/linux/pci_regs.h | 6 ++++++
1 file changed, 6 insertions(+)
--- a/include/uapi/linux/pci_regs.h
+++ b/include/uapi/linux/pci_regs.h
@@ -497,6 +497,12 @@
#define PCI_EXP_DEVCTL_URRE 0x0008 /* Unsupported Request Reporting En. */
#define PCI_EXP_DEVCTL_RELAX_EN 0x0010 /* Enable relaxed ordering */
#define PCI_EXP_DEVCTL_PAYLOAD 0x00e0 /* Max_Payload_Size */
+#define PCI_EXP_DEVCTL_PAYLOAD_128B 0x0000 /* 128 Bytes */
+#define PCI_EXP_DEVCTL_PAYLOAD_256B 0x0020 /* 256 Bytes */
+#define PCI_EXP_DEVCTL_PAYLOAD_512B 0x0040 /* 512 Bytes */
+#define PCI_EXP_DEVCTL_PAYLOAD_1024B 0x0060 /* 1024 Bytes */
+#define PCI_EXP_DEVCTL_PAYLOAD_2048B 0x0080 /* 2048 Bytes */
+#define PCI_EXP_DEVCTL_PAYLOAD_4096B 0x00a0 /* 4096 Bytes */
#define PCI_EXP_DEVCTL_EXT_TAG 0x0100 /* Extended Tag Field Enable */
#define PCI_EXP_DEVCTL_PHANTOM 0x0200 /* Phantom Functions Enable */
#define PCI_EXP_DEVCTL_AUX_PME 0x0400 /* Auxiliary Power PM Enable */
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 249/323] fuse: truncate pagecache on atomic_o_trunc
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 248/323] PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 250/323] x86/cpu: Fix migration safety with X86_BUG_NULL_SEL Greg Kroah-Hartman
` (77 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xie Yongji, Miklos Szeredi,
syzbot+bea44a5189836d956894
From: Miklos Szeredi <mszeredi@redhat.com>
commit 76224355db7570cbe6b6f75c8929a1558828dd55 upstream.
fuse_finish_open() will be called with FUSE_NOWRITE in case of atomic
O_TRUNC. This can deadlock with fuse_wait_on_page_writeback() in
fuse_launder_page() triggered by invalidate_inode_pages2().
Fix by replacing invalidate_inode_pages2() in fuse_finish_open() with a
truncate_pagecache() call. This makes sense regardless of FOPEN_KEEP_CACHE
or fc->writeback cache, so do it unconditionally.
Reported-by: Xie Yongji <xieyongji@bytedance.com>
Reported-and-tested-by: syzbot+bea44a5189836d956894@syzkaller.appspotmail.com
Fixes: e4648309b85a ("fuse: truncate pending writes on O_TRUNC")
Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/file.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -178,12 +178,11 @@ void fuse_finish_open(struct inode *inod
if (ff->open_flags & FOPEN_DIRECT_IO)
file->f_op = &fuse_direct_io_file_operations;
- if (!(ff->open_flags & FOPEN_KEEP_CACHE))
- invalidate_inode_pages2(inode->i_mapping);
if (ff->open_flags & FOPEN_STREAM)
stream_open(inode, file);
else if (ff->open_flags & FOPEN_NONSEEKABLE)
nonseekable_open(inode, file);
+
if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
struct fuse_inode *fi = get_fuse_inode(inode);
@@ -191,10 +190,14 @@ void fuse_finish_open(struct inode *inod
fi->attr_version = ++fc->attr_version;
i_size_write(inode, 0);
spin_unlock(&fc->lock);
+ truncate_pagecache(inode, 0);
fuse_invalidate_attr(inode);
if (fc->writeback_cache)
file_update_time(file);
+ } else if (!(ff->open_flags & FOPEN_KEEP_CACHE)) {
+ invalidate_inode_pages2(inode->i_mapping);
}
+
if ((file->f_mode & FMODE_WRITE) && fc->writeback_cache)
fuse_link_write_file(file);
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 250/323] x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 249/323] fuse: truncate pagecache on atomic_o_trunc Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 251/323] ext4: fix lazy initialization next schedule time computation in more granular unit Greg Kroah-Hartman
` (76 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jane Malalane, Borislav Petkov
From: Jane Malalane <jane.malalane@citrix.com>
commit 415de44076640483648d6c0f6d645a9ee61328ad upstream.
Currently, Linux probes for X86_BUG_NULL_SEL unconditionally which
makes it unsafe to migrate in a virtualised environment as the
properties across the migration pool might differ.
To be specific, the case which goes wrong is:
1. Zen1 (or earlier) and Zen2 (or later) in a migration pool
2. Linux boots on Zen2, probes and finds the absence of X86_BUG_NULL_SEL
3. Linux is then migrated to Zen1
Linux is now running on a X86_BUG_NULL_SEL-impacted CPU while believing
that the bug is fixed.
The only way to address the problem is to fully trust the "no longer
affected" CPUID bit when virtualised, because in the above case it would
be clear deliberately to indicate the fact "you might migrate to
somewhere which has this behaviour".
Zen3 adds the NullSelectorClearsBase CPUID bit to indicate that loading
a NULL segment selector zeroes the base and limit fields, as well as
just attributes. Zen2 also has this behaviour but doesn't have the NSCB
bit.
[ bp: Minor touchups. ]
Signed-off-by: Jane Malalane <jane.malalane@citrix.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
CC: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20211021104744.24126-1-jane.malalane@citrix.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/amd.c | 2 +
arch/x86/kernel/cpu/common.c | 44 ++++++++++++++++++++++++++++++++++++-------
arch/x86/kernel/cpu/cpu.h | 1
3 files changed, 40 insertions(+), 7 deletions(-)
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -993,6 +993,8 @@ static void init_amd(struct cpuinfo_x86
if (cpu_has(c, X86_FEATURE_IRPERF) &&
!cpu_has_amd_erratum(c, amd_erratum_1054))
msr_set_bit(MSR_K7_HWCR, MSR_K7_HWCR_IRPERF_EN_BIT);
+
+ check_null_seg_clears_base(c);
}
#ifdef CONFIG_X86_32
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1254,9 +1254,8 @@ void __init early_cpu_init(void)
early_identify_cpu(&boot_cpu_data);
}
-static void detect_null_seg_behavior(struct cpuinfo_x86 *c)
+static bool detect_null_seg_behavior(void)
{
-#ifdef CONFIG_X86_64
/*
* Empirically, writing zero to a segment selector on AMD does
* not clear the base, whereas writing zero to a segment
@@ -1277,10 +1276,43 @@ static void detect_null_seg_behavior(str
wrmsrl(MSR_FS_BASE, 1);
loadsegment(fs, 0);
rdmsrl(MSR_FS_BASE, tmp);
- if (tmp != 0)
- set_cpu_bug(c, X86_BUG_NULL_SEG);
wrmsrl(MSR_FS_BASE, old_base);
-#endif
+ return tmp == 0;
+}
+
+void check_null_seg_clears_base(struct cpuinfo_x86 *c)
+{
+ /* BUG_NULL_SEG is only relevant with 64bit userspace */
+ if (!IS_ENABLED(CONFIG_X86_64))
+ return;
+
+ /* Zen3 CPUs advertise Null Selector Clears Base in CPUID. */
+ if (c->extended_cpuid_level >= 0x80000021 &&
+ cpuid_eax(0x80000021) & BIT(6))
+ return;
+
+ /*
+ * CPUID bit above wasn't set. If this kernel is still running
+ * as a HV guest, then the HV has decided not to advertize
+ * that CPUID bit for whatever reason. For example, one
+ * member of the migration pool might be vulnerable. Which
+ * means, the bug is present: set the BUG flag and return.
+ */
+ if (cpu_has(c, X86_FEATURE_HYPERVISOR)) {
+ set_cpu_bug(c, X86_BUG_NULL_SEG);
+ return;
+ }
+
+ /*
+ * Zen2 CPUs also have this behaviour, but no CPUID bit.
+ * 0x18 is the respective family for Hygon.
+ */
+ if ((c->x86 == 0x17 || c->x86 == 0x18) &&
+ detect_null_seg_behavior())
+ return;
+
+ /* All the remaining ones are affected */
+ set_cpu_bug(c, X86_BUG_NULL_SEG);
}
static void generic_identify(struct cpuinfo_x86 *c)
@@ -1316,8 +1348,6 @@ static void generic_identify(struct cpui
get_model_name(c); /* Default name */
- detect_null_seg_behavior(c);
-
/*
* ESPFIX is a strange bug. All real CPUs have it. Paravirt
* systems that run Linux at CPL > 0 may or may not have the
--- a/arch/x86/kernel/cpu/cpu.h
+++ b/arch/x86/kernel/cpu/cpu.h
@@ -76,6 +76,7 @@ extern int detect_extended_topology_earl
extern int detect_extended_topology(struct cpuinfo_x86 *c);
extern int detect_ht_early(struct cpuinfo_x86 *c);
extern void detect_ht(struct cpuinfo_x86 *c);
+extern void check_null_seg_clears_base(struct cpuinfo_x86 *c);
unsigned int aperfmperf_get_khz(int cpu);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 251/323] ext4: fix lazy initialization next schedule time computation in more granular unit
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 250/323] x86/cpu: Fix migration safety with X86_BUG_NULL_SEL Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 252/323] fortify: Explicitly disable Clang support Greg Kroah-Hartman
` (75 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Shaoying Xu, Theodore Tso
From: Shaoying Xu <shaoyi@amazon.com>
commit 39fec6889d15a658c3a3ebb06fd69d3584ddffd3 upstream.
Ext4 file system has default lazy inode table initialization setup once
it is mounted. However, it has issue on computing the next schedule time
that makes the timeout same amount in jiffies but different real time in
secs if with various HZ values. Therefore, fix by measuring the current
time in a more granular unit nanoseconds and make the next schedule time
independent of the HZ value.
Fixes: bfff68738f1c ("ext4: add support for lazy inode table initialization")
Signed-off-by: Shaoying Xu <shaoyi@amazon.com>
Cc: stable@vger.kernel.org
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210902164412.9994-2-shaoyi@amazon.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/super.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3026,8 +3026,8 @@ static int ext4_run_li_request(struct ex
struct ext4_group_desc *gdp = NULL;
ext4_group_t group, ngroups;
struct super_block *sb;
- unsigned long timeout = 0;
int ret = 0;
+ u64 start_time;
sb = elr->lr_super;
ngroups = EXT4_SB(sb)->s_groups_count;
@@ -3047,13 +3047,12 @@ static int ext4_run_li_request(struct ex
ret = 1;
if (!ret) {
- timeout = jiffies;
+ start_time = ktime_get_real_ns();
ret = ext4_init_inode_table(sb, group,
elr->lr_timeout ? 0 : 1);
if (elr->lr_timeout == 0) {
- timeout = (jiffies - timeout) *
- elr->lr_sbi->s_li_wait_mult;
- elr->lr_timeout = timeout;
+ elr->lr_timeout = nsecs_to_jiffies((ktime_get_real_ns() - start_time) *
+ elr->lr_sbi->s_li_wait_mult);
}
elr->lr_next_sched = jiffies + elr->lr_timeout;
elr->lr_next_group = group + 1;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 252/323] fortify: Explicitly disable Clang support
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 251/323] ext4: fix lazy initialization next schedule time computation in more granular unit Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 253/323] parisc/entry: fix trace test in syscall exit path Greg Kroah-Hartman
` (74 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kees Cook, Nick Desaulniers,
Nathan Chancellor
From: Kees Cook <keescook@chromium.org>
commit a52f8a59aef46b59753e583bf4b28fccb069ce64 upstream.
Clang has never correctly compiled the FORTIFY_SOURCE defenses due to
a couple bugs:
Eliding inlines with matching __builtin_* names
https://bugs.llvm.org/show_bug.cgi?id=50322
Incorrect __builtin_constant_p() of some globals
https://bugs.llvm.org/show_bug.cgi?id=41459
In the process of making improvements to the FORTIFY_SOURCE defenses, the
first (silent) bug (coincidentally) becomes worked around, but exposes
the latter which breaks the build. As such, Clang must not be used with
CONFIG_FORTIFY_SOURCE until at least latter bug is fixed (in Clang 13),
and the fortify routines have been rearranged.
Update the Kconfig to reflect the reality of the current situation.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/lkml/CAKwvOd=A+ueGV2ihdy5GtgR2fQbcXjjAtVxv3=cPjffpebZB7A@mail.gmail.com
Cc: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/Kconfig | 3 +++
1 file changed, 3 insertions(+)
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -191,6 +191,9 @@ config HARDENED_USERCOPY_PAGESPAN
config FORTIFY_SOURCE
bool "Harden common str/mem functions against buffer overflows"
depends on ARCH_HAS_FORTIFY_SOURCE
+ # https://bugs.llvm.org/show_bug.cgi?id=50322
+ # https://bugs.llvm.org/show_bug.cgi?id=41459
+ depends on !CC_IS_CLANG
help
Detect overflows of buffers in common string and memory functions
where the compiler can determine and validate the buffer sizes.
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 253/323] parisc/entry: fix trace test in syscall exit path
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 252/323] fortify: Explicitly disable Clang support Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 254/323] PCI/MSI: Destroy sysfs before freeing entries Greg Kroah-Hartman
` (73 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Helge Deller
From: Sven Schnelle <svens@stackframe.org>
commit 3ec18fc7831e7d79e2d536dd1f3bc0d3ba425e8a upstream.
commit 8779e05ba8aa ("parisc: Fix ptrace check on syscall return")
fixed testing of TI_FLAGS. This uncovered a bug in the test mask.
syscall_restore_rfi is only used when the kernel needs to exit to
usespace with single or block stepping and the recovery counter
enabled. The test however used _TIF_SYSCALL_TRACE_MASK, which
includes a lot of bits that shouldn't be tested here.
Fix this by using TIF_SINGLESTEP and TIF_BLOCKSTEP directly.
I encountered this bug by enabling syscall tracepoints. Both in qemu and
on real hardware. As soon as i enabled the tracepoint (sys_exit_read,
but i guess it doesn't really matter which one), i got random page
faults in userspace almost immediately.
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/kernel/entry.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -1852,7 +1852,7 @@ syscall_restore:
/* Are we being ptraced? */
LDREG TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19
- ldi _TIF_SYSCALL_TRACE_MASK,%r2
+ ldi _TIF_SINGLESTEP|_TIF_BLOCKSTEP,%r2
and,COND(=) %r19,%r2,%r0
b,n syscall_restore_rfi
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 254/323] PCI/MSI: Destroy sysfs before freeing entries
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 253/323] parisc/entry: fix trace test in syscall exit path Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 255/323] PCI/MSI: Deal with devices lying about their MSI mask capability Greg Kroah-Hartman
` (72 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Bjorn Helgaas
From: Thomas Gleixner <tglx@linutronix.de>
commit 3735459037114d31e5acd9894fad9aed104231a0 upstream.
free_msi_irqs() frees the MSI entries before destroying the sysfs entries
which are exposing them. Nothing prevents a concurrent free while a sysfs
file is read and accesses the possibly freed entry.
Move the sysfs release ahead of freeing the entries.
Fixes: 1c51b50c2995 ("PCI/MSI: Export MSI mode using attributes, not kobjects")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Bjorn Helgaas <helgaas@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87sfw5305m.ffs@tglx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/msi.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -372,18 +372,6 @@ static void free_msi_irqs(struct pci_dev
for (i = 0; i < entry->nvec_used; i++)
BUG_ON(irq_has_action(entry->irq + i));
- pci_msi_teardown_msi_irqs(dev);
-
- list_for_each_entry_safe(entry, tmp, msi_list, list) {
- if (entry->msi_attrib.is_msix) {
- if (list_is_last(&entry->list, msi_list))
- iounmap(entry->mask_base);
- }
-
- list_del(&entry->list);
- free_msi_entry(entry);
- }
-
if (dev->msi_irq_groups) {
sysfs_remove_groups(&dev->dev.kobj, dev->msi_irq_groups);
msi_attrs = dev->msi_irq_groups[0]->attrs;
@@ -399,6 +387,18 @@ static void free_msi_irqs(struct pci_dev
kfree(dev->msi_irq_groups);
dev->msi_irq_groups = NULL;
}
+
+ pci_msi_teardown_msi_irqs(dev);
+
+ list_for_each_entry_safe(entry, tmp, msi_list, list) {
+ if (entry->msi_attrib.is_msix) {
+ if (list_is_last(&entry->list, msi_list))
+ iounmap(entry->mask_base);
+ }
+
+ list_del(&entry->list);
+ free_msi_entry(entry);
+ }
}
static void pci_intx_for_msi(struct pci_dev *dev, int enable)
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 255/323] PCI/MSI: Deal with devices lying about their MSI mask capability
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 254/323] PCI/MSI: Destroy sysfs before freeing entries Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 256/323] PCI: Add MSI masking quirk for Nvidia ION AHCI Greg Kroah-Hartman
` (71 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marc Zyngier, Thomas Gleixner, Bjorn Helgaas
From: Marc Zyngier <maz@kernel.org>
commit 2226667a145db2e1f314d7f57fd644fe69863ab9 upstream.
It appears that some devices are lying about their mask capability,
pretending that they don't have it, while they actually do.
The net result is that now that we don't enable MSIs on such
endpoint.
Add a new per-device flag to deal with this. Further patches will
make use of it, sadly.
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20211104180130.3825416-2-maz@kernel.org
Cc: Bjorn Helgaas <helgaas@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/msi.c | 3 +++
include/linux/pci.h | 2 ++
2 files changed, 5 insertions(+)
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -569,6 +569,9 @@ msi_setup_entry(struct pci_dev *dev, int
goto out;
pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &control);
+ /* Lies, damned lies, and MSIs */
+ if (dev->dev_flags & PCI_DEV_FLAGS_HAS_MSI_MASKING)
+ control |= PCI_MSI_FLAGS_MASKBIT;
entry->msi_attrib.is_msix = 0;
entry->msi_attrib.is_64 = !!(control & PCI_MSI_FLAGS_64BIT);
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -205,6 +205,8 @@ enum pci_dev_flags {
PCI_DEV_FLAGS_NO_FLR_RESET = (__force pci_dev_flags_t) (1 << 10),
/* Don't use Relaxed Ordering for TLPs directed at this device */
PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 11),
+ /* Device does honor MSI masking despite saying otherwise */
+ PCI_DEV_FLAGS_HAS_MSI_MASKING = (__force pci_dev_flags_t) (1 << 12),
};
enum pci_irq_reroute_variant {
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 256/323] PCI: Add MSI masking quirk for Nvidia ION AHCI
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 255/323] PCI/MSI: Deal with devices lying about their MSI mask capability Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 257/323] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() Greg Kroah-Hartman
` (70 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rui Salvaterra, Marc Zyngier,
Thomas Gleixner, Bjorn Helgaas
From: Marc Zyngier <maz@kernel.org>
commit f21082fb20dbfb3e42b769b59ef21c2a7f2c7c1f upstream.
The ION AHCI device pretends that MSI masking isn't a thing, while it
actually implements it and needs MSIs to be unmasked to work. Add a quirk
to that effect.
Reported-by: Rui Salvaterra <rsalvaterra@gmail.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Rui Salvaterra <rsalvaterra@gmail.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Bjorn Helgaas <helgaas@kernel.org>
Link: https://lore.kernel.org/r/CALjTZvbzYfBuLB+H=fj2J+9=DxjQ2Uqcy0if_PvmJ-nU-qEgkg@mail.gmail.com
Link: https://lore.kernel.org/r/20211104180130.3825416-3-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -5579,3 +5579,9 @@ static void apex_pci_fixup_class(struct
}
DECLARE_PCI_FIXUP_CLASS_HEADER(0x1ac1, 0x089a,
PCI_CLASS_NOT_DEFINED, 8, apex_pci_fixup_class);
+
+static void nvidia_ion_ahci_fixup(struct pci_dev *pdev)
+{
+ pdev->dev_flags |= PCI_DEV_FLAGS_HAS_MSI_MASKING;
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0ab8, nvidia_ion_ahci_fixup);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 257/323] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 256/323] PCI: Add MSI masking quirk for Nvidia ION AHCI Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 258/323] erofs: fix unsafe pagevec reuse of hooked pclusters Greg Kroah-Hartman
` (69 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yue Hu, Gao Xiang, Gao Xiang
From: Yue Hu <huyue2@yulong.com>
commit 7dea3de7d384f4c8156e8bd93112ba6db1eb276c upstream.
No any behavior to variable occupied in z_erofs_attach_page() which
is only caller to z_erofs_pagevec_enqueue().
Link: https://lore.kernel.org/r/20210419102623.2015-1-zbestahu@gmail.com
Signed-off-by: Yue Hu <huyue2@yulong.com>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
[ Gao Xiang: handle 4.19 codebase conflicts manually. ]
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/erofs/unzip_pagevec.h | 5 +----
drivers/staging/erofs/unzip_vle.c | 4 +---
2 files changed, 2 insertions(+), 7 deletions(-)
--- a/drivers/staging/erofs/unzip_pagevec.h
+++ b/drivers/staging/erofs/unzip_pagevec.h
@@ -117,10 +117,8 @@ static inline void z_erofs_pagevec_ctor_
static inline bool
z_erofs_pagevec_ctor_enqueue(struct z_erofs_pagevec_ctor *ctor,
struct page *page,
- enum z_erofs_page_type type,
- bool *occupied)
+ enum z_erofs_page_type type)
{
- *occupied = false;
if (unlikely(ctor->next == NULL && type))
if (ctor->index + 1 == ctor->nr)
return false;
@@ -135,7 +133,6 @@ z_erofs_pagevec_ctor_enqueue(struct z_er
/* should remind that collector->next never equal to 1, 2 */
if (type == (uintptr_t)ctor->next) {
ctor->next = page;
- *occupied = true;
}
ctor->pages[ctor->index++] =
--- a/drivers/staging/erofs/unzip_vle.c
+++ b/drivers/staging/erofs/unzip_vle.c
@@ -234,7 +234,6 @@ static int z_erofs_vle_work_add_page(
enum z_erofs_page_type type)
{
int ret;
- bool occupied;
/* give priority for the compressed data storage */
if (builder->role >= Z_EROFS_VLE_WORK_PRIMARY &&
@@ -242,8 +241,7 @@ static int z_erofs_vle_work_add_page(
try_to_reuse_as_compressed_page(builder, page))
return 0;
- ret = z_erofs_pagevec_ctor_enqueue(&builder->vector,
- page, type, &occupied);
+ ret = z_erofs_pagevec_ctor_enqueue(&builder->vector, page, type);
builder->work->vcnt += (unsigned)ret;
return ret ? 0 : -EAGAIN;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 258/323] erofs: fix unsafe pagevec reuse of hooked pclusters
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 257/323] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 259/323] arm64: zynqmp: Do not duplicate flash partition label property Greg Kroah-Hartman
` (68 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chao Yu, Gao Xiang
From: Gao Xiang <hsiangkao@linux.alibaba.com>
commit 86432a6dca9bed79111990851df5756d3eb5f57c upstream.
There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL
before actual I/O submission. Thus, the decompression chain can be
extended if the following pcluster chain hooks such tail pcluster.
As the related comment mentioned, if some page is made of a hooked
pcluster and another followed pcluster, it can be reused for in-place
I/O (since I/O should be submitted anyway):
_______________________________________________________________
| tail (partial) page | head (partial) page |
|_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________|
However, it's by no means safe to reuse as pagevec since if such
PRIMARY_HOOKED pclusters finally move into bypass chain without I/O
submission. It's somewhat hard to reproduce with LZ4 and I just found
it (general protection fault) by ro_fsstressing a LZMA image for long
time.
I'm going to actively clean up related code together with multi-page
folio adaption in the next few months. Let's address it directly for
easier backporting for now.
Call trace for reference:
z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs]
z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs]
z_erofs_runqueue+0x5f3/0x840 [erofs]
z_erofs_readahead+0x1e8/0x320 [erofs]
read_pages+0x91/0x270
page_cache_ra_unbounded+0x18b/0x240
filemap_get_pages+0x10a/0x5f0
filemap_read+0xa9/0x330
new_sync_read+0x11b/0x1a0
vfs_read+0xf1/0x190
Link: https://lore.kernel.org/r/20211103182006.4040-1-xiang@kernel.org
Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
Cc: <stable@vger.kernel.org> # 4.19+
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/erofs/unzip_pagevec.h | 13 ++++++++++---
drivers/staging/erofs/unzip_vle.c | 17 +++++++++--------
2 files changed, 19 insertions(+), 11 deletions(-)
--- a/drivers/staging/erofs/unzip_pagevec.h
+++ b/drivers/staging/erofs/unzip_pagevec.h
@@ -117,11 +117,18 @@ static inline void z_erofs_pagevec_ctor_
static inline bool
z_erofs_pagevec_ctor_enqueue(struct z_erofs_pagevec_ctor *ctor,
struct page *page,
- enum z_erofs_page_type type)
+ enum z_erofs_page_type type,
+ bool pvec_safereuse)
{
- if (unlikely(ctor->next == NULL && type))
- if (ctor->index + 1 == ctor->nr)
+ if (!ctor->next) {
+ /* some pages cannot be reused as pvec safely without I/O */
+ if (type == Z_EROFS_PAGE_TYPE_EXCLUSIVE && !pvec_safereuse)
+ type = Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED;
+
+ if (type != Z_EROFS_PAGE_TYPE_EXCLUSIVE &&
+ ctor->index + 1 == ctor->nr)
return false;
+ }
if (unlikely(ctor->index >= ctor->nr))
z_erofs_pagevec_ctor_pagedown(ctor, false);
--- a/drivers/staging/erofs/unzip_vle.c
+++ b/drivers/staging/erofs/unzip_vle.c
@@ -228,10 +228,10 @@ static inline bool try_to_reuse_as_compr
}
/* callers must be with work->lock held */
-static int z_erofs_vle_work_add_page(
- struct z_erofs_vle_work_builder *builder,
- struct page *page,
- enum z_erofs_page_type type)
+static int z_erofs_vle_work_add_page(struct z_erofs_vle_work_builder *builder,
+ struct page *page,
+ enum z_erofs_page_type type,
+ bool pvec_safereuse)
{
int ret;
@@ -241,9 +241,9 @@ static int z_erofs_vle_work_add_page(
try_to_reuse_as_compressed_page(builder, page))
return 0;
- ret = z_erofs_pagevec_ctor_enqueue(&builder->vector, page, type);
+ ret = z_erofs_pagevec_ctor_enqueue(&builder->vector, page, type,
+ pvec_safereuse);
builder->work->vcnt += (unsigned)ret;
-
return ret ? 0 : -EAGAIN;
}
@@ -688,14 +688,15 @@ hitted:
tight &= builder_is_followed(builder);
retry:
- err = z_erofs_vle_work_add_page(builder, page, page_type);
+ err = z_erofs_vle_work_add_page(builder, page, page_type,
+ builder_is_followed(builder));
/* should allocate an additional staging page for pagevec */
if (err == -EAGAIN) {
struct page *const newpage =
__stagingpage_alloc(page_pool, GFP_NOFS);
err = z_erofs_vle_work_add_page(builder,
- newpage, Z_EROFS_PAGE_TYPE_EXCLUSIVE);
+ newpage, Z_EROFS_PAGE_TYPE_EXCLUSIVE, true);
if (likely(!err))
goto retry;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 259/323] arm64: zynqmp: Do not duplicate flash partition label property
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 258/323] erofs: fix unsafe pagevec reuse of hooked pclusters Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 260/323] arm64: zynqmp: Fix serial compatible string Greg Kroah-Hartman
` (67 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Amit Kumar Mahapatra, Michal Simek,
Sasha Levin
From: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
[ Upstream commit 167721a5909f867f8c18c8e78ea58e705ad9bbd4 ]
In kernel 5.4, support has been added for reading MTD devices via the nvmem
API.
For this the mtd devices are registered as read-only NVMEM providers under
sysfs with the same name as the flash partition label property.
So if flash partition label property of multiple flash devices are
identical then the second mtd device fails to get registered as a NVMEM
provider.
This patch fixes the issue by having different label property for different
flashes.
Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Link: https://lore.kernel.org/r/6c4b9b9232b93d9e316a63c086540fd5bf6b8687.1623684253.git.michal.simek@xilinx.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts
index 11cc67184fa9f..f1edd7fcef764 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts
+++ b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts
@@ -130,7 +130,7 @@
reg = <0>;
partition@0 {
- label = "data";
+ label = "spi0-data";
reg = <0x0 0x100000>;
};
};
@@ -148,7 +148,7 @@
reg = <0>;
partition@0 {
- label = "data";
+ label = "spi1-data";
reg = <0x0 0x84000>;
};
};
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 260/323] arm64: zynqmp: Fix serial compatible string
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 259/323] arm64: zynqmp: Do not duplicate flash partition label property Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 261/323] scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() Greg Kroah-Hartman
` (66 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michal Simek, Laurent Pinchart, Sasha Levin
From: Michal Simek <michal.simek@xilinx.com>
[ Upstream commit 812fa2f0e9d33564bd0131a69750e0d165f4c82a ]
Based on commit 65a2c14d4f00 ("dt-bindings: serial: convert Cadence UART
bindings to YAML") compatible string should look like differently that's
why fix it to be aligned with dt binding.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/89b36e0a6187cc6b05b27a035efdf79173bd4486.1628240307.git.michal.simek@xilinx.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
index 8a885ae647b7e..6478bca018197 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
@@ -574,7 +574,7 @@
};
uart0: serial@ff000000 {
- compatible = "cdns,uart-r1p12", "xlnx,xuartps";
+ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12";
status = "disabled";
interrupt-parent = <&gic>;
interrupts = <0 21 4>;
@@ -583,7 +583,7 @@
};
uart1: serial@ff010000 {
- compatible = "cdns,uart-r1p12", "xlnx,xuartps";
+ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12";
status = "disabled";
interrupt-parent = <&gic>;
interrupts = <0 22 4>;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 261/323] scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 260/323] arm64: zynqmp: Fix serial compatible string Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 262/323] arm64: dts: hisilicon: fix arm,sp805 compatible string Greg Kroah-Hartman
` (65 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Justin Tee, James Smart,
Martin K. Petersen, Sasha Levin
From: James Smart <jsmart2021@gmail.com>
[ Upstream commit 99154581b05c8fb22607afb7c3d66c1bace6aa5d ]
When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass
the requests to the adapter. If such an attempt fails, a local "fail_msg"
string is set and a log message output. The job is then added to a
completions list for cancellation.
Processing of any further jobs from the txq list continues, but since
"fail_msg" remains set, jobs are added to the completions list regardless
of whether a wqe was passed to the adapter. If successfully added to
txcmplq, jobs are added to both lists resulting in list corruption.
Fix by clearing the fail_msg string after adding a job to the completions
list. This stops the subsequent jobs from being added to the completions
list unless they had an appropriate failure.
Link: https://lore.kernel.org/r/20210910233159.115896-2-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_sli.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 40d6537e64dd6..e72fc88aeb40e 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -19171,6 +19171,7 @@ lpfc_drain_txq(struct lpfc_hba *phba)
fail_msg,
piocbq->iotag, piocbq->sli4_xritag);
list_add_tail(&piocbq->list, &completions);
+ fail_msg = NULL;
}
spin_unlock_irqrestore(&pring->ring_lock, iflags);
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 262/323] arm64: dts: hisilicon: fix arm,sp805 compatible string
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 261/323] scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 263/323] usb: musb: tusb6010: check return value after calling platform_get_resource() Greg Kroah-Hartman
` (64 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Walle, Wei Xu, Sasha Levin
From: Michael Walle <michael@walle.cc>
[ Upstream commit 894d4f1f77d0e88f1f81af2e1e37333c1c41b631 ]
According to Documentation/devicetree/bindings/watchdog/arm,sp805.yaml
the compatible is:
compatible = "arm,sp805", "arm,primecell";
The current compatible string doesn't exist at all. Fix it.
