* [PATCH 4.14 01/60] ah6: fix error return code in ah6_input()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 02/60] atm: nicstar: Unmap DMA on send error Greg Kroah-Hartman
` (61 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong, Jakub Kicinski
From: Zhang Changzhong <zhangchangzhong@huawei.com>
[ Upstream commit a5ebcbdf34b65fcc07f38eaf2d60563b42619a59 ]
Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1605581105-35295-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ah6.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -599,7 +599,8 @@ static int ah6_input(struct xfrm_state *
memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
memset(ah->auth_data, 0, ahp->icv_trunc_len);
- if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN))
+ err = ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN);
+ if (err)
goto out_free;
ip6h->priority = 0;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 02/60] atm: nicstar: Unmap DMA on send error
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 01/60] ah6: fix error return code in ah6_input() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 03/60] bnxt_en: read EEPROM A2h address using page 0 Greg Kroah-Hartman
` (60 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chas Williams,
Sebastian Andrzej Siewior, Jakub Kicinski
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 6dceaa9f56e22d0f9b4c4ad2ed9e04e315ce7fe5 ]
The `skb' is mapped for DMA in ns_send() but does not unmap DMA in case
push_scqe() fails to submit the `skb'. The memory of the `skb' is
released so only the DMA mapping is leaking.
Unmap the DMA mapping in case push_scqe() failed.
Fixes: 864a3ff635fa7 ("atm: [nicstar] remove virt_to_bus() and support 64-bit platforms")
Cc: Chas Williams <3chas3@gmail.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/atm/nicstar.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -1707,6 +1707,8 @@ static int ns_send(struct atm_vcc *vcc,
if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
atomic_inc(&vcc->stats->tx_err);
+ dma_unmap_single(&card->pcidev->dev, NS_PRV_DMA(skb), skb->len,
+ DMA_TO_DEVICE);
dev_kfree_skb_any(skb);
return -EIO;
}
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 03/60] bnxt_en: read EEPROM A2h address using page 0
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 01/60] ah6: fix error return code in ah6_input() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 02/60] atm: nicstar: Unmap DMA on send error Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 04/60] devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() Greg Kroah-Hartman
` (59 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Edwin Peer, Michael Chan, Jakub Kicinski
From: Edwin Peer <edwin.peer@broadcom.com>
[ Upstream commit 4260330b32b14330cfe427d568ac5f5b29b5be3d ]
The module eeprom address range returned by bnxt_get_module_eeprom()
should be 256 bytes of A0h address space, the lower half of the A2h
address space, and page 0 for the upper half of the A2h address space.
Fix the firmware call by passing page_number 0 for the A2h slave address
space.
Fixes: 42ee18fe4ca2 ("bnxt_en: Add Support for ETHTOOL_GMODULEINFO and ETHTOOL_GMODULEEEPRO")
Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -2168,7 +2168,7 @@ static int bnxt_get_module_eeprom(struct
/* Read A2 portion of the EEPROM */
if (length) {
start -= ETH_MODULE_SFF_8436_LEN;
- rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 1,
+ rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 0,
start, length, data);
}
return rc;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 04/60] devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 03/60] bnxt_en: read EEPROM A2h address using page 0 Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 05/60] inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() Greg Kroah-Hartman
` (58 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Jakub Kicinski
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit 849920c703392957f94023f77ec89ca6cf119d43 ]
If sb_occ_port_pool_get() failed in devlink_nl_sb_port_pool_fill(),
msg should be canceled by genlmsg_cancel().
Fixes: df38dafd2559 ("devlink: implement shared buffer occupancy monitoring interface")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20201113111622.11040-1-wanghai38@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/devlink.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1031,7 +1031,7 @@ static int devlink_nl_sb_port_pool_fill(
err = ops->sb_occ_port_pool_get(devlink_port, devlink_sb->index,
pool_index, &cur, &max);
if (err && err != -EOPNOTSUPP)
- return err;
+ goto sb_occ_get_failure;
if (!err) {
if (nla_put_u32(msg, DEVLINK_ATTR_SB_OCC_CUR, cur))
goto nla_put_failure;
@@ -1044,8 +1044,10 @@ static int devlink_nl_sb_port_pool_fill(
return 0;
nla_put_failure:
+ err = -EMSGSIZE;
+sb_occ_get_failure:
genlmsg_cancel(msg, hdr);
- return -EMSGSIZE;
+ return err;
}
static int devlink_nl_cmd_sb_port_pool_get_doit(struct sk_buff *skb,
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 05/60] inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 04/60] devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 06/60] mlxsw: core: Use variable timeout for EMAD retries Greg Kroah-Hartman
` (57 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Jakub Kicinski
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit e33de7c5317e2827b2ba6fd120a505e9eb727b05 ]
nlmsg_cancel() needs to be called in the error path of
inet_req_diag_fill to cancel the message.
Fixes: d545caca827b ("net: inet: diag: expose the socket mark to privileged processes.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20201116082018.16496-1-wanghai38@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/inet_diag.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -393,8 +393,10 @@ static int inet_req_diag_fill(struct soc
r->idiag_inode = 0;
if (net_admin && nla_put_u32(skb, INET_DIAG_MARK,
- inet_rsk(reqsk)->ir_mark))
+ inet_rsk(reqsk)->ir_mark)) {
+ nlmsg_cancel(skb, nlh);
return -EMSGSIZE;
+ }
nlmsg_end(skb, nlh);
return 0;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 06/60] mlxsw: core: Use variable timeout for EMAD retries
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 05/60] inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 07/60] net: b44: fix error return code in b44_init_one() Greg Kroah-Hartman
` (56 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Denis Yulevich, Ido Schimmel,
Jiri Pirko, Jakub Kicinski
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 1f492eab67bced119a0ac7db75ef2047e29a30c6 ]
The driver sends Ethernet Management Datagram (EMAD) packets to the
device for configuration purposes and waits for up to 200ms for a reply.
A request is retried up to 5 times.
When the system is under heavy load, replies are not always processed in
time and EMAD transactions fail.
Make the process more robust to such delays by using exponential
backoff. First wait for up to 200ms, then retransmit and wait for up to
400ms and so on.
Fixes: caf7297e7ab5 ("mlxsw: core: Introduce support for asynchronous EMAD register access")
Reported-by: Denis Yulevich <denisyu@nvidia.com>
Tested-by: Denis Yulevich <denisyu@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlxsw/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -471,7 +471,8 @@ static void mlxsw_emad_trans_timeout_sch
if (trans->core->fw_flash_in_progress)
timeout = msecs_to_jiffies(MLXSW_EMAD_TIMEOUT_DURING_FW_FLASH_MS);
- queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw, timeout);
+ queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw,
+ timeout << trans->retries);
}
static int mlxsw_emad_transmit(struct mlxsw_core *mlxsw_core,
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 07/60] net: b44: fix error return code in b44_init_one()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 06/60] mlxsw: core: Use variable timeout for EMAD retries Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 08/60] net: bridge: add missing counters to ndo_get_stats64 callback Greg Kroah-Hartman
` (55 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
Michael Chan, Jakub Kicinski
From: Zhang Changzhong <zhangchangzhong@huawei.com>
[ Upstream commit 7b027c249da54f492699c43e26cba486cfd48035 ]
Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.
Fixes: 39a6f4bce6b4 ("b44: replace the ssb_dma API with the generic DMA API")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/1605582131-36735-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/b44.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -2391,7 +2391,8 @@ static int b44_init_one(struct ssb_devic
goto err_out_free_dev;
}
- if (dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30))) {
+ err = dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30));
+ if (err) {
dev_err(sdev->dev,
"Required 30BIT DMA mask unsupported by the system\n");
goto err_out_powerdown;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 08/60] net: bridge: add missing counters to ndo_get_stats64 callback
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 07/60] net: b44: fix error return code in b44_init_one() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 09/60] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 Greg Kroah-Hartman
` (54 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Heiner Kallweit, Jakub Kicinski
From: Heiner Kallweit <hkallweit1@gmail.com>
[ Upstream commit 7a30ecc9237681bb125cbd30eee92bef7e86293d ]
In br_forward.c and br_input.c fields dev->stats.tx_dropped and
dev->stats.multicast are populated, but they are ignored in
ndo_get_stats64.
Fixes: 28172739f0a2 ("net: fix 64 bit counters on 32 bit arches")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/58ea9963-77ad-a7cf-8dfd-fc95ab95f606@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/br_device.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -186,6 +186,7 @@ static void br_get_stats64(struct net_de
sum.rx_packets += tmp.rx_packets;
}
+ netdev_stats_to_stats64(stats, &dev->stats);
stats->tx_bytes = sum.tx_bytes;
stats->tx_packets = sum.tx_packets;
stats->rx_bytes = sum.rx_bytes;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 09/60] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 08/60] net: bridge: add missing counters to ndo_get_stats64 callback Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 10/60] net: Have netpoll bring-up DSA management interface Greg Kroah-Hartman
` (53 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tobias Waldekranz, Jakub Kicinski
From: Tobias Waldekranz <tobias@waldekranz.com>
[ Upstream commit 92307069a96c07d9b6e74b96b79390e7cd7d2111 ]
As soon as you add the second port to a VLAN, all other port
membership configuration is overwritten with zeroes. The HW interprets
this as all ports being "unmodified members" of the VLAN.
In the simple case when all ports belong to the same VLAN, switching
will still work. But using multiple VLANs or trying to set multiple
ports as tagged members will not work.
On the 6352, doing a VTU GetNext op, followed by an STU GetNext op
will leave you with both the member- and state- data in the VTU/STU
data registers. But on the 6097 (which uses the same implementation),
the STU GetNext will override the information gathered from the VTU
GetNext.
Separate the two stages, parsing the result of the VTU GetNext before
doing the STU GetNext.
We opt to update the existing implementation for all applicable chips,
as opposed to creating a separate callback for 6097, because although
the previous implementation did work for (at least) 6352, the
datasheet does not mention the masking behavior.
Fixes: ef6fcea37f01 ("net: dsa: mv88e6xxx: get STU entry on VTU GetNext")
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Link: https://lore.kernel.org/r/20201112114335.27371-1-tobias@waldekranz.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/dsa/mv88e6xxx/global1_vtu.c | 59 ++++++++++++++++++++++++++------
1 file changed, 49 insertions(+), 10 deletions(-)
--- a/drivers/net/dsa/mv88e6xxx/global1_vtu.c
+++ b/drivers/net/dsa/mv88e6xxx/global1_vtu.c
@@ -124,11 +124,9 @@ static int mv88e6xxx_g1_vtu_vid_write(st
* Offset 0x08: VTU/STU Data Register 2
* Offset 0x09: VTU/STU Data Register 3
*/
-
-static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip,
- struct mv88e6xxx_vtu_entry *entry)
+static int mv88e6185_g1_vtu_stu_data_read(struct mv88e6xxx_chip *chip,
+ u16 *regs)
{
- u16 regs[3];
int i;
/* Read all 3 VTU/STU Data registers */
@@ -141,12 +139,45 @@ static int mv88e6185_g1_vtu_data_read(st
return err;
}
- /* Extract MemberTag and PortState data */
+ return 0;
+}
+
+static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip,
+ struct mv88e6xxx_vtu_entry *entry)
+{
+ u16 regs[3];
+ int err;
+ int i;
+
+ err = mv88e6185_g1_vtu_stu_data_read(chip, regs);
+ if (err)
+ return err;
+
+ /* Extract MemberTag data */
for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) {
unsigned int member_offset = (i % 4) * 4;
- unsigned int state_offset = member_offset + 2;
entry->member[i] = (regs[i / 4] >> member_offset) & 0x3;
+ }
+
+ return 0;
+}
+
+static int mv88e6185_g1_stu_data_read(struct mv88e6xxx_chip *chip,
+ struct mv88e6xxx_vtu_entry *entry)
+{
+ u16 regs[3];
+ int err;
+ int i;
+
+ err = mv88e6185_g1_vtu_stu_data_read(chip, regs);
+ if (err)
+ return err;
+
+ /* Extract PortState data */
+ for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) {
+ unsigned int state_offset = (i % 4) * 4 + 2;
+
entry->state[i] = (regs[i / 4] >> state_offset) & 0x3;
}
@@ -319,6 +350,10 @@ int mv88e6185_g1_vtu_getnext(struct mv88
if (err)
return err;
+ err = mv88e6185_g1_stu_data_read(chip, entry);
+ if (err)
+ return err;
+
/* VTU DBNum[3:0] are located in VTU Operation 3:0
* VTU DBNum[7:4] are located in VTU Operation 11:8
*/
@@ -344,16 +379,20 @@ int mv88e6352_g1_vtu_getnext(struct mv88
return err;
if (entry->valid) {
- /* Fetch (and mask) VLAN PortState data from the STU */
- err = mv88e6xxx_g1_vtu_stu_get(chip, entry);
+ err = mv88e6185_g1_vtu_data_read(chip, entry);
if (err)
return err;
- err = mv88e6185_g1_vtu_data_read(chip, entry);
+ err = mv88e6xxx_g1_vtu_fid_read(chip, entry);
if (err)
return err;
- err = mv88e6xxx_g1_vtu_fid_read(chip, entry);
+ /* Fetch VLAN PortState data from the STU */
+ err = mv88e6xxx_g1_vtu_stu_get(chip, entry);
+ if (err)
+ return err;
+
+ err = mv88e6185_g1_stu_data_read(chip, entry);
if (err)
return err;
}
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 10/60] net: Have netpoll bring-up DSA management interface
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 09/60] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 11/60] netlabel: fix our progress tracking in netlbl_unlabel_staticlist() Greg Kroah-Hartman
` (52 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Florian Fainelli,
Jakub Kicinski
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit 1532b9778478577152201adbafa7738b1e844868 ]
DSA network devices rely on having their DSA management interface up and
running otherwise their ndo_open() will return -ENETDOWN. Without doing
this it would not be possible to use DSA devices as netconsole when
configured on the command line. These devices also do not utilize the
upper/lower linking so the check about the netpoll device having upper
is not going to be a problem.
The solution adopted here is identical to the one done for
net/ipv4/ipconfig.c with 728c02089a0e ("net: ipv4: handle DSA enabled
master network devices"), with the network namespace scope being
restricted to that of the process configuring netpoll.
Fixes: 04ff53f96a93 ("net: dsa: Add netconsole support")
Tested-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201117035236.22658-1-f.fainelli@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/netpoll.c | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -28,6 +28,7 @@
#include <linux/slab.h>
#include <linux/export.h>
#include <linux/if_vlan.h>
+#include <net/dsa.h>
#include <net/tcp.h>
#include <net/udp.h>
#include <net/addrconf.h>
@@ -661,15 +662,15 @@ EXPORT_SYMBOL_GPL(__netpoll_setup);
int netpoll_setup(struct netpoll *np)
{
- struct net_device *ndev = NULL;
+ struct net_device *ndev = NULL, *dev = NULL;
+ struct net *net = current->nsproxy->net_ns;
struct in_device *in_dev;
int err;
rtnl_lock();
- if (np->dev_name[0]) {
- struct net *net = current->nsproxy->net_ns;
+ if (np->dev_name[0])
ndev = __dev_get_by_name(net, np->dev_name);
- }
+
if (!ndev) {
np_err(np, "%s doesn't exist, aborting\n", np->dev_name);
err = -ENODEV;
@@ -677,6 +678,19 @@ int netpoll_setup(struct netpoll *np)
}
dev_hold(ndev);
+ /* bring up DSA management network devices up first */
+ for_each_netdev(net, dev) {
+ if (!netdev_uses_dsa(dev))
+ continue;
+
+ err = dev_change_flags(dev, dev->flags | IFF_UP);
+ if (err < 0) {
+ np_err(np, "%s failed to open %s\n",
+ np->dev_name, dev->name);
+ goto put;
+ }
+ }
+
if (netdev_master_upper_dev_get(ndev)) {
np_err(np, "%s is a slave device, aborting\n", np->dev_name);
err = -EBUSY;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 11/60] netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 10/60] net: Have netpoll bring-up DSA management interface Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 12/60] netlabel: fix an uninitialized warning " Greg Kroah-Hartman
` (51 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Moore, Jakub Kicinski
From: Paul Moore <paul@paul-moore.com>
[ Upstream commit 866358ec331f8faa394995fb4b511af1db0247c8 ]
The current NetLabel code doesn't correctly keep track of the netlink
dump state in some cases, in particular when multiple interfaces with
large configurations are loaded. The problem manifests itself by not
reporting the full configuration to userspace, even though it is
loaded and active in the kernel. This patch fixes this by ensuring
that the dump state is properly reset when necessary inside the
netlbl_unlabel_staticlist() function.
