* [PATCH 5.15 001/567] HID: asus: use spinlock to protect concurrent accesses
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 002/567] HID: asus: use spinlock to safely schedule workers Greg Kroah-Hartman
` (569 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello, Benjamin Tissoires,
Stefan Ghinea
From: Pietro Borrello <borrello@diag.uniroma1.it>
commit 315c537068a13f0b5681d33dd045a912f4bece6f upstream.
asus driver has a worker that may access data concurrently.
Proct the accesses using a spinlock.
Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-4-7860c5763c38@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-asus.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -98,6 +98,7 @@ struct asus_kbd_leds {
struct hid_device *hdev;
struct work_struct work;
unsigned int brightness;
+ spinlock_t lock;
bool removed;
};
@@ -497,7 +498,12 @@ static void asus_kbd_backlight_set(struc
{
struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
cdev);
+ unsigned long flags;
+
+ spin_lock_irqsave(&led->lock, flags);
led->brightness = brightness;
+ spin_unlock_irqrestore(&led->lock, flags);
+
schedule_work(&led->work);
}
@@ -505,8 +511,14 @@ static enum led_brightness asus_kbd_back
{
struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
cdev);
+ enum led_brightness brightness;
+ unsigned long flags;
- return led->brightness;
+ spin_lock_irqsave(&led->lock, flags);
+ brightness = led->brightness;
+ spin_unlock_irqrestore(&led->lock, flags);
+
+ return brightness;
}
static void asus_kbd_backlight_work(struct work_struct *work)
@@ -514,11 +526,14 @@ static void asus_kbd_backlight_work(stru
struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work);
u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, 0x00 };
int ret;
+ unsigned long flags;
if (led->removed)
return;
+ spin_lock_irqsave(&led->lock, flags);
buf[4] = led->brightness;
+ spin_unlock_irqrestore(&led->lock, flags);
ret = asus_kbd_set_report(led->hdev, buf, sizeof(buf));
if (ret < 0)
@@ -586,6 +601,7 @@ static int asus_kbd_register_leds(struct
drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set;
drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get;
INIT_WORK(&drvdata->kbd_backlight->work, asus_kbd_backlight_work);
+ spin_lock_init(&drvdata->kbd_backlight->lock);
ret = devm_led_classdev_register(&hdev->dev, &drvdata->kbd_backlight->cdev);
if (ret < 0) {
@@ -1121,9 +1137,13 @@ err_stop_hw:
static void asus_remove(struct hid_device *hdev)
{
struct asus_drvdata *drvdata = hid_get_drvdata(hdev);
+ unsigned long flags;
if (drvdata->kbd_backlight) {
+ spin_lock_irqsave(&drvdata->kbd_backlight->lock, flags);
drvdata->kbd_backlight->removed = true;
+ spin_unlock_irqrestore(&drvdata->kbd_backlight->lock, flags);
+
cancel_work_sync(&drvdata->kbd_backlight->work);
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 002/567] HID: asus: use spinlock to safely schedule workers
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 001/567] HID: asus: use spinlock to protect concurrent accesses Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 003/567] powerpc/mm: Rearrange if-else block to avoid clang warning Greg Kroah-Hartman
` (568 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello, Benjamin Tissoires,
Stefan Ghinea
From: Pietro Borrello <borrello@diag.uniroma1.it>
commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream.
Use spinlocks to deal with workers introducing a wrapper
asus_schedule_work(), and several spinlock checks.
Otherwise, asus_kbd_backlight_set() may schedule led->work after the
structure has been freed, causing a use-after-free.
Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-asus.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -493,6 +493,16 @@ static int rog_nkey_led_init(struct hid_
return ret;
}
+static void asus_schedule_work(struct asus_kbd_leds *led)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&led->lock, flags);
+ if (!led->removed)
+ schedule_work(&led->work);
+ spin_unlock_irqrestore(&led->lock, flags);
+}
+
static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
enum led_brightness brightness)
{
@@ -504,7 +514,7 @@ static void asus_kbd_backlight_set(struc
led->brightness = brightness;
spin_unlock_irqrestore(&led->lock, flags);
- schedule_work(&led->work);
+ asus_schedule_work(led);
}
static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev)
@@ -528,9 +538,6 @@ static void asus_kbd_backlight_work(stru
int ret;
unsigned long flags;
- if (led->removed)
- return;
-
spin_lock_irqsave(&led->lock, flags);
buf[4] = led->brightness;
spin_unlock_irqrestore(&led->lock, flags);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 003/567] powerpc/mm: Rearrange if-else block to avoid clang warning
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 001/567] HID: asus: use spinlock to protect concurrent accesses Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 002/567] HID: asus: use spinlock to safely schedule workers Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 004/567] ARM: OMAP2+: Fix memory leak in realtime_counter_init() Greg Kroah-Hartman
` (567 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Nathan Chancellor,
Christophe Leroy, Anders Roxell, Michael Ellerman,
Daniel Díaz
From: Anders Roxell <anders.roxell@linaro.org>
commit d78c8e32890ef7eca79ffd67c96022c7f9d8cce4 upstream.
Clang warns:
arch/powerpc/mm/book3s64/radix_tlb.c:1191:23: error: variable 'hstart' is uninitialized when used here
__tlbiel_va_range(hstart, hend, pid,
^~~~~~
arch/powerpc/mm/book3s64/radix_tlb.c:1191:31: error: variable 'hend' is uninitialized when used here
__tlbiel_va_range(hstart, hend, pid,
^~~~
Rework the 'if (IS_ENABLE(CONFIG_TRANSPARENT_HUGEPAGE))' so hstart/hend
is always initialized to silence the warnings. That will also simplify
the 'else' path. Clang is getting confused with these warnings, but the
warnings is a false-positive.
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20220810114318.3220630-1-anders.roxell@linaro.org
Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/book3s64/radix_tlb.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
--- a/arch/powerpc/mm/book3s64/radix_tlb.c
+++ b/arch/powerpc/mm/book3s64/radix_tlb.c
@@ -1171,15 +1171,12 @@ static inline void __radix__flush_tlb_ra
}
}
} else {
- bool hflush = false;
+ bool hflush;
unsigned long hstart, hend;
- if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) {
- hstart = (start + PMD_SIZE - 1) & PMD_MASK;
- hend = end & PMD_MASK;
- if (hstart < hend)
- hflush = true;
- }
+ hstart = (start + PMD_SIZE - 1) & PMD_MASK;
+ hend = end & PMD_MASK;
+ hflush = IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && hstart < hend;
if (type == FLUSH_TYPE_LOCAL) {
asm volatile("ptesync": : :"memory");
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 004/567] ARM: OMAP2+: Fix memory leak in realtime_counter_init()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 003/567] powerpc/mm: Rearrange if-else block to avoid clang warning Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 005/567] arm64: dts: qcom: qcs404: use symbol names for PCIe resets Greg Kroah-Hartman
` (566 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chen Hui, Tony Lindgren, Sasha Levin
From: Chen Hui <judy.chenhui@huawei.com>
[ Upstream commit ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac ]
The "sys_clk" resource is malloced by clk_get(),
it is not released when the function return.
Fixes: fa6d79d27614 ("ARM: OMAP: Add initialisation for the real-time counter.")
Signed-off-by: Chen Hui <judy.chenhui@huawei.com>
Message-Id: <20221108141917.46796-1-judy.chenhui@huawei.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-omap2/timer.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index 620ba69c8f114..5677c4a08f376 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -76,6 +76,7 @@ static void __init realtime_counter_init(void)
}
rate = clk_get_rate(sys_clk);
+ clk_put(sys_clk);
if (soc_is_dra7xx()) {
/*
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 005/567] arm64: dts: qcom: qcs404: use symbol names for PCIe resets
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 004/567] ARM: OMAP2+: Fix memory leak in realtime_counter_init() Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 006/567] arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up Greg Kroah-Hartman
` (565 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Bjorn Andersson, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 41a37d157a613444c97e8f71a5fb2a21116b70d7 ]
The commit e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") added names
for PCIe resets, but it did not change the existing qcs404.dtsi to use
these names. Do it now and use symbol names to make it easier to check
and modify the dtsi in future.
Fixes: e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets")
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221226042154.2666748-14-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/qcs404.dtsi b/arch/arm64/boot/dts/qcom/qcs404.dtsi
index 18cc8e3bc93ac..fd0d634a373fc 100644
--- a/arch/arm64/boot/dts/qcom/qcs404.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcs404.dtsi
@@ -775,7 +775,7 @@ pcie_phy: phy@7786000 {
clocks = <&gcc GCC_PCIE_0_PIPE_CLK>;
resets = <&gcc GCC_PCIEPHY_0_PHY_BCR>,
- <&gcc 21>;
+ <&gcc GCC_PCIE_0_PIPE_ARES>;
reset-names = "phy", "pipe";
clock-output-names = "pcie_0_pipe_clk";
@@ -1305,12 +1305,12 @@ pcie: pci@10000000 {
<&gcc GCC_PCIE_0_SLV_AXI_CLK>;
clock-names = "iface", "aux", "master_bus", "slave_bus";
- resets = <&gcc 18>,
- <&gcc 17>,
- <&gcc 15>,
- <&gcc 19>,
+ resets = <&gcc GCC_PCIE_0_AXI_MASTER_ARES>,
+ <&gcc GCC_PCIE_0_AXI_SLAVE_ARES>,
+ <&gcc GCC_PCIE_0_AXI_MASTER_STICKY_ARES>,
+ <&gcc GCC_PCIE_0_CORE_STICKY_ARES>,
<&gcc GCC_PCIE_0_BCR>,
- <&gcc 16>;
+ <&gcc GCC_PCIE_0_AHB_ARES>;
reset-names = "axi_m",
"axi_s",
"axi_m_sticky",
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 006/567] arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 005/567] arm64: dts: qcom: qcs404: use symbol names for PCIe resets Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 007/567] arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k Greg Kroah-Hartman
` (564 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Neil Armstrong,
Bjorn Andersson, Sasha Levin
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit 43069b9cd358aebc692e654de91ee06ff66e26af ]
The hardware turns out to be pretty sluggish at assuming it can only
do USB2 with just a USB2 phy assigned to it - before it needed about
6 minutes to acknowledge that.
Limit it to USB-HS explicitly to make USB come up about 720x faster.
Fixes: 9da65e441d4d ("arm64: dts: qcom: Add support for SONY Xperia X Performance / XZ / XZs (msm8996, Tone platform)")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221124220147.102611-1-konrad.dybcio@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi b/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi
index 507396c4d23b6..7802abac39fa5 100644
--- a/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi
@@ -938,10 +938,6 @@ touch_int_sleep: touch-int-sleep {
};
};
-/*
- * For reasons that are currently unknown (but probably related to fusb301), USB takes about
- * 6 minutes to wake up (nothing interesting in kernel logs), but then it works as it should.
- */
&usb3 {
status = "okay";
qcom,select-utmi-as-pipe-clk;
@@ -950,6 +946,7 @@ &usb3 {
&usb3_dwc3 {
extcon = <&usb3_id>;
dr_mode = "peripheral";
+ maximum-speed = "high-speed";
phys = <&hsusb_phy1>;
phy-names = "usb2-phy";
snps,hird-threshold = /bits/ 8 <0>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 007/567] arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 006/567] arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 008/567] arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings Greg Kroah-Hartman
` (563 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marijn Suijten, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Marijn Suijten <marijn.suijten@somainline.org>
[ Upstream commit be8de06dc397c45cb0f3fe04084089c3f06c419f ]
The framebuffer configuration for kumano griffin, written in kumano dtsi
(which is overwritten in bahamut dts for its smaller panel) has to use a
1096x2560 configuration as this is what the panel (and framebuffer area)
has been initialized to. Downstream userspace also has access to (and
uses) this 2.5k mode by default, and only switches the panel to 4k when
requested.
Fixes: d0a6ce59ea4e ("arm64: dts: qcom: sm8150: Add support for SONY Xperia 1 / 5 (Kumano platform)")
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221209191733.1458031-1-marijn.suijten@somainline.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi
index fb6e5a140c9f6..04c71f74ab72d 100644
--- a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi
@@ -33,9 +33,10 @@ chosen {
framebuffer: framebuffer@9c000000 {
compatible = "simple-framebuffer";
reg = <0 0x9c000000 0 0x2300000>;
- width = <1644>;
- height = <3840>;
- stride = <(1644 * 4)>;
+ /* Griffin BL initializes in 2.5k mode, not 4k */
+ width = <1096>;
+ height = <2560>;
+ stride = <(1096 * 4)>;
format = "a8r8g8b8";
/*
* That's (going to be) a lot of clocks, but it's necessary due
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 008/567] arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 007/567] arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 009/567] arm64: dts: imx8m: Align SoC unique ID node unit address Greg Kroah-Hartman
` (562 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marijn Suijten, Martin Botka,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
From: Marijn Suijten <marijn.suijten@somainline.org>
[ Upstream commit 8416262b0ea46d84767141b074748f4d4f37736a ]
Reorder the clocks and corresponding names to match the QUSB2 phy
schema, fixing the following CHECK_DTBS errors:
arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dtb: phy@1613000: clock-names:0: 'cfg_ahb' was expected
From schema: /newdata/aosp-r/kernel/mainline/kernel/Documentation/devicetree/bindings/phy/qcom,qusb2-phy.yaml
arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dtb: phy@1613000: clock-names:1: 'ref' was expected
From schema: /newdata/aosp-r/kernel/mainline/kernel/Documentation/devicetree/bindings/phy/qcom,qusb2-phy.yaml
Fixes: cff4bbaf2a2d ("arm64: dts: qcom: Add support for SM6125")
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Reviewed-by: Martin Botka <martin.botka@somainline.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221216213343.1140143-1-marijn.suijten@somainline.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm6125.dtsi | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi
index dc3bddc54eb62..2e4fe2bc1e0a8 100644
--- a/arch/arm64/boot/dts/qcom/sm6125.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi
@@ -392,9 +392,9 @@ hsusb_phy1: phy@1613000 {
reg = <0x01613000 0x180>;
#phy-cells = <0>;
- clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>,
- <&gcc GCC_AHB2PHY_USB_CLK>;
- clock-names = "ref", "cfg_ahb";
+ clocks = <&gcc GCC_AHB2PHY_USB_CLK>,
+ <&rpmcc RPM_SMD_XO_CLK_SRC>;
+ clock-names = "cfg_ahb", "ref";
resets = <&gcc GCC_QUSB2PHY_PRIM_BCR>;
status = "disabled";
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 009/567] arm64: dts: imx8m: Align SoC unique ID node unit address
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 008/567] arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 010/567] ARM: zynq: Fix refcount leak in zynq_early_slcr_init Greg Kroah-Hartman
` (561 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peng Fan, Marek Vasut, Shawn Guo,
Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit ee0d68f219be8618f53d3f8808952e20525e3f30 ]
Align the SoC unique ID DT node unit address with its reg property.
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Fixes: cbff23797fa1 ("arm64: dts: imx8m: add NVMEM provider and consumer to read soc unique ID")
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +-
arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +-
arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +-
arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
index 67e91fdfaf526..2a67122c5624c 100644
--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
@@ -530,7 +530,7 @@ ocotp: efuse@30350000 {
#address-cells = <1>;
#size-cells = <1>;
- imx8mm_uid: unique-id@410 {
+ imx8mm_uid: unique-id@4 {
reg = <0x4 0x8>;
};
diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
index 6dcead5bae620..0c47ff2426410 100644
--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
@@ -533,7 +533,7 @@ ocotp: efuse@30350000 {
#address-cells = <1>;
#size-cells = <1>;
- imx8mn_uid: unique-id@410 {
+ imx8mn_uid: unique-id@4 {
reg = <0x4 0x8>;
};
diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
index 664177ed38d3e..ab670b5d641b1 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
@@ -358,7 +358,7 @@ ocotp: efuse@30350000 {
#address-cells = <1>;
#size-cells = <1>;
- imx8mp_uid: unique-id@420 {
+ imx8mp_uid: unique-id@8 {
reg = <0x8 0x8>;
};
diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
index fd38092bb247e..2a698c5b87bcd 100644
--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
@@ -557,7 +557,7 @@ ocotp: efuse@30350000 {
#address-cells = <1>;
#size-cells = <1>;
- imx8mq_uid: soc-uid@410 {
+ imx8mq_uid: soc-uid@4 {
reg = <0x4 0x8>;
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 010/567] ARM: zynq: Fix refcount leak in zynq_early_slcr_init
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 009/567] arm64: dts: imx8m: Align SoC unique ID node unit address Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 011/567] arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description Greg Kroah-Hartman
` (560 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qiheng Lin, Michal Simek, Sasha Levin
From: Qiheng Lin <linqiheng@huawei.com>
[ Upstream commit 9eedb910a3be0005b88c696a8552c0d4c9937cd4 ]
of_find_compatible_node() returns a node pointer with refcount incremented,
we should use of_node_put() on error path.
Add missing of_node_put() to avoid refcount leak.
Fixes: 3329659df030 ("ARM: zynq: Simplify SLCR initialization")
Signed-off-by: Qiheng Lin <linqiheng@huawei.com>
Link: https://lore.kernel.org/r/20221129140544.41293-1-linqiheng@huawei.com
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-zynq/slcr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-zynq/slcr.c b/arch/arm/mach-zynq/slcr.c
index 37707614885a5..9765b3f4c2fc5 100644
--- a/arch/arm/mach-zynq/slcr.c
+++ b/arch/arm/mach-zynq/slcr.c
@@ -213,6 +213,7 @@ int __init zynq_early_slcr_init(void)
zynq_slcr_regmap = syscon_regmap_lookup_by_compatible("xlnx,zynq-slcr");
if (IS_ERR(zynq_slcr_regmap)) {
pr_err("%s: failed to find zynq-slcr\n", __func__);
+ of_node_put(np);
return -ENODEV;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 011/567] arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 010/567] ARM: zynq: Fix refcount leak in zynq_early_slcr_init Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 012/567] arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name Greg Kroah-Hartman
` (559 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai,
AngeloGioacchino Del Regno, Matthias Brugger, Sasha Levin
From: Chen-Yu Tsai <wenst@chromium.org>
[ Upstream commit ce8a06b5bac75ccce99c0cf91b96b767d64f28a7 ]
The systimer block derives its 13 MHz clock by dividing the main 26 MHz
oscillator clock by 2 internally, not through the TOPCKGEN clock
controller.
On the MT8183 this divider is set either by power-on-reset or by the
bootloader. The bootloader may then make the divider unconfigurable to,
but can be read out by, the operating system.
Making the systimer block take the 26 MHz clock directly requires
changing the implementations. As an ABI compatible fix, change the
input clock of the systimer block a fixed factor divide-by-2 clock
that takes the 26 MHz oscillator as its input.
Fixes: 5bc8e2875ffb ("arm64: dts: mt8183: add systimer0 device node")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20221201084229.3464449-2-wenst@chromium.org
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8183.dtsi | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
index f4e0bea8ddcb6..81fde34ffd52a 100644
--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
@@ -299,6 +299,15 @@ psci {
method = "smc";
};
+ clk13m: fixed-factor-clock-13m {
+ compatible = "fixed-factor-clock";
+ #clock-cells = <0>;
+ clocks = <&clk26m>;
+ clock-div = <2>;
+ clock-mult = <1>;
+ clock-output-names = "clk13m";
+ };
+
clk26m: oscillator {
compatible = "fixed-clock";
#clock-cells = <0>;
@@ -610,8 +619,7 @@ systimer: timer@10017000 {
"mediatek,mt6765-timer";
reg = <0 0x10017000 0 0x1000>;
interrupts = <GIC_SPI 200 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&topckgen CLK_TOP_CLK13M>;
- clock-names = "clk13m";
+ clocks = <&clk13m>;
};
iommu: iommu@10205000 {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 012/567] arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 011/567] arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 013/567] arm64: dts: qcom: sc7180: correct SPMI bus address cells Greg Kroah-Hartman
` (558 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Doug Anderson, Krzysztof Kozlowski,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 740862bb5f59b93efb390a417995f88a64bdc323 ]
The pin config entry should have a string, not number, for the GPIO used
as WCD9340 audio codec interrupt.
Fixes: 89a32a4e769c ("arm64: dts: qcom: db845c: add analog audio support")
Reported-by: Doug Anderson <dianders@chromium.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221222151319.122398-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
index 146d3cd3f1b31..5ce270f0b2ec1 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
@@ -896,7 +896,7 @@ sdc2_card_det_n: sd-card-det-n {
};
wcd_intr_default: wcd_intr_default {
- pins = <54>;
+ pins = "gpio54";
function = "gpio";
input-enable;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 013/567] arm64: dts: qcom: sc7180: correct SPMI bus address cells
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 012/567] arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 014/567] arm64: dts: qcom: sc7280: " Greg Kroah-Hartman
` (557 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Stephen Boyd, Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 1f75745537222172f84783d369bbd1fb2d4b6414 ]
The SPMI bus uses two address cells and zero size cells (second reg
entry - SPMI_USID - is not the size):
spmi@c440000: #address-cells:0:0: 2 was expected
Fixes: 0f9dc5f09fbd ("arm64: dts: qcom: sc7180: Add SPMI PMIC arbiter device")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221213101921.47924-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
index de86ae3a7fd27..12816d60e2494 100644
--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
@@ -3241,8 +3241,8 @@ spmi_bus: spmi@c440000 {
interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>;
qcom,ee = <0>;
qcom,channel = <0>;
- #address-cells = <1>;
- #size-cells = <1>;
+ #address-cells = <2>;
+ #size-cells = <0>;
interrupt-controller;
#interrupt-cells = <4>;
cell-index = <0>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 014/567] arm64: dts: qcom: sc7280: correct SPMI bus address cells
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 013/567] arm64: dts: qcom: sc7180: correct SPMI bus address cells Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 015/567] arm64: dts: meson-gx: Fix Ethernet MAC address unit name Greg Kroah-Hartman
` (556 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Stephen Boyd, Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 8da3786a91e56fe0c4aeb2c2209744474af6e517 ]
The SPMI bus uses two address cells and zero size cells (second reg
entry - SPMI_USID - is not the size):
spmi@c440000: #address-cells:0:0: 2 was expected
Fixes: 14abf8dfe364 ("arm64: dts: qcom: sc7280: Add SPMI PMIC arbiter device for SC7280")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221213101921.47924-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
index b795a9993cc1b..fb6473a0aa4b3 100644
--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
@@ -1494,8 +1494,8 @@ spmi_bus: spmi@c440000 {
interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>;
qcom,ee = <0>;
qcom,channel = <0>;
- #address-cells = <1>;
- #size-cells = <1>;
+ #address-cells = <2>;
+ #size-cells = <0>;
interrupt-controller;
#interrupt-cells = <4>;
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 015/567] arm64: dts: meson-gx: Fix Ethernet MAC address unit name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 014/567] arm64: dts: qcom: sc7280: " Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 016/567] arm64: dts: meson-g12a: Fix internal Ethernet PHY " Greg Kroah-Hartman
` (555 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vyacheslav Bocharov,
Martin Blumenstingl, Neil Armstrong, Sasha Levin
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[ Upstream commit 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 ]
Unit names should use hyphens instead of underscores to not cause
warnings.
Fixes: bfe59f92d306 ("ARM64: dts: amlogic: gxbb: Enable NVMEM")
Suggested-by: Vyacheslav Bocharov <adeep@lexina.in>
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20230111211350.1461860-5-martin.blumenstingl@googlemail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
index ee623ead972e5..f8d46588e582f 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
@@ -232,7 +232,7 @@ sn: sn@14 {
reg = <0x14 0x10>;
};
- eth_mac: eth_mac@34 {
+ eth_mac: eth-mac@34 {
reg = <0x34 0x10>;
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 016/567] arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 015/567] arm64: dts: meson-gx: Fix Ethernet MAC address unit name Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 017/567] arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address Greg Kroah-Hartman
` (554 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Blumenstingl, Neil Armstrong,
Sasha Levin
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[ Upstream commit e7303651bbc76c848007f1cfac1fbeaa65f600d1 ]
Documentation/devicetree/bindings/net/ethernet-phy.yaml defines that the
node name for Ethernet PHYs should match the following pattern:
^ethernet-phy(@[a-f0-9]+)?$
Replace the underscore with a hyphen to adhere to this binding.
Fixes: 280c17df8fbf ("arm64: dts: meson: g12a: add mdio multiplexer")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20230111211350.1461860-6-martin.blumenstingl@googlemail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
index 2526d6e3a3dcb..899cfe416aef4 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
@@ -1733,7 +1733,7 @@ int_mdio: mdio@1 {
#address-cells = <1>;
#size-cells = <0>;
- internal_ephy: ethernet_phy@8 {
+ internal_ephy: ethernet-phy@8 {
compatible = "ethernet-phy-id0180.3301",
"ethernet-phy-ieee802.3-c22";
interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 017/567] arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 016/567] arm64: dts: meson-g12a: Fix internal Ethernet PHY " Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 018/567] arm64: dts: msm8992-bullhead: add memory hole region Greg Kroah-Hartman
` (553 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Blumenstingl, Neil Armstrong,
Sasha Levin
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[ Upstream commit f189c869ad92787ddd753558bcbae89d75825bb6 ]
Node names should be generic and use hyphens instead of underscores to
not cause warnings. Also nodes without a reg property should not have a
unit-address. Change the scpi_dvfs node to use clock-controller as node
name without a unit address (since it does not have a reg property).
Fixes: 70db166a2baa ("ARM64: dts: meson-gxbb: Add SCPI with cpufreq & sensors Nodes")
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20230111211350.1461860-7-martin.blumenstingl@googlemail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
index f8d46588e582f..304f6b467de8b 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
@@ -249,7 +249,7 @@ scpi {
scpi_clocks: clocks {
compatible = "arm,scpi-clocks";
- scpi_dvfs: scpi_clocks@0 {
+ scpi_dvfs: clock-controller {
compatible = "arm,scpi-dvfs-clocks";
#clock-cells = <1>;
clock-indices = <0>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 018/567] arm64: dts: msm8992-bullhead: add memory hole region
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 017/567] arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 019/567] arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size Greg Kroah-Hartman
` (552 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Vorel, Dominik Kobinski,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
From: Dominik Kobinski <dominikkobinski314@gmail.com>
[ Upstream commit 22c7e1a0fa45cd7d028d6b4117161fd0e3427fe0 ]
Add region for memory hole present on bullhead in order to
fix a reboot issue on recent kernels
Reported-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Dominik Kobinski <dominikkobinski314@gmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Tested-by: Petr Vorel <petr.vorel@gmail.com>
Reviewed-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221211100501.82323-1-dominikkobinski314@gmail.com
Stable-dep-of: 26a91359aea4 ("arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
index c7d191dc6d4ba..d7d06553bf9ec 100644
--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
+++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
@@ -2,6 +2,7 @@
/* Copyright (c) 2015, LGE Inc. All rights reserved.
* Copyright (c) 2016, The Linux Foundation. All rights reserved.
* Copyright (c) 2021, Petr Vorel <petr.vorel@gmail.com>
+ * Copyright (c) 2022, Dominik Kobinski <dominikkobinski314@gmail.com>
*/
/dts-v1/;
@@ -50,6 +51,11 @@ cont_splash_mem: memory@3400000 {
reg = <0 0x03400000 0 0x1200000>;
no-map;
};
+
+ removed_region: reserved@5000000 {
+ reg = <0 0x05000000 0 0x2200000>;
+ no-map;
+ };
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 019/567] arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 018/567] arm64: dts: msm8992-bullhead: add memory hole region Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 020/567] arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem Greg Kroah-Hartman
` (551 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Vorel, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Petr Vorel <petr.vorel@gmail.com>
[ Upstream commit 26a91359aea4d89e7d3646d806eed0f3755b74bd ]
Original google firmware reports 12 MiB:
[ 0.000000] cma: Found cont_splash_mem@0, memory base 0x0000000003400000, size 12 MiB, limit 0xffffffffffffffff
which is actually 12*1024*1024 = 0xc00000.
This matches the aosp source [1]:
&cont_splash_mem {
reg = <0 0x03400000 0 0xc00000>;
};
Fixes: 3cb6a271f4b0 ("arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem mapping")
Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994")
[1] https://android.googlesource.com/kernel/msm.git/+/android-7.0.0_r0.17/arch/arm64/boot/dts/lge/msm8992-bullhead.dtsi#141
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221226185440.440968-2-pevik@seznam.cz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
index d7d06553bf9ec..8e20bb13bd65e 100644
--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
+++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2015, LGE Inc. All rights reserved.
* Copyright (c) 2016, The Linux Foundation. All rights reserved.
- * Copyright (c) 2021, Petr Vorel <petr.vorel@gmail.com>
+ * Copyright (c) 2021-2022, Petr Vorel <petr.vorel@gmail.com>
* Copyright (c) 2022, Dominik Kobinski <dominikkobinski314@gmail.com>
*/
@@ -48,7 +48,7 @@ ramoops@1ff00000 {
};
cont_splash_mem: memory@3400000 {
- reg = <0 0x03400000 0 0x1200000>;
+ reg = <0 0x03400000 0 0xc00000>;
no-map;
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 020/567] arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 019/567] arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 021/567] arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names Greg Kroah-Hartman
` (550 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Vorel, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
From: Petr Vorel <petr.vorel@gmail.com>
[ Upstream commit 4dee5aa44b924036511a744ceb3abb1ceeb96bb6 ]
It's disabled on downstream [1] thus not shown on downstream dmesg.
Removing it fixes warnings on v6.1:
[ 0.000000] OF: reserved mem: OVERLAP DETECTED!
[ 0.000000] dfps_data_mem@3400000 (0x0000000003400000--0x0000000003401000) overlaps with memory@3400000 (0x0000000003400000--0x0000000004600000)
[1] https://android.googlesource.com/kernel/msm.git/+/android-7.0.0_r0.17/arch/arm64/boot/dts/lge/msm8992-bullhead.dtsi#137
Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994")
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221226185440.440968-3-pevik@seznam.cz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
index 8e20bb13bd65e..84ba740cb957b 100644
--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
+++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
@@ -14,6 +14,9 @@
/* cont_splash_mem has different memory mapping */
/delete-node/ &cont_splash_mem;
+/* disabled on downstream, conflicts with cont_splash_mem */
+/delete-node/ &dfps_data_mem;
+
/ {
model = "LG Nexus 5X";
compatible = "lg,bullhead", "qcom,msm8992";
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 021/567] arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 020/567] arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 022/567] arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes Greg Kroah-Hartman
` (549 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Marko, Dmitry Baryshkov,
Bjorn Andersson, Sasha Levin
From: Robert Marko <robimarko@gmail.com>
[ Upstream commit 877cff3568c0f54511d77918ae16b2d6e9a0dfce ]
It seems that clock-output-names for the USB3 QMP PHY-s where set without
actually checking what is the GCC clock driver expecting, so clock core
could never actually find the parents for usb0_pipe_clk_src and
usb1_pipe_clk_src clocks in the GCC driver.
So, correct the names to be what the driver expects so that parenting
works.