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/hisilicon/hi3660.dtsi | 4 ++--
arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi
index f432b0a88c65d..6d4dee3cac16b 100644
--- a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi
+++ b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi
@@ -1062,7 +1062,7 @@
};
watchdog0: watchdog@e8a06000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xe8a06000 0x0 0x1000>;
interrupts = <GIC_SPI 44 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&crg_ctrl HI3660_OSC32K>;
@@ -1070,7 +1070,7 @@
};
watchdog1: watchdog@e8a07000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xe8a07000 0x0 0x1000>;
interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&crg_ctrl HI3660_OSC32K>;
diff --git a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
index 247024df714fc..5e9ae262caf3e 100644
--- a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
+++ b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
@@ -830,7 +830,7 @@
};
watchdog0: watchdog@f8005000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xf8005000 0x0 0x1000>;
interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&ao_ctrl HI6220_WDT0_PCLK>;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 263/323] usb: musb: tusb6010: check return value after calling platform_get_resource()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 262/323] arm64: dts: hisilicon: fix arm,sp805 compatible string Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 264/323] usb: typec: tipd: Remove WARN_ON in tps6598x_block_read Greg Kroah-Hartman
` (63 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yang Yingliang, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 14651496a3de6807a17c310f63c894ea0c5d858e ]
It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210915034925.2399823-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/musb/tusb6010.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 4ecfbf6bb1fa8..902507da8aa85 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1103,6 +1103,11 @@ static int tusb_musb_init(struct musb *musb)
/* dma address for async dma */
mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!mem) {
+ pr_debug("no async dma resource?\n");
+ ret = -ENODEV;
+ goto done;
+ }
musb->async = mem->start;
/* dma address for sync dma */
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 264/323] usb: typec: tipd: Remove WARN_ON in tps6598x_block_read
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 263/323] usb: musb: tusb6010: check return value after calling platform_get_resource() Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 265/323] arm64: dts: freescale: fix arm,sp805 compatible string Greg Kroah-Hartman
` (62 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heikki Krogerus, Sven Peter, Sasha Levin
From: Sven Peter <sven@svenpeter.dev>
[ Upstream commit b7a0a63f3fed57d413bb857de164ea9c3984bc4e ]
Calling tps6598x_block_read with a higher than allowed len can be
handled by just returning an error. There's no need to crash systems
with panic-on-warn enabled.
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Sven Peter <sven@svenpeter.dev>
Link: https://lore.kernel.org/r/20210914140235.65955-3-sven@svenpeter.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/tps6598x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c
index 987b8fcfb2aae..a4dd23a8f1954 100644
--- a/drivers/usb/typec/tps6598x.c
+++ b/drivers/usb/typec/tps6598x.c
@@ -93,7 +93,7 @@ tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len)
u8 data[TPS_MAX_LEN + 1];
int ret;
- if (WARN_ON(len + 1 > sizeof(data)))
+ if (len + 1 > sizeof(data))
return -EINVAL;
if (!tps->i2c_protocol)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 265/323] arm64: dts: freescale: fix arm,sp805 compatible string
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 264/323] usb: typec: tipd: Remove WARN_ON in tps6598x_block_read Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 266/323] ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect Greg Kroah-Hartman
` (61 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Walle, Shawn Guo, Sasha Levin
From: Michael Walle <michael@walle.cc>
[ Upstream commit 99a7cacc66cae92db40139b57689be2af75fc6b8 ]
According to Documentation/devicetree/bindings/watchdog/arm,sp805.yaml
the compatible is:
compatible = "arm,sp805", "arm,primecell";
The current compatible string doesn't exist at all. Fix it.
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 16 ++++++++--------
arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 16 ++++++++--------
2 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi
index a07f612ab56b7..b3b87c4c738e6 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi
@@ -584,56 +584,56 @@
};
cluster1_core0_watchdog: wdt@c000000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc000000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster1_core1_watchdog: wdt@c010000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc010000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster1_core2_watchdog: wdt@c020000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc020000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster1_core3_watchdog: wdt@c030000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc030000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster2_core0_watchdog: wdt@c100000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc100000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster2_core1_watchdog: wdt@c110000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc110000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster2_core2_watchdog: wdt@c120000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc120000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster2_core3_watchdog: wdt@c130000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc130000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
index 8c22ce904e655..73a60fd516e06 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
@@ -222,56 +222,56 @@
};
cluster1_core0_watchdog: wdt@c000000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc000000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster1_core1_watchdog: wdt@c010000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc010000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster2_core0_watchdog: wdt@c100000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc100000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster2_core1_watchdog: wdt@c110000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc110000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster3_core0_watchdog: wdt@c200000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc200000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster3_core1_watchdog: wdt@c210000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc210000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster4_core0_watchdog: wdt@c300000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc300000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
};
cluster4_core1_watchdog: wdt@c310000 {
- compatible = "arm,sp805-wdt", "arm,primecell";
+ compatible = "arm,sp805", "arm,primecell";
reg = <0x0 0xc310000 0x0 0x1000>;
clocks = <&clockgen 4 3>, <&clockgen 4 3>;
clock-names = "apb_pclk", "wdog_clk";
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 266/323] ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 265/323] arm64: dts: freescale: fix arm,sp805 compatible string Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 267/323] scsi: advansys: Fix kernel pointer leak Greg Kroah-Hartman
` (60 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Mark Brown, Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 92d3360108f1839ca40451bad20ff67dd24a1964 ]
Add a quirk mechanism to allow specifying that active-high jack-detection
should be used on platforms where this info is not available in devicetree.
And add an entry for the Cyberbook T116 tablet to the DMI table, so that
jack-detection will work properly on this tablet.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20211002211459.110124-2-hdegoede@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/nau8824.c | 40 ++++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)
diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
index 663a208c2f784..4af87340b1655 100644
--- a/sound/soc/codecs/nau8824.c
+++ b/sound/soc/codecs/nau8824.c
@@ -11,6 +11,7 @@
#include <linux/module.h>
#include <linux/delay.h>
+#include <linux/dmi.h>
#include <linux/init.h>
#include <linux/i2c.h>
#include <linux/regmap.h>
@@ -30,6 +31,12 @@
#include "nau8824.h"
+#define NAU8824_JD_ACTIVE_HIGH BIT(0)
+
+static int nau8824_quirk;
+static int quirk_override = -1;
+module_param_named(quirk, quirk_override, uint, 0444);
+MODULE_PARM_DESC(quirk, "Board-specific quirk override");
static int nau8824_config_sysclk(struct nau8824 *nau8824,
int clk_id, unsigned int freq);
@@ -1878,6 +1885,34 @@ static int nau8824_read_device_properties(struct device *dev,
return 0;
}
+/* Please keep this list alphabetically sorted */
+static const struct dmi_system_id nau8824_quirk_table[] = {
+ {
+ /* Cyberbook T116 rugged tablet */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "20170531"),
+ },
+ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH),
+ },
+ {}
+};
+
+static void nau8824_check_quirks(void)
+{
+ const struct dmi_system_id *dmi_id;
+
+ if (quirk_override != -1) {
+ nau8824_quirk = quirk_override;
+ return;
+ }
+
+ dmi_id = dmi_first_match(nau8824_quirk_table);
+ if (dmi_id)
+ nau8824_quirk = (unsigned long)dmi_id->driver_data;
+}
+
static int nau8824_i2c_probe(struct i2c_client *i2c,
const struct i2c_device_id *id)
{
@@ -1902,6 +1937,11 @@ static int nau8824_i2c_probe(struct i2c_client *i2c,
nau8824->irq = i2c->irq;
sema_init(&nau8824->jd_sem, 1);
+ nau8824_check_quirks();
+
+ if (nau8824_quirk & NAU8824_JD_ACTIVE_HIGH)
+ nau8824->jkdet_polarity = 0;
+
nau8824_print_device_properties(nau8824);
ret = regmap_read(nau8824->regmap, NAU8824_REG_I2C_DEVICE_ID, &value);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 267/323] scsi: advansys: Fix kernel pointer leak
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 266/323] ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 268/323] firmware_loader: fix pre-allocated buf built-in firmware use Greg Kroah-Hartman
` (59 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Guo Zhi, Martin K. Petersen, Sasha Levin
From: Guo Zhi <qtxuning1999@sjtu.edu.cn>
[ Upstream commit d4996c6eac4c81b8872043e9391563f67f13e406 ]
Pointers should be printed with %p or %px rather than cast to 'unsigned
long' and printed with %lx.
Change %lx to %p to print the hashed pointer.
Link: https://lore.kernel.org/r/20210929122538.1158235-1-qtxuning1999@sjtu.edu.cn
Signed-off-by: Guo Zhi <qtxuning1999@sjtu.edu.cn>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/advansys.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index 713f69033f201..2856b0ce7ab9a 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -3370,8 +3370,8 @@ static void asc_prt_adv_board_info(struct seq_file *m, struct Scsi_Host *shost)
shost->host_no);
seq_printf(m,
- " iop_base 0x%lx, cable_detect: %X, err_code %u\n",
- (unsigned long)v->iop_base,
+ " iop_base 0x%p, cable_detect: %X, err_code %u\n",
+ v->iop_base,
AdvReadWordRegister(iop_base,IOPW_SCSI_CFG1) & CABLE_DETECT,
v->err_code);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 268/323] firmware_loader: fix pre-allocated buf built-in firmware use
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 267/323] scsi: advansys: Fix kernel pointer leak Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 269/323] ARM: dts: omap: fix gpmc,mux-add-data type Greg Kroah-Hartman
` (58 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luis Chamberlain, Sasha Levin
From: Luis Chamberlain <mcgrof@kernel.org>
[ Upstream commit f7a07f7b96033df7709042ff38e998720a3f7119 ]
The firmware_loader can be used with a pre-allocated buffer
through the use of the API calls:
o request_firmware_into_buf()
o request_partial_firmware_into_buf()
If the firmware was built-in and present, our current check
for if the built-in firmware fits into the pre-allocated buffer
does not return any errors, and we proceed to tell the caller
that everything worked fine. It's a lie and no firmware would
end up being copied into the pre-allocated buffer. So if the
caller trust the result it may end up writing a bunch of 0's
to a device!
Fix this by making the function that checks for the pre-allocated
buffer return non-void. Since the typical use case is when no
pre-allocated buffer is provided make this return successfully
for that case. If the built-in firmware does *not* fit into the
pre-allocated buffer size return a failure as we should have
been doing before.
I'm not aware of users of the built-in firmware using the API
calls with a pre-allocated buffer, as such I doubt this fixes
any real life issue. But you never know... perhaps some oddball
private tree might use it.
In so far as upstream is concerned this just fixes our code for
correctness.
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20210917182226.3532898-2-mcgrof@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/firmware_loader/main.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
index 24410a0d6df07..cfa5e598a0dc8 100644
--- a/drivers/base/firmware_loader/main.c
+++ b/drivers/base/firmware_loader/main.c
@@ -97,12 +97,15 @@ static struct firmware_cache fw_cache;
extern struct builtin_fw __start_builtin_fw[];
extern struct builtin_fw __end_builtin_fw[];
-static void fw_copy_to_prealloc_buf(struct firmware *fw,
+static bool fw_copy_to_prealloc_buf(struct firmware *fw,
void *buf, size_t size)
{
- if (!buf || size < fw->size)
- return;
+ if (!buf)
+ return true;
+ if (size < fw->size)
+ return false;
memcpy(buf, fw->data, fw->size);
+ return true;
}
static bool fw_get_builtin_firmware(struct firmware *fw, const char *name,
@@ -114,9 +117,7 @@ static bool fw_get_builtin_firmware(struct firmware *fw, const char *name,
if (strcmp(name, b_fw->name) == 0) {
fw->size = b_fw->size;
fw->data = b_fw->data;
- fw_copy_to_prealloc_buf(fw, buf, size);
-
- return true;
+ return fw_copy_to_prealloc_buf(fw, buf, size);
}
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 269/323] ARM: dts: omap: fix gpmc,mux-add-data type
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 268/323] firmware_loader: fix pre-allocated buf built-in firmware use Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 270/323] usb: host: ohci-tmio: check return value after calling platform_get_resource() Greg Kroah-Hartman
` (57 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Roger Quadros, Tony Lindgren, Sasha Levin
From: Roger Quadros <rogerq@kernel.org>
[ Upstream commit 51b9e22ffd3c4c56cbb7caae9750f70e55ffa603 ]
gpmc,mux-add-data is not boolean.
Fixes the below errors flagged by dtbs_check.
"ethernet@4,0:gpmc,mux-add-data: True is not of type 'array'"
Signed-off-by: Roger Quadros <rogerq@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 2 +-
arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi
index 7f6aefd134514..e7534fe9c53cf 100644
--- a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi
+++ b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi
@@ -29,7 +29,7 @@
compatible = "smsc,lan9221","smsc,lan9115";
bank-width = <2>;
- gpmc,mux-add-data;
+ gpmc,mux-add-data = <0>;
gpmc,cs-on-ns = <0>;
gpmc,cs-rd-off-ns = <42>;
gpmc,cs-wr-off-ns = <36>;
diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
index 82e98ee3023ad..3dbeb7a6c569c 100644
--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
@@ -25,7 +25,7 @@
compatible = "smsc,lan9221","smsc,lan9115";
bank-width = <2>;
- gpmc,mux-add-data;
+ gpmc,mux-add-data = <0>;
gpmc,cs-on-ns = <0>;
gpmc,cs-rd-off-ns = <42>;
gpmc,cs-wr-off-ns = <36>;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 270/323] usb: host: ohci-tmio: check return value after calling platform_get_resource()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 269/323] ARM: dts: omap: fix gpmc,mux-add-data type Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 271/323] ALSA: ISA: not for M68K Greg Kroah-Hartman
` (56 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Stern, Yang Yingliang, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 9eff2b2e59fda25051ab36cd1cb5014661df657b ]
It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20211011134920.118477-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/ohci-tmio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c
index 983a00e2988dc..702d78e0d903a 100644
--- a/drivers/usb/host/ohci-tmio.c
+++ b/drivers/usb/host/ohci-tmio.c
@@ -196,7 +196,7 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev)
if (usb_disabled())
return -ENODEV;
- if (!cell)
+ if (!cell || !regs || !config || !sram)
return -EINVAL;
if (irq < 0)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 271/323] ALSA: ISA: not for M68K
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 270/323] usb: host: ohci-tmio: check return value after calling platform_get_resource() Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 272/323] tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc Greg Kroah-Hartman
` (55 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Jaroslav Kysela,
Takashi Iwai, alsa-devel, linux-m68k, Geert Uytterhoeven,
Takashi Iwai, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 3c05f1477e62ea5a0a8797ba6a545b1dc751fb31 ]
On m68k, compiling drivers under SND_ISA causes build errors:
../sound/core/isadma.c: In function 'snd_dma_program':
../sound/core/isadma.c:33:17: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration]
33 | flags = claim_dma_lock();
| ^~~~~~~~~~~~~~
../sound/core/isadma.c:41:9: error: implicit declaration of function 'release_dma_lock' [-Werror=implicit-function-declaration]
41 | release_dma_lock(flags);
| ^~~~~~~~~~~~~~~~
../sound/isa/sb/sb16_main.c: In function 'snd_sb16_playback_prepare':
../sound/isa/sb/sb16_main.c:253:72: error: 'DMA_AUTOINIT' undeclared (first use in this function)
253 | snd_dma_program(dma, runtime->dma_addr, size, DMA_MODE_WRITE | DMA_AUTOINIT);
| ^~~~~~~~~~~~
../sound/isa/sb/sb16_main.c:253:72: note: each undeclared identifier is reported only once for each function it appears in
../sound/isa/sb/sb16_main.c: In function 'snd_sb16_capture_prepare':
../sound/isa/sb/sb16_main.c:322:71: error: 'DMA_AUTOINIT' undeclared (first use in this function)
322 | snd_dma_program(dma, runtime->dma_addr, size, DMA_MODE_READ | DMA_AUTOINIT);
| ^~~~~~~~~~~~
and more...
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: alsa-devel@alsa-project.org
Cc: linux-m68k@lists.linux-m68k.org
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20211016062602.3588-1-rdunlap@infradead.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/Makefile | 2 ++
sound/isa/Kconfig | 2 +-
sound/pci/Kconfig | 1 +
3 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/sound/core/Makefile b/sound/core/Makefile
index ee4a4a6b99ba7..d123587c0fd8f 100644
--- a/sound/core/Makefile
+++ b/sound/core/Makefile
@@ -9,7 +9,9 @@ ifneq ($(CONFIG_SND_PROC_FS),)
snd-y += info.o
snd-$(CONFIG_SND_OSSEMUL) += info_oss.o
endif
+ifneq ($(CONFIG_M68K),y)
snd-$(CONFIG_ISA_DMA_API) += isadma.o
+endif
snd-$(CONFIG_SND_OSSEMUL) += sound_oss.o
snd-$(CONFIG_SND_VMASTER) += vmaster.o
snd-$(CONFIG_SND_JACK) += ctljack.o jack.o
diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig
index d7db1eeebc844..f8f3433925bb4 100644
--- a/sound/isa/Kconfig
+++ b/sound/isa/Kconfig
@@ -21,7 +21,7 @@ config SND_SB16_DSP
menuconfig SND_ISA
bool "ISA sound devices"
depends on ISA || COMPILE_TEST
- depends on ISA_DMA_API
+ depends on ISA_DMA_API && !M68K
default y
help
Support for sound devices connected via the ISA bus.
diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
index 4105d9f653d90..bbaf46dc3f804 100644
--- a/sound/pci/Kconfig
+++ b/sound/pci/Kconfig
@@ -278,6 +278,7 @@ config SND_CS46XX_NEW_DSP
config SND_CS5530
tristate "CS5530 Audio"
depends on ISA_DMA_API && (X86_32 || COMPILE_TEST)
+ depends on !M68K
select SND_SB16_DSP
help
Say Y here to include support for audio on Cyrix/NatSemi CS5530 chips.
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 272/323] tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 271/323] ALSA: ISA: not for M68K Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 273/323] MIPS: sni: Fix the build Greg Kroah-Hartman
` (54 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Guanghui Feng, Sasha Levin
From: Guanghui Feng <guanghuifeng@linux.alibaba.com>
[ Upstream commit 3968ddcf05fb4b9409cd1859feb06a5b0550a1c1 ]
When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup,
which look like this one:
Workqueue: events_unbound flush_to_ldisc
Call trace:
dump_backtrace+0x0/0x1ec
show_stack+0x24/0x30
dump_stack+0xd0/0x128
panic+0x15c/0x374
watchdog_timer_fn+0x2b8/0x304
__run_hrtimer+0x88/0x2c0
__hrtimer_run_queues+0xa4/0x120
hrtimer_interrupt+0xfc/0x270
arch_timer_handler_phys+0x40/0x50
handle_percpu_devid_irq+0x94/0x220
__handle_domain_irq+0x88/0xf0
gic_handle_irq+0x84/0xfc
el1_irq+0xc8/0x180
slip_unesc+0x80/0x214 [slip]
tty_ldisc_receive_buf+0x64/0x80
tty_port_default_receive_buf+0x50/0x90
flush_to_ldisc+0xbc/0x110
process_one_work+0x1d4/0x4b0
worker_thread+0x180/0x430
kthread+0x11c/0x120
In the testcase pty04, The first process call the write syscall to send
data to the pty master. At the same time, the workqueue will do the
flush_to_ldisc to pop data in a loop until there is no more data left.
When the sender and workqueue running in different core, the sender sends
data fastly in full time which will result in workqueue doing work in loop
for a long time and occuring softlockup in flush_to_ldisc with kernel
configured without preempt. So I add need_resched check and cond_resched
in the flush_to_ldisc loop to avoid it.
Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Link: https://lore.kernel.org/r/1633961304-24759-1-git-send-email-guanghuifeng@linux.alibaba.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/tty_buffer.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index ee3aa57bc0e7b..6b0cb633679d9 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -529,6 +529,9 @@ static void flush_to_ldisc(struct work_struct *work)
if (!count)
break;
head->read += count;
+
+ if (need_resched())
+ cond_resched();
}
mutex_unlock(&buf->lock);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 273/323] MIPS: sni: Fix the build
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 272/323] tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 274/323] scsi: target: Fix ordered tag handling Greg Kroah-Hartman
` (53 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, linux-mips, Bart Van Assche,
Thomas Bogendoerfer, Sasha Levin
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit c91cf42f61dc77b289784ea7b15a8531defa41c0 ]
This patch fixes the following gcc 10 build error:
arch/mips/sni/time.c: In function ‘a20r_set_periodic’:
arch/mips/sni/time.c:15:26: error: unsigned conversion from ‘int’ to ‘u8’ {aka ‘volatile unsigned char’} changes value from ‘576’ to ‘64’ [-Werror=overflow]
15 | #define SNI_COUNTER0_DIV ((SNI_CLOCK_TICK_RATE / SNI_COUNTER2_DIV) / HZ)
| ^
arch/mips/sni/time.c:21:45: note: in expansion of macro ‘SNI_COUNTER0_DIV’
21 | *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV;
| ^~~~~~~~~~~~~~~~
Cc: linux-mips@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/sni/time.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/mips/sni/time.c b/arch/mips/sni/time.c
index dbace1f3e1a97..745ceb945fc50 100644
--- a/arch/mips/sni/time.c
+++ b/arch/mips/sni/time.c
@@ -18,14 +18,14 @@ static int a20r_set_periodic(struct clock_event_device *evt)
{
*(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0x34;
wmb();
- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV;
+ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV & 0xff;
wmb();
*(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV >> 8;
wmb();
*(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0xb4;
wmb();
- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV;
+ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV & 0xff;
wmb();
*(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV >> 8;
wmb();
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 274/323] scsi: target: Fix ordered tag handling
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 273/323] MIPS: sni: Fix the build Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 275/323] scsi: target: Fix alua_tg_pt_gps_count tracking Greg Kroah-Hartman
` (52 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Christie, Martin K. Petersen,
Sasha Levin
From: Mike Christie <michael.christie@oracle.com>
[ Upstream commit ed1227e080990ffec5bf39006ec8a57358e6689a ]
This patch fixes the following bugs:
1. If there are multiple ordered cmds queued and multiple simple cmds
completing, target_restart_delayed_cmds() could be called on different
CPUs and each instance could start a ordered cmd. They could then run in
different orders than they were queued.
2. target_restart_delayed_cmds() and target_handle_task_attr() can race
where:
1. target_handle_task_attr() has passed the simple_cmds == 0 check.
2. transport_complete_task_attr() then decrements simple_cmds to 0.
3. transport_complete_task_attr() runs target_restart_delayed_cmds() and
it does not see any cmds on the delayed_cmd_list.
4. target_handle_task_attr() adds the cmd to the delayed_cmd_list.
The cmd will then end up timing out.
3. If we are sent > 1 ordered cmds and simple_cmds == 0, we can execute
them out of order, because target_handle_task_attr() will hit that
simple_cmds check first and return false for all ordered cmds sent.
4. We run target_restart_delayed_cmds() after every cmd completion, so if
there is more than 1 simple cmd running, we start executing ordered cmds
after that first cmd instead of waiting for all of them to complete.
5. Ordered cmds are not supposed to start until HEAD OF QUEUE and all older
cmds have completed, and not just simple.
6. It's not a bug but it doesn't make sense to take the delayed_cmd_lock
for every cmd completion when ordered cmds are almost never used. Just
replacing that lock with an atomic increases IOPs by up to 10% when
completions are spread over multiple CPUs and there are multiple
sessions/ mqs/thread accessing the same device.
This patch moves the queued delayed handling to a per device work to
serialze the cmd executions for each device and adds a new counter to track
HEAD_OF_QUEUE and SIMPLE cmds. We can then check the new counter to
determine when to run the work on the completion path.
Link: https://lore.kernel.org/r/20210930020422.92578-3-michael.christie@oracle.com
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/target_core_device.c | 2 +
drivers/target/target_core_internal.h | 1 +
drivers/target/target_core_transport.c | 76 ++++++++++++++++++--------
include/target/target_core_base.h | 6 +-
4 files changed, 61 insertions(+), 24 deletions(-)
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 22e97a93728db..1b381519c1649 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -790,6 +790,8 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
INIT_LIST_HEAD(&dev->t10_alua.lba_map_list);
spin_lock_init(&dev->t10_alua.lba_map_lock);
+ INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work);
+
dev->t10_wwn.t10_dev = dev;
dev->t10_alua.t10_dev = dev;
diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
index 0c66355879301..c7e1fadcc5cc5 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -151,6 +151,7 @@ void transport_clear_lun_ref(struct se_lun *);
void transport_send_task_abort(struct se_cmd *);
sense_reason_t target_cmd_size_check(struct se_cmd *cmd, unsigned int size);
void target_qf_do_work(struct work_struct *work);
+void target_do_delayed_work(struct work_struct *work);
bool target_check_wce(struct se_device *dev);
bool target_check_fua(struct se_device *dev);
void __target_execute_cmd(struct se_cmd *, bool);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 9c60a090cfd17..64481a3a34d44 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1990,32 +1990,35 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
*/
switch (cmd->sam_task_attr) {
case TCM_HEAD_TAG:
+ atomic_inc_mb(&dev->non_ordered);
pr_debug("Added HEAD_OF_QUEUE for CDB: 0x%02x\n",
cmd->t_task_cdb[0]);
return false;
case TCM_ORDERED_TAG:
- atomic_inc_mb(&dev->dev_ordered_sync);
+ atomic_inc_mb(&dev->delayed_cmd_count);
pr_debug("Added ORDERED for CDB: 0x%02x to ordered list\n",
cmd->t_task_cdb[0]);
-
- /*
- * Execute an ORDERED command if no other older commands
- * exist that need to be completed first.
- */
- if (!atomic_read(&dev->simple_cmds))
- return false;
break;
default:
/*
* For SIMPLE and UNTAGGED Task Attribute commands
*/
- atomic_inc_mb(&dev->simple_cmds);
+ atomic_inc_mb(&dev->non_ordered);
+
+ if (atomic_read(&dev->delayed_cmd_count) == 0)
+ return false;
break;
}
- if (atomic_read(&dev->dev_ordered_sync) == 0)
- return false;
+ if (cmd->sam_task_attr != TCM_ORDERED_TAG) {
+ atomic_inc_mb(&dev->delayed_cmd_count);
+ /*
+ * We will account for this when we dequeue from the delayed
+ * list.
+ */
+ atomic_dec_mb(&dev->non_ordered);
+ }
spin_lock(&dev->delayed_cmd_lock);
list_add_tail(&cmd->se_delayed_node, &dev->delayed_cmd_list);
@@ -2023,6 +2026,12 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
pr_debug("Added CDB: 0x%02x Task Attr: 0x%02x to delayed CMD listn",
cmd->t_task_cdb[0], cmd->sam_task_attr);
+ /*
+ * We may have no non ordered cmds when this function started or we
+ * could have raced with the last simple/head cmd completing, so kick
+ * the delayed handler here.
+ */
+ schedule_work(&dev->delayed_cmd_work);
return true;
}
@@ -2073,29 +2082,48 @@ EXPORT_SYMBOL(target_execute_cmd);
* Process all commands up to the last received ORDERED task attribute which
* requires another blocking boundary
*/
-static void target_restart_delayed_cmds(struct se_device *dev)
+void target_do_delayed_work(struct work_struct *work)
{
- for (;;) {
+ struct se_device *dev = container_of(work, struct se_device,
+ delayed_cmd_work);
+
+ spin_lock(&dev->delayed_cmd_lock);
+ while (!dev->ordered_sync_in_progress) {
struct se_cmd *cmd;
- spin_lock(&dev->delayed_cmd_lock);
- if (list_empty(&dev->delayed_cmd_list)) {
- spin_unlock(&dev->delayed_cmd_lock);
+ if (list_empty(&dev->delayed_cmd_list))
break;
- }
cmd = list_entry(dev->delayed_cmd_list.next,
struct se_cmd, se_delayed_node);
+
+ if (cmd->sam_task_attr == TCM_ORDERED_TAG) {
+ /*
+ * Check if we started with:
+ * [ordered] [simple] [ordered]
+ * and we are now at the last ordered so we have to wait
+ * for the simple cmd.
+ */
+ if (atomic_read(&dev->non_ordered) > 0)
+ break;
+
+ dev->ordered_sync_in_progress = true;
+ }
+
list_del(&cmd->se_delayed_node);
+ atomic_dec_mb(&dev->delayed_cmd_count);
spin_unlock(&dev->delayed_cmd_lock);
+ if (cmd->sam_task_attr != TCM_ORDERED_TAG)
+ atomic_inc_mb(&dev->non_ordered);
+
cmd->transport_state |= CMD_T_SENT;
__target_execute_cmd(cmd, true);
- if (cmd->sam_task_attr == TCM_ORDERED_TAG)
- break;
+ spin_lock(&dev->delayed_cmd_lock);
}
+ spin_unlock(&dev->delayed_cmd_lock);
}
/*
@@ -2113,14 +2141,17 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
goto restart;
if (cmd->sam_task_attr == TCM_SIMPLE_TAG) {
- atomic_dec_mb(&dev->simple_cmds);
+ atomic_dec_mb(&dev->non_ordered);
dev->dev_cur_ordered_id++;
} else if (cmd->sam_task_attr == TCM_HEAD_TAG) {
+ atomic_dec_mb(&dev->non_ordered);
dev->dev_cur_ordered_id++;
pr_debug("Incremented dev_cur_ordered_id: %u for HEAD_OF_QUEUE\n",
dev->dev_cur_ordered_id);
} else if (cmd->sam_task_attr == TCM_ORDERED_TAG) {
- atomic_dec_mb(&dev->dev_ordered_sync);
+ spin_lock(&dev->delayed_cmd_lock);
+ dev->ordered_sync_in_progress = false;
+ spin_unlock(&dev->delayed_cmd_lock);
dev->dev_cur_ordered_id++;
pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n",
@@ -2129,7 +2160,8 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET;
restart:
- target_restart_delayed_cmds(dev);
+ if (atomic_read(&dev->delayed_cmd_count) > 0)
+ schedule_work(&dev->delayed_cmd_work);
}
static void transport_complete_qf(struct se_cmd *cmd)
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 2cfd3b4573b06..ac59a03d0d00e 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -774,8 +774,9 @@ struct se_device {
atomic_long_t read_bytes;
atomic_long_t write_bytes;
/* Active commands on this virtual SE device */
- atomic_t simple_cmds;
- atomic_t dev_ordered_sync;
+ atomic_t non_ordered;
+ bool ordered_sync_in_progress;
+ atomic_t delayed_cmd_count;
atomic_t dev_qf_count;
u32 export_count;
spinlock_t delayed_cmd_lock;
@@ -798,6 +799,7 @@ struct se_device {
struct list_head dev_tmr_list;
struct workqueue_struct *tmr_wq;
struct work_struct qf_work_queue;
+ struct work_struct delayed_cmd_work;
struct list_head delayed_cmd_list;
struct list_head state_list;
struct list_head qf_cmd_list;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 275/323] scsi: target: Fix alua_tg_pt_gps_count tracking
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 274/323] scsi: target: Fix ordered tag handling Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 276/323] powerpc/5200: dts: fix memory node unit name Greg Kroah-Hartman
` (51 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Christie, Martin K. Petersen,
Sasha Levin
From: Mike Christie <michael.christie@oracle.com>
[ Upstream commit 1283c0d1a32bb924324481586b5d6e8e76f676ba ]
We can't free the tg_pt_gp in core_alua_set_tg_pt_gp_id() because it's
still accessed via configfs. Its release must go through the normal
configfs/refcount process.
The max alua_tg_pt_gps_count check should probably have been done in
core_alua_allocate_tg_pt_gp(), but with the current code userspace could
have created 0x0000ffff + 1 groups, but only set the id for 0x0000ffff.
Then it could have deleted a group with an ID set, and then set the ID for
that extra group and it would work ok.
It's unlikely, but just in case this patch continues to allow that type of
behavior, and just fixes the kfree() while in use bug.