Fixes: 8cc44579d1bd ("NetLabel: Introduce static network labels for unlabeled connections")
Signed-off-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/160484450633.3752.16512718263560813473.stgit@sifl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netlabel/netlabel_unlabeled.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1179,12 +1179,13 @@ static int netlbl_unlabel_staticlist(str
struct netlbl_unlhsh_walk_arg cb_arg;
u32 skip_bkt = cb->args[0];
u32 skip_chain = cb->args[1];
- u32 iter_bkt;
- u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
+ u32 skip_addr4 = cb->args[2];
+ u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0;
struct netlbl_unlhsh_iface *iface;
struct list_head *iter_list;
struct netlbl_af4list *addr4;
#if IS_ENABLED(CONFIG_IPV6)
+ u32 skip_addr6 = cb->args[3];
struct netlbl_af6list *addr6;
#endif
@@ -1195,7 +1196,7 @@ static int netlbl_unlabel_staticlist(str
rcu_read_lock();
for (iter_bkt = skip_bkt;
iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
- iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
+ iter_bkt++) {
iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
list_for_each_entry_rcu(iface, iter_list, list) {
if (!iface->valid ||
@@ -1203,7 +1204,7 @@ static int netlbl_unlabel_staticlist(str
continue;
netlbl_af4list_foreach_rcu(addr4,
&iface->addr4_list) {
- if (iter_addr4++ < cb->args[2])
+ if (iter_addr4++ < skip_addr4)
continue;
if (netlbl_unlabel_staticlist_gen(
NLBL_UNLABEL_C_STATICLIST,
@@ -1216,10 +1217,12 @@ static int netlbl_unlabel_staticlist(str
goto unlabel_staticlist_return;
}
}
+ iter_addr4 = 0;
+ skip_addr4 = 0;
#if IS_ENABLED(CONFIG_IPV6)
netlbl_af6list_foreach_rcu(addr6,
&iface->addr6_list) {
- if (iter_addr6++ < cb->args[3])
+ if (iter_addr6++ < skip_addr6)
continue;
if (netlbl_unlabel_staticlist_gen(
NLBL_UNLABEL_C_STATICLIST,
@@ -1232,8 +1235,12 @@ static int netlbl_unlabel_staticlist(str
goto unlabel_staticlist_return;
}
}
+ iter_addr6 = 0;
+ skip_addr6 = 0;
#endif /* IPv6 */
}
+ iter_chain = 0;
+ skip_chain = 0;
}
unlabel_staticlist_return:
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 12/60] netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 11/60] netlabel: fix our progress tracking in netlbl_unlabel_staticlist() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 13/60] net/mlx4_core: Fix init_hca fields offset Greg Kroah-Hartman
` (50 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Paul Moore,
James Morris, Jakub Kicinski
From: Paul Moore <paul@paul-moore.com>
[ Upstream commit 1ba86d4366e023d96df3dbe415eea7f1dc08c303 ]
Static checking revealed that a previous fix to
netlbl_unlabel_staticlist() leaves a stack variable uninitialized,
this patches fixes that.
Fixes: 866358ec331f ("netlabel: fix our progress tracking in netlbl_unlabel_staticlist()")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Reviewed-by: James Morris <jamorris@linux.microsoft.com>
Link: https://lore.kernel.org/r/160530304068.15651.18355773009751195447.stgit@sifl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netlabel/netlabel_unlabeled.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1180,7 +1180,7 @@ static int netlbl_unlabel_staticlist(str
u32 skip_bkt = cb->args[0];
u32 skip_chain = cb->args[1];
u32 skip_addr4 = cb->args[2];
- u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0;
+ u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
struct netlbl_unlhsh_iface *iface;
struct list_head *iter_list;
struct netlbl_af4list *addr4;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 13/60] net/mlx4_core: Fix init_hca fields offset
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 12/60] netlabel: fix an uninitialized warning " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 14/60] net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request Greg Kroah-Hartman
` (49 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aya Levin, Moshe Shemesh,
Eran Ben Elisha, Tariq Toukan, Jakub Kicinski
From: Aya Levin <ayal@nvidia.com>
[ Upstream commit 6d9c8d15af0ef20a66a0b432cac0d08319920602 ]
Slave function read the following capabilities from the wrong offset:
1. log_mc_entry_sz
2. fs_log_entry_sz
3. log_mc_hash_sz
Fix that by adjusting these capabilities offset to match firmware
layout.
Due to the wrong offset read, the following issues might occur:
1+2. Negative value reported at max_mcast_qp_attach.
3. Driver to init FW with multicast hash size of zero.
Fixes: a40ded604365 ("net/mlx4_core: Add masking for a few queries on HCA caps")
Signed-off-by: Aya Levin <ayal@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Eran Ben Elisha <eranbe@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://lore.kernel.org/r/20201118081922.553-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +++---
drivers/net/ethernet/mellanox/mlx4/fw.h | 4 ++--
2 files changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -1854,14 +1854,14 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev,
#define INIT_HCA_LOG_RD_OFFSET (INIT_HCA_QPC_OFFSET + 0x77)
#define INIT_HCA_MCAST_OFFSET 0x0c0
#define INIT_HCA_MC_BASE_OFFSET (INIT_HCA_MCAST_OFFSET + 0x00)
-#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x12)
-#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x16)
+#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x13)
+#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x17)
#define INIT_HCA_UC_STEERING_OFFSET (INIT_HCA_MCAST_OFFSET + 0x18)
#define INIT_HCA_LOG_MC_TABLE_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x1b)
#define INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN 0x6
#define INIT_HCA_FS_PARAM_OFFSET 0x1d0
#define INIT_HCA_FS_BASE_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x00)
-#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x12)
+#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x13)
#define INIT_HCA_FS_A0_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x18)
#define INIT_HCA_FS_LOG_TABLE_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x1b)
#define INIT_HCA_FS_ETH_BITS_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x21)
--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
@@ -181,8 +181,8 @@ struct mlx4_init_hca_param {
u64 cmpt_base;
u64 mtt_base;
u64 global_caps;
- u16 log_mc_entry_sz;
- u16 log_mc_hash_sz;
+ u8 log_mc_entry_sz;
+ u8 log_mc_hash_sz;
u16 hca_core_clock; /* Internal Clock Frequency (in MHz) */
u8 log_num_qps;
u8 log_num_srqs;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 14/60] net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 13/60] net/mlx4_core: Fix init_hca fields offset Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 15/60] qlcnic: fix error return code in qlcnic_83xx_restart_hw() Greg Kroah-Hartman
` (48 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin Schiller, Xie He, Jakub Kicinski
From: Xie He <xie.he.0141@gmail.com>
[ Upstream commit 4ee18c179e5e815fa5575e0d2db0c05795a804ee ]
The x25_disconnect function in x25_subr.c would decrease the refcount of
"x25->neighbour" (struct x25_neigh) and reset this pointer to NULL.
However, the x25_rx_call_request function in af_x25.c, which is called
when we receive a connection request, does not increase the refcount when
it assigns the pointer.
Fix this issue by increasing the refcount of "struct x25_neigh" in
x25_rx_call_request.
This patch fixes frequent kernel crashes when using AF_X25 sockets.
Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
Cc: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Link: https://lore.kernel.org/r/20201112103506.5875-1-xie.he.0141@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/x25/af_x25.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1048,6 +1048,7 @@ int x25_rx_call_request(struct sk_buff *
makex25->lci = lci;
makex25->dest_addr = dest_addr;
makex25->source_addr = source_addr;
+ x25_neigh_hold(nb);
makex25->neighbour = nb;
makex25->facilities = facilities;
makex25->dte_facilities= dte_facilities;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 15/60] qlcnic: fix error return code in qlcnic_83xx_restart_hw()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 14/60] net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 16/60] sctp: change to hold/put transport for proto_unreach_timer Greg Kroah-Hartman
` (47 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong, Jakub Kicinski
From: Zhang Changzhong <zhangchangzhong@huawei.com>
[ Upstream commit 3beb9be165083c2964eba1923601c3bfac0b02d4 ]
Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.
Fixes: 3ced0a88cd4c ("qlcnic: Add support to run firmware POST")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1605248186-16013-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -2251,7 +2251,8 @@ static int qlcnic_83xx_restart_hw(struct
/* Boot either flash image or firmware image from host file system */
if (qlcnic_load_fw_file == 1) {
- if (qlcnic_83xx_load_fw_image_from_host(adapter))
+ err = qlcnic_83xx_load_fw_image_from_host(adapter);
+ if (err)
return err;
} else {
QLC_SHARED_REG_WR32(adapter, QLCNIC_FW_IMG_VALID,
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 16/60] sctp: change to hold/put transport for proto_unreach_timer
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 15/60] qlcnic: fix error return code in qlcnic_83xx_restart_hw() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 4.14 17/60] net/mlx5: Disable QoS when min_rates on all VFs are zero Greg Kroah-Hartman
` (46 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hangbin Liu, Xin Long,
Marcelo Ricardo Leitner, Jakub Kicinski
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit 057a10fa1f73d745c8e69aa54ab147715f5630ae ]
A call trace was found in Hangbin's Codenomicon testing with debug kernel:
[ 2615.981988] ODEBUG: free active (active state 0) object type: timer_list hint: sctp_generate_proto_unreach_event+0x0/0x3a0 [sctp]
[ 2615.995050] WARNING: CPU: 17 PID: 0 at lib/debugobjects.c:328 debug_print_object+0x199/0x2b0
[ 2616.095934] RIP: 0010:debug_print_object+0x199/0x2b0
[ 2616.191533] Call Trace:
[ 2616.194265] <IRQ>
[ 2616.202068] debug_check_no_obj_freed+0x25e/0x3f0
[ 2616.207336] slab_free_freelist_hook+0xeb/0x140
[ 2616.220971] kfree+0xd6/0x2c0
[ 2616.224293] rcu_do_batch+0x3bd/0xc70
[ 2616.243096] rcu_core+0x8b9/0xd00
[ 2616.256065] __do_softirq+0x23d/0xacd
[ 2616.260166] irq_exit+0x236/0x2a0
[ 2616.263879] smp_apic_timer_interrupt+0x18d/0x620
[ 2616.269138] apic_timer_interrupt+0xf/0x20
[ 2616.273711] </IRQ>
This is because it holds asoc when transport->proto_unreach_timer starts
and puts asoc when the timer stops, and without holding transport the
transport could be freed when the timer is still running.
So fix it by holding/putting transport instead for proto_unreach_timer
in transport, just like other timers in transport.
v1->v2:
- Also use sctp_transport_put() for the "out_unlock:" path in
sctp_generate_proto_unreach_event(), as Marcelo noticed.
Fixes: 50b5d6ad6382 ("sctp: Fix a race between ICMP protocol unreachable and connect()")
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://lore.kernel.org/r/102788809b554958b13b95d33440f5448113b8d6.1605331373.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/input.c | 4 ++--
net/sctp/sm_sideeffect.c | 4 ++--
net/sctp/transport.c | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -453,7 +453,7 @@ void sctp_icmp_proto_unreachable(struct
else {
if (!mod_timer(&t->proto_unreach_timer,
jiffies + (HZ/20)))
- sctp_association_hold(asoc);
+ sctp_transport_hold(t);
}
} else {
struct net *net = sock_net(sk);
@@ -462,7 +462,7 @@ void sctp_icmp_proto_unreachable(struct
"encountered!\n", __func__);
if (del_timer(&t->proto_unreach_timer))
- sctp_association_put(asoc);
+ sctp_transport_put(t);
sctp_do_sm(net, SCTP_EVENT_T_OTHER,
SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -418,7 +418,7 @@ void sctp_generate_proto_unreach_event(u
/* Try again later. */
if (!mod_timer(&transport->proto_unreach_timer,
jiffies + (HZ/20)))
- sctp_association_hold(asoc);
+ sctp_transport_hold(transport);
goto out_unlock;
}
@@ -434,7 +434,7 @@ void sctp_generate_proto_unreach_event(u
out_unlock:
bh_unlock_sock(sk);
- sctp_association_put(asoc);
+ sctp_transport_put(transport);
}
/* Handle the timeout of the RE-CONFIG timer. */
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -151,7 +151,7 @@ void sctp_transport_free(struct sctp_tra
/* Delete the ICMP proto unreachable timer if it's active. */
if (del_timer(&transport->proto_unreach_timer))
- sctp_association_put(transport->asoc);
+ sctp_transport_put(transport);
sctp_transport_put(transport);
}
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 17/60] net/mlx5: Disable QoS when min_rates on all VFs are zero
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 16/60] sctp: change to hold/put transport for proto_unreach_timer Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 18/60] net: usb: qmi_wwan: Set DTR quirk for MR400 Greg Kroah-Hartman
` (45 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladyslav Tarasiuk, Moshe Shemesh,
Saeed Mahameed
From: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
[ Upstream commit 470b74758260e4abc2508cf1614573c00a00465c ]
Currently when QoS is enabled for VF and any min_rate is configured,
the driver sets bw_share value to at least 1 and doesn’t allow to set
it to 0 to make minimal rate unlimited. It means there is always a
minimal rate configured for every VF, even if user tries to remove it.
In order to make QoS disable possible, check whether all vports have
configured min_rate = 0. If this is true, set their bw_share to 0 to
disable min_rate limitations.