Before:
gcc_usb0_pipe_clk_src 0 0 0 125000000 0 0 50000 Y
gcc_usb1_pipe_clk_src 0 0 0 125000000 0 0 50000 Y
After:
usb3phy_0_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y
usb0_pipe_clk_src 1 1 0 125000000 0 0 50000 Y
gcc_usb0_pipe_clk 1 1 0 125000000 0 0 50000 Y
usb3phy_1_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y
usb1_pipe_clk_src 1 1 0 125000000 0 0 50000 Y
gcc_usb1_pipe_clk 1 1 0 125000000 0 0 50000 Y
Fixes: 5e09bc51d07b ("arm64: dts: ipq8074: enable USB support")
Signed-off-by: Robert Marko <robimarko@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230108130440.670181-2-robimarko@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
index 9d4019e0949a9..183b144a23fb5 100644
--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
@@ -114,7 +114,7 @@ usb1_ssphy: phy@58200 {
#phy-cells = <0>;
clocks = <&gcc GCC_USB1_PIPE_CLK>;
clock-names = "pipe0";
- clock-output-names = "gcc_usb1_pipe_clk_src";
+ clock-output-names = "usb3phy_1_cc_pipe_clk";
};
};
@@ -157,7 +157,7 @@ usb0_ssphy: phy@78200 {
#phy-cells = <0>;
clocks = <&gcc GCC_USB0_PIPE_CLK>;
clock-names = "pipe0";
- clock-output-names = "gcc_usb0_pipe_clk_src";
+ clock-output-names = "usb3phy_0_cc_pipe_clk";
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 022/567] arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 021/567] arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:55 ` [PATCH 5.15 023/567] arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size Greg Kroah-Hartman
` (548 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shawn Guo, Bjorn Andersson, Sasha Levin
From: Shawn Guo <shawn.guo@linaro.org>
[ Upstream commit 942bcd33ed455ad40b71a59901bd926bbf4a500e ]
IPQ8074 PCIe PHY nodes are broken in the many ways:
- '#address-cells', '#size-cells' and 'ranges' are missing.
- Child phy/lane node is missing, and the child properties like
'#phy-cells' and 'clocks' are mistakenly put into parent node.
- The clocks properties for parent node are missing.
Fix them to get the nodes comply with the bindings schema.
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20210929034253.24570-9-shawn.guo@linaro.org
Stable-dep-of: 7ba33591b45f ("arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/ipq8074.dtsi | 46 +++++++++++++++++++++------
1 file changed, 36 insertions(+), 10 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
index 183b144a23fb5..ae32e2380dd5a 100644
--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
@@ -174,34 +174,60 @@ qusb_phy_0: phy@79000 {
status = "disabled";
};
- pcie_phy0: phy@86000 {
+ pcie_qmp0: phy@86000 {
compatible = "qcom,ipq8074-qmp-pcie-phy";
reg = <0x00086000 0x1000>;
- #phy-cells = <0>;
- clocks = <&gcc GCC_PCIE0_PIPE_CLK>;
- clock-names = "pipe_clk";
- clock-output-names = "pcie20_phy0_pipe_clk";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges;
+ clocks = <&gcc GCC_PCIE0_AUX_CLK>,
+ <&gcc GCC_PCIE0_AHB_CLK>;
+ clock-names = "aux", "cfg_ahb";
resets = <&gcc GCC_PCIE0_PHY_BCR>,
<&gcc GCC_PCIE0PHY_PHY_BCR>;
reset-names = "phy",
"common";
status = "disabled";
+
+ pcie_phy0: phy@86200 {
+ reg = <0x86200 0x16c>,
+ <0x86400 0x200>,
+ <0x86800 0x4f4>;
+ #phy-cells = <0>;
+ #clock-cells = <0>;
+ clocks = <&gcc GCC_PCIE0_PIPE_CLK>;
+ clock-names = "pipe0";
+ clock-output-names = "pcie_0_pipe_clk";
+ };
};
- pcie_phy1: phy@8e000 {
+ pcie_qmp1: phy@8e000 {
compatible = "qcom,ipq8074-qmp-pcie-phy";
reg = <0x0008e000 0x1000>;
- #phy-cells = <0>;
- clocks = <&gcc GCC_PCIE1_PIPE_CLK>;
- clock-names = "pipe_clk";
- clock-output-names = "pcie20_phy1_pipe_clk";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges;
+ clocks = <&gcc GCC_PCIE1_AUX_CLK>,
+ <&gcc GCC_PCIE1_AHB_CLK>;
+ clock-names = "aux", "cfg_ahb";
resets = <&gcc GCC_PCIE1_PHY_BCR>,
<&gcc GCC_PCIE1PHY_PHY_BCR>;
reset-names = "phy",
"common";
status = "disabled";
+
+ pcie_phy1: phy@8e200 {
+ reg = <0x8e200 0x16c>,
+ <0x8e400 0x200>,
+ <0x8e800 0x4f4>;
+ #phy-cells = <0>;
+ #clock-cells = <0>;
+ clocks = <&gcc GCC_PCIE1_PIPE_CLK>;
+ clock-names = "pipe0";
+ clock-output-names = "pcie_1_pipe_clk";
+ };
};
prng: rng@e3000 {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 023/567] arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 022/567] arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes Greg Kroah-Hartman
@ 2023-03-07 16:55 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 024/567] arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY Greg Kroah-Hartman
` (547 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Bjorn Andersson, Sasha Levin
From: Johan Hovold <johan+linaro@kernel.org>
[ Upstream commit ed22cc93abae68f9d3fc4957c20a1d902cf28882 ]
The size of the PCIe PHY serdes register region is 0x1c4 and the
corresponding 'reg' property should specifically not include the
adjacent regions that are defined in the child node (e.g. tx and rx).
Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes")
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20220915143431.19842-1-johan+linaro@kernel.org
Stable-dep-of: 7ba33591b45f ("arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
index ae32e2380dd5a..a7ce999182e9e 100644
--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
@@ -176,7 +176,7 @@ qusb_phy_0: phy@79000 {
pcie_qmp0: phy@86000 {
compatible = "qcom,ipq8074-qmp-pcie-phy";
- reg = <0x00086000 0x1000>;
+ reg = <0x00086000 0x1c4>;
#address-cells = <1>;
#size-cells = <1>;
ranges;
@@ -204,7 +204,7 @@ pcie_phy0: phy@86200 {
pcie_qmp1: phy@8e000 {
compatible = "qcom,ipq8074-qmp-pcie-phy";
- reg = <0x0008e000 0x1000>;
+ reg = <0x0008e000 0x1c4>;
#address-cells = <1>;
#size-cells = <1>;
ranges;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 024/567] arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2023-03-07 16:55 ` [PATCH 5.15 023/567] arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 025/567] arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges Greg Kroah-Hartman
` (546 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Marko, Bjorn Andersson, Sasha Levin
From: Robert Marko <robimarko@gmail.com>
[ Upstream commit 7ba33591b45f9d547a317e42f1c2acd19c925eb6 ]
IPQ8074 comes in 2 silicon versions:
* v1 with 2x Gen2 PCIe ports and QMP PHY-s
* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s
v2 is the final and production version that is actually supported by the
kernel, however it looks like PCIe related nodes were added for the v1 SoC.
Now that we have Gen3 QMP PHY support, we can start fixing the PCIe support
by fixing the Gen3 QMP PHY node first.
Change the compatible to the Gen3 QMP PHY, correct the register space start
and size, add the missing misc PCS register space.
Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes")
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230113164449.906002-2-robimarko@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/ipq8074.dtsi | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
index a7ce999182e9e..6a095087bc64e 100644
--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
@@ -174,9 +174,9 @@ qusb_phy_0: phy@79000 {
status = "disabled";
};
- pcie_qmp0: phy@86000 {
- compatible = "qcom,ipq8074-qmp-pcie-phy";
- reg = <0x00086000 0x1c4>;
+ pcie_qmp0: phy@84000 {
+ compatible = "qcom,ipq8074-qmp-gen3-pcie-phy";
+ reg = <0x00084000 0x1bc>;
#address-cells = <1>;
#size-cells = <1>;
ranges;
@@ -190,10 +190,11 @@ pcie_qmp0: phy@86000 {
"common";
status = "disabled";
- pcie_phy0: phy@86200 {
- reg = <0x86200 0x16c>,
- <0x86400 0x200>,
- <0x86800 0x4f4>;
+ pcie_phy0: phy@84200 {
+ reg = <0x84200 0x16c>,
+ <0x84400 0x200>,
+ <0x84800 0x1f0>,
+ <0x84c00 0xf4>;
#phy-cells = <0>;
#clock-cells = <0>;
clocks = <&gcc GCC_PCIE0_PIPE_CLK>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 025/567] arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 024/567] arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 026/567] arm64: dts: qcom: ipq8074: fix Gen3 PCIe node Greg Kroah-Hartman
` (545 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Marko, Bjorn Andersson, Sasha Levin
From: Robert Marko <robimarko@gmail.com>
[ Upstream commit 2055cb7dccea16bafa3adf9c5e3216949512c34a ]
Current ranges property set in Gen2 PCIe node is incorrect, replace it
with the downstream 5.4 QCA kernel value.
Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes")
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230113164449.906002-3-robimarko@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/ipq8074.dtsi | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
index 6a095087bc64e..fe0a4cdfe4e56 100644
--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
@@ -662,9 +662,9 @@ pcie1: pci@10000000 {
phy-names = "pciephy";
ranges = <0x81000000 0 0x10200000 0x10200000
- 0 0x100000 /* downstream I/O */
- 0x82000000 0 0x10300000 0x10300000
- 0 0xd00000>; /* non-prefetchable memory */
+ 0 0x10000>, /* downstream I/O */
+ <0x82000000 0 0x10220000 0x10220000
+ 0 0xfde0000>; /* non-prefetchable memory */
interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
interrupt-names = "msi";
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 026/567] arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 025/567] arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 027/567] arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names Greg Kroah-Hartman
` (544 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Marko, Bjorn Andersson, Sasha Levin
From: Robert Marko <robimarko@gmail.com>
[ Upstream commit 3e83a9c41ab0244a45a4a2800b9adb8de0d15f82 ]
IPQ8074 comes in 2 silicon versions:
* v1 with 2x Gen2 PCIe ports and QMP PHY-s
* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s
v2 is the final and production version that is actually supported by the
kernel, however it looks like PCIe related nodes were added for the v1 SoC.
Finish the PCIe fixup by using the correct compatible, adding missing ATU
register space, declaring max-link-speed, use correct ranges, add missing
clocks and resets.
Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes")
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230113164449.906002-8-robimarko@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/ipq8074.dtsi | 30 +++++++++++++++------------
1 file changed, 17 insertions(+), 13 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
index fe0a4cdfe4e56..e1c1f132209d9 100644
--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
@@ -707,16 +707,18 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */
};
pcie0: pci@20000000 {
- compatible = "qcom,pcie-ipq8074";
+ compatible = "qcom,pcie-ipq8074-gen3";
reg = <0x20000000 0xf1d>,
<0x20000f20 0xa8>,
- <0x00080000 0x2000>,
+ <0x20001000 0x1000>,
+ <0x00080000 0x4000>,
<0x20100000 0x1000>;
- reg-names = "dbi", "elbi", "parf", "config";
+ reg-names = "dbi", "elbi", "atu", "parf", "config";
device_type = "pci";
linux,pci-domain = <0>;
bus-range = <0x00 0xff>;
num-lanes = <1>;
+ max-link-speed = <3>;
#address-cells = <3>;
#size-cells = <2>;
@@ -724,9 +726,9 @@ pcie0: pci@20000000 {
phy-names = "pciephy";
ranges = <0x81000000 0 0x20200000 0x20200000
- 0 0x100000 /* downstream I/O */
- 0x82000000 0 0x20300000 0x20300000
- 0 0xd00000>; /* non-prefetchable memory */
+ 0 0x10000>, /* downstream I/O */
+ <0x82000000 0 0x20220000 0x20220000
+ 0 0xfde0000>; /* non-prefetchable memory */
interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
interrupt-names = "msi";
@@ -744,28 +746,30 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */
clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>,
<&gcc GCC_PCIE0_AXI_M_CLK>,
<&gcc GCC_PCIE0_AXI_S_CLK>,
- <&gcc GCC_PCIE0_AHB_CLK>,
- <&gcc GCC_PCIE0_AUX_CLK>;
-
+ <&gcc GCC_PCIE0_AXI_S_BRIDGE_CLK>,
+ <&gcc GCC_PCIE0_RCHNG_CLK>;
clock-names = "iface",
"axi_m",
"axi_s",
- "ahb",
- "aux";
+ "axi_bridge",
+ "rchng";
+
resets = <&gcc GCC_PCIE0_PIPE_ARES>,
<&gcc GCC_PCIE0_SLEEP_ARES>,
<&gcc GCC_PCIE0_CORE_STICKY_ARES>,
<&gcc GCC_PCIE0_AXI_MASTER_ARES>,
<&gcc GCC_PCIE0_AXI_SLAVE_ARES>,
<&gcc GCC_PCIE0_AHB_ARES>,
- <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>;
+ <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>,
+ <&gcc GCC_PCIE0_AXI_SLAVE_STICKY_ARES>;
reset-names = "pipe",
"sleep",
"sticky",
"axi_m",
"axi_s",
"ahb",
- "axi_m_sticky";
+ "axi_m_sticky",
+ "axi_s_sticky";
status = "disabled";
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 027/567] arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 026/567] arm64: dts: qcom: ipq8074: fix Gen3 PCIe node Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 028/567] arm64: dts: meson: remove CPU opps below 1GHz for G12A boards Greg Kroah-Hartman
` (543 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Marko, Bjorn Andersson, Sasha Levin
From: Robert Marko <robimarko@gmail.com>
[ Upstream commit 0e8b90c0256cf9c9589e2cee517dedc987a34355 ]
Current PCIe QMP PHY output name were changed in ("arm64: dts: qcom: Fix
IPQ8074 PCIe PHY nodes") however it did not account for the fact that GCC
driver is relying on the old names to match them as they are being used as
the parent for the gcc_pcie0_pipe_clk and gcc_pcie1_pipe_clk.
This broke parenting as GCC could not find the parent clock, so fix it by
changing to the names that driver is expecting.
Fixes: 942bcd33ed45 ("arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes")
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230113164449.906002-9-robimarko@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
index e1c1f132209d9..a893a221e5633 100644
--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
@@ -199,7 +199,7 @@ pcie_phy0: phy@84200 {
#clock-cells = <0>;
clocks = <&gcc GCC_PCIE0_PIPE_CLK>;
clock-names = "pipe0";
- clock-output-names = "pcie_0_pipe_clk";
+ clock-output-names = "pcie20_phy0_pipe_clk";
};
};
@@ -227,7 +227,7 @@ pcie_phy1: phy@8e200 {
#clock-cells = <0>;
clocks = <&gcc GCC_PCIE1_PIPE_CLK>;
clock-names = "pipe0";
- clock-output-names = "pcie_1_pipe_clk";
+ clock-output-names = "pcie20_phy1_pipe_clk";
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 028/567] arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 027/567] arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 029/567] ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() Greg Kroah-Hartman
` (542 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Hewitt, Neil Armstrong,
Sasha Levin
From: Christian Hewitt <christianshewitt@gmail.com>
[ Upstream commit 3cbd431c2b34d84605d358c8c57654193fd661fb ]
Amlogic G12A devices experience CPU stalls and random board wedges when
the system idles and CPU cores clock down to lower opp points. Recent
vendor kernels include a change to remove 100-250MHz and other distro
sources also remove the 500/667MHz points. Unless all 100-667Mhz opps
are removed or the CPU governor forced to performance stalls are still
observed, so let's remove them to improve stability and uptime.
Fixes: b190056fa9ee ("arm64: dts: meson-g12a: add cpus OPP table")
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Link: https://lore.kernel.org/r/20230119053031.21400-1-christianshewitt@gmail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 --------------------
1 file changed, 20 deletions(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi
index fb0ab27d1f642..6eaceb717d617 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi
@@ -57,26 +57,6 @@ cpu_opp_table: opp-table {
compatible = "operating-points-v2";
opp-shared;
- opp-100000000 {
- opp-hz = /bits/ 64 <100000000>;
- opp-microvolt = <731000>;
- };
-
- opp-250000000 {
- opp-hz = /bits/ 64 <250000000>;
- opp-microvolt = <731000>;
- };
-
- opp-500000000 {
- opp-hz = /bits/ 64 <500000000>;
- opp-microvolt = <731000>;
- };
-
- opp-667000000 {
- opp-hz = /bits/ 64 <666666666>;
- opp-microvolt = <731000>;
- };
-
opp-1000000000 {
opp-hz = /bits/ 64 <1000000000>;
opp-microvolt = <731000>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 029/567] ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 028/567] arm64: dts: meson: remove CPU opps below 1GHz for G12A boards Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 030/567] ARM: bcm2835_defconfig: Enable the framebuffer Greg Kroah-Hartman
` (541 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hulk Robot, Yang Yingliang,
Tony Lindgren, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 0414a100d6ab32721efa70ab55524540fdfe0ede ]
If platform_device_add() is not called or failed, it should call
platform_device_put() in error case.
Fixes: 97933d6ced60 ("ARM: OMAP1: dmtimer: conversion to platform devices")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Message-Id: <20220701094602.2365099-1-yangyingliang@huawei.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-omap1/timer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c
index 0411d5508d637..7046d7fa7a0aa 100644
--- a/arch/arm/mach-omap1/timer.c
+++ b/arch/arm/mach-omap1/timer.c
@@ -165,7 +165,7 @@ static int __init omap1_dm_timer_init(void)
kfree(pdata);
err_free_pdev:
- platform_device_unregister(pdev);
+ platform_device_put(pdev);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 030/567] ARM: bcm2835_defconfig: Enable the framebuffer
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 029/567] ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 031/567] ARM: s3c: fix s3c64xx_set_timer_source prototype Greg Kroah-Hartman
` (540 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Wahren, Florian Fainelli,
Sasha Levin
From: Stefan Wahren <stefan.wahren@i2se.com>
[ Upstream commit afc8dd99840b7fb7190e769a893cda673bc3a907 ]
Booting Linux on a Raspberry Pi based on bcm2835_defconfig there is
no display activity.
Enable CONFIG_FB which is nowadays required for CONFIG_FB_SIMPLE
and CONFIG_FRAMEBUFFER_CONSOLE.
Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Link: https://lore.kernel.org/r/20230113205842.17051-1-stefan.wahren@i2se.com
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/configs/bcm2835_defconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/configs/bcm2835_defconfig b/arch/arm/configs/bcm2835_defconfig
index 383c632eba7bd..1e244a9287902 100644
--- a/arch/arm/configs/bcm2835_defconfig
+++ b/arch/arm/configs/bcm2835_defconfig
@@ -108,6 +108,7 @@ CONFIG_MEDIA_SUPPORT=y
CONFIG_MEDIA_CAMERA_SUPPORT=y
CONFIG_DRM=y
CONFIG_DRM_VC4=y
+CONFIG_FB=y
CONFIG_FB_SIMPLE=y
CONFIG_FRAMEBUFFER_CONSOLE=y
CONFIG_SOUND=y
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 031/567] ARM: s3c: fix s3c64xx_set_timer_source prototype
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 030/567] ARM: bcm2835_defconfig: Enable the framebuffer Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 032/567] arm64: dts: ti: k3-j7200: Fix wakeup pinmux range Greg Kroah-Hartman
` (539 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Krzysztof Kozlowski,
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 5bf52f5e4d12b8109f348cab60cb7d51092c4270 ]
The prototype does not match the definition, as gcc-13 points
out:
arch/arm/mach-s3c/s3c64xx.c:169:13: error: conflicting types for 's3c64xx_set_timer_source' due to enum/integer mismatch; have 'void(unsigned int, unsigned int)' [-Werror=enum-int-mismatch]
169 | void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source)
| ^~~~~~~~~~~~~~~~~~~~~~~~
In file included from arch/arm/mach-s3c/s3c64xx.c:50:
arch/arm/mach-s3c/s3c64xx.h:62:20: note: previous declaration of 's3c64xx_set_timer_source' with type 'void(enum s3c64xx_timer_mode, enum s3c64xx_timer_mode)'
62 | extern void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event,
| ^~~~~~~~~~~~~~~~~~~~~~~~
Fixes: 4280506ac9bb ("ARM: SAMSUNG: Move all platforms to new clocksource driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20230118090224.2162863-1-arnd@kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-s3c/s3c64xx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm/mach-s3c/s3c64xx.c b/arch/arm/mach-s3c/s3c64xx.c
index 4dfb648142f2a..17f0065031490 100644
--- a/arch/arm/mach-s3c/s3c64xx.c
+++ b/arch/arm/mach-s3c/s3c64xx.c
@@ -173,7 +173,8 @@ static struct samsung_pwm_variant s3c64xx_pwm_variant = {
.tclk_mask = (1 << 7) | (1 << 6) | (1 << 5),
};
-void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source)
+void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event,
+ enum s3c64xx_timer_mode source)
{
s3c64xx_pwm_variant.output_mask = BIT(SAMSUNG_PWM_NUM) - 1;
s3c64xx_pwm_variant.output_mask &= ~(BIT(event) | BIT(source));
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 032/567] arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 031/567] ARM: s3c: fix s3c64xx_set_timer_source prototype Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 033/567] ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato Greg Kroah-Hartman
` (538 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vaishnav Achath, Jayesh Choudhary,
Vignesh Raghavendra, Sasha Levin
From: Vaishnav Achath <vaishnav.a@ti.com>
[ Upstream commit 9ae21ac445e911e3541985c20052fc05d60f6879 ]
The WKUP_PADCONFIG register region in J7200 has multiple non-addressable
regions, split the existing wkup_pmx region as follows to avoid the
non-addressable regions and include all valid WKUP_PADCONFIG registers.
Also update references to old nodes with new ones.
wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12)
wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15)
wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84)
wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100)
J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) :
https://www.ti.com/lit/ds/symlink/dra821u.pdf
Fixes: d361ed88455f ("arm64: dts: ti: Add support for J7200 SoC")
Signed-off-by: Vaishnav Achath <vaishnav.a@ti.com>
Reviewed-by: Jayesh Choudhary <j-choudhary@ti.com>
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Link: https://lore.kernel.org/r/20230119042622.22310-1-vaishnav.a@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dts/ti/k3-j7200-common-proc-board.dts | 2 +-
.../boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 29 ++++++++++++++++++-
2 files changed, 29 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
index c3406e7f10a97..4417fe81afd7f 100644
--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
@@ -77,7 +77,7 @@ vdd_sd_dv: gpio-regulator-TLV71033 {
};
};
-&wkup_pmx0 {
+&wkup_pmx2 {
mcu_cpsw_pins_default: mcu-cpsw-pins-default {
pinctrl-single,pins = <
J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */
diff --git a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
index 1044ec6c4b0d4..8185c1627c6f1 100644
--- a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
@@ -56,7 +56,34 @@ chipid@43000014 {
wkup_pmx0: pinctrl@4301c000 {
compatible = "pinctrl-single";
/* Proxy 0 addressing */
- reg = <0x00 0x4301c000 0x00 0x178>;
+ reg = <0x00 0x4301c000 0x00 0x34>;
+ #pinctrl-cells = <1>;
+ pinctrl-single,register-width = <32>;
+ pinctrl-single,function-mask = <0xffffffff>;
+ };
+
+ wkup_pmx1: pinctrl@0x4301c038 {
+ compatible = "pinctrl-single";
+ /* Proxy 0 addressing */
+ reg = <0x00 0x4301c038 0x00 0x8>;
+ #pinctrl-cells = <1>;
+ pinctrl-single,register-width = <32>;
+ pinctrl-single,function-mask = <0xffffffff>;
+ };
+
+ wkup_pmx2: pinctrl@0x4301c068 {
+ compatible = "pinctrl-single";
+ /* Proxy 0 addressing */
+ reg = <0x00 0x4301c068 0x00 0xec>;
+ #pinctrl-cells = <1>;
+ pinctrl-single,register-width = <32>;
+ pinctrl-single,function-mask = <0xffffffff>;
+ };
+
+ wkup_pmx3: pinctrl@0x4301c174 {
+ compatible = "pinctrl-single";
+ /* Proxy 0 addressing */
+ reg = <0x00 0x4301c174 0x00 0x20>;
#pinctrl-cells = <1>;
pinctrl-single,register-width = <32>;
pinctrl-single,function-mask = <0xffffffff>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 033/567] ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 032/567] arm64: dts: ti: k3-j7200: Fix wakeup pinmux range Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 034/567] ARM: imx: Call ida_simple_remove() for ida_simple_get Greg Kroah-Hartman
` (537 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit d15d2a617499882971ddb773a583015bf36fa492 ]
The property is wr-active:
exynos3250-rinato.dtb: fimd@11c00000: i80-if-timings: 'wr-act' does not match any of the regexes: 'pinctrl-[0-9]+'
Fixes: b59b3afb94d4 ("ARM: dts: add fimd device support for exynos3250-rinato")
Link: https://lore.kernel.org/r/20230120155404.323386-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/exynos3250-rinato.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts
index f6ba5e4260404..7562497c45dd8 100644
--- a/arch/arm/boot/dts/exynos3250-rinato.dts
+++ b/arch/arm/boot/dts/exynos3250-rinato.dts
@@ -249,7 +249,7 @@ &fimd {
i80-if-timings {
cs-setup = <0>;
wr-setup = <0>;
- wr-act = <1>;
+ wr-active = <1>;
wr-hold = <0>;
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 034/567] ARM: imx: Call ida_simple_remove() for ida_simple_get
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 033/567] ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 035/567] arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name Greg Kroah-Hartman
` (536 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Angus Chen, Shawn Guo, Sasha Levin
From: Angus Chen <angus.chen@jaguarmicro.com>
[ Upstream commit ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 ]
The function call ida_simple_get maybe fail,we should deal with it.
And if ida_simple_get success ,it need to call ida_simple_remove also.
BTW,devm_kasprintf can handle id is zero for consistency.
Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver")
Signed-off-by: Angus Chen <angus.chen@jaguarmicro.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-imx/mmdc.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
index af12668d0bf51..b9efe9da06e0b 100644
--- a/arch/arm/mach-imx/mmdc.c
+++ b/arch/arm/mach-imx/mmdc.c
@@ -99,6 +99,7 @@ struct mmdc_pmu {
cpumask_t cpu;
struct hrtimer hrtimer;
unsigned int active_events;
+ int id;
struct device *dev;
struct perf_event *mmdc_events[MMDC_NUM_COUNTERS];
struct hlist_node node;
@@ -433,8 +434,6 @@ static enum hrtimer_restart mmdc_pmu_timer_handler(struct hrtimer *hrtimer)
static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc,
void __iomem *mmdc_base, struct device *dev)
{
- int mmdc_num;
-
*pmu_mmdc = (struct mmdc_pmu) {
.pmu = (struct pmu) {
.task_ctx_nr = perf_invalid_context,
@@ -452,15 +451,16 @@ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc,
.active_events = 0,
};
- mmdc_num = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL);
+ pmu_mmdc->id = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL);
- return mmdc_num;
+ return pmu_mmdc->id;
}
static int imx_mmdc_remove(struct platform_device *pdev)
{
struct mmdc_pmu *pmu_mmdc = platform_get_drvdata(pdev);
+ ida_simple_remove(&mmdc_ida, pmu_mmdc->id);
cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
perf_pmu_unregister(&pmu_mmdc->pmu);
iounmap(pmu_mmdc->mmdc_base);
@@ -474,7 +474,6 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
{
struct mmdc_pmu *pmu_mmdc;
char *name;
- int mmdc_num;
int ret;
const struct of_device_id *of_id =
of_match_device(imx_mmdc_dt_ids, &pdev->dev);
@@ -497,14 +496,14 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
cpuhp_mmdc_state = ret;
}
- mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev);
- pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;
- if (mmdc_num == 0)
- name = "mmdc";
- else
- name = devm_kasprintf(&pdev->dev,
- GFP_KERNEL, "mmdc%d", mmdc_num);
+ ret = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev);
+ if (ret < 0)
+ goto pmu_free;
+ name = devm_kasprintf(&pdev->dev,
+ GFP_KERNEL, "mmdc%d", ret);
+
+ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;
pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data;
hrtimer_init(&pmu_mmdc->hrtimer, CLOCK_MONOTONIC,
@@ -525,6 +524,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
pmu_register_err:
pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret);
+ ida_simple_remove(&mmdc_ida, pmu_mmdc->id);
cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
hrtimer_cancel(&pmu_mmdc->hrtimer);
pmu_free:
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 035/567] arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 034/567] ARM: imx: Call ida_simple_remove() for ida_simple_get Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 036/567] arm64: dts: amlogic: meson-axg: " Greg Kroah-Hartman
` (535 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit 127f79212b07c5d9a6657a87e3eafdd889335814 ]
Fixes:
scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-1-44351528957e@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
index 304f6b467de8b..31bbfe4868d8e 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
@@ -249,7 +249,7 @@ scpi {
scpi_clocks: clocks {
compatible = "arm,scpi-clocks";
- scpi_dvfs: clock-controller {
+ scpi_dvfs: clocks-0 {
compatible = "arm,scpi-dvfs-clocks";
#clock-cells = <1>;
clock-indices = <0>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 036/567] arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 035/567] arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 037/567] arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible Greg Kroah-Hartman
` (534 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit 5b7069d72f03c92a0ab919725017394ebce03a81 ]
Fixes:
scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-2-44351528957e@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
index e2ab338adb3c1..03e2c5d0bb9c1 100644
--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
@@ -152,7 +152,7 @@ scpi {
scpi_clocks: clocks {
compatible = "arm,scpi-clocks";
- scpi_dvfs: clock-controller {
+ scpi_dvfs: clocks-0 {
compatible = "arm,scpi-dvfs-clocks";
#clock-cells = <1>;
clock-indices = <0>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 037/567] arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 036/567] arm64: dts: amlogic: meson-axg: " Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 038/567] arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property Greg Kroah-Hartman
` (533 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit 2ff650051493d5bdb6dd09d4c2850bb37db6be31 ]
Fixes:
scpi: sensors:compatible: 'oneOf' conditional failed, one must be fixed:
['amlogic,meson-gxbb-scpi-sensors'] is too short
'arm,scpi-sensors' was expected
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-3-44351528957e@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
index 03e2c5d0bb9c1..db5a1f4653135 100644
--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
@@ -161,7 +161,7 @@ scpi_dvfs: clocks-0 {
};
scpi_sensors: sensors {
- compatible = "amlogic,meson-gxbb-scpi-sensors";
+ compatible = "amlogic,meson-gxbb-scpi-sensors", "arm,scpi-sensors";
#thermal-sensor-cells = <1>;
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 038/567] arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 037/567] arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 039/567] arm64: dts: amlogic: meson-gx: add missing unit address to rng node name Greg Kroah-Hartman
` (532 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit e3bd275ccbacf5eb18eaa311cea39f8bf8655feb ]
Fixes:
bluetooth: 'clock-names' does not match any of the regexes: 'pinctrl-[0-9]+'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-5-44351528957e@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts
index b331a013572f3..c490dbbf063bf 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts
@@ -79,6 +79,5 @@ bluetooth {
enable-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>;
max-speed = <2000000>;
clocks = <&wifi32k>;
- clock-names = "lpo";
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 039/567] arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 038/567] arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 040/567] arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux " Greg Kroah-Hartman
` (531 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit 61ff70708b98a85516eccb3755084ac97b42cf48 ]
Fixes:
bus@c8834000: rng: {...} should not be valid under {'type': 'object'}
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-6-44351528957e@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
index 31bbfe4868d8e..32cc9fab4490f 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
@@ -531,7 +531,7 @@ periphs: bus@c8834000 {
#size-cells = <2>;
ranges = <0x0 0x0 0x0 0xc8834000 0x0 0x2000>;
- hwrng: rng {
+ hwrng: rng@0 {
compatible = "amlogic,meson-rng";
reg = <0x0 0x0 0x0 0x4>;
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 040/567] arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 039/567] arm64: dts: amlogic: meson-gx: add missing unit address to rng node name Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 041/567] arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name Greg Kroah-Hartman
` (530 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit d19189f70ba596798ea49166d2d1ef36a8df5289 ]
Fixes:
bus@c8834000: eth-phy-mux: {...} should not be valid under {'type': 'object'}
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-9-44351528957e@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index c3ac531c4f84a..3500229350522 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -759,7 +759,7 @@ mux {
};
};
- eth-phy-mux {
+ eth-phy-mux@55c {
compatible = "mdio-mux-mmioreg", "mdio-mux";
#address-cells = <1>;
#size-cells = <0>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 041/567] arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 040/567] arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux " Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 042/567] arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names Greg Kroah-Hartman
` (529 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit 6bb506ed36968207a8832f0143ebc127f0770eef ]
Fixes:
adc-keys: 'update-button' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-10-44351528957e@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi
index 2d7032f41e4b5..772c220c8f496 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi
@@ -17,7 +17,7 @@ adc-keys {
io-channel-names = "buttons";
keyup-threshold-microvolt = <1800000>;
- update-button {
+ button-update {
label = "update";
linux,code = <KEY_VENDOR>;
press-threshold-microvolt = <1300000>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 042/567] arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 041/567] arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 043/567] arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name Greg Kroah-Hartman
` (528 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit d519a73332b6c3d14e15f8fd20d7c6f29ed13d41 ]
Fixes:
adc_keys: 'key' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+'
Also fix the invalid "adc_keys" node name.