Link: https://lore.kernel.org/r/20210930020422.92578-4-michael.christie@oracle.com
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/target_core_alua.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index e46ca968009c0..804956c712a5a 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -1716,7 +1716,6 @@ int core_alua_set_tg_pt_gp_id(
pr_err("Maximum ALUA alua_tg_pt_gps_count:"
" 0x0000ffff reached\n");
spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
- kmem_cache_free(t10_alua_tg_pt_gp_cache, tg_pt_gp);
return -ENOSPC;
}
again:
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 276/323] powerpc/5200: dts: fix memory node unit name
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 275/323] scsi: target: Fix alua_tg_pt_gps_count tracking Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 277/323] ALSA: gus: fix null pointer dereference on pointer block Greg Kroah-Hartman
` (50 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anatolij Gustschin, Rob Herring,
Michael Ellerman, Sasha Levin
From: Anatolij Gustschin <agust@denx.de>
[ Upstream commit aed2886a5e9ffc8269a4220bff1e9e030d3d2eb1 ]
Fixes build warnings:
Warning (unit_address_vs_reg): /memory: node has a reg or ranges property, but no unit name
Signed-off-by: Anatolij Gustschin <agust@denx.de>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211013220532.24759-4-agust@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/boot/dts/charon.dts | 2 +-
arch/powerpc/boot/dts/digsy_mtc.dts | 2 +-
arch/powerpc/boot/dts/lite5200.dts | 2 +-
arch/powerpc/boot/dts/lite5200b.dts | 2 +-
arch/powerpc/boot/dts/media5200.dts | 2 +-
arch/powerpc/boot/dts/mpc5200b.dtsi | 2 +-
arch/powerpc/boot/dts/o2d.dts | 2 +-
arch/powerpc/boot/dts/o2d.dtsi | 2 +-
arch/powerpc/boot/dts/o2dnt2.dts | 2 +-
arch/powerpc/boot/dts/o3dnt.dts | 2 +-
arch/powerpc/boot/dts/pcm032.dts | 2 +-
arch/powerpc/boot/dts/tqm5200.dts | 2 +-
12 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/arch/powerpc/boot/dts/charon.dts b/arch/powerpc/boot/dts/charon.dts
index 0e00e508eaa6a..1c8fe20752e6a 100644
--- a/arch/powerpc/boot/dts/charon.dts
+++ b/arch/powerpc/boot/dts/charon.dts
@@ -39,7 +39,7 @@
};
};
- memory {
+ memory@0 {
device_type = "memory";
reg = <0x00000000 0x08000000>; // 128MB
};
diff --git a/arch/powerpc/boot/dts/digsy_mtc.dts b/arch/powerpc/boot/dts/digsy_mtc.dts
index c3922fc03e0b1..1a002cc487d57 100644
--- a/arch/powerpc/boot/dts/digsy_mtc.dts
+++ b/arch/powerpc/boot/dts/digsy_mtc.dts
@@ -20,7 +20,7 @@
model = "intercontrol,digsy-mtc";
compatible = "intercontrol,digsy-mtc";
- memory {
+ memory@0 {
reg = <0x00000000 0x02000000>; // 32MB
};
diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts
index 179a1785d6454..18d137a3393f0 100644
--- a/arch/powerpc/boot/dts/lite5200.dts
+++ b/arch/powerpc/boot/dts/lite5200.dts
@@ -36,7 +36,7 @@
};
};
- memory {
+ memory@0 {
device_type = "memory";
reg = <0x00000000 0x04000000>; // 64MB
};
diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts
index 5abb46c5cc951..29419cf81e044 100644
--- a/arch/powerpc/boot/dts/lite5200b.dts
+++ b/arch/powerpc/boot/dts/lite5200b.dts
@@ -35,7 +35,7 @@
led4 { gpios = <&gpio_simple 2 1>; };
};
- memory {
+ memory@0 {
reg = <0x00000000 0x10000000>; // 256MB
};
diff --git a/arch/powerpc/boot/dts/media5200.dts b/arch/powerpc/boot/dts/media5200.dts
index 843f156a49c46..3ae4432165f75 100644
--- a/arch/powerpc/boot/dts/media5200.dts
+++ b/arch/powerpc/boot/dts/media5200.dts
@@ -36,7 +36,7 @@
};
};
- memory {
+ memory@0 {
reg = <0x00000000 0x08000000>; // 128MB RAM
};
diff --git a/arch/powerpc/boot/dts/mpc5200b.dtsi b/arch/powerpc/boot/dts/mpc5200b.dtsi
index 969b2200b2f97..ecfba675b5611 100644
--- a/arch/powerpc/boot/dts/mpc5200b.dtsi
+++ b/arch/powerpc/boot/dts/mpc5200b.dtsi
@@ -37,7 +37,7 @@
};
};
- memory: memory {
+ memory: memory@0 {
device_type = "memory";
reg = <0x00000000 0x04000000>; // 64MB
};
diff --git a/arch/powerpc/boot/dts/o2d.dts b/arch/powerpc/boot/dts/o2d.dts
index 9f6dd4d889b32..5a676e8141caf 100644
--- a/arch/powerpc/boot/dts/o2d.dts
+++ b/arch/powerpc/boot/dts/o2d.dts
@@ -16,7 +16,7 @@
model = "ifm,o2d";
compatible = "ifm,o2d";
- memory {
+ memory@0 {
reg = <0x00000000 0x08000000>; // 128MB
};
diff --git a/arch/powerpc/boot/dts/o2d.dtsi b/arch/powerpc/boot/dts/o2d.dtsi
index cf073e693f24d..1b4df5f64b580 100644
--- a/arch/powerpc/boot/dts/o2d.dtsi
+++ b/arch/powerpc/boot/dts/o2d.dtsi
@@ -23,7 +23,7 @@
model = "ifm,o2d";
compatible = "ifm,o2d";
- memory {
+ memory@0 {
reg = <0x00000000 0x04000000>; // 64MB
};
diff --git a/arch/powerpc/boot/dts/o2dnt2.dts b/arch/powerpc/boot/dts/o2dnt2.dts
index a0f5b97a4f06e..5184c461a205f 100644
--- a/arch/powerpc/boot/dts/o2dnt2.dts
+++ b/arch/powerpc/boot/dts/o2dnt2.dts
@@ -16,7 +16,7 @@
model = "ifm,o2dnt2";
compatible = "ifm,o2d";
- memory {
+ memory@0 {
reg = <0x00000000 0x08000000>; // 128MB
};
diff --git a/arch/powerpc/boot/dts/o3dnt.dts b/arch/powerpc/boot/dts/o3dnt.dts
index acce49326491b..045b901719245 100644
--- a/arch/powerpc/boot/dts/o3dnt.dts
+++ b/arch/powerpc/boot/dts/o3dnt.dts
@@ -16,7 +16,7 @@
model = "ifm,o3dnt";
compatible = "ifm,o2d";
- memory {
+ memory@0 {
reg = <0x00000000 0x04000000>; // 64MB
};
diff --git a/arch/powerpc/boot/dts/pcm032.dts b/arch/powerpc/boot/dts/pcm032.dts
index 576249bf2fb91..637e14286dde5 100644
--- a/arch/powerpc/boot/dts/pcm032.dts
+++ b/arch/powerpc/boot/dts/pcm032.dts
@@ -26,7 +26,7 @@
model = "phytec,pcm032";
compatible = "phytec,pcm032";
- memory {
+ memory@0 {
reg = <0x00000000 0x08000000>; // 128MB
};
diff --git a/arch/powerpc/boot/dts/tqm5200.dts b/arch/powerpc/boot/dts/tqm5200.dts
index 1db07f6cf133c..68b9e8240fb5b 100644
--- a/arch/powerpc/boot/dts/tqm5200.dts
+++ b/arch/powerpc/boot/dts/tqm5200.dts
@@ -36,7 +36,7 @@
};
};
- memory {
+ memory@0 {
device_type = "memory";
reg = <0x00000000 0x04000000>; // 64MB
};
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 277/323] ALSA: gus: fix null pointer dereference on pointer block
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 276/323] powerpc/5200: dts: fix memory node unit name Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 278/323] powerpc/dcr: Use cmplwi instead of 3-argument cmpli Greg Kroah-Hartman
` (49 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chengfeng Ye, Takashi Iwai, Sasha Levin
From: Chengfeng Ye <cyeaa@connect.ust.hk>
[ Upstream commit a0d21bb3279476c777434c40d969ea88ca64f9aa ]
The pointer block return from snd_gf1_dma_next_block could be
null, so there is a potential null pointer dereference issue.
Fix this by adding a null check before dereference.
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Link: https://lore.kernel.org/r/20211024104611.9919-1-cyeaa@connect.ust.hk
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/isa/gus/gus_dma.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c
index 7f95f452f1064..48e76b8fede41 100644
--- a/sound/isa/gus/gus_dma.c
+++ b/sound/isa/gus/gus_dma.c
@@ -141,6 +141,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus)
}
block = snd_gf1_dma_next_block(gus);
spin_unlock(&gus->dma_lock);
+ if (!block)
+ return;
snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd);
kfree(block);
#if 0
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 278/323] powerpc/dcr: Use cmplwi instead of 3-argument cmpli
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 277/323] ALSA: gus: fix null pointer dereference on pointer block Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 279/323] sh: check return code of request_irq Greg Kroah-Hartman
` (48 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nick Desaulniers, Michael Ellerman,
Sasha Levin
From: Michael Ellerman <mpe@ellerman.id.au>
[ Upstream commit fef071be57dc43679a32d5b0e6ee176d6f12e9f2 ]
In dcr-low.S we use cmpli with three arguments, instead of four
arguments as defined in the ISA:
cmpli cr0,r3,1024
This appears to be a PPC440-ism, looking at the "PPC440x5 CPU Core
User’s Manual" it shows cmpli having no L field, but implied to be 0 due
to the core being 32-bit. It mentions that the ISA defines four
arguments and recommends using cmplwi.
It also corresponds to the old POWER instruction set, which had no L
field there, a reserved bit instead.
dcr-low.S is only built 32-bit, because it is only built when
DCR_NATIVE=y, which is only selected by 40x and 44x. Looking at the
generated code (with gcc/gas) we see cmplwi as expected.
Although gas is happy with the 3-argument version when building for
32-bit, the LLVM assembler is not and errors out with:
arch/powerpc/sysdev/dcr-low.S:27:10: error: invalid operand for instruction
cmpli 0,%r3,1024; ...
^
Switch to the cmplwi extended opcode, which avoids any confusion when
reading the ISA, fixes the issue with the LLVM assembler, and also means
the code could be built 64-bit in future (though that's very unlikely).
Reported-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
BugLink: https://github.com/ClangBuiltLinux/linux/issues/1419
Link: https://lore.kernel.org/r/20211014024424.528848-1-mpe@ellerman.id.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/sysdev/dcr-low.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/sysdev/dcr-low.S b/arch/powerpc/sysdev/dcr-low.S
index e687bb2003ff0..5589fbe48bbdc 100644
--- a/arch/powerpc/sysdev/dcr-low.S
+++ b/arch/powerpc/sysdev/dcr-low.S
@@ -15,7 +15,7 @@
#include <asm/export.h>
#define DCR_ACCESS_PROLOG(table) \
- cmpli cr0,r3,1024; \
+ cmplwi cr0,r3,1024; \
rlwinm r3,r3,4,18,27; \
lis r5,table@h; \
ori r5,r5,table@l; \
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 279/323] sh: check return code of request_irq
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 278/323] powerpc/dcr: Use cmplwi instead of 3-argument cmpli Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 280/323] maple: fix wrong return value of maple_bus_init() Greg Kroah-Hartman
` (47 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Miguel Ojeda, Paul Mundt,
Guenter Roeck, Nick Desaulniers, John Paul Adrian Glaubitz,
Miguel Ojeda, Rich Felker, Sasha Levin
From: Nick Desaulniers <ndesaulniers@google.com>
[ Upstream commit 0e38225c92c7964482a8bb6b3e37fde4319e965c ]
request_irq is marked __must_check, but the call in shx3_prepare_cpus
has a void return type, so it can't propagate failure to the caller.
Follow cues from hexagon and just print an error.
Fixes: c7936b9abcf5 ("sh: smp: Hook in to the generic IPI handler for SH-X3 SMP.")
Cc: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Cc: Paul Mundt <lethal@linux-sh.org>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Reviewed-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Rich Felker <dalias@libc.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sh/kernel/cpu/sh4a/smp-shx3.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c
index 0d3637c494bfe..c1f66c35e0c12 100644
--- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c
+++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c
@@ -76,8 +76,9 @@ static void shx3_prepare_cpus(unsigned int max_cpus)
BUILD_BUG_ON(SMP_MSG_NR >= 8);
for (i = 0; i < SMP_MSG_NR; i++)
- request_irq(104 + i, ipi_interrupt_handler,
- IRQF_PERCPU, "IPI", (void *)(long)i);
+ if (request_irq(104 + i, ipi_interrupt_handler,
+ IRQF_PERCPU, "IPI", (void *)(long)i))
+ pr_err("Failed to request irq %d\n", i);
for (i = 0; i < max_cpus; i++)
set_cpu_present(i, true);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 280/323] maple: fix wrong return value of maple_bus_init().
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 279/323] sh: check return code of request_irq Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 281/323] f2fs: fix up f2fs_lookup tracepoints Greg Kroah-Hartman
` (46 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Lu Wei,
John Paul Adrian Glaubitz, Rich Felker, Sasha Levin
From: Lu Wei <luwei32@huawei.com>
[ Upstream commit bde82ee391fa6d3ad054313c4aa7b726d32515ce ]
If KMEM_CACHE or maple_alloc_dev failed, the maple_bus_init() will return 0
rather than error, because the retval is not changed after KMEM_CACHE or
maple_alloc_dev failed.
Fixes: 17be2d2b1c33 ("sh: Add maple bus support for the SEGA Dreamcast.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Lu Wei <luwei32@huawei.com>
Acked-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Rich Felker <dalias@libc.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/sh/maple/maple.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c
index e5d7fb81ad665..44a931d41a132 100644
--- a/drivers/sh/maple/maple.c
+++ b/drivers/sh/maple/maple.c
@@ -835,8 +835,10 @@ static int __init maple_bus_init(void)
maple_queue_cache = KMEM_CACHE(maple_buffer, SLAB_HWCACHE_ALIGN);
- if (!maple_queue_cache)
+ if (!maple_queue_cache) {
+ retval = -ENOMEM;
goto cleanup_bothirqs;
+ }
INIT_LIST_HEAD(&maple_waitq);
INIT_LIST_HEAD(&maple_sentq);
@@ -849,6 +851,7 @@ static int __init maple_bus_init(void)
if (!mdev[i]) {
while (i-- > 0)
maple_free_dev(mdev[i]);
+ retval = -ENOMEM;
goto cleanup_cache;
}
baseunits[i] = mdev[i];
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 281/323] f2fs: fix up f2fs_lookup tracepoints
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 280/323] maple: fix wrong return value of maple_bus_init() Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 282/323] sh: fix kconfig unmet dependency warning for FRAME_POINTER Greg Kroah-Hartman
` (45 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gao Xiang, Jaegeuk Kim, Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit 70a9ac36ffd807ac506ed0b849f3e8ce3c6623f2 ]
Fix up a misuse that the filename pointer isn't always valid in
the ring buffer, and we should copy the content instead.
Fixes: 0c5e36db17f5 ("f2fs: trace f2fs_lookup")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/trace/events/f2fs.h | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h
index 795698925d206..52e6456bdb922 100644
--- a/include/trace/events/f2fs.h
+++ b/include/trace/events/f2fs.h
@@ -751,20 +751,20 @@ TRACE_EVENT(f2fs_lookup_start,
TP_STRUCT__entry(
__field(dev_t, dev)
__field(ino_t, ino)
- __field(const char *, name)
+ __string(name, dentry->d_name.name)
__field(unsigned int, flags)
),
TP_fast_assign(
__entry->dev = dir->i_sb->s_dev;
__entry->ino = dir->i_ino;
- __entry->name = dentry->d_name.name;
+ __assign_str(name, dentry->d_name.name);
__entry->flags = flags;
),
TP_printk("dev = (%d,%d), pino = %lu, name:%s, flags:%u",
show_dev_ino(__entry),
- __entry->name,
+ __get_str(name),
__entry->flags)
);
@@ -778,7 +778,7 @@ TRACE_EVENT(f2fs_lookup_end,
TP_STRUCT__entry(
__field(dev_t, dev)
__field(ino_t, ino)
- __field(const char *, name)
+ __string(name, dentry->d_name.name)
__field(nid_t, cino)
__field(int, err)
),
@@ -786,14 +786,14 @@ TRACE_EVENT(f2fs_lookup_end,
TP_fast_assign(
__entry->dev = dir->i_sb->s_dev;
__entry->ino = dir->i_ino;
- __entry->name = dentry->d_name.name;
+ __assign_str(name, dentry->d_name.name);
__entry->cino = ino;
__entry->err = err;
),
TP_printk("dev = (%d,%d), pino = %lu, name:%s, ino:%u, err:%d",
show_dev_ino(__entry),
- __entry->name,
+ __get_str(name),
__entry->cino,
__entry->err)
);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 282/323] sh: fix kconfig unmet dependency warning for FRAME_POINTER
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 281/323] f2fs: fix up f2fs_lookup tracepoints Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 283/323] sh: define __BIG_ENDIAN for math-emu Greg Kroah-Hartman
` (44 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Matt Fleming,
Matt Fleming, Yoshinori Sato, John Paul Adrian Glaubitz,
Geert Uytterhoeven, Rich Felker, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit fda1bc533094a7db68b11e7503d2c6c73993d12a ]
FRAME_POINTER depends on DEBUG_KERNEL so DWARF_UNWINDER should
depend on DEBUG_KERNEL before selecting FRAME_POINTER.
WARNING: unmet direct dependencies detected for FRAME_POINTER
Depends on [n]: DEBUG_KERNEL [=n] && (M68K || UML || SUPERH [=y]) || ARCH_WANT_FRAME_POINTERS [=n]
Selected by [y]:
- DWARF_UNWINDER [=y]
Fixes: bd353861c735 ("sh: dwarf unwinder support.")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Matt Fleming <matt@console-pimps.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Rich Felker <dalias@libc.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sh/Kconfig.debug | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
index 010b6c33bbba2..71acd3d9b9e83 100644
--- a/arch/sh/Kconfig.debug
+++ b/arch/sh/Kconfig.debug
@@ -58,6 +58,7 @@ config DUMP_CODE
config DWARF_UNWINDER
bool "Enable the DWARF unwinder for stacktraces"
+ depends on DEBUG_KERNEL
select FRAME_POINTER
depends on SUPERH32
default n
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 283/323] sh: define __BIG_ENDIAN for math-emu
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 282/323] sh: fix kconfig unmet dependency warning for FRAME_POINTER Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 284/323] mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set Greg Kroah-Hartman
` (43 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Yoshinori Sato,
John Paul Adrian Glaubitz, Geert Uytterhoeven, Rich Felker,
Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit b929926f01f2d14635345d22eafcf60feed1085e ]
Fix this by defining both ENDIAN macros in
<asm/sfp-machine.h> so that they can be utilized in
<math-emu/soft-fp.h> according to the latter's comment:
/* Allow sfp-machine to have its own byte order definitions. */
(This is what is done in arch/nds32/include/asm/sfp-machine.h.)
This placates these build warnings:
In file included from ../arch/sh/math-emu/math.c:23:
.../include/math-emu/single.h:50:21: warning: "__BIG_ENDIAN" is not defined, evaluates to 0 [-Wundef]
50 | #if __BYTE_ORDER == __BIG_ENDIAN
In file included from ../arch/sh/math-emu/math.c:24:
.../include/math-emu/double.h:59:21: warning: "__BIG_ENDIAN" is not defined, evaluates to 0 [-Wundef]
59 | #if __BYTE_ORDER == __BIG_ENDIAN
Fixes: 4b565680d163 ("sh: math-emu support")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Rich Felker <dalias@libc.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sh/include/asm/sfp-machine.h | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/sh/include/asm/sfp-machine.h b/arch/sh/include/asm/sfp-machine.h
index d3c548443f2a6..dd195c6f3b9d8 100644
--- a/arch/sh/include/asm/sfp-machine.h
+++ b/arch/sh/include/asm/sfp-machine.h
@@ -25,6 +25,14 @@
#ifndef _SFP_MACHINE_H
#define _SFP_MACHINE_H
+#ifdef __BIG_ENDIAN__
+#define __BYTE_ORDER __BIG_ENDIAN
+#define __LITTLE_ENDIAN 0
+#else
+#define __BYTE_ORDER __LITTLE_ENDIAN
+#define __BIG_ENDIAN 0
+#endif
+
#define _FP_W_TYPE_SIZE 32
#define _FP_W_TYPE unsigned long
#define _FP_WS_TYPE signed long
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 284/323] mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 283/323] sh: define __BIG_ENDIAN for math-emu Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 285/323] sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() Greg Kroah-Hartman
` (42 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, kernel test robot,
Thomas Bogendoerfer, Florian Fainelli, bcm-kernel-feedback-list,
linux-mips, Paul Burton, Maxime Bizon, Ralf Baechle, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 5eeaafc8d69373c095e461bdb39e5c9b62228ac5 ]
Several header files need info on CONFIG_32BIT or CONFIG_64BIT,
but kconfig symbol BCM63XX does not provide that info. This leads
to many build errors, e.g.:
arch/mips/include/asm/page.h:196:13: error: use of undeclared identifier 'CAC_BASE'
return x - PAGE_OFFSET + PHYS_OFFSET;
arch/mips/include/asm/mach-generic/spaces.h:91:23: note: expanded from macro 'PAGE_OFFSET'
#define PAGE_OFFSET (CAC_BASE + PHYS_OFFSET)
arch/mips/include/asm/io.h:134:28: error: use of undeclared identifier 'CAC_BASE'
return (void *)(address + PAGE_OFFSET - PHYS_OFFSET);
arch/mips/include/asm/mach-generic/spaces.h:91:23: note: expanded from macro 'PAGE_OFFSET'
#define PAGE_OFFSET (CAC_BASE + PHYS_OFFSET)
arch/mips/include/asm/uaccess.h:82:10: error: use of undeclared identifier '__UA_LIMIT'
return (__UA_LIMIT & (addr | (addr + size) | __ua_size(size))) == 0;
Selecting the SYS_HAS_CPU_BMIPS* symbols causes SYS_HAS_CPU_BMIPS to be
set, which then selects CPU_SUPPORT_32BIT_KERNEL, which causes
CONFIG_32BIT to be set. (a bit more indirect than v1 [RFC].)
Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: bcm-kernel-feedback-list@broadcom.com
Cc: linux-mips@vger.kernel.org
Cc: Paul Burton <paulburton@kernel.org>
Cc: Maxime Bizon <mbizon@freebox.fr>
Cc: Ralf Baechle <ralf@linux-mips.org>
Suggested-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/Kconfig | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index fb8554c41e803..e513528be3ad7 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -285,6 +285,9 @@ config BCM63XX
select SYS_SUPPORTS_32BIT_KERNEL
select SYS_SUPPORTS_BIG_ENDIAN
select SYS_HAS_EARLY_PRINTK
+ select SYS_HAS_CPU_BMIPS32_3300
+ select SYS_HAS_CPU_BMIPS4350
+ select SYS_HAS_CPU_BMIPS4380
select SWAP_IO_SPACE
select GPIOLIB
select HAVE_CLK
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 285/323] sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 284/323] mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 286/323] drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame Greg Kroah-Hartman
` (41 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jing-Ting Wu, Vincent Donnefort,
Peter Zijlstra (Intel),
Valentin Schneider, Vincent Guittot, Sasha Levin
From: Vincent Donnefort <vincent.donnefort@arm.com>
[ Upstream commit 42dc938a590c96eeb429e1830123fef2366d9c80 ]
Nothing protects the access to the per_cpu variable sd_llc_id. When testing
the same CPU (i.e. this_cpu == that_cpu), a race condition exists with
update_top_cache_domain(). One scenario being:
CPU1 CPU2
==================================================================
per_cpu(sd_llc_id, CPUX) => 0
partition_sched_domains_locked()
detach_destroy_domains()
cpus_share_cache(CPUX, CPUX) update_top_cache_domain(CPUX)
per_cpu(sd_llc_id, CPUX) => 0
per_cpu(sd_llc_id, CPUX) = CPUX
per_cpu(sd_llc_id, CPUX) => CPUX
return false
ttwu_queue_cond() wouldn't catch smp_processor_id() == cpu and the result
is a warning triggered from ttwu_queue_wakelist().
Avoid a such race in cpus_share_cache() by always returning true when
this_cpu == that_cpu.
Fixes: 518cd6234178 ("sched: Only queue remote wakeups when crossing cache boundaries")
Reported-by: Jing-Ting Wu <jing-ting.wu@mediatek.com>
Signed-off-by: Vincent Donnefort <vincent.donnefort@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Link: https://lore.kernel.org/r/20211104175120.857087-1-vincent.donnefort@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 013b1c6cb4ed9..32af895bd86b3 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1821,6 +1821,9 @@ out:
bool cpus_share_cache(int this_cpu, int that_cpu)
{
+ if (this_cpu == that_cpu)
+ return true;
+
return per_cpu(sd_llc_id, this_cpu) == per_cpu(sd_llc_id, that_cpu);
}
#endif /* CONFIG_SMP */
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 286/323] drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 285/323] sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 287/323] net: bnx2x: fix variable dereferenced before check Greg Kroah-Hartman
` (40 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Ben Skeggs,
Karol Herbst, Sasha Levin
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 3cc1ae1fa70ab369e4645e38ce335a19438093ad ]
gv100_hdmi_ctrl() writes vendor_infoframe.subpack0_high to 0x6f0110, and
then overwrites it with 0. Just drop the overwrite with 0, that's clearly
a mistake.
Because of this issue the HDMI VIC is 0 instead of 1 in the HDMI Vendor
InfoFrame when transmitting 4kp30.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 290ffeafcc1a ("drm/nouveau/disp/gv100: initial support")
Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/3d3bd0f7-c150-2479-9350-35d394ee772d@xs4all.nl
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c
index 6e3c450eaacef..3ff49344abc77 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c
@@ -62,7 +62,6 @@ gv100_hdmi_ctrl(struct nvkm_ior *ior, int head, bool enable, u8 max_ac_packet,
nvkm_wr32(device, 0x6f0108 + hdmi, vendor_infoframe.header);
nvkm_wr32(device, 0x6f010c + hdmi, vendor_infoframe.subpack0_low);
nvkm_wr32(device, 0x6f0110 + hdmi, vendor_infoframe.subpack0_high);
- nvkm_wr32(device, 0x6f0110 + hdmi, 0x00000000);
nvkm_wr32(device, 0x6f0114 + hdmi, 0x00000000);
nvkm_wr32(device, 0x6f0118 + hdmi, 0x00000000);
nvkm_wr32(device, 0x6f011c + hdmi, 0x00000000);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 287/323] net: bnx2x: fix variable dereferenced before check
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 286/323] drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 288/323] iavf: check for null in iavf_fix_features Greg Kroah-Hartman
` (39 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, David S. Miller, Sasha Levin
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit f8885ac89ce310570e5391fe0bf0ec9c7c9b4fdc ]
Smatch says:
bnx2x_init_ops.h:640 bnx2x_ilt_client_mem_op()
warn: variable dereferenced before check 'ilt' (see line 638)
Move ilt_cli variable initialization _after_ ilt validation, because
it's unsafe to deref the pointer before validation check.
Fixes: 523224a3b3cd ("bnx2x, cnic, bnx2i: use new FW/HSI")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h
index 1835d2e451c01..fc7fce642666c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h
@@ -635,11 +635,13 @@ static int bnx2x_ilt_client_mem_op(struct bnx2x *bp, int cli_num,
{
int i, rc;
struct bnx2x_ilt *ilt = BP_ILT(bp);
- struct ilt_client_info *ilt_cli = &ilt->clients[cli_num];
+ struct ilt_client_info *ilt_cli;
if (!ilt || !ilt->lines)
return -1;
+ ilt_cli = &ilt->clients[cli_num];
+
if (ilt_cli->flags & (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM))
return 0;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 288/323] iavf: check for null in iavf_fix_features
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 287/323] net: bnx2x: fix variable dereferenced before check Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 289/323] iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset Greg Kroah-Hartman
` (38 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Nunley, Tony Brelinski,
Tony Nguyen, Sasha Levin
From: Nicholas Nunley <nicholas.d.nunley@intel.com>
[ Upstream commit 8a4a126f4be88eb8b5f00a165ab58c35edf4ef76 ]
If the driver has lost contact with the PF then it enters a disabled state
and frees adapter->vf_res. However, ndo_fix_features can still be called on
the interface, so we need to check for this condition first. Since we have
no information on the features at this time simply leave them unmodified
and return.
Fixes: c4445aedfe09 ("i40evf: Fix VLAN features")
Signed-off-by: Nicholas Nunley <nicholas.d.nunley@intel.com>
Tested-by: Tony Brelinski <tony.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/i40evf/i40evf_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
index ac5709624c7ad..1fd8cc5ac306c 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
@@ -3185,7 +3185,8 @@ static netdev_features_t i40evf_fix_features(struct net_device *netdev,
{
struct i40evf_adapter *adapter = netdev_priv(netdev);
- if (!(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN))
+ if (adapter->vf_res &&
+ !(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN))
features &= ~(NETIF_F_HW_VLAN_CTAG_TX |
NETIF_F_HW_VLAN_CTAG_RX |
NETIF_F_HW_VLAN_CTAG_FILTER);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 289/323] iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 288/323] iavf: check for null in iavf_fix_features Greg Kroah-Hartman
@ 2021-11-24 11:57 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 290/323] MIPS: generic/yamon-dt: fix uninitialized variable error Greg Kroah-Hartman
` (37 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:57 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Surabhi Boob, Tony Brelinski,
Tony Nguyen, Sasha Levin
From: Surabhi Boob <surabhi.boob@intel.com>
[ Upstream commit 321421b57a12e933f92b228e0e6d0b2c6541f41d ]
While issuing VF Reset from the guest OS, the VF driver prints
logs about critical / Overflow error detection. This is not an
actual error since the VF_MBX_ARQLEN register is set to all FF's
for a short period of time and the VF would catch the bits set if
it was reading the register during that spike of time.
This patch introduces an additional check to ignore this condition
since the VF is in reset.
Fixes: 19b73d8efaa4 ("i40evf: Add additional check for reset")
Signed-off-by: Surabhi Boob <surabhi.boob@intel.com>
Tested-by: Tony Brelinski <tony.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/i40evf/i40evf_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
index 1fd8cc5ac306c..5a6e579e9e653 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
@@ -2058,7 +2058,7 @@ static void i40evf_adminq_task(struct work_struct *work)
/* check for error indications */
val = rd32(hw, hw->aq.arq.len);
- if (val == 0xdeadbeef) /* indicates device in reset */
+ if (val == 0xdeadbeef || val == 0xffffffff) /* device in reset */
goto freedom;
oldval = val;
if (val & I40E_VF_ARQLEN1_ARQVFE_MASK) {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 290/323] MIPS: generic/yamon-dt: fix uninitialized variable error
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2021-11-24 11:57 ` [PATCH 4.19 289/323] iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 291/323] mips: bcm63xx: add support for clk_get_parent() Greg Kroah-Hartman
` (36 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Thomas Bogendoerfer,
Sasha Levin
From: Colin Ian King <colin.i.king@googlemail.com>
[ Upstream commit 255e51da15baed47531beefd02f222e4dc01f1c1 ]
In the case where fw_getenv returns an error when fetching values
for ememsizea and memsize then variable phys_memsize is not assigned
a variable and will be uninitialized on a zero check of phys_memsize.
Fix this by initializing phys_memsize to zero.