Fixes: c9497c98901c ("net/mlx5: Add support for setting VF min rate")
Signed-off-by: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1921,12 +1921,15 @@ static u32 calculate_vports_min_rate_div
max_guarantee = evport->info.min_rate;
}
- return max_t(u32, max_guarantee / fw_max_bw_share, 1);
+ if (max_guarantee)
+ return max_t(u32, max_guarantee / fw_max_bw_share, 1);
+ return 0;
}
-static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider)
+static int normalize_vports_min_rate(struct mlx5_eswitch *esw)
{
u32 fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share);
+ u32 divider = calculate_vports_min_rate_divider(esw);
struct mlx5_vport *evport;
u32 vport_max_rate;
u32 vport_min_rate;
@@ -1940,9 +1943,9 @@ static int normalize_vports_min_rate(str
continue;
vport_min_rate = evport->info.min_rate;
vport_max_rate = evport->info.max_rate;
- bw_share = MLX5_MIN_BW_SHARE;
+ bw_share = 0;
- if (vport_min_rate)
+ if (divider)
bw_share = MLX5_RATE_TO_BW_SHARE(vport_min_rate,
divider,
fw_max_bw_share);
@@ -1967,7 +1970,6 @@ int mlx5_eswitch_set_vport_rate(struct m
struct mlx5_vport *evport;
u32 fw_max_bw_share;
u32 previous_min_rate;
- u32 divider;
bool min_rate_supported;
bool max_rate_supported;
int err = 0;
@@ -1993,8 +1995,7 @@ int mlx5_eswitch_set_vport_rate(struct m
previous_min_rate = evport->info.min_rate;
evport->info.min_rate = min_rate;
- divider = calculate_vports_min_rate_divider(esw);
- err = normalize_vports_min_rate(esw, divider);
+ err = normalize_vports_min_rate(esw);
if (err) {
evport->info.min_rate = previous_min_rate;
goto unlock;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 18/60] net: usb: qmi_wwan: Set DTR quirk for MR400
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2020-11-23 12:21 ` [PATCH 4.14 17/60] net/mlx5: Disable QoS when min_rates on all VFs are zero Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 19/60] tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Greg Kroah-Hartman
` (44 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Filip Moc, Bjørn Mork, Jakub Kicinski
From: Filip Moc <dev@moc6.cz>
[ Upstream commit df8d85d8c69d6837817e54dcb73c84a8b5a13877 ]
LTE module MR400 embedded in TL-MR6400 v4 requires DTR to be set.
Signed-off-by: Filip Moc <dev@moc6.cz>
Acked-by: Bjørn Mork <bjorn@mork.no>
Link: https://lore.kernel.org/r/20201117173631.GA550981@moc6.cz
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/qmi_wwan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1029,7 +1029,7 @@ static const struct usb_device_id produc
{QMI_FIXED_INTF(0x05c6, 0x9011, 4)},
{QMI_FIXED_INTF(0x05c6, 0x9021, 1)},
{QMI_FIXED_INTF(0x05c6, 0x9022, 2)},
- {QMI_FIXED_INTF(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */
+ {QMI_QUIRK_SET_DTR(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */
{QMI_FIXED_INTF(0x05c6, 0x9026, 3)},
{QMI_FIXED_INTF(0x05c6, 0x902e, 5)},
{QMI_FIXED_INTF(0x05c6, 0x9031, 5)},
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 19/60] tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 18/60] net: usb: qmi_wwan: Set DTR quirk for MR400 Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 20/60] net: ftgmac100: Fix crash when removing driver Greg Kroah-Hartman
` (43 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ryan Sharpelletti, Neal Cardwell,
Soheil Hassas Yeganeh, Yuchung Cheng, Jakub Kicinski
From: Ryan Sharpelletti <sharpelletti@google.com>
[ Upstream commit 1b9e2a8c99a5c021041bfb2d512dc3ed92a94ffd ]
During loss recovery, retransmitted packets are forced to use TCP
timestamps to calculate the RTT samples, which have a millisecond
granularity. BBR is designed using a microsecond granularity. As a
result, multiple RTT samples could be truncated to the same RTT value
during loss recovery. This is problematic, as BBR will not enter
PROBE_RTT if the RTT sample is <= the current min_rtt sample, meaning
that if there are persistent losses, PROBE_RTT will constantly be
pushed off and potentially never re-entered. This patch makes sure
that BBR enters PROBE_RTT by checking if RTT sample is < the current
min_rtt sample, rather than <=.
The Netflix transport/TCP team discovered this bug in the Linux TCP
BBR code during lab tests.
Fixes: 0f8782ea1497 ("tcp_bbr: add BBR congestion control")
Signed-off-by: Ryan Sharpelletti <sharpelletti@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Link: https://lore.kernel.org/r/20201116174412.1433277-1-sharpelletti.kdev@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_bbr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -769,7 +769,7 @@ static void bbr_update_min_rtt(struct so
filter_expired = after(tcp_jiffies32,
bbr->min_rtt_stamp + bbr_min_rtt_win_sec * HZ);
if (rs->rtt_us >= 0 &&
- (rs->rtt_us <= bbr->min_rtt_us || filter_expired)) {
+ (rs->rtt_us < bbr->min_rtt_us || filter_expired)) {
bbr->min_rtt_us = rs->rtt_us;
bbr->min_rtt_stamp = tcp_jiffies32;
}
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 20/60] net: ftgmac100: Fix crash when removing driver
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 19/60] tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 21/60] pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq Greg Kroah-Hartman
` (42 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joel Stanley, Jakub Kicinski
From: Joel Stanley <joel@jms.id.au>
[ Upstream commit 3d5179458d22dc0b4fdc724e4bed4231a655112a ]
When removing the driver we would hit BUG_ON(!list_empty(&dev->ptype_specific))
in net/core/dev.c due to still having the NC-SI packet handler
registered.
# echo 1e660000.ethernet > /sys/bus/platform/drivers/ftgmac100/unbind
------------[ cut here ]------------
kernel BUG at net/core/dev.c:10254!
Internal error: Oops - BUG: 0 [#1] SMP ARM
CPU: 0 PID: 115 Comm: sh Not tainted 5.10.0-rc3-next-20201111-00007-g02e0365710c4 #46
Hardware name: Generic DT based system
PC is at netdev_run_todo+0x314/0x394
LR is at cpumask_next+0x20/0x24
pc : [<806f5830>] lr : [<80863cb0>] psr: 80000153
sp : 855bbd58 ip : 00000001 fp : 855bbdac
r10: 80c03d00 r9 : 80c06228 r8 : 81158c54
r7 : 00000000 r6 : 80c05dec r5 : 80c05d18 r4 : 813b9280
r3 : 813b9054 r2 : 8122c470 r1 : 00000002 r0 : 00000002
Flags: Nzcv IRQs on FIQs off Mode SVC_32 ISA ARM Segment none
Control: 00c5387d Table: 85514008 DAC: 00000051
Process sh (pid: 115, stack limit = 0x7cb5703d)
...
Backtrace:
[<806f551c>] (netdev_run_todo) from [<80707eec>] (rtnl_unlock+0x18/0x1c)
r10:00000051 r9:854ed710 r8:81158c54 r7:80c76bb0 r6:81158c10 r5:8115b410
r4:813b9000
[<80707ed4>] (rtnl_unlock) from [<806f5db8>] (unregister_netdev+0x2c/0x30)
[<806f5d8c>] (unregister_netdev) from [<805a8180>] (ftgmac100_remove+0x20/0xa8)
r5:8115b410 r4:813b9000
[<805a8160>] (ftgmac100_remove) from [<805355e4>] (platform_drv_remove+0x34/0x4c)
Fixes: bd466c3fb5a4 ("net/faraday: Support NCSI mode")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20201117024448.1170761-1-joel@jms.id.au
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/faraday/ftgmac100.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -1860,6 +1860,8 @@ static int ftgmac100_probe(struct platfo
return 0;
err_ncsi_dev:
+ if (priv->ndev)
+ ncsi_unregister_dev(priv->ndev);
err_register_netdev:
ftgmac100_destroy_mdio(netdev);
err_setup_mdio:
@@ -1880,6 +1882,8 @@ static int ftgmac100_remove(struct platf
netdev = platform_get_drvdata(pdev);
priv = netdev_priv(netdev);
+ if (priv->ndev)
+ ncsi_unregister_dev(priv->ndev);
unregister_netdev(netdev);
/* There's a small chance the reset task will have been re-queued,
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 21/60] pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 20/60] net: ftgmac100: Fix crash when removing driver Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 22/60] arm64: psci: Avoid printing in cpu_psci_cpu_die() Greg Kroah-Hartman
` (41 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jianqun Xu, Heiko Stuebner,
Kever Yang, Linus Walleij, Sasha Levin
From: Jianqun Xu <jay.xu@rock-chips.com>
[ Upstream commit 63fbf8013b2f6430754526ef9594f229c7219b1f ]
There need to enable pclk_gpio when do irq_create_mapping, since it will
do access to gpio controller.
Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Kever Yang<kever.yang@rock-chips.com>
Link: https://lore.kernel.org/r/20201013063731.3618-3-jay.xu@rock-chips.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-rockchip.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index 5d6cf024ee9c8..26974973ecdde 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -2547,7 +2547,9 @@ static int rockchip_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
if (!bank->domain)
return -ENXIO;
+ clk_enable(bank->clk);
virq = irq_create_mapping(bank->domain, offset);
+ clk_disable(bank->clk);
return (virq) ? : -ENXIO;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 22/60] arm64: psci: Avoid printing in cpu_psci_cpu_die()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 21/60] pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 23/60] vfs: remove lockdep bogosity in __sb_start_write Greg Kroah-Hartman
` (40 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qian Cai, Paul E. McKenney,
Catalin Marinas, Will Deacon, Sasha Levin
From: Will Deacon <will@kernel.org>
[ Upstream commit 891deb87585017d526b67b59c15d38755b900fea ]
cpu_psci_cpu_die() is called in the context of the dying CPU, which
will no longer be online or tracked by RCU. It is therefore not generally
safe to call printk() if the PSCI "cpu off" request fails, so remove the
pr_crit() invocation.
Cc: Qian Cai <cai@redhat.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20201106103602.9849-2-will@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/psci.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
index 3856d51c645b5..3ebb2a56e5f7b 100644
--- a/arch/arm64/kernel/psci.c
+++ b/arch/arm64/kernel/psci.c
@@ -69,7 +69,6 @@ static int cpu_psci_cpu_disable(unsigned int cpu)
static void cpu_psci_cpu_die(unsigned int cpu)
{
- int ret;
/*
* There are no known implementations of PSCI actually using the
* power state field, pass a sensible default for now.
@@ -77,9 +76,7 @@ static void cpu_psci_cpu_die(unsigned int cpu)
u32 state = PSCI_POWER_STATE_TYPE_POWER_DOWN <<
PSCI_0_2_POWER_STATE_TYPE_SHIFT;
- ret = psci_ops.cpu_off(state);
-
- pr_crit("unable to power off CPU%u (%d)\n", cpu, ret);
+ psci_ops.cpu_off(state);
}
static int cpu_psci_cpu_kill(unsigned int cpu)
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 23/60] vfs: remove lockdep bogosity in __sb_start_write
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 22/60] arm64: psci: Avoid printing in cpu_psci_cpu_die() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 24/60] Input: adxl34x - clean up a data type in adxl34x_probe() Greg Kroah-Hartman
` (39 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Darrick J. Wong, Christoph Hellwig,
Jan Kara, Sasha Levin
From: Darrick J. Wong <darrick.wong@oracle.com>
[ Upstream commit 22843291efc986ce7722610073fcf85a39b4cb13 ]
__sb_start_write has some weird looking lockdep code that claims to
exist to handle nested freeze locking requests from xfs. The code as
written seems broken -- if we think we hold a read lock on any of the
higher freeze levels (e.g. we hold SB_FREEZE_WRITE and are trying to
lock SB_FREEZE_PAGEFAULT), it converts a blocking lock attempt into a
trylock.
However, it's not correct to downgrade a blocking lock attempt to a
trylock unless the downgrading code or the callers are prepared to deal
with that situation. Neither __sb_start_write nor its callers handle
this at all. For example:
sb_start_pagefault ignores the return value completely, with the result
that if xfs_filemap_fault loses a race with a different thread trying to
fsfreeze, it will proceed without pagefault freeze protection (thereby
breaking locking rules) and then unlocks the pagefault freeze lock that
it doesn't own on its way out (thereby corrupting the lock state), which
leads to a system hang shortly afterwards.
Normally, this won't happen because our ownership of a read lock on a
higher freeze protection level blocks fsfreeze from grabbing a write
lock on that higher level. *However*, if lockdep is offline,
lock_is_held_type unconditionally returns 1, which means that
percpu_rwsem_is_held returns 1, which means that __sb_start_write
unconditionally converts blocking freeze lock attempts into trylocks,
even when we *don't* hold anything that would block a fsfreeze.
Apparently this all held together until 5.10-rc1, when bugs in lockdep
caused lockdep to shut itself off early in an fstests run, and once
fstests gets to the "race writes with freezer" tests, kaboom. This
might explain the long trail of vanishingly infrequent livelocks in
fstests after lockdep goes offline that I've never been able to
diagnose.
We could fix it by spinning on the trylock if wait==true, but AFAICT the
locking works fine if lockdep is not built at all (and I didn't see any
complaints running fstests overnight), so remove this snippet entirely.
NOTE: Commit f4b554af9931 in 2015 created the current weird logic (which
used to exist in a different form in commit 5accdf82ba25c from 2012) in
__sb_start_write. XFS solved this whole problem in the late 2.6 era by
creating a variant of transactions (XFS_TRANS_NO_WRITECOUNT) that don't
grab intwrite freeze protection, thus making lockdep's solution
unnecessary. The commit claims that Dave Chinner explained that the
trylock hack + comment could be removed, but nobody ever did.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/super.c | 33 ++++-----------------------------
1 file changed, 4 insertions(+), 29 deletions(-)
diff --git a/fs/super.c b/fs/super.c
index 219f7ca7c5d29..1d7461bca1600 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1336,36 +1336,11 @@ EXPORT_SYMBOL(__sb_end_write);
*/
int __sb_start_write(struct super_block *sb, int level, bool wait)
{
- bool force_trylock = false;
- int ret = 1;
+ if (!wait)
+ return percpu_down_read_trylock(sb->s_writers.rw_sem + level-1);
-#ifdef CONFIG_LOCKDEP
- /*
- * We want lockdep to tell us about possible deadlocks with freezing
- * but it's it bit tricky to properly instrument it. Getting a freeze
- * protection works as getting a read lock but there are subtle
- * problems. XFS for example gets freeze protection on internal level
- * twice in some cases, which is OK only because we already hold a
- * freeze protection also on higher level. Due to these cases we have
- * to use wait == F (trylock mode) which must not fail.
- */
- if (wait) {
- int i;
-
- for (i = 0; i < level - 1; i++)
- if (percpu_rwsem_is_held(sb->s_writers.rw_sem + i)) {
- force_trylock = true;
- break;
- }
- }
-#endif
- if (wait && !force_trylock)
- percpu_down_read(sb->s_writers.rw_sem + level-1);
- else
- ret = percpu_down_read_trylock(sb->s_writers.rw_sem + level-1);
-
- WARN_ON(force_trylock && !ret);
- return ret;
+ percpu_down_read(sb->s_writers.rw_sem + level-1);
+ return 1;
}
EXPORT_SYMBOL(__sb_start_write);
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 24/60] Input: adxl34x - clean up a data type in adxl34x_probe()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 23/60] vfs: remove lockdep bogosity in __sb_start_write Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 25/60] MIPS: export has_transparent_hugepage() for modules Greg Kroah-Hartman
` (38 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Michael Hennerich,
Dmitry Torokhov, Sasha Levin
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ]
The "revid" is used to store negative error codes so it should be an int
type.
Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/misc/adxl34x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
index 2b2d02f408bbb..2e189646d8fe2 100644
--- a/drivers/input/misc/adxl34x.c
+++ b/drivers/input/misc/adxl34x.c
@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
struct input_dev *input_dev;
const struct adxl34x_platform_data *pdata;
int err, range, i;
- unsigned char revid;
+ int revid;
if (!irq) {
dev_err(dev, "no IRQ?\n");
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 25/60] MIPS: export has_transparent_hugepage() for modules
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 24/60] Input: adxl34x - clean up a data type in adxl34x_probe() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 26/60] arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy Greg Kroah-Hartman
` (37 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Randy Dunlap,
Thomas Bogendoerfer, linux-mips, Dan Williams, Vishal Verma,
Dave Jiang, linux-nvdimm, Hugh Dickins, Andrew Morton,
Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 31b4d8e172f614adc53ddecb4b6b2f6411a49b84 ]
MIPS should export its local version of "has_transparent_hugepage"
so that loadable modules (dax) can use it.