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-11-44351528957e@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
index cadba194b149b..6d0db667581fa 100644
--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
@@ -17,13 +17,13 @@ / {
compatible = "bananapi,bpi-m5", "amlogic,sm1";
model = "Banana Pi BPI-M5";
- adc_keys {
+ adc-keys {
compatible = "adc-keys";
io-channels = <&saradc 2>;
io-channel-names = "buttons";
keyup-threshold-microvolt = <1800000>;
- key {
+ button-sw3 {
label = "SW3";
linux,code = <BTN_3>;
press-threshold-microvolt = <1700000>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 043/567] arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 042/567] arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 044/567] arm64: dts: amlogic: meson-gxbb-kii-pro: " Greg Kroah-Hartman
` (527 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit eee64d8fbbdaab72bbab3e462f3a7b742d20c8c2 ]
Fixes:
leds: status: {...} is not of type 'array'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-12-44351528957e@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts
index 9ef210f17b4aa..393d3cb33b9ee 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts
@@ -18,7 +18,7 @@ cvbs-connector {
leds {
compatible = "gpio-leds";
- status {
+ led {
label = "n1:white:status";
gpios = <&gpio_ao GPIOAO_9 GPIO_ACTIVE_HIGH>;
default-state = "on";
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 044/567] arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 043/567] arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 045/567] arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip Greg Kroah-Hartman
` (526 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit afdef3b188c934f79ad4b0a7bd8c692742f9b5af ]
Fixes:
leds: status: {...} is not of type 'array'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-13-44351528957e@linaro.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts
index e8394a8269ee1..802faf7e4e3cb 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts
@@ -16,7 +16,7 @@ / {
leds {
compatible = "gpio-leds";
- status {
+ led {
gpios = <&gpio_ao GPIOAO_13 GPIO_ACTIVE_LOW>;
default-state = "off";
color = <LED_COLOR_ID_RED>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 045/567] arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 044/567] arm64: dts: amlogic: meson-gxbb-kii-pro: " Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 046/567] locking/rwsem: Optimize down_read_trylock() under highly contended case Greg Kroah-Hartman
` (525 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Pardini, Neil Armstrong,
Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit 1d2f14117aa7773efff50f832b85fc7779e586e0 ]
Add an active trip tied to the on-board fan cooling device, which is better
than describing it along the passive cooling maps.
Fixes: 33b14f663df8 ("arm64: dts: meson: add initial device-tree for ODROID-HC4")
Reported-by: Ricardo Pardini <ricardo@pardini.net>
Link: https://lore.kernel.org/r/20230124-topic-odroid-hc4-upstream-fix-fan-trip-v1-1-b0c6aa355d93@linaro.org
Tested-by: Ricardo Pardini <ricardo@pardini.net>
[narmstrong: added Ricardo's tested-by from off-list chat]
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts
index f3f953225bf5b..15fece2e63205 100644
--- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts
@@ -76,9 +76,17 @@ sound {
};
&cpu_thermal {
+ trips {
+ cpu_active: cpu-active {
+ temperature = <60000>; /* millicelsius */
+ hysteresis = <2000>; /* millicelsius */
+ type = "active";
+ };
+ };
+
cooling-maps {
map {
- trip = <&cpu_passive>;
+ trip = <&cpu_active>;
cooling-device = <&fan0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 046/567] locking/rwsem: Optimize down_read_trylock() under highly contended case
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 045/567] arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 047/567] locking/rwsem: Disable preemption in all down_read*() and up_read() code paths Greg Kroah-Hartman
` (524 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muchun Song, Peter Zijlstra (Intel),
Waiman Long, Sasha Levin
From: Muchun Song <songmuchun@bytedance.com>
[ Upstream commit 14c24048841151548a3f4d9e218510c844c1b737 ]
We found that a process with 10 thousnads threads has been encountered
a regression problem from Linux-v4.14 to Linux-v5.4. It is a kind of
workload which will concurrently allocate lots of memory in different
threads sometimes. In this case, we will see the down_read_trylock()
with a high hotspot. Therefore, we suppose that rwsem has a regression
at least since Linux-v5.4. In order to easily debug this problem, we
write a simply benchmark to create the similar situation lile the
following.
```c++
#include <sys/mman.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <sched.h>
#include <cstdio>
#include <cassert>
#include <thread>
#include <vector>
#include <chrono>
volatile int mutex;
void trigger(int cpu, char* ptr, std::size_t sz)
{
cpu_set_t set;
CPU_ZERO(&set);
CPU_SET(cpu, &set);
assert(pthread_setaffinity_np(pthread_self(), sizeof(set), &set) == 0);
while (mutex);
for (std::size_t i = 0; i < sz; i += 4096) {
*ptr = '\0';
ptr += 4096;
}
}
int main(int argc, char* argv[])
{
std::size_t sz = 100;
if (argc > 1)
sz = atoi(argv[1]);
auto nproc = std::thread::hardware_concurrency();
std::vector<std::thread> thr;
sz <<= 30;
auto* ptr = mmap(nullptr, sz, PROT_READ | PROT_WRITE, MAP_ANON |
MAP_PRIVATE, -1, 0);
assert(ptr != MAP_FAILED);
char* cptr = static_cast<char*>(ptr);
auto run = sz / nproc;
run = (run >> 12) << 12;
mutex = 1;
for (auto i = 0U; i < nproc; ++i) {
thr.emplace_back(std::thread([i, cptr, run]() { trigger(i, cptr, run); }));
cptr += run;
}
rusage usage_start;
getrusage(RUSAGE_SELF, &usage_start);
auto start = std::chrono::system_clock::now();
mutex = 0;
for (auto& t : thr)
t.join();
rusage usage_end;
getrusage(RUSAGE_SELF, &usage_end);
auto end = std::chrono::system_clock::now();
timeval utime;
timeval stime;
timersub(&usage_end.ru_utime, &usage_start.ru_utime, &utime);
timersub(&usage_end.ru_stime, &usage_start.ru_stime, &stime);
printf("usr: %ld.%06ld\n", utime.tv_sec, utime.tv_usec);
printf("sys: %ld.%06ld\n", stime.tv_sec, stime.tv_usec);
printf("real: %lu\n",
std::chrono::duration_cast<std::chrono::milliseconds>(end -
start).count());
return 0;
}
```
The functionality of above program is simply which creates `nproc`
threads and each of them are trying to touch memory (trigger page
fault) on different CPU. Then we will see the similar profile by
`perf top`.
25.55% [kernel] [k] down_read_trylock
14.78% [kernel] [k] handle_mm_fault
13.45% [kernel] [k] up_read
8.61% [kernel] [k] clear_page_erms
3.89% [kernel] [k] __do_page_fault
The highest hot instruction, which accounts for about 92%, in
down_read_trylock() is cmpxchg like the following.
91.89 │ lock cmpxchg %rdx,(%rdi)
Sice the problem is found by migrating from Linux-v4.14 to Linux-v5.4,
so we easily found that the commit ddb20d1d3aed ("locking/rwsem: Optimize
down_read_trylock()") caused the regression. The reason is that the
commit assumes the rwsem is not contended at all. But it is not always
true for mmap lock which could be contended with thousands threads.
So most threads almost need to run at least 2 times of "cmpxchg" to
acquire the lock. The overhead of atomic operation is higher than
non-atomic instructions, which caused the regression.
By using the above benchmark, the real executing time on a x86-64 system
before and after the patch were:
Before Patch After Patch
# of Threads real real reduced by
------------ ------ ------ ----------
1 65,373 65,206 ~0.0%
4 15,467 15,378 ~0.5%
40 6,214 5,528 ~11.0%
For the uncontended case, the new down_read_trylock() is the same as
before. For the contended cases, the new down_read_trylock() is faster
than before. The more contended, the more fast.
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Waiman Long <longman@redhat.com>
Link: https://lore.kernel.org/r/20211118094455.9068-1-songmuchun@bytedance.com
Stable-dep-of: 3f5245538a19 ("locking/rwsem: Disable preemption in all down_read*() and up_read() code paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/rwsem.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c
index 4cc73e6f8974b..73cff464dde00 100644
--- a/kernel/locking/rwsem.c
+++ b/kernel/locking/rwsem.c
@@ -1255,17 +1255,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)
DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem);
- /*
- * Optimize for the case when the rwsem is not locked at all.
- */
- tmp = RWSEM_UNLOCKED_VALUE;
- do {
+ tmp = atomic_long_read(&sem->count);
+ while (!(tmp & RWSEM_READ_FAILED_MASK)) {
if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp,
- tmp + RWSEM_READER_BIAS)) {
+ tmp + RWSEM_READER_BIAS)) {
rwsem_set_reader_owned(sem);
return 1;
}
- } while (!(tmp & RWSEM_READ_FAILED_MASK));
+ }
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 047/567] locking/rwsem: Disable preemption in all down_read*() and up_read() code paths
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 046/567] locking/rwsem: Optimize down_read_trylock() under highly contended case Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 048/567] arm64: dts: renesas: beacon-renesom: Fix gpio expander reference Greg Kroah-Hartman
` (523 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mukesh Ojha, Peter Zijlstra,
Waiman Long, Ingo Molnar, Sasha Levin
From: Waiman Long <longman@redhat.com>
[ Upstream commit 3f5245538a1964ae186ab7e1636020a41aa63143 ]
Commit:
91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner")
... assumes that when the owner field is changed to NULL, the lock will
become free soon. But commit:
48dfb5d2560d ("locking/rwsem: Disable preemption while trying for rwsem lock")
... disabled preemption when acquiring rwsem for write.
However, preemption has not yet been disabled when acquiring a read lock
on a rwsem. So a reader can add a RWSEM_READER_BIAS to count without
setting owner to signal a reader, got preempted out by a RT task which
then spins in the writer slowpath as owner remains NULL leading to live lock.
One easy way to fix this problem is to disable preemption at all the
down_read*() and up_read() code paths as implemented in this patch.
Fixes: 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner")
Reported-by: Mukesh Ojha <quic_mojha@quicinc.com>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20230126003628.365092-3-longman@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/rwsem.c | 30 ++++++++++++++++++++++++------
1 file changed, 24 insertions(+), 6 deletions(-)
diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c
index 73cff464dde00..bd1d714a7ea08 100644
--- a/kernel/locking/rwsem.c
+++ b/kernel/locking/rwsem.c
@@ -1045,7 +1045,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat
/* Ordered by sem->wait_lock against rwsem_mark_wake(). */
break;
}
- schedule();
+ schedule_preempt_disabled();
lockevent_inc(rwsem_sleep_reader);
}
@@ -1224,14 +1224,20 @@ static struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem)
*/
static inline int __down_read_common(struct rw_semaphore *sem, int state)
{
+ int ret = 0;
long count;
+ preempt_disable();
if (!rwsem_read_trylock(sem, &count)) {
- if (IS_ERR(rwsem_down_read_slowpath(sem, count, state)))
- return -EINTR;
+ if (IS_ERR(rwsem_down_read_slowpath(sem, count, state))) {
+ ret = -EINTR;
+ goto out;
+ }
DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem);
}
- return 0;
+out:
+ preempt_enable();
+ return ret;
}
static inline void __down_read(struct rw_semaphore *sem)
@@ -1251,19 +1257,23 @@ static inline int __down_read_killable(struct rw_semaphore *sem)
static inline int __down_read_trylock(struct rw_semaphore *sem)
{
+ int ret = 0;
long tmp;
DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem);
+ preempt_disable();
tmp = atomic_long_read(&sem->count);
while (!(tmp & RWSEM_READ_FAILED_MASK)) {
if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp,
tmp + RWSEM_READER_BIAS)) {
rwsem_set_reader_owned(sem);
- return 1;
+ ret = 1;
+ break;
}
}
- return 0;
+ preempt_enable();
+ return ret;
}
/*
@@ -1305,6 +1315,7 @@ static inline void __up_read(struct rw_semaphore *sem)
DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem);
DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem);
+ preempt_disable();
rwsem_clear_reader_owned(sem);
tmp = atomic_long_add_return_release(-RWSEM_READER_BIAS, &sem->count);
DEBUG_RWSEMS_WARN_ON(tmp < 0, sem);
@@ -1313,6 +1324,7 @@ static inline void __up_read(struct rw_semaphore *sem)
clear_nonspinnable(sem);
rwsem_wake(sem);
}
+ preempt_enable();
}
/*
@@ -1630,6 +1642,12 @@ void down_read_non_owner(struct rw_semaphore *sem)
{
might_sleep();
__down_read(sem);
+ /*
+ * The owner value for a reader-owned lock is mostly for debugging
+ * purpose only and is not critical to the correct functioning of
+ * rwsem. So it is perfectly fine to set it in a preempt-enabled
+ * context here.
+ */
__rwsem_set_reader_owned(sem, NULL);
}
EXPORT_SYMBOL(down_read_non_owner);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 048/567] arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 047/567] locking/rwsem: Disable preemption in all down_read*() and up_read() code paths Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 049/567] arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN Greg Kroah-Hartman
` (522 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Ford, Geert Uytterhoeven, Sasha Levin
From: Adam Ford <aford173@gmail.com>
[ Upstream commit d7f9492dfc03153ac56ab59066a196558748f575 ]
The board used to originally introduce the Beacon Embedded RZ/G2[M/N/H]
boards had a GPIO expander with address 20, but this was changed when
the final board went to production.
The production boards changed both the part itself and the address.
With the incorrect address, the LCD cannot come up. If the LCD fails,
the rcar-du driver fails to come up, and that also breaks HDMI.
Pre-release board were not shipped to the general public, so it should
be safe to push this as a fix. Anyone with a production board would
have video fail due to this GPIO expander change.
Fixes: a1d8a344f1ca ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit")
Signed-off-by: Adam Ford <aford173@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20230114225647.227972-1-aford173@gmail.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dts/renesas/beacon-renesom-baseboard.dtsi | 24 ++++++++-----------
1 file changed, 10 insertions(+), 14 deletions(-)
diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
index 48e0c0494f6a0..f1ab4943c295c 100644
--- a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
+++ b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
@@ -432,20 +432,6 @@ wm8962_endpoint: endpoint {
};
};
- /* 0 - lcd_reset */
- /* 1 - lcd_pwr */
- /* 2 - lcd_select */
- /* 3 - backlight-enable */
- /* 4 - Touch_shdwn */
- /* 5 - LCD_H_pol */
- /* 6 - lcd_V_pol */
- gpio_exp1: gpio@20 {
- compatible = "onnn,pca9654";
- reg = <0x20>;
- gpio-controller;
- #gpio-cells = <2>;
- };
-
touchscreen@26 {
compatible = "ilitek,ili2117";
reg = <0x26>;
@@ -477,6 +463,16 @@ hd3ss3220_out_ep: endpoint {
};
};
};
+
+ gpio_exp1: gpio@70 {
+ compatible = "nxp,pca9538";
+ reg = <0x70>;
+ gpio-controller;
+ #gpio-cells = <2>;
+ gpio-line-names = "lcd_reset", "lcd_pwr", "lcd_select",
+ "backlight-enable", "Touch_shdwn",
+ "LCD_H_pol", "lcd_V_pol";
+ };
};
&lvds0 {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 049/567] arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 048/567] arm64: dts: renesas: beacon-renesom: Fix gpio expander reference Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 050/567] ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference Greg Kroah-Hartman
` (521 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Christian Hewitt,
Sasha Levin
From: Christian Hewitt <christianshewitt@gmail.com>
[ Upstream commit 856968e066bd77b113965f1a355ec7401edff65f ]
For proper warm (re)boot from SD card the BPI-M5 board requires TFLASH_VDD_EN
and VDDIO_C pins to be switched to high impedance mode. This can be achieved
using OPEN_DRAIN instead of ACTIVE_HIGH to leave the GPIO pins in input mode
and retain high state (pin has the pull-up).
This change is inspired by meson-sm1-odroid.dtsi where OPEN_DRAIN has been
used to resolve similar problems with the Odroid C4 board (TF_IO in the C4
dts is the equivalent regulator).
Fixes: 976e920183e4 ("arm64: dts: meson-sm1: add Banana PI BPI-M5 board dts")
Suggested-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20230127142221.3718184-2-christianshewitt@gmail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
index 6d0db667581fa..38ebe98ba9c6b 100644
--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts
@@ -123,7 +123,7 @@ vddio_c: regulator-vddio_c {
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <3300000>;
- enable-gpio = <&gpio_ao GPIOE_2 GPIO_ACTIVE_HIGH>;
+ enable-gpio = <&gpio_ao GPIOE_2 GPIO_OPEN_DRAIN>;
enable-active-high;
regulator-always-on;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 050/567] ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 049/567] arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 051/567] ARM: dts: imx7s: correct iomuxc gpr mux controller cells Greg Kroah-Hartman
` (520 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andre Przywara, Jernej Skrabec,
Samuel Holland, Sasha Levin
From: Samuel Holland <samuel@sholland.org>
[ Upstream commit 2177d4ae971f79b4a9a3c411f2fb8ae6113d1430 ]
The property named in the schema is 'enable-gpios', not 'enable-gpio'.
This makes no difference at runtime, because the regulator is marked as
always-on, but it breaks validation.
Fixes: 4701fc6e5dd9 ("ARM: dts: sun8i: add FriendlyARM NanoPi Duo2")
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Samuel Holland <samuel@sholland.org>
Link: https://lore.kernel.org/r/20221231225854.16320-2-samuel@sholland.org
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts
index 8e7dfcffe1fbe..355f7844fd55e 100644
--- a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts
+++ b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts
@@ -57,7 +57,7 @@ reg_vdd_cpux: vdd-cpux-regulator {
regulator-ramp-delay = <50>; /* 4ms */
enable-active-high;
- enable-gpio = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */
+ enable-gpios = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */
gpios = <&r_pio 0 6 GPIO_ACTIVE_HIGH>; /* PL6 */
gpios-states = <0x1>;
states = <1100000 0>, <1300000 1>;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 051/567] ARM: dts: imx7s: correct iomuxc gpr mux controller cells
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 050/567] ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 052/567] arm64: dts: mt8192: Fix CPU map for single-cluster SoC Greg Kroah-Hartman
` (519 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peng Fan, Marco Felsch, Shawn Guo,
Sasha Levin
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit 0e3e1946606a2919b1dda9967ab2e1c5af2fedd6 ]
Per binding doc reg-mux.yaml, the #mux-control-cells should be 1
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
Fixes: 94a905a79f2c ("ARM: dts: imx7s: add multiplexer controls")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx7s.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
index 95f22513a7c02..f4d2009d998b7 100644
--- a/arch/arm/boot/dts/imx7s.dtsi
+++ b/arch/arm/boot/dts/imx7s.dtsi
@@ -497,7 +497,7 @@ gpr: iomuxc-gpr@30340000 {
mux: mux-controller {
compatible = "mmio-mux";
- #mux-control-cells = <0>;
+ #mux-control-cells = <1>;
mux-reg-masks = <0x14 0x00000010>;
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 052/567] arm64: dts: mt8192: Fix CPU map for single-cluster SoC
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 051/567] ARM: dts: imx7s: correct iomuxc gpr mux controller cells Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 053/567] arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node Greg Kroah-Hartman
` (518 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno,
Matthias Brugger, Sasha Levin
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
[ Upstream commit 160ce54d635455ffb5e9b42c5ba9cb9aaa98cdb2 ]
MT8192 features the ARM DynamIQ technology and combines both four
Cortex-A76 (big) and four Cortex-A55 (LITTLE) CPUs in one cluster:
fix the CPU map to reflect that.
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile")
Link: https://lore.kernel.org/r/20230126103526.417039-3-angelogioacchino.delregno@collabora.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8192.dtsi | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
index d1e63527b3875..9ed1a72295747 100644
--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
@@ -135,19 +135,16 @@ core2 {
core3 {
cpu = <&cpu3>;
};
- };
-
- cluster1 {
- core0 {
+ core4 {
cpu = <&cpu4>;
};
- core1 {
+ core5 {
cpu = <&cpu5>;
};
- core2 {
+ core6 {
cpu = <&cpu6>;
};
- core3 {
+ core7 {
cpu = <&cpu7>;
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 053/567] arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 052/567] arm64: dts: mt8192: Fix CPU map for single-cluster SoC Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 054/567] blk-mq: avoid sleep in blk_mq_alloc_request_hctx Greg Kroah-Hartman
` (517 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno,
Matthias Brugger, Sasha Levin
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
[ Upstream commit 22925af785fa3470efdf566339616d801119d348 ]
Specify #pwm-cells on pwm@11006000 to make it actually usable.
Fixes: ae457b7679c4 ("arm64: dts: mt7622: add SoC and peripheral related device nodes")
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20221128112028.58021-2-angelogioacchino.delregno@collabora.com
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
index 890a942ec6082..a4c48b2abd209 100644
--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
@@ -428,6 +428,7 @@ uart3: serial@11005000 {
pwm: pwm@11006000 {
compatible = "mediatek,mt7622-pwm";
reg = <0 0x11006000 0 0x1000>;
+ #pwm-cells = <2>;
interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_LOW>;
clocks = <&topckgen CLK_TOP_PWM_SEL>,
<&pericfg CLK_PERI_PWM_PD>,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 054/567] blk-mq: avoid sleep in blk_mq_alloc_request_hctx
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 053/567] arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 055/567] blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx Greg Kroah-Hartman
` (516 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Kemeng Shi,
Jens Axboe, Sasha Levin
From: Kemeng Shi <shikemeng@huaweicloud.com>
[ Upstream commit 6ee858a3d3270a68902d66bb47c151a83622535c ]
Commit 1f5bd336b9150 ("blk-mq: add blk_mq_alloc_request_hctx") add
blk_mq_alloc_request_hctx to send commands to a specific queue. If
BLK_MQ_REQ_NOWAIT is not set in tag allocation, we may change to different
hctx after sleep and get tag from unexpected hctx. So BLK_MQ_REQ_NOWAIT
must be set in flags for blk_mq_alloc_request_hctx.
After commit 600c3b0cea784 ("blk-mq: open code __blk_mq_alloc_request in
blk_mq_alloc_request_hctx"), blk_mq_alloc_request_hctx return -EINVAL
if both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED are not set instead of
if BLK_MQ_REQ_NOWAIT is not set. So if BLK_MQ_REQ_NOWAIT is not set and
BLK_MQ_REQ_RESERVED is set, blk_mq_alloc_request_hctx could alloc tag
from unexpected hctx. I guess what we need here is that return -EINVAL
if either BLK_MQ_REQ_NOWAIT or BLK_MQ_REQ_RESERVED is not set.
Currently both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED will be set if
specific hctx is needed in nvme_auth_submit, nvmf_connect_io_queue
and nvmf_connect_admin_queue. Fix the potential BLK_MQ_REQ_NOWAIT missed
case in future.
Fixes: 600c3b0cea78 ("blk-mq: open code __blk_mq_alloc_request in blk_mq_alloc_request_hctx")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 9f53b4caf9772..01e281801453d 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -457,7 +457,8 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
* allocator for this for the rare use case of a command tied to
* a specific queue.
*/
- if (WARN_ON_ONCE(!(flags & (BLK_MQ_REQ_NOWAIT | BLK_MQ_REQ_RESERVED))))
+ if (WARN_ON_ONCE(!(flags & BLK_MQ_REQ_NOWAIT)) ||
+ WARN_ON_ONCE(!(flags & BLK_MQ_REQ_RESERVED)))
return ERR_PTR(-EINVAL);
if (hctx_idx >= q->nr_hw_queues)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 055/567] blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 054/567] blk-mq: avoid sleep in blk_mq_alloc_request_hctx Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 056/567] blk-mq: correct stale comment of .get_budget Greg Kroah-Hartman
` (515 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Kemeng Shi,
Jens Axboe, Sasha Levin
From: Kemeng Shi <shikemeng@huaweicloud.com>
[ Upstream commit c31e76bcc379182fe67a82c618493b7b8868c672 ]
Commit 97889f9ac24f8 ("blk-mq: remove synchronize_rcu() from
blk_mq_del_queue_tag_set()") remove handle of TAG_SHARED in restart,
then shared_hctx_restart counted for how many hardware queues are marked
for restart is removed too.
Remove the stale comment that we still count hardware queues need restart.
Fixes: 97889f9ac24f ("blk-mq: remove synchronize_rcu() from blk_mq_del_queue_tag_set()")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq-sched.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 35770e33c817a..de45a28925d83 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -45,8 +45,7 @@ void blk_mq_sched_assign_ioc(struct request *rq)
}
/*
- * Mark a hardware queue as needing a restart. For shared queues, maintain
- * a count of how many hardware queues are marked for restart.
+ * Mark a hardware queue as needing a restart.
*/
void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 056/567] blk-mq: correct stale comment of .get_budget
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 055/567] blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 057/567] arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions Greg Kroah-Hartman
` (514 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kemeng Shi, Christoph Hellwig,
Jens Axboe, Sasha Levin
From: Kemeng Shi <shikemeng@huaweicloud.com>
[ Upstream commit 01542f651a9f58a9b176c3d3dc3eefbacee53b78 ]
Commit 88022d7201e96 ("blk-mq: don't handle failure in .get_budget")
remove BLK_STS_RESOURCE return value and we only check if we can get
the budget from .get_budget() now.
Correct stale comment that ".get_budget() returns BLK_STS_NO_RESOURCE"
to ".get_budget() fails to get the budget".
Fixes: 88022d7201e9 ("blk-mq: don't handle failure in .get_budget")
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq-sched.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index de45a28925d83..ff1021dbb0d22 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -109,7 +109,7 @@ static bool blk_mq_dispatch_hctx_list(struct list_head *rq_list)
/*
* Only SCSI implements .get_budget and .put_budget, and SCSI restarts
* its queue by itself in its completion handler, so we don't need to
- * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE.
+ * restart queue if .get_budget() fails to get the budget.
*
* Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to
* be run again. This is necessary to avoid starving flushes.
@@ -237,7 +237,7 @@ static struct blk_mq_ctx *blk_mq_next_ctx(struct blk_mq_hw_ctx *hctx,
/*
* Only SCSI implements .get_budget and .put_budget, and SCSI restarts
* its queue by itself in its completion handler, so we don't need to
- * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE.
+ * restart queue if .get_budget() fails to get the budget.
*
* Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to
* be run again. This is necessary to avoid starving flushes.
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 057/567] arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 056/567] blk-mq: correct stale comment of .get_budget Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 058/567] s390/dasd: Fix potential memleak in dasd_eckd_init() Greg Kroah-Hartman
` (513 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamie Douglass, Petr Vorel,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
From: Jamie Douglass <jamiemdouglass@gmail.com>
[ Upstream commit d44106883d74992343710f18c4aaae937c7cefab ]
The memory region reserved by a previous commit (see fixes tag below)
overlaps with the SMEM and MPSS memory regions, causing error messages in
dmesg:
OF: reserved mem: OVERLAP DETECTED!
reserved@5000000 (0x0000000005000000--0x0000000007200000)
overlaps with smem_region@6a00000
(0x0000000006a00000--0x0000000006c00000)
OF: reserved mem: OVERLAP DETECTED!
reserved@6c00000 (0x0000000006c00000--0x0000000007200000)
overlaps with memory@7000000
(0x0000000007000000--0x000000000ca00000)
This patch resolves both of these by splitting the previously reserved
memory region into two sections either side of the SMEM region and by
cutting off the second memory region to 0x7000000.
Fixes: 22c7e1a0fa45 ("arm64: dts: msm8992-bullhead: add memory hole region")
Signed-off-by: Jamie Douglass <jamiemdouglass@gmail.com>
Reviewed-by: Petr Vorel <pvorel@suse.cz>
Tested-by: Petr Vorel <pvorel@suse.cz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230202054819.16079-1-jamiemdouglass@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
index 84ba740cb957b..60fcb024c8879 100644
--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
+++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts
@@ -55,8 +55,13 @@ cont_splash_mem: memory@3400000 {
no-map;
};
- removed_region: reserved@5000000 {
- reg = <0 0x05000000 0 0x2200000>;
+ reserved@5000000 {
+ reg = <0x0 0x05000000 0x0 0x1a00000>;
+ no-map;
+ };
+
+ reserved@6c00000 {
+ reg = <0x0 0x06c00000 0x0 0x400000>;
no-map;
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 058/567] s390/dasd: Fix potential memleak in dasd_eckd_init()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 057/567] arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 059/567] sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() Greg Kroah-Hartman
` (512 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qiheng Lin, Stefan Haberland,
Jens Axboe, Sasha Levin
From: Qiheng Lin <linqiheng@huawei.com>
[ Upstream commit 460e9bed82e49db1b823dcb4e421783854d86c40 ]
`dasd_reserve_req` is allocated before `dasd_vol_info_req`, and it
also needs to be freed before the error returns, just like the other
cases in this function.
Fixes: 9e12e54c7a8f ("s390/dasd: Handle out-of-space constraint")
Signed-off-by: Qiheng Lin <linqiheng@huawei.com>
Link: https://lore.kernel.org/r/20221208133809.16796-1-linqiheng@huawei.com
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://lore.kernel.org/r/20230210000253.1644903-3-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/block/dasd_eckd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 57dfc92aa756f..56ab74aa07f42 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -6729,8 +6729,10 @@ dasd_eckd_init(void)
return -ENOMEM;
dasd_vol_info_req = kmalloc(sizeof(*dasd_vol_info_req),
GFP_KERNEL | GFP_DMA);
- if (!dasd_vol_info_req)
+ if (!dasd_vol_info_req) {
+ kfree(dasd_reserve_req);
return -ENOMEM;
+ }
pe_handler_worker = kmalloc(sizeof(*pe_handler_worker),
GFP_KERNEL | GFP_DMA);
if (!pe_handler_worker) {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 059/567] sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 058/567] s390/dasd: Fix potential memleak in dasd_eckd_init() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 060/567] sched/rt: pick_next_rt_entity(): check list_entry Greg Kroah-Hartman
` (511 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dietmar Eggemann,
Peter Zijlstra (Intel),
Juri Lelli, Sasha Levin
From: Dietmar Eggemann <dietmar.eggemann@arm.com>
[ Upstream commit 821aecd09e5ad2f8d4c3d8195333d272b392f7d3 ]
The `struct rq *rq` parameter isn't used. Remove it.