Cleans up cppcheck error:
arch/mips/generic/yamon-dt.c:100:7: error: Uninitialized variable: phys_memsize [uninitvar]
Fixes: f41d2430bbd6 ("MIPS: generic/yamon-dt: Support > 256MB of RAM")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/generic/yamon-dt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/generic/yamon-dt.c b/arch/mips/generic/yamon-dt.c
index 7ba4ad5cc1d66..7b7ba0f76c60e 100644
--- a/arch/mips/generic/yamon-dt.c
+++ b/arch/mips/generic/yamon-dt.c
@@ -79,7 +79,7 @@ static unsigned int __init gen_fdt_mem_array(
__init int yamon_dt_append_memory(void *fdt,
const struct yamon_mem_region *regions)
{
- unsigned long phys_memsize, memsize;
+ unsigned long phys_memsize = 0, memsize;
__be32 mem_array[2 * MAX_MEM_ARRAY_ENTRIES];
unsigned int mem_entries;
int i, err, mem_off;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 291/323] mips: bcm63xx: add support for clk_get_parent()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 290/323] MIPS: generic/yamon-dt: fix uninitialized variable error Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 292/323] mips: lantiq: " Greg Kroah-Hartman
` (35 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, kernel test robot,
Russell King (Oracle),
Artur Rojek, Paul Cercueil, linux-mips, Jonathan Cameron,
Lars-Peter Clausen, linux-iio, Florian Fainelli, Andy Shevchenko,
Russell King, bcm-kernel-feedback-list, Jonas Gorski,
Jonathan Cameron, Thomas Bogendoerfer, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit e8f67482e5a4bc8d0b65d606d08cb60ee123b468 ]
BCM63XX selects HAVE_LEGACY_CLK but does not provide/support
clk_get_parent(), so add a simple implementation of that
function so that callers of it will build without errors.
Fixes these build errors:
mips-linux-ld: drivers/iio/adc/ingenic-adc.o: in function `jz4770_adc_init_clk_div':
ingenic-adc.c:(.text+0xe4): undefined reference to `clk_get_parent'
mips-linux-ld: drivers/iio/adc/ingenic-adc.o: in function `jz4725b_adc_init_clk_div':
ingenic-adc.c:(.text+0x1b8): undefined reference to `clk_get_parent'
Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs." )
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Cc: Artur Rojek <contact@artur-rojek.eu>
Cc: Paul Cercueil <paul@crapouillou.net>
Cc: linux-mips@vger.kernel.org
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: linux-iio@vger.kernel.org
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: bcm-kernel-feedback-list@broadcom.com
Cc: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/bcm63xx/clk.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c
index 164115944a7fd..aba6e2d6a736c 100644
--- a/arch/mips/bcm63xx/clk.c
+++ b/arch/mips/bcm63xx/clk.c
@@ -381,6 +381,12 @@ void clk_disable(struct clk *clk)
EXPORT_SYMBOL(clk_disable);
+struct clk *clk_get_parent(struct clk *clk)
+{
+ return NULL;
+}
+EXPORT_SYMBOL(clk_get_parent);
+
unsigned long clk_get_rate(struct clk *clk)
{
if (!clk)
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 292/323] mips: lantiq: add support for clk_get_parent()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 291/323] mips: bcm63xx: add support for clk_get_parent() Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 293/323] platform/x86: hp_accel: Fix an error handling path in lis3lv02d_probe() Greg Kroah-Hartman
` (34 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Russell King (Oracle),
linux-mips, John Crispin, Thomas Bogendoerfer, Jonathan Cameron,
linux-iio, Russell King, Andy Shevchenko, Jonathan Cameron,
Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit fc1aabb088860d6cf9dd03612b7a6f0de91ccac2 ]
Provide a simple implementation of clk_get_parent() in the
lantiq subarch so that callers of it will build without errors.
Fixes this build error:
ERROR: modpost: "clk_get_parent" [drivers/iio/adc/ingenic-adc.ko] undefined!
Fixes: 171bb2f19ed6 ("MIPS: Lantiq: Add initial support for Lantiq SoCs")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Suggested-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Cc: linux-mips@vger.kernel.org
Cc: John Crispin <john@phrozen.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: linux-iio@vger.kernel.org
Cc: Russell King <linux@armlinux.org.uk>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: John Crispin <john@phrozen.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/lantiq/clk.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c
index a263d1b751ffe..a8e309dcd38d7 100644
--- a/arch/mips/lantiq/clk.c
+++ b/arch/mips/lantiq/clk.c
@@ -160,6 +160,12 @@ void clk_deactivate(struct clk *clk)
}
EXPORT_SYMBOL(clk_deactivate);
+struct clk *clk_get_parent(struct clk *clk)
+{
+ return NULL;
+}
+EXPORT_SYMBOL(clk_get_parent);
+
static inline u32 get_counter_resolution(void)
{
u32 res;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 293/323] platform/x86: hp_accel: Fix an error handling path in lis3lv02d_probe()
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 292/323] mips: lantiq: " Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 294/323] net: virtio_net_hdr_to_skb: count transport header in UFO Greg Kroah-Hartman
` (33 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Hans de Goede,
Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit c961a7d2aa23ae19e0099fbcdf1040fb760eea83 ]
If 'led_classdev_register()' fails, some additional resources should be
released.
Add the missing 'i8042_remove_filter()' and 'lis3lv02d_remove_fs()' calls
that are already in the remove function but are missing here.
Fixes: a4c724d0723b ("platform: hp_accel: add a i8042 filter to remove HPQ6000 data from kb bus stream")
Fixes: 9e0c79782143 ("lis3lv02d: merge with leds hp disk")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/5a4f218f8f16d2e3a7906b7ca3654ffa946895f8.1636314074.git.christophe.jaillet@wanadoo.fr
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp_accel.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
index 9c3c83ef445bf..075332c6890d0 100644
--- a/drivers/platform/x86/hp_accel.c
+++ b/drivers/platform/x86/hp_accel.c
@@ -383,9 +383,11 @@ static int lis3lv02d_add(struct acpi_device *device)
INIT_WORK(&hpled_led.work, delayed_set_status_worker);
ret = led_classdev_register(NULL, &hpled_led.led_classdev);
if (ret) {
+ i8042_remove_filter(hp_accel_i8042_filter);
lis3lv02d_joystick_disable(&lis3_dev);
lis3lv02d_poweroff(&lis3_dev);
flush_work(&hpled_led.work);
+ lis3lv02d_remove_fs(&lis3_dev);
return ret;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 294/323] net: virtio_net_hdr_to_skb: count transport header in UFO
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 293/323] platform/x86: hp_accel: Fix an error handling path in lis3lv02d_probe() Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 295/323] i40e: Fix correct max_pkt_size on VF RX queue Greg Kroah-Hartman
` (32 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jonathan Davies, Willem de Bruijn,
David S. Miller, Sasha Levin
From: Jonathan Davies <jonathan.davies@nutanix.com>
[ Upstream commit cf9acc90c80ecbee00334aa85d92f4e74014bcff ]
virtio_net_hdr_to_skb does not set the skb's gso_size and gso_type
correctly for UFO packets received via virtio-net that are a little over
the GSO size. This can lead to problems elsewhere in the networking
stack, e.g. ovs_vport_send dropping over-sized packets if gso_size is
not set.
This is due to the comparison
if (skb->len - p_off > gso_size)
not properly accounting for the transport layer header.
p_off includes the size of the transport layer header (thlen), so
skb->len - p_off is the size of the TCP/UDP payload.
gso_size is read from the virtio-net header. For UFO, fragmentation
happens at the IP level so does not need to include the UDP header.
Hence the calculation could be comparing a TCP/UDP payload length with
an IP payload length, causing legitimate virtio-net packets to have
lack gso_type/gso_size information.
Example: a UDP packet with payload size 1473 has IP payload size 1481.
If the guest used UFO, it is not fragmented and the virtio-net header's
flags indicate that it is a GSO frame (VIRTIO_NET_HDR_GSO_UDP), with
gso_size = 1480 for an MTU of 1500. skb->len will be 1515 and p_off
will be 42, so skb->len - p_off = 1473. Hence the comparison fails, and
shinfo->gso_size and gso_type are not set as they should be.
Instead, add the UDP header length before comparing to gso_size when
using UFO. In this way, it is the size of the IP payload that is
compared to gso_size.
Fixes: 6dd912f82680 ("net: check untrusted gso_size at kernel entry")
Signed-off-by: Jonathan Davies <jonathan.davies@nutanix.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/virtio_net.h | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index 8f48264f5dab3..e7330a9a7d7dc 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -120,10 +120,15 @@ retry:
if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size);
+ unsigned int nh_off = p_off;
struct skb_shared_info *shinfo = skb_shinfo(skb);
+ /* UFO may not include transport header in gso_size. */
+ if (gso_type & SKB_GSO_UDP)
+ nh_off -= thlen;
+
/* Too small packets are not really GSO ones. */
- if (skb->len - p_off > gso_size) {
+ if (skb->len - nh_off > gso_size) {
shinfo->gso_size = gso_size;
shinfo->gso_type = gso_type;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 295/323] i40e: Fix correct max_pkt_size on VF RX queue
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 294/323] net: virtio_net_hdr_to_skb: count transport header in UFO Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 296/323] i40e: Fix NULL ptr dereference on VSI filter sync Greg Kroah-Hartman
` (31 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sylwester Dziedziuch,
Aleksandr Loktionov, Eryk Rybak, Konrad Jankowski, Tony Nguyen,
Sasha Levin
From: Eryk Rybak <eryk.roch.rybak@intel.com>
[ Upstream commit 6afbd7b3c53cb7417189f476e99d431daccb85b0 ]
Setting VLAN port increasing RX queue max_pkt_size
by 4 bytes to take VLAN tag into account.
Trigger the VF reset when setting port VLAN for
VF to renegotiate its capabilities and reinitialize.
Fixes: ba4e003d29c1 ("i40e: don't hold spinlock while resetting VF")
Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Eryk Rybak <eryk.roch.rybak@intel.com>
Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/intel/i40e/i40e_virtchnl_pf.c | 53 ++++---------------
1 file changed, 9 insertions(+), 44 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 3c1533c627fd0..02d245970d7fa 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -621,14 +621,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id,
u16 vsi_queue_id,
struct virtchnl_rxq_info *info)
{
+ u16 pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id);
struct i40e_pf *pf = vf->pf;
+ struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx];
struct i40e_hw *hw = &pf->hw;
struct i40e_hmc_obj_rxq rx_ctx;
- u16 pf_queue_id;
int ret = 0;
- pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id);
-
/* clear the context structure first */
memset(&rx_ctx, 0, sizeof(struct i40e_hmc_obj_rxq));
@@ -666,6 +665,10 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id,
}
rx_ctx.rxmax = info->max_pkt_size;
+ /* if port VLAN is configured increase the max packet size */
+ if (vsi->info.pvid)
+ rx_ctx.rxmax += VLAN_HLEN;
+
/* enable 32bytes desc always */
rx_ctx.dsize = 1;
@@ -3927,34 +3930,6 @@ error_param:
return ret;
}
-/**
- * i40e_vsi_has_vlans - True if VSI has configured VLANs
- * @vsi: pointer to the vsi
- *
- * Check if a VSI has configured any VLANs. False if we have a port VLAN or if
- * we have no configured VLANs. Do not call while holding the
- * mac_filter_hash_lock.
- */
-static bool i40e_vsi_has_vlans(struct i40e_vsi *vsi)
-{
- bool have_vlans;
-
- /* If we have a port VLAN, then the VSI cannot have any VLANs
- * configured, as all MAC/VLAN filters will be assigned to the PVID.
- */
- if (vsi->info.pvid)
- return false;
-
- /* Since we don't have a PVID, we know that if the device is in VLAN
- * mode it must be because of a VLAN filter configured on this VSI.
- */
- spin_lock_bh(&vsi->mac_filter_hash_lock);
- have_vlans = i40e_is_vsi_in_vlan(vsi);
- spin_unlock_bh(&vsi->mac_filter_hash_lock);
-
- return have_vlans;
-}
-
/**
* i40e_ndo_set_vf_port_vlan
* @netdev: network interface device structure
@@ -4007,19 +3982,9 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id,
/* duplicate request, so just return success */
goto error_pvid;
- if (i40e_vsi_has_vlans(vsi)) {
- dev_err(&pf->pdev->dev,
- "VF %d has already configured VLAN filters and the administrator is requesting a port VLAN override.\nPlease unload and reload the VF driver for this change to take effect.\n",
- vf_id);
- /* Administrator Error - knock the VF offline until he does
- * the right thing by reconfiguring his network correctly
- * and then reloading the VF driver.
- */
- i40e_vc_disable_vf(vf);
- /* During reset the VF got a new VSI, so refresh the pointer. */
- vsi = pf->vsi[vf->lan_vsi_idx];
- }
-
+ i40e_vc_disable_vf(vf);
+ /* During reset the VF got a new VSI, so refresh a pointer. */
+ vsi = pf->vsi[vf->lan_vsi_idx];
/* Locked once because multiple functions below iterate list */
spin_lock_bh(&vsi->mac_filter_hash_lock);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 296/323] i40e: Fix NULL ptr dereference on VSI filter sync
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 295/323] i40e: Fix correct max_pkt_size on VF RX queue Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 297/323] i40e: Fix changing previously set num_queue_pairs for PFs Greg Kroah-Hartman
` (30 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Grzegorz Szczurek,
Michal Maloszewski, Przemyslaw Patynowski, Witold Fijalkowski,
Jaroslaw Gawin, Aleksandr Loktionov, Tony Brelinski, Tony Nguyen,
Sasha Levin
From: Michal Maloszewski <michal.maloszewski@intel.com>
[ Upstream commit 37d9e304acd903a445df8208b8a13d707902dea6 ]
Remove the reason of null pointer dereference in sync VSI filters.
Added new I40E_VSI_RELEASING flag to signalize deleting and releasing
of VSI resources to sync this thread with sync filters subtask.
Without this patch it is possible to start update the VSI filter list
after VSI is removed, that's causing a kernel oops.
Fixes: 41c445ff0f48 ("i40e: main driver core")
Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
Signed-off-by: Michal Maloszewski <michal.maloszewski@intel.com>
Reviewed-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
Reviewed-by: Witold Fijalkowski <witoldx.fijalkowski@intel.com>
Reviewed-by: Jaroslaw Gawin <jaroslawx.gawin@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Tony Brelinski <tony.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/i40e/i40e.h | 1 +
drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++--
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index 3c921dfc20564..519b595944235 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -166,6 +166,7 @@ enum i40e_vsi_state_t {
__I40E_VSI_OVERFLOW_PROMISC,
__I40E_VSI_REINIT_REQUESTED,
__I40E_VSI_DOWN_REQUESTED,
+ __I40E_VSI_RELEASING,
/* This must be last as it determines the size of the BITMAP */
__I40E_VSI_STATE_SIZE__,
};
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 062b942517822..d948ca6368422 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -2584,7 +2584,8 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
for (v = 0; v < pf->num_alloc_vsi; v++) {
if (pf->vsi[v] &&
- (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED)) {
+ (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED) &&
+ !test_bit(__I40E_VSI_RELEASING, pf->vsi[v]->state)) {
int ret = i40e_sync_vsi_filters(pf->vsi[v]);
if (ret) {
@@ -12444,7 +12445,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi)
dev_info(&pf->pdev->dev, "Can't remove PF VSI\n");
return -ENODEV;
}
-
+ set_bit(__I40E_VSI_RELEASING, vsi->state);
uplink_seid = vsi->uplink_seid;
if (vsi->type != I40E_VSI_SRIOV) {
if (vsi->netdev_registered) {
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 297/323] i40e: Fix changing previously set num_queue_pairs for PFs
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 296/323] i40e: Fix NULL ptr dereference on VSI filter sync Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 298/323] i40e: Fix display error code in dmesg Greg Kroah-Hartman
` (29 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maciej Fijalkowski,
Przemyslaw Patynowski, Eryk Rybak, Tony Brelinski, Tony Nguyen,
Sasha Levin
From: Eryk Rybak <eryk.roch.rybak@intel.com>
[ Upstream commit d2a69fefd75683004ffe87166de5635b3267ee07 ]
Currently, the i40e_vsi_setup_queue_map is basing the count of queues in
TCs on a VSI's alloc_queue_pairs member which is not changed throughout
any user's action (for example via ethtool's set_channels callback).
This implies that vsi->tc_config.tc_info[n].qcount value that is given
to the kernel via netdev_set_tc_queue() that notifies about the count of
queues per particular traffic class is constant even if user has changed
the total count of queues.
This in turn caused the kernel warning after setting the queue count to
the lower value than the initial one:
$ ethtool -l ens801f0
Channel parameters for ens801f0:
Pre-set maximums:
RX: 0
TX: 0
Other: 1
Combined: 64
Current hardware settings:
RX: 0
TX: 0
Other: 1
Combined: 64
$ ethtool -L ens801f0 combined 40
[dmesg]
Number of in use tx queues changed invalidating tc mappings. Priority
traffic classification disabled!
Reason was that vsi->alloc_queue_pairs stayed at 64 value which was used
to set the qcount on TC0 (by default only TC0 exists so all of the
existing queues are assigned to TC0). we update the offset/qcount via
netdev_set_tc_queue() back to the old value but then the
netif_set_real_num_tx_queues() is using the vsi->num_queue_pairs as a
value which got set to 40.
Fix it by using vsi->req_queue_pairs as a queue count that will be
distributed across TCs. Do it only for non-zero values, which implies
that user actually requested the new count of queues.
For VSIs other than main, stay with the vsi->alloc_queue_pairs as we
only allow manipulating the queue count on main VSI.
Fixes: bc6d33c8d93f ("i40e: Fix the number of queues available to be mapped for use")
Co-developed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Co-developed-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
Signed-off-by: Eryk Rybak <eryk.roch.rybak@intel.com>
Tested-by: Tony Brelinski <tony.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/i40e/i40e_main.c | 35 ++++++++++++++-------
1 file changed, 23 insertions(+), 12 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index d948ca6368422..222eb82d56109 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -1765,6 +1765,7 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi,
bool is_add)
{
struct i40e_pf *pf = vsi->back;
+ u16 num_tc_qps = 0;
u16 sections = 0;
u8 netdev_tc = 0;
u16 numtc = 1;
@@ -1772,13 +1773,29 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi,
u8 offset;
u16 qmap;
int i;
- u16 num_tc_qps = 0;
sections = I40E_AQ_VSI_PROP_QUEUE_MAP_VALID;
offset = 0;
+ if (vsi->type == I40E_VSI_MAIN) {
+ /* This code helps add more queue to the VSI if we have
+ * more cores than RSS can support, the higher cores will
+ * be served by ATR or other filters. Furthermore, the
+ * non-zero req_queue_pairs says that user requested a new
+ * queue count via ethtool's set_channels, so use this
+ * value for queues distribution across traffic classes
+ */
+ if (vsi->req_queue_pairs > 0)
+ vsi->num_queue_pairs = vsi->req_queue_pairs;
+ else if (pf->flags & I40E_FLAG_MSIX_ENABLED)
+ vsi->num_queue_pairs = pf->num_lan_msix;
+ }
+
/* Number of queues per enabled TC */
- num_tc_qps = vsi->alloc_queue_pairs;
+ if (vsi->type == I40E_VSI_MAIN)
+ num_tc_qps = vsi->num_queue_pairs;
+ else
+ num_tc_qps = vsi->alloc_queue_pairs;
if (enabled_tc && (vsi->back->flags & I40E_FLAG_DCB_ENABLED)) {
/* Find numtc from enabled TC bitmap */
for (i = 0, numtc = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) {
@@ -1856,16 +1873,10 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi,
}
ctxt->info.tc_mapping[i] = cpu_to_le16(qmap);
}
-
- /* Set actual Tx/Rx queue pairs */
- vsi->num_queue_pairs = offset;
- if ((vsi->type == I40E_VSI_MAIN) && (numtc == 1)) {
- if (vsi->req_queue_pairs > 0)
- vsi->num_queue_pairs = vsi->req_queue_pairs;
- else if (pf->flags & I40E_FLAG_MSIX_ENABLED)
- vsi->num_queue_pairs = pf->num_lan_msix;
- }
-
+ /* Do not change previously set num_queue_pairs for PFs */
+ if ((vsi->type == I40E_VSI_MAIN && numtc != 1) ||
+ vsi->type != I40E_VSI_MAIN)
+ vsi->num_queue_pairs = offset;
/* Scheduler section valid can only be set for ADD VSI */
if (is_add) {
sections |= I40E_AQ_VSI_PROP_SCHED_VALID;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 298/323] i40e: Fix display error code in dmesg
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 297/323] i40e: Fix changing previously set num_queue_pairs for PFs Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 299/323] NFC: reorganize the functions in nci_request Greg Kroah-Hartman
` (28 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Grzegorz Szczurek,
Mateusz Palczewski, Dave Switzer, Tony Nguyen, Sasha Levin
From: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
[ Upstream commit 5aff430d4e33a0b48a6b3d5beb06f79da23f9916 ]
Fix misleading display error in dmesg if tc filter return fail.
Only i40e status error code should be converted to string, not linux
error code. Otherwise, we return false information about the error.
Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower")
Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
Tested-by: Dave Switzer <david.switzer@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/i40e/i40e_main.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 222eb82d56109..51edc7fdc9b9e 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -7517,9 +7517,8 @@ static int i40e_configure_clsflower(struct i40e_vsi *vsi,
err = i40e_add_del_cloud_filter(vsi, filter, true);
if (err) {
- dev_err(&pf->pdev->dev,
- "Failed to add cloud filter, err %s\n",
- i40e_stat_str(&pf->hw, err));
+ dev_err(&pf->pdev->dev, "Failed to add cloud filter, err %d\n",
+ err);
goto err;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 299/323] NFC: reorganize the functions in nci_request
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 298/323] i40e: Fix display error code in dmesg Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 300/323] NFC: reorder the logic in nfc_{un,}register_device Greg Kroah-Hartman
` (27 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lin Ma, Jakub Kicinski, Sasha Levin
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit 86cdf8e38792545161dbe3350a7eced558ba4d15 ]
There is a possible data race as shown below:
thread-A in nci_request() | thread-B in nci_close_device()
| mutex_lock(&ndev->req_lock);
test_bit(NCI_UP, &ndev->flags); |
... | test_and_clear_bit(NCI_UP, &ndev->flags)
mutex_lock(&ndev->req_lock); |
|
This race will allow __nci_request() to be awaked while the device is
getting removed.
Similar to commit e2cb6b891ad2 ("bluetooth: eliminate the potential race
condition when removing the HCI controller"). this patch alters the
function sequence in nci_request() to prevent the data races between the
nci_close_device().
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
Link: https://lore.kernel.org/r/20211115145600.8320-1-linma@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/nci/core.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 33c23af6709d4..1008bbbb3af9c 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -156,12 +156,15 @@ inline int nci_request(struct nci_dev *ndev,
{
int rc;
- if (!test_bit(NCI_UP, &ndev->flags))
- return -ENETDOWN;
-
/* Serialize all requests */
mutex_lock(&ndev->req_lock);
- rc = __nci_request(ndev, req, opt, timeout);
+ /* check the state after obtaing the lock against any races
+ * from nci_close_device when the device gets removed.
+ */
+ if (test_bit(NCI_UP, &ndev->flags))
+ rc = __nci_request(ndev, req, opt, timeout);
+ else
+ rc = -ENETDOWN;
mutex_unlock(&ndev->req_lock);
return rc;
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 300/323] NFC: reorder the logic in nfc_{un,}register_device
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 299/323] NFC: reorganize the functions in nci_request Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 301/323] perf bench: Fix two memory leaks detected with ASan Greg Kroah-Hartman
` (26 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lin Ma, Jakub Kicinski,
Krzysztof Kozlowski, Sasha Levin
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit 3e3b5dfcd16a3e254aab61bd1e8c417dd4503102 ]
There is a potential UAF between the unregistration routine and the NFC
netlink operations.
The race that cause that UAF can be shown as below:
(FREE) | (USE)
nfcmrvl_nci_unregister_dev | nfc_genl_dev_up
nci_close_device |
nci_unregister_device | nfc_get_device
nfc_unregister_device | nfc_dev_up
rfkill_destory |
device_del | rfkill_blocked
... | ...
The root cause for this race is concluded below:
1. The rfkill_blocked (USE) in nfc_dev_up is supposed to be placed after
the device_is_registered check.
2. Since the netlink operations are possible just after the device_add
in nfc_register_device, the nfc_dev_up() can happen anywhere during the
rfkill creation process, which leads to data race.
This patch reorder these actions to permit
1. Once device_del is finished, the nfc_dev_up cannot dereference the
rfkill object.
2. The rfkill_register need to be placed after the device_add of nfc_dev
because the parent device need to be created first. So this patch keeps
the order but inject device_lock to prevent the data race.
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Fixes: be055b2f89b5 ("NFC: RFKILL support")
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20211116152652.19217-1-linma@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/core.c | 32 ++++++++++++++++++--------------
1 file changed, 18 insertions(+), 14 deletions(-)
diff --git a/net/nfc/core.c b/net/nfc/core.c
index 947a470f929d6..ff646d1758d16 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -106,13 +106,13 @@ int nfc_dev_up(struct nfc_dev *dev)
device_lock(&dev->dev);
- if (dev->rfkill && rfkill_blocked(dev->rfkill)) {
- rc = -ERFKILL;
+ if (!device_is_registered(&dev->dev)) {
+ rc = -ENODEV;
goto error;
}
- if (!device_is_registered(&dev->dev)) {
- rc = -ENODEV;
+ if (dev->rfkill && rfkill_blocked(dev->rfkill)) {
+ rc = -ERFKILL;
goto error;
}
@@ -1130,11 +1130,7 @@ int nfc_register_device(struct nfc_dev *dev)
if (rc)
pr_err("Could not register llcp device\n");
- rc = nfc_genl_device_added(dev);
- if (rc)
- pr_debug("The userspace won't be notified that the device %s was added\n",
- dev_name(&dev->dev));
-
+ device_lock(&dev->dev);
dev->rfkill = rfkill_alloc(dev_name(&dev->dev), &dev->dev,
RFKILL_TYPE_NFC, &nfc_rfkill_ops, dev);
if (dev->rfkill) {
@@ -1143,6 +1139,12 @@ int nfc_register_device(struct nfc_dev *dev)
dev->rfkill = NULL;
}
}
+ device_unlock(&dev->dev);
+
+ rc = nfc_genl_device_added(dev);
+ if (rc)
+ pr_debug("The userspace won't be notified that the device %s was added\n",
+ dev_name(&dev->dev));
return 0;
}
@@ -1159,10 +1161,17 @@ void nfc_unregister_device(struct nfc_dev *dev)
pr_debug("dev_name=%s\n", dev_name(&dev->dev));
+ rc = nfc_genl_device_removed(dev);
+ if (rc)
+ pr_debug("The userspace won't be notified that the device %s "
+ "was removed\n", dev_name(&dev->dev));
+
+ device_lock(&dev->dev);
if (dev->rfkill) {
rfkill_unregister(dev->rfkill);
rfkill_destroy(dev->rfkill);
}
+ device_unlock(&dev->dev);
if (dev->ops->check_presence) {
device_lock(&dev->dev);
@@ -1172,11 +1181,6 @@ void nfc_unregister_device(struct nfc_dev *dev)
cancel_work_sync(&dev->check_pres_work);
}
- rc = nfc_genl_device_removed(dev);
- if (rc)
- pr_debug("The userspace won't be notified that the device %s "
- "was removed\n", dev_name(&dev->dev));
-
nfc_llcp_unregister_device(dev);
mutex_lock(&nfc_devlist_mutex);
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 301/323] perf bench: Fix two memory leaks detected with ASan
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 300/323] NFC: reorder the logic in nfc_{un,}register_device Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
[not found] ` <CAOz-JA4kZFoOig-aNu0yai+DE81XbNBkWUAaAYgUW4TQSCoY3g@mail.gmail.com>
2021-11-24 11:58 ` [PATCH 4.19 302/323] perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server Greg Kroah-Hartman
` (25 subsequent siblings)
326 siblings, 1 reply; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sohaib Mohamed, Ian Rogers,
Alexander Shishkin, Hitoshi Mitake, Jiri Olsa, Mark Rutland,
Namhyung Kim, Paul Russel, Peter Zijlstra, Pierre Gondois,
Arnaldo Carvalho de Melo, Sasha Levin
From: Sohaib Mohamed <sohaib.amhmd@gmail.com>
[ Upstream commit 92723ea0f11d92496687db8c9725248e9d1e5e1d ]
ASan reports memory leaks while running:
$ perf bench sched all
Fixes: e27454cc6352c422 ("perf bench: Add sched-messaging.c: Benchmark for scheduler and IPC mechanisms based on hackbench")
Signed-off-by: Sohaib Mohamed <sohaib.amhmd@gmail.com>
Acked-by: Ian Rogers <irogers@google.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Hitoshi Mitake <h.mitake@gmail.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Paul Russel <rusty@rustcorp.com.au>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Pierre Gondois <pierre.gondois@arm.com>
Link: http://lore.kernel.org/lkml/20211110022012.16620-1-sohaib.amhmd@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/bench/sched-messaging.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/perf/bench/sched-messaging.c b/tools/perf/bench/sched-messaging.c
index f9d7641ae8338..b4e13db991e9e 100644
--- a/tools/perf/bench/sched-messaging.c
+++ b/tools/perf/bench/sched-messaging.c
@@ -226,6 +226,8 @@ static unsigned int group(pthread_t *pth,
snd_ctx->out_fds[i] = fds[1];
if (!thread_mode)
close(fds[0]);
+
+ free(ctx);
}
/* Now we have all the fds, fork the senders */
@@ -242,6 +244,8 @@ static unsigned int group(pthread_t *pth,
for (i = 0; i < num_fds; i++)
close(snd_ctx->out_fds[i]);
+ free(snd_ctx);
+
/* Return number of children to reap */
return num_fds * 2;
}
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 302/323] perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 301/323] perf bench: Fix two memory leaks detected with ASan Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 303/323] perf/x86/intel/uncore: Fix IIO event constraints for " Greg Kroah-Hartman
` (24 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Antonov,
Peter Zijlstra (Intel),
Kan Liang, Sasha Levin
From: Alexander Antonov <alexander.antonov@linux.intel.com>
[ Upstream commit e324234e0aa881b7841c7c713306403e12b069ff ]
According Uncore Reference Manual: any of the CHA events may be filtered
by Thread/Core-ID by using tid modifier in CHA Filter 0 Register.
Update skx_cha_hw_config() to follow Uncore Guide.
Fixes: cd34cd97b7b4 ("perf/x86/intel/uncore: Add Skylake server uncore support")
Signed-off-by: Alexander Antonov <alexander.antonov@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Link: https://lore.kernel.org/r/20211115090334.3789-2-alexander.antonov@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/uncore_snbep.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index c06074b847fa6..f6f5641c6299a 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3416,6 +3416,9 @@ static int skx_cha_hw_config(struct intel_uncore_box *box, struct perf_event *ev
struct hw_perf_event_extra *reg1 = &event->hw.extra_reg;
struct extra_reg *er;
int idx = 0;
+ /* Any of the CHA events may be filtered by Thread/Core-ID.*/
+ if (event->hw.config & SNBEP_CBO_PMON_CTL_TID_EN)
+ idx = SKX_CHA_MSR_PMON_BOX_FILTER_TID;
for (er = skx_uncore_cha_extra_regs; er->msr; er++) {
if (er->event != (event->hw.config & er->config_mask))
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 303/323] perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 302/323] perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 304/323] tun: fix bonding active backup with arp monitoring Greg Kroah-Hartman
` (23 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Antonov,
Peter Zijlstra (Intel),
Kan Liang, Sasha Levin
From: Alexander Antonov <alexander.antonov@linux.intel.com>
[ Upstream commit 3866ae319c846a612109c008f43cba80b8c15e86 ]
According to the latest uncore document, COMP_BUF_OCCUPANCY (0xd5) event
can be collected on 2-3 counters. Update uncore IIO event constraints for
Skylake Server.