Fixes this build error:
ERROR: modpost: "has_transparent_hugepage" [drivers/dax/dax.ko] undefined!
Fixes: fd8cfd300019 ("arch: fix has_transparent_hugepage()")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: linux-mips@vger.kernel.org
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: linux-nvdimm@lists.01.org
Cc: Hugh Dickins <hughd@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/mm/tlb-r4k.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index 0596505770dba..11985399c4695 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -424,6 +424,7 @@ int has_transparent_hugepage(void)
}
return mask == PM_HUGE_MASK;
}
+EXPORT_SYMBOL(has_transparent_hugepage);
#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 26/60] arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 25/60] MIPS: export has_transparent_hugepage() for modules Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 27/60] ARM: dts: imx50-evk: Fix the chip select 1 IOMUX Greg Kroah-Hartman
` (36 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergey Matyukevich, Fabio Estevam,
Shawn Guo, Sasha Levin
From: Sergey Matyukevich <geomatsi@gmail.com>
[ Upstream commit 7dd8f0ba88fce98e2953267a66af74c6f4792a56 ]
Commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the
KSZ9031 PHY") fixed micrel phy driver adding proper support for phy
modes. Adapt imx6q-udoo board phy settings : explicitly set required
delay configuration using "rgmii-id".
Fixes: cbd54fe0b2bc ("ARM: dts: imx6dl-udoo: Add board support based off imx6q-udoo")
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
index c96c91d836785..fc4ae2e423bd7 100644
--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
@@ -94,7 +94,7 @@
&fec {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_enet>;
- phy-mode = "rgmii";
+ phy-mode = "rgmii-id";
status = "okay";
};
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 27/60] ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 26/60] arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 28/60] perf lock: Dont free "lock_seq_stat" if read_count isnt zero Greg Kroah-Hartman
` (35 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Shawn Guo, Sasha Levin
From: Fabio Estevam <festevam@gmail.com>
[ Upstream commit 33d0d843872c5ddbe28457a92fc6f2487315fb9f ]
The SPI chip selects are represented as:
cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>, <&gpio4 13 GPIO_ACTIVE_LOW>;
, which means that they are used in GPIO function instead of native
SPI mode.
Fix the IOMUX for the chip select 1 to use GPIO4_13 instead of
the native CSPI_SSI function.
Fixes: c605cbf5e135 ("ARM: dts: imx: add device tree support for Freescale imx50evk board")
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx50-evk.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
index 98b5faa06e27e..07b8870dfff13 100644
--- a/arch/arm/boot/dts/imx50-evk.dts
+++ b/arch/arm/boot/dts/imx50-evk.dts
@@ -65,7 +65,7 @@
MX50_PAD_CSPI_MISO__CSPI_MISO 0x00
MX50_PAD_CSPI_MOSI__CSPI_MOSI 0x00
MX50_PAD_CSPI_SS0__GPIO4_11 0xc4
- MX50_PAD_ECSPI1_MOSI__CSPI_SS1 0xf4
+ MX50_PAD_ECSPI1_MOSI__GPIO4_13 0x84
>;
};
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 28/60] perf lock: Dont free "lock_seq_stat" if read_count isnt zero
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 27/60] ARM: dts: imx50-evk: Fix the chip select 1 IOMUX Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 29/60] can: af_can: prevent potential access of uninitialized member in can_rcv() Greg Kroah-Hartman
` (34 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Leo Yan, Jiri Olsa,
Arnaldo Carvalho de Melo, Sasha Levin
From: Leo Yan <leo.yan@linaro.org>
[ Upstream commit b0e5a05cc9e37763c7f19366d94b1a6160c755bc ]
When execute command "perf lock report", it hits failure and outputs log
as follows:
perf: builtin-lock.c:623: report_lock_release_event: Assertion `!(seq->read_count < 0)' failed.
Aborted
This is an imbalance issue. The locking sequence structure
"lock_seq_stat" contains the reader counter and it is used to check if
the locking sequence is balance or not between acquiring and releasing.
If the tool wrongly frees "lock_seq_stat" when "read_count" isn't zero,
the "read_count" will be reset to zero when allocate a new structure at
the next time; thus it causes the wrong counting for reader and finally
results in imbalance issue.
To fix this issue, if detects "read_count" is not zero (means still have
read user in the locking sequence), goto the "end" tag to skip freeing
structure "lock_seq_stat".
Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence")
Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Link: https://lore.kernel.org/r/20201104094229.17509-2-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-lock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
index fe69cd6b89e1a..6140b0548ad7d 100644
--- a/tools/perf/builtin-lock.c
+++ b/tools/perf/builtin-lock.c
@@ -620,7 +620,7 @@ static int report_lock_release_event(struct perf_evsel *evsel,
case SEQ_STATE_READ_ACQUIRED:
seq->read_count--;
BUG_ON(seq->read_count < 0);
- if (!seq->read_count) {
+ if (seq->read_count) {
ls->nr_release++;
goto end;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 29/60] can: af_can: prevent potential access of uninitialized member in can_rcv()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 28/60] perf lock: Dont free "lock_seq_stat" if read_count isnt zero Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 30/60] can: af_can: prevent potential access of uninitialized member in canfd_rcv() Greg Kroah-Hartman
` (33 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+9bcb0c9409066696d3aa,
Anant Thazhemadam, Marc Kleine-Budde, Sasha Levin
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
[ Upstream commit c8c958a58fc67f353289986850a0edf553435702 ]
In can_rcv(), cfd->len is uninitialized when skb->len = 0, and this
uninitialized cfd->len is accessed nonetheless by pr_warn_once().
Fix this uninitialized variable access by checking cfd->len's validity
condition (cfd->len > CAN_MAX_DLEN) separately after the skb->len's
condition is checked, and appropriately modify the log messages that
are generated as well.
In case either of the required conditions fail, the skb is freed and
NET_RX_DROP is returned, same as before.
Fixes: 8cb68751c115 ("can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once")
Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201103213906.24219-2-anant.thazhemadam@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/af_can.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 46c85731d16f0..e1cf5c300bacc 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -722,16 +722,25 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
{
struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU ||
- cfd->len > CAN_MAX_DLEN)) {
- pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n",
+ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU)) {
+ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n",
+ dev->type, skb->len);
+ goto free_skb;
+ }
+
+ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
+ if (unlikely(cfd->len > CAN_MAX_DLEN)) {
+ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d, datalen %d\n",
dev->type, skb->len, cfd->len);
- kfree_skb(skb);
- return NET_RX_DROP;
+ goto free_skb;
}
can_receive(skb, dev);
return NET_RX_SUCCESS;
+
+free_skb:
+ kfree_skb(skb);
+ return NET_RX_DROP;
}
static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 30/60] can: af_can: prevent potential access of uninitialized member in canfd_rcv()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 29/60] can: af_can: prevent potential access of uninitialized member in can_rcv() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 31/60] can: dev: can_restart(): post buffer from the right context Greg Kroah-Hartman
` (32 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+9bcb0c9409066696d3aa,
Anant Thazhemadam, Marc Kleine-Budde, Sasha Levin
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
[ Upstream commit 9aa9379d8f868e91719333a7f063ccccc0579acc ]
In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this
uninitialized cfd->len is accessed nonetheless by pr_warn_once().
Fix this uninitialized variable access by checking cfd->len's validity
condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's
condition is checked, and appropriately modify the log messages that
are generated as well.
In case either of the required conditions fail, the skb is freed and
NET_RX_DROP is returned, same as before.
Fixes: d4689846881d ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once")
Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/can/af_can.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/net/can/af_can.c b/net/can/af_can.c
index e1cf5c300bacc..ec04a33cd333c 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -748,16 +748,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
{
struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU ||
- cfd->len > CANFD_MAX_DLEN)) {
- pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n",
+ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) {
+ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n",
+ dev->type, skb->len);
+ goto free_skb;
+ }
+
+ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
+ if (unlikely(cfd->len > CANFD_MAX_DLEN)) {
+ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n",
dev->type, skb->len, cfd->len);
- kfree_skb(skb);
- return NET_RX_DROP;
+ goto free_skb;
}
can_receive(skb, dev);
return NET_RX_SUCCESS;
+
+free_skb:
+ kfree_skb(skb);
+ return NET_RX_DROP;
}
/*
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 31/60] can: dev: can_restart(): post buffer from the right context
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 30/60] can: af_can: prevent potential access of uninitialized member in canfd_rcv() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 32/60] can: ti_hecc: Fix memleak in ti_hecc_probe Greg Kroah-Hartman
` (31 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Loris Fauster,
Alejandro Concepcion Rodriguez, Marc Kleine-Budde, Sasha Levin
From: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
[ Upstream commit a1e654070a60d5d4f7cce59c38f4ca790bb79121 ]
netif_rx() is meant to be called from interrupt contexts. can_restart() may be
called by can_restart_work(), which is called from a worqueue, so it may run in
process context. Use netif_rx_ni() instead.
Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
Co-developed-by: Loris Fauster <loris.fauster@ttcontrol.com>
Signed-off-by: Loris Fauster <loris.fauster@ttcontrol.com>
Signed-off-by: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
Link: https://lore.kernel.org/r/4e84162b-fb31-3a73-fa9a-9438b4bd5234@acoro.eu
[mkl: use netif_rx_ni() instead of netif_rx_any_context()]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index e79965a390aab..c483c4b787fee 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -578,7 +578,7 @@ static void can_restart(struct net_device *dev)
}
cf->can_id |= CAN_ERR_RESTARTED;
- netif_rx(skb);
+ netif_rx_ni(skb);
stats->rx_packets++;
stats->rx_bytes += cf->can_dlc;
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 32/60] can: ti_hecc: Fix memleak in ti_hecc_probe
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 31/60] can: dev: can_restart(): post buffer from the right context Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 33/60] can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() Greg Kroah-Hartman
` (30 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Marc Kleine-Budde, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit 7968c7c79d3be8987feb8021f0c46e6866831408 ]
In the error handling, we should goto the probe_exit_candev
to free ndev to prevent memory leak.
Fixes: dabf54dd1c63 ("can: ti_hecc: Convert TI HECC driver to DT only driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201114111708.3465543-1-zhangqilong3@huawei.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/ti_hecc.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index db6ea936dc3fc..81a3fdd5e0103 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -903,7 +903,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
priv->base = devm_ioremap_resource(&pdev->dev, res);
if (IS_ERR(priv->base)) {
dev_err(&pdev->dev, "hecc ioremap failed\n");
- return PTR_ERR(priv->base);
+ err = PTR_ERR(priv->base);
+ goto probe_exit_candev;
}
/* handle hecc-ram memory */
@@ -916,7 +917,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
priv->hecc_ram = devm_ioremap_resource(&pdev->dev, res);
if (IS_ERR(priv->hecc_ram)) {
dev_err(&pdev->dev, "hecc-ram ioremap failed\n");
- return PTR_ERR(priv->hecc_ram);
+ err = PTR_ERR(priv->hecc_ram);
+ goto probe_exit_candev;
}
/* handle mbx memory */
@@ -929,13 +931,14 @@ static int ti_hecc_probe(struct platform_device *pdev)
priv->mbx = devm_ioremap_resource(&pdev->dev, res);
if (IS_ERR(priv->mbx)) {
dev_err(&pdev->dev, "mbx ioremap failed\n");
- return PTR_ERR(priv->mbx);
+ err = PTR_ERR(priv->mbx);
+ goto probe_exit_candev;
}
irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
if (!irq) {
dev_err(&pdev->dev, "No irq resource\n");
- goto probe_exit;
+ goto probe_exit_candev;
}
priv->ndev = ndev;
@@ -988,7 +991,7 @@ probe_exit_clk:
clk_put(priv->clk);
probe_exit_candev:
free_candev(ndev);
-probe_exit:
+
return err;
}
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 33/60] can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 32/60] can: ti_hecc: Fix memleak in ti_hecc_probe Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 34/60] can: peak_usb: fix potential integer overflow on shift of a int Greg Kroah-Hartman
` (29 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Remigiusz Kołłątaj,
Marc Kleine-Budde, Sasha Levin
From: Marc Kleine-Budde <mkl@pengutronix.de>
[ Upstream commit 81c9c8e0adef3285336b942f93287c554c89e6c6 ]
The driver has to first fill the skb with data and then handle it to
can_put_echo_skb(). This patch moves the can_put_echo_skb() down, right before
sending the skb out via USB.
Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
Cc: Remigiusz Kołłątaj <remigiusz.kollataj@mobica.com>
Link: https://lore.kernel.org/r/20201111221204.1639007-1-mkl@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/mcba_usb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
index 070e1ba797369..a09e3f6c2c504 100644
--- a/drivers/net/can/usb/mcba_usb.c
+++ b/drivers/net/can/usb/mcba_usb.c
@@ -337,8 +337,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
if (!ctx)
return NETDEV_TX_BUSY;
- can_put_echo_skb(skb, priv->netdev, ctx->ndx);
-
if (cf->can_id & CAN_EFF_FLAG) {
/* SIDH | SIDL | EIDH | EIDL
* 28 - 21 | 20 19 18 x x x 17 16 | 15 - 8 | 7 - 0
@@ -368,6 +366,8 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
if (cf->can_id & CAN_RTR_FLAG)
usb_msg.dlc |= MCBA_DLC_RTR_MASK;
+ can_put_echo_skb(skb, priv->netdev, ctx->ndx);
+
err = mcba_usb_xmit(priv, (struct mcba_usb_msg *)&usb_msg, ctx);
if (err)
goto xmit_failed;
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 34/60] can: peak_usb: fix potential integer overflow on shift of a int
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 33/60] can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 35/60] can: m_can: m_can_handle_state_change(): fix state change Greg Kroah-Hartman
` (28 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Colin Ian King, Marc Kleine-Budde,
Sasha Levin
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 8a68cc0d690c9e5730d676b764c6f059343b842c ]
The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
arithmetic and then assigned to a signed 64 bit variable. In the case where
time_ref->adapter->ts_used_bits is 32 or more this can lead to an oveflow.
Avoid this by shifting using the BIT_ULL macro instead.
Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20201105112427.40688-1-colin.king@canonical.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 9d78ba7776140..c9d86d50bf886 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -180,7 +180,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts,
if (time_ref->ts_dev_1 < time_ref->ts_dev_2) {
/* case when event time (tsw) wraps */
if (ts < time_ref->ts_dev_1)
- delta_ts = 1 << time_ref->adapter->ts_used_bits;
+ delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits);
/* Otherwise, sync time counter (ts_dev_2) has wrapped:
* handle case when event time (tsn) hasn't.
@@ -192,7 +192,7 @@ void peak_usb_get_ts_tv(struct peak_time_ref *time_ref, u32 ts,
* tsn ts
*/
} else if (time_ref->ts_dev_1 < ts) {
- delta_ts = -(1 << time_ref->adapter->ts_used_bits);
+ delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits);
}
/* add delay between last sync and event timestamps */
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 35/60] can: m_can: m_can_handle_state_change(): fix state change
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 34/60] can: peak_usb: fix potential integer overflow on shift of a int Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 36/60] ASoC: qcom: lpass-platform: Fix memory leak Greg Kroah-Hartman
` (27 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wu Bo, Dan Murphy, Marc Kleine-Budde,
Sasha Levin
From: Wu Bo <wubo.oduw@gmail.com>
[ Upstream commit cd0d83eab2e0c26fe87a10debfedbb23901853c1 ]
m_can_handle_state_change() is called with the new_state as an argument.