Signed-off-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Juri Lelli <juri.lelli@redhat.com>
Link: https://lore.kernel.org/r/20220302183433.333029-7-dietmar.eggemann@arm.com
Stable-dep-of: 7c4a5b89a0b5 ("sched/rt: pick_next_rt_entity(): check list_entry")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/deadline.c | 5 ++---
kernel/sched/rt.c | 5 ++---
2 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 2a2f32eaffccd..226c814368d1b 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1846,8 +1846,7 @@ static void set_next_task_dl(struct rq *rq, struct task_struct *p, bool first)
deadline_queue_push_tasks(rq);
}
-static struct sched_dl_entity *pick_next_dl_entity(struct rq *rq,
- struct dl_rq *dl_rq)
+static struct sched_dl_entity *pick_next_dl_entity(struct dl_rq *dl_rq)
{
struct rb_node *left = rb_first_cached(&dl_rq->root);
@@ -1866,7 +1865,7 @@ static struct task_struct *pick_task_dl(struct rq *rq)
if (!sched_dl_runnable(rq))
return NULL;
- dl_se = pick_next_dl_entity(rq, dl_rq);
+ dl_se = pick_next_dl_entity(dl_rq);
BUG_ON(!dl_se);
p = dl_task_of(dl_se);
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index add67f811e004..b374ea9f58ab2 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -1614,8 +1614,7 @@ static inline void set_next_task_rt(struct rq *rq, struct task_struct *p, bool f
rt_queue_push_tasks(rq);
}
-static struct sched_rt_entity *pick_next_rt_entity(struct rq *rq,
- struct rt_rq *rt_rq)
+static struct sched_rt_entity *pick_next_rt_entity(struct rt_rq *rt_rq)
{
struct rt_prio_array *array = &rt_rq->active;
struct sched_rt_entity *next = NULL;
@@ -1637,7 +1636,7 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq)
struct rt_rq *rt_rq = &rq->rt;
do {
- rt_se = pick_next_rt_entity(rq, rt_rq);
+ rt_se = pick_next_rt_entity(rt_rq);
BUG_ON(!rt_se);
rt_rq = group_rt_rq(rt_se);
} while (rt_rq);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 060/567] sched/rt: pick_next_rt_entity(): check list_entry
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 059/567] sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 061/567] x86/perf/zhaoxin: Add stepping check for ZXC Greg Kroah-Hartman
` (510 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello,
Peter Zijlstra (Intel), Phil Auld, Steven Rostedt (Google),
Sasha Levin
From: Pietro Borrello <borrello@diag.uniroma1.it>
[ Upstream commit 7c4a5b89a0b5a57a64b601775b296abf77a9fe97 ]
Commit 326587b84078 ("sched: fix goto retry in pick_next_task_rt()")
removed any path which could make pick_next_rt_entity() return NULL.
However, BUG_ON(!rt_se) in _pick_next_task_rt() (the only caller of
pick_next_rt_entity()) still checks the error condition, which can
never happen, since list_entry() never returns NULL.
Remove the BUG_ON check, and instead emit a warning in the only
possible error condition here: the queue being empty which should
never happen.
Fixes: 326587b84078 ("sched: fix goto retry in pick_next_task_rt()")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Phil Auld <pauld@redhat.com>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://lore.kernel.org/r/20230128-list-entry-null-check-sched-v3-1-b1a71bd1ac6b@diag.uniroma1.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/rt.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index b374ea9f58ab2..08af6076c8097 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -1625,6 +1625,8 @@ static struct sched_rt_entity *pick_next_rt_entity(struct rt_rq *rt_rq)
BUG_ON(idx >= MAX_RT_PRIO);
queue = array->queue + idx;
+ if (SCHED_WARN_ON(list_empty(queue)))
+ return NULL;
next = list_entry(queue->next, struct sched_rt_entity, run_list);
return next;
@@ -1637,7 +1639,8 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq)
do {
rt_se = pick_next_rt_entity(rt_rq);
- BUG_ON(!rt_se);
+ if (unlikely(!rt_se))
+ return NULL;
rt_rq = group_rt_rq(rt_se);
} while (rt_rq);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 061/567] x86/perf/zhaoxin: Add stepping check for ZXC
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 060/567] sched/rt: pick_next_rt_entity(): check list_entry Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 062/567] KEYS: asymmetric: Fix ECDSA use via keyctl uapi Greg Kroah-Hartman
` (509 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arjan, Kevin Brace, silviazhao,
Peter Zijlstra (Intel),
Sasha Levin
From: silviazhao <silviazhao-oc@zhaoxin.com>
[ Upstream commit fd636b6a9bc6034f2e5bb869658898a2b472c037 ]
Some of Nano series processors will lead GP when accessing
PMC fixed counter. Meanwhile, their hardware support for PMC
has not announced externally. So exclude Nano CPUs from ZXC
by checking stepping information. This is an unambiguous way
to differentiate between ZXC and Nano CPUs.
Following are Nano and ZXC FMS information:
Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D]
ZXC FMS: Family=6, Model=F, Stepping=E-F OR
Family=6, Model=0x19, Stepping=0-3
Fixes: 3a4ac121c2ca ("x86/perf: Add hardware performance events support for Zhaoxin CPU.")
Reported-by: Arjan <8vvbbqzo567a@nospam.xutrox.com>
Reported-by: Kevin Brace <kevinbrace@gmx.com>
Signed-off-by: silviazhao <silviazhao-oc@zhaoxin.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=212389
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/zhaoxin/core.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/x86/events/zhaoxin/core.c b/arch/x86/events/zhaoxin/core.c
index 949d845c922b4..3e9acdaeed1ec 100644
--- a/arch/x86/events/zhaoxin/core.c
+++ b/arch/x86/events/zhaoxin/core.c
@@ -541,7 +541,13 @@ __init int zhaoxin_pmu_init(void)
switch (boot_cpu_data.x86) {
case 0x06:
- if (boot_cpu_data.x86_model == 0x0f || boot_cpu_data.x86_model == 0x19) {
+ /*
+ * Support Zhaoxin CPU from ZXC series, exclude Nano series through FMS.
+ * Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D]
+ * ZXC FMS: Family=6, Model=F, Stepping=E-F OR Family=6, Model=0x19, Stepping=0-3
+ */
+ if ((boot_cpu_data.x86_model == 0x0f && boot_cpu_data.x86_stepping >= 0x0e) ||
+ boot_cpu_data.x86_model == 0x19) {
x86_pmu.max_period = x86_pmu.cntval_mask >> 1;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 062/567] KEYS: asymmetric: Fix ECDSA use via keyctl uapi
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 061/567] x86/perf/zhaoxin: Add stepping check for ZXC Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 063/567] arm64: dts: qcom: pmk8350: Specify PBS register for PON Greg Kroah-Hartman
` (508 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Denis Kenzior, Stefan Berger,
Jarkko Sakkinen, Sasha Levin
From: Denis Kenzior <denkenz@gmail.com>
[ Upstream commit 10de7b54293995368c52d9aa153f3e7a359f04a1 ]
When support for ECDSA keys was added, constraints for data & signature
sizes were never updated. This makes it impossible to use such keys via
keyctl API from userspace.
Update constraint on max_data_size to 64 bytes in order to support
SHA512-based signatures. Also update the signature length constraints
per ECDSA signature encoding described in RFC 5480.
Fixes: 299f561a6693 ("x509: Add support for parsing x509 certs with ECDSA keys")
Signed-off-by: Denis Kenzior <denkenz@gmail.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/asymmetric_keys/public_key.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index 2f8352e888602..eca5671ad3f22 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -186,8 +186,28 @@ static int software_key_query(const struct kernel_pkey_params *params,
len = crypto_akcipher_maxsize(tfm);
info->key_size = len * 8;
- info->max_data_size = len;
- info->max_sig_size = len;
+
+ if (strncmp(pkey->pkey_algo, "ecdsa", 5) == 0) {
+ /*
+ * ECDSA key sizes are much smaller than RSA, and thus could
+ * operate on (hashed) inputs that are larger than key size.
+ * For example SHA384-hashed input used with secp256r1
+ * based keys. Set max_data_size to be at least as large as
+ * the largest supported hash size (SHA512)
+ */
+ info->max_data_size = 64;
+
+ /*
+ * Verify takes ECDSA-Sig (described in RFC 5480) as input,
+ * which is actually 2 'key_size'-bit integers encoded in
+ * ASN.1. Account for the ASN.1 encoding overhead here.
+ */
+ info->max_sig_size = 2 * (len + 3) + 2;
+ } else {
+ info->max_data_size = len;
+ info->max_sig_size = len;
+ }
+
info->max_enc_size = len;
info->max_dec_size = len;
info->supported_ops = (KEYCTL_SUPPORTS_ENCRYPT |
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 063/567] arm64: dts: qcom: pmk8350: Specify PBS register for PON
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 062/567] KEYS: asymmetric: Fix ECDSA use via keyctl uapi Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 064/567] arm64: dts: qcom: pmk8350: Use the correct PON compatible Greg Kroah-Hartman
` (507 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson, Sasha Levin
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit f46ef374e0dcb8fd2f272a376cf0dcdab7e52fc2 ]
PMK8350 is the first PMIC to require both HLOS and PBS registers for
PON to function properly (at least in theory, sm8350 sees no change).
The support for it on the driver side has been added long ago,
but it has never been wired up. Do so.
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20221115132626.7465-1-konrad.dybcio@linaro.org
Stable-dep-of: c0ee8e0ba5cc ("arm64: dts: qcom: pmk8350: Use the correct PON compatible")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/pmk8350.dtsi | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/pmk8350.dtsi b/arch/arm64/boot/dts/qcom/pmk8350.dtsi
index 04fc2632a0b20..530adc87a4096 100644
--- a/arch/arm64/boot/dts/qcom/pmk8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/pmk8350.dtsi
@@ -17,7 +17,8 @@ pmk8350: pmic@0 {
pmk8350_pon: pon@1300 {
compatible = "qcom,pm8998-pon";
- reg = <0x1300>;
+ reg = <0x1300>, <0x800>;
+ reg-names = "hlos", "pbs";
pwrkey {
compatible = "qcom,pmk8350-pwrkey";
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 064/567] arm64: dts: qcom: pmk8350: Use the correct PON compatible
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 063/567] arm64: dts: qcom: pmk8350: Specify PBS register for PON Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 065/567] block: bio-integrity: Copy flags when bio_integrity_payload is cloned Greg Kroah-Hartman
` (506 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson, Sasha Levin
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit c0ee8e0ba5cc17623e63349a168b41e407b1eef0 ]
A special compatible was introduced for PMK8350 both in the driver and
the bindings to facilitate for 2 base registers (PBS & HLOS). Use it.
Fixes: b2de43136058 ("arm64: dts: qcom: pmk8350: Add peripherals for pmk8350")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230213212930.2115182-1-konrad.dybcio@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/pmk8350.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/pmk8350.dtsi b/arch/arm64/boot/dts/qcom/pmk8350.dtsi
index 530adc87a4096..fc38f77d12a36 100644
--- a/arch/arm64/boot/dts/qcom/pmk8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/pmk8350.dtsi
@@ -16,7 +16,7 @@ pmk8350: pmic@0 {
#size-cells = <0>;
pmk8350_pon: pon@1300 {
- compatible = "qcom,pm8998-pon";
+ compatible = "qcom,pmk8350-pon";
reg = <0x1300>, <0x800>;
reg-names = "hlos", "pbs";
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 065/567] block: bio-integrity: Copy flags when bio_integrity_payload is cloned
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 064/567] arm64: dts: qcom: pmk8350: Use the correct PON compatible Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 066/567] wifi: rsi: Fix memory leak in rsi_coex_attach() Greg Kroah-Hartman
` (505 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saurav Kashyap, Martin K. Petersen,
Christoph Hellwig, Chaitanya Kulkarni, Jens Axboe, Sasha Levin
From: Martin K. Petersen <martin.petersen@oracle.com>
[ Upstream commit b6a4bdcda430e3ca43bbb9cb1d4d4d34ebe15c40 ]
Make sure to copy the flags when a bio_integrity_payload is cloned.
Otherwise per-I/O properties such as IP checksum flag will not be
passed down to the HBA driver. Since the integrity buffer is owned by
the original bio, the BIP_BLOCK_INTEGRITY flag needs to be masked off
to avoid a double free in the completion path.
Fixes: aae7df50190a ("block: Integrity checksum flag")
Fixes: b1f01388574c ("block: Relocate bio integrity flags")
Reported-by: Saurav Kashyap <skashyap@marvell.com>
Tested-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Link: https://lore.kernel.org/r/20230215171801.21062-1-martin.petersen@oracle.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/bio-integrity.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 4a7c33ed9a661..4f34ac27c47dd 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -417,6 +417,7 @@ int bio_integrity_clone(struct bio *bio, struct bio *bio_src,
bip->bip_vcnt = bip_src->bip_vcnt;
bip->bip_iter = bip_src->bip_iter;
+ bip->bip_flags = bip_src->bip_flags & ~BIP_BLOCK_INTEGRITY;
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 066/567] wifi: rsi: Fix memory leak in rsi_coex_attach()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 065/567] block: bio-integrity: Copy flags when bio_integrity_payload is cloned Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 067/567] wifi: rtlwifi: rtl8821ae: dont call kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
` (504 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Can, Simon Horman, Kalle Valo,
Sasha Levin
From: Yuan Can <yuancan@huawei.com>
[ Upstream commit 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f ]
The coex_cb needs to be freed when rsi_create_kthread() failed in
rsi_coex_attach().
Fixes: 2108df3c4b18 ("rsi: add coex support")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221205061441.114632-1-yuancan@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/rsi/rsi_91x_coex.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/rsi/rsi_91x_coex.c b/drivers/net/wireless/rsi/rsi_91x_coex.c
index a0c5d02ae88cf..7395359b43b77 100644
--- a/drivers/net/wireless/rsi/rsi_91x_coex.c
+++ b/drivers/net/wireless/rsi/rsi_91x_coex.c
@@ -160,6 +160,7 @@ int rsi_coex_attach(struct rsi_common *common)
rsi_coex_scheduler_thread,
"Coex-Tx-Thread")) {
rsi_dbg(ERR_ZONE, "%s: Unable to init tx thrd\n", __func__);
+ kfree(coex_cb);
return -EINVAL;
}
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 067/567] wifi: rtlwifi: rtl8821ae: dont call kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 066/567] wifi: rsi: Fix memory leak in rsi_coex_attach() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 068/567] wifi: rtlwifi: rtl8188ee: " Greg Kroah-Hartman
` (503 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Ping-Ke Shih,
Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 106031c1f4a850915190d7ec1026696282f9359b ]
It is not allowed to call kfree_skb() from hardware interrupt
context or with interrupts being disabled. All the SKBs have
been dequeued from the old queue, so it's safe to enqueue these
SKBs to a free queue, then free them after spin_unlock_irqrestore()
at once. Compile tested only.
Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221207141411.46098-2-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
index 33ffc24d36759..c4ee65cc2d5e6 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
@@ -26,8 +26,10 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw)
struct rtl_priv *rtlpriv = rtl_priv(hw);
struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
+ struct sk_buff_head free_list;
unsigned long flags;
+ skb_queue_head_init(&free_list);
spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
while (skb_queue_len(&ring->queue)) {
struct rtl_tx_desc *entry = &ring->desc[ring->idx];
@@ -37,10 +39,12 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw)
rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry,
true, HW_DESC_TXBUFF_ADDR),
skb->len, DMA_TO_DEVICE);
- kfree_skb(skb);
+ __skb_queue_tail(&free_list, skb);
ring->idx = (ring->idx + 1) % ring->entries;
}
spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
+
+ __skb_queue_purge(&free_list);
}
static void _rtl8821ae_set_bcn_ctrl_reg(struct ieee80211_hw *hw,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 068/567] wifi: rtlwifi: rtl8188ee: dont call kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 067/567] wifi: rtlwifi: rtl8821ae: dont call kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 069/567] wifi: rtlwifi: rtl8723be: " Greg Kroah-Hartman
` (502 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Ping-Ke Shih,
Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 2611687fa7ffc84190f92292de0b80468de17220 ]
It is not allowed to call kfree_skb() from hardware interrupt
context or with interrupts being disabled. All the SKBs have
been dequeued from the old queue, so it's safe to enqueue these
SKBs to a free queue, then free them after spin_unlock_irqrestore()
at once. Compile tested only.
Fixes: 7fe3b3abb5da ("rtlwifi: rtl8188ee: rtl8821ae: Fix a queue locking problem")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221207141411.46098-3-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c
index bf686a916acb8..13e9717a1ce82 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c
@@ -68,8 +68,10 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
struct rtl_priv *rtlpriv = rtl_priv(hw);
struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
+ struct sk_buff_head free_list;
unsigned long flags;
+ skb_queue_head_init(&free_list);
spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
while (skb_queue_len(&ring->queue)) {
struct rtl_tx_desc *entry = &ring->desc[ring->idx];
@@ -79,10 +81,12 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry,
true, HW_DESC_TXBUFF_ADDR),
skb->len, DMA_TO_DEVICE);
- kfree_skb(skb);
+ __skb_queue_tail(&free_list, skb);
ring->idx = (ring->idx + 1) % ring->entries;
}
spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
+
+ __skb_queue_purge(&free_list);
}
static void _rtl88ee_disable_bcn_sub_func(struct ieee80211_hw *hw)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 069/567] wifi: rtlwifi: rtl8723be: dont call kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 068/567] wifi: rtlwifi: rtl8188ee: " Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 070/567] wifi: iwlegacy: common: dont call dev_kfree_skb() " Greg Kroah-Hartman
` (501 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Ping-Ke Shih,
Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 313950c2114e7051c4e3020fd82495fa1fb526a8 ]
It is not allowed to call kfree_skb() from hardware interrupt
context or with interrupts being disabled. All the SKBs have
been dequeued from the old queue, so it's safe to enqueue these
SKBs to a free queue, then free them after spin_unlock_irqrestore()
at once. Compile tested only.
Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221207141411.46098-4-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
index 0748aedce2adb..ccbb082d5e928 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
@@ -30,8 +30,10 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw)
struct rtl_priv *rtlpriv = rtl_priv(hw);
struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
+ struct sk_buff_head free_list;
unsigned long flags;
+ skb_queue_head_init(&free_list);
spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
while (skb_queue_len(&ring->queue)) {
struct rtl_tx_desc *entry = &ring->desc[ring->idx];
@@ -41,10 +43,12 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw)
rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry,
true, HW_DESC_TXBUFF_ADDR),
skb->len, DMA_TO_DEVICE);
- kfree_skb(skb);
+ __skb_queue_tail(&free_list, skb);
ring->idx = (ring->idx + 1) % ring->entries;
}
spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
+
+ __skb_queue_purge(&free_list);
}
static void _rtl8723be_set_bcn_ctrl_reg(struct ieee80211_hw *hw,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 070/567] wifi: iwlegacy: common: dont call dev_kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 069/567] wifi: rtlwifi: rtl8723be: " Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 071/567] wifi: libertas: fix memory leak in lbs_init_adapter() Greg Kroah-Hartman
` (500 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Stanislaw Gruszka,
Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 0c1528675d7a9787cb516b64d8f6c0f6f8efcb48 ]
It is not allowed to call consume_skb() from hardware interrupt context
or with interrupts being disabled. So replace dev_kfree_skb() with
dev_consume_skb_irq() under spin_lock_irqsave(). Compile tested only.
Fixes: 4bc85c1324aa ("Revert "iwlwifi: split the drivers for agn and legacy devices 3945/4965"")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221207144013.70210-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlegacy/common.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
index 683b632981ed3..83c1ff0d660f7 100644
--- a/drivers/net/wireless/intel/iwlegacy/common.c
+++ b/drivers/net/wireless/intel/iwlegacy/common.c
@@ -5173,7 +5173,7 @@ il_mac_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
memset(&il->current_ht_config, 0, sizeof(struct il_ht_config));
/* new association get rid of ibss beacon skb */
- dev_kfree_skb(il->beacon_skb);
+ dev_consume_skb_irq(il->beacon_skb);
il->beacon_skb = NULL;
il->timestamp = 0;
@@ -5292,7 +5292,7 @@ il_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
}
spin_lock_irqsave(&il->lock, flags);
- dev_kfree_skb(il->beacon_skb);
+ dev_consume_skb_irq(il->beacon_skb);
il->beacon_skb = skb;
timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 071/567] wifi: libertas: fix memory leak in lbs_init_adapter()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 070/567] wifi: iwlegacy: common: dont call dev_kfree_skb() " Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 072/567] wifi: rtl8xxxu: dont call dev_kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
` (499 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengchao Shao, Jiri Pirko,
Kalle Valo, Sasha Levin
From: Zhengchao Shao <shaozhengchao@huawei.com>
[ Upstream commit 16a03958618fb91bb1bc7077cf3211055162cc2f ]
When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not
released. Add free memory to processing error path.
Fixes: 7919b89c8276 ("libertas: convert libertas driver to use an event/cmdresp queue")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221208121448.2845986-1-shaozhengchao@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/libertas/main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c
index 64fc5e4108648..b739a490fc20a 100644
--- a/drivers/net/wireless/marvell/libertas/main.c
+++ b/drivers/net/wireless/marvell/libertas/main.c
@@ -870,6 +870,7 @@ static int lbs_init_adapter(struct lbs_private *priv)
ret = kfifo_alloc(&priv->event_fifo, sizeof(u32) * 16, GFP_KERNEL);
if (ret) {
pr_err("Out of memory allocating event FIFO buffer\n");
+ lbs_free_cmd_buffer(priv);
goto out;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 072/567] wifi: rtl8xxxu: dont call dev_kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 071/567] wifi: libertas: fix memory leak in lbs_init_adapter() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 073/567] wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() Greg Kroah-Hartman
` (498 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Ping-Ke Shih,
Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 4c2005ac87685907b3719b4f40215b578efd27c4 ]
It is not allowed to call kfree_skb() or consume_skb() from hardware
interrupt context or with hardware interrupts being disabled.
It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead.
The difference between them is free reason, dev_kfree_skb_irq() means
the SKB is dropped in error and dev_consume_skb_irq() means the SKB
is consumed in normal.
In this case, dev_kfree_skb() is called to free and drop the SKB when
it's shutdown, so replace it with dev_kfree_skb_irq(). Compile tested
only.
Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221208143517.2383424-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
index 3d3fa2b616a86..dc734e8fa0f1c 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
@@ -5184,7 +5184,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv,
pending = priv->rx_urb_pending_count;
} else {
skb = (struct sk_buff *)rx_urb->urb.context;
- dev_kfree_skb(skb);
+ dev_kfree_skb_irq(skb);
usb_free_urb(&rx_urb->urb);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 073/567] wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 072/567] wifi: rtl8xxxu: dont call dev_kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 074/567] libbpf: Fix btf__align_of() by taking into account field offsets Greg Kroah-Hartman
` (497 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Zetao, Ping-Ke Shih, Kalle Valo,
Sasha Levin
From: Li Zetao <lizetao1@huawei.com>
[ Upstream commit 117dbeda22ec5ea0918254d03b540ef8b8a64d53 ]
There is a global-out-of-bounds reported by KASAN:
BUG: KASAN: global-out-of-bounds in
_rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]
Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411
CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D
6.1.0-rc8+ #144 e15588508517267d37
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
Call Trace:
<TASK>
...
kasan_report+0xbb/0x1c0
_rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]
rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]
rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]
...
</TASK>
The root cause of the problem is that the comparison order of
"prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The
_rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two
strings from tail to head, which causes the problem. In the
_rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet
this requirement by carefully designing the comparison order.
For example, "pregulation" and "pbandwidth" are compared in order of
length from small to large, first is 3 and last is 4. However, the
comparison order of "prate_section" dose not obey such order requirement,
therefore when "prate_section" is "HT", when comparing from tail to head,
it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As
mentioned above, the _rtl8812ae_eq_n_byte() has the same function as
strcmp(), so just strcmp() is enough.
Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely.
Although it can be fixed by adjusting the comparison order of
"prate_section", this may cause the value of "rate_section" to not be
from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver
from staging to regular tree, but also added setting txpower limit
function during the driver config phase, so the problem was introduced
by this commit.
Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree")
Signed-off-by: Li Zetao <lizetao1@huawei.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221212025812.1541311-1-lizetao1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------
1 file changed, 20 insertions(+), 32 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
index a29321e2fa72f..5323ead30db03 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
@@ -1598,18 +1598,6 @@ static bool _rtl8812ae_get_integer_from_string(const char *str, u8 *pint)
return true;
}
-static bool _rtl8812ae_eq_n_byte(const char *str1, const char *str2, u32 num)
-{
- if (num == 0)
- return false;
- while (num > 0) {
- num--;
- if (str1[num] != str2[num])
- return false;
- }
- return true;
-}
-
static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw,
u8 band, u8 channel)
{
@@ -1659,42 +1647,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw,
power_limit = power_limit > MAX_POWER_INDEX ?
MAX_POWER_INDEX : power_limit;
- if (_rtl8812ae_eq_n_byte(pregulation, "FCC", 3))
+ if (strcmp(pregulation, "FCC") == 0)
regulation = 0;
- else if (_rtl8812ae_eq_n_byte(pregulation, "MKK", 3))
+ else if (strcmp(pregulation, "MKK") == 0)
regulation = 1;
- else if (_rtl8812ae_eq_n_byte(pregulation, "ETSI", 4))
+ else if (strcmp(pregulation, "ETSI") == 0)
regulation = 2;
- else if (_rtl8812ae_eq_n_byte(pregulation, "WW13", 4))
+ else if (strcmp(pregulation, "WW13") == 0)
regulation = 3;
- if (_rtl8812ae_eq_n_byte(prate_section, "CCK", 3))
+ if (strcmp(prate_section, "CCK") == 0)
rate_section = 0;
- else if (_rtl8812ae_eq_n_byte(prate_section, "OFDM", 4))
+ else if (strcmp(prate_section, "OFDM") == 0)
rate_section = 1;
- else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) &&
- _rtl8812ae_eq_n_byte(prf_path, "1T", 2))
+ else if (strcmp(prate_section, "HT") == 0 &&
+ strcmp(prf_path, "1T") == 0)
rate_section = 2;
- else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) &&
- _rtl8812ae_eq_n_byte(prf_path, "2T", 2))
+ else if (strcmp(prate_section, "HT") == 0 &&
+ strcmp(prf_path, "2T") == 0)
rate_section = 3;
- else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) &&
- _rtl8812ae_eq_n_byte(prf_path, "1T", 2))
+ else if (strcmp(prate_section, "VHT") == 0 &&
+ strcmp(prf_path, "1T") == 0)
rate_section = 4;
- else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) &&
- _rtl8812ae_eq_n_byte(prf_path, "2T", 2))
+ else if (strcmp(prate_section, "VHT") == 0 &&
+ strcmp(prf_path, "2T") == 0)
rate_section = 5;
- if (_rtl8812ae_eq_n_byte(pbandwidth, "20M", 3))
+ if (strcmp(pbandwidth, "20M") == 0)
bandwidth = 0;
- else if (_rtl8812ae_eq_n_byte(pbandwidth, "40M", 3))
+ else if (strcmp(pbandwidth, "40M") == 0)
bandwidth = 1;
- else if (_rtl8812ae_eq_n_byte(pbandwidth, "80M", 3))
+ else if (strcmp(pbandwidth, "80M") == 0)
bandwidth = 2;
- else if (_rtl8812ae_eq_n_byte(pbandwidth, "160M", 4))
+ else if (strcmp(pbandwidth, "160M") == 0)
bandwidth = 3;
- if (_rtl8812ae_eq_n_byte(pband, "2.4G", 4)) {
+ if (strcmp(pband, "2.4G") == 0) {
ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw,
BAND_ON_2_4G,
channel);
@@ -1718,7 +1706,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw,
regulation, bandwidth, rate_section, channel_index,
rtlphy->txpwr_limit_2_4g[regulation][bandwidth]
[rate_section][channel_index][RF90_PATH_A]);
- } else if (_rtl8812ae_eq_n_byte(pband, "5G", 2)) {
+ } else if (strcmp(pband, "5G") == 0) {
ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw,
BAND_ON_5G,
channel);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 074/567] libbpf: Fix btf__align_of() by taking into account field offsets
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 073/567] wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 075/567] wifi: ipw2x00: dont call dev_kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
` (496 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Daniel Borkmann,
Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 25a4481b4136af7794e1df2d6c90ed2f354d60ce ]
btf__align_of() is supposed to be return alignment requirement of
a requested BTF type. For STRUCT/UNION it doesn't always return correct
value, because it calculates alignment only based on field types. But
for packed structs this is not enough, we need to also check field
offsets and struct size. If field offset isn't aligned according to
field type's natural alignment, then struct must be packed. Similarly,
if struct size is not a multiple of struct's natural alignment, then
struct must be packed as well.
This patch fixes this issue precisely by additionally checking these
conditions.
Fixes: 3d208f4ca111 ("libbpf: Expose btf__align_of() API")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20221212211505.558851-5-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/btf.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 3ed759f53e7c2..fd23095129782 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -647,8 +647,21 @@ int btf__align_of(const struct btf *btf, __u32 id)
if (align <= 0)
return libbpf_err(align);
max_align = max(max_align, align);
+
+ /* if field offset isn't aligned according to field
+ * type's alignment, then struct must be packed
+ */
+ if (btf_member_bitfield_size(t, i) == 0 &&
+ (m->offset % (8 * align)) != 0)
+ return 1;
}
+ /* if struct/union size isn't a multiple of its alignment,
+ * then struct must be packed
+ */
+ if ((t->size % max_align) != 0)
+ return 1;
+
return max_align;
}
default:
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 075/567] wifi: ipw2x00: dont call dev_kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 074/567] libbpf: Fix btf__align_of() by taking into account field offsets Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 076/567] wifi: ipw2200: fix memory leak in ipw_wdev_init() Greg Kroah-Hartman
` (495 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 45fc6d7461f18df2f238caf0cbc5acc4163203d1 ]
It is not allowed to call kfree_skb() or consume_skb() from hardware
interrupt context or with hardware interrupts being disabled.
It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead.
The difference between them is free reason, dev_kfree_skb_irq() means
the SKB is dropped in error and dev_consume_skb_irq() means the SKB
is consumed in normal.
In this case, dev_kfree_skb() is called to free and drop the SKB when
it's reset, so replace it with dev_kfree_skb_irq(). Compile tested
only.
Fixes: 43f66a6ce8da ("Add ipw2200 wireless driver.")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221208143826.2385218-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/ipw2x00/ipw2200.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
index ada6ce32c1f19..df28e4a05e140 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -3444,7 +3444,7 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv,
dma_unmap_single(&priv->pci_dev->dev,
rxq->pool[i].dma_addr,
IPW_RX_BUF_SIZE, DMA_FROM_DEVICE);
- dev_kfree_skb(rxq->pool[i].skb);
+ dev_kfree_skb_irq(rxq->pool[i].skb);
rxq->pool[i].skb = NULL;
}
list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 076/567] wifi: ipw2200: fix memory leak in ipw_wdev_init()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 075/567] wifi: ipw2x00: dont call dev_kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 077/567] wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() Greg Kroah-Hartman
` (494 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengchao Shao, Kalle Valo, Sasha Levin
From: Zhengchao Shao <shaozhengchao@huawei.com>
[ Upstream commit 9fe21dc626117fb44a8eb393713a86a620128ce3 ]
In the error path of ipw_wdev_init(), exception value is returned, and
the memory applied for in the function is not released. Also the memory
is not released in ipw_pci_probe(). As a result, memory leakage occurs.
So memory release needs to be added to the error path of ipw_wdev_init().
Fixes: a3caa99e6c68 ("libipw: initiate cfg80211 API conversion (v2)")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221209012422.182669-1-shaozhengchao@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/ipw2x00/ipw2200.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
index df28e4a05e140..bb728fb24b8a4 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -11400,9 +11400,14 @@ static int ipw_wdev_init(struct net_device *dev)
set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
/* With that information in place, we can now register the wiphy... */
- if (wiphy_register(wdev->wiphy))
- rc = -EIO;
+ rc = wiphy_register(wdev->wiphy);
+ if (rc)
+ goto out;
+
+ return 0;
out:
+ kfree(priv->ieee->a_band.channels);
+ kfree(priv->ieee->bg_band.channels);
return rc;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 077/567] wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 076/567] wifi: ipw2200: fix memory leak in ipw_wdev_init() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 078/567] wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() Greg Kroah-Hartman
` (493 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Changzhong, Kalle Valo, Sasha Levin
From: Zhang Changzhong <zhangchangzhong@huawei.com>
[ Upstream commit deb962ec9e1c9a81babd3d37542ad4bd6ac3396e ]
The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add
dev_kfree_skb() to fix it. Compile tested only.
Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/1668684964-48622-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/microchip/wilc1000/netdev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c
index 9dfb1a285e6a4..5e3ec20e24dad 100644
--- a/drivers/net/wireless/microchip/wilc1000/netdev.c
+++ b/drivers/net/wireless/microchip/wilc1000/netdev.c
@@ -724,6 +724,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev)
if (skb->dev != ndev) {
netdev_err(ndev, "Packet not destined to this device\n");
+ dev_kfree_skb(skb);
return NETDEV_TX_OK;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 078/567] wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 077/567] wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 079/567] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() Greg Kroah-Hartman
` (492 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Changzhong, Arend van Spriel,
Kalle Valo, Sasha Levin
From: Zhang Changzhong <zhangchangzhong@huawei.com>
[ Upstream commit 212fde3fe76e962598ce1d47b97cc78afdfc71b3 ]
The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb
in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it.
Compile tested only.
Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/1668684782-47422-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index e5bae62245215..f03fc6f1f8333 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -338,6 +338,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
bphy_err(drvr, "%s: failed to expand headroom\n",
brcmf_ifname(ifp));
atomic_inc(&drvr->bus_if->stats.pktcow_failed);
+ dev_kfree_skb(skb);
goto done;
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 079/567] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 078/567] wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 080/567] wifi: libertas_tf: dont call kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
` (491 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengchao Shao,
Sebastian Andrzej Siewior, Kalle Valo, Sasha Levin
From: Zhengchao Shao <shaozhengchao@huawei.com>
[ Upstream commit b9f420032f2ba1e634b22ca7b433e5c40ea663af ]
After the DMA buffer is mapped to a physical address, address is stored
in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr
and later unmap the DMA buffer. But when count is always equal to
pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
will not be unmapped anyway.
Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221207013114.1748936-1-shaozhengchao@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index 7c8e08ee8f0ff..bd3b234b78038 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -346,8 +346,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev,
count++;
} while (count < pktids->array_size);
- if (count == pktids->array_size)
+ if (count == pktids->array_size) {
+ dma_unmap_single(dev, *physaddr, skb->len - data_offset,
+ pktids->direction);
return -ENOMEM;
+ }
array[*idx].data_offset = data_offset;
array[*idx].physaddr = *physaddr;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 080/567] wifi: libertas_tf: dont call kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 079/567] wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 081/567] wifi: libertas: if_usb: " Greg Kroah-Hartman
` (490 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 9388ce97b98216833c969191ee6df61a7201d797 ]
It is not allowed to call kfree_skb() from hardware interrupt
context or with interrupts being disabled. So replace kfree_skb()
with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile
tested only.
Fixes: fc75122fabb5 ("libertas_tf: use irqsave() in USB's complete callback")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221207150008.111743-2-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
index 75b5319d033f3..1750f5e93de21 100644
--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
@@ -613,7 +613,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
spin_lock_irqsave(&priv->driver_lock, flags);
memcpy(priv->cmd_resp_buff, recvbuff + MESSAGE_HEADER_LEN,
recvlength - MESSAGE_HEADER_LEN);
- kfree_skb(skb);
+ dev_kfree_skb_irq(skb);
lbtf_cmd_response_rx(priv);
spin_unlock_irqrestore(&priv->driver_lock, flags);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 081/567] wifi: libertas: if_usb: dont call kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 080/567] wifi: libertas_tf: dont call kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 082/567] wifi: libertas: main: " Greg Kroah-Hartman
` (489 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 3968e81ba644f10a7d45bae2539560db9edac501 ]
It is not allowed to call kfree_skb() from hardware interrupt
context or with interrupts being disabled. So replace kfree_skb()
with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile
tested only.
Fixes: a3128feef6d5 ("libertas: use irqsave() in USB's complete callback")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221207150008.111743-3-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/libertas/if_usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
index 32fdc4150b605..2240b4db8c036 100644
--- a/drivers/net/wireless/marvell/libertas/if_usb.c
+++ b/drivers/net/wireless/marvell/libertas/if_usb.c
@@ -637,7 +637,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
priv->resp_len[i] = (recvlength - MESSAGE_HEADER_LEN);
memcpy(priv->resp_buf[i], recvbuff + MESSAGE_HEADER_LEN,
priv->resp_len[i]);
- kfree_skb(skb);
+ dev_kfree_skb_irq(skb);
lbs_notify_command_response(priv, i);
spin_unlock_irqrestore(&priv->driver_lock, flags);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 082/567] wifi: libertas: main: dont call kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 081/567] wifi: libertas: if_usb: " Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:56 ` [PATCH 5.15 083/567] wifi: libertas: cmdresp: " Greg Kroah-Hartman
` (488 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit f393df151540bf858effbd29ff572ab94e76a4c4 ]
It is not allowed to call kfree_skb() from hardware interrupt
context or with interrupts being disabled. So replace kfree_skb()
with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile
tested only.
Fixes: d2e7b3425c47 ("libertas: disable functionality when interface is down")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221207150008.111743-4-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/libertas/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c
index b739a490fc20a..46877773a36de 100644
--- a/drivers/net/wireless/marvell/libertas/main.c
+++ b/drivers/net/wireless/marvell/libertas/main.c
@@ -217,7 +217,7 @@ int lbs_stop_iface(struct lbs_private *priv)
spin_lock_irqsave(&priv->driver_lock, flags);
priv->iface_running = false;
- kfree_skb(priv->currenttxskb);
+ dev_kfree_skb_irq(priv->currenttxskb);
priv->currenttxskb = NULL;
priv->tx_pending_len = 0;
spin_unlock_irqrestore(&priv->driver_lock, flags);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 083/567] wifi: libertas: cmdresp: dont call kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 082/567] wifi: libertas: main: " Greg Kroah-Hartman
@ 2023-03-07 16:56 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 084/567] wifi: wl3501_cs: " Greg Kroah-Hartman
` (487 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 708a49a64237f19bd404852f297aaadbc9e7fee0 ]
It is not allowed to call kfree_skb() from hardware interrupt
context or with interrupts being disabled. So replace kfree_skb()
with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile
tested only.
Fixes: f52b041aed77 ("libertas: Add spinlock to avoid race condition")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221207150008.111743-5-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/libertas/cmdresp.c b/drivers/net/wireless/marvell/libertas/cmdresp.c
index cb515c5584c1f..74cb7551f4275 100644
--- a/drivers/net/wireless/marvell/libertas/cmdresp.c
+++ b/drivers/net/wireless/marvell/libertas/cmdresp.c
@@ -48,7 +48,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv,
/* Free Tx and Rx packets */
spin_lock_irqsave(&priv->driver_lock, flags);
- kfree_skb(priv->currenttxskb);
+ dev_kfree_skb_irq(priv->currenttxskb);
priv->currenttxskb = NULL;
priv->tx_pending_len = 0;
spin_unlock_irqrestore(&priv->driver_lock, flags);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 084/567] wifi: wl3501_cs: dont call kfree_skb() under spin_lock_irqsave()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2023-03-07 16:56 ` [PATCH 5.15 083/567] wifi: libertas: cmdresp: " Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 085/567] crypto: x86/ghash - fix unaligned access in ghash_setkey() Greg Kroah-Hartman
` (486 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Kalle Valo, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 44bacbdf9066c590423259dbd6d520baac99c1a8 ]
It is not allowed to call kfree_skb() from hardware interrupt
context or with interrupts being disabled. So replace kfree_skb()
with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile
tested only.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221207150453.114742-1-yangyingliang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/wl3501_cs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 672f5d5f3f2c7..cb71b73853f4e 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -1328,7 +1328,7 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb,
} else {
++dev->stats.tx_packets;
dev->stats.tx_bytes += skb->len;
- kfree_skb(skb);
+ dev_kfree_skb_irq(skb);
if (this->tx_buffer_cnt < 2)
netif_stop_queue(dev);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 085/567] crypto: x86/ghash - fix unaligned access in ghash_setkey()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 084/567] wifi: wl3501_cs: " Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 086/567] ACPICA: Drop port I/O validation for some regions Greg Kroah-Hartman
` (485 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu, Sasha Levin
From: Eric Biggers <ebiggers@google.com>
[ Upstream commit 116db2704c193fff6d73ea6c2219625f0c9bdfc8 ]
The key can be unaligned, so use the unaligned memory access helpers.
Fixes: 8ceee72808d1 ("crypto: ghash-clmulni-intel - use C implementation for setkey()")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c
index 1f1a95f3dd0ca..c0ab0ff4af655 100644
--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
+++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
@@ -19,6 +19,7 @@
#include <crypto/internal/simd.h>
#include <asm/cpu_device_id.h>
#include <asm/simd.h>
+#include <asm/unaligned.h>
#define GHASH_BLOCK_SIZE 16
#define GHASH_DIGEST_SIZE 16
@@ -54,15 +55,14 @@ static int ghash_setkey(struct crypto_shash *tfm,
const u8 *key, unsigned int keylen)
{
struct ghash_ctx *ctx = crypto_shash_ctx(tfm);
- be128 *x = (be128 *)key;
u64 a, b;
if (keylen != GHASH_BLOCK_SIZE)
return -EINVAL;
/* perform multiplication by 'x' in GF(2^128) */
- a = be64_to_cpu(x->a);
- b = be64_to_cpu(x->b);
+ a = get_unaligned_be64(key);
+ b = get_unaligned_be64(key + 8);
ctx->shash.a = (b << 1) | (a >> 63);
ctx->shash.b = (a << 1) | (b >> 63);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 086/567] ACPICA: Drop port I/O validation for some regions
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 085/567] crypto: x86/ghash - fix unaligned access in ghash_setkey() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 087/567] genirq: Fix the return type of kstat_cpu_irqs_sum() Greg Kroah-Hartman
` (484 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello,
Rafael J. Wysocki, Sasha Levin
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 ]
Microsoft introduced support in Windows XP for blocking port I/O
to various regions. For Windows compatibility ACPICA has adopted
the same protections and will disallow writes to those
(presumably) the same regions.
On some systems the AML included with the firmware will issue 4 byte
long writes to 0x80. These writes aren't making it over because of this
blockage. The first 4 byte write attempt is rejected, and then
subsequently 1 byte at a time each offset is tried. The first at 0x80
works, but then the next 3 bytes are rejected.
This manifests in bizarre failures for devices that expected the AML to
write all 4 bytes. Trying the same AML on Windows 10 or 11 doesn't hit
this failure and all 4 bytes are written.
Either some of these regions were wrong or some point after Windows XP
some of these regions blocks have been lifted.
In the last 15 years there doesn't seem to be any reports popping up of
this error in the Windows event viewer anymore. There is no documentation
at Microsoft's developer site indicating that Windows ACPI interpreter
blocks these regions. Between the lack of documentation and the fact that
the writes actually do work in Windows 10 and 11, it's quite likely
Windows doesn't actually enforce this anymore.
So to help the issue, only enforce Windows XP specific entries if the
latest _OSI supported is Windows XP. Continue to enforce the
ALWAYS_ILLEGAL entries.
Link: https://github.com/acpica/acpica/pull/817
Fixes: 7f0719039085 ("ACPICA: New: I/O port protection")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/hwvalid.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
index e15badf4077aa..c6716f90e013a 100644
--- a/drivers/acpi/acpica/hwvalid.c
+++ b/drivers/acpi/acpica/hwvalid.c
@@ -23,8 +23,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width);
*
* The table is used to implement the Microsoft port access rules that
* first appeared in Windows XP. Some ports are always illegal, and some
- * ports are only illegal if the BIOS calls _OSI with a win_XP string or
- * later (meaning that the BIOS itelf is post-XP.)
+ * ports are only illegal if the BIOS calls _OSI with nothing newer than
+ * the specific _OSI strings.
*
* This provides ACPICA with the desired port protections and
* Microsoft compatibility.
@@ -145,7 +145,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
/* Port illegality may depend on the _OSI calls made by the BIOS */
- if (acpi_gbl_osi_data >= port_info->osi_dependency) {
+ if (port_info->osi_dependency == ACPI_ALWAYS_ILLEGAL ||
+ acpi_gbl_osi_data == port_info->osi_dependency) {
ACPI_DEBUG_PRINT((ACPI_DB_VALUES,
"Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)\n",
ACPI_FORMAT_UINT64(address),
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 087/567] genirq: Fix the return type of kstat_cpu_irqs_sum()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 086/567] ACPICA: Drop port I/O validation for some regions Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 088/567] rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose Greg Kroah-Hartman
` (483 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Elliott, Robert (Servers),
Zhen Lei, Tejun Heo, Peter Zijlstra (Intel),
Josh Don, Andrew Morton, Frederic Weisbecker, Paul E. McKenney,
Sasha Levin, Elliott
From: Zhen Lei <thunder.leizhen@huawei.com>
[ Upstream commit 47904aed898a08f028572b9b5a5cc101ddfb2d82 ]
The type of member ->irqs_sum is unsigned long, but kstat_cpu_irqs_sum()
returns int, which can result in truncation. Therefore, change the
kstat_cpu_irqs_sum() function's return value to unsigned long to avoid
truncation.
Fixes: f2c66cd8eedd ("/proc/stat: scalability of irq num per cpu")
Reported-by: Elliott, Robert (Servers) <elliott@hpe.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org>
Cc: Josh Don <joshdon@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/kernel_stat.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h
index 69ae6b2784645..f9460fbea0a81 100644
--- a/include/linux/kernel_stat.h
+++ b/include/linux/kernel_stat.h
@@ -72,7 +72,7 @@ extern unsigned int kstat_irqs_usr(unsigned int irq);
/*
* Number of interrupts per cpu, since bootup
*/
-static inline unsigned int kstat_cpu_irqs_sum(unsigned int cpu)
+static inline unsigned long kstat_cpu_irqs_sum(unsigned int cpu)
{
return kstat_cpu(cpu).irqs_sum;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 088/567] rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 087/567] genirq: Fix the return type of kstat_cpu_irqs_sum() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 089/567] rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls Greg Kroah-Hartman
` (482 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boqun Feng, Neeraj Upadhyay,
Paul E. McKenney, Oleg Nesterov, Lai Jiangshan,
Eric W. Biederman, Frederic Weisbecker, Sasha Levin
From: Frederic Weisbecker <frederic@kernel.org>
[ Upstream commit e4e1e8089c5fd948da12cb9f4adc93821036945f ]
Make sure we don't need to look again into the depths of git blame in
order not to miss a subtle part about how rcu-tasks is dealing with
exiting tasks.
Suggested-by: Boqun Feng <boqun.feng@gmail.com>
Suggested-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/tasks.h | 37 +++++++++++++++++++++++++++++--------
1 file changed, 29 insertions(+), 8 deletions(-)
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index 4bd07cc3c0eab..d937bacf27b68 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -451,11 +451,21 @@ static void rcu_tasks_pertask(struct task_struct *t, struct list_head *hop)
static void rcu_tasks_postscan(struct list_head *hop)
{
/*
- * Wait for tasks that are in the process of exiting. This
- * does only part of the job, ensuring that all tasks that were
- * previously exiting reach the point where they have disabled
- * preemption, allowing the later synchronize_rcu() to finish
- * the job.
+ * Exiting tasks may escape the tasklist scan. Those are vulnerable
+ * until their final schedule() with TASK_DEAD state. To cope with
+ * this, divide the fragile exit path part in two intersecting
+ * read side critical sections:
+ *
+ * 1) An _SRCU_ read side starting before calling exit_notify(),
+ * which may remove the task from the tasklist, and ending after
+ * the final preempt_disable() call in do_exit().
+ *
+ * 2) An _RCU_ read side starting with the final preempt_disable()
+ * call in do_exit() and ending with the final call to schedule()
+ * with TASK_DEAD state.
+ *
+ * This handles the part 1). And postgp will handle part 2) with a
+ * call to synchronize_rcu().
*/
synchronize_srcu(&tasks_rcu_exit_srcu);
}
@@ -522,7 +532,10 @@ static void rcu_tasks_postgp(struct rcu_tasks *rtp)
*
* In addition, this synchronize_rcu() waits for exiting tasks
* to complete their final preempt_disable() region of execution,
- * cleaning up after the synchronize_srcu() above.
+ * cleaning up after synchronize_srcu(&tasks_rcu_exit_srcu),
+ * enforcing the whole region before tasklist removal until
+ * the final schedule() with TASK_DEAD state to be an RCU TASKS
+ * read side critical section.
*/
synchronize_rcu();
}
@@ -612,7 +625,11 @@ void show_rcu_tasks_classic_gp_kthread(void)
EXPORT_SYMBOL_GPL(show_rcu_tasks_classic_gp_kthread);
#endif // !defined(CONFIG_TINY_RCU)
-/* Do the srcu_read_lock() for the above synchronize_srcu(). */
+/*
+ * Contribute to protect against tasklist scan blind spot while the
+ * task is exiting and may be removed from the tasklist. See
+ * corresponding synchronize_srcu() for further details.
+ */
void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu)
{
preempt_disable();
@@ -620,7 +637,11 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu)
preempt_enable();
}
-/* Do the srcu_read_unlock() for the above synchronize_srcu(). */
+/*
+ * Contribute to protect against tasklist scan blind spot while the
+ * task is exiting and may be removed from the tasklist. See
+ * corresponding synchronize_srcu() for further details.
+ */
void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu)
{
struct task_struct *t = current;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 089/567] rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 088/567] rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 090/567] rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes() Greg Kroah-Hartman
` (481 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boqun Feng, Paul E. McKenney,
Neeraj Upadhyay, Lai Jiangshan, Frederic Weisbecker, Sasha Levin
From: Frederic Weisbecker <frederic@kernel.org>
[ Upstream commit 44757092958bdd749775022f915b7ac974384c2a ]
Ever since the following commit:
5a41344a3d83 ("srcu: Simplify __srcu_read_unlock() via this_cpu_dec()")
SRCU doesn't rely anymore on preemption to be disabled in order to
modify the per-CPU counter. And even then it used to be done from the API
itself.
Therefore and after checking further, it appears to be safe to remove
the preemption disablement around __srcu_read_[un]lock() in
exit_tasks_rcu_start() and exit_tasks_rcu_finish()
Suggested-by: Boqun Feng <boqun.feng@gmail.com>
Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Suggested-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/tasks.h | 4 ----
1 file changed, 4 deletions(-)
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index d937bacf27b68..2408ca633872a 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -632,9 +632,7 @@ EXPORT_SYMBOL_GPL(show_rcu_tasks_classic_gp_kthread);
*/
void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu)
{
- preempt_disable();
current->rcu_tasks_idx = __srcu_read_lock(&tasks_rcu_exit_srcu);
- preempt_enable();
}
/*
@@ -646,9 +644,7 @@ void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu)
{
struct task_struct *t = current;
- preempt_disable();
__srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx);
- preempt_enable();
exit_tasks_rcu_finish_trace(t);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 090/567] rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 089/567] rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 091/567] lib/mpi: Fix buffer overrun when SG is too long Greg Kroah-Hartman
` (480 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengfei Xu, Boqun Feng,
Neeraj Upadhyay, Paul E. McKenney, Oleg Nesterov, Lai Jiangshan,
Eric W . Biederman, Frederic Weisbecker, Sasha Levin
From: Frederic Weisbecker <frederic@kernel.org>
[ Upstream commit 28319d6dc5e2ffefa452c2377dd0f71621b5bff0 ]
RCU Tasks and PID-namespace unshare can interact in do_exit() in a
complicated circular dependency:
1) TASK A calls unshare(CLONE_NEWPID), this creates a new PID namespace
that every subsequent child of TASK A will belong to. But TASK A
doesn't itself belong to that new PID namespace.
2) TASK A forks() and creates TASK B. TASK A stays attached to its PID
namespace (let's say PID_NS1) and TASK B is the first task belonging
to the new PID namespace created by unshare() (let's call it PID_NS2).
3) Since TASK B is the first task attached to PID_NS2, it becomes the
PID_NS2 child reaper.
4) TASK A forks() again and creates TASK C which get attached to PID_NS2.
Note how TASK C has TASK A as a parent (belonging to PID_NS1) but has
TASK B (belonging to PID_NS2) as a pid_namespace child_reaper.
5) TASK B exits and since it is the child reaper for PID_NS2, it has to
kill all other tasks attached to PID_NS2, and wait for all of them to
die before getting reaped itself (zap_pid_ns_process()).
6) TASK A calls synchronize_rcu_tasks() which leads to
synchronize_srcu(&tasks_rcu_exit_srcu).
7) TASK B is waiting for TASK C to get reaped. But TASK B is under a
tasks_rcu_exit_srcu SRCU critical section (exit_notify() is between
exit_tasks_rcu_start() and exit_tasks_rcu_finish()), blocking TASK A.
8) TASK C exits and since TASK A is its parent, it waits for it to reap
TASK C, but it can't because TASK A waits for TASK B that waits for
TASK C.
Pid_namespace semantics can hardly be changed at this point. But the
coverage of tasks_rcu_exit_srcu can be reduced instead.
The current task is assumed not to be concurrently reapable at this
stage of exit_notify() and therefore tasks_rcu_exit_srcu can be
temporarily relaxed without breaking its constraints, providing a way
out of the deadlock scenario.
[ paulmck: Fix build failure by adding additional declaration. ]
Fixes: 3f95aa81d265 ("rcu: Make TASKS_RCU handle tasks that are almost done exiting")
Reported-by: Pengfei Xu <pengfei.xu@intel.com>
Suggested-by: Boqun Feng <boqun.feng@gmail.com>
Suggested-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
Suggested-by: Paul E. McKenney <paulmck@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Cc: Eric W . Biederman <ebiederm@xmission.com>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/rcupdate.h | 2 ++
kernel/pid_namespace.c | 17 +++++++++++++++++
kernel/rcu/tasks.h | 15 +++++++++++++--
3 files changed, 32 insertions(+), 2 deletions(-)
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 434d12fe2d4f5..1e937a32da33d 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -193,6 +193,7 @@ void synchronize_rcu_tasks_rude(void);
#define rcu_note_voluntary_context_switch(t) rcu_tasks_qs(t, false)
void exit_tasks_rcu_start(void);
+void exit_tasks_rcu_stop(void);
void exit_tasks_rcu_finish(void);
#else /* #ifdef CONFIG_TASKS_RCU_GENERIC */
#define rcu_tasks_qs(t, preempt) do { } while (0)
@@ -200,6 +201,7 @@ void exit_tasks_rcu_finish(void);
#define call_rcu_tasks call_rcu
#define synchronize_rcu_tasks synchronize_rcu
static inline void exit_tasks_rcu_start(void) { }
+static inline void exit_tasks_rcu_stop(void) { }
static inline void exit_tasks_rcu_finish(void) { }
#endif /* #else #ifdef CONFIG_TASKS_RCU_GENERIC */
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index a46a3723bc662..259fc4ca0d9cc 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -244,7 +244,24 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
set_current_state(TASK_INTERRUPTIBLE);
if (pid_ns->pid_allocated == init_pids)
break;
+ /*
+ * Release tasks_rcu_exit_srcu to avoid following deadlock:
+ *
+ * 1) TASK A unshare(CLONE_NEWPID)
+ * 2) TASK A fork() twice -> TASK B (child reaper for new ns)
+ * and TASK C
+ * 3) TASK B exits, kills TASK C, waits for TASK A to reap it
+ * 4) TASK A calls synchronize_rcu_tasks()
+ * -> synchronize_srcu(tasks_rcu_exit_srcu)
+ * 5) *DEADLOCK*
+ *
+ * It is considered safe to release tasks_rcu_exit_srcu here
+ * because we assume the current task can not be concurrently
+ * reaped at this point.
+ */
+ exit_tasks_rcu_stop();
schedule();
+ exit_tasks_rcu_start();
}
__set_current_state(TASK_RUNNING);
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index 2408ca633872a..5533e3106ba01 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -640,16 +640,27 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu)
* task is exiting and may be removed from the tasklist. See
* corresponding synchronize_srcu() for further details.
*/
-void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu)
+void exit_tasks_rcu_stop(void) __releases(&tasks_rcu_exit_srcu)
{
struct task_struct *t = current;
__srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx);
- exit_tasks_rcu_finish_trace(t);
+}
+
+/*
+ * Contribute to protect against tasklist scan blind spot while the
+ * task is exiting and may be removed from the tasklist. See
+ * corresponding synchronize_srcu() for further details.
+ */
+void exit_tasks_rcu_finish(void)
+{
+ exit_tasks_rcu_stop();
+ exit_tasks_rcu_finish_trace(current);
}
#else /* #ifdef CONFIG_TASKS_RCU */
void exit_tasks_rcu_start(void) { }
+void exit_tasks_rcu_stop(void) { }
void exit_tasks_rcu_finish(void) { exit_tasks_rcu_finish_trace(current); }
#endif /* #else #ifdef CONFIG_TASKS_RCU */
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 091/567] lib/mpi: Fix buffer overrun when SG is too long
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 090/567] rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 092/567] crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 Greg Kroah-Hartman
` (479 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roberto Sassu, Herbert Xu,
Eric Biggers, Sasha Levin
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ]
The helper mpi_read_raw_from_sgl sets the number of entries in
the SG list according to nbytes. However, if the last entry
in the SG list contains more data than nbytes, then it may overrun
the buffer because it only allocates enough memory for nbytes.
Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers")
Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/mpi/mpicoder.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index 39c4c67310946..3cb6bd148fa9e 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
while (sg_miter_next(&miter)) {
buff = miter.addr;
- len = miter.length;
+ len = min_t(unsigned, miter.length, nbytes);
+ nbytes -= len;
for (x = 0; x < len; x++) {
a <<= 8;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 092/567] crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 091/567] lib/mpi: Fix buffer overrun when SG is too long Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 093/567] ACPICA: nsrepair: handle cases without a return value correctly Greg Kroah-Hartman
` (478 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Nguyen, Peter Gonda,
Herbert Xu, David Rientjes, Tom Lendacky, Sasha Levin
From: David Rientjes <rientjes@google.com>
[ Upstream commit 91dfd98216d817ec5f1c55890bacb7b4fe9b068a ]
For SEV_GET_ID2, the user provided length does not have a specified
limitation because the length of the ID may change in the future. The
kernel memory allocation, however, is implicitly limited to 4MB on x86 by
the page allocator, otherwise the kzalloc() will fail.
When this happens, it is best not to spam the kernel log with the warning.
Simply fail the allocation and return ENOMEM to the user.
Fixes: d6112ea0cb34 ("crypto: ccp - introduce SEV_GET_ID2 command")
Reported-by: Andy Nguyen <theflow@google.com>
Reported-by: Peter Gonda <pgonda@google.com>
Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David Rientjes <rientjes@google.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccp/sev-dev.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 900727b5edda5..15ef60cd4b149 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -667,7 +667,14 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp)
input_address = (void __user *)input.address;
if (input.address && input.length) {
- id_blob = kzalloc(input.length, GFP_KERNEL);
+ /*
+ * The length of the ID shouldn't be assumed by software since
+ * it may change in the future. The allocation size is limited
+ * to 1 << (PAGE_SHIFT + MAX_ORDER - 1) by the page allocator.
+ * If the allocation fails, simply return ENOMEM rather than
+ * warning in the kernel log.
+ */
+ id_blob = kzalloc(input.length, GFP_KERNEL | __GFP_NOWARN);
if (!id_blob)
return -ENOMEM;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 093/567] ACPICA: nsrepair: handle cases without a return value correctly
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 092/567] crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 094/567] thermal/drivers/tsens: Drop msm8976-specific defines Greg Kroah-Hartman
` (477 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniil Tatianin, Rafael J. Wysocki,
Sasha Levin
From: Daniil Tatianin <d-tatianin@yandex-team.ru>
[ Upstream commit ca843a4c79486e99a19b859ef0b9887854afe146 ]
Previously acpi_ns_simple_repair() would crash if expected_btypes
contained any combination of ACPI_RTYPE_NONE with a different type,
e.g | ACPI_RTYPE_INTEGER because of slightly incorrect logic in the
!return_object branch, which wouldn't return AE_AML_NO_RETURN_VALUE
for such cases.
Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.
Link: https://github.com/acpica/acpica/pull/811
Fixes: 61db45ca2163 ("ACPICA: Restore code that repairs NULL package elements in return values.")
Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/nsrepair.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c
index 499067daa22c6..1b8677f2ced37 100644
--- a/drivers/acpi/acpica/nsrepair.c
+++ b/drivers/acpi/acpica/nsrepair.c
@@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,
* Try to fix if there was no return object. Warning if failed to fix.
*/
if (!return_object) {
- if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) {
- if (package_index != ACPI_NOT_PACKAGE_ELEMENT) {
+ if (expected_btypes) {
+ if (!(expected_btypes & ACPI_RTYPE_NONE) &&
+ package_index != ACPI_NOT_PACKAGE_ELEMENT) {
ACPI_WARN_PREDEFINED((AE_INFO,
info->full_pathname,
ACPI_WARN_ALWAYS,
@@ -196,14 +197,15 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,
if (ACPI_SUCCESS(status)) {
return (AE_OK); /* Repair was successful */
}
- } else {
+ }
+
+ if (expected_btypes != ACPI_RTYPE_NONE) {
ACPI_WARN_PREDEFINED((AE_INFO,
info->full_pathname,
ACPI_WARN_ALWAYS,
"Missing expected return value"));
+ return (AE_AML_NO_RETURN_VALUE);
}
-
- return (AE_AML_NO_RETURN_VALUE);
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 094/567] thermal/drivers/tsens: Drop msm8976-specific defines
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 093/567] ACPICA: nsrepair: handle cases without a return value correctly Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 095/567] thermal/drivers/tsens: Add compat string for the qcom,msm8960 Greg Kroah-Hartman
` (476 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno,
Konrad Dybcio, Dmitry Baryshkov, Daniel Lezcano, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 3bf0ea99e2e32b0335106b86d84404cc85bcd113 ]
Drop msm8976-specific defines, which duplicate generic ones.
Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976")
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20230101194034.831222-6-dmitry.baryshkov@linaro.org
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/qcom/tsens-v1.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c
index 573e261ccca74..13624263f1dfe 100644
--- a/drivers/thermal/qcom/tsens-v1.c
+++ b/drivers/thermal/qcom/tsens-v1.c
@@ -78,11 +78,6 @@
#define MSM8976_CAL_SEL_MASK 0x3
-#define MSM8976_CAL_DEGC_PT1 30
-#define MSM8976_CAL_DEGC_PT2 120
-#define MSM8976_SLOPE_FACTOR 1000
-#define MSM8976_SLOPE_DEFAULT 3200
-
/* eeprom layout data for qcs404/405 (v1) */
#define BASE0_MASK 0x000007f8
#define BASE1_MASK 0x0007f800
@@ -160,8 +155,8 @@ static void compute_intercept_slope_8976(struct tsens_priv *priv,
priv->sensor[10].slope = 3286;
for (i = 0; i < priv->num_sensors; i++) {
- priv->sensor[i].offset = (p1[i] * MSM8976_SLOPE_FACTOR) -
- (MSM8976_CAL_DEGC_PT1 *
+ priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) -
+ (CAL_DEGC_PT1 *
priv->sensor[i].slope);
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 095/567] thermal/drivers/tsens: Add compat string for the qcom,msm8960
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 094/567] thermal/drivers/tsens: Drop msm8976-specific defines Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 096/567] thermal/drivers/tsens: Sort out msm8976 vs msm8956 data Greg Kroah-Hartman
` (475 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Daniel Lezcano,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 2caf73969de6675318a711d0622406c8c66afc03 ]
On apq8064 (msm8960) platforms the tsens device is created manually by
the gcc driver. Prepare the tsens driver for the qcom,msm8960-tsens
device instantiated from the device tree.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20220406002648.393486-3-dmitry.baryshkov@linaro.org
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Stable-dep-of: a7d3006be5ca ("thermal/drivers/tsens: Sort out msm8976 vs msm8956 data")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/qcom/tsens.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c
index 99a8d9f3e03ca..cef1cbcf03f41 100644
--- a/drivers/thermal/qcom/tsens.c
+++ b/drivers/thermal/qcom/tsens.c
@@ -978,6 +978,9 @@ static const struct of_device_id tsens_table[] = {
}, {
.compatible = "qcom,msm8939-tsens",
.data = &data_8939,
+ }, {
+ .compatible = "qcom,msm8960-tsens",
+ .data = &data_8960,
}, {
.compatible = "qcom,msm8974-tsens",
.data = &data_8974,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 096/567] thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 095/567] thermal/drivers/tsens: Add compat string for the qcom,msm8960 Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 097/567] thermal/drivers/tsens: fix slope values for msm8939 Greg Kroah-Hartman
` (474 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno,
Konrad Dybcio, Dmitry Baryshkov, Daniel Lezcano, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit a7d3006be5ca7b04e4b84b5ceaae55a700e511bd ]
Tsens driver mentions that msm8976 data should be used for both msm8976
and msm8956 SoCs. This is not quite correct, as according to the
vendor kernels, msm8976 should use standard slope values (3200), while
msm8956 really uses the slope values found in the driver.