Fixes: cd34cd97b7b4 ("perf/x86/intel/uncore: Add Skylake server uncore support")
Signed-off-by: Alexander Antonov <alexander.antonov@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Link: https://lore.kernel.org/r/20211115090334.3789-3-alexander.antonov@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/uncore_snbep.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index f6f5641c6299a..2bf1170f7afdb 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3486,6 +3486,7 @@ static struct event_constraint skx_uncore_iio_constraints[] = {
UNCORE_EVENT_CONSTRAINT(0xc0, 0xc),
UNCORE_EVENT_CONSTRAINT(0xc5, 0xc),
UNCORE_EVENT_CONSTRAINT(0xd4, 0xc),
+ UNCORE_EVENT_CONSTRAINT(0xd5, 0xc),
EVENT_CONSTRAINT_END
};
--
2.33.0
^ permalink raw reply related [flat|nested] 340+ messages in thread
* [PATCH 4.19 304/323] tun: fix bonding active backup with arp monitoring
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 303/323] perf/x86/intel/uncore: Fix IIO event constraints for " Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 305/323] hexagon: export raw I/O routines for modules Greg Kroah-Hartman
` (22 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicolas Dichtel, David S. Miller
From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
commit a31d27fbed5d518734cb60956303eb15089a7634 upstream.
As stated in the bonding doc, trans_start must be set manually for drivers
using NETIF_F_LLTX:
Drivers that use NETIF_F_LLTX flag must also update
netdev_queue->trans_start. If they do not, then the ARP monitor will
immediately fail any slaves using that driver, and those slaves will stay
down.
Link: https://www.kernel.org/doc/html/v5.15/networking/bonding.html#arp-monitor-operation
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/tun.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1085,6 +1085,7 @@ static netdev_tx_t tun_net_xmit(struct s
{
struct tun_struct *tun = netdev_priv(dev);
int txq = skb->queue_mapping;
+ struct netdev_queue *queue;
struct tun_file *tfile;
int len = skb->len;
@@ -1131,6 +1132,10 @@ static netdev_tx_t tun_net_xmit(struct s
if (ptr_ring_produce(&tfile->tx_ring, skb))
goto drop;
+ /* NETIF_F_LLTX requires to do our own update of trans_start */
+ queue = netdev_get_tx_queue(dev, txq);
+ queue->trans_start = jiffies;
+
/* Notify and wake up reader process */
if (tfile->flags & TUN_FASYNC)
kill_fasync(&tfile->fasync, SIGIO, POLL_IN);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 305/323] hexagon: export raw I/O routines for modules
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 304/323] tun: fix bonding active backup with arp monitoring Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 306/323] ipc: WARN if trying to remove ipc object which is absent Greg Kroah-Hartman
` (21 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nathan Chancellor, Brian Cain,
Nick Desaulniers, Andrew Morton, Linus Torvalds
From: Nathan Chancellor <nathan@kernel.org>
commit ffb92ce826fd801acb0f4e15b75e4ddf0d189bde upstream.
Patch series "Fixes for ARCH=hexagon allmodconfig", v2.
This series fixes some issues noticed with ARCH=hexagon allmodconfig.
This patch (of 3):
When building ARCH=hexagon allmodconfig, the following errors occur:
ERROR: modpost: "__raw_readsl" [drivers/i3c/master/svc-i3c-master.ko] undefined!
ERROR: modpost: "__raw_writesl" [drivers/i3c/master/dw-i3c-master.ko] undefined!
ERROR: modpost: "__raw_readsl" [drivers/i3c/master/dw-i3c-master.ko] undefined!
ERROR: modpost: "__raw_writesl" [drivers/i3c/master/i3c-master-cdns.ko] undefined!
ERROR: modpost: "__raw_readsl" [drivers/i3c/master/i3c-master-cdns.ko] undefined!
Export these symbols so that modules can use them without any errors.
Link: https://lkml.kernel.org/r/20211115174250.1994179-1-nathan@kernel.org
Link: https://lkml.kernel.org/r/20211115174250.1994179-2-nathan@kernel.org
Fixes: 013bf24c3829 ("Hexagon: Provide basic implementation and/or stubs for I/O routines.")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Brian Cain <bcain@codeaurora.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/hexagon/lib/io.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/hexagon/lib/io.c
+++ b/arch/hexagon/lib/io.c
@@ -40,6 +40,7 @@ void __raw_readsw(const void __iomem *ad
*dst++ = *src;
}
+EXPORT_SYMBOL(__raw_readsw);
/*
* __raw_writesw - read words a short at a time
@@ -60,6 +61,7 @@ void __raw_writesw(void __iomem *addr, c
}
+EXPORT_SYMBOL(__raw_writesw);
/* Pretty sure len is pre-adjusted for the length of the access already */
void __raw_readsl(const void __iomem *addr, void *data, int len)
@@ -75,6 +77,7 @@ void __raw_readsl(const void __iomem *ad
}
+EXPORT_SYMBOL(__raw_readsl);
void __raw_writesl(void __iomem *addr, const void *data, int len)
{
@@ -89,3 +92,4 @@ void __raw_writesl(void __iomem *addr, c
}
+EXPORT_SYMBOL(__raw_writesl);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 306/323] ipc: WARN if trying to remove ipc object which is absent
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 305/323] hexagon: export raw I/O routines for modules Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 307/323] mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag Greg Kroah-Hartman
` (20 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Manfred Spraul,
Alexander Mikhalitsyn, Eric W. Biederman, Davidlohr Bueso,
Andrei Vagin, Pavel Tikhomirov, Vasily Averin, Andrew Morton,
Linus Torvalds
From: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
commit 126e8bee943e9926238c891e2df5b5573aee76bc upstream.
Patch series "shm: shm_rmid_forced feature fixes".
Some time ago I met kernel crash after CRIU restore procedure,
fortunately, it was CRIU restore, so, I had dump files and could do
restore many times and crash reproduced easily. After some
investigation I've constructed the minimal reproducer. It was found
that it's use-after-free and it happens only if sysctl
kernel.shm_rmid_forced = 1.
The key of the problem is that the exit_shm() function not handles shp's
object destroy when task->sysvshm.shm_clist contains items from
different IPC namespaces. In most cases this list will contain only
items from one IPC namespace.
How can this list contain object from different namespaces? The
exit_shm() function is designed to clean up this list always when
process leaves IPC namespace. But we made a mistake a long time ago and
did not add a exit_shm() call into the setns() syscall procedures.
The first idea was just to add this call to setns() syscall but it
obviously changes semantics of setns() syscall and that's
userspace-visible change. So, I gave up on this idea.
The first real attempt to address the issue was just to omit forced
destroy if we meet shp object not from current task IPC namespace [1].
But that was not the best idea because task->sysvshm.shm_clist was
protected by rwsem which belongs to current task IPC namespace. It
means that list corruption may occur.
Second approach is just extend exit_shm() to properly handle shp's from
different IPC namespaces [2]. This is really non-trivial thing, I've
put a lot of effort into that but not believed that it's possible to
make it fully safe, clean and clear.
Thanks to the efforts of Manfred Spraul working an elegant solution was
designed. Thanks a lot, Manfred!
Eric also suggested the way to address the issue in ("[RFC][PATCH] shm:
In shm_exit destroy all created and never attached segments") Eric's
idea was to maintain a list of shm_clists one per IPC namespace, use
lock-less lists. But there is some extra memory consumption-related
concerns.
An alternative solution which was suggested by me was implemented in
("shm: reset shm_clist on setns but omit forced shm destroy"). The idea
is pretty simple, we add exit_shm() syscall to setns() but DO NOT
destroy shm segments even if sysctl kernel.shm_rmid_forced = 1, we just
clean up the task->sysvshm.shm_clist list.
This chages semantics of setns() syscall a little bit but in comparision
to the "naive" solution when we just add exit_shm() without any special
exclusions this looks like a safer option.
[1] https://lkml.org/lkml/2021/7/6/1108
[2] https://lkml.org/lkml/2021/7/14/736
This patch (of 2):
Let's produce a warning if we trying to remove non-existing IPC object
from IPC namespace kht/idr structures.
This allows us to catch possible bugs when the ipc_rmid() function was
called with inconsistent struct ipc_ids*, struct kern_ipc_perm*
arguments.
Link: https://lkml.kernel.org/r/20211027224348.611025-1-alexander.mikhalitsyn@virtuozzo.com
Link: https://lkml.kernel.org/r/20211027224348.611025-2-alexander.mikhalitsyn@virtuozzo.com
Co-developed-by: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: Andrei Vagin <avagin@gmail.com>
Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Cc: Vasily Averin <vvs@virtuozzo.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
ipc/util.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -417,8 +417,8 @@ static int ipcget_public(struct ipc_name
static void ipc_kht_remove(struct ipc_ids *ids, struct kern_ipc_perm *ipcp)
{
if (ipcp->key != IPC_PRIVATE)
- rhashtable_remove_fast(&ids->key_ht, &ipcp->khtnode,
- ipc_kht_params);
+ WARN_ON_ONCE(rhashtable_remove_fast(&ids->key_ht, &ipcp->khtnode,
+ ipc_kht_params));
}
/**
@@ -433,7 +433,7 @@ void ipc_rmid(struct ipc_ids *ids, struc
{
int idx = ipcid_to_idx(ipcp->id);
- idr_remove(&ids->ipcs_idr, idx);
+ WARN_ON_ONCE(idr_remove(&ids->ipcs_idr, idx) != ipcp);
ipc_kht_remove(ids, ipcp);
ids->in_use--;
ipcp->deleted = true;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 307/323] mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 306/323] ipc: WARN if trying to remove ipc object which is absent Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 308/323] x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails Greg Kroah-Hartman
` (19 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rustam Kovhaev, Vlastimil Babka,
Muchun Song, Christoph Lameter, Pekka Enberg, David Rientjes,
Joonsoo Kim, Catalin Marinas, Glauber Costa, Andrew Morton,
Linus Torvalds
From: Rustam Kovhaev <rkovhaev@gmail.com>
commit 34dbc3aaf5d9e89ba6cc5e24add9458c21ab1950 upstream.
When kmemleak is enabled for SLOB, system does not boot and does not
print anything to the console. At the very early stage in the boot
process we hit infinite recursion from kmemleak_init() and eventually
kernel crashes.
kmemleak_init() specifies SLAB_NOLEAKTRACE for KMEM_CACHE(), but
kmem_cache_create_usercopy() removes it because CACHE_CREATE_MASK is not
valid for SLOB.
Let's fix CACHE_CREATE_MASK and make kmemleak work with SLOB
Link: https://lkml.kernel.org/r/20211115020850.3154366-1-rkovhaev@gmail.com
Fixes: d8843922fba4 ("slab: Ignore internal flags in cache creation")
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Muchun Song <songmuchun@bytedance.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Glauber Costa <glommer@parallels.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/slab.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -148,7 +148,7 @@ static inline slab_flags_t kmem_cache_fl
#define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE | SLAB_RECLAIM_ACCOUNT | \
SLAB_TEMPORARY | SLAB_ACCOUNT)
#else
-#define SLAB_CACHE_FLAGS (0)
+#define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE)
#endif
/* Common flags available with current configuration */
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 308/323] x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 307/323] mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 309/323] udf: Fix crash after seekdir Greg Kroah-Hartman
` (18 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vitaly Kuznetsov,
Sean Christopherson, Wei Liu
From: Sean Christopherson <seanjc@google.com>
commit daf972118c517b91f74ff1731417feb4270625a4 upstream.
Check for a valid hv_vp_index array prior to derefencing hv_vp_index when
setting Hyper-V's TSC change callback. If Hyper-V setup failed in
hyperv_init(), the kernel will still report that it's running under
Hyper-V, but will have silently disabled nearly all functionality.
BUG: kernel NULL pointer dereference, address: 0000000000000010
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP
CPU: 4 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc2+ #75
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:set_hv_tscchange_cb+0x15/0xa0
Code: <8b> 04 82 8b 15 12 17 85 01 48 c1 e0 20 48 0d ee 00 01 00 f6 c6 08
...
Call Trace:
kvm_arch_init+0x17c/0x280
kvm_init+0x31/0x330
vmx_init+0xba/0x13a
do_one_initcall+0x41/0x1c0
kernel_init_freeable+0x1f2/0x23b
kernel_init+0x16/0x120
ret_from_fork+0x22/0x30
Fixes: 93286261de1b ("x86/hyperv: Reenlightenment notifications support")
Cc: stable@vger.kernel.org
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://lore.kernel.org/r/20211104182239.1302956-2-seanjc@google.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/hyperv/hv_init.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -200,6 +200,9 @@ void set_hv_tscchange_cb(void (*cb)(void
return;
}
+ if (!hv_vp_index)
+ return;
+
hv_reenlightenment_cb = cb;
/* Make sure callback is registered before we write to MSRs */
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 309/323] udf: Fix crash after seekdir
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 308/323] x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 310/323] btrfs: fix memory ordering between normal and ordered work functions Greg Kroah-Hartman
` (17 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nathan Wilson, Jan Kara
From: Jan Kara <jack@suse.cz>
commit a48fc69fe6588b48d878d69de223b91a386a7cb4 upstream.
udf_readdir() didn't validate the directory position it should start
reading from. Thus when user uses lseek(2) on directory file descriptor
it can trick udf_readdir() into reading from a position in the middle of
directory entry which then upsets directory parsing code resulting in
errors or even possible kernel crashes. Similarly when the directory is
modified between two readdir calls, the directory position need not be
valid anymore.
Add code to validate current offset in the directory. This is actually
rather expensive for UDF as we need to read from the beginning of the
directory and parse all directory entries. This is because in UDF a
directory is just a stream of data containing directory entries and
since file names are fully under user's control we cannot depend on
detecting magic numbers and checksums in the header of directory entry
as a malicious attacker could fake them. We skip this step if we detect
that nothing changed since the last readdir call.
Reported-by: Nathan Wilson <nate@chickenbrittle.com>
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/dir.c | 32 ++++++++++++++++++++++++++++++--
fs/udf/namei.c | 3 +++
fs/udf/super.c | 2 ++
3 files changed, 35 insertions(+), 2 deletions(-)
--- a/fs/udf/dir.c
+++ b/fs/udf/dir.c
@@ -31,6 +31,7 @@
#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/bio.h>
+#include <linux/iversion.h>
#include "udf_i.h"
#include "udf_sb.h"
@@ -44,7 +45,7 @@ static int udf_readdir(struct file *file
struct fileIdentDesc *fi = NULL;
struct fileIdentDesc cfi;
udf_pblk_t block, iblock;
- loff_t nf_pos;
+ loff_t nf_pos, emit_pos = 0;
int flen;
unsigned char *fname = NULL, *copy_name = NULL;
unsigned char *nameptr;
@@ -58,6 +59,7 @@ static int udf_readdir(struct file *file
int i, num, ret = 0;
struct extent_position epos = { NULL, 0, {0, 0} };
struct super_block *sb = dir->i_sb;
+ bool pos_valid = false;
if (ctx->pos == 0) {
if (!dir_emit_dot(file, ctx))
@@ -68,6 +70,21 @@ static int udf_readdir(struct file *file
if (nf_pos >= size)
goto out;
+ /*
+ * Something changed since last readdir (either lseek was called or dir
+ * changed)? We need to verify the position correctly points at the
+ * beginning of some dir entry so that the directory parsing code does
+ * not get confused. Since UDF does not have any reliable way of
+ * identifying beginning of dir entry (names are under user control),
+ * we need to scan the directory from the beginning.
+ */
+ if (!inode_eq_iversion(dir, file->f_version)) {
+ emit_pos = nf_pos;
+ nf_pos = 0;
+ } else {
+ pos_valid = true;
+ }
+
fname = kmalloc(UDF_NAME_LEN, GFP_NOFS);
if (!fname) {
ret = -ENOMEM;
@@ -123,13 +140,21 @@ static int udf_readdir(struct file *file
while (nf_pos < size) {
struct kernel_lb_addr tloc;
+ loff_t cur_pos = nf_pos;
- ctx->pos = (nf_pos >> 2) + 1;
+ /* Update file position only if we got past the current one */
+ if (nf_pos >= emit_pos) {
+ ctx->pos = (nf_pos >> 2) + 1;
+ pos_valid = true;
+ }
fi = udf_fileident_read(dir, &nf_pos, &fibh, &cfi, &epos, &eloc,
&elen, &offset);
if (!fi)
goto out;
+ /* Still not at offset where user asked us to read from? */
+ if (cur_pos < emit_pos)
+ continue;
liu = le16_to_cpu(cfi.lengthOfImpUse);
lfi = cfi.lengthFileIdent;
@@ -187,8 +212,11 @@ static int udf_readdir(struct file *file
} /* end while */
ctx->pos = (nf_pos >> 2) + 1;
+ pos_valid = true;
out:
+ if (pos_valid)
+ file->f_version = inode_query_iversion(dir);
if (fibh.sbh != fibh.ebh)
brelse(fibh.ebh);
brelse(fibh.sbh);
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -30,6 +30,7 @@
#include <linux/sched.h>
#include <linux/crc-itu-t.h>
#include <linux/exportfs.h>
+#include <linux/iversion.h>
static inline int udf_match(int len1, const unsigned char *name1, int len2,
const unsigned char *name2)
@@ -135,6 +136,8 @@ int udf_write_fi(struct inode *inode, st
mark_buffer_dirty_inode(fibh->ebh, inode);
mark_buffer_dirty_inode(fibh->sbh, inode);
}
+ inode_inc_iversion(inode);
+
return 0;
}
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -57,6 +57,7 @@
#include <linux/crc-itu-t.h>
#include <linux/log2.h>
#include <asm/byteorder.h>
+#include <linux/iversion.h>
#include "udf_sb.h"
#include "udf_i.h"
@@ -151,6 +152,7 @@ static struct inode *udf_alloc_inode(str
init_rwsem(&ei->i_data_sem);
ei->cached_extent.lstart = -1;
spin_lock_init(&ei->i_extent_cache_lock);
+ inode_set_iversion(&ei->vfs_inode, 1);
return &ei->vfs_inode;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 310/323] btrfs: fix memory ordering between normal and ordered work functions
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 309/323] udf: Fix crash after seekdir Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 311/323] parisc/sticon: fix reverse colors Greg Kroah-Hartman
` (16 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Murphy, Josef Bacik,
Chris Murphy, Nikolay Borisov, David Sterba
From: Nikolay Borisov <nborisov@suse.com>
commit 45da9c1767ac31857df572f0a909fbe88fd5a7e9 upstream.
Ordered work functions aren't guaranteed to be handled by the same thread
which executed the normal work functions. The only way execution between
normal/ordered functions is synchronized is via the WORK_DONE_BIT,
unfortunately the used bitops don't guarantee any ordering whatsoever.
This manifested as seemingly inexplicable crashes on ARM64, where
async_chunk::inode is seen as non-null in async_cow_submit which causes
submit_compressed_extents to be called and crash occurs because
async_chunk::inode suddenly became NULL. The call trace was similar to:
pc : submit_compressed_extents+0x38/0x3d0
lr : async_cow_submit+0x50/0xd0
sp : ffff800015d4bc20
<registers omitted for brevity>
Call trace:
submit_compressed_extents+0x38/0x3d0
async_cow_submit+0x50/0xd0
run_ordered_work+0xc8/0x280
btrfs_work_helper+0x98/0x250
process_one_work+0x1f0/0x4ac
worker_thread+0x188/0x504
kthread+0x110/0x114
ret_from_fork+0x10/0x18
Fix this by adding respective barrier calls which ensure that all
accesses preceding setting of WORK_DONE_BIT are strictly ordered before
setting the flag. At the same time add a read barrier after reading of
WORK_DONE_BIT in run_ordered_work which ensures all subsequent loads
would be strictly ordered after reading the bit. This in turn ensures
are all accesses before WORK_DONE_BIT are going to be strictly ordered
before any access that can occur in ordered_func.
Reported-by: Chris Murphy <lists@colorremedies.com>
Fixes: 08a9ff326418 ("btrfs: Added btrfs_workqueue_struct implemented ordered execution based on kernel workqueue")
CC: stable@vger.kernel.org # 4.4+
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2011928
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Tested-by: Chris Murphy <chris@colorremedies.com>
Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/async-thread.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -270,6 +270,13 @@ static void run_ordered_work(struct __bt
ordered_list);
if (!test_bit(WORK_DONE_BIT, &work->flags))
break;
+ /*
+ * Orders all subsequent loads after reading WORK_DONE_BIT,
+ * paired with the smp_mb__before_atomic in btrfs_work_helper
+ * this guarantees that the ordered function will see all
+ * updates from ordinary work function.
+ */
+ smp_rmb();
/*
* we are going to call the ordered done function, but
@@ -355,6 +362,13 @@ static void normal_work_helper(struct bt
thresh_exec_hook(wq);
work->func(work);
if (need_order) {
+ /*
+ * Ensures all memory accesses done in the work function are
+ * ordered before setting the WORK_DONE_BIT. Ensuring the thread
+ * which is going to executed the ordered work sees them.
+ * Pairs with the smp_rmb in run_ordered_work.
+ */
+ smp_mb__before_atomic();
set_bit(WORK_DONE_BIT, &work->flags);
run_ordered_work(wq, work);
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 311/323] parisc/sticon: fix reverse colors
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 310/323] btrfs: fix memory ordering between normal and ordered work functions Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 312/323] cfg80211: call cfg80211_stop_ap when switch from P2P_GO type Greg Kroah-Hartman
` (15 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sven Schnelle, Helge Deller
From: Sven Schnelle <svens@stackframe.org>
commit bec05f33ebc1006899c6d3e59a00c58881fe7626 upstream.
sticon_build_attr() checked the reverse argument and flipped
background and foreground color, but returned the non-reverse
value afterwards. Fix this and also add two local variables
for foreground and background color to make the code easier
to read.
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/console/sticon.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/video/console/sticon.c
+++ b/drivers/video/console/sticon.c
@@ -291,13 +291,13 @@ static unsigned long sticon_getxy(struct
static u8 sticon_build_attr(struct vc_data *conp, u8 color, u8 intens,
u8 blink, u8 underline, u8 reverse, u8 italic)
{
- u8 attr = ((color & 0x70) >> 1) | ((color & 7));
+ u8 fg = color & 7;
+ u8 bg = (color & 0x70) >> 4;
- if (reverse) {
- color = ((color >> 3) & 0x7) | ((color & 0x7) << 3);
- }
-
- return attr;
+ if (reverse)
+ return (fg << 3) | bg;
+ else
+ return (bg << 3) | fg;
}
static void sticon_invert_region(struct vc_data *conp, u16 *p, int count)
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 312/323] cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 311/323] parisc/sticon: fix reverse colors Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 313/323] drm/udl: fix control-message timeout Greg Kroah-Hartman
` (14 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nguyen Dinh Phi,
syzbot+bbf402b783eeb6d908db, Johannes Berg
From: Nguyen Dinh Phi <phind.uet@gmail.com>
commit 563fbefed46ae4c1f70cffb8eb54c02df480b2c2 upstream.
If the userspace tools switch from NL80211_IFTYPE_P2P_GO to
NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it
does not call the cleanup cfg80211_stop_ap(), this leads to the
initialization of in-use data. For example, this path re-init the
sdata->assigned_chanctx_list while it is still an element of
assigned_vifs list, and makes that linked list corrupt.
Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
Reported-by: syzbot+bbf402b783eeb6d908db@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20211027173722.777287-1-phind.uet@gmail.com
Cc: stable@vger.kernel.org
Fixes: ac800140c20e ("cfg80211: .stop_ap when interface is going down")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/util.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -950,6 +950,7 @@ int cfg80211_change_iface(struct cfg8021
switch (otype) {
case NL80211_IFTYPE_AP:
+ case NL80211_IFTYPE_P2P_GO:
cfg80211_stop_ap(rdev, dev, true);
break;
case NL80211_IFTYPE_ADHOC:
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 313/323] drm/udl: fix control-message timeout
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 312/323] cfg80211: call cfg80211_stop_ap when switch from P2P_GO type Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 314/323] drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors Greg Kroah-Hartman
` (13 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, Daniel Vetter
From: Johan Hovold <johan@kernel.org>
commit 5591c8f79db1729d9c5ac7f5b4d3a5c26e262d93 upstream.
USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.
Fixes: 5320918b9a87 ("drm/udl: initial UDL driver (v4)")
Cc: stable@vger.kernel.org # 3.4
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20211025115353.5089-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/udl/udl_connector.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -32,7 +32,7 @@ static bool udl_get_edid_block(struct ud
ret = usb_control_msg(udl->udev,
usb_rcvctrlpipe(udl->udev, 0),
(0x02), (0x80 | (0x02 << 5)), bval,
- 0xA1, read_buff, 2, HZ);
+ 0xA1, read_buff, 2, 1000);
if (ret < 1) {
DRM_ERROR("Read EDID byte %d failed err %x\n", i, ret);
kfree(read_buff);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 314/323] drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 313/323] drm/udl: fix control-message timeout Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 315/323] perf/core: Avoid put_page() when GUP fails Greg Kroah-Hartman
` (12 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, hongao, Alex Deucher
From: hongao <hongao@uniontech.com>
commit bf552083916a7f8800477b5986940d1c9a31b953 upstream.
amdgpu_connector_vga_get_modes missed function amdgpu_get_native_mode
which assign amdgpu_encoder->native_mode with *preferred_mode result in
amdgpu_encoder->native_mode.clock always be 0. That will cause
amdgpu_connector_set_property returned early on:
if ((rmx_type != DRM_MODE_SCALE_NONE) &&
(amdgpu_encoder->native_mode.clock == 0))
when we try to set scaling mode Full/Full aspect/Center.
Add the missing function to amdgpu_connector_vga_get_mode can fix this.
It also works on dvi connectors because
amdgpu_connector_dvi_helper_funcs.get_mode use the same method.
Signed-off-by: hongao <hongao@uniontech.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -828,6 +828,7 @@ static int amdgpu_connector_vga_get_mode
amdgpu_connector_get_edid(connector);
ret = amdgpu_connector_ddc_get_modes(connector);
+ amdgpu_get_native_mode(connector);
return ret;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 315/323] perf/core: Avoid put_page() when GUP fails
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 314/323] drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 316/323] batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN Greg Kroah-Hartman
` (11 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Greg Thelen, Peter Zijlstra (Intel)
From: Greg Thelen <gthelen@google.com>
commit 4716023a8f6a0f4a28047f14dd7ebdc319606b84 upstream.
PEBS PERF_SAMPLE_PHYS_ADDR events use perf_virt_to_phys() to convert PMU
sampled virtual addresses to physical using get_user_page_fast_only()
and page_to_phys().
Some get_user_page_fast_only() error cases return false, indicating no
page reference, but still initialize the output page pointer with an
unreferenced page. In these error cases perf_virt_to_phys() calls
put_page(). This causes page reference count underflow, which can lead
to unintentional page sharing.
Fix perf_virt_to_phys() to only put_page() if get_user_page_fast_only()
returns a referenced page.
Fixes: fc7ce9c74c3ad ("perf/core, x86: Add PERF_SAMPLE_PHYS_ADDR")
Signed-off-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20211111021814.757086-1-gthelen@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/events/core.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6424,7 +6424,6 @@ void perf_output_sample(struct perf_outp
static u64 perf_virt_to_phys(u64 virt)
{
u64 phys_addr = 0;
- struct page *p = NULL;
if (!virt)
return 0;
@@ -6443,14 +6442,15 @@ static u64 perf_virt_to_phys(u64 virt)
* If failed, leave phys_addr as 0.
*/
if (current->mm != NULL) {
+ struct page *p;
+
pagefault_disable();
- if (__get_user_pages_fast(virt, 1, 0, &p) == 1)
+ if (__get_user_pages_fast(virt, 1, 0, &p) == 1) {
phys_addr = page_to_phys(p) + virt % PAGE_SIZE;
+ put_page(p);
+ }
pagefault_enable();
}
-
- if (p)
- put_page(p);
}
return phys_addr;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 316/323] batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 315/323] perf/core: Avoid put_page() when GUP fails Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 317/323] batman-adv: Consider fragmentation for needed_headroom Greg Kroah-Hartman
` (10 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, Linus L�ssing, Simon Wunderlich,
Sven Eckelmann
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 5300 bytes --]
From: Linus Lüssing <linus.luessing@c0d3.blue>
commit 3236d215ad38a3f5372e65cd1e0a52cf93d3c6a2 upstream.
Scenario:
* Multicast frame send from a BLA backbone (multiple nodes with
their bat0 bridged together, with BLA enabled)
Issue:
* BLA backbone nodes receive the frame multiple times on bat0
For multicast frames received via batman-adv broadcast packets the
originator of the broadcast packet is checked before decapsulating and
forwarding the frame to bat0 (batadv_bla_is_backbone_gw()->
batadv_recv_bcast_packet()). If it came from a node which shares the
same BLA backbone with us then it is not forwarded to bat0 to avoid a
loop.
When sending a multicast frame in a non-4-address batman-adv unicast
packet we are currently missing this check - and cannot do so because
the batman-adv unicast packet has no originator address field.
However, we can simply fix this on the sender side by only sending the
multicast frame via unicasts to interested nodes which do not share the
same BLA backbone with us. This also nicely avoids some unnecessary
transmissions on mesh side.
Note that no infinite loop was observed, probably because of dropping
via batadv_interface_tx()->batadv_bla_tx(). However the duplicates still
utterly confuse switches/bridges, ICMPv6 duplicate address detection and
neighbor discovery and therefore leads to long delays before being able
to establish TCP connections, for instance. And it also leads to the Linux
bridge printing messages like:
"br-lan: received packet on eth1 with own address as source address ..."
Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets")
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
[ bp: 4.19 backport: drop usage in non-existing batadv_mcast_forw*, correct
fixes line ]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/multicast.c | 31 +++++++++++++++++++++++++++++++
net/batman-adv/multicast.h | 15 +++++++++++++++
net/batman-adv/soft-interface.c | 5 ++---
3 files changed, 48 insertions(+), 3 deletions(-)
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -62,10 +62,12 @@
#include <uapi/linux/batadv_packet.h>
#include <uapi/linux/batman_adv.h>
+#include "bridge_loop_avoidance.h"
#include "hard-interface.h"
#include "hash.h"
#include "log.h"
#include "netlink.h"
+#include "send.h"
#include "soft-interface.h"
#include "translation-table.h"
#include "tvlv.h"
@@ -1025,6 +1027,35 @@ batadv_mcast_forw_mode(struct batadv_pri
}
/**
+ * batadv_mcast_forw_send_orig() - send a multicast packet to an originator
+ * @bat_priv: the bat priv with all the soft interface information
+ * @skb: the multicast packet to send
+ * @vid: the vlan identifier
+ * @orig_node: the originator to send the packet to
+ *
+ * Return: NET_XMIT_DROP in case of error or NET_XMIT_SUCCESS otherwise.
+ */
+int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv,
+ struct sk_buff *skb,
+ unsigned short vid,
+ struct batadv_orig_node *orig_node)
+{
+ /* Avoid sending multicast-in-unicast packets to other BLA
+ * gateways - they already got the frame from the LAN side
+ * we share with them.
+ * TODO: Refactor to take BLA into account earlier, to avoid
+ * reducing the mcast_fanout count.
+ */
+ if (batadv_bla_is_backbone_gw_orig(bat_priv, orig_node->orig, vid)) {
+ dev_kfree_skb(skb);
+ return NET_XMIT_SUCCESS;
+ }
+
+ return batadv_send_skb_unicast(bat_priv, skb, BATADV_UNICAST, 0,
+ orig_node, vid);
+}
+
+/**
* batadv_mcast_want_unsnoop_update() - update unsnoop counter and list
* @bat_priv: the bat priv with all the soft interface information
* @orig: the orig_node which multicast state might have changed of
--- a/net/batman-adv/multicast.h
+++ b/net/batman-adv/multicast.h
@@ -51,6 +51,11 @@ enum batadv_forw_mode
batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
struct batadv_orig_node **mcast_single_orig);
+int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv,
+ struct sk_buff *skb,
+ unsigned short vid,
+ struct batadv_orig_node *orig_node);
+
void batadv_mcast_init(struct batadv_priv *bat_priv);
int batadv_mcast_flags_seq_print_text(struct seq_file *seq, void *offset);
@@ -79,6 +84,16 @@ static inline int batadv_mcast_init(stru
}
static inline int
+batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv,
+ struct sk_buff *skb,
+ unsigned short vid,
+ struct batadv_orig_node *orig_node)
+{
+ kfree_skb(skb);
+ return NET_XMIT_DROP;
+}
+
+static inline int
batadv_mcast_mesh_info_put(struct sk_buff *msg, struct batadv_priv *bat_priv)
{
return 0;
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -367,9 +367,8 @@ send:
goto dropped;
ret = batadv_send_skb_via_gw(bat_priv, skb, vid);
} else if (mcast_single_orig) {
- ret = batadv_send_skb_unicast(bat_priv, skb,
- BATADV_UNICAST, 0,
- mcast_single_orig, vid);
+ ret = batadv_mcast_forw_send_orig(bat_priv, skb, vid,
+ mcast_single_orig);
} else {
if (batadv_dat_snoop_outgoing_arp_request(bat_priv,
skb))
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 317/323] batman-adv: Consider fragmentation for needed_headroom
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 316/323] batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 318/323] batman-adv: Reserve needed_*room for fragments Greg Kroah-Hartman
` (9 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, Linus L�ssing, Sven Eckelmann,
Simon Wunderlich
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 1291 bytes --]
From: Sven Eckelmann <sven@narfation.org>
commit 4ca23e2c2074465bff55ea14221175fecdf63c5f upstream.