In the switch statements for CAN_STATE_ERROR_ACTIVE, the comment and the
following code indicate that a CAN_STATE_ERROR_WARNING is handled.
This patch fixes this problem by changing the case to CAN_STATE_ERROR_WARNING.
Signed-off-by: Wu Bo <wubo.oduw@gmail.com>
Link: http://lore.kernel.org/r/20200129022330.21248-2-wubo.oduw@gmail.com
Cc: Dan Murphy <dmurphy@ti.com>
Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/m_can/m_can.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index ebad93ac8f118..680ee8345211f 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -671,7 +671,7 @@ static int m_can_handle_state_change(struct net_device *dev,
unsigned int ecr;
switch (new_state) {
- case CAN_STATE_ERROR_ACTIVE:
+ case CAN_STATE_ERROR_WARNING:
/* error warning state */
priv->can.can_stats.error_warning++;
priv->can.state = CAN_STATE_ERROR_WARNING;
@@ -700,7 +700,7 @@ static int m_can_handle_state_change(struct net_device *dev,
__m_can_get_berr_counter(dev, &bec);
switch (new_state) {
- case CAN_STATE_ERROR_ACTIVE:
+ case CAN_STATE_ERROR_WARNING:
/* error warning state */
cf->can_id |= CAN_ERR_CRTL;
cf->data[1] = (bec.txerr > bec.rxerr) ?
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 36/60] ASoC: qcom: lpass-platform: Fix memory leak
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 35/60] can: m_can: m_can_handle_state_change(): fix state change Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 37/60] MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu Greg Kroah-Hartman
` (26 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Machek, V Sujith Kumar Reddy,
Srinivasa Rao Mandadapu, Mark Brown, Sasha Levin
From: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
[ Upstream commit bd6327fda2f3ded85b69b3c3125c99aaa51c7881 ]
lpass_pcm_data is not freed in error paths. Free it in
error paths to avoid memory leak.
Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage")
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: V Sujith Kumar Reddy <vsujithk@codeaurora.org>
Signed-off-by: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
Link: https://lore.kernel.org/r/1605416210-14530-1-git-send-email-srivasam@codeaurora.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/qcom/lpass-platform.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
index b8f8cb906d805..35c49fc9602b6 100644
--- a/sound/soc/qcom/lpass-platform.c
+++ b/sound/soc/qcom/lpass-platform.c
@@ -80,8 +80,10 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
else
dma_ch = 0;
- if (dma_ch < 0)
+ if (dma_ch < 0) {
+ kfree(data);
return dma_ch;
+ }
drvdata->substream[dma_ch] = substream;
@@ -102,6 +104,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
ret = snd_pcm_hw_constraint_integer(runtime,
SNDRV_PCM_HW_PARAM_PERIODS);
if (ret < 0) {
+ kfree(data);
dev_err(soc_runtime->dev, "setting constraints failed: %d\n",
ret);
return -EINVAL;
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 37/60] MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 36/60] ASoC: qcom: lpass-platform: Fix memory leak Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 38/60] regulator: ti-abb: Fix array out of bound read access on the first transition Greg Kroah-Hartman
` (25 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Qilong,
Thomas Bogendoerfer, Sasha Levin
From: Zhang Qilong <zhangqilong3@huawei.com>
[ Upstream commit ac3b57adf87ad9bac7e33ca26bbbb13fae1ed62b ]
If the clk_register fails, we should free h before
function returns to prevent memleak.
Fixes: 474402291a0ad ("MIPS: Alchemy: clock framework integration of onchip clocks")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/alchemy/common/clock.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
index a83c7b7e2eb1f..c5e49bb79c004 100644
--- a/arch/mips/alchemy/common/clock.c
+++ b/arch/mips/alchemy/common/clock.c
@@ -152,6 +152,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
{
struct clk_init_data id;
struct clk_hw *h;
+ struct clk *clk;
h = kzalloc(sizeof(*h), GFP_KERNEL);
if (!h)
@@ -164,7 +165,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
id.ops = &alchemy_clkops_cpu;
h->init = &id;
- return clk_register(NULL, h);
+ clk = clk_register(NULL, h);
+ if (IS_ERR(clk)) {
+ pr_err("failed to register clock\n");
+ kfree(h);
+ }
+
+ return clk;
}
/* AUXPLLs ************************************************************/
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 38/60] regulator: ti-abb: Fix array out of bound read access on the first transition
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 37/60] MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 39/60] xfs: revert "xfs: fix rmap key and record comparison functions" Greg Kroah-Hartman
` (24 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Naresh Kamboju, Arnd Bergmann,
Nishanth Menon, Mark Brown, Sasha Levin
From: Nishanth Menon <nm@ti.com>
[ Upstream commit 2ba546ebe0ce2af47833d8912ced9b4a579f13cb ]
At the start of driver initialization, we do not know what bias
setting the bootloader has configured the system for and we only know
for certain the very first time we do a transition.
However, since the initial value of the comparison index is -EINVAL,
this negative value results in an array out of bound access on the
very first transition.
Since we don't know what the setting is, we just set the bias
configuration as there is nothing to compare against. This prevents
the array out of bound access.
NOTE: Even though we could use a more relaxed check of "< 0" the only
valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+.
Fixes: 40b1936efebd ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver")
Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Nishanth Menon <nm@ti.com>
Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/ti-abb-regulator.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
index 6d17357b3a248..5f5f63eb8c762 100644
--- a/drivers/regulator/ti-abb-regulator.c
+++ b/drivers/regulator/ti-abb-regulator.c
@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
return ret;
}
- /* If data is exactly the same, then just update index, no change */
info = &abb->info[sel];
+ /*
+ * When Linux kernel is starting up, we are'nt sure of the
+ * Bias configuration that bootloader has configured.
+ * So, we get to know the actual setting the first time
+ * we are asked to transition.
+ */
+ if (abb->current_info_idx == -EINVAL)
+ goto just_set_abb;
+
+ /* If data is exactly the same, then just update index, no change */
oinfo = &abb->info[abb->current_info_idx];
if (!memcmp(info, oinfo, sizeof(*info))) {
dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__,
@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
goto out;
}
+just_set_abb:
ret = ti_abb_set_opp(rdev, abb, info);
out:
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 39/60] xfs: revert "xfs: fix rmap key and record comparison functions"
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 38/60] regulator: ti-abb: Fix array out of bound read access on the first transition Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 40/60] libfs: fix error cast of negative value in simple_attr_write() Greg Kroah-Hartman
` (23 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Sandeen, Darrick J. Wong,
Eric Sandeen, Sasha Levin
From: Darrick J. Wong <darrick.wong@oracle.com>
[ Upstream commit eb8409071a1d47e3593cfe077107ac46853182ab ]
This reverts commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f.
Your maintainer committed a major braino in the rmap code by adding the
attr fork, bmbt, and unwritten extent usage bits into rmap record key
comparisons. While XFS uses the usage bits *in the rmap records* for
cross-referencing metadata in xfs_scrub and xfs_repair, it only needs
the owner and offset information to distinguish between reverse mappings
of the same physical extent into the data fork of a file at multiple
offsets. The other bits are not important for key comparisons for index
lookups, and never have been.
Eric Sandeen reports that this causes regressions in generic/299, so
undo this patch before it does more damage.
Reported-by: Eric Sandeen <sandeen@sandeen.net>
Fixes: 6ff646b2ceb0 ("xfs: fix rmap key and record comparison functions")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
index cd689d21d3af8..9d9c9192584c9 100644
--- a/fs/xfs/libxfs/xfs_rmap_btree.c
+++ b/fs/xfs/libxfs/xfs_rmap_btree.c
@@ -262,8 +262,8 @@ xfs_rmapbt_key_diff(
else if (y > x)
return -1;
- x = be64_to_cpu(kp->rm_offset);
- y = xfs_rmap_irec_offset_pack(rec);
+ x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset));
+ y = rec->rm_offset;
if (x > y)
return 1;
else if (y > x)
@@ -294,8 +294,8 @@ xfs_rmapbt_diff_two_keys(
else if (y > x)
return -1;
- x = be64_to_cpu(kp1->rm_offset);
- y = be64_to_cpu(kp2->rm_offset);
+ x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset));
+ y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset));
if (x > y)
return 1;
else if (y > x)
@@ -400,8 +400,8 @@ xfs_rmapbt_keys_inorder(
return 1;
else if (a > b)
return 0;
- a = be64_to_cpu(k1->rmap.rm_offset);
- b = be64_to_cpu(k2->rmap.rm_offset);
+ a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset));
+ b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset));
if (a <= b)
return 1;
return 0;
@@ -430,8 +430,8 @@ xfs_rmapbt_recs_inorder(
return 1;
else if (a > b)
return 0;
- a = be64_to_cpu(r1->rmap.rm_offset);
- b = be64_to_cpu(r2->rmap.rm_offset);
+ a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset));
+ b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset));
if (a <= b)
return 1;
return 0;
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 40/60] libfs: fix error cast of negative value in simple_attr_write()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 39/60] xfs: revert "xfs: fix rmap key and record comparison functions" Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 41/60] powerpc/uaccess-flush: fix missing includes in kup-radix.h Greg Kroah-Hartman
` (22 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yicong Yang, Andrew Morton, Al Viro,
Linus Torvalds, Sasha Levin
From: Yicong Yang <yangyicong@hisilicon.com>
[ Upstream commit 488dac0c9237647e9b8f788b6a342595bfa40bda ]
The attr->set() receive a value of u64, but simple_strtoll() is used for
doing the conversion. It will lead to the error cast if user inputs a
negative value.
Use kstrtoull() instead of simple_strtoll() to convert a string got from
the user to an unsigned value. The former will return '-EINVAL' if it
gets a negetive value, but the latter can't handle the situation
correctly. Make 'val' unsigned long long as what kstrtoull() takes,
this will eliminate the compile warning on no 64-bit architectures.
Fixes: f7b88631a897 ("fs/libfs.c: fix simple_attr_write() on 32bit machines")
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Link: https://lkml.kernel.org/r/1605341356-11872-1-git-send-email-yangyicong@hisilicon.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/libfs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/libfs.c b/fs/libfs.c
index cb9310b091f5a..83618c21c2165 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -868,7 +868,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
size_t len, loff_t *ppos)
{
struct simple_attr *attr;
- u64 val;
+ unsigned long long val;
size_t size;
ssize_t ret;
@@ -886,7 +886,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
goto out;
attr->set_buf[size] = '\0';
- val = simple_strtoll(attr->set_buf, NULL, 0);
+ ret = kstrtoull(attr->set_buf, 0, &val);
+ if (ret)
+ goto out;
ret = attr->set(attr->data, val);
if (ret == 0)
ret = len; /* on success, claim we got the whole input */
--
2.27.0
^ permalink raw reply related [flat|nested] 64+ messages in thread* [PATCH 4.14 41/60] powerpc/uaccess-flush: fix missing includes in kup-radix.h
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 40/60] libfs: fix error cast of negative value in simple_attr_write() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 42/60] speakup: Do not let the line discipline be used several times Greg Kroah-Hartman
` (21 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, Guenter Roeck, Daniel Axtens
From: Daniel Axtens <dja@axtens.net>
Guenter reports a build failure on cell_defconfig and maple_defconfg:
In file included from arch/powerpc/include/asm/kup.h:10:0,
from arch/powerpc/include/asm/uaccess.h:12,
from arch/powerpc/lib/checksum_wrappers.c:24:
arch/powerpc/include/asm/book3s/64/kup-radix.h:5:1: error: data definition has no type or storage class [-Werror]
DECLARE_STATIC_KEY_FALSE(uaccess_flush_key);
^~~~~~~~~~~~~~~~~~~~~~~~
arch/powerpc/include/asm/book3s/64/kup-radix.h:5:1: error: type defaults to ‘int’ in declaration of ‘DECLARE_STATIC_KEY_FALSE’ [-Werror=implicit-int]
arch/powerpc/include/asm/book3s/64/kup-radix.h:5:1: error: parameter names (without types) in function declaration [-Werror]
arch/powerpc/include/asm/book3s/64/kup-radix.h: In function ‘prevent_user_access’:
arch/powerpc/include/asm/book3s/64/kup-radix.h:18:6: error: implicit declaration of function ‘static_branch_unlikely’ [-Werror=implicit-function-declaration]
if (static_branch_unlikely(&uaccess_flush_key))
^~~~~~~~~~~~~~~~~~~~~~
arch/powerpc/include/asm/book3s/64/kup-radix.h:18:30: error: ‘uaccess_flush_key’ undeclared (first use in this function); did you mean
‘do_uaccess_flush’?
if (static_branch_unlikely(&uaccess_flush_key))
^~~~~~~~~~~~~~~~~
do_uaccess_flush
arch/powerpc/include/asm/book3s/64/kup-radix.h:18:30: note: each undeclared identifier is reported only once for each function it appears in
cc1: all warnings being treated as errors
This is because I failed to include linux/jump_label.h in kup-radix.h. Include it.
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/book3s/64/kup-radix.h | 1 +
1 file changed, 1 insertion(+)
--- a/arch/powerpc/include/asm/book3s/64/kup-radix.h
+++ b/arch/powerpc/include/asm/book3s/64/kup-radix.h
@@ -1,6 +1,7 @@
/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H
#define _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H
+#include <linux/jump_label.h>
DECLARE_STATIC_KEY_FALSE(uaccess_flush_key);
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 42/60] speakup: Do not let the line discipline be used several times
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 41/60] powerpc/uaccess-flush: fix missing includes in kup-radix.h Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 43/60] ALSA: ctl: fix error path at adding user-defined element set Greg Kroah-Hartman
` (20 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, 秦世松, Samuel Thibault
From: Samuel Thibault <samuel.thibault@ens-lyon.org>
commit d4122754442799187d5d537a9c039a49a67e57f1 upstream.
Speakup has only one speakup_tty variable to store the tty it is managing. This
makes sense since its codebase currently assumes that there is only one user who
controls the screen reading.
That however means that we have to forbid using the line discipline several
times, otherwise the second closure would try to free a NULL ldisc_data, leading to
general protection fault: 0000 [#1] SMP KASAN PTI
RIP: 0010:spk_ttyio_ldisc_close+0x2c/0x60
Call Trace:
tty_ldisc_release+0xa2/0x340
tty_release_struct+0x17/0xd0
tty_release+0x9d9/0xcc0
__fput+0x231/0x740
task_work_run+0x12c/0x1a0
do_exit+0x9b5/0x2230
? release_task+0x1240/0x1240
? __do_page_fault+0x562/0xa30
do_group_exit+0xd5/0x2a0
__x64_sys_exit_group+0x35/0x40
do_syscall_64+0x89/0x2b0
? page_fault+0x8/0x30
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Cc: stable@vger.kernel.org
Reported-by: 秦世松 <qinshisong1205@gmail.com>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Tested-by: Shisong Qin <qinshisong1205@gmail.com>
Link: https://lore.kernel.org/r/20201110183541.fzgnlwhjpgqzjeth@function
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/speakup/spk_ttyio.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/staging/speakup/spk_ttyio.c
+++ b/drivers/staging/speakup/spk_ttyio.c
@@ -48,10 +48,18 @@ static int spk_ttyio_ldisc_open(struct t
if (tty->ops->write == NULL)
return -EOPNOTSUPP;
+
+ mutex_lock(&speakup_tty_mutex);
+ if (speakup_tty) {
+ mutex_unlock(&speakup_tty_mutex);
+ return -EBUSY;
+ }
speakup_tty = tty;
ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL);
if (!ldisc_data) {
+ speakup_tty = NULL;
+ mutex_unlock(&speakup_tty_mutex);
pr_err("speakup: Failed to allocate ldisc_data.\n");
return -ENOMEM;
}
@@ -59,6 +67,7 @@ static int spk_ttyio_ldisc_open(struct t
sema_init(&ldisc_data->sem, 0);
ldisc_data->buf_free = true;
speakup_tty->disc_data = ldisc_data;
+ mutex_unlock(&speakup_tty_mutex);
return 0;
}
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 43/60] ALSA: ctl: fix error path at adding user-defined element set
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 42/60] speakup: Do not let the line discipline be used several times Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 44/60] ALSA: mixart: Fix mutex deadlock Greg Kroah-Hartman
` (19 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Sakamoto, Takashi Iwai
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
commit 95a793c3bc75cf888e0e641d656e7d080f487d8b upstream.