Add separate compatibility string for msm8956, move slope value
overrides to the corresponding init function and use the standard
compute_intercept_slope() function for both platforms.
Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976")
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20230101194034.831222-7-dmitry.baryshkov@linaro.org
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/qcom/tsens-v1.c | 56 ++++++++++++++++++---------------
drivers/thermal/qcom/tsens.c | 3 ++
drivers/thermal/qcom/tsens.h | 2 +-
3 files changed, 34 insertions(+), 27 deletions(-)
diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c
index 13624263f1dfe..faa4576fa028f 100644
--- a/drivers/thermal/qcom/tsens-v1.c
+++ b/drivers/thermal/qcom/tsens-v1.c
@@ -137,30 +137,6 @@
#define CAL_SEL_MASK 7
#define CAL_SEL_SHIFT 0
-static void compute_intercept_slope_8976(struct tsens_priv *priv,
- u32 *p1, u32 *p2, u32 mode)
-{
- int i;
-
- priv->sensor[0].slope = 3313;
- priv->sensor[1].slope = 3275;
- priv->sensor[2].slope = 3320;
- priv->sensor[3].slope = 3246;
- priv->sensor[4].slope = 3279;
- priv->sensor[5].slope = 3257;
- priv->sensor[6].slope = 3234;
- priv->sensor[7].slope = 3269;
- priv->sensor[8].slope = 3255;
- priv->sensor[9].slope = 3239;
- priv->sensor[10].slope = 3286;
-
- for (i = 0; i < priv->num_sensors; i++) {
- priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) -
- (CAL_DEGC_PT1 *
- priv->sensor[i].slope);
- }
-}
-
static int calibrate_v1(struct tsens_priv *priv)
{
u32 base0 = 0, base1 = 0;
@@ -286,7 +262,7 @@ static int calibrate_8976(struct tsens_priv *priv)
break;
}
- compute_intercept_slope_8976(priv, p1, p2, mode);
+ compute_intercept_slope(priv, p1, p2, mode);
kfree(qfprom_cdata);
return 0;
@@ -357,6 +333,22 @@ static const struct reg_field tsens_v1_regfields[MAX_REGFIELDS] = {
[TRDY] = REG_FIELD(TM_TRDY_OFF, 0, 0),
};
+static int __init init_8956(struct tsens_priv *priv) {
+ priv->sensor[0].slope = 3313;
+ priv->sensor[1].slope = 3275;
+ priv->sensor[2].slope = 3320;
+ priv->sensor[3].slope = 3246;
+ priv->sensor[4].slope = 3279;
+ priv->sensor[5].slope = 3257;
+ priv->sensor[6].slope = 3234;
+ priv->sensor[7].slope = 3269;
+ priv->sensor[8].slope = 3255;
+ priv->sensor[9].slope = 3239;
+ priv->sensor[10].slope = 3286;
+
+ return init_common(priv);
+}
+
static const struct tsens_ops ops_generic_v1 = {
.init = init_common,
.calibrate = calibrate_v1,
@@ -369,13 +361,25 @@ struct tsens_plat_data data_tsens_v1 = {
.fields = tsens_v1_regfields,
};
+static const struct tsens_ops ops_8956 = {
+ .init = init_8956,
+ .calibrate = calibrate_8976,
+ .get_temp = get_temp_tsens_valid,
+};
+
+struct tsens_plat_data data_8956 = {
+ .num_sensors = 11,
+ .ops = &ops_8956,
+ .feat = &tsens_v1_feat,
+ .fields = tsens_v1_regfields,
+};
+
static const struct tsens_ops ops_8976 = {
.init = init_common,
.calibrate = calibrate_8976,
.get_temp = get_temp_tsens_valid,
};
-/* Valid for both MSM8956 and MSM8976. */
struct tsens_plat_data data_8976 = {
.num_sensors = 11,
.ops = &ops_8976,
diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c
index cef1cbcf03f41..926cd8b41132c 100644
--- a/drivers/thermal/qcom/tsens.c
+++ b/drivers/thermal/qcom/tsens.c
@@ -978,6 +978,9 @@ static const struct of_device_id tsens_table[] = {
}, {
.compatible = "qcom,msm8939-tsens",
.data = &data_8939,
+ }, {
+ .compatible = "qcom,msm8956-tsens",
+ .data = &data_8956,
}, {
.compatible = "qcom,msm8960-tsens",
.data = &data_8960,
diff --git a/drivers/thermal/qcom/tsens.h b/drivers/thermal/qcom/tsens.h
index 1471a2c00f158..c2e5aee159276 100644
--- a/drivers/thermal/qcom/tsens.h
+++ b/drivers/thermal/qcom/tsens.h
@@ -590,7 +590,7 @@ extern struct tsens_plat_data data_8960;
extern struct tsens_plat_data data_8916, data_8939, data_8974, data_9607;
/* TSENS v1 targets */
-extern struct tsens_plat_data data_tsens_v1, data_8976;
+extern struct tsens_plat_data data_tsens_v1, data_8976, data_8956;
/* TSENS v2 targets */
extern struct tsens_plat_data data_8996, data_tsens_v2;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 097/567] thermal/drivers/tsens: fix slope values for msm8939
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 096/567] thermal/drivers/tsens: Sort out msm8976 vs msm8956 data Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 098/567] thermal/drivers/tsens: limit num_sensors to 9 " Greg Kroah-Hartman
` (473 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Shawn Guo,
Konrad Dybcio, Dmitry Baryshkov, Daniel Lezcano, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 5aec3b035e0cbf3f042c2a03d654e5ad6748feb7 ]
According to the vendor kernels (msm-3.10, 3.14 and 3.18), msm8939
uses non-standard slope values for calibrating the sensors. Fill them
accordingly.
Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939")
Cc: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Cc: Shawn Guo <shawn.guo@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Link: https://lore.kernel.org/r/20230101194034.831222-8-dmitry.baryshkov@linaro.org
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/qcom/tsens-v0_1.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c
index 327f37202c69f..f6d55e6d85dde 100644
--- a/drivers/thermal/qcom/tsens-v0_1.c
+++ b/drivers/thermal/qcom/tsens-v0_1.c
@@ -534,6 +534,21 @@ static int calibrate_9607(struct tsens_priv *priv)
return 0;
}
+static int __init init_8939(struct tsens_priv *priv) {
+ priv->sensor[0].slope = 2911;
+ priv->sensor[1].slope = 2789;
+ priv->sensor[2].slope = 2906;
+ priv->sensor[3].slope = 2763;
+ priv->sensor[4].slope = 2922;
+ priv->sensor[5].slope = 2867;
+ priv->sensor[6].slope = 2833;
+ priv->sensor[7].slope = 2838;
+ priv->sensor[8].slope = 2840;
+ priv->sensor[9].slope = 2852;
+
+ return init_common(priv);
+}
+
/* v0.1: 8916, 8939, 8974, 9607 */
static struct tsens_features tsens_v0_1_feat = {
@@ -596,7 +611,7 @@ struct tsens_plat_data data_8916 = {
};
static const struct tsens_ops ops_8939 = {
- .init = init_common,
+ .init = init_8939,
.calibrate = calibrate_8939,
.get_temp = get_temp_common,
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 098/567] thermal/drivers/tsens: limit num_sensors to 9 for msm8939
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 097/567] thermal/drivers/tsens: fix slope values for msm8939 Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 099/567] wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU Greg Kroah-Hartman
` (472 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Shawn Guo,
Dmitry Baryshkov, Daniel Lezcano, Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 903238a33c116edf5f64f7a3fd246e6169cccfa6 ]
On msm8939 last (hwid=10) sensor was added in the hw revision 3.0.
Calibration data for it was placed outside of the main calibration data
blob, so it is not accessible by the current blob-parsing code.
Moreover data for the sensor's p2 is not contiguous in the fuses. This
makes it hard to use nvmem_cell API to parse calibration data in a
generic way.
Since the sensor doesn't seem to be actually used by the existing
hardware, disable the sensor for now.
Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939")
Cc: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Cc: Shawn Guo <shawn.guo@linaro.org>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Link: https://lore.kernel.org/r/20230101194034.831222-9-dmitry.baryshkov@linaro.org
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/qcom/tsens-v0_1.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c
index f6d55e6d85dde..8d036727b99fe 100644
--- a/drivers/thermal/qcom/tsens-v0_1.c
+++ b/drivers/thermal/qcom/tsens-v0_1.c
@@ -285,7 +285,7 @@ static int calibrate_8939(struct tsens_priv *priv)
u32 p1[10], p2[10];
int mode = 0;
u32 *qfprom_cdata;
- u32 cdata[6];
+ u32 cdata[4];
qfprom_cdata = (u32 *)qfprom_read(priv->dev, "calib");
if (IS_ERR(qfprom_cdata))
@@ -296,8 +296,6 @@ static int calibrate_8939(struct tsens_priv *priv)
cdata[1] = qfprom_cdata[13];
cdata[2] = qfprom_cdata[0];
cdata[3] = qfprom_cdata[1];
- cdata[4] = qfprom_cdata[22];
- cdata[5] = qfprom_cdata[21];
mode = (cdata[0] & MSM8939_CAL_SEL_MASK) >> MSM8939_CAL_SEL_SHIFT;
dev_dbg(priv->dev, "calibration mode is %d\n", mode);
@@ -314,8 +312,6 @@ static int calibrate_8939(struct tsens_priv *priv)
p2[6] = (cdata[2] & MSM8939_S6_P2_MASK) >> MSM8939_S6_P2_SHIFT;
p2[7] = (cdata[3] & MSM8939_S7_P2_MASK) >> MSM8939_S7_P2_SHIFT;
p2[8] = (cdata[3] & MSM8939_S8_P2_MASK) >> MSM8939_S8_P2_SHIFT;
- p2[9] = (cdata[4] & MSM8939_S9_P2_MASK_0_4) >> MSM8939_S9_P2_SHIFT_0_4;
- p2[9] |= ((cdata[5] & MSM8939_S9_P2_MASK_5) >> MSM8939_S9_P2_SHIFT_5) << 5;
for (i = 0; i < priv->num_sensors; i++)
p2[i] = (base1 + p2[i]) << 2;
fallthrough;
@@ -331,7 +327,6 @@ static int calibrate_8939(struct tsens_priv *priv)
p1[6] = (cdata[2] & MSM8939_S6_P1_MASK) >> MSM8939_S6_P1_SHIFT;
p1[7] = (cdata[3] & MSM8939_S7_P1_MASK) >> MSM8939_S7_P1_SHIFT;
p1[8] = (cdata[3] & MSM8939_S8_P1_MASK) >> MSM8939_S8_P1_SHIFT;
- p1[9] = (cdata[4] & MSM8939_S9_P1_MASK) >> MSM8939_S9_P1_SHIFT;
for (i = 0; i < priv->num_sensors; i++)
p1[i] = ((base0) + p1[i]) << 2;
break;
@@ -544,7 +539,7 @@ static int __init init_8939(struct tsens_priv *priv) {
priv->sensor[6].slope = 2833;
priv->sensor[7].slope = 2838;
priv->sensor[8].slope = 2840;
- priv->sensor[9].slope = 2852;
+ /* priv->sensor[9].slope = 2852; */
return init_common(priv);
}
@@ -617,9 +612,9 @@ static const struct tsens_ops ops_8939 = {
};
struct tsens_plat_data data_8939 = {
- .num_sensors = 10,
+ .num_sensors = 9,
.ops = &ops_8939,
- .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, 10 },
+ .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, /* 10 */ },
.feat = &tsens_v0_1_feat,
.fields = tsens_v0_1_regfields,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 099/567] wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 098/567] thermal/drivers/tsens: limit num_sensors to 9 " Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 100/567] wifi: orinoco: check return value of hermes_write_wordrec() Greg Kroah-Hartman
` (471 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Erhard F.,
Bitterblue Smith, Ping-Ke Shih, Kalle Valo, Sasha Levin
From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
[ Upstream commit b39f662ce1648db0b9de32e6a849b098480793cb ]
The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?)
when it's connected to a bluetooth audio device. The busy bluetooth
traffic generates lots of C2H (card to host) messages, which are not
freed correctly.
To fix this, move the dev_kfree_skb() call in rtl8xxxu_c2hcmd_callback()
inside the loop where skb_dequeue() is called.
The RTL8192EU leaks memory because the C2H messages are added to the
queue and left there forever. (This was fine in the past because it
probably wasn't sending any C2H messages until commit e542e66b7c2e
("wifi: rtl8xxxu: gen2: Turn on the rate control"). Since that commit
it sends a C2H message when the TX rate changes.)
To fix this, delete the check for rf_paths > 1 and the goto. Let the
function process the C2H messages from RTL8192EU like the ones from
the other chips.
Theoretically the RTL8188FU could also leak like RTL8723BU, but it
most likely doesn't send C2H messages frequently enough.
This change was tested with RTL8723BU by Erhard F. I tested it with
RTL8188FU and RTL8192EU.
Reported-by: Erhard F. <erhard_f@mailbox.org>
Tested-by: Erhard F. <erhard_f@mailbox.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=215197
Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna")
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/03b099c1-c671-d252-36f4-57b70d721f9d@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
index dc734e8fa0f1c..a404d0344351d 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
@@ -5490,9 +5490,6 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work)
btcoex = &priv->bt_coex;
rarpt = &priv->ra_report;
- if (priv->rf_paths > 1)
- goto out;
-
while (!skb_queue_empty(&priv->c2hcmd_queue)) {
skb = skb_dequeue(&priv->c2hcmd_queue);
@@ -5544,10 +5541,9 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work)
default:
break;
}
- }
-out:
- dev_kfree_skb(skb);
+ dev_kfree_skb(skb);
+ }
}
static void rtl8723bu_handle_c2h(struct rtl8xxxu_priv *priv,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 100/567] wifi: orinoco: check return value of hermes_write_wordrec()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 099/567] wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 101/567] wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function Greg Kroah-Hartman
` (470 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Kodanev, Kalle Valo, Sasha Levin
From: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
[ Upstream commit 1e346cbb096a5351a637ec1992beffbf330547f0 ]
There is currently no return check for writing an authentication
type (HERMES_AUTH_SHARED_KEY or HERMES_AUTH_OPEN). It looks like
it was accidentally skipped.
This patch adds a return check similar to the other checks in
__orinoco_hw_setup_enc() for hermes_write_wordrec().
Detected using the static analysis tool - Svace.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221227133306.201356-1-aleksei.kodanev@bell-sw.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intersil/orinoco/hw.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/intersil/orinoco/hw.c b/drivers/net/wireless/intersil/orinoco/hw.c
index 0aea35c9c11c7..4fcca08e50de2 100644
--- a/drivers/net/wireless/intersil/orinoco/hw.c
+++ b/drivers/net/wireless/intersil/orinoco/hw.c
@@ -931,6 +931,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv)
err = hermes_write_wordrec(hw, USER_BAP,
HERMES_RID_CNFAUTHENTICATION_AGERE,
auth_flag);
+ if (err)
+ return err;
}
err = hermes_write_wordrec(hw, USER_BAP,
HERMES_RID_CNFWEPENABLED_AGERE,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 101/567] wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 100/567] wifi: orinoco: check return value of hermes_write_wordrec() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 102/567] ath9k: hif_usb: simplify if-if to if-else Greg Kroah-Hartman
` (469 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+e008dccab31bd3647609,
syzbot+6692c72009680f7c4eb2, Fedor Pchelkin, Alexey Khoroshilov,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 ]
It is stated that ath9k_htc_rx_msg() either frees the provided skb or
passes its management to another callback function. However, the skb is
not freed in case there is no another callback function, and Syzkaller was
able to cause a memory leak. Also minor comment fix.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Reported-by: syzbot+e008dccab31bd3647609@syzkaller.appspotmail.com
Reported-by: syzbot+6692c72009680f7c4eb2@syzkaller.appspotmail.com
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230104123546.51427-1-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index ca05b07a45e67..fe62ff668f757 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -391,7 +391,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,
* HTC Messages are handled directly here and the obtained SKB
* is freed.
*
- * Service messages (Data, WMI) passed to the corresponding
+ * Service messages (Data, WMI) are passed to the corresponding
* endpoint RX handlers, which have to free the SKB.
*/
void ath9k_htc_rx_msg(struct htc_target *htc_handle,
@@ -478,6 +478,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
if (endpoint->ep_callbacks.rx)
endpoint->ep_callbacks.rx(endpoint->ep_callbacks.priv,
skb, epid);
+ else
+ goto invalid;
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 102/567] ath9k: hif_usb: simplify if-if to if-else
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 101/567] wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 103/567] ath9k: htc: clean up statistics macros Greg Kroah-Hartman
` (468 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wan Jiabing,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin
From: Wan Jiabing <wanjiabing@vivo.com>
[ Upstream commit 2950833f10cfa601813262e1d9c8473f9415681b ]
Use if and else instead of if(A) and if (!A).
Signed-off-by: Wan Jiabing <wanjiabing@vivo.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220424094441.104937-1-wanjiabing@vivo.com
Stable-dep-of: 0af54343a762 ("wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/hif_usb.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index f938ac1a4abd4..f54380fb6c9e5 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -368,10 +368,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
__skb_queue_head_init(&tx_buf->skb_queue);
list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
hif_dev->tx.tx_buf_cnt++;
- }
-
- if (!ret)
+ } else {
TX_STAT_INC(buf_queued);
+ }
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 103/567] ath9k: htc: clean up statistics macros
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 102/567] ath9k: hif_usb: simplify if-if to if-else Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 104/567] wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Greg Kroah-Hartman
` (467 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff Johnson, Pavel Skripkin,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit d7fc76039b74ad37b7056d5607b05d7cb31a5404 ]
I've changed *STAT_* macros a bit in previous patch and I seems like
they become really unreadable. Align these macros definitions to make
code cleaner and fix folllowing checkpatch warning
ERROR: Macros with complex values should be enclosed in parentheses
Also, statistics macros now accept an hif_dev as argument, since
macros that depend on having a local variable with a magic name
don't abide by the coding style.
No functional change
Suggested-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/ebb2306d06a496cd1b032155ae52fdc5fa8cc2c5.1655145743.git.paskripkin@gmail.com
Stable-dep-of: 0af54343a762 ("wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/hif_usb.c | 26 +++++++--------
drivers/net/wireless/ath/ath9k/htc.h | 32 +++++++++++--------
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +++---
3 files changed, 36 insertions(+), 32 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index f54380fb6c9e5..1a2e0c7eeb023 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -244,11 +244,11 @@ static inline void ath9k_skb_queue_complete(struct hif_device_usb *hif_dev,
ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
skb, txok);
if (txok) {
- TX_STAT_INC(skb_success);
- TX_STAT_ADD(skb_success_bytes, ln);
+ TX_STAT_INC(hif_dev, skb_success);
+ TX_STAT_ADD(hif_dev, skb_success_bytes, ln);
}
else
- TX_STAT_INC(skb_failed);
+ TX_STAT_INC(hif_dev, skb_failed);
}
}
@@ -302,7 +302,7 @@ static void hif_usb_tx_cb(struct urb *urb)
hif_dev->tx.tx_buf_cnt++;
if (!(hif_dev->tx.flags & HIF_USB_TX_STOP))
__hif_usb_tx(hif_dev); /* Check for pending SKBs */
- TX_STAT_INC(buf_completed);
+ TX_STAT_INC(hif_dev, buf_completed);
spin_unlock(&hif_dev->tx.tx_lock);
}
@@ -353,7 +353,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
tx_buf->len += tx_buf->offset;
__skb_queue_tail(&tx_buf->skb_queue, nskb);
- TX_STAT_INC(skb_queued);
+ TX_STAT_INC(hif_dev, skb_queued);
}
usb_fill_bulk_urb(tx_buf->urb, hif_dev->udev,
@@ -369,7 +369,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
hif_dev->tx.tx_buf_cnt++;
} else {
- TX_STAT_INC(buf_queued);
+ TX_STAT_INC(hif_dev, buf_queued);
}
return ret;
@@ -514,7 +514,7 @@ static void hif_usb_sta_drain(void *hif_handle, u8 idx)
ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
skb, false);
hif_dev->tx.tx_skb_cnt--;
- TX_STAT_INC(skb_failed);
+ TX_STAT_INC(hif_dev, skb_failed);
}
}
@@ -585,14 +585,14 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
pkt_tag = get_unaligned_le16(ptr + index + 2);
if (pkt_tag != ATH_USB_RX_STREAM_MODE_TAG) {
- RX_STAT_INC(skb_dropped);
+ RX_STAT_INC(hif_dev, skb_dropped);
return;
}
if (pkt_len > 2 * MAX_RX_BUF_SIZE) {
dev_err(&hif_dev->udev->dev,
"ath9k_htc: invalid pkt_len (%x)\n", pkt_len);
- RX_STAT_INC(skb_dropped);
+ RX_STAT_INC(hif_dev, skb_dropped);
return;
}
@@ -618,7 +618,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
goto err;
}
skb_reserve(nskb, 32);
- RX_STAT_INC(skb_allocated);
+ RX_STAT_INC(hif_dev, skb_allocated);
memcpy(nskb->data, &(skb->data[chk_idx+4]),
hif_dev->rx_transfer_len);
@@ -639,7 +639,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
goto err;
}
skb_reserve(nskb, 32);
- RX_STAT_INC(skb_allocated);
+ RX_STAT_INC(hif_dev, skb_allocated);
memcpy(nskb->data, &(skb->data[chk_idx+4]), pkt_len);
skb_put(nskb, pkt_len);
@@ -649,10 +649,10 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
err:
for (i = 0; i < pool_index; i++) {
- RX_STAT_ADD(skb_completed_bytes, skb_pool[i]->len);
+ RX_STAT_ADD(hif_dev, skb_completed_bytes, skb_pool[i]->len);
ath9k_htc_rx_msg(hif_dev->htc_handle, skb_pool[i],
skb_pool[i]->len, USB_WLAN_RX_PIPE);
- RX_STAT_INC(skb_completed);
+ RX_STAT_INC(hif_dev, skb_completed);
}
}
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index e3d546ef71ddc..30f0765fb9fd8 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -327,14 +327,18 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)
}
#ifdef CONFIG_ATH9K_HTC_DEBUGFS
-#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0)
-#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
-#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a)
-#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++)
-#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a)
-#define CAB_STAT_INC priv->debug.tx_stats.cab_queued++
-
-#define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++)
+#define __STAT_SAFE(hif_dev, expr) ((hif_dev)->htc_handle->drv_priv ? (expr) : 0)
+#define CAB_STAT_INC(priv) ((priv)->debug.tx_stats.cab_queued++)
+#define TX_QSTAT_INC(priv, q) ((priv)->debug.tx_stats.queue_stats[q]++)
+
+#define TX_STAT_INC(hif_dev, c) \
+ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c++)
+#define TX_STAT_ADD(hif_dev, c, a) \
+ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c += a)
+#define RX_STAT_INC(hif_dev, c) \
+ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c++)
+#define RX_STAT_ADD(hif_dev, c, a) \
+ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c += a)
void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
struct ath_rx_status *rs);
@@ -374,13 +378,13 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
struct ethtool_stats *stats, u64 *data);
#else
-#define TX_STAT_INC(c) do { } while (0)
-#define TX_STAT_ADD(c, a) do { } while (0)
-#define RX_STAT_INC(c) do { } while (0)
-#define RX_STAT_ADD(c, a) do { } while (0)
-#define CAB_STAT_INC do { } while (0)
+#define TX_STAT_INC(hif_dev, c)
+#define TX_STAT_ADD(hif_dev, c, a)
+#define RX_STAT_INC(hif_dev, c)
+#define RX_STAT_ADD(hif_dev, c, a)
-#define TX_QSTAT_INC(c) do { } while (0)
+#define CAB_STAT_INC(priv)
+#define TX_QSTAT_INC(priv, c)
static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
struct ath_rx_status *rs)
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index a23eaca0326d1..672789e3c55d0 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -106,20 +106,20 @@ static inline enum htc_endpoint_id get_htc_epid(struct ath9k_htc_priv *priv,
switch (qnum) {
case 0:
- TX_QSTAT_INC(IEEE80211_AC_VO);
+ TX_QSTAT_INC(priv, IEEE80211_AC_VO);
epid = priv->data_vo_ep;
break;
case 1:
- TX_QSTAT_INC(IEEE80211_AC_VI);
+ TX_QSTAT_INC(priv, IEEE80211_AC_VI);
epid = priv->data_vi_ep;
break;
case 2:
- TX_QSTAT_INC(IEEE80211_AC_BE);
+ TX_QSTAT_INC(priv, IEEE80211_AC_BE);
epid = priv->data_be_ep;
break;
case 3:
default:
- TX_QSTAT_INC(IEEE80211_AC_BK);
+ TX_QSTAT_INC(priv, IEEE80211_AC_BK);
epid = priv->data_bk_ep;
break;
}
@@ -328,7 +328,7 @@ static void ath9k_htc_tx_data(struct ath9k_htc_priv *priv,
memcpy(tx_fhdr, (u8 *) &tx_hdr, sizeof(tx_hdr));
if (is_cab) {
- CAB_STAT_INC;
+ CAB_STAT_INC(priv);
tx_ctl->epid = priv->cab_ep;
return;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 104/567] wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 103/567] ath9k: htc: clean up statistics macros Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 105/567] wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() Greg Kroah-Hartman
` (466 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+e9632e3eb038d93d6bc6,
Fedor Pchelkin, Alexey Khoroshilov,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 0af54343a76263a12dbae7fafb64eb47c4a6ad38 ]
Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream().
While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated
skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we
have an incorrect pkt_len or pkt_tag, the input skb is considered invalid
and dropped. All the associated packets already in skb_pool should be
dropped and freed. Added a comment describing this issue.
The patch also makes remain_skb NULL after being processed so that it
cannot be referenced after potential free. The initialization of hif_dev
fields which are associated with remain_skb (rx_remain_len,
rx_transfer_len and rx_pad_len) is moved after a new remain_skb is
allocated.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 6ce708f54cc8 ("ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream")
Fixes: 44b23b488d44 ("ath9k: hif_usb: Reduce indent 1 column")
Reported-by: syzbot+e9632e3eb038d93d6bc6@syzkaller.appspotmail.com
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230104123615.51511-1-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/hif_usb.c | 31 +++++++++++++++++-------
1 file changed, 22 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 1a2e0c7eeb023..de6c0824c9cab 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -561,11 +561,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
memcpy(ptr, skb->data, rx_remain_len);
rx_pkt_len += rx_remain_len;
- hif_dev->rx_remain_len = 0;
skb_put(remain_skb, rx_pkt_len);
skb_pool[pool_index++] = remain_skb;
-
+ hif_dev->remain_skb = NULL;
+ hif_dev->rx_remain_len = 0;
} else {
index = rx_remain_len;
}
@@ -584,16 +584,21 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
pkt_len = get_unaligned_le16(ptr + index);
pkt_tag = get_unaligned_le16(ptr + index + 2);
+ /* It is supposed that if we have an invalid pkt_tag or
+ * pkt_len then the whole input SKB is considered invalid
+ * and dropped; the associated packets already in skb_pool
+ * are dropped, too.
+ */
if (pkt_tag != ATH_USB_RX_STREAM_MODE_TAG) {
RX_STAT_INC(hif_dev, skb_dropped);
- return;
+ goto invalid_pkt;
}
if (pkt_len > 2 * MAX_RX_BUF_SIZE) {
dev_err(&hif_dev->udev->dev,
"ath9k_htc: invalid pkt_len (%x)\n", pkt_len);
RX_STAT_INC(hif_dev, skb_dropped);
- return;
+ goto invalid_pkt;
}
pad_len = 4 - (pkt_len & 0x3);
@@ -605,11 +610,6 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
if (index > MAX_RX_BUF_SIZE) {
spin_lock(&hif_dev->rx_lock);
- hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE;
- hif_dev->rx_transfer_len =
- MAX_RX_BUF_SIZE - chk_idx - 4;
- hif_dev->rx_pad_len = pad_len;
-
nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC);
if (!nskb) {
dev_err(&hif_dev->udev->dev,
@@ -617,6 +617,12 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
spin_unlock(&hif_dev->rx_lock);
goto err;
}
+
+ hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE;
+ hif_dev->rx_transfer_len =
+ MAX_RX_BUF_SIZE - chk_idx - 4;
+ hif_dev->rx_pad_len = pad_len;
+
skb_reserve(nskb, 32);
RX_STAT_INC(hif_dev, skb_allocated);
@@ -654,6 +660,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
skb_pool[i]->len, USB_WLAN_RX_PIPE);
RX_STAT_INC(hif_dev, skb_completed);
}
+ return;
+invalid_pkt:
+ for (i = 0; i < pool_index; i++) {
+ dev_kfree_skb_any(skb_pool[i]);
+ RX_STAT_INC(hif_dev, skb_dropped);
+ }
+ return;
}
static void ath9k_hif_usb_rx_cb(struct urb *urb)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 105/567] wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 104/567] wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 106/567] wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup Greg Kroah-Hartman
` (465 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Minsuk Kang,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin
From: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
[ Upstream commit 8a2f35b9830692f7a616f2f627f943bc748af13a ]
Fix a stack-out-of-bounds write that occurs in a WMI response callback
function that is called after a timeout occurs in ath9k_wmi_cmd().
The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that
could no longer be valid when a timeout occurs. Set wmi->last_seq_id to
0 when a timeout occurred.
Found by a modified version of syzkaller.
BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx
Write of size 4
Call Trace:
memcpy
ath9k_wmi_ctrl_rx
ath9k_htc_rx_msg
ath9k_hif_usb_reg_in_cb
__usb_hcd_giveback_urb
usb_hcd_giveback_urb
dummy_timer
call_timer_fn
run_timer_softirq
__do_softirq
irq_exit_rcu
sysvec_apic_timer_interrupt
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230104124130.10996-1-linuxlovemin@yonsei.ac.kr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/wmi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index f315c54bd3ac0..19345b8f7bfd5 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -341,6 +341,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
if (!time_left) {
ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
wmi_cmd_to_name(cmd_id));
+ wmi->last_seq_id = 0;
mutex_unlock(&wmi->op_mutex);
return -ETIMEDOUT;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 106/567] wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 105/567] wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 107/567] wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data() Greg Kroah-Hartman
` (464 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Leon Romanovsky,
Kalle Valo, Sasha Levin
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit ed3f83b3459a67a3ab9d806490ac304b567b1c2d ]
crypto_alloc_shash() allocates resources, which should be released by
crypto_free_shash(). When ath11k_peer_find() fails, there has memory
leak. Add missing crypto_free_shash() to fix this.
Fixes: 243874c64c81 ("ath11k: handle RX fragments")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230102081142.3937570-1-linmq006@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/dp_rx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 0ae6bebff801d..3c64d33d0133b 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -3056,6 +3056,7 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id
if (!peer) {
ath11k_warn(ab, "failed to find the peer to set up fragment info\n");
spin_unlock_bh(&ab->base_lock);
+ crypto_free_shash(tfm);
return -ENOENT;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 107/567] wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 106/567] wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 108/567] ACPI: battery: Fix missing NUL-termination with large strings Greg Kroah-Hartman
` (463 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shivani Baranwal,
Veerendranath Jakkam, Johannes Berg, Sasha Levin
From: Shivani Baranwal <quic_shivbara@quicinc.com>
[ Upstream commit df4969ca135b9b3b2c38c07514aaa775112ac835 ]
The extended KCK key length check wrongly using the KEK key attribute
for validation. Due to this GTK rekey offload is failing when the KCK
key length is 24 bytes even though the driver advertising
WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK flag. Use correct attribute to fix the
same.