If a batman-adv packets has to be fragmented, then the original batman-adv
packet header is not stripped away. Instead, only a new header is added in
front of the packet after it was split.
This size must be considered to avoid cost intensive reallocations during
the transmission through the various device layers.
Fixes: 7bca68c7844b ("batman-adv: Add lower layer needed_(head|tail)room to own ones")
Reported-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/hard-interface.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -565,6 +565,9 @@ static void batadv_hardif_recalc_extra_s
needed_headroom = lower_headroom + (lower_header_len - ETH_HLEN);
needed_headroom += batadv_max_header_len();
+ /* fragmentation headers don't strip the unicast/... header */
+ needed_headroom += sizeof(struct batadv_frag_packet);
+
soft_iface->needed_headroom = needed_headroom;
soft_iface->needed_tailroom = lower_tailroom;
}
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 318/323] batman-adv: Reserve needed_*room for fragments
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 317/323] batman-adv: Consider fragmentation for needed_headroom Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 319/323] batman-adv: Dont always reallocate the fragmentation skb head Greg Kroah-Hartman
` (8 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
commit c5cbfc87558168ef4c3c27ce36eba6b83391db19 upstream.
The batadv net_device is trying to propagate the needed_headroom and
needed_tailroom from the lower devices. This is needed to avoid cost
intensive reallocations using pskb_expand_head during the transmission.
But the fragmentation code split the skb's without adding extra room at the
end/beginning of the various fragments. This reduced the performance of
transmissions over complex scenarios (batadv on vxlan on wireguard) because
the lower devices had to perform the reallocations at least once.
Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
[ bp: 4.19 backported: adjust context. ]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/fragmentation.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -403,6 +403,7 @@ out:
/**
* batadv_frag_create() - create a fragment from skb
+ * @net_dev: outgoing device for fragment
* @skb: skb to create fragment from
* @frag_head: header to use in new fragment
* @fragment_size: size of new fragment
@@ -413,22 +414,25 @@ out:
*
* Return: the new fragment, NULL on error.
*/
-static struct sk_buff *batadv_frag_create(struct sk_buff *skb,
+static struct sk_buff *batadv_frag_create(struct net_device *net_dev,
+ struct sk_buff *skb,
struct batadv_frag_packet *frag_head,
unsigned int fragment_size)
{
+ unsigned int ll_reserved = LL_RESERVED_SPACE(net_dev);
+ unsigned int tailroom = net_dev->needed_tailroom;
struct sk_buff *skb_fragment;
unsigned int header_size = sizeof(*frag_head);
unsigned int mtu = fragment_size + header_size;
- skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN);
+ skb_fragment = dev_alloc_skb(ll_reserved + mtu + tailroom);
if (!skb_fragment)
goto err;
skb_fragment->priority = skb->priority;
/* Eat the last mtu-bytes of the skb */
- skb_reserve(skb_fragment, header_size + ETH_HLEN);
+ skb_reserve(skb_fragment, ll_reserved + header_size);
skb_split(skb, skb_fragment, skb->len - fragment_size);
/* Add the header */
@@ -451,11 +455,12 @@ int batadv_frag_send_packet(struct sk_bu
struct batadv_orig_node *orig_node,
struct batadv_neigh_node *neigh_node)
{
+ struct net_device *net_dev = neigh_node->if_incoming->net_dev;
struct batadv_priv *bat_priv;
struct batadv_hard_iface *primary_if = NULL;
struct batadv_frag_packet frag_header;
struct sk_buff *skb_fragment;
- unsigned int mtu = neigh_node->if_incoming->net_dev->mtu;
+ unsigned int mtu = net_dev->mtu;
unsigned int header_size = sizeof(frag_header);
unsigned int max_fragment_size, num_fragments;
int ret;
@@ -515,7 +520,7 @@ int batadv_frag_send_packet(struct sk_bu
goto put_primary_if;
}
- skb_fragment = batadv_frag_create(skb, &frag_header,
+ skb_fragment = batadv_frag_create(net_dev, skb, &frag_header,
max_fragment_size);
if (!skb_fragment) {
ret = -ENOMEM;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 319/323] batman-adv: Dont always reallocate the fragmentation skb head
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 318/323] batman-adv: Reserve needed_*room for fragments Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 320/323] RDMA/netlink: Add __maybe_unused to static inline in C file Greg Kroah-Hartman
` (7 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
commit 992b03b88e36254e26e9a4977ab948683e21bd9f upstream.
When a packet is fragmented by batman-adv, the original batman-adv header
is not modified. Only a new fragmentation is inserted between the original
one and the ethernet header. The code must therefore make sure that it has
a writable region of this size in the skbuff head.
But it is not useful to always reallocate the skbuff by this size even when
there would be more than enough headroom still in the skb. The reallocation
is just to costly during in this codepath.
Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/fragmentation.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -539,13 +539,14 @@ int batadv_frag_send_packet(struct sk_bu
frag_header.no++;
}
- /* Make room for the fragment header. */
- if (batadv_skb_head_push(skb, header_size) < 0 ||
- pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) {
- ret = -ENOMEM;
+ /* make sure that there is at least enough head for the fragmentation
+ * and ethernet headers
+ */
+ ret = skb_cow_head(skb, ETH_HLEN + header_size);
+ if (ret < 0)
goto put_primary_if;
- }
+ skb_push(skb, header_size);
memcpy(skb->data, &frag_header, header_size);
/* Send the last fragment */
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 320/323] RDMA/netlink: Add __maybe_unused to static inline in C file
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 319/323] batman-adv: Dont always reallocate the fragmentation skb head Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 321/323] ASoC: DAPM: Cover regression by kctl change notification fix Greg Kroah-Hartman
` (6 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Leon Romanovsky,
Jason Gunthorpe
From: Leon Romanovsky <leonro@nvidia.com>
commit 83dde7498fefeb920b1def317421262317d178e5 upstream.
Like other commits in the tree add __maybe_unused to a static inline in a
C file because some clang compilers will complain about unused code:
>> drivers/infiniband/core/nldev.c:2543:1: warning: unused function '__chk_RDMA_NL_NLDEV'
MODULE_ALIAS_RDMA_NETLINK(RDMA_NL_NLDEV, 5);
^
Fixes: e3bf14bdc17a ("rdma: Autoload netlink client modules")
Link: https://lore.kernel.org/r/4a8101919b765e01d7fde6f27fd572c958deeb4a.1636267207.git.leonro@nvidia.com
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/rdma/rdma_netlink.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/rdma/rdma_netlink.h
+++ b/include/rdma/rdma_netlink.h
@@ -24,7 +24,7 @@ enum rdma_nl_flags {
* constant as well and the compiler checks they are the same.
*/
#define MODULE_ALIAS_RDMA_NETLINK(_index, _val) \
- static inline void __chk_##_index(void) \
+ static inline void __maybe_unused __chk_##_index(void) \
{ \
BUILD_BUG_ON(_index != _val); \
} \
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 321/323] ASoC: DAPM: Cover regression by kctl change notification fix
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 320/323] RDMA/netlink: Add __maybe_unused to static inline in C file Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 322/323] usb: max-3421: Use driver data instead of maintaining a list of bound devices Greg Kroah-Hartman
` (5 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yu-Hsuan Hsu, Takashi Iwai, Mark Brown
From: Takashi Iwai <tiwai@suse.de>
commit 827b0913a9d9d07a0c3e559dbb20ca4d6d285a54 upstream.
The recent fix for DAPM to correct the kctl change notification by the
commit 5af82c81b2c4 ("ASoC: DAPM: Fix missing kctl change
notifications") caused other regressions since it changed the behavior
of snd_soc_dapm_set_pin() that is called from several API functions.
Formerly it returned always 0 for success, but now it returns 0 or 1.
This patch addresses it, restoring the old behavior of
snd_soc_dapm_set_pin() while keeping the fix in
snd_soc_dapm_put_pin_switch().
Fixes: 5af82c81b2c4 ("ASoC: DAPM: Fix missing kctl change notifications")
Reported-by: Yu-Hsuan Hsu <yuhsuan@chromium.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20211105090925.20575-1-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/soc-dapm.c | 29 +++++++++++++++++++++++------
1 file changed, 23 insertions(+), 6 deletions(-)
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2511,8 +2511,13 @@ static struct snd_soc_dapm_widget *dapm_
return NULL;
}
-static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
- const char *pin, int status)
+/*
+ * set the DAPM pin status:
+ * returns 1 when the value has been updated, 0 when unchanged, or a negative
+ * error code; called from kcontrol put callback
+ */
+static int __snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
+ const char *pin, int status)
{
struct snd_soc_dapm_widget *w = dapm_find_widget(dapm, pin, true);
int ret = 0;
@@ -2538,6 +2543,18 @@ static int snd_soc_dapm_set_pin(struct s
return ret;
}
+/*
+ * similar as __snd_soc_dapm_set_pin(), but returns 0 when successful;
+ * called from several API functions below
+ */
+static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
+ const char *pin, int status)
+{
+ int ret = __snd_soc_dapm_set_pin(dapm, pin, status);
+
+ return ret < 0 ? ret : 0;
+}
+
/**
* snd_soc_dapm_sync_unlocked - scan and power dapm paths
* @dapm: DAPM context
@@ -3465,10 +3482,10 @@ int snd_soc_dapm_put_pin_switch(struct s
const char *pin = (const char *)kcontrol->private_value;
int ret;
- if (ucontrol->value.integer.value[0])
- ret = snd_soc_dapm_enable_pin(&card->dapm, pin);
- else
- ret = snd_soc_dapm_disable_pin(&card->dapm, pin);
+ mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
+ ret = __snd_soc_dapm_set_pin(&card->dapm, pin,
+ !!ucontrol->value.integer.value[0]);
+ mutex_unlock(&card->dapm_mutex);
snd_soc_dapm_sync(&card->dapm);
return ret;
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 322/323] usb: max-3421: Use driver data instead of maintaining a list of bound devices
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 321/323] ASoC: DAPM: Cover regression by kctl change notification fix Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 323/323] hugetlbfs: flush TLBs correctly after huge_pmd_unshare Greg Kroah-Hartman
` (4 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
commit fc153aba3ef371d0d76eb88230ed4e0dee5b38f2 upstream.
Instead of maintaining a single-linked list of devices that must be
searched linearly in .remove() just use spi_set_drvdata() to remember the
link between the spi device and the driver struct. Then the global list
and the next member can be dropped.
This simplifies the driver, reduces the memory footprint and the time to
search the list. Also it makes obvious that there is always a corresponding
driver struct for a given device in .remove(), so the error path for
!max3421_hcd can be dropped, too.
As a side effect this fixes a data inconsistency when .probe() races with
itself for a second max3421 device in manipulating max3421_hcd_list. A
similar race is fixed in .remove(), too.
Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20211018204028.2914597-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/max3421-hcd.c | 25 +++++--------------------
1 file changed, 5 insertions(+), 20 deletions(-)
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -125,8 +125,6 @@ struct max3421_hcd {
struct task_struct *spi_thread;
- struct max3421_hcd *next;
-
enum max3421_rh_state rh_state;
/* lower 16 bits contain port status, upper 16 bits the change mask: */
u32 port_status;
@@ -174,8 +172,6 @@ struct max3421_ep {
u8 retransmit; /* packet needs retransmission */
};
-static struct max3421_hcd *max3421_hcd_list;
-
#define MAX3421_FIFO_SIZE 64
#define MAX3421_SPI_DIR_RD 0 /* read register from MAX3421 */
@@ -1899,9 +1895,8 @@ max3421_probe(struct spi_device *spi)
}
set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
max3421_hcd = hcd_to_max3421(hcd);
- max3421_hcd->next = max3421_hcd_list;
- max3421_hcd_list = max3421_hcd;
INIT_LIST_HEAD(&max3421_hcd->ep_list);
+ spi_set_drvdata(spi, max3421_hcd);
max3421_hcd->tx = kmalloc(sizeof(*max3421_hcd->tx), GFP_KERNEL);
if (!max3421_hcd->tx)
@@ -1951,28 +1946,18 @@ error:
static int
max3421_remove(struct spi_device *spi)
{
- struct max3421_hcd *max3421_hcd = NULL, **prev;
- struct usb_hcd *hcd = NULL;
+ struct max3421_hcd *max3421_hcd;
+ struct usb_hcd *hcd;
unsigned long flags;
- for (prev = &max3421_hcd_list; *prev; prev = &(*prev)->next) {
- max3421_hcd = *prev;
- hcd = max3421_to_hcd(max3421_hcd);
- if (hcd->self.controller == &spi->dev)
- break;
- }
- if (!max3421_hcd) {
- dev_err(&spi->dev, "no MAX3421 HCD found for SPI device %p\n",
- spi);
- return -ENODEV;
- }
+ max3421_hcd = spi_get_drvdata(spi);
+ hcd = max3421_to_hcd(max3421_hcd);
usb_remove_hcd(hcd);
spin_lock_irqsave(&max3421_hcd->lock, flags);
kthread_stop(max3421_hcd->spi_thread);
- *prev = max3421_hcd->next;
spin_unlock_irqrestore(&max3421_hcd->lock, flags);
^ permalink raw reply [flat|nested] 340+ messages in thread
* [PATCH 4.19 323/323] hugetlbfs: flush TLBs correctly after huge_pmd_unshare
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 322/323] usb: max-3421: Use driver data instead of maintaining a list of bound devices Greg Kroah-Hartman
@ 2021-11-24 11:58 ` Greg Kroah-Hartman
2021-11-24 15:33 ` [PATCH 4.19 000/323] 4.19.218-rc1 review Naresh Kamboju
` (3 subsequent siblings)
326 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 11:58 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nadav Amit, Mike Kravetz,
Aneesh Kumar K.V, KAMEZAWA Hiroyuki, Andrew Morton,
Linus Torvalds
From: Nadav Amit <namit@vmware.com>
commit a4a118f2eead1d6c49e00765de89878288d4b890 upstream.
When __unmap_hugepage_range() calls to huge_pmd_unshare() succeed, a TLB
flush is missing. This TLB flush must be performed before releasing the
i_mmap_rwsem, in order to prevent an unshared PMDs page from being
released and reused before the TLB flush took place.
Arguably, a comprehensive solution would use mmu_gather interface to
batch the TLB flushes and the PMDs page release, however it is not an
easy solution: (1) try_to_unmap_one() and try_to_migrate_one() also call
huge_pmd_unshare() and they cannot use the mmu_gather interface; and (2)
deferring the release of the page reference for the PMDs page until
after i_mmap_rwsem is dropeed can confuse huge_pmd_unshare() into
thinking PMDs are shared when they are not.
Fix __unmap_hugepage_range() by adding the missing TLB flush, and
forcing a flush when unshare is successful.
Fixes: 24669e58477e ("hugetlb: use mmu_gather instead of a temporary linked list for accumulating pages)" # 3.6
Signed-off-by: Nadav Amit <namit@vmware.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/asm-generic/tlb.h | 6 ++++++
mm/hugetlb.c | 23 +++++++++++++++++++----
2 files changed, 25 insertions(+), 4 deletions(-)
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -205,6 +205,12 @@ static inline void tlb_remove_check_page
#define tlb_end_vma __tlb_end_vma
#endif
+static inline void tlb_flush_pmd_range(struct mmu_gather *tlb,
+ unsigned long address, unsigned long size)
+{
+ __tlb_adjust_range(tlb, address, size);
+}
+
#ifndef __tlb_remove_tlb_entry
#define __tlb_remove_tlb_entry(tlb, ptep, address) do { } while (0)
#endif
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3425,6 +3425,7 @@ void __unmap_hugepage_range(struct mmu_g
unsigned long sz = huge_page_size(h);
unsigned long mmun_start = start; /* For mmu_notifiers */
unsigned long mmun_end = end; /* For mmu_notifiers */
+ bool force_flush = false;
WARN_ON(!is_vm_hugetlb_page(vma));
BUG_ON(start & ~huge_page_mask(h));
@@ -3451,10 +3452,8 @@ void __unmap_hugepage_range(struct mmu_g
ptl = huge_pte_lock(h, mm, ptep);
if (huge_pmd_unshare(mm, &address, ptep)) {
spin_unlock(ptl);
- /*
- * We just unmapped a page of PMDs by clearing a PUD.
- * The caller's TLB flush range should cover this area.
- */
+ tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE);
+ force_flush = true;
continue;
}
@@ -3511,6 +3510,22 @@ void __unmap_hugepage_range(struct mmu_g
}
mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
tlb_end_vma(tlb, vma);
+
+ /*
+ * If we unshared PMDs, the TLB flush was not recorded in mmu_gather. We
+ * could defer the flush until now, since by holding i_mmap_rwsem we
+ * guaranteed that the last refernece would not be dropped. But we must
+ * do the flushing before we return, as otherwise i_mmap_rwsem will be
+ * dropped and the last reference to the shared PMDs page might be
+ * dropped as well.
+ *
+ * In theory we could defer the freeing of the PMD pages as well, but
+ * huge_pmd_unshare() relies on the exact page_count for the PMD page to
+ * detect sharing, so we cannot defer the release of the page either.
+ * Instead, do flush now.
+ */
+ if (force_flush)
+ tlb_flush_mmu_tlbonly(tlb);
}
void __unmap_hugepage_range_final(struct mmu_gather *tlb,
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 301/323] perf bench: Fix two memory leaks detected with ASan
[not found] ` <CAOz-JA4kZFoOig-aNu0yai+DE81XbNBkWUAaAYgUW4TQSCoY3g@mail.gmail.com>
@ 2021-11-24 13:13 ` Greg Kroah-Hartman
0 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-24 13:13 UTC (permalink / raw)
To: Sohaib Mohamed
Cc: open list, stable, Ian Rogers, Alexander Shishkin,
Hitoshi Mitake, Jiri Olsa, Mark Rutland, Namhyung Kim,
Paul Russel, Peter Zijlstra, Pierre Gondois,
Arnaldo Carvalho de Melo, Sasha Levin
On Wed, Nov 24, 2021 at 02:56:17PM +0200, Sohaib Mohamed wrote:
> Hello, Greg
>
> On Wed, Nov 24, 2021, 2:45 PM Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> wrote:
>
> > From: Sohaib Mohamed <sohaib.amhmd@gmail.com>
> >
> > [ Upstream commit 92723ea0f11d92496687db8c9725248e9d1e5e1d ]
> >
>
> Please, remove this patch from the queue.
> This patch has a problem and should be reverted.
Dropped from all branches now, thanks.
greg k-h
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 000/323] 4.19.218-rc1 review
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2021-11-24 11:58 ` [PATCH 4.19 323/323] hugetlbfs: flush TLBs correctly after huge_pmd_unshare Greg Kroah-Hartman
@ 2021-11-24 15:33 ` Naresh Kamboju
2021-11-25 11:13 ` Greg Kroah-Hartman
2021-11-25 1:27 ` Samuel Zou
` (2 subsequent siblings)
326 siblings, 1 reply; 340+ messages in thread
From: Naresh Kamboju @ 2021-11-24 15:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, shuah, f.fainelli, patches, lkft-triage, jonathanh,
stable, pavel, akpm, torvalds, linux, Nadav Amit, Mike Kravetz,
Aneesh Kumar K.V, KAMEZAWA Hiroyuki
On Wed, 24 Nov 2021 at 18:07, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 4.19.218 release.
> There are 323 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 26 Nov 2021 11:56:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.218-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Regression found on s390 gcc-11 builds with defconfig
Here it is reported,
https://lore.kernel.org/stable/CA+G9fYv+SjDwfvP=Zgf-gr2RngkrzHO_w6OQzH7wqzU-dOW9+g@mail.gmail.com/
mm/hugetlb.c: In function '__unmap_hugepage_range':
mm/hugetlb.c:3455:25: error: implicit declaration of function
'tlb_flush_pmd_range'; did you mean 'tlb_flush_mmu_free'?
[-Werror=implicit-function-declaration]
3455 | tlb_flush_pmd_range(tlb, address &
PUD_MASK, PUD_SIZE);
| ^~~~~~~~~~~~~~~~~~~
| tlb_flush_mmu_free
cc1: some warnings being treated as errors
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 000/323] 4.19.218-rc1 review
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2021-11-24 15:33 ` [PATCH 4.19 000/323] 4.19.218-rc1 review Naresh Kamboju
@ 2021-11-25 1:27 ` Samuel Zou
2021-11-25 1:40 ` Guenter Roeck
2021-11-25 3:45 ` Naresh Kamboju
326 siblings, 0 replies; 340+ messages in thread
From: Samuel Zou @ 2021-11-25 1:27 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, stable
On 2021/11/24 19:53, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.218 release.
> There are 323 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 26 Nov 2021 11:56:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.218-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Tested on arm64 and x86 for 4.19.218-rc1,
Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-4.19.y
Version: 4.19.218-rc1
Commit: 451ddd7eb93b3648ea9e23132bd24faedb11279b
Compiler: gcc version 7.3.0 (GCC)
arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8938
passed: 8938
failed: 0
timeout: 0
--------------------------------------------------------------------
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8938
passed: 8938
failed: 0
timeout: 0
--------------------------------------------------------------------
Tested-by: Hulk Robot <hulkrobot@huawei.com>
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 000/323] 4.19.218-rc1 review
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2021-11-25 1:27 ` Samuel Zou
@ 2021-11-25 1:40 ` Guenter Roeck
2021-11-25 11:13 ` Greg Kroah-Hartman
2021-11-25 3:45 ` Naresh Kamboju
326 siblings, 1 reply; 340+ messages in thread
From: Guenter Roeck @ 2021-11-25 1:40 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, stable
On Wed, Nov 24, 2021 at 12:53:10PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.218 release.
> There are 323 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 26 Nov 2021 11:56:36 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 155 pass: 147 fail: 8
Failed builds:
ia64:defconfig
s390:defconfig
s390:allmodconfig
s390:performance_defconfig
sh:defconfig
sh:dreamcast_defconfig
sh:microdev_defconfig
sh:shx3_defconfig
Qemu test results:
total: 441 pass: 436 fail: 5
Failed tests:
s390:defconfig:nolocktests:smp2:net,default:initrd
s390:defconfig:nolocktests:smp2:virtio-blk-ccw:net,virtio-net-pci:rootfs
s390:defconfig:nolocktests:smp2:scsi[virtio-ccw]:net,default:rootfs
s390:defconfig:nolocktests:virtio-pci:net,virtio-net-pci:rootfs
s390:defconfig:nolocktests:scsi[virtio-pci]:net,default:rootfs
Again:
mm/hugetlb.c: In function '__unmap_hugepage_range':
mm/hugetlb.c:3455:25: error: implicit declaration of function 'tlb_flush_pmd_range'
Guenter
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 000/323] 4.19.218-rc1 review
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2021-11-25 1:40 ` Guenter Roeck
@ 2021-11-25 3:45 ` Naresh Kamboju
2021-11-25 11:15 ` Greg Kroah-Hartman
326 siblings, 1 reply; 340+ messages in thread
From: Naresh Kamboju @ 2021-11-25 3:45 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, shuah, f.fainelli, patches, lkft-triage, jonathanh,
stable, pavel, akpm, torvalds, linux
On Wed, 24 Nov 2021 at 18:07, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 4.19.218 release.
> There are 323 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 26 Nov 2021 11:56:36 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.218-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
FYI,
New warnings on Linux 4.19.218-rc1 arm and arm64 (defconfig+7) with gcc-11.
drivers/soc/tegra/pmc.c: In function 'tegra_powergate_power_up':
drivers/soc/tegra/pmc.c:429:1: warning: label 'powergate_off' defined
but not used [-Wunused-label]
429 | powergate_off:
| ^~~~~~
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 000/323] 4.19.218-rc1 review
2021-11-25 1:40 ` Guenter Roeck
@ 2021-11-25 11:13 ` Greg Kroah-Hartman
0 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-25 11:13 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, stable
On Wed, Nov 24, 2021 at 05:40:13PM -0800, Guenter Roeck wrote:
> On Wed, Nov 24, 2021 at 12:53:10PM +0100, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.19.218 release.
> > There are 323 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Fri, 26 Nov 2021 11:56:36 +0000.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 155 pass: 147 fail: 8
> Failed builds:
> ia64:defconfig
> s390:defconfig
> s390:allmodconfig
> s390:performance_defconfig
> sh:defconfig
> sh:dreamcast_defconfig
> sh:microdev_defconfig
> sh:shx3_defconfig
> Qemu test results:
> total: 441 pass: 436 fail: 5
> Failed tests:
> s390:defconfig:nolocktests:smp2:net,default:initrd
> s390:defconfig:nolocktests:smp2:virtio-blk-ccw:net,virtio-net-pci:rootfs
> s390:defconfig:nolocktests:smp2:scsi[virtio-ccw]:net,default:rootfs
> s390:defconfig:nolocktests:virtio-pci:net,virtio-net-pci:rootfs
> s390:defconfig:nolocktests:scsi[virtio-pci]:net,default:rootfs
>
> Again:
>
> mm/hugetlb.c: In function '__unmap_hugepage_range':
> mm/hugetlb.c:3455:25: error: implicit declaration of function 'tlb_flush_pmd_range'
Should now be fixed, will push out a -rc2 now.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 000/323] 4.19.218-rc1 review
2021-11-24 15:33 ` [PATCH 4.19 000/323] 4.19.218-rc1 review Naresh Kamboju
@ 2021-11-25 11:13 ` Greg Kroah-Hartman
0 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-25 11:13 UTC (permalink / raw)
To: Naresh Kamboju
Cc: linux-kernel, shuah, f.fainelli, patches, lkft-triage, jonathanh,
stable, pavel, akpm, torvalds, linux, Nadav Amit, Mike Kravetz,
Aneesh Kumar K.V, KAMEZAWA Hiroyuki
On Wed, Nov 24, 2021 at 09:03:46PM +0530, Naresh Kamboju wrote:
> On Wed, 24 Nov 2021 at 18:07, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > This is the start of the stable review cycle for the 4.19.218 release.
> > There are 323 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Fri, 26 Nov 2021 11:56:36 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.218-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> Regression found on s390 gcc-11 builds with defconfig
>
> Here it is reported,
> https://lore.kernel.org/stable/CA+G9fYv+SjDwfvP=Zgf-gr2RngkrzHO_w6OQzH7wqzU-dOW9+g@mail.gmail.com/
>
> mm/hugetlb.c: In function '__unmap_hugepage_range':
> mm/hugetlb.c:3455:25: error: implicit declaration of function
> 'tlb_flush_pmd_range'; did you mean 'tlb_flush_mmu_free'?
> [-Werror=implicit-function-declaration]
> 3455 | tlb_flush_pmd_range(tlb, address &
> PUD_MASK, PUD_SIZE);
> | ^~~~~~~~~~~~~~~~~~~
> | tlb_flush_mmu_free
> cc1: some warnings being treated as errors
>
>
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
>
Should now be fixed, thanks.
greg k-h
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 000/323] 4.19.218-rc1 review
2021-11-25 3:45 ` Naresh Kamboju
@ 2021-11-25 11:15 ` Greg Kroah-Hartman
0 siblings, 0 replies; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-25 11:15 UTC (permalink / raw)
To: Naresh Kamboju
Cc: linux-kernel, shuah, f.fainelli, patches, lkft-triage, jonathanh,
stable, pavel, akpm, torvalds, linux
On Thu, Nov 25, 2021 at 09:15:27AM +0530, Naresh Kamboju wrote:
> On Wed, 24 Nov 2021 at 18:07, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > This is the start of the stable review cycle for the 4.19.218 release.
> > There are 323 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Fri, 26 Nov 2021 11:56:36 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.218-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
>
> FYI,
> New warnings on Linux 4.19.218-rc1 arm and arm64 (defconfig+7) with gcc-11.
>
> drivers/soc/tegra/pmc.c: In function 'tegra_powergate_power_up':
> drivers/soc/tegra/pmc.c:429:1: warning: label 'powergate_off' defined
> but not used [-Wunused-label]
> 429 | powergate_off:
> | ^~~~~~
>
>
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Should now be fixed up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-24 11:54 ` [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail Greg Kroah-Hartman
@ 2021-11-28 9:46 ` Salvatore Bonaccorso
2021-11-28 11:59 ` Salvatore Bonaccorso
0 siblings, 1 reply; 340+ messages in thread
From: Salvatore Bonaccorso @ 2021-11-28 9:46 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Peter Zijlstra (Intel), Sasha Levin
Hi,
On Wed, Nov 24, 2021 at 12:54:38PM +0100, Greg Kroah-Hartman wrote:
> From: Peter Zijlstra <peterz@infradead.org>
>
> [ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]
>
> vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section
For 4.19.218 at least this commit seems to cause a build failure for
cpupower, if warnings are treated as errors, I have not seen the same
for the 5.10.80 build:
gcc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -DVERSION=\"4.19\" -DPACKAGE=\"cpupower\" -DPACKAGE_BUGREPORT=\"Debian\ \(reportbug\ linux-cpupower\)\" -D_GNU_SOURCE -pipe -DNLS -Wall -Wchar-subscripts -Wpointer-arith
-Wsign-compare -Wno-pointer-sign -Wdeclaration-after-statement -Wshadow -Os -fomit-frame-pointer -fPIC -o /home/build/linux-4.19.218/debian/build/build-tools/tools/power/cpupower/lib/cpupower.o -c lib/cpupower.c
In file included from lockdep.c:28:
../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
../../../kernel/locking/lockdep.c:694:2: error: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Werror=implicit-function-declaration]
hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
hlist_for_each_entry_continue
../../../kernel/locking/lockdep.c:694:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
^~~~~~~~~~
hash_ptr
../../../kernel/locking/lockdep.c:694:53: note: each undeclared identifier is reported only once for each function it appears in
../../../kernel/locking/lockdep.c:694:64: error: expected ‘;’ before ‘{’ token
hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
^~
;
../../../kernel/locking/lockdep.c:706:1: warning: control reaches end of non-void function [-Wreturn-type]
}
^
cc1: some warnings being treated as errors
make[5]: *** [/home/build/linux-4.19.218/tools/build/Makefile.build:97: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/lockdep.o] Error 1
make[4]: *** [Makefile:121: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/liblockdep-in.o] Error 2
make[4]: Leaving directory '/home/build/linux-4.19.218/tools/lib/lockdep'
make[3]: *** [/home/build/linux-4.19.218/debian/rules.d/tools/lib/lockdep/Makefile:16: all] Error 2
make[3]: Leaving directory '/home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep'
make[2]: *** [debian/rules.real:795: build-liblockdep] Error 2
make[2]: *** Waiting for unfinished jobs....
I was not yet able to look further on it.