When processing request to add/replace user-defined element set, check
of given element identifier and decision of numeric identifier is done
in "__snd_ctl_add_replace()" helper function. When the result of check
is wrong, the helper function returns error code. The error code shall
be returned to userspace application.
Current implementation includes bug to return zero to userspace application
regardless of the result. This commit fixes the bug.
Cc: <stable@vger.kernel.org>
Fixes: e1a7bfe38079 ("ALSA: control: Fix race between adding and removing a user element")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20201113092043.16148-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/control.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1387,7 +1387,7 @@ static int snd_ctl_elem_add(struct snd_c
unlock:
up_write(&card->controls_rwsem);
- return 0;
+ return err;
}
static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 44/60] ALSA: mixart: Fix mutex deadlock
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 43/60] ALSA: ctl: fix error path at adding user-defined element set Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 45/60] tty: serial: imx: keep console clocks always on Greg Kroah-Hartman
` (18 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Takashi Iwai
From: Takashi Iwai <tiwai@suse.de>
commit d21b96c8ed2aea7e6b7bf4735e1d2503cfbf4072 upstream.
The code change for switching to non-atomic mode brought the
unexpected mutex deadlock in get_msg(). It converted the spinlock
with the existing mutex, but there were calls with the already holding
the mutex. Since the only place that needs the extra lock is the code
path from snd_mixart_send_msg(), remove the mutex lock in get_msg()
and apply in the caller side for fixing the mutex deadlock.
Fixes: 8d3a8b5cb57d ("ALSA: mixart: Use nonatomic PCM ops")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201119121440.18945-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/mixart/mixart_core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/sound/pci/mixart/mixart_core.c
+++ b/sound/pci/mixart/mixart_core.c
@@ -83,7 +83,6 @@ static int get_msg(struct mixart_mgr *mg
unsigned int i;
#endif
- mutex_lock(&mgr->msg_lock);
err = 0;
/* copy message descriptor from miXart to driver */
@@ -132,8 +131,6 @@ static int get_msg(struct mixart_mgr *mg
writel_be(headptr, MIXART_MEM(mgr, MSG_OUTBOUND_FREE_HEAD));
_clean_exit:
- mutex_unlock(&mgr->msg_lock);
-
return err;
}
@@ -271,7 +268,9 @@ int snd_mixart_send_msg(struct mixart_mg
resp.data = resp_data;
resp.size = max_resp_size;
+ mutex_lock(&mgr->msg_lock);
err = get_msg(mgr, &resp, msg_frame);
+ mutex_unlock(&mgr->msg_lock);
if( request->message_id != resp.message_id )
dev_err(&mgr->pci->dev, "RESPONSE ERROR!\n");
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 45/60] tty: serial: imx: keep console clocks always on
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 44/60] ALSA: mixart: Fix mutex deadlock Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 46/60] efivarfs: fix memory leak in efivarfs_create() Greg Kroah-Hartman
` (17 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König, Fugang Duan
From: Fugang Duan <fugang.duan@nxp.com>
commit e67c139c488e84e7eae6c333231e791f0e89b3fb upstream.
For below code, there has chance to cause deadlock in SMP system:
Thread 1:
clk_enable_lock();
pr_info("debug message");
clk_enable_unlock();
Thread 2:
imx_uart_console_write()
clk_enable()
clk_enable_lock();
Thread 1:
Acuired clk enable_lock -> printk -> console_trylock_spinning
Thread 2:
console_unlock() -> imx_uart_console_write -> clk_disable -> Acquite clk enable_lock
So the patch is to keep console port clocks always on like
other console drivers.
Fixes: 1cf93e0d5488 ("serial: imx: remove the uart_console() check")
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Link: https://lore.kernel.org/r/20201111025136.29818-1-fugang.duan@nxp.com
Cc: stable <stable@vger.kernel.org>
[fix up build warning - gregkh]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/imx.c | 20 +++-----------------
1 file changed, 3 insertions(+), 17 deletions(-)
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1879,16 +1879,6 @@ imx_console_write(struct console *co, co
unsigned int ucr1;
unsigned long flags = 0;
int locked = 1;
- int retval;
-
- retval = clk_enable(sport->clk_per);
- if (retval)
- return;
- retval = clk_enable(sport->clk_ipg);
- if (retval) {
- clk_disable(sport->clk_per);
- return;
- }
if (sport->port.sysrq)
locked = 0;
@@ -1924,9 +1914,6 @@ imx_console_write(struct console *co, co
if (locked)
spin_unlock_irqrestore(&sport->port.lock, flags);
-
- clk_disable(sport->clk_ipg);
- clk_disable(sport->clk_per);
}
/*
@@ -2027,15 +2014,14 @@ imx_console_setup(struct console *co, ch
retval = uart_set_options(&sport->port, co, baud, parity, bits, flow);
- clk_disable(sport->clk_ipg);
if (retval) {
- clk_unprepare(sport->clk_ipg);
+ clk_disable_unprepare(sport->clk_ipg);
goto error_console;
}
- retval = clk_prepare(sport->clk_per);
+ retval = clk_prepare_enable(sport->clk_per);
if (retval)
- clk_unprepare(sport->clk_ipg);
+ clk_disable_unprepare(sport->clk_ipg);
error_console:
return retval;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 46/60] efivarfs: fix memory leak in efivarfs_create()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 45/60] tty: serial: imx: keep console clocks always on Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 47/60] staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids Greg Kroah-Hartman
` (16 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vamshi K Sthambamkadi, Ard Biesheuvel
From: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
commit fe5186cf12e30facfe261e9be6c7904a170bd822 upstream.
kmemleak report:
unreferenced object 0xffff9b8915fcb000 (size 4096):
comm "efivarfs.sh", pid 2360, jiffies 4294920096 (age 48.264s)
hex dump (first 32 bytes):
2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -...............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000cc4d897c>] kmem_cache_alloc_trace+0x155/0x4b0
[<000000007d1dfa72>] efivarfs_create+0x6e/0x1a0
[<00000000e6ee18fc>] path_openat+0xe4b/0x1120
[<000000000ad0414f>] do_filp_open+0x91/0x100
[<00000000ce93a198>] do_sys_openat2+0x20c/0x2d0
[<000000002a91be6d>] do_sys_open+0x46/0x80
[<000000000a854999>] __x64_sys_openat+0x20/0x30
[<00000000c50d89c9>] do_syscall_64+0x38/0x90
[<00000000cecd6b5f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
In efivarfs_create(), inode->i_private is setup with efivar_entry
object which is never freed.
Cc: <stable@vger.kernel.org>
Signed-off-by: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
Link: https://lore.kernel.org/r/20201023115429.GA2479@cosmos
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/efivarfs/super.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -23,6 +23,7 @@ LIST_HEAD(efivarfs_list);
static void efivarfs_evict_inode(struct inode *inode)
{
clear_inode(inode);
+ kfree(inode->i_private);
}
static const struct super_operations efivarfs_ops = {
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 47/60] staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 46/60] efivarfs: fix memory leak in efivarfs_create() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 48/60] ext4: fix bogus warning in ext4_update_dx_flag() Greg Kroah-Hartman
` (15 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Brian OKeefe, Hans de Goede
From: Brian O'Keefe <bokeefe@alum.wpi.edu>
commit aee9dccc5b64e878cf1b18207436e73f66d74157 upstream.
Add 024c:0627 to the list of SDIO device-ids, based on hardware found in
the wild. This hardware exists on at least some Acer SW1-011 tablets.
Signed-off-by: Brian O'Keefe <bokeefe@alum.wpi.edu>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/b9e1523f-2ba7-fb82-646a-37f095b4440e@alum.wpi.edu
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -28,6 +28,7 @@ static const struct sdio_device_id sdio_
{ SDIO_DEVICE(0x024c, 0x0525), },
{ SDIO_DEVICE(0x024c, 0x0623), },
{ SDIO_DEVICE(0x024c, 0x0626), },
+ { SDIO_DEVICE(0x024c, 0x0627), },
{ SDIO_DEVICE(0x024c, 0xb723), },
{ /* end: all zeroes */ },
};
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 48/60] ext4: fix bogus warning in ext4_update_dx_flag()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 47/60] staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 49/60] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum Greg Kroah-Hartman
` (14 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Biggers, Eric Biggers, Jan Kara,
Theodore Tso, stable
From: Jan Kara <jack@suse.cz>
commit f902b216501094495ff75834035656e8119c537f upstream.
The idea of the warning in ext4_update_dx_flag() is that we should warn
when we are clearing EXT4_INODE_INDEX on a filesystem with metadata
checksums enabled since after clearing the flag, checksums for internal
htree nodes will become invalid. So there's no need to warn (or actually
do anything) when EXT4_INODE_INDEX is not set.
Link: https://lore.kernel.org/r/20201118153032.17281-1-jack@suse.cz
Fixes: 48a34311953d ("ext4: fix checksum errors with indexed dirs")
Reported-by: Eric Biggers <ebiggers@kernel.org>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/ext4.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2406,7 +2406,8 @@ void ext4_insert_dentry(struct inode *in
struct ext4_filename *fname);
static inline void ext4_update_dx_flag(struct inode *inode)
{
- if (!ext4_has_feature_dir_index(inode->i_sb)) {
+ if (!ext4_has_feature_dir_index(inode->i_sb) &&
+ ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
/* ext4_iget() should have caught this... */
WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb));
ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 49/60] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 48/60] ext4: fix bogus warning in ext4_update_dx_flag() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 50/60] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode Greg Kroah-Hartman
` (13 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Stable, Jonathan Cameron
From: Hans de Goede <hdegoede@redhat.com>
commit 11e94f28c3de35d5ad1ac6a242a5b30f4378991a upstream.
Replace the boolean is_smo8500_device variable with an acpi_type enum.
For now this can be either ACPI_GENERIC or ACPI_SMO8500, this is a
preparation patch for adding special handling for the KIOX010A ACPI HID,
which will add a ACPI_KIOX010A acpi_type to the introduced enum.
For stable as needed as precursor for next patch.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID")
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201110133835.129080-2-hdegoede@redhat.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/kxcjk-1013.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -91,6 +91,11 @@ enum kx_chipset {
KX_MAX_CHIPS /* this must be last */
};
+enum kx_acpi_type {
+ ACPI_GENERIC,
+ ACPI_SMO8500,
+};
+
struct kxcjk1013_data {
struct i2c_client *client;
struct iio_trigger *dready_trig;
@@ -107,7 +112,7 @@ struct kxcjk1013_data {
bool motion_trigger_on;
int64_t timestamp;
enum kx_chipset chipset;
- bool is_smo8500_device;
+ enum kx_acpi_type acpi_type;
};
enum kxcjk1013_axis {
@@ -1144,7 +1149,7 @@ static irqreturn_t kxcjk1013_data_rdy_tr
static const char *kxcjk1013_match_acpi_device(struct device *dev,
enum kx_chipset *chipset,
- bool *is_smo8500_device)
+ enum kx_acpi_type *acpi_type)
{
const struct acpi_device_id *id;
@@ -1153,7 +1158,7 @@ static const char *kxcjk1013_match_acpi_
return NULL;
if (strcmp(id->id, "SMO8500") == 0)
- *is_smo8500_device = true;
+ *acpi_type = ACPI_SMO8500;
*chipset = (enum kx_chipset)id->driver_data;
@@ -1189,7 +1194,7 @@ static int kxcjk1013_probe(struct i2c_cl
} else if (ACPI_HANDLE(&client->dev)) {
name = kxcjk1013_match_acpi_device(&client->dev,
&data->chipset,
- &data->is_smo8500_device);
+ &data->acpi_type);
} else
return -ENODEV;
@@ -1207,7 +1212,7 @@ static int kxcjk1013_probe(struct i2c_cl
indio_dev->modes = INDIO_DIRECT_MODE;
indio_dev->info = &kxcjk1013_info;
- if (client->irq > 0 && !data->is_smo8500_device) {
+ if (client->irq > 0 && data->acpi_type != ACPI_SMO8500) {
ret = devm_request_threaded_irq(&client->dev, client->irq,
kxcjk1013_data_rdy_trig_poll,
kxcjk1013_event_handler,
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 50/60] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 49/60] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 51/60] regulator: fix memory leak with repeated set_machine_constraints() Greg Kroah-Hartman
` (12 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans de Goede, Stable,
Jonathan Cameron, russianneuromancer
From: Hans de Goede <hdegoede@redhat.com>
commit e5b1032a656e9aa4c7a4df77cb9156a2a651a5f9 upstream.
Some 360 degree hinges (yoga) style 2-in-1 devices use 2 KXCJ91008-s
to allow the OS to determine the angle between the display and the base
of the device, so that the OS can determine if the 2-in-1 is in laptop
or in tablet-mode.
On Windows both accelerometers are read by a special HingeAngleService
process; and this process calls a DSM (Device Specific Method) on the
ACPI KIOX010A device node for the sensor in the display, to let the
embedded-controller (EC) know about the mode so that it can disable the
kbd and touchpad to avoid spurious input while folded into tablet-mode.
This notifying of the EC is problematic because sometimes the EC comes up
thinking that device is in tablet-mode and the kbd and touchpad do not
work. This happens for example on Irbis NB111 devices after a suspend /
resume cycle (after a complete battery drain / hard reset without having
booted Windows at least once). Other 2-in-1s which are likely affected
too are e.g. the Teclast F5 and F6 series.
The kxcjk-1013 driver may seem like a strange place to deal with this,
but since it is *the* driver for the ACPI KIOX010A device, it is also
the driver which has access to the ACPI handle needed by the DSM.
Add support for calling the DSM and on probe unconditionally tell the
EC that the device is laptop mode, fixing the kbd and touchpad sometimes
not working.
Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID")
Reported-and-tested-by: russianneuromancer <russianneuromancer@ya.ru>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201110133835.129080-3-hdegoede@redhat.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/kxcjk-1013.c | 36 ++++++++++++++++++++++++++++++++++++
1 file changed, 36 insertions(+)
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -94,6 +94,7 @@ enum kx_chipset {
enum kx_acpi_type {
ACPI_GENERIC,
ACPI_SMO8500,
+ ACPI_KIOX010A,
};
struct kxcjk1013_data {
@@ -220,6 +221,32 @@ static const struct {
{800, 0, 0x06},
{1600, 0, 0x06} };
+#ifdef CONFIG_ACPI
+enum kiox010a_fn_index {
+ KIOX010A_SET_LAPTOP_MODE = 1,
+ KIOX010A_SET_TABLET_MODE = 2,
+};
+
+static int kiox010a_dsm(struct device *dev, int fn_index)
+{
+ acpi_handle handle = ACPI_HANDLE(dev);
+ guid_t kiox010a_dsm_guid;
+ union acpi_object *obj;
+
+ if (!handle)
+ return -ENODEV;
+
+ guid_parse("1f339696-d475-4e26-8cad-2e9f8e6d7a91", &kiox010a_dsm_guid);
+
+ obj = acpi_evaluate_dsm(handle, &kiox010a_dsm_guid, 1, fn_index, NULL);
+ if (!obj)
+ return -EIO;
+
+ ACPI_FREE(obj);
+ return 0;
+}
+#endif
+
static int kxcjk1013_set_mode(struct kxcjk1013_data *data,
enum kxcjk1013_mode mode)
{
@@ -297,6 +324,13 @@ static int kxcjk1013_chip_init(struct kx
{
int ret;
+#ifdef CONFIG_ACPI
+ if (data->acpi_type == ACPI_KIOX010A) {
+ /* Make sure the kbd and touchpad on 2-in-1s using 2 KXCJ91008-s work */
+ kiox010a_dsm(&data->client->dev, KIOX010A_SET_LAPTOP_MODE);
+ }
+#endif
+
ret = i2c_smbus_read_byte_data(data->client, KXCJK1013_REG_WHO_AM_I);
if (ret < 0) {
dev_err(&data->client->dev, "Error reading who_am_i\n");
@@ -1159,6 +1193,8 @@ static const char *kxcjk1013_match_acpi_
if (strcmp(id->id, "SMO8500") == 0)
*acpi_type = ACPI_SMO8500;
+ else if (strcmp(id->id, "KIOX010A") == 0)
+ *acpi_type = ACPI_KIOX010A;
*chipset = (enum kx_chipset)id->driver_data;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 51/60] regulator: fix memory leak with repeated set_machine_constraints()
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 50/60] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 52/60] regulator: avoid resolve_supply() infinite recursion Greg Kroah-Hartman
` (11 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michał Mirosław,
Mark Brown, Ahmad Fatoum
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
commit 57a6ad482af256b2a13de14194fb8f67c1a65f10 upstream.
Fixed commit introduced a possible second call to
set_machine_constraints() and that allocates memory for
rdev->constraints. Move the allocation to the caller so
it's easier to manage and done once.
Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
Cc: stable@vger.kernel.org
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
Link: https://lore.kernel.org/r/78c3d4016cebc08d441aad18cb924b4e4d9cf9df.1605226675.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/core.c | 29 +++++++++++++----------------
1 file changed, 13 insertions(+), 16 deletions(-)
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1026,7 +1026,6 @@ static int _regulator_do_enable(struct r
/**
* set_machine_constraints - sets regulator constraints
* @rdev: regulator source
- * @constraints: constraints to apply
*
* Allows platform initialisation code to define and constrain
* regulator circuits e.g. valid voltage/current ranges, etc. NOTE:
@@ -1034,21 +1033,11 @@ static int _regulator_do_enable(struct r
* regulator operations to proceed i.e. set_voltage, set_current_limit,
* set_mode.
*/
-static int set_machine_constraints(struct regulator_dev *rdev,
- const struct regulation_constraints *constraints)
+static int set_machine_constraints(struct regulator_dev *rdev)
{
int ret = 0;
const struct regulator_ops *ops = rdev->desc->ops;
- if (constraints)
- rdev->constraints = kmemdup(constraints, sizeof(*constraints),
- GFP_KERNEL);
- else
- rdev->constraints = kzalloc(sizeof(*constraints),
- GFP_KERNEL);
- if (!rdev->constraints)
- return -ENOMEM;
-
ret = machine_constraints_voltage(rdev, rdev->constraints);
if (ret != 0)
return ret;
@@ -3985,7 +3974,6 @@ struct regulator_dev *
regulator_register(const struct regulator_desc *regulator_desc,
const struct regulator_config *cfg)
{
- const struct regulation_constraints *constraints = NULL;
const struct regulator_init_data *init_data;
struct regulator_config *config = NULL;
static atomic_t regulator_no = ATOMIC_INIT(-1);
@@ -4085,14 +4073,23 @@ regulator_register(const struct regulato
/* set regulator constraints */
if (init_data)
- constraints = &init_data->constraints;
+ rdev->constraints = kmemdup(&init_data->constraints,
+ sizeof(*rdev->constraints),
+ GFP_KERNEL);
+ else
+ rdev->constraints = kzalloc(sizeof(*rdev->constraints),
+ GFP_KERNEL);
+ if (!rdev->constraints) {
+ ret = -ENOMEM;
+ goto wash;
+ }
if (init_data && init_data->supply_regulator)
rdev->supply_name = init_data->supply_regulator;
else if (regulator_desc->supply_name)
rdev->supply_name = regulator_desc->supply_name;
- ret = set_machine_constraints(rdev, constraints);
+ ret = set_machine_constraints(rdev);
if (ret == -EPROBE_DEFER) {
/* Regulator might be in bypass mode and so needs its supply
* to set the constraints */
@@ -4101,7 +4098,7 @@ regulator_register(const struct regulato
* that is just being created */
ret = regulator_resolve_supply(rdev);
if (!ret)
- ret = set_machine_constraints(rdev, constraints);
+ ret = set_machine_constraints(rdev);
else
rdev_dbg(rdev, "unable to resolve supply early: %pe\n",
ERR_PTR(ret));
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 52/60] regulator: avoid resolve_supply() infinite recursion
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 51/60] regulator: fix memory leak with repeated set_machine_constraints() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 53/60] regulator: workaround self-referent regulators Greg Kroah-Hartman
` (10 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ahmad Fatoum,
Michał Mirosław, Mark Brown
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
commit 4b639e254d3d4f15ee4ff2b890a447204cfbeea9 upstream.
When a regulator's name equals its supply's name the
regulator_resolve_supply() recurses indefinitely. Add a check
so that debugging the problem is easier. The "fixed" commit
just exposed the problem.
Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
Cc: stable@vger.kernel.org
Reported-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
Link: https://lore.kernel.org/r/c6171057cfc0896f950c4d8cb82df0f9f1b89ad9.1605226675.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/core.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1544,6 +1544,12 @@ static int regulator_resolve_supply(stru
}
}
+ if (r == rdev) {
+ dev_err(dev, "Supply for %s (%s) resolved to itself\n",
+ rdev->desc->name, rdev->supply_name);
+ return -EINVAL;
+ }
+
/*
* If the supply's parent device is not the same as the
* regulator's parent device, then ensure the parent device
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 53/60] regulator: workaround self-referent regulators
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 52/60] regulator: avoid resolve_supply() infinite recursion Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 54/60] xtensa: disable preemption around cache alias management calls Greg Kroah-Hartman
` (9 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ahmad Fatoum,
Michał Mirosław, Mark Brown
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
commit f5c042b23f7429e5c2ac987b01a31c69059a978b upstream.
Workaround regulators whose supply name happens to be the same as its
own name. This fixes boards that used to work before the early supply
resolving was removed. The error message is left in place so that
offending drivers can be detected.
Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
Cc: stable@vger.kernel.org
Reported-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
Link: https://lore.kernel.org/r/d703acde2a93100c3c7a81059d716c50ad1b1f52.1605226675.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1547,7 +1547,10 @@ static int regulator_resolve_supply(stru
if (r == rdev) {
dev_err(dev, "Supply for %s (%s) resolved to itself\n",
rdev->desc->name, rdev->supply_name);
- return -EINVAL;
+ if (!have_full_constraints())
+ return -EINVAL;
+ r = dummy_regulator_rdev;
+ get_device(&r->dev);
}
/*
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 54/60] xtensa: disable preemption around cache alias management calls
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 53/60] regulator: workaround self-referent regulators Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 55/60] mac80211: minstrel: remove deferred sampling code Greg Kroah-Hartman
` (8 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Max Filippov
From: Max Filippov <jcmvbkbc@gmail.com>
commit 3a860d165eb5f4d7cf0bf81ef6a5b5c5e1754422 upstream.
Although cache alias management calls set up and tear down TLB entries
and fast_second_level_miss is able to restore TLB entry should it be
evicted they absolutely cannot preempt each other because they use the
same TLBTEMP area for different purposes.
Disable preemption around all cache alias management calls to enforce
that.
Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/xtensa/mm/cache.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/arch/xtensa/mm/cache.c
+++ b/arch/xtensa/mm/cache.c
@@ -74,8 +74,10 @@ static inline void kmap_invalidate_coher
kvaddr = TLBTEMP_BASE_1 +
(page_to_phys(page) & DCACHE_ALIAS_MASK);
+ preempt_disable();
__invalidate_dcache_page_alias(kvaddr,
page_to_phys(page));
+ preempt_enable();
}
}
}
@@ -160,6 +162,7 @@ void flush_dcache_page(struct page *page
if (!alias && !mapping)
return;
+ preempt_disable();
virt = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK);
__flush_invalidate_dcache_page_alias(virt, phys);
@@ -170,6 +173,7 @@ void flush_dcache_page(struct page *page
if (mapping)
__invalidate_icache_page_alias(virt, phys);
+ preempt_enable();
}
/* There shouldn't be an entry in the cache for this page anymore. */
@@ -203,8 +207,10 @@ void local_flush_cache_page(struct vm_ar
unsigned long phys = page_to_phys(pfn_to_page(pfn));
unsigned long virt = TLBTEMP_BASE_1 + (address & DCACHE_ALIAS_MASK);
+ preempt_disable();
__flush_invalidate_dcache_page_alias(virt, phys);
__invalidate_icache_page_alias(virt, phys);
+ preempt_enable();
}
EXPORT_SYMBOL(local_flush_cache_page);
@@ -231,11 +237,13 @@ update_mmu_cache(struct vm_area_struct *
unsigned long phys = page_to_phys(page);
unsigned long tmp;
+ preempt_disable();
tmp = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK);
__flush_invalidate_dcache_page_alias(tmp, phys);
tmp = TLBTEMP_BASE_1 + (addr & DCACHE_ALIAS_MASK);
__flush_invalidate_dcache_page_alias(tmp, phys);
__invalidate_icache_page_alias(tmp, phys);
+ preempt_enable();
clear_bit(PG_arch_1, &page->flags);
}
@@ -269,7 +277,9 @@ void copy_to_user_page(struct vm_area_st
if (alias) {
unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
+ preempt_disable();
__flush_invalidate_dcache_page_alias(t, phys);
+ preempt_enable();
}
/* Copy data */
@@ -284,9 +294,11 @@ void copy_to_user_page(struct vm_area_st
if (alias) {
unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
+ preempt_disable();
__flush_invalidate_dcache_range((unsigned long) dst, len);
if ((vma->vm_flags & VM_EXEC) != 0)
__invalidate_icache_page_alias(t, phys);
+ preempt_enable();
} else if ((vma->vm_flags & VM_EXEC) != 0) {
__flush_dcache_range((unsigned long)dst,len);
@@ -308,7 +320,9 @@ extern void copy_from_user_page(struct v
if (alias) {
unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
+ preempt_disable();
__flush_invalidate_dcache_page_alias(t, phys);
+ preempt_enable();
}
memcpy(dst, src, len);
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 55/60] mac80211: minstrel: remove deferred sampling code
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 54/60] xtensa: disable preemption around cache alias management calls Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 56/60] mac80211: minstrel: fix tx status processing corner case Greg Kroah-Hartman
` (7 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Johannes Berg
From: Felix Fietkau <nbd@nbd.name>
commit 4fe40b8e1566dad04c87fbf299049a1d0d4bd58d upstream.
Deferring sampling attempts to the second stage has some bad interactions
with drivers that process the rate table in hardware and use the probe flag
to indicate probing packets (e.g. most mt76 drivers). On affected drivers
it can lead to probing not working at all.
If the link conditions turn worse, it might not be such a good idea to
do a lot of sampling for lower rates in this case.
Fix this by simply skipping the sample attempt instead of deferring it,
but keep the checks that would allow it to be sampled if it was skipped
too often, but only if it has less than 95% success probability.
Also ensure that IEEE80211_TX_CTL_RATE_CTRL_PROBE is set for all probing
packets.
Cc: stable@vger.kernel.org
Fixes: cccf129f820e ("mac80211: add the 'minstrel' rate control algorithm")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20201111183359.43528-2-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/rc80211_minstrel.c | 25 ++++---------------------
net/mac80211/rc80211_minstrel.h | 1 -
2 files changed, 4 insertions(+), 22 deletions(-)
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -289,12 +289,6 @@ minstrel_tx_status(void *priv, struct ie
mi->r[ndx].stats.success += success;
}
- if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && (i >= 0))
- mi->sample_packets++;
-
- if (mi->sample_deferred > 0)
- mi->sample_deferred--;
-
if (time_after(jiffies, mi->last_stats_update +
(mp->update_interval * HZ) / 1000))
minstrel_update_stats(mp, mi);
@@ -373,7 +367,7 @@ minstrel_get_rate(void *priv, struct iee
return;
delta = (mi->total_packets * sampling_ratio / 100) -
- (mi->sample_packets + mi->sample_deferred / 2);
+ mi->sample_packets;
/* delta < 0: no sampling required */
prev_sample = mi->prev_sample;
@@ -382,7 +376,6 @@ minstrel_get_rate(void *priv, struct iee
return;
if (mi->total_packets >= 10000) {
- mi->sample_deferred = 0;
mi->sample_packets = 0;
mi->total_packets = 0;
} else if (delta > mi->n_rates * 2) {
@@ -407,19 +400,8 @@ minstrel_get_rate(void *priv, struct iee
* rate sampling method should be used.
* Respect such rates that are not sampled for 20 interations.
*/
- if (mrr_capable &&
- msr->perfect_tx_time > mr->perfect_tx_time &&
- msr->stats.sample_skipped < 20) {
- /* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
- * packets that have the sampling rate deferred to the
- * second MRR stage. Increase the sample counter only
- * if the deferred sample rate was actually used.
- * Use the sample_deferred counter to make sure that
- * the sampling is not done in large bursts */
- info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
- rate++;
- mi->sample_deferred++;
- } else {
+ if (msr->perfect_tx_time < mr->perfect_tx_time ||
+ msr->stats.sample_skipped >= 20) {
if (!msr->sample_limit)
return;
@@ -439,6 +421,7 @@ minstrel_get_rate(void *priv, struct iee
rate->idx = mi->r[ndx].rix;
rate->count = minstrel_get_retry_count(&mi->r[ndx], info);
+ info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
}
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -98,7 +98,6 @@ struct minstrel_sta_info {
u8 max_prob_rate;
unsigned int total_packets;
unsigned int sample_packets;
- int sample_deferred;
unsigned int sample_row;
unsigned int sample_column;
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 56/60] mac80211: minstrel: fix tx status processing corner case
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 55/60] mac80211: minstrel: remove deferred sampling code Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 57/60] mac80211: free sta in sta_info_insert_finish() on errors Greg Kroah-Hartman
` (6 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Johannes Berg
From: Felix Fietkau <nbd@nbd.name>
commit b2911a84396f72149dce310a3b64d8948212c1b3 upstream.
Some drivers fill the status rate list without setting the rate index after
the final rate to -1. minstrel_ht already deals with this, but minstrel
doesn't, which causes it to get stuck at the lowest rate on these drivers.
Fix this by checking the count as well.