Fixes: 093a48d2aa4b ("cfg80211: support bigger kek/kck key length")
Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Link: https://lore.kernel.org/r/20221206143715.1802987-2-quic_vjakkam@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/nl80211.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index bb46a6a346146..1b91a9c208969 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -12922,7 +12922,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
return -ERANGE;
if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
- nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN))
+ nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN))
return -ERANGE;
rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 108/567] ACPI: battery: Fix missing NUL-termination with large strings
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 107/567] wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 109/567] crypto: ccp - Failure on re-initialization due to duplicate sysfs filename Greg Kroah-Hartman
` (462 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Armin Wolf, Rafael J. Wysocki, Sasha Levin
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc ]
When encountering a string bigger than the destination buffer (32 bytes),
the string is not properly NUL-terminated, causing buffer overreads later.
This for example happens on the Inspiron 3505, where the battery
model name is larger than 32 bytes, which leads to sysfs showing
the model name together with the serial number string (which is
NUL-terminated and thus prevents worse).
Fix this by using strscpy() which ensures that the result is
always NUL-terminated.
Fixes: 106449e870b3 ("ACPI: Battery: Allow extract string from integer")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 56db7b4da5140..c7569151fd02a 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -449,7 +449,7 @@ static int extract_package(struct acpi_battery *battery,
if (element->type == ACPI_TYPE_STRING ||
element->type == ACPI_TYPE_BUFFER)
- strncpy(ptr, element->string.pointer, 32);
+ strscpy(ptr, element->string.pointer, 32);
else if (element->type == ACPI_TYPE_INTEGER) {
strncpy(ptr, (u8 *)&element->integer.value,
sizeof(u64));
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 109/567] crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 108/567] ACPI: battery: Fix missing NUL-termination with large strings Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 110/567] crypto: essiv - Handle EBUSY correctly Greg Kroah-Hartman
` (461 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladis Dronov, Koba Ko,
Tom Lendacky, Herbert Xu, Sasha Levin
From: Koba Ko <koba.taiwan@gmail.com>
[ Upstream commit 299bf602b3f92f1456aef59c6413591fb02e762a ]
The following warning appears during the CCP module re-initialization:
[ 140.965403] sysfs: cannot create duplicate filename
'/devices/pci0000:00/0000:00:07.1/0000:03:00.2/dma/dma0chan0'
[ 140.975736] CPU: 0 PID: 388 Comm: kworker/0:2 Kdump: loaded Not
tainted 6.2.0-0.rc2.18.eln124.x86_64 #1
[ 140.985185] Hardware name: HPE ProLiant DL325 Gen10/ProLiant DL325
Gen10, BIOS A41 07/17/2020
[ 140.993761] Workqueue: events work_for_cpu_fn
[ 140.998151] Call Trace:
[ 141.000613] <TASK>
[ 141.002726] dump_stack_lvl+0x33/0x46
[ 141.006415] sysfs_warn_dup.cold+0x17/0x23
[ 141.010542] sysfs_create_dir_ns+0xba/0xd0
[ 141.014670] kobject_add_internal+0xba/0x260
[ 141.018970] kobject_add+0x81/0xb0
[ 141.022395] device_add+0xdc/0x7e0
[ 141.025822] ? complete_all+0x20/0x90
[ 141.029510] __dma_async_device_channel_register+0xc9/0x130
[ 141.035119] dma_async_device_register+0x19e/0x3b0
[ 141.039943] ccp_dmaengine_register+0x334/0x3f0 [ccp]
[ 141.045042] ccp5_init+0x662/0x6a0 [ccp]
[ 141.049000] ? devm_kmalloc+0x40/0xd0
[ 141.052688] ccp_dev_init+0xbb/0xf0 [ccp]
[ 141.056732] ? __pci_set_master+0x56/0xd0
[ 141.060768] sp_init+0x70/0x90 [ccp]
[ 141.064377] sp_pci_probe+0x186/0x1b0 [ccp]
[ 141.068596] local_pci_probe+0x41/0x80
[ 141.072374] work_for_cpu_fn+0x16/0x20
[ 141.076145] process_one_work+0x1c8/0x380
[ 141.080181] worker_thread+0x1ab/0x380
[ 141.083953] ? __pfx_worker_thread+0x10/0x10
[ 141.088250] kthread+0xda/0x100
[ 141.091413] ? __pfx_kthread+0x10/0x10
[ 141.095185] ret_from_fork+0x2c/0x50
[ 141.098788] </TASK>
[ 141.100996] kobject_add_internal failed for dma0chan0 with -EEXIST,
don't try to register things with the same name in the same directory.
[ 141.113703] ccp 0000:03:00.2: ccp initialization failed
The /dma/dma0chan0 sysfs file is not removed since dma_chan object
has been released in ccp_dma_release() before releasing dma device.
A correct procedure would be: release dma channels first => unregister
dma device => release ccp dma object.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216888
Fixes: 68dbe80f5b51 ("crypto: ccp - Release dma channels before dmaengine unrgister")
Tested-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Koba Ko <koba.ko@canonical.com>
Reviewed-by: Vladis Dronov <vdronov@redhat.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccp/ccp-dmaengine.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
index 9f753cb4f5f18..b386a7063818b 100644
--- a/drivers/crypto/ccp/ccp-dmaengine.c
+++ b/drivers/crypto/ccp/ccp-dmaengine.c
@@ -642,14 +642,26 @@ static void ccp_dma_release(struct ccp_device *ccp)
chan = ccp->ccp_dma_chan + i;
dma_chan = &chan->dma_chan;
- if (dma_chan->client_count)
- dma_release_channel(dma_chan);
-
tasklet_kill(&chan->cleanup_tasklet);
list_del_rcu(&dma_chan->device_node);
}
}
+static void ccp_dma_release_channels(struct ccp_device *ccp)
+{
+ struct ccp_dma_chan *chan;
+ struct dma_chan *dma_chan;
+ unsigned int i;
+
+ for (i = 0; i < ccp->cmd_q_count; i++) {
+ chan = ccp->ccp_dma_chan + i;
+ dma_chan = &chan->dma_chan;
+
+ if (dma_chan->client_count)
+ dma_release_channel(dma_chan);
+ }
+}
+
int ccp_dmaengine_register(struct ccp_device *ccp)
{
struct ccp_dma_chan *chan;
@@ -770,8 +782,9 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp)
if (!dmaengine)
return;
- ccp_dma_release(ccp);
+ ccp_dma_release_channels(ccp);
dma_async_device_unregister(dma_dev);
+ ccp_dma_release(ccp);
kmem_cache_destroy(ccp->dma_desc_cache);
kmem_cache_destroy(ccp->dma_cmd_cache);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 110/567] crypto: essiv - Handle EBUSY correctly
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 109/567] crypto: ccp - Failure on re-initialization due to duplicate sysfs filename Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 111/567] crypto: seqiv " Greg Kroah-Hartman
` (460 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herbert Xu, Ard Biesheuvel, Sasha Levin
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit b5a772adf45a32c68bef28e60621f12617161556 ]
As it is essiv only handles the special return value of EINPROGERSS,
which means that in all other cases it will free data related to the
request.
However, as the caller of essiv may specify MAY_BACKLOG, we also need
to expect EBUSY and treat it in the same way. Otherwise backlogged
requests will trigger a use-after-free.
Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/essiv.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/crypto/essiv.c b/crypto/essiv.c
index 8bcc5bdcb2a95..3505b071e6471 100644
--- a/crypto/essiv.c
+++ b/crypto/essiv.c
@@ -171,7 +171,12 @@ static void essiv_aead_done(struct crypto_async_request *areq, int err)
struct aead_request *req = areq->data;
struct essiv_aead_request_ctx *rctx = aead_request_ctx(req);
+ if (err == -EINPROGRESS)
+ goto out;
+
kfree(rctx->assoc);
+
+out:
aead_request_complete(req, err);
}
@@ -247,7 +252,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
err = enc ? crypto_aead_encrypt(subreq) :
crypto_aead_decrypt(subreq);
- if (rctx->assoc && err != -EINPROGRESS)
+ if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
kfree(rctx->assoc);
return err;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 111/567] crypto: seqiv - Handle EBUSY correctly
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 110/567] crypto: essiv - Handle EBUSY correctly Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 112/567] powercap: fix possible name leak in powercap_register_zone() Greg Kroah-Hartman
` (459 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Herbert Xu, Sasha Levin
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 32e62025e5e52fbe4812ef044759de7010b15dbc ]
As it is seqiv only handles the special return value of EINPROGERSS,
which means that in all other cases it will free data related to the
request.
However, as the caller of seqiv may specify MAY_BACKLOG, we also need
to expect EBUSY and treat it in the same way. Otherwise backlogged
requests will trigger a use-after-free.
Fixes: 0a270321dbf9 ("[CRYPTO] seqiv: Add Sequence Number IV Generator")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/seqiv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/seqiv.c b/crypto/seqiv.c
index 0899d527c2845..b1bcfe537daf1 100644
--- a/crypto/seqiv.c
+++ b/crypto/seqiv.c
@@ -23,7 +23,7 @@ static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err)
struct aead_request *subreq = aead_request_ctx(req);
struct crypto_aead *geniv;
- if (err == -EINPROGRESS)
+ if (err == -EINPROGRESS || err == -EBUSY)
return;
if (err)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 112/567] powercap: fix possible name leak in powercap_register_zone()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 111/567] crypto: seqiv " Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 113/567] x86: Mark stop_this_cpu() __noreturn Greg Kroah-Hartman
` (458 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Rafael J. Wysocki,
Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 1b6599f741a4525ca761ecde46e5885ff1e6ba58 ]
In the error path after calling dev_set_name(), the device
name is leaked. To fix this, calling dev_set_name() before
device_register(), and call put_device() if it returns error.
All the resources is released in powercap_release(), so it
can return from powercap_register_zone() directly.
Fixes: 75d2364ea0ca ("PowerCap: Add class driver")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/powercap/powercap_sys.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index f0654a932b372..ff736b006198f 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -529,9 +529,6 @@ struct powercap_zone *powercap_register_zone(
power_zone->name = kstrdup(name, GFP_KERNEL);
if (!power_zone->name)
goto err_name_alloc;
- dev_set_name(&power_zone->dev, "%s:%x",
- dev_name(power_zone->dev.parent),
- power_zone->id);
power_zone->constraints = kcalloc(nr_constraints,
sizeof(*power_zone->constraints),
GFP_KERNEL);
@@ -554,9 +551,16 @@ struct powercap_zone *powercap_register_zone(
power_zone->dev_attr_groups[0] = &power_zone->dev_zone_attr_group;
power_zone->dev_attr_groups[1] = NULL;
power_zone->dev.groups = power_zone->dev_attr_groups;
+ dev_set_name(&power_zone->dev, "%s:%x",
+ dev_name(power_zone->dev.parent),
+ power_zone->id);
result = device_register(&power_zone->dev);
- if (result)
- goto err_dev_ret;
+ if (result) {
+ put_device(&power_zone->dev);
+ mutex_unlock(&control_type->lock);
+
+ return ERR_PTR(result);
+ }
control_type->nr_zones++;
mutex_unlock(&control_type->lock);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 113/567] x86: Mark stop_this_cpu() __noreturn
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 112/567] powercap: fix possible name leak in powercap_register_zone() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 114/567] x86/microcode: Rip out the OLD_INTERFACE Greg Kroah-Hartman
` (457 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Josh Poimboeuf, Sasha Levin
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit f9cdf7ca57cada055f61ef6d0eb4db21c3f200db ]
vmlinux.o: warning: objtool: smp_stop_nmi_callback()+0x2b: unreachable instruction
0000 0000000000047cf0 <smp_stop_nmi_callback>:
...
0026 47d16: e8 00 00 00 00 call 47d1b <smp_stop_nmi_callback+0x2b> 47d17: R_X86_64_PLT32 stop_this_cpu-0x4
002b 47d1b: b8 01 00 00 00 mov $0x1,%eax
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lore.kernel.org/r/20220308154319.290905453@infradead.org
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/processor.h | 2 +-
arch/x86/kernel/process.c | 2 +-
tools/objtool/check.c | 1 +
3 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 577f342dbfb27..5c7904c97a1a7 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -834,7 +834,7 @@ bool xen_set_default_idle(void);
#define xen_set_default_idle 0
#endif
-void stop_this_cpu(void *dummy);
+void __noreturn stop_this_cpu(void *dummy);
void microcode_check(void);
enum l1tf_mitigations {
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index bc9b4b93cf9bc..e6b28c689e9a9 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -731,7 +731,7 @@ bool xen_set_default_idle(void)
}
#endif
-void stop_this_cpu(void *dummy)
+void __noreturn stop_this_cpu(void *dummy)
{
local_irq_disable();
/*
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 758c0ba8de350..3ef767284b3f0 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -181,6 +181,7 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
"kunit_try_catch_throw",
"xen_start_kernel",
"cpu_bringup_and_idle",
+ "stop_this_cpu",
};
if (!func)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 114/567] x86/microcode: Rip out the OLD_INTERFACE
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 113/567] x86: Mark stop_this_cpu() __noreturn Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 115/567] x86/microcode: Default-disable late loading Greg Kroah-Hartman
` (456 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Borislav Petkov, Thomas Gleixner,
Sasha Levin
From: Borislav Petkov <bp@suse.de>
[ Upstream commit 181b6f40e9ea80c76756d4d0cdeed396016c487e ]
Everything should be using the early initrd loading by now.
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20220525161232.14924-2-bp@alien8.de
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/Kconfig | 12 ----
arch/x86/kernel/cpu/microcode/core.c | 100 ---------------------------
2 files changed, 112 deletions(-)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 0f2234cd8453c..da87b3bfc9132 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1320,18 +1320,6 @@ config MICROCODE_AMD
If you select this option, microcode patch loading support for AMD
processors will be enabled.
-config MICROCODE_OLD_INTERFACE
- bool "Ancient loading interface (DEPRECATED)"
- default n
- depends on MICROCODE
- help
- DO NOT USE THIS! This is the ancient /dev/cpu/microcode interface
- which was used by userspace tools like iucode_tool and microcode.ctl.
- It is inadequate because it runs too late to be able to properly
- load microcode on a machine and it needs special tools. Instead, you
- should've switched to the early loading method with the initrd or
- builtin microcode by now: Documentation/x86/microcode.rst
-
config X86_MSR
tristate "/dev/cpu/*/msr - Model-specific register support"
help
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 150ebfb8c12ed..951677121c77d 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -390,98 +390,6 @@ static int apply_microcode_on_target(int cpu)
return ret;
}
-#ifdef CONFIG_MICROCODE_OLD_INTERFACE
-static int do_microcode_update(const void __user *buf, size_t size)
-{
- int error = 0;
- int cpu;
-
- for_each_online_cpu(cpu) {
- struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
- enum ucode_state ustate;
-
- if (!uci->valid)
- continue;
-
- ustate = microcode_ops->request_microcode_user(cpu, buf, size);
- if (ustate == UCODE_ERROR) {
- error = -1;
- break;
- } else if (ustate == UCODE_NEW) {
- apply_microcode_on_target(cpu);
- }
- }
-
- return error;
-}
-
-static int microcode_open(struct inode *inode, struct file *file)
-{
- return capable(CAP_SYS_RAWIO) ? stream_open(inode, file) : -EPERM;
-}
-
-static ssize_t microcode_write(struct file *file, const char __user *buf,
- size_t len, loff_t *ppos)
-{
- ssize_t ret = -EINVAL;
- unsigned long nr_pages = totalram_pages();
-
- if ((len >> PAGE_SHIFT) > nr_pages) {
- pr_err("too much data (max %ld pages)\n", nr_pages);
- return ret;
- }
-
- cpus_read_lock();
- mutex_lock(µcode_mutex);
-
- if (do_microcode_update(buf, len) == 0)
- ret = (ssize_t)len;
-
- if (ret > 0)
- perf_check_microcode();
-
- mutex_unlock(µcode_mutex);
- cpus_read_unlock();
-
- return ret;
-}
-
-static const struct file_operations microcode_fops = {
- .owner = THIS_MODULE,
- .write = microcode_write,
- .open = microcode_open,
- .llseek = no_llseek,
-};
-
-static struct miscdevice microcode_dev = {
- .minor = MICROCODE_MINOR,
- .name = "microcode",
- .nodename = "cpu/microcode",
- .fops = µcode_fops,
-};
-
-static int __init microcode_dev_init(void)
-{
- int error;
-
- error = misc_register(µcode_dev);
- if (error) {
- pr_err("can't misc_register on minor=%d\n", MICROCODE_MINOR);
- return error;
- }
-
- return 0;
-}
-
-static void __exit microcode_dev_exit(void)
-{
- misc_deregister(µcode_dev);
-}
-#else
-#define microcode_dev_init() 0
-#define microcode_dev_exit() do { } while (0)
-#endif
-
/* fake device for request_firmware */
static struct platform_device *microcode_pdev;
@@ -873,10 +781,6 @@ static int __init microcode_init(void)
goto out_driver;
}
- error = microcode_dev_init();
- if (error)
- goto out_ucode_group;
-
register_syscore_ops(&mc_syscore_ops);
cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:starting",
mc_cpu_starting, NULL);
@@ -887,10 +791,6 @@ static int __init microcode_init(void)
return 0;
- out_ucode_group:
- sysfs_remove_group(&cpu_subsys.dev_root->kobj,
- &cpu_root_microcode_group);
-
out_driver:
cpus_read_lock();
mutex_lock(µcode_mutex);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 115/567] x86/microcode: Default-disable late loading
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 114/567] x86/microcode: Rip out the OLD_INTERFACE Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 116/567] x86/microcode: Print previous version of microcode after reload Greg Kroah-Hartman
` (455 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Borislav Petkov, Thomas Gleixner, Sasha Levin
From: Borislav Petkov <bp@suse.de>
[ Upstream commit a77a94f86273ce42a39cb479217dd8d68acfe0ff ]
It is dangerous and it should not be used anyway - there's a nice early
loading already.
Requested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20220525161232.14924-3-bp@alien8.de
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/Kconfig | 11 +++++++++++
arch/x86/kernel/cpu/common.c | 2 ++
arch/x86/kernel/cpu/microcode/core.c | 7 ++++++-
3 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index da87b3bfc9132..a08ce6360382a 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1320,6 +1320,17 @@ config MICROCODE_AMD
If you select this option, microcode patch loading support for AMD
processors will be enabled.
+config MICROCODE_LATE_LOADING
+ bool "Late microcode loading (DANGEROUS)"
+ default n
+ depends on MICROCODE
+ help
+ Loading microcode late, when the system is up and executing instructions
+ is a tricky business and should be avoided if possible. Just the sequence
+ of synchronizing all cores and SMT threads is one fragile dance which does
+ not guarantee that cores might not softlock after the loading. Therefore,
+ use this at your own risk. Late loading taints the kernel too.
+
config X86_MSR
tristate "/dev/cpu/*/msr - Model-specific register support"
help
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 1698470dbea5f..6b71f40cd52d6 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -2149,6 +2149,7 @@ void cpu_init_secondary(void)
}
#endif
+#ifdef CONFIG_MICROCODE_LATE_LOADING
/*
* The microcode loader calls this upon late microcode load to recheck features,
* only when microcode has been updated. Caller holds microcode_mutex and CPU
@@ -2178,6 +2179,7 @@ void microcode_check(void)
pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n");
pr_warn("x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.\n");
}
+#endif
/*
* Invoked from core CPU hotplug code after hotplug operations
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 951677121c77d..dc346bbb06777 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -393,6 +393,7 @@ static int apply_microcode_on_target(int cpu)
/* fake device for request_firmware */
static struct platform_device *microcode_pdev;
+#ifdef CONFIG_MICROCODE_LATE_LOADING
/*
* Late loading dance. Why the heavy-handed stomp_machine effort?
*
@@ -560,6 +561,9 @@ static ssize_t reload_store(struct device *dev,
return ret;
}
+static DEVICE_ATTR_WO(reload);
+#endif
+
static ssize_t version_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
@@ -576,7 +580,6 @@ static ssize_t pf_show(struct device *dev,
return sprintf(buf, "0x%x\n", uci->cpu_sig.pf);
}
-static DEVICE_ATTR_WO(reload);
static DEVICE_ATTR(version, 0444, version_show, NULL);
static DEVICE_ATTR(processor_flags, 0444, pf_show, NULL);
@@ -729,7 +732,9 @@ static int mc_cpu_down_prep(unsigned int cpu)
}
static struct attribute *cpu_root_microcode_attrs[] = {
+#ifdef CONFIG_MICROCODE_LATE_LOADING
&dev_attr_reload.attr,
+#endif
NULL
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 116/567] x86/microcode: Print previous version of microcode after reload
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 115/567] x86/microcode: Default-disable late loading Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 117/567] x86/microcode: Add a parameter to microcode_check() to store CPU capabilities Greg Kroah-Hartman
` (454 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashok Raj, Borislav Petkov,
Tony Luck, Sasha Levin
From: Ashok Raj <ashok.raj@intel.com>
[ Upstream commit 7fce8d6eccbc31a561d07c79f359ad09f0424347 ]
Print both old and new versions of microcode after a reload is complete
because knowing the previous microcode version is sometimes important
from a debugging perspective.
[ bp: Massage commit message. ]
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Tony Luck <tony.luck@intel.com>
Link: https://lore.kernel.org/r/20220829181030.722891-1-ashok.raj@intel.com
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/microcode/core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index dc346bbb06777..a7fc2d47a4ace 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -508,7 +508,7 @@ static int __reload_late(void *info)
*/
static int microcode_reload_late(void)
{
- int ret;
+ int old = boot_cpu_data.microcode, ret;
atomic_set(&late_cpus_in, 0);
atomic_set(&late_cpus_out, 0);
@@ -517,7 +517,8 @@ static int microcode_reload_late(void)
if (ret == 0)
microcode_check();
- pr_info("Reload completed, microcode revision: 0x%x\n", boot_cpu_data.microcode);
+ pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n",
+ old, boot_cpu_data.microcode);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 117/567] x86/microcode: Add a parameter to microcode_check() to store CPU capabilities
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 116/567] x86/microcode: Print previous version of microcode after reload Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 118/567] x86/microcode: Check CPU capabilities after late microcode update correctly Greg Kroah-Hartman
` (453 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashok Raj, Borislav Petkov (AMD),
Sasha Levin
From: Ashok Raj <ashok.raj@intel.com>
[ Upstream commit ab31c74455c64e69342ddab21fd9426fcbfefde7 ]
Add a parameter to store CPU capabilities before performing a microcode
update so that CPU capabilities can be compared before and after update.
[ bp: Massage. ]
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230109153555.4986-2-ashok.raj@intel.com
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/processor.h | 2 +-
arch/x86/kernel/cpu/common.c | 21 +++++++++++++--------
arch/x86/kernel/cpu/microcode/core.c | 3 ++-
3 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 5c7904c97a1a7..eb6d6d1057929 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -835,7 +835,7 @@ bool xen_set_default_idle(void);
#endif
void __noreturn stop_this_cpu(void *dummy);
-void microcode_check(void);
+void microcode_check(struct cpuinfo_x86 *prev_info);
enum l1tf_mitigations {
L1TF_MITIGATION_OFF,
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 6b71f40cd52d6..f2cd244d31311 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -2150,30 +2150,35 @@ void cpu_init_secondary(void)
#endif
#ifdef CONFIG_MICROCODE_LATE_LOADING
-/*
+/**
+ * microcode_check() - Check if any CPU capabilities changed after an update.
+ * @prev_info: CPU capabilities stored before an update.
+ *
* The microcode loader calls this upon late microcode load to recheck features,
* only when microcode has been updated. Caller holds microcode_mutex and CPU
* hotplug lock.
+ *
+ * Return: None
*/
-void microcode_check(void)
+void microcode_check(struct cpuinfo_x86 *prev_info)
{
- struct cpuinfo_x86 info;
-
perf_check_microcode();
/* Reload CPUID max function as it might've changed. */
- info.cpuid_level = cpuid_eax(0);
+ prev_info->cpuid_level = cpuid_eax(0);
/*
* Copy all capability leafs to pick up the synthetic ones so that
* memcmp() below doesn't fail on that. The ones coming from CPUID will
* get overwritten in get_cpu_cap().
*/
- memcpy(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability));
+ memcpy(&prev_info->x86_capability, &boot_cpu_data.x86_capability,
+ sizeof(prev_info->x86_capability));
- get_cpu_cap(&info);
+ get_cpu_cap(prev_info);
- if (!memcmp(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability)))
+ if (!memcmp(&prev_info->x86_capability, &boot_cpu_data.x86_capability,
+ sizeof(prev_info->x86_capability)))
return;
pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n");
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index a7fc2d47a4ace..9592dbf628b43 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -509,13 +509,14 @@ static int __reload_late(void *info)
static int microcode_reload_late(void)
{
int old = boot_cpu_data.microcode, ret;
+ struct cpuinfo_x86 prev_info;
atomic_set(&late_cpus_in, 0);
atomic_set(&late_cpus_out, 0);
ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask);
if (ret == 0)
- microcode_check();
+ microcode_check(&prev_info);
pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n",
old, boot_cpu_data.microcode);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 118/567] x86/microcode: Check CPU capabilities after late microcode update correctly
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 117/567] x86/microcode: Add a parameter to microcode_check() to store CPU capabilities Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 119/567] x86/microcode: Adjust late loading result reporting message Greg Kroah-Hartman
` (452 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashok Raj, Borislav Petkov (AMD),
Sasha Levin
From: Ashok Raj <ashok.raj@intel.com>
[ Upstream commit c0dd9245aa9e25a697181f6085692272c9ec61bc ]
The kernel caches each CPU's feature bits at boot in an x86_capability[]
structure. However, the capabilities in the BSP's copy can be turned off
as a result of certain command line parameters or configuration
restrictions, for example the SGX bit. This can cause a mismatch when
comparing the values before and after the microcode update.
Another example is X86_FEATURE_SRBDS_CTRL which gets added only after
microcode update:
# --- cpuid.before 2023-01-21 14:54:15.652000747 +0100
# +++ cpuid.after 2023-01-21 14:54:26.632001024 +0100
# @@ -10,7 +10,7 @@ CPU:
# 0x00000004 0x04: eax=0x00000000 ebx=0x00000000 ecx=0x00000000 edx=0x00000000
# 0x00000005 0x00: eax=0x00000040 ebx=0x00000040 ecx=0x00000003 edx=0x11142120
# 0x00000006 0x00: eax=0x000027f7 ebx=0x00000002 ecx=0x00000001 edx=0x00000000
# - 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002400
# + 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002e00
^^^
and which proves for a gazillionth time that late loading is a bad bad
idea.
microcode_check() is called after an update to report any previously
cached CPUID bits which might have changed due to the update.
Therefore, store the cached CPU caps before the update and compare them
with the CPU caps after the microcode update has succeeded.
Thus, the comparison is done between the CPUID *hardware* bits before
and after the upgrade instead of using the cached, possibly runtime
modified values in BSP's boot_cpu_data copy.
As a result, false warnings about CPUID bits changes are avoided.
[ bp:
- Massage.
- Add SRBDS_CTRL example.
- Add kernel-doc.
- Incorporate forgotten review feedback from dhansen.
]
Fixes: 1008c52c09dc ("x86/CPU: Add a microcode loader callback")
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230109153555.4986-3-ashok.raj@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/processor.h | 1 +
arch/x86/kernel/cpu/common.c | 36 ++++++++++++++++++----------
arch/x86/kernel/cpu/microcode/core.c | 6 +++++
3 files changed, 30 insertions(+), 13 deletions(-)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index eb6d6d1057929..3e3bd5b7d5dbe 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -836,6 +836,7 @@ bool xen_set_default_idle(void);
void __noreturn stop_this_cpu(void *dummy);
void microcode_check(struct cpuinfo_x86 *prev_info);
+void store_cpu_caps(struct cpuinfo_x86 *info);
enum l1tf_mitigations {
L1TF_MITIGATION_OFF,
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index f2cd244d31311..f7b4bbe71cdf9 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -2150,6 +2150,25 @@ void cpu_init_secondary(void)
#endif
#ifdef CONFIG_MICROCODE_LATE_LOADING
+/**
+ * store_cpu_caps() - Store a snapshot of CPU capabilities
+ * @curr_info: Pointer where to store it
+ *
+ * Returns: None
+ */
+void store_cpu_caps(struct cpuinfo_x86 *curr_info)
+{
+ /* Reload CPUID max function as it might've changed. */
+ curr_info->cpuid_level = cpuid_eax(0);
+
+ /* Copy all capability leafs and pick up the synthetic ones. */
+ memcpy(&curr_info->x86_capability, &boot_cpu_data.x86_capability,
+ sizeof(curr_info->x86_capability));
+
+ /* Get the hardware CPUID leafs */
+ get_cpu_cap(curr_info);
+}
+
/**
* microcode_check() - Check if any CPU capabilities changed after an update.
* @prev_info: CPU capabilities stored before an update.
@@ -2162,22 +2181,13 @@ void cpu_init_secondary(void)
*/
void microcode_check(struct cpuinfo_x86 *prev_info)
{
- perf_check_microcode();
-
- /* Reload CPUID max function as it might've changed. */
- prev_info->cpuid_level = cpuid_eax(0);
+ struct cpuinfo_x86 curr_info;
- /*
- * Copy all capability leafs to pick up the synthetic ones so that
- * memcmp() below doesn't fail on that. The ones coming from CPUID will
- * get overwritten in get_cpu_cap().
- */
- memcpy(&prev_info->x86_capability, &boot_cpu_data.x86_capability,
- sizeof(prev_info->x86_capability));
+ perf_check_microcode();
- get_cpu_cap(prev_info);
+ store_cpu_caps(&curr_info);
- if (!memcmp(&prev_info->x86_capability, &boot_cpu_data.x86_capability,
+ if (!memcmp(&prev_info->x86_capability, &curr_info.x86_capability,
sizeof(prev_info->x86_capability)))
return;
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 9592dbf628b43..30d1bd36934dd 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -514,6 +514,12 @@ static int microcode_reload_late(void)
atomic_set(&late_cpus_in, 0);
atomic_set(&late_cpus_out, 0);
+ /*
+ * Take a snapshot before the microcode update in order to compare and
+ * check whether any bits changed after an update.
+ */
+ store_cpu_caps(&prev_info);
+
ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask);
if (ret == 0)
microcode_check(&prev_info);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 119/567] x86/microcode: Adjust late loading result reporting message
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 118/567] x86/microcode: Check CPU capabilities after late microcode update correctly Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 120/567] crypto: xts - Handle EBUSY correctly Greg Kroah-Hartman
` (451 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Ashok Raj,
Borislav Petkov (AMD),
Tony Luck, Sasha Levin
From: Ashok Raj <ashok.raj@intel.com>
[ Upstream commit 6eab3abac7043226e5375e9ead0c7607ced6767b ]
During late microcode loading, the "Reload completed" message is issued
unconditionally, regardless of success or failure.
Adjust the message to report the result of the update.
[ bp: Massage. ]
Fixes: 9bd681251b7c ("x86/microcode: Announce reload operation's completion")
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Link: https://lore.kernel.org/lkml/874judpqqd.ffs@tglx/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/microcode/core.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 30d1bd36934dd..7efdfc16144e5 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -521,11 +521,14 @@ static int microcode_reload_late(void)
store_cpu_caps(&prev_info);
ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask);
- if (ret == 0)
+ if (!ret) {
+ pr_info("Reload succeeded, microcode revision: 0x%x -> 0x%x\n",
+ old, boot_cpu_data.microcode);
microcode_check(&prev_info);
-
- pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n",
- old, boot_cpu_data.microcode);
+ } else {
+ pr_info("Reload failed, current microcode revision: 0x%x\n",
+ boot_cpu_data.microcode);
+ }
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 120/567] crypto: xts - Handle EBUSY correctly
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 119/567] x86/microcode: Adjust late loading result reporting message Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 121/567] leds: led-class: Add missing put_device() to led_put() Greg Kroah-Hartman
` (450 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herbert Xu, Ard Biesheuvel, Sasha Levin
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 51c082514c2dedf2711c99d93c196cc4eedceb40 ]
As it is xts only handles the special return value of EINPROGRESS,
which means that in all other cases it will free data related to the
request.