Regards,
Salvatore
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-28 9:46 ` Salvatore Bonaccorso
@ 2021-11-28 11:59 ` Salvatore Bonaccorso
2021-11-28 12:11 ` Salvatore Bonaccorso
0 siblings, 1 reply; 340+ messages in thread
From: Salvatore Bonaccorso @ 2021-11-28 11:59 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Peter Zijlstra (Intel), Sasha Levin
Hi,
On Sun, Nov 28, 2021 at 10:46:13AM +0100, Salvatore Bonaccorso wrote:
> Hi,
>
> On Wed, Nov 24, 2021 at 12:54:38PM +0100, Greg Kroah-Hartman wrote:
> > From: Peter Zijlstra <peterz@infradead.org>
> >
> > [ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]
> >
> > vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section
>
> For 4.19.218 at least this commit seems to cause a build failure for
> cpupower, if warnings are treated as errors, I have not seen the same
> for the 5.10.80 build:
>
> gcc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -DVERSION=\"4.19\" -DPACKAGE=\"cpupower\" -DPACKAGE_BUGREPORT=\"Debian\ \(reportbug\ linux-cpupower\)\" -D_GNU_SOURCE -pipe -DNLS -Wall -Wchar-subscripts -Wpointer-arith
> -Wsign-compare -Wno-pointer-sign -Wdeclaration-after-statement -Wshadow -Os -fomit-frame-pointer -fPIC -o /home/build/linux-4.19.218/debian/build/build-tools/tools/power/cpupower/lib/cpupower.o -c lib/cpupower.c
> In file included from lockdep.c:28:
> ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> ../../../kernel/locking/lockdep.c:694:2: error: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Werror=implicit-function-declaration]
> hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> hlist_for_each_entry_continue
> ../../../kernel/locking/lockdep.c:694:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> ^~~~~~~~~~
> hash_ptr
> ../../../kernel/locking/lockdep.c:694:53: note: each undeclared identifier is reported only once for each function it appears in
> ../../../kernel/locking/lockdep.c:694:64: error: expected ‘;’ before ‘{’ token
> hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> ^~
> ;
> ../../../kernel/locking/lockdep.c:706:1: warning: control reaches end of non-void function [-Wreturn-type]
> }
> ^
> cc1: some warnings being treated as errors
> make[5]: *** [/home/build/linux-4.19.218/tools/build/Makefile.build:97: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/lockdep.o] Error 1
> make[4]: *** [Makefile:121: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/liblockdep-in.o] Error 2
> make[4]: Leaving directory '/home/build/linux-4.19.218/tools/lib/lockdep'
> make[3]: *** [/home/build/linux-4.19.218/debian/rules.d/tools/lib/lockdep/Makefile:16: all] Error 2
> make[3]: Leaving directory '/home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep'
> make[2]: *** [debian/rules.real:795: build-liblockdep] Error 2
> make[2]: *** Waiting for unfinished jobs....
>
> I was not yet able to look further on it.
Might actually be a distro specific issue, needs some further
investigation.
Regards,
Salvatore
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-28 11:59 ` Salvatore Bonaccorso
@ 2021-11-28 12:11 ` Salvatore Bonaccorso
2021-11-28 13:06 ` Greg Kroah-Hartman
0 siblings, 1 reply; 340+ messages in thread
From: Salvatore Bonaccorso @ 2021-11-28 12:11 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Peter Zijlstra (Intel), Sasha Levin
Hi,
On Sun, Nov 28, 2021 at 12:59:24PM +0100, Salvatore Bonaccorso wrote:
> Hi,
>
> On Sun, Nov 28, 2021 at 10:46:13AM +0100, Salvatore Bonaccorso wrote:
> > Hi,
> >
> > On Wed, Nov 24, 2021 at 12:54:38PM +0100, Greg Kroah-Hartman wrote:
> > > From: Peter Zijlstra <peterz@infradead.org>
> > >
> > > [ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]
> > >
> > > vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section
> >
> > For 4.19.218 at least this commit seems to cause a build failure for
> > cpupower, if warnings are treated as errors, I have not seen the same
> > for the 5.10.80 build:
> >
> > gcc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -DVERSION=\"4.19\" -DPACKAGE=\"cpupower\" -DPACKAGE_BUGREPORT=\"Debian\ \(reportbug\ linux-cpupower\)\" -D_GNU_SOURCE -pipe -DNLS -Wall -Wchar-subscripts -Wpointer-arith
> > -Wsign-compare -Wno-pointer-sign -Wdeclaration-after-statement -Wshadow -Os -fomit-frame-pointer -fPIC -o /home/build/linux-4.19.218/debian/build/build-tools/tools/power/cpupower/lib/cpupower.o -c lib/cpupower.c
> > In file included from lockdep.c:28:
> > ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> > ../../../kernel/locking/lockdep.c:694:2: error: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Werror=implicit-function-declaration]
> > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > hlist_for_each_entry_continue
> > ../../../kernel/locking/lockdep.c:694:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > ^~~~~~~~~~
> > hash_ptr
> > ../../../kernel/locking/lockdep.c:694:53: note: each undeclared identifier is reported only once for each function it appears in
> > ../../../kernel/locking/lockdep.c:694:64: error: expected ‘;’ before ‘{’ token
> > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > ^~
> > ;
> > ../../../kernel/locking/lockdep.c:706:1: warning: control reaches end of non-void function [-Wreturn-type]
> > }
> > ^
> > cc1: some warnings being treated as errors
> > make[5]: *** [/home/build/linux-4.19.218/tools/build/Makefile.build:97: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/lockdep.o] Error 1
> > make[4]: *** [Makefile:121: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/liblockdep-in.o] Error 2
> > make[4]: Leaving directory '/home/build/linux-4.19.218/tools/lib/lockdep'
> > make[3]: *** [/home/build/linux-4.19.218/debian/rules.d/tools/lib/lockdep/Makefile:16: all] Error 2
> > make[3]: Leaving directory '/home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep'
> > make[2]: *** [debian/rules.real:795: build-liblockdep] Error 2
> > make[2]: *** Waiting for unfinished jobs....
> >
> > I was not yet able to look further on it.
>
> Might actually be a distro specific issue, needs some further
> investigation.
I'm really sorry about the doubled noice, so here is the stance. I can
reproduce distro indpeendent, but the initial claim was wrong. It can
be reproduced for 4.19.218:
$ LC_ALL=C.UTF-8 V=1 ARCH=x86 make -C tools liblockdep
make: Entering directory '/home/build/linux-stable/tools'
mkdir -p lib/lockdep && make subdir=lib/lockdep -C lib/lockdep
make[1]: Entering directory '/home/build/linux-stable/tools/lib/lockdep'
make -f /home/build/linux-stable/tools/build/Makefile.build dir=. obj=fixdep
gcc -Wp,-MD,./.fixdep.o.d -Wp,-MT,fixdep.o -D"BUILD_STR(s)=#s" -c -o fixdep.o fixdep.c
ld -r -o fixdep-in.o fixdep.o
gcc -o fixdep fixdep-in.o
gcc -Wp,-MD,./.common.o.d -Wp,-MT,common.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o common.o common.c
gcc -Wp,-MD,./.lockdep.o.d -Wp,-MT,lockdep.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o lockdep.o lockdep.c
In file included from lockdep.c:28:
../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
../../../kernel/locking/lockdep.c:692:2: warning: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Wimplicit-function-declaration]
hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
hlist_for_each_entry_continue
../../../kernel/locking/lockdep.c:692:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
^~~~~~~~~~
hash_ptr
../../../kernel/locking/lockdep.c:692:53: note: each undeclared identifier is reported only once for each function it appears in
../../../kernel/locking/lockdep.c:692:64: error: expected ‘;’ before ‘{’ token
hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
^~
;
../../../kernel/locking/lockdep.c:704:1: warning: control reaches end of non-void function [-Wreturn-type]
}
^
make[2]: *** [/home/build/linux-stable/tools/build/Makefile.build:97: lockdep.o] Error 1
make[1]: *** [Makefile:121: liblockdep-in.o] Error 2
make[1]: Leaving directory '/home/build/linux-stable/tools/lib/lockdep'
make: *** [Makefile:66: liblockdep] Error 2
make: Leaving directory '/home/build/linux-stable/tools'
Reverting upstream ce0b9c805dd6 ("locking/lockdep: Avoid RCU-induced
noinstr fail") on top of 4.19.218 fixes the issue.
So back to square one, and again apologies for the intermediate noise!
Regards,
Salvatore
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-28 12:11 ` Salvatore Bonaccorso
@ 2021-11-28 13:06 ` Greg Kroah-Hartman
2021-11-28 13:08 ` Greg Kroah-Hartman
0 siblings, 1 reply; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-28 13:06 UTC (permalink / raw)
To: Salvatore Bonaccorso
Cc: linux-kernel, stable, Peter Zijlstra (Intel), Sasha Levin
On Sun, Nov 28, 2021 at 01:11:11PM +0100, Salvatore Bonaccorso wrote:
> Hi,
>
> On Sun, Nov 28, 2021 at 12:59:24PM +0100, Salvatore Bonaccorso wrote:
> > Hi,
> >
> > On Sun, Nov 28, 2021 at 10:46:13AM +0100, Salvatore Bonaccorso wrote:
> > > Hi,
> > >
> > > On Wed, Nov 24, 2021 at 12:54:38PM +0100, Greg Kroah-Hartman wrote:
> > > > From: Peter Zijlstra <peterz@infradead.org>
> > > >
> > > > [ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]
> > > >
> > > > vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section
> > >
> > > For 4.19.218 at least this commit seems to cause a build failure for
> > > cpupower, if warnings are treated as errors, I have not seen the same
> > > for the 5.10.80 build:
> > >
> > > gcc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -DVERSION=\"4.19\" -DPACKAGE=\"cpupower\" -DPACKAGE_BUGREPORT=\"Debian\ \(reportbug\ linux-cpupower\)\" -D_GNU_SOURCE -pipe -DNLS -Wall -Wchar-subscripts -Wpointer-arith
> > > -Wsign-compare -Wno-pointer-sign -Wdeclaration-after-statement -Wshadow -Os -fomit-frame-pointer -fPIC -o /home/build/linux-4.19.218/debian/build/build-tools/tools/power/cpupower/lib/cpupower.o -c lib/cpupower.c
> > > In file included from lockdep.c:28:
> > > ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> > > ../../../kernel/locking/lockdep.c:694:2: error: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Werror=implicit-function-declaration]
> > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > hlist_for_each_entry_continue
> > > ../../../kernel/locking/lockdep.c:694:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > ^~~~~~~~~~
> > > hash_ptr
> > > ../../../kernel/locking/lockdep.c:694:53: note: each undeclared identifier is reported only once for each function it appears in
> > > ../../../kernel/locking/lockdep.c:694:64: error: expected ‘;’ before ‘{’ token
> > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > ^~
> > > ;
> > > ../../../kernel/locking/lockdep.c:706:1: warning: control reaches end of non-void function [-Wreturn-type]
> > > }
> > > ^
> > > cc1: some warnings being treated as errors
> > > make[5]: *** [/home/build/linux-4.19.218/tools/build/Makefile.build:97: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/lockdep.o] Error 1
> > > make[4]: *** [Makefile:121: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/liblockdep-in.o] Error 2
> > > make[4]: Leaving directory '/home/build/linux-4.19.218/tools/lib/lockdep'
> > > make[3]: *** [/home/build/linux-4.19.218/debian/rules.d/tools/lib/lockdep/Makefile:16: all] Error 2
> > > make[3]: Leaving directory '/home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep'
> > > make[2]: *** [debian/rules.real:795: build-liblockdep] Error 2
> > > make[2]: *** Waiting for unfinished jobs....
> > >
> > > I was not yet able to look further on it.
> >
> > Might actually be a distro specific issue, needs some further
> > investigation.
>
> I'm really sorry about the doubled noice, so here is the stance. I can
> reproduce distro indpeendent, but the initial claim was wrong. It can
> be reproduced for 4.19.218:
>
> $ LC_ALL=C.UTF-8 V=1 ARCH=x86 make -C tools liblockdep
> make: Entering directory '/home/build/linux-stable/tools'
> mkdir -p lib/lockdep && make subdir=lib/lockdep -C lib/lockdep
> make[1]: Entering directory '/home/build/linux-stable/tools/lib/lockdep'
> make -f /home/build/linux-stable/tools/build/Makefile.build dir=. obj=fixdep
> gcc -Wp,-MD,./.fixdep.o.d -Wp,-MT,fixdep.o -D"BUILD_STR(s)=#s" -c -o fixdep.o fixdep.c
> ld -r -o fixdep-in.o fixdep.o
> gcc -o fixdep fixdep-in.o
> gcc -Wp,-MD,./.common.o.d -Wp,-MT,common.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o common.o common.c
> gcc -Wp,-MD,./.lockdep.o.d -Wp,-MT,lockdep.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o lockdep.o lockdep.c
> In file included from lockdep.c:28:
> ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> ../../../kernel/locking/lockdep.c:692:2: warning: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Wimplicit-function-declaration]
> hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> hlist_for_each_entry_continue
> ../../../kernel/locking/lockdep.c:692:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> ^~~~~~~~~~
> hash_ptr
> ../../../kernel/locking/lockdep.c:692:53: note: each undeclared identifier is reported only once for each function it appears in
> ../../../kernel/locking/lockdep.c:692:64: error: expected ‘;’ before ‘{’ token
> hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> ^~
> ;
> ../../../kernel/locking/lockdep.c:704:1: warning: control reaches end of non-void function [-Wreturn-type]
> }
> ^
> make[2]: *** [/home/build/linux-stable/tools/build/Makefile.build:97: lockdep.o] Error 1
> make[1]: *** [Makefile:121: liblockdep-in.o] Error 2
> make[1]: Leaving directory '/home/build/linux-stable/tools/lib/lockdep'
> make: *** [Makefile:66: liblockdep] Error 2
> make: Leaving directory '/home/build/linux-stable/tools'
>
> Reverting upstream ce0b9c805dd6 ("locking/lockdep: Avoid RCU-induced
> noinstr fail") on top of 4.19.218 fixes the issue.
>
> So back to square one, and again apologies for the intermediate noise!
What config/arch is causing this to break? And if you add rchlist.h to
the include files for lockdep.c, does that resolve the issue? I haven't
seen any other reports of this yet.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-28 13:06 ` Greg Kroah-Hartman
@ 2021-11-28 13:08 ` Greg Kroah-Hartman
2021-11-29 18:30 ` Salvatore Bonaccorso
0 siblings, 1 reply; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-28 13:08 UTC (permalink / raw)
To: Salvatore Bonaccorso
Cc: linux-kernel, stable, Peter Zijlstra (Intel), Sasha Levin
On Sun, Nov 28, 2021 at 02:06:30PM +0100, Greg Kroah-Hartman wrote:
> On Sun, Nov 28, 2021 at 01:11:11PM +0100, Salvatore Bonaccorso wrote:
> > Hi,
> >
> > On Sun, Nov 28, 2021 at 12:59:24PM +0100, Salvatore Bonaccorso wrote:
> > > Hi,
> > >
> > > On Sun, Nov 28, 2021 at 10:46:13AM +0100, Salvatore Bonaccorso wrote:
> > > > Hi,
> > > >
> > > > On Wed, Nov 24, 2021 at 12:54:38PM +0100, Greg Kroah-Hartman wrote:
> > > > > From: Peter Zijlstra <peterz@infradead.org>
> > > > >
> > > > > [ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]
> > > > >
> > > > > vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section
> > > >
> > > > For 4.19.218 at least this commit seems to cause a build failure for
> > > > cpupower, if warnings are treated as errors, I have not seen the same
> > > > for the 5.10.80 build:
> > > >
> > > > gcc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -DVERSION=\"4.19\" -DPACKAGE=\"cpupower\" -DPACKAGE_BUGREPORT=\"Debian\ \(reportbug\ linux-cpupower\)\" -D_GNU_SOURCE -pipe -DNLS -Wall -Wchar-subscripts -Wpointer-arith
> > > > -Wsign-compare -Wno-pointer-sign -Wdeclaration-after-statement -Wshadow -Os -fomit-frame-pointer -fPIC -o /home/build/linux-4.19.218/debian/build/build-tools/tools/power/cpupower/lib/cpupower.o -c lib/cpupower.c
> > > > In file included from lockdep.c:28:
> > > > ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> > > > ../../../kernel/locking/lockdep.c:694:2: error: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Werror=implicit-function-declaration]
> > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > > hlist_for_each_entry_continue
> > > > ../../../kernel/locking/lockdep.c:694:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > ^~~~~~~~~~
> > > > hash_ptr
> > > > ../../../kernel/locking/lockdep.c:694:53: note: each undeclared identifier is reported only once for each function it appears in
> > > > ../../../kernel/locking/lockdep.c:694:64: error: expected ‘;’ before ‘{’ token
> > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > ^~
> > > > ;
> > > > ../../../kernel/locking/lockdep.c:706:1: warning: control reaches end of non-void function [-Wreturn-type]
> > > > }
> > > > ^
> > > > cc1: some warnings being treated as errors
> > > > make[5]: *** [/home/build/linux-4.19.218/tools/build/Makefile.build:97: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/lockdep.o] Error 1
> > > > make[4]: *** [Makefile:121: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/liblockdep-in.o] Error 2
> > > > make[4]: Leaving directory '/home/build/linux-4.19.218/tools/lib/lockdep'
> > > > make[3]: *** [/home/build/linux-4.19.218/debian/rules.d/tools/lib/lockdep/Makefile:16: all] Error 2
> > > > make[3]: Leaving directory '/home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep'
> > > > make[2]: *** [debian/rules.real:795: build-liblockdep] Error 2
> > > > make[2]: *** Waiting for unfinished jobs....
> > > >
> > > > I was not yet able to look further on it.
> > >
> > > Might actually be a distro specific issue, needs some further
> > > investigation.
> >
> > I'm really sorry about the doubled noice, so here is the stance. I can
> > reproduce distro indpeendent, but the initial claim was wrong. It can
> > be reproduced for 4.19.218:
> >
> > $ LC_ALL=C.UTF-8 V=1 ARCH=x86 make -C tools liblockdep
> > make: Entering directory '/home/build/linux-stable/tools'
> > mkdir -p lib/lockdep && make subdir=lib/lockdep -C lib/lockdep
> > make[1]: Entering directory '/home/build/linux-stable/tools/lib/lockdep'
> > make -f /home/build/linux-stable/tools/build/Makefile.build dir=. obj=fixdep
> > gcc -Wp,-MD,./.fixdep.o.d -Wp,-MT,fixdep.o -D"BUILD_STR(s)=#s" -c -o fixdep.o fixdep.c
> > ld -r -o fixdep-in.o fixdep.o
> > gcc -o fixdep fixdep-in.o
> > gcc -Wp,-MD,./.common.o.d -Wp,-MT,common.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o common.o common.c
> > gcc -Wp,-MD,./.lockdep.o.d -Wp,-MT,lockdep.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o lockdep.o lockdep.c
> > In file included from lockdep.c:28:
> > ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> > ../../../kernel/locking/lockdep.c:692:2: warning: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Wimplicit-function-declaration]
> > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > hlist_for_each_entry_continue
> > ../../../kernel/locking/lockdep.c:692:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > ^~~~~~~~~~
> > hash_ptr
> > ../../../kernel/locking/lockdep.c:692:53: note: each undeclared identifier is reported only once for each function it appears in
> > ../../../kernel/locking/lockdep.c:692:64: error: expected ‘;’ before ‘{’ token
> > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > ^~
> > ;
> > ../../../kernel/locking/lockdep.c:704:1: warning: control reaches end of non-void function [-Wreturn-type]
> > }
> > ^
> > make[2]: *** [/home/build/linux-stable/tools/build/Makefile.build:97: lockdep.o] Error 1
> > make[1]: *** [Makefile:121: liblockdep-in.o] Error 2
> > make[1]: Leaving directory '/home/build/linux-stable/tools/lib/lockdep'
> > make: *** [Makefile:66: liblockdep] Error 2
> > make: Leaving directory '/home/build/linux-stable/tools'
> >
> > Reverting upstream ce0b9c805dd6 ("locking/lockdep: Avoid RCU-induced
> > noinstr fail") on top of 4.19.218 fixes the issue.
> >
> > So back to square one, and again apologies for the intermediate noise!
>
> What config/arch is causing this to break? And if you add rchlist.h to
> the include files for lockdep.c, does that resolve the issue? I haven't
> seen any other reports of this yet.
Ah, it's the tools being built here, sorry, that was confusing.
Yes, I can duplicate this, when building liblockdep. As that code just
got ripped out of upstream, perhaps just use the out-of-tree code
instead now?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-28 13:08 ` Greg Kroah-Hartman
@ 2021-11-29 18:30 ` Salvatore Bonaccorso
2021-11-30 7:57 ` Greg Kroah-Hartman
0 siblings, 1 reply; 340+ messages in thread
From: Salvatore Bonaccorso @ 2021-11-29 18:30 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Peter Zijlstra (Intel), Sasha Levin, Ben Hutchings
Hi Greg,
(Adding Ben as well)
On Sun, Nov 28, 2021 at 02:08:53PM +0100, Greg Kroah-Hartman wrote:
> On Sun, Nov 28, 2021 at 02:06:30PM +0100, Greg Kroah-Hartman wrote:
> > On Sun, Nov 28, 2021 at 01:11:11PM +0100, Salvatore Bonaccorso wrote:
> > > Hi,
> > >
> > > On Sun, Nov 28, 2021 at 12:59:24PM +0100, Salvatore Bonaccorso wrote:
> > > > Hi,
> > > >
> > > > On Sun, Nov 28, 2021 at 10:46:13AM +0100, Salvatore Bonaccorso wrote:
> > > > > Hi,
> > > > >
> > > > > On Wed, Nov 24, 2021 at 12:54:38PM +0100, Greg Kroah-Hartman wrote:
> > > > > > From: Peter Zijlstra <peterz@infradead.org>
> > > > > >
> > > > > > [ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]
> > > > > >
> > > > > > vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section
> > > > >
> > > > > For 4.19.218 at least this commit seems to cause a build failure for
> > > > > cpupower, if warnings are treated as errors, I have not seen the same
> > > > > for the 5.10.80 build:
> > > > >
> > > > > gcc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -DVERSION=\"4.19\" -DPACKAGE=\"cpupower\" -DPACKAGE_BUGREPORT=\"Debian\ \(reportbug\ linux-cpupower\)\" -D_GNU_SOURCE -pipe -DNLS -Wall -Wchar-subscripts -Wpointer-arith
> > > > > -Wsign-compare -Wno-pointer-sign -Wdeclaration-after-statement -Wshadow -Os -fomit-frame-pointer -fPIC -o /home/build/linux-4.19.218/debian/build/build-tools/tools/power/cpupower/lib/cpupower.o -c lib/cpupower.c
> > > > > In file included from lockdep.c:28:
> > > > > ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> > > > > ../../../kernel/locking/lockdep.c:694:2: error: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Werror=implicit-function-declaration]
> > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > > > hlist_for_each_entry_continue
> > > > > ../../../kernel/locking/lockdep.c:694:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > ^~~~~~~~~~
> > > > > hash_ptr
> > > > > ../../../kernel/locking/lockdep.c:694:53: note: each undeclared identifier is reported only once for each function it appears in
> > > > > ../../../kernel/locking/lockdep.c:694:64: error: expected ‘;’ before ‘{’ token
> > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > ^~
> > > > > ;
> > > > > ../../../kernel/locking/lockdep.c:706:1: warning: control reaches end of non-void function [-Wreturn-type]
> > > > > }
> > > > > ^
> > > > > cc1: some warnings being treated as errors
> > > > > make[5]: *** [/home/build/linux-4.19.218/tools/build/Makefile.build:97: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/lockdep.o] Error 1
> > > > > make[4]: *** [Makefile:121: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/liblockdep-in.o] Error 2
> > > > > make[4]: Leaving directory '/home/build/linux-4.19.218/tools/lib/lockdep'
> > > > > make[3]: *** [/home/build/linux-4.19.218/debian/rules.d/tools/lib/lockdep/Makefile:16: all] Error 2
> > > > > make[3]: Leaving directory '/home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep'
> > > > > make[2]: *** [debian/rules.real:795: build-liblockdep] Error 2
> > > > > make[2]: *** Waiting for unfinished jobs....
> > > > >
> > > > > I was not yet able to look further on it.
> > > >
> > > > Might actually be a distro specific issue, needs some further
> > > > investigation.
> > >
> > > I'm really sorry about the doubled noice, so here is the stance. I can
> > > reproduce distro indpeendent, but the initial claim was wrong. It can
> > > be reproduced for 4.19.218:
> > >
> > > $ LC_ALL=C.UTF-8 V=1 ARCH=x86 make -C tools liblockdep
> > > make: Entering directory '/home/build/linux-stable/tools'
> > > mkdir -p lib/lockdep && make subdir=lib/lockdep -C lib/lockdep
> > > make[1]: Entering directory '/home/build/linux-stable/tools/lib/lockdep'
> > > make -f /home/build/linux-stable/tools/build/Makefile.build dir=. obj=fixdep
> > > gcc -Wp,-MD,./.fixdep.o.d -Wp,-MT,fixdep.o -D"BUILD_STR(s)=#s" -c -o fixdep.o fixdep.c
> > > ld -r -o fixdep-in.o fixdep.o
> > > gcc -o fixdep fixdep-in.o
> > > gcc -Wp,-MD,./.common.o.d -Wp,-MT,common.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o common.o common.c
> > > gcc -Wp,-MD,./.lockdep.o.d -Wp,-MT,lockdep.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o lockdep.o lockdep.c
> > > In file included from lockdep.c:28:
> > > ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> > > ../../../kernel/locking/lockdep.c:692:2: warning: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Wimplicit-function-declaration]
> > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > hlist_for_each_entry_continue
> > > ../../../kernel/locking/lockdep.c:692:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > ^~~~~~~~~~
> > > hash_ptr
> > > ../../../kernel/locking/lockdep.c:692:53: note: each undeclared identifier is reported only once for each function it appears in
> > > ../../../kernel/locking/lockdep.c:692:64: error: expected ‘;’ before ‘{’ token
> > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > ^~
> > > ;
> > > ../../../kernel/locking/lockdep.c:704:1: warning: control reaches end of non-void function [-Wreturn-type]
> > > }
> > > ^
> > > make[2]: *** [/home/build/linux-stable/tools/build/Makefile.build:97: lockdep.o] Error 1
> > > make[1]: *** [Makefile:121: liblockdep-in.o] Error 2
> > > make[1]: Leaving directory '/home/build/linux-stable/tools/lib/lockdep'
> > > make: *** [Makefile:66: liblockdep] Error 2
> > > make: Leaving directory '/home/build/linux-stable/tools'
> > >
> > > Reverting upstream ce0b9c805dd6 ("locking/lockdep: Avoid RCU-induced
> > > noinstr fail") on top of 4.19.218 fixes the issue.
> > >
> > > So back to square one, and again apologies for the intermediate noise!
> >
> > What config/arch is causing this to break? And if you add rchlist.h to
> > the include files for lockdep.c, does that resolve the issue? I haven't
> > seen any other reports of this yet.
>
> Ah, it's the tools being built here, sorry, that was confusing.
Ah yes, sorry this was not clear. It's all about the tools, which some
are built as well as packages in Debian accompaning, tools/lib/lockdep
is one of those built.
> Yes, I can duplicate this, when building liblockdep. As that code just
> got ripped out of upstream, perhaps just use the out-of-tree code
> instead now?
That's tricky. Even though lockep is probably only usefull for Kernel
developers, we usually cannot drop a package built in a stable
release. If it's not fixable in upstream and the respective stable
series, then we might need to find a suitable fix downstream to make
it build.
Speaking of Debian: Last resort would probably be still to drop the
package in the stable release.
I know lockdep was ripped in v5.16-rc1, but AFAIK lockdep has not
found a new home yet out of tree.
Regards,
Salvatore
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-29 18:30 ` Salvatore Bonaccorso
@ 2021-11-30 7:57 ` Greg Kroah-Hartman
2021-12-04 10:30 ` Salvatore Bonaccorso
0 siblings, 1 reply; 340+ messages in thread
From: Greg Kroah-Hartman @ 2021-11-30 7:57 UTC (permalink / raw)
To: Salvatore Bonaccorso
Cc: linux-kernel, stable, Peter Zijlstra (Intel), Sasha Levin, Ben Hutchings
On Mon, Nov 29, 2021 at 07:30:30PM +0100, Salvatore Bonaccorso wrote:
> Hi Greg,
>
> (Adding Ben as well)
>
> On Sun, Nov 28, 2021 at 02:08:53PM +0100, Greg Kroah-Hartman wrote:
> > On Sun, Nov 28, 2021 at 02:06:30PM +0100, Greg Kroah-Hartman wrote:
> > > On Sun, Nov 28, 2021 at 01:11:11PM +0100, Salvatore Bonaccorso wrote:
> > > > Hi,
> > > >
> > > > On Sun, Nov 28, 2021 at 12:59:24PM +0100, Salvatore Bonaccorso wrote:
> > > > > Hi,
> > > > >
> > > > > On Sun, Nov 28, 2021 at 10:46:13AM +0100, Salvatore Bonaccorso wrote:
> > > > > > Hi,
> > > > > >
> > > > > > On Wed, Nov 24, 2021 at 12:54:38PM +0100, Greg Kroah-Hartman wrote:
> > > > > > > From: Peter Zijlstra <peterz@infradead.org>
> > > > > > >
> > > > > > > [ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]
> > > > > > >
> > > > > > > vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section
> > > > > >
> > > > > > For 4.19.218 at least this commit seems to cause a build failure for
> > > > > > cpupower, if warnings are treated as errors, I have not seen the same
> > > > > > for the 5.10.80 build:
> > > > > >
> > > > > > gcc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -DVERSION=\"4.19\" -DPACKAGE=\"cpupower\" -DPACKAGE_BUGREPORT=\"Debian\ \(reportbug\ linux-cpupower\)\" -D_GNU_SOURCE -pipe -DNLS -Wall -Wchar-subscripts -Wpointer-arith
> > > > > > -Wsign-compare -Wno-pointer-sign -Wdeclaration-after-statement -Wshadow -Os -fomit-frame-pointer -fPIC -o /home/build/linux-4.19.218/debian/build/build-tools/tools/power/cpupower/lib/cpupower.o -c lib/cpupower.c
> > > > > > In file included from lockdep.c:28:
> > > > > > ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> > > > > > ../../../kernel/locking/lockdep.c:694:2: error: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Werror=implicit-function-declaration]
> > > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > > > > hlist_for_each_entry_continue
> > > > > > ../../../kernel/locking/lockdep.c:694:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> > > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > > ^~~~~~~~~~
> > > > > > hash_ptr
> > > > > > ../../../kernel/locking/lockdep.c:694:53: note: each undeclared identifier is reported only once for each function it appears in
> > > > > > ../../../kernel/locking/lockdep.c:694:64: error: expected ‘;’ before ‘{’ token
> > > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > > ^~
> > > > > > ;
> > > > > > ../../../kernel/locking/lockdep.c:706:1: warning: control reaches end of non-void function [-Wreturn-type]
> > > > > > }
> > > > > > ^
> > > > > > cc1: some warnings being treated as errors
> > > > > > make[5]: *** [/home/build/linux-4.19.218/tools/build/Makefile.build:97: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/lockdep.o] Error 1
> > > > > > make[4]: *** [Makefile:121: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/liblockdep-in.o] Error 2
> > > > > > make[4]: Leaving directory '/home/build/linux-4.19.218/tools/lib/lockdep'
> > > > > > make[3]: *** [/home/build/linux-4.19.218/debian/rules.d/tools/lib/lockdep/Makefile:16: all] Error 2
> > > > > > make[3]: Leaving directory '/home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep'
> > > > > > make[2]: *** [debian/rules.real:795: build-liblockdep] Error 2
> > > > > > make[2]: *** Waiting for unfinished jobs....
> > > > > >
> > > > > > I was not yet able to look further on it.
> > > > >
> > > > > Might actually be a distro specific issue, needs some further
> > > > > investigation.