Cc: stable@vger.kernel.org
Fixes: cccf129f820e ("mac80211: add the 'minstrel' rate control algorithm")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20201111183359.43528-3-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/rc80211_minstrel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -276,7 +276,7 @@ minstrel_tx_status(void *priv, struct ie
success = !!(info->flags & IEEE80211_TX_STAT_ACK);
for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
- if (ar[i].idx < 0)
+ if (ar[i].idx < 0 || !ar[i].count)
break;
ndx = rix_to_ndx(mi, ar[i].idx);
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 57/60] mac80211: free sta in sta_info_insert_finish() on errors
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 56/60] mac80211: minstrel: fix tx status processing corner case Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 58/60] s390/cpum_sf.c: fix file permission for cpum_sfb_size Greg Kroah-Hartman
` (5 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+32c6c38c4812d22f2f0b,
syzbot+4c81fe92e372d26c4246, syzbot+6a7fe9faf0d1d61bc24a,
syzbot+abed06851c5ffe010921, syzbot+b7aeb9318541a1c709f1,
syzbot+d5a9416c6cafe53b5dd0, Johannes Berg
From: Johannes Berg <johannes.berg@intel.com>
commit 7bc40aedf24d31d8bea80e1161e996ef4299fb10 upstream.
If sta_info_insert_finish() fails, we currently keep the station
around and free it only in the caller, but there's only one such
caller and it always frees it immediately.
As syzbot found, another consequence of this split is that we can
put things that sleep only into __cleanup_single_sta() and not in
sta_info_free(), but this is the only place that requires such of
sta_info_free() now.
Change this to free the station in sta_info_insert_finish(), in
which case we can still sleep. This will also let us unify the
cleanup code later.
Cc: stable@vger.kernel.org
Fixes: dcd479e10a05 ("mac80211: always wind down STA state")
Reported-by: syzbot+32c6c38c4812d22f2f0b@syzkaller.appspotmail.com
Reported-by: syzbot+4c81fe92e372d26c4246@syzkaller.appspotmail.com
Reported-by: syzbot+6a7fe9faf0d1d61bc24a@syzkaller.appspotmail.com
Reported-by: syzbot+abed06851c5ffe010921@syzkaller.appspotmail.com
Reported-by: syzbot+b7aeb9318541a1c709f1@syzkaller.appspotmail.com
Reported-by: syzbot+d5a9416c6cafe53b5dd0@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201112112201.ee6b397b9453.I9c31d667a0ea2151441cc64ed6613d36c18a48e0@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/sta_info.c | 14 ++++----------
1 file changed, 4 insertions(+), 10 deletions(-)
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -607,7 +607,7 @@ static int sta_info_insert_finish(struct
out_drop_sta:
local->num_sta--;
synchronize_net();
- __cleanup_single_sta(sta);
+ cleanup_single_sta(sta);
out_err:
mutex_unlock(&local->sta_mtx);
kfree(sinfo);
@@ -626,19 +626,13 @@ int sta_info_insert_rcu(struct sta_info
err = sta_info_insert_check(sta);
if (err) {
+ sta_info_free(local, sta);
mutex_unlock(&local->sta_mtx);
rcu_read_lock();
- goto out_free;
+ return err;
}
- err = sta_info_insert_finish(sta);
- if (err)
- goto out_free;
-
- return 0;
- out_free:
- sta_info_free(local, sta);
- return err;
+ return sta_info_insert_finish(sta);
}
int sta_info_insert(struct sta_info *sta)
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 58/60] s390/cpum_sf.c: fix file permission for cpum_sfb_size
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 57/60] mac80211: free sta in sta_info_insert_finish() on errors Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 59/60] s390/dasd: fix null pointer dereference for ERP requests Greg Kroah-Hartman
` (4 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Richter, Sumanth Korikkar,
Heiko Carstens
From: Thomas Richter <tmricht@linux.ibm.com>
commit 78d732e1f326f74f240d416af9484928303d9951 upstream.
This file is installed by the s390 CPU Measurement sampling
facility device driver to export supported minimum and
maximum sample buffer sizes.
This file is read by lscpumf tool to display the details
of the device driver capabilities. The lscpumf tool might
be invoked by a non-root user. In this case it does not
print anything because the file contents can not be read.
Fix this by allowing read access for all users. Reading
the file contents is ok, changing the file contents is
left to the root user only.
For further reference and details see:
[1] https://github.com/ibm-s390-tools/s390-tools/issues/97
Fixes: 69f239ed335a ("s390/cpum_sf: Dynamically extend the sampling buffer if overflows occur")
Cc: <stable@vger.kernel.org> # 3.14
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/perf_cpum_sf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -1662,4 +1662,4 @@ out:
return err;
}
arch_initcall(init_cpum_sampling_pmu);
-core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0640);
+core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0644);
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 59/60] s390/dasd: fix null pointer dereference for ERP requests
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 58/60] s390/cpum_sf.c: fix file permission for cpum_sfb_size Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 4.14 60/60] x86/microcode/intel: Check patch signature before saving microcode for early loading Greg Kroah-Hartman
` (3 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe
From: Stefan Haberland <sth@linux.ibm.com>
commit 6f117cb854a44a79898d844e6ae3fd23bd94e786 upstream.
When requeueing all requests on the device request queue to the blocklayer
we might get to an ERP (error recovery) request that is a copy of an
original CQR.
Those requests do not have blocklayer request information or a pointer to
the dasd_queue set. When trying to access those data it will lead to a
null pointer dereference in dasd_requeue_all_requests().
Fix by checking if the request is an ERP request that can simply be
ignored. The blocklayer request will be requeued by the original CQR that
is on the device queue right behind the ERP request.
Fixes: 9487cfd3430d ("s390/dasd: fix handling of internal requests")
Cc: <stable@vger.kernel.org> #4.16
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/block/dasd.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2891,6 +2891,12 @@ static int _dasd_requeue_request(struct
if (!block)
return -EINVAL;
+ /*
+ * If the request is an ERP request there is nothing to requeue.
+ * This will be done with the remaining original request.
+ */
+ if (cqr->refers)
+ return 0;
spin_lock_irq(&cqr->dq->lock);
req = (struct request *) cqr->callback_data;
blk_mq_requeue_request(req, false);
^ permalink raw reply [flat|nested] 64+ messages in thread* [PATCH 4.14 60/60] x86/microcode/intel: Check patch signature before saving microcode for early loading
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 59/60] s390/dasd: fix null pointer dereference for ERP requests Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
2020-11-23 20:54 ` [PATCH 4.14 00/60] 4.14.209-rc1 review Jon Hunter
` (2 subsequent siblings)
62 siblings, 0 replies; 64+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chen Yu, Borislav Petkov
From: Chen Yu <yu.c.chen@intel.com>
commit 1a371e67dc77125736cc56d3a0893f06b75855b6 upstream.
Currently, scan_microcode() leverages microcode_matches() to check
if the microcode matches the CPU by comparing the family and model.
However, the processor stepping and flags of the microcode signature
should also be considered when saving a microcode patch for early
update.
Use find_matching_signature() in scan_microcode() and get rid of the
now-unused microcode_matches() which is a good cleanup in itself.
Complete the verification of the patch being saved for early loading in
save_microcode_patch() directly. This needs to be done there too because
save_mc_for_early() will call save_microcode_patch() too.
The second reason why this needs to be done is because the loader still
tries to support, at least hypothetically, mixed-steppings systems and
thus adds all patches to the cache that belong to the same CPU model
albeit with different steppings.
For example:
microcode: CPU: sig=0x906ec, pf=0x2, rev=0xd6
microcode: mc_saved[0]: sig=0x906e9, pf=0x2a, rev=0xd6, total size=0x19400, date = 2020-04-23
microcode: mc_saved[1]: sig=0x906ea, pf=0x22, rev=0xd6, total size=0x19000, date = 2020-04-27
microcode: mc_saved[2]: sig=0x906eb, pf=0x2, rev=0xd6, total size=0x19400, date = 2020-04-23
microcode: mc_saved[3]: sig=0x906ec, pf=0x22, rev=0xd6, total size=0x19000, date = 2020-04-27
microcode: mc_saved[4]: sig=0x906ed, pf=0x22, rev=0xd6, total size=0x19400, date = 2020-04-23
The patch which is being saved for early loading, however, can only be
the one which fits the CPU this runs on so do the signature verification
before saving.
[ bp: Do signature verification in save_microcode_patch()
and rewrite commit message. ]
Fixes: ec400ddeff20 ("x86/microcode_intel_early.c: Early update ucode on Intel's CPU")
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=208535
Link: https://lkml.kernel.org/r/20201113015923.13960-1-yu.c.chen@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/microcode/intel.c | 63 +++++-----------------------------
1 file changed, 10 insertions(+), 53 deletions(-)
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -103,53 +103,6 @@ static int has_newer_microcode(void *mc,
return find_matching_signature(mc, csig, cpf);
}
-/*
- * Given CPU signature and a microcode patch, this function finds if the
- * microcode patch has matching family and model with the CPU.
- *
- * %true - if there's a match
- * %false - otherwise
- */
-static bool microcode_matches(struct microcode_header_intel *mc_header,
- unsigned long sig)
-{
- unsigned long total_size = get_totalsize(mc_header);
- unsigned long data_size = get_datasize(mc_header);
- struct extended_sigtable *ext_header;
- unsigned int fam_ucode, model_ucode;
- struct extended_signature *ext_sig;
- unsigned int fam, model;
- int ext_sigcount, i;
-
- fam = x86_family(sig);
- model = x86_model(sig);
-
- fam_ucode = x86_family(mc_header->sig);
- model_ucode = x86_model(mc_header->sig);
-
- if (fam == fam_ucode && model == model_ucode)
- return true;
-
- /* Look for ext. headers: */
- if (total_size <= data_size + MC_HEADER_SIZE)
- return false;
-
- ext_header = (void *) mc_header + data_size + MC_HEADER_SIZE;
- ext_sig = (void *)ext_header + EXT_HEADER_SIZE;
- ext_sigcount = ext_header->count;
-
- for (i = 0; i < ext_sigcount; i++) {
- fam_ucode = x86_family(ext_sig->sig);
- model_ucode = x86_model(ext_sig->sig);
-
- if (fam == fam_ucode && model == model_ucode)
- return true;
-
- ext_sig++;
- }
- return false;
-}
-
static struct ucode_patch *memdup_patch(void *data, unsigned int size)
{
struct ucode_patch *p;
@@ -167,7 +120,7 @@ static struct ucode_patch *memdup_patch(
return p;
}
-static void save_microcode_patch(void *data, unsigned int size)
+static void save_microcode_patch(struct ucode_cpu_info *uci, void *data, unsigned int size)
{
struct microcode_header_intel *mc_hdr, *mc_saved_hdr;
struct ucode_patch *iter, *tmp, *p = NULL;
@@ -213,6 +166,9 @@ static void save_microcode_patch(void *d
if (!p)
return;
+ if (!find_matching_signature(p->data, uci->cpu_sig.sig, uci->cpu_sig.pf))
+ return;
+
/*
* Save for early loading. On 32-bit, that needs to be a physical
* address as the APs are running from physical addresses, before
@@ -347,13 +303,14 @@ scan_microcode(void *data, size_t size,
size -= mc_size;
- if (!microcode_matches(mc_header, uci->cpu_sig.sig)) {
+ if (!find_matching_signature(data, uci->cpu_sig.sig,
+ uci->cpu_sig.pf)) {
data += mc_size;
continue;
}
if (save) {
- save_microcode_patch(data, mc_size);
+ save_microcode_patch(uci, data, mc_size);
goto next;
}
@@ -486,14 +443,14 @@ static void show_saved_mc(void)
* Save this microcode patch. It will be loaded early when a CPU is
* hot-added or resumes.
*/
-static void save_mc_for_early(u8 *mc, unsigned int size)
+static void save_mc_for_early(struct ucode_cpu_info *uci, u8 *mc, unsigned int size)
{
/* Synchronization during CPU hotplug. */
static DEFINE_MUTEX(x86_cpu_microcode_mutex);
mutex_lock(&x86_cpu_microcode_mutex);
- save_microcode_patch(mc, size);
+ save_microcode_patch(uci, mc, size);
show_saved_mc();
mutex_unlock(&x86_cpu_microcode_mutex);
@@ -937,7 +894,7 @@ static enum ucode_state generic_load_mic
* permanent memory. So it will be loaded early when a CPU is hot added
* or resumes.
*/
- save_mc_for_early(new_mc, new_mc_size);
+ save_mc_for_early(uci, new_mc, new_mc_size);
pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n",
cpu, new_rev, uci->cpu_sig.rev);
^ permalink raw reply [flat|nested] 64+ messages in thread* Re: [PATCH 4.14 00/60] 4.14.209-rc1 review
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2020-11-23 12:22 ` [PATCH 4.14 60/60] x86/microcode/intel: Check patch signature before saving microcode for early loading Greg Kroah-Hartman
@ 2020-11-23 20:54 ` Jon Hunter
2020-11-23 22:35 ` Guenter Roeck
2020-11-24 7:21 ` Naresh Kamboju
62 siblings, 0 replies; 64+ messages in thread
From: Jon Hunter @ 2020-11-23 20:54 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, stable, linux-tegra
On Mon, 23 Nov 2020 13:21:42 +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.14.209 release.
> There are 60 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 25 Nov 2020 12:17:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.209-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
10 boots: 10 pass, 0 fail
16 tests: 16 pass, 0 fail
Linux version: 4.14.209-rc1-gc3391de31d51
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Jon
^ permalink raw reply [flat|nested] 64+ messages in thread* Re: [PATCH 4.14 00/60] 4.14.209-rc1 review
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2020-11-23 20:54 ` [PATCH 4.14 00/60] 4.14.209-rc1 review Jon Hunter
@ 2020-11-23 22:35 ` Guenter Roeck
2020-11-24 7:21 ` Naresh Kamboju
62 siblings, 0 replies; 64+ messages in thread
From: Guenter Roeck @ 2020-11-23 22:35 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel, stable
On Mon, Nov 23, 2020 at 01:21:42PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.14.209 release.
> There are 60 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 25 Nov 2020 12:17:50 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 168 pass: 168 fail: 0
Qemu test results:
total: 404 pass: 404 fail: 0
Tested-by: Guenter Roeck <linux@roeck-us.net>
Guenter
^ permalink raw reply [flat|nested] 64+ messages in thread* Re: [PATCH 4.14 00/60] 4.14.209-rc1 review
2020-11-23 12:21 [PATCH 4.14 00/60] 4.14.209-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2020-11-23 22:35 ` Guenter Roeck
@ 2020-11-24 7:21 ` Naresh Kamboju
62 siblings, 0 replies; 64+ messages in thread
From: Naresh Kamboju @ 2020-11-24 7:21 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
Shuah Khan, patches, lkft-triage, pavel, linux-stable
On Mon, 23 Nov 2020 at 17:59, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 4.14.209 release.
> There are 60 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 25 Nov 2020 12:17:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.209-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Summary
------------------------------------------------------------------------
kernel: 4.14.209-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: c3391de31d51a6a479f081994040a5fb99b29c9b
git describe: v4.14.208-61-gc3391de31d51
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.14.y/build/v4.14.208-61-gc3391de31d51
No regressions (compared to build v4.14.208)
No fixes (compared to build v4.14.208)
Ran 41581 total tests in the following environments and test suites.
Environments
--------------
- arm
- arm64
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- juno-r2-kasan
- mips
- qemu-arm64-clang
- qemu-arm64-kasan
- qemu-x86_64-clang
- qemu-x86_64-kasan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- sparc
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* igt-gpu-tools
* install-android-platform-tools-r2600
* linux-log-parser
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-dio-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* perf
* v4l2-compliance
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-mm-tests
* network-basic-tests
* ltp-open-posix-tests
* kvm-unit-tests
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 64+ messages in thread