> > > >
> > > > I'm really sorry about the doubled noice, so here is the stance. I can
> > > > reproduce distro indpeendent, but the initial claim was wrong. It can
> > > > be reproduced for 4.19.218:
> > > >
> > > > $ LC_ALL=C.UTF-8 V=1 ARCH=x86 make -C tools liblockdep
> > > > make: Entering directory '/home/build/linux-stable/tools'
> > > > mkdir -p lib/lockdep && make subdir=lib/lockdep -C lib/lockdep
> > > > make[1]: Entering directory '/home/build/linux-stable/tools/lib/lockdep'
> > > > make -f /home/build/linux-stable/tools/build/Makefile.build dir=. obj=fixdep
> > > > gcc -Wp,-MD,./.fixdep.o.d -Wp,-MT,fixdep.o -D"BUILD_STR(s)=#s" -c -o fixdep.o fixdep.c
> > > > ld -r -o fixdep-in.o fixdep.o
> > > > gcc -o fixdep fixdep-in.o
> > > > gcc -Wp,-MD,./.common.o.d -Wp,-MT,common.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o common.o common.c
> > > > gcc -Wp,-MD,./.lockdep.o.d -Wp,-MT,lockdep.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o lockdep.o lockdep.c
> > > > In file included from lockdep.c:28:
> > > > ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> > > > ../../../kernel/locking/lockdep.c:692:2: warning: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Wimplicit-function-declaration]
> > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > > hlist_for_each_entry_continue
> > > > ../../../kernel/locking/lockdep.c:692:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > ^~~~~~~~~~
> > > > hash_ptr
> > > > ../../../kernel/locking/lockdep.c:692:53: note: each undeclared identifier is reported only once for each function it appears in
> > > > ../../../kernel/locking/lockdep.c:692:64: error: expected ‘;’ before ‘{’ token
> > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > ^~
> > > > ;
> > > > ../../../kernel/locking/lockdep.c:704:1: warning: control reaches end of non-void function [-Wreturn-type]
> > > > }
> > > > ^
> > > > make[2]: *** [/home/build/linux-stable/tools/build/Makefile.build:97: lockdep.o] Error 1
> > > > make[1]: *** [Makefile:121: liblockdep-in.o] Error 2
> > > > make[1]: Leaving directory '/home/build/linux-stable/tools/lib/lockdep'
> > > > make: *** [Makefile:66: liblockdep] Error 2
> > > > make: Leaving directory '/home/build/linux-stable/tools'
> > > >
> > > > Reverting upstream ce0b9c805dd6 ("locking/lockdep: Avoid RCU-induced
> > > > noinstr fail") on top of 4.19.218 fixes the issue.
> > > >
> > > > So back to square one, and again apologies for the intermediate noise!
> > >
> > > What config/arch is causing this to break? And if you add rchlist.h to
> > > the include files for lockdep.c, does that resolve the issue? I haven't
> > > seen any other reports of this yet.
> >
> > Ah, it's the tools being built here, sorry, that was confusing.
>
> Ah yes, sorry this was not clear. It's all about the tools, which some
> are built as well as packages in Debian accompaning, tools/lib/lockdep
> is one of those built.
Ok, fair enough, I'll gladly take a patch that fixes this up for the
4.19.y releases.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 340+ messages in thread
* Re: [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-30 7:57 ` Greg Kroah-Hartman
@ 2021-12-04 10:30 ` Salvatore Bonaccorso
0 siblings, 0 replies; 340+ messages in thread
From: Salvatore Bonaccorso @ 2021-12-04 10:30 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Peter Zijlstra (Intel), Sasha Levin, Ben Hutchings
Hi Greg,
On Tue, Nov 30, 2021 at 08:57:46AM +0100, Greg Kroah-Hartman wrote:
> On Mon, Nov 29, 2021 at 07:30:30PM +0100, Salvatore Bonaccorso wrote:
> > Hi Greg,
> >
> > (Adding Ben as well)
> >
> > On Sun, Nov 28, 2021 at 02:08:53PM +0100, Greg Kroah-Hartman wrote:
> > > On Sun, Nov 28, 2021 at 02:06:30PM +0100, Greg Kroah-Hartman wrote:
> > > > On Sun, Nov 28, 2021 at 01:11:11PM +0100, Salvatore Bonaccorso wrote:
> > > > > Hi,
> > > > >
> > > > > On Sun, Nov 28, 2021 at 12:59:24PM +0100, Salvatore Bonaccorso wrote:
> > > > > > Hi,
> > > > > >
> > > > > > On Sun, Nov 28, 2021 at 10:46:13AM +0100, Salvatore Bonaccorso wrote:
> > > > > > > Hi,
> > > > > > >
> > > > > > > On Wed, Nov 24, 2021 at 12:54:38PM +0100, Greg Kroah-Hartman wrote:
> > > > > > > > From: Peter Zijlstra <peterz@infradead.org>
> > > > > > > >
> > > > > > > > [ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]
> > > > > > > >
> > > > > > > > vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section
> > > > > > >
> > > > > > > For 4.19.218 at least this commit seems to cause a build failure for
> > > > > > > cpupower, if warnings are treated as errors, I have not seen the same
> > > > > > > for the 5.10.80 build:
> > > > > > >
> > > > > > > gcc -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -DVERSION=\"4.19\" -DPACKAGE=\"cpupower\" -DPACKAGE_BUGREPORT=\"Debian\ \(reportbug\ linux-cpupower\)\" -D_GNU_SOURCE -pipe -DNLS -Wall -Wchar-subscripts -Wpointer-arith
> > > > > > > -Wsign-compare -Wno-pointer-sign -Wdeclaration-after-statement -Wshadow -Os -fomit-frame-pointer -fPIC -o /home/build/linux-4.19.218/debian/build/build-tools/tools/power/cpupower/lib/cpupower.o -c lib/cpupower.c
> > > > > > > In file included from lockdep.c:28:
> > > > > > > ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> > > > > > > ../../../kernel/locking/lockdep.c:694:2: error: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Werror=implicit-function-declaration]
> > > > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > > > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > > > > > hlist_for_each_entry_continue
> > > > > > > ../../../kernel/locking/lockdep.c:694:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> > > > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > > > ^~~~~~~~~~
> > > > > > > hash_ptr
> > > > > > > ../../../kernel/locking/lockdep.c:694:53: note: each undeclared identifier is reported only once for each function it appears in
> > > > > > > ../../../kernel/locking/lockdep.c:694:64: error: expected ‘;’ before ‘{’ token
> > > > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > > > ^~
> > > > > > > ;
> > > > > > > ../../../kernel/locking/lockdep.c:706:1: warning: control reaches end of non-void function [-Wreturn-type]
> > > > > > > }
> > > > > > > ^
> > > > > > > cc1: some warnings being treated as errors
> > > > > > > make[5]: *** [/home/build/linux-4.19.218/tools/build/Makefile.build:97: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/lockdep.o] Error 1
> > > > > > > make[4]: *** [Makefile:121: /home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep/liblockdep-in.o] Error 2
> > > > > > > make[4]: Leaving directory '/home/build/linux-4.19.218/tools/lib/lockdep'
> > > > > > > make[3]: *** [/home/build/linux-4.19.218/debian/rules.d/tools/lib/lockdep/Makefile:16: all] Error 2
> > > > > > > make[3]: Leaving directory '/home/build/linux-4.19.218/debian/build/build-tools/tools/lib/lockdep'
> > > > > > > make[2]: *** [debian/rules.real:795: build-liblockdep] Error 2
> > > > > > > make[2]: *** Waiting for unfinished jobs....
> > > > > > >
> > > > > > > I was not yet able to look further on it.
> > > > > >
> > > > > > Might actually be a distro specific issue, needs some further
> > > > > > investigation.
> > > > >
> > > > > I'm really sorry about the doubled noice, so here is the stance. I can
> > > > > reproduce distro indpeendent, but the initial claim was wrong. It can
> > > > > be reproduced for 4.19.218:
> > > > >
> > > > > $ LC_ALL=C.UTF-8 V=1 ARCH=x86 make -C tools liblockdep
> > > > > make: Entering directory '/home/build/linux-stable/tools'
> > > > > mkdir -p lib/lockdep && make subdir=lib/lockdep -C lib/lockdep
> > > > > make[1]: Entering directory '/home/build/linux-stable/tools/lib/lockdep'
> > > > > make -f /home/build/linux-stable/tools/build/Makefile.build dir=. obj=fixdep
> > > > > gcc -Wp,-MD,./.fixdep.o.d -Wp,-MT,fixdep.o -D"BUILD_STR(s)=#s" -c -o fixdep.o fixdep.c
> > > > > ld -r -o fixdep-in.o fixdep.o
> > > > > gcc -o fixdep fixdep-in.o
> > > > > gcc -Wp,-MD,./.common.o.d -Wp,-MT,common.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o common.o common.c
> > > > > gcc -Wp,-MD,./.lockdep.o.d -Wp,-MT,lockdep.o -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"4.19.218"' -rdynamic -O0 -g -fPIC -Wall -I. -I./uinclude -I./include -I../../include -D"BUILD_STR(s)=#s" -c -o lockdep.o lockdep.c
> > > > > In file included from lockdep.c:28:
> > > > > ../../../kernel/locking/lockdep.c: In function ‘look_up_lock_class’:
> > > > > ../../../kernel/locking/lockdep.c:692:2: warning: implicit declaration of function ‘hlist_for_each_entry_rcu_notrace’; did you mean ‘hlist_for_each_entry_continue’? [-Wimplicit-function-declaration]
> > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > > > hlist_for_each_entry_continue
> > > > > ../../../kernel/locking/lockdep.c:692:53: error: ‘hash_entry’ undeclared (first use in this function); did you mean ‘hash_ptr’?
> > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > ^~~~~~~~~~
> > > > > hash_ptr
> > > > > ../../../kernel/locking/lockdep.c:692:53: note: each undeclared identifier is reported only once for each function it appears in
> > > > > ../../../kernel/locking/lockdep.c:692:64: error: expected ‘;’ before ‘{’ token
> > > > > hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
> > > > > ^~
> > > > > ;
> > > > > ../../../kernel/locking/lockdep.c:704:1: warning: control reaches end of non-void function [-Wreturn-type]
> > > > > }
> > > > > ^
> > > > > make[2]: *** [/home/build/linux-stable/tools/build/Makefile.build:97: lockdep.o] Error 1
> > > > > make[1]: *** [Makefile:121: liblockdep-in.o] Error 2
> > > > > make[1]: Leaving directory '/home/build/linux-stable/tools/lib/lockdep'
> > > > > make: *** [Makefile:66: liblockdep] Error 2
> > > > > make: Leaving directory '/home/build/linux-stable/tools'
> > > > >
> > > > > Reverting upstream ce0b9c805dd6 ("locking/lockdep: Avoid RCU-induced
> > > > > noinstr fail") on top of 4.19.218 fixes the issue.
> > > > >
> > > > > So back to square one, and again apologies for the intermediate noise!
> > > >
> > > > What config/arch is causing this to break? And if you add rchlist.h to
> > > > the include files for lockdep.c, does that resolve the issue? I haven't
> > > > seen any other reports of this yet.
> > >
> > > Ah, it's the tools being built here, sorry, that was confusing.
> >
> > Ah yes, sorry this was not clear. It's all about the tools, which some
> > are built as well as packages in Debian accompaning, tools/lib/lockdep
> > is one of those built.
>
> Ok, fair enough, I'll gladly take a patch that fixes this up for the
> 4.19.y releases.
We (speaking as for Debian) will probably drop the ball here as well,
and drop building the lockdep tool packages in the next upload. It was
probabably anyway not a good idea to have them built in the first
place.
Regards,
Salvatore
^ permalink raw reply [flat|nested] 340+ messages in thread
end of thread, other threads:[~2021-12-04 10:30 UTC | newest]
Thread overview: 340+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-24 11:53 [PATCH 4.19 000/323] 4.19.218-rc1 review Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 001/323] xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 002/323] binder: use euid from cred instead of using task Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 003/323] binder: use cred instead of task for selinux checks Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 004/323] Input: elantench - fix misreporting trackpoint coordinates Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 005/323] Input: i8042 - Add quirk for Fujitsu Lifebook T725 Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 006/323] libata: fix read log timeout value Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 007/323] ocfs2: fix data corruption on truncate Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 008/323] mmc: dw_mmc: Dont wait for DRTO on Write RSP error Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 009/323] parisc: Fix ptrace check on syscall return Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 010/323] tpm: Check for integer overflow in tpm2_map_response_body() Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 011/323] firmware/psci: fix application of sizeof to pointer Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 012/323] crypto: s5p-sss - Add error handling in s5p_aes_probe() Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 013/323] media: ite-cir: IR receiver stop working after receive overflow Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 014/323] media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 015/323] ALSA: hda/realtek: Add quirk for Clevo PC70HS Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 016/323] ALSA: ua101: fix division by zero at probe Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 017/323] ALSA: 6fire: fix control and bulk message timeouts Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 018/323] ALSA: line6: fix control and interrupt " Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 019/323] ALSA: usb-audio: Add registration quirk for JBL Quantum 400 Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 020/323] ALSA: synth: missing check for possible NULL after the call to kstrdup Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 021/323] ALSA: timer: Fix use-after-free problem Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 022/323] ALSA: timer: Unconditionally unlink slave instances, too Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 023/323] fuse: fix page stealing Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 024/323] x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 025/323] x86/irq: Ensure PI wakeup handler is unregistered before module unload Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 026/323] cavium: Return negative value when pci_alloc_irq_vectors() fails Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 027/323] scsi: qla2xxx: Fix unmap of already freed sgl Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 028/323] cavium: Fix return values of the probe function Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 029/323] sfc: Dont use netif_info before net_device setup Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 030/323] hyperv/vmbus: include linux/bitops.h Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 031/323] mmc: winbond: dont build on M68K Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 032/323] drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 033/323] bpf: Prevent increasing bpf_jit_limit above max Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 034/323] xen/netfront: stop tx queues during live migration Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 035/323] spi: spl022: fix Microwire full duplex mode Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 036/323] watchdog: Fix OMAP watchdog early handling Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 037/323] vmxnet3: do not stop tx queues after netif_device_detach() Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 038/323] btrfs: clear MISSING device status bit in btrfs_close_one_device Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 039/323] btrfs: fix lost error handling when replaying directory deletes Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 040/323] btrfs: call btrfs_check_rw_degradable only if there is a missing device Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 041/323] ia64: kprobes: Fix to pass correct trampoline address to the handler Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 042/323] hwmon: (pmbus/lm25066) Add offset coefficients Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 043/323] regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 044/323] regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 045/323] EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 046/323] mwifiex: fix division by zero in fw download path Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 047/323] ath6kl: fix division by zero in send path Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 048/323] ath6kl: fix control-message timeout Greg Kroah-Hartman
2021-11-24 11:53 ` [PATCH 4.19 049/323] ath10k: " Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 050/323] ath10k: fix division by zero in send path Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 051/323] PCI: Mark Atheros QCA6174 to avoid bus reset Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 052/323] rtl8187: fix control-message timeouts Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 053/323] evm: mark evm_fixmode as __ro_after_init Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 054/323] wcn36xx: Fix HT40 capability for 2Ghz band Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 055/323] mwifiex: Read a PCI register after writing the TX ring write pointer Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 056/323] libata: fix checking of DMA state Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 057/323] wcn36xx: handle connection loss indication Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 058/323] rsi: fix occasional initialisation failure with BT coex Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 059/323] rsi: fix key enabled check causing unwanted encryption for vap_id > 0 Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 060/323] rsi: fix rate mask set leading to P2P failure Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 061/323] rsi: Fix module dev_oper_mode parameter description Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 062/323] RDMA/qedr: Fix NULL deref for query_qp on the GSI QP Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 063/323] signal: Remove the bogus sigkill_pending in ptrace_stop Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 064/323] signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 065/323] power: supply: max17042_battery: Prevent int underflow in set_soc_threshold Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 066/323] power: supply: max17042_battery: use VFSOC for capacity when no rsns Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 067/323] powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 068/323] serial: core: Fix initializing and restoring termios speed Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 069/323] ALSA: mixer: oss: Fix racy access to slots Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 070/323] ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 071/323] xen/balloon: add late_initcall_sync() for initial ballooning done Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 072/323] PCI: aardvark: Do not clear status bits of masked interrupts Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 073/323] PCI: aardvark: Do not unmask unused interrupts Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 074/323] PCI: aardvark: Fix return value of MSI domain .alloc() method Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 075/323] PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 076/323] quota: check block number when reading the block in quota file Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 077/323] quota: correct error number in free_dqentry() Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 078/323] pinctrl: core: fix possible memory leak in pinctrl_enable() Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 079/323] iio: dac: ad5446: Fix ad5622_write() return value Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 080/323] USB: serial: keyspan: fix memleak on probe errors Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 081/323] USB: iowarrior: fix control-message timeouts Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 082/323] drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 083/323] Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 084/323] Bluetooth: fix use-after-free error in lock_sock_nested() Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 085/323] platform/x86: wmi: do not fail if disabling fails Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 086/323] MIPS: lantiq: dma: add small delay after reset Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 087/323] MIPS: lantiq: dma: reset correct number of channel Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 088/323] locking/lockdep: Avoid RCU-induced noinstr fail Greg Kroah-Hartman
2021-11-28 9:46 ` Salvatore Bonaccorso
2021-11-28 11:59 ` Salvatore Bonaccorso
2021-11-28 12:11 ` Salvatore Bonaccorso
2021-11-28 13:06 ` Greg Kroah-Hartman
2021-11-28 13:08 ` Greg Kroah-Hartman
2021-11-29 18:30 ` Salvatore Bonaccorso
2021-11-30 7:57 ` Greg Kroah-Hartman
2021-12-04 10:30 ` Salvatore Bonaccorso
2021-11-24 11:54 ` [PATCH 4.19 089/323] net: sched: update default qdisc visibility after Tx queue cnt changes Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 090/323] smackfs: Fix use-after-free in netlbl_catmap_walk() Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 091/323] x86: Increase exception stack sizes Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 092/323] mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 093/323] mwifiex: Properly initialize private structure on interface type changes Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 094/323] media: mt9p031: Fix corrupted frame after restarting stream Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 095/323] media: netup_unidvb: handle interrupt properly according to the firmware Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 096/323] media: uvcvideo: Set capability in s_param Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 097/323] media: uvcvideo: Return -EIO for control errors Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 098/323] media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 099/323] media: s5p-mfc: Add checking to s5p_mfc_probe() Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 100/323] media: mceusb: return without resubmitting URB in case of -EPROTO error Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 101/323] ia64: dont do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 102/323] media: rcar-csi2: Add checking to rcsi2_start_receiver() Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 103/323] ACPICA: Avoid evaluating methods too early during system resume Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 104/323] media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 105/323] tracefs: Have tracefs directories not set OTH permission bits by default Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 106/323] ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 107/323] ACPI: battery: Accept charges over the design capacity as full Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 108/323] leaking_addresses: Always print a trailing newline Greg Kroah-Hartman
2021-11-24 11:54 ` [PATCH 4.19 109/323] memstick: r592: Fix a UAF bug when removing the driver Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 110/323] lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 111/323] lib/xz: Validate the value before assigning it to an enum variable Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 112/323] workqueue: make sysfs of unbound kworker cpumask more clever Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 113/323] tracing/cfi: Fix cmp_entries_* functions signature mismatch Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 114/323] mwl8k: Fix use-after-free in mwl8k_fw_state_machine() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 115/323] PM: hibernate: Get block device exclusively in swsusp_check() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 116/323] iwlwifi: mvm: disable RX-diversity in powersave Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 117/323] smackfs: use __GFP_NOFAIL for smk_cipso_doi() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 118/323] ARM: clang: Do not rely on lr register for stacktrace Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 119/323] gre/sit: Dont generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 120/323] ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 121/323] spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 122/323] x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 123/323] parisc: fix warning in flush_tlb_all Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 124/323] task_stack: Fix end_of_stack() for architectures with upwards-growing stack Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 125/323] parisc/unwind: fix unwinder when CONFIG_64BIT is enabled Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 126/323] parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 127/323] Bluetooth: fix init and cleanup of sco_conn.timeout_work Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 128/323] cgroup: Make rebind_subsystems() disable v2 controllers all at once Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 129/323] net: dsa: rtl8366rb: Fix off-by-one bug Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 130/323] drm/amdgpu: fix warning for overflow check Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 131/323] media: em28xx: add missing em28xx_close_extension Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 132/323] media: dvb-usb: fix ununit-value in az6027_rc_query Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 133/323] media: mtk-vpu: Fix a resource leak in the error handling path of mtk_vpu_probe() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 134/323] media: si470x: Avoid card name truncation Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 135/323] media: cx23885: Fix snd_card_free call on null card pointer Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 136/323] cpuidle: Fix kobject memory leaks in error paths Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 137/323] media: em28xx: Dont use ops->suspend if it is NULL Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 138/323] ath9k: Fix potential interrupt storm on queue reset Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 139/323] media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 140/323] crypto: qat - detect PFVF collision after ACK Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 141/323] crypto: qat - disregard spurious PFVF interrupts Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 142/323] hwrng: mtk - Force runtime pm ops for sleep ops Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 143/323] b43legacy: fix a lower bounds test Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 144/323] b43: " Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 145/323] mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 146/323] memstick: avoid out-of-range warning Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 147/323] memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 148/323] hwmon: Fix possible memleak in __hwmon_device_register() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 149/323] hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 150/323] ath10k: fix max antenna gain unit Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 151/323] drm/msm: uninitialized variable in msm_gem_import() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 152/323] net: stream: dont purge sk_error_queue in sk_stream_kill_queues() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 153/323] mmc: mxs-mmc: disable regulator on error and in the remove function Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 154/323] platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 155/323] rsi: stop thread firstly in rsi_91x_init() error handling Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 156/323] mwifiex: Send DELBA requests according to spec Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 157/323] phy: micrel: ksz8041nl: do not use power down mode Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 158/323] nvme-rdma: fix error code in nvme_rdma_setup_ctrl Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 159/323] PM: hibernate: fix sparse warnings Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 160/323] clocksource/drivers/timer-ti-dm: Select TIMER_OF Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 161/323] drm/msm: Fix potential NULL dereference in DPU SSPP Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 162/323] smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 163/323] s390/gmap: dont unconditionally call pte_unmap_unlock() in __gmap_zap() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 164/323] irq: mips: avoid nested irq_enter() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 165/323] tcp: dont free a FIN sk_buff in tcp_remove_empty_skb() Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 166/323] samples/kretprobes: Fix return value if register_kretprobe() failed Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 167/323] KVM: s390: Fix handle_sske page fault handling Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 168/323] libertas_tf: Fix possible memory leak in probe and disconnect Greg Kroah-Hartman
2021-11-24 11:55 ` [PATCH 4.19 169/323] libertas: " Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 170/323] wcn36xx: add proper DMA memory barriers in rx path Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 171/323] net: amd-xgbe: Toggle PLL settings during rate change Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 172/323] net: phylink: avoid mvneta warning when setting pause parameters Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 173/323] crypto: pcrypt - Delay write to padata->info Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 174/323] selftests/bpf: Fix fclose/pclose mismatch in test_progs Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 175/323] ibmvnic: Process crqs after enabling interrupts Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 176/323] RDMA/rxe: Fix wrong port_cap_flags Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 177/323] ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 178/323] arm64: dts: rockchip: Fix GPU register width for RK3328 Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 179/323] RDMA/bnxt_re: Fix query SRQ failure Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 180/323] ARM: dts: at91: tse850: the emac<->phy interface is rmii Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 181/323] scsi: dc395: Fix error case unwinding Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 182/323] MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 183/323] JFS: fix memleak in jfs_mount Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 184/323] ALSA: hda: Reduce udelay() at SKL+ position reporting Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 185/323] arm: dts: omap3-gta04a4: accelerometer irq fix Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 186/323] soc/tegra: Fix an error handling path in tegra_powergate_power_up() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 187/323] memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 188/323] video: fbdev: chipsfb: use memset_io() instead of memset() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 189/323] serial: 8250_dw: Drop wrong use of ACPI_PTR() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 190/323] usb: gadget: hid: fix error code in do_config() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 191/323] =?UTF-8?q?power:=20supply:=20rt5033=5Fbattery:=20Change=20voltage?= =?UTF-8?q?=20values=20to=20=C2=B5V?= Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 192/323] scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 193/323] RDMA/mlx4: Return missed an error if device doesnt support steering Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 194/323] ASoC: cs42l42: Correct some register default values Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 195/323] ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 196/323] phy: qcom-qusb2: Fix a memory leak on probe Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 197/323] serial: xilinx_uartps: Fix race condition causing stuck TX Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 198/323] mips: cm: Convert to bitfield API to fix out-of-bounds access Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 199/323] power: supply: bq27xxx: Fix kernel crash on IRQ handler register error Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 200/323] apparmor: fix error check Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 201/323] rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 202/323] pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 203/323] drm/plane-helper: fix uninitialized variable reference Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 204/323] PCI: aardvark: Dont spam about PIO Response Status Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 205/323] NFS: Fix deadlocks in nfs_scan_commit_list() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 206/323] fs: orangefs: fix error return code of orangefs_revalidate_lookup() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 207/323] mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 208/323] dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 209/323] auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 210/323] auxdisplay: ht16k33: Connect backlight to fbdev Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 211/323] auxdisplay: ht16k33: Fix frame buffer device blanking Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 212/323] netfilter: nfnetlink_queue: fix OOB when mac header was cleared Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 213/323] dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 214/323] m68k: set a default value for MEMORY_RESERVE Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 215/323] watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 216/323] ar7: fix kernel builds for compiler test Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 217/323] scsi: qla2xxx: Fix gnl list corruption Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 218/323] scsi: qla2xxx: Turn off target reset during issue_lip Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 219/323] i2c: xlr: Fix a resource leak in the error handling path of xlr_i2c_probe() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 220/323] xen-pciback: Fix return in pm_ctrl_init() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 221/323] net: davinci_emac: Fix interrupt pacing disable Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 222/323] net: vlan: fix a UAF in vlan_dev_real_dev() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 223/323] ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 224/323] bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 225/323] mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 226/323] zram: off by one in read_block_state() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 227/323] llc: fix out-of-bound array index in llc_sk_dev_hash() Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 228/323] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails Greg Kroah-Hartman
2021-11-24 11:56 ` [PATCH 4.19 229/323] arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 230/323] vsock: prevent unnecessary refcnt inc for nonblocking connect Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 231/323] cxgb4: fix eeprom len when diagnostics not implemented Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 232/323] USB: chipidea: fix interrupt deadlock Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 233/323] ARM: 9155/1: fix early early_iounmap() Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 234/323] ARM: 9156/1: drop cc-option fallbacks for architecture selection Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 235/323] f2fs: should use GFP_NOFS for directory inodes Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 236/323] 9p/net: fix missing error check in p9_check_errors Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 237/323] powerpc/lib: Add helper to check if offset is within conditional branch range Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 238/323] powerpc/bpf: Validate branch ranges Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 239/323] powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 240/323] powerpc/security: Add a helper to query stf_barrier type Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 241/323] powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 242/323] mm, oom: pagefault_out_of_memory: dont force global OOM for dying tasks Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 243/323] mm, oom: do not trigger out_of_memory from the #PF Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 244/323] backlight: gpio-backlight: Correct initial power state handling Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 245/323] video: backlight: Drop maximum brightness override for brightness zero Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 246/323] s390/cio: check the subchannel validity for dev_busid Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 247/323] s390/tape: fix timer initialization in tape_std_assign() Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 248/323] PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 249/323] fuse: truncate pagecache on atomic_o_trunc Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 250/323] x86/cpu: Fix migration safety with X86_BUG_NULL_SEL Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 251/323] ext4: fix lazy initialization next schedule time computation in more granular unit Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 252/323] fortify: Explicitly disable Clang support Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 253/323] parisc/entry: fix trace test in syscall exit path Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 254/323] PCI/MSI: Destroy sysfs before freeing entries Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 255/323] PCI/MSI: Deal with devices lying about their MSI mask capability Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 256/323] PCI: Add MSI masking quirk for Nvidia ION AHCI Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 257/323] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 258/323] erofs: fix unsafe pagevec reuse of hooked pclusters Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 259/323] arm64: zynqmp: Do not duplicate flash partition label property Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 260/323] arm64: zynqmp: Fix serial compatible string Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 261/323] scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 262/323] arm64: dts: hisilicon: fix arm,sp805 compatible string Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 263/323] usb: musb: tusb6010: check return value after calling platform_get_resource() Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 264/323] usb: typec: tipd: Remove WARN_ON in tps6598x_block_read Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 265/323] arm64: dts: freescale: fix arm,sp805 compatible string Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 266/323] ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 267/323] scsi: advansys: Fix kernel pointer leak Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 268/323] firmware_loader: fix pre-allocated buf built-in firmware use Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 269/323] ARM: dts: omap: fix gpmc,mux-add-data type Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 270/323] usb: host: ohci-tmio: check return value after calling platform_get_resource() Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 271/323] ALSA: ISA: not for M68K Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 272/323] tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 273/323] MIPS: sni: Fix the build Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 274/323] scsi: target: Fix ordered tag handling Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 275/323] scsi: target: Fix alua_tg_pt_gps_count tracking Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 276/323] powerpc/5200: dts: fix memory node unit name Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 277/323] ALSA: gus: fix null pointer dereference on pointer block Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 278/323] powerpc/dcr: Use cmplwi instead of 3-argument cmpli Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 279/323] sh: check return code of request_irq Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 280/323] maple: fix wrong return value of maple_bus_init() Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 281/323] f2fs: fix up f2fs_lookup tracepoints Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 282/323] sh: fix kconfig unmet dependency warning for FRAME_POINTER Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 283/323] sh: define __BIG_ENDIAN for math-emu Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 284/323] mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 285/323] sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 286/323] drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 287/323] net: bnx2x: fix variable dereferenced before check Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 288/323] iavf: check for null in iavf_fix_features Greg Kroah-Hartman
2021-11-24 11:57 ` [PATCH 4.19 289/323] iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 290/323] MIPS: generic/yamon-dt: fix uninitialized variable error Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 291/323] mips: bcm63xx: add support for clk_get_parent() Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 292/323] mips: lantiq: " Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 293/323] platform/x86: hp_accel: Fix an error handling path in lis3lv02d_probe() Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 294/323] net: virtio_net_hdr_to_skb: count transport header in UFO Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 295/323] i40e: Fix correct max_pkt_size on VF RX queue Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 296/323] i40e: Fix NULL ptr dereference on VSI filter sync Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 297/323] i40e: Fix changing previously set num_queue_pairs for PFs Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 298/323] i40e: Fix display error code in dmesg Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 299/323] NFC: reorganize the functions in nci_request Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 300/323] NFC: reorder the logic in nfc_{un,}register_device Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 301/323] perf bench: Fix two memory leaks detected with ASan Greg Kroah-Hartman
[not found] ` <CAOz-JA4kZFoOig-aNu0yai+DE81XbNBkWUAaAYgUW4TQSCoY3g@mail.gmail.com>
2021-11-24 13:13 ` Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 302/323] perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 303/323] perf/x86/intel/uncore: Fix IIO event constraints for " Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 304/323] tun: fix bonding active backup with arp monitoring Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 305/323] hexagon: export raw I/O routines for modules Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 306/323] ipc: WARN if trying to remove ipc object which is absent Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 307/323] mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 308/323] x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 309/323] udf: Fix crash after seekdir Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 310/323] btrfs: fix memory ordering between normal and ordered work functions Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 311/323] parisc/sticon: fix reverse colors Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 312/323] cfg80211: call cfg80211_stop_ap when switch from P2P_GO type Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 313/323] drm/udl: fix control-message timeout Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 314/323] drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 315/323] perf/core: Avoid put_page() when GUP fails Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 316/323] batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 317/323] batman-adv: Consider fragmentation for needed_headroom Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 318/323] batman-adv: Reserve needed_*room for fragments Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 319/323] batman-adv: Dont always reallocate the fragmentation skb head Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 320/323] RDMA/netlink: Add __maybe_unused to static inline in C file Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 321/323] ASoC: DAPM: Cover regression by kctl change notification fix Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 322/323] usb: max-3421: Use driver data instead of maintaining a list of bound devices Greg Kroah-Hartman
2021-11-24 11:58 ` [PATCH 4.19 323/323] hugetlbfs: flush TLBs correctly after huge_pmd_unshare Greg Kroah-Hartman
2021-11-24 15:33 ` [PATCH 4.19 000/323] 4.19.218-rc1 review Naresh Kamboju
2021-11-25 11:13 ` Greg Kroah-Hartman
2021-11-25 1:27 ` Samuel Zou
2021-11-25 1:40 ` Guenter Roeck
2021-11-25 11:13 ` Greg Kroah-Hartman
2021-11-25 3:45 ` Naresh Kamboju
2021-11-25 11:15 ` Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).