However, as the caller of xts may specify MAY_BACKLOG, we also need
to expect EBUSY and treat it in the same way. Otherwise backlogged
requests will trigger a use-after-free.
Fixes: 8083b1bf8163 ("crypto: xts - add support for ciphertext stealing")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/xts.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/crypto/xts.c b/crypto/xts.c
index 63c85b9e64e08..de6cbcf69bbd6 100644
--- a/crypto/xts.c
+++ b/crypto/xts.c
@@ -203,12 +203,12 @@ static void xts_encrypt_done(struct crypto_async_request *areq, int err)
if (!err) {
struct xts_request_ctx *rctx = skcipher_request_ctx(req);
- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+ rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
err = xts_xor_tweak_post(req, true);
if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) {
err = xts_cts_final(req, crypto_skcipher_encrypt);
- if (err == -EINPROGRESS)
+ if (err == -EINPROGRESS || err == -EBUSY)
return;
}
}
@@ -223,12 +223,12 @@ static void xts_decrypt_done(struct crypto_async_request *areq, int err)
if (!err) {
struct xts_request_ctx *rctx = skcipher_request_ctx(req);
- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+ rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
err = xts_xor_tweak_post(req, false);
if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) {
err = xts_cts_final(req, crypto_skcipher_decrypt);
- if (err == -EINPROGRESS)
+ if (err == -EINPROGRESS || err == -EBUSY)
return;
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 121/567] leds: led-class: Add missing put_device() to led_put()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 120/567] crypto: xts - Handle EBUSY correctly Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 122/567] crypto: ccp - Refactor out sev_fw_alloc() Greg Kroah-Hartman
` (449 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Linus Walleij,
Hans de Goede, Lee Jones, Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 445110941eb94709216363f9d807d2508e64abd7 ]
led_put() is used to "undo" a successful of_led_get() call,
of_led_get() uses class_find_device_by_of_node() which returns
a reference to the device which must be free-ed with put_device()
when the caller is done with it.
Add a put_device() call to led_put() to free the reference returned
by class_find_device_by_of_node().
And also add a put_device() in the error-exit case of try_module_get()
failing.
Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()")
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20230120114524.408368-2-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/led-class.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index f4bb02f6e0428..6e88df4c87fa8 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -241,8 +241,10 @@ struct led_classdev *of_led_get(struct device_node *np, int index)
led_cdev = dev_get_drvdata(led_dev);
- if (!try_module_get(led_cdev->dev->parent->driver->owner))
+ if (!try_module_get(led_cdev->dev->parent->driver->owner)) {
+ put_device(led_cdev->dev);
return ERR_PTR(-ENODEV);
+ }
return led_cdev;
}
@@ -255,6 +257,7 @@ EXPORT_SYMBOL_GPL(of_led_get);
void led_put(struct led_classdev *led_cdev)
{
module_put(led_cdev->dev->parent->driver->owner);
+ put_device(led_cdev->dev);
}
EXPORT_SYMBOL_GPL(led_put);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 122/567] crypto: ccp - Refactor out sev_fw_alloc()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 121/567] leds: led-class: Add missing put_device() to led_put() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 123/567] crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware Greg Kroah-Hartman
` (448 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Gonda, Marc Orr,
David Rientjes, Brijesh Singh, Tom Lendacky, Joerg Roedel,
Herbert Xu, John Allen, David S. Miller, Paolo Bonzini,
linux-crypto, linux-kernel, Sasha Levin
From: Peter Gonda <pgonda@google.com>
[ Upstream commit cc17982d58d1e67eab831e7023ede999dda56173 ]
Create a helper function sev_fw_alloc() which can be used to allocate
aligned memory regions for use by the PSP firmware. Currently only used
for the SEV-ES TMR region but will be used for the SEV_INIT_EX NV memory
region.
Signed-off-by: Peter Gonda <pgonda@google.com>
Reviewed-by: Marc Orr <marcorr@google.com>
Acked-by: David Rientjes <rientjes@google.com>
Acked-by: Brijesh Singh <brijesh.singh@amd.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Cc: Marc Orr <marcorr@google.com>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: David Rientjes <rientjes@google.com>
Cc: John Allen <john.allen@amd.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: linux-crypto@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: 46a334a98f58 ("crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccp/sev-dev.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 15ef60cd4b149..7c9149492970d 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -141,6 +141,17 @@ static int sev_cmd_buffer_len(int cmd)
return 0;
}
+static void *sev_fw_alloc(unsigned long len)
+{
+ struct page *page;
+
+ page = alloc_pages(GFP_KERNEL, get_order(len));
+ if (!page)
+ return NULL;
+
+ return page_address(page);
+}
+
static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret)
{
struct psp_device *psp = psp_master;
@@ -1087,7 +1098,6 @@ EXPORT_SYMBOL_GPL(sev_issue_cmd_external_user);
void sev_pci_init(void)
{
struct sev_device *sev = psp_master->sev_data;
- struct page *tmr_page;
int error, rc;
if (!sev)
@@ -1103,14 +1113,10 @@ void sev_pci_init(void)
sev_get_api_version();
/* Obtain the TMR memory area for SEV-ES use */
- tmr_page = alloc_pages(GFP_KERNEL, get_order(SEV_ES_TMR_SIZE));
- if (tmr_page) {
- sev_es_tmr = page_address(tmr_page);
- } else {
- sev_es_tmr = NULL;
+ sev_es_tmr = sev_fw_alloc(SEV_ES_TMR_SIZE);
+ if (!sev_es_tmr)
dev_warn(sev->dev,
"SEV: TMR allocation failed, SEV-ES support unavailable\n");
- }
/* Initialize the platform */
rc = sev_platform_init(&error);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 123/567] crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 122/567] crypto: ccp - Refactor out sev_fw_alloc() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 124/567] bpftool: profile online CPUs instead of possible Greg Kroah-Hartman
` (447 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tom Lendacky, Herbert Xu, Sasha Levin
From: Tom Lendacky <thomas.lendacky@amd.com>
[ Upstream commit 46a334a98f585ef78d51d8f5736596887bdd7f54 ]
Perform a cache flush on the SEV-ES TMR memory after allocation to prevent
any possibility of the firmware encountering an error should dirty cache
lines be present. Use clflush_cache_range() to flush the SEV-ES TMR memory.
Fixes: 97f9ac3db661 ("crypto: ccp - Add support for SEV-ES to the PSP driver")
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccp/sev-dev.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index 7c9149492970d..70174a9118b19 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -24,6 +24,7 @@
#include <linux/cpufeature.h>
#include <asm/smp.h>
+#include <asm/cacheflush.h>
#include "psp-dev.h"
#include "sev-dev.h"
@@ -1114,7 +1115,10 @@ void sev_pci_init(void)
/* Obtain the TMR memory area for SEV-ES use */
sev_es_tmr = sev_fw_alloc(SEV_ES_TMR_SIZE);
- if (!sev_es_tmr)
+ if (sev_es_tmr)
+ /* Must flush the cache before giving it to the firmware */
+ clflush_cache_range(sev_es_tmr, SEV_ES_TMR_SIZE);
+ else
dev_warn(sev->dev,
"SEV: TMR allocation failed, SEV-ES support unavailable\n");
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 124/567] bpftool: profile online CPUs instead of possible
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 123/567] crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 125/567] mt76: mt7915: fix polling firmware-own status Greg Kroah-Hartman
` (446 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tonghao Zhang, Quentin Monnet,
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Martin KaFai Lau, Song Liu, Yonghong Song, John Fastabend,
KP Singh, Stanislav Fomichev, Hao Luo, Jiri Olsa,
Martin KaFai Lau, Sasha Levin
From: Tonghao Zhang <tong@infragraf.org>
[ Upstream commit 377c16fa3f3c60d21e4b05314c8be034ce37f2eb ]
The number of online cpu may be not equal to possible cpu.
"bpftool prog profile" can not create pmu event on possible
but on online cpu.
$ dmidecode -s system-product-name
PowerEdge R620
$ cat /sys/devices/system/cpu/possible
0-47
$ cat /sys/devices/system/cpu/online
0-31
Disable cpu dynamically:
$ echo 0 > /sys/devices/system/cpu/cpuX/online
If one cpu is offline, perf_event_open will return ENODEV.
To fix this issue:
* check value returned and skip offline cpu.
* close pmu_fd immediately on error path, avoid fd leaking.
Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command")
Signed-off-by: Tonghao Zhang <tong@infragraf.org>
Cc: Quentin Monnet <quentin@isovalent.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Martin KaFai Lau <martin.lau@linux.dev>
Cc: Song Liu <song@kernel.org>
Cc: Yonghong Song <yhs@fb.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: KP Singh <kpsingh@kernel.org>
Cc: Stanislav Fomichev <sdf@google.com>
Cc: Hao Luo <haoluo@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20230202131701.29519-1-tong@infragraf.org
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/prog.c | 38 ++++++++++++++++++++++++++++++--------
1 file changed, 30 insertions(+), 8 deletions(-)
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index f8755beb3d9eb..bdd4d3b12f6c0 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -2064,10 +2064,38 @@ static void profile_close_perf_events(struct profiler_bpf *obj)
profile_perf_event_cnt = 0;
}
+static int profile_open_perf_event(int mid, int cpu, int map_fd)
+{
+ int pmu_fd;
+
+ pmu_fd = syscall(__NR_perf_event_open, &metrics[mid].attr,
+ -1 /*pid*/, cpu, -1 /*group_fd*/, 0);
+ if (pmu_fd < 0) {
+ if (errno == ENODEV) {
+ p_info("cpu %d may be offline, skip %s profiling.",
+ cpu, metrics[mid].name);
+ profile_perf_event_cnt++;
+ return 0;
+ }
+ return -1;
+ }
+
+ if (bpf_map_update_elem(map_fd,
+ &profile_perf_event_cnt,
+ &pmu_fd, BPF_ANY) ||
+ ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) {
+ close(pmu_fd);
+ return -1;
+ }
+
+ profile_perf_events[profile_perf_event_cnt++] = pmu_fd;
+ return 0;
+}
+
static int profile_open_perf_events(struct profiler_bpf *obj)
{
unsigned int cpu, m;
- int map_fd, pmu_fd;
+ int map_fd;
profile_perf_events = calloc(
sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric);
@@ -2086,17 +2114,11 @@ static int profile_open_perf_events(struct profiler_bpf *obj)
if (!metrics[m].selected)
continue;
for (cpu = 0; cpu < obj->rodata->num_cpu; cpu++) {
- pmu_fd = syscall(__NR_perf_event_open, &metrics[m].attr,
- -1/*pid*/, cpu, -1/*group_fd*/, 0);
- if (pmu_fd < 0 ||
- bpf_map_update_elem(map_fd, &profile_perf_event_cnt,
- &pmu_fd, BPF_ANY) ||
- ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) {
+ if (profile_open_perf_event(m, cpu, map_fd)) {
p_err("failed to create event %s on cpu %d",
metrics[m].name, cpu);
return -1;
}
- profile_perf_events[profile_perf_event_cnt++] = pmu_fd;
}
}
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 125/567] mt76: mt7915: fix polling firmware-own status
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 124/567] bpftool: profile online CPUs instead of possible Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 126/567] net/mlx5: Enhance debug print in page allocation failure Greg Kroah-Hartman
` (445 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Sasha Levin
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 71bb496ce17f6976c8a75b054861781965b07ac0 ]
Check the register status bit instead of the trigger bit
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7915/regs.h | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index e9d854e3293e4..1c900454cf58c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -2689,7 +2689,7 @@ static int mt7915_driver_own(struct mt7915_dev *dev)
{
mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_DRV_OWN);
if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND0,
- MT_TOP_LPCR_HOST_FW_OWN, 0, 500)) {
+ MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) {
dev_err(dev->mt76.dev, "Timeout for driver own\n");
return -EIO;
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h
index a213b5cb82f81..f4101cc9f9eb1 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h
@@ -426,6 +426,7 @@
#define MT_TOP_LPCR_HOST_BAND0 MT_TOP(0x10)
#define MT_TOP_LPCR_HOST_FW_OWN BIT(0)
#define MT_TOP_LPCR_HOST_DRV_OWN BIT(1)
+#define MT_TOP_LPCR_HOST_FW_OWN_STAT BIT(2)
#define MT_TOP_MISC MT_TOP(0xf0)
#define MT_TOP_MISC_FW_STATE GENMASK(2, 0)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 126/567] net/mlx5: Enhance debug print in page allocation failure
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 125/567] mt76: mt7915: fix polling firmware-own status Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 127/567] irqchip: Fix refcount leak in platform_irqchip_probe Greg Kroah-Hartman
` (444 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eran Ben Elisha, Majd Dibbiny,
Jack Morgenstein, Saeed Mahameed, Sasha Levin
From: Jack Morgenstein <jackm@nvidia.com>
[ Upstream commit 7eef93003e5d20e1a6a6e59e12d914b5431cbda2 ]
Provide more details to aid debugging.
Fixes: bf0bf77f6519 ("mlx5: Support communicating arbitrary host page size to firmware")
Signed-off-by: Eran Ben Elisha <eranbe@nvidia.com>
Signed-off-by: Majd Dibbiny <majd@nvidia.com>
Signed-off-by: Jack Morgenstein <jackm@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index 110c0837f95b9..ae6ac51b8ab03 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -216,7 +216,8 @@ static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr, u32 function)
n = find_first_bit(&fp->bitmask, 8 * sizeof(fp->bitmask));
if (n >= MLX5_NUM_4K_IN_PAGE) {
- mlx5_core_warn(dev, "alloc 4k bug\n");
+ mlx5_core_warn(dev, "alloc 4k bug: fw page = 0x%llx, n = %u, bitmask: %lu, max num of 4K pages: %d\n",
+ fp->addr, n, fp->bitmask, MLX5_NUM_4K_IN_PAGE);
return -ENOENT;
}
clear_bit(n, &fp->bitmask);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 127/567] irqchip: Fix refcount leak in platform_irqchip_probe
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 126/567] net/mlx5: Enhance debug print in page allocation failure Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 128/567] irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains Greg Kroah-Hartman
` (443 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Marc Zyngier, Sasha Levin
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit 6caa5a2b78f5f53c433d3a3781e53325da22f0ac ]
of_irq_find_parent() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
Fixes: f8410e626569 ("irqchip: Add IRQCHIP_PLATFORM_DRIVER_BEGIN/END and IRQCHIP_MATCH helper macros")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230102121318.3990586-1-linmq006@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irqchip.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/irqchip/irqchip.c b/drivers/irqchip/irqchip.c
index 3570f0a588c4b..7899607fbee8d 100644
--- a/drivers/irqchip/irqchip.c
+++ b/drivers/irqchip/irqchip.c
@@ -38,8 +38,10 @@ int platform_irqchip_probe(struct platform_device *pdev)
struct device_node *par_np = of_irq_find_parent(np);
of_irq_init_cb_t irq_init_cb = of_device_get_match_data(&pdev->dev);
- if (!irq_init_cb)
+ if (!irq_init_cb) {
+ of_node_put(par_np);
return -EINVAL;
+ }
if (par_np == np)
par_np = NULL;
@@ -52,8 +54,10 @@ int platform_irqchip_probe(struct platform_device *pdev)
* interrupt controller. The actual initialization callback of this
* interrupt controller can check for specific domains as necessary.
*/
- if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY))
+ if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) {
+ of_node_put(par_np);
return -EPROBE_DEFER;
+ }
return irq_init_cb(np, par_np);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 128/567] irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 127/567] irqchip: Fix refcount leak in platform_irqchip_probe Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 129/567] irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe Greg Kroah-Hartman
` (442 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Marc Zyngier, Sasha Levin
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit 071d068b89e95d1b078aa6bbcb9d0961b77d6aa1 ]
of_irq_find_parent() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230102082811.3947760-1-linmq006@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-alpine-msi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
index 5ddb8e578ac6a..fc1ef7de37973 100644
--- a/drivers/irqchip/irq-alpine-msi.c
+++ b/drivers/irqchip/irq-alpine-msi.c
@@ -199,6 +199,7 @@ static int alpine_msix_init_domains(struct alpine_msix_data *priv,
}
gic_domain = irq_find_host(gic_node);
+ of_node_put(gic_node);
if (!gic_domain) {
pr_err("Failed to find the GIC domain\n");
return -ENXIO;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 129/567] irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 128/567] irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 130/567] irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe Greg Kroah-Hartman
` (441 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Marc Zyngier, Sasha Levin
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit 9419e700021a393f67be36abd0c4f3acc6139041 ]
of_irq_find_parent() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
Fixes: a68a63cb4dfc ("irqchip/irq-mvebu-gicp: Add new driver for Marvell GICP")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230102084208.3951758-1-linmq006@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-mvebu-gicp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-mvebu-gicp.c b/drivers/irqchip/irq-mvebu-gicp.c
index fe88a782173dd..c43a345061d53 100644
--- a/drivers/irqchip/irq-mvebu-gicp.c
+++ b/drivers/irqchip/irq-mvebu-gicp.c
@@ -221,6 +221,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev)
}
parent_domain = irq_find_host(irq_parent_dn);
+ of_node_put(irq_parent_dn);
if (!parent_domain) {
dev_err(&pdev->dev, "failed to find parent IRQ domain\n");
return -ENODEV;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 130/567] irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 129/567] irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 131/567] s390/mem_detect: fix detect_memory() error handling Greg Kroah-Hartman
` (440 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Marc Zyngier, Sasha Levin
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit 02298b7bae12936ca313975b02e7f98b06670d37 ]
of_irq_find_parent() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
Fixes: cd844b0715ce ("irqchip/ti-sci-intr: Add support for Interrupt Router driver")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230102085611.3955984-1-linmq006@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-ti-sci-intr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-ti-sci-intr.c b/drivers/irqchip/irq-ti-sci-intr.c
index fe8fad22bcf96..020ddf29efb80 100644
--- a/drivers/irqchip/irq-ti-sci-intr.c
+++ b/drivers/irqchip/irq-ti-sci-intr.c
@@ -236,6 +236,7 @@ static int ti_sci_intr_irq_domain_probe(struct platform_device *pdev)
}
parent_domain = irq_find_host(parent_node);
+ of_node_put(parent_node);
if (!parent_domain) {
dev_err(dev, "Failed to find IRQ parent domain\n");
return -ENODEV;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 131/567] s390/mem_detect: fix detect_memory() error handling
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 130/567] irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 132/567] s390/vmem: fix empty page tables cleanup under KASAN Greg Kroah-Hartman
` (439 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Gordeev, Vasily Gorbik,
Heiko Carstens, Sasha Levin
From: Vasily Gorbik <gor@linux.ibm.com>
[ Upstream commit 3400c35a4090704e6c465449616ab7e67a9209e7 ]
Currently if for some reason sclp_early_read_info() fails,
sclp_early_get_memsize() will not set max_physmem_end and it
will stay uninitialized. Any garbage value other than 0 will lead
to detect_memory() taking wrong path or returning a garbage value
as max_physmem_end. To avoid that simply initialize max_physmem_end.
Fixes: 73045a08cf55 ("s390: unify identity mapping limits handling")
Reported-by: Alexander Gordeev <agordeev@linux.ibm.com>
Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/boot/mem_detect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c
index 2f949cd9076b8..17a32707d17e0 100644
--- a/arch/s390/boot/mem_detect.c
+++ b/arch/s390/boot/mem_detect.c
@@ -165,7 +165,7 @@ static void search_mem_end(void)
unsigned long detect_memory(void)
{
- unsigned long max_physmem_end;
+ unsigned long max_physmem_end = 0;
sclp_early_get_memsize(&max_physmem_end);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 132/567] s390/vmem: fix empty page tables cleanup under KASAN
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 131/567] s390/mem_detect: fix detect_memory() error handling Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 133/567] net: add sock_init_data_uid() Greg Kroah-Hartman
` (438 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Gordeev, Vasily Gorbik,
Heiko Carstens, Sasha Levin
From: Vasily Gorbik <gor@linux.ibm.com>
[ Upstream commit 108303b0a2d27cb14eed565e33e64ad9eefe5d7e ]
Commit b9ff81003cf1 ("s390/vmem: cleanup empty page tables") introduced
empty page tables cleanup in vmem code, but when the kernel is built
with KASAN enabled the code has no effect due to wrong KASAN shadow
memory intersection condition, which effectively ignores any memory
range below KASAN shadow. Fix intersection condition to make code
work as anticipated.
Fixes: b9ff81003cf1 ("s390/vmem: cleanup empty page tables")
Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/mm/vmem.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index 2b1c6d916cf9c..39912629b0619 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -297,7 +297,7 @@ static void try_free_pmd_table(pud_t *pud, unsigned long start)
if (end > VMALLOC_START)
return;
#ifdef CONFIG_KASAN
- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end)
+ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START)
return;
#endif
pmd = pmd_offset(pud, start);
@@ -372,7 +372,7 @@ static void try_free_pud_table(p4d_t *p4d, unsigned long start)
if (end > VMALLOC_START)
return;
#ifdef CONFIG_KASAN
- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end)
+ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START)
return;
#endif
@@ -426,7 +426,7 @@ static void try_free_p4d_table(pgd_t *pgd, unsigned long start)
if (end > VMALLOC_START)
return;
#ifdef CONFIG_KASAN
- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end)
+ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START)
return;
#endif
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 133/567] net: add sock_init_data_uid()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 132/567] s390/vmem: fix empty page tables cleanup under KASAN Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 134/567] tun: tun_chr_open(): correctly initialize socket uid Greg Kroah-Hartman
` (437 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello, Eric Dumazet,
David S. Miller, Sasha Levin
From: Pietro Borrello <borrello@diag.uniroma1.it>
[ Upstream commit 584f3742890e966d2f0a1f3c418c9ead70b2d99e ]
Add sock_init_data_uid() to explicitly initialize the socket uid.
To initialise the socket uid, sock_init_data() assumes a the struct
socket* sock is always embedded in a struct socket_alloc, used to
access the corresponding inode uid. This may not be true.
Examples are sockets created in tun_chr_open() and tap_open().
Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sock.h | 7 ++++++-
net/core/sock.c | 15 ++++++++++++---
2 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index cd6f2ae28ecf2..3a4e81399edc6 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1847,7 +1847,12 @@ void sk_common_release(struct sock *sk);
* Default socket callbacks and setup code
*/
-/* Initialise core socket variables */
+/* Initialise core socket variables using an explicit uid. */
+void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid);
+
+/* Initialise core socket variables.
+ * Assumes struct socket *sock is embedded in a struct socket_alloc.
+ */
void sock_init_data(struct socket *sock, struct sock *sk);
/*
diff --git a/net/core/sock.c b/net/core/sock.c
index b7ac53e72d1ad..ff7e8fc80731d 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3118,7 +3118,7 @@ void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer)
}
EXPORT_SYMBOL(sk_stop_timer_sync);
-void sock_init_data(struct socket *sock, struct sock *sk)
+void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid)
{
sk_init_common(sk);
sk->sk_send_head = NULL;
@@ -3137,11 +3137,10 @@ void sock_init_data(struct socket *sock, struct sock *sk)
sk->sk_type = sock->type;
RCU_INIT_POINTER(sk->sk_wq, &sock->wq);
sock->sk = sk;
- sk->sk_uid = SOCK_INODE(sock)->i_uid;
} else {
RCU_INIT_POINTER(sk->sk_wq, NULL);
- sk->sk_uid = make_kuid(sock_net(sk)->user_ns, 0);
}
+ sk->sk_uid = uid;
rwlock_init(&sk->sk_callback_lock);
if (sk->sk_kern_sock)
@@ -3199,6 +3198,16 @@ void sock_init_data(struct socket *sock, struct sock *sk)
refcount_set(&sk->sk_refcnt, 1);
atomic_set(&sk->sk_drops, 0);
}
+EXPORT_SYMBOL(sock_init_data_uid);
+
+void sock_init_data(struct socket *sock, struct sock *sk)
+{
+ kuid_t uid = sock ?
+ SOCK_INODE(sock)->i_uid :
+ make_kuid(sock_net(sk)->user_ns, 0);
+
+ sock_init_data_uid(sock, sk, uid);
+}
EXPORT_SYMBOL(sock_init_data);
void lock_sock_nested(struct sock *sk, int subclass)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 134/567] tun: tun_chr_open(): correctly initialize socket uid
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 133/567] net: add sock_init_data_uid() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 135/567] tap: tap_open(): " Greg Kroah-Hartman
` (436 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello, Eric Dumazet,
David S. Miller, Sasha Levin
From: Pietro Borrello <borrello@diag.uniroma1.it>
[ Upstream commit a096ccca6e503a5c575717ff8a36ace27510ab0a ]
sock_init_data() assumes that the `struct socket` passed in input is
contained in a `struct socket_alloc` allocated with sock_alloc().
However, tun_chr_open() passes a `struct socket` embedded in a `struct
tun_file` allocated with sk_alloc().
This causes a type confusion when issuing a container_of() with
SOCK_INODE() in sock_init_data() which results in assigning a wrong
sk_uid to the `struct sock` in input.
On default configuration, the type confused field overlaps with the
high 4 bytes of `struct tun_struct __rcu *tun` of `struct tun_file`,
NULL at the time of call, which makes the uid of all tun sockets 0,
i.e., the root one.
Fix the assignment by using sock_init_data_uid().
Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/tun.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a1dda57c812dd..30eea8270c9b2 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -3411,7 +3411,7 @@ static int tun_chr_open(struct inode *inode, struct file * file)
tfile->socket.file = file;
tfile->socket.ops = &tun_socket_ops;
- sock_init_data(&tfile->socket, &tfile->sk);
+ sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid);
tfile->sk.sk_write_space = tun_sock_write_space;
tfile->sk.sk_sndbuf = INT_MAX;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 135/567] tap: tap_open(): correctly initialize socket uid
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 134/567] tun: tun_chr_open(): correctly initialize socket uid Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 136/567] OPP: fix error checking in opp_migrate_dentry() Greg Kroah-Hartman
` (435 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello, Eric Dumazet,
David S. Miller, Sasha Levin
From: Pietro Borrello <borrello@diag.uniroma1.it>
[ Upstream commit 66b2c338adce580dfce2199591e65e2bab889cff ]
sock_init_data() assumes that the `struct socket` passed in input is
contained in a `struct socket_alloc` allocated with sock_alloc().
However, tap_open() passes a `struct socket` embedded in a `struct
tap_queue` allocated with sk_alloc().
This causes a type confusion when issuing a container_of() with
SOCK_INODE() in sock_init_data() which results in assigning a wrong
sk_uid to the `struct sock` in input.
On default configuration, the type confused field overlaps with
padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu
*tap` in `struct tap_queue`, which makes the uid of all tap sockets 0,
i.e., the root one.
Fix the assignment by using sock_init_data_uid().
Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/tap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index ba2ef5437e167..854ed2f21d32c 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -523,7 +523,7 @@ static int tap_open(struct inode *inode, struct file *file)
q->sock.state = SS_CONNECTED;
q->sock.file = file;
q->sock.ops = &tap_socket_ops;
- sock_init_data(&q->sock, &q->sk);
+ sock_init_data_uid(&q->sock, &q->sk, inode->i_uid);
q->sk.sk_write_space = tap_sock_write_space;
q->sk.sk_destruct = tap_sock_destruct;
q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 136/567] OPP: fix error checking in opp_migrate_dentry()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 135/567] tap: tap_open(): " Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 137/567] Bluetooth: L2CAP: Fix potential user-after-free Greg Kroah-Hartman
` (434 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qi Zheng, Viresh Kumar, Sasha Levin
From: Qi Zheng <zhengqi.arch@bytedance.com>
[ Upstream commit eca4c0eea53432ec4b711b2a8ad282cbad231b4f ]
Since commit ff9fb72bc077 ("debugfs: return error values,
not NULL") changed return value of debugfs_rename() in
error cases from %NULL to %ERR_PTR(-ERROR), we should
also check error values instead of NULL.
Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL")
Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/opp/debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/opp/debugfs.c b/drivers/opp/debugfs.c
index b5f2f9f393926..9eb71f47487b2 100644
--- a/drivers/opp/debugfs.c
+++ b/drivers/opp/debugfs.c
@@ -209,7 +209,7 @@ static void opp_migrate_dentry(struct opp_device *opp_dev,
dentry = debugfs_rename(rootdir, opp_dev->dentry, rootdir,
opp_table->dentry_name);
- if (!dentry) {
+ if (IS_ERR(dentry)) {
dev_err(dev, "%s: Failed to rename link from: %s to %s\n",
__func__, dev_name(opp_dev->dev), dev_name(dev));
return;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 137/567] Bluetooth: L2CAP: Fix potential user-after-free
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 136/567] OPP: fix error checking in opp_migrate_dentry() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 138/567] Bluetooth: hci_qca: get wakeup status from serdev device handle Greg Kroah-Hartman
` (433 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Coffin,
Luiz Augusto von Dentz, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit df5703348813235874d851934e957c3723d71644 ]
This fixes all instances of which requires to allocate a buffer calling
alloc_skb which may release the chan lock and reacquire later which
makes it possible that the chan is disconnected in the meantime.
Fixes: a6a5568c03c4 ("Bluetooth: Lock the L2CAP channel when sending")
Reported-by: Alexander Coffin <alex.coffin@matician.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 24 ------------------------
net/bluetooth/l2cap_sock.c | 8 ++++++++
2 files changed, 8 insertions(+), 24 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index e15fcf72a3428..a21e086d69d0e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2683,14 +2683,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
if (IS_ERR(skb))
return PTR_ERR(skb);
- /* Channel lock is released before requesting new skb and then
- * reacquired thus we need to recheck channel state.
- */
- if (chan->state != BT_CONNECTED) {
- kfree_skb(skb);
- return -ENOTCONN;
- }
-
l2cap_do_send(chan, skb);
return len;
}
@@ -2735,14 +2727,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
if (IS_ERR(skb))
return PTR_ERR(skb);
- /* Channel lock is released before requesting new skb and then
- * reacquired thus we need to recheck channel state.
- */
- if (chan->state != BT_CONNECTED) {
- kfree_skb(skb);
- return -ENOTCONN;
- }
-
l2cap_do_send(chan, skb);
err = len;
break;
@@ -2763,14 +2747,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
*/
err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
- /* The channel could have been closed while segmenting,
- * check that it is still connected.
- */
- if (chan->state != BT_CONNECTED) {
- __skb_queue_purge(&seg_queue);
- err = -ENOTCONN;
- }
-
if (err)
break;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index d2c6785205992..a267c9b6bcef4 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1623,6 +1623,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
if (!skb)
return ERR_PTR(err);
+ /* Channel lock is released before requesting new skb and then
+ * reacquired thus we need to recheck channel state.
+ */
+ if (chan->state != BT_CONNECTED) {
+ kfree_skb(skb);
+ return ERR_PTR(-ENOTCONN);
+ }
+
skb->priority = sk->sk_priority;
bt_cb(skb)->l2cap.chan = chan;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 138/567] Bluetooth: hci_qca: get wakeup status from serdev device handle
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 137/567] Bluetooth: L2CAP: Fix potential user-after-free Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 139/567] s390/ap: fix status returned by ap_aqic() Greg Kroah-Hartman
` (432 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengping Jiang,
Luiz Augusto von Dentz, Sasha Levin
From: Zhengping Jiang <jiangzp@google.com>
[ Upstream commit 03b0093f7b310493bc944a20f725228cfe0d3fea ]
Bluetooth controller attached via the UART is handled by the serdev driver.
Get the wakeup status from the device handle through serdev, instead of the
parent path.
Fixes: c1a74160eaf1 ("Bluetooth: hci_qca: Add device_may_wakeup support")
Signed-off-by: Zhengping Jiang <jiangzp@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_qca.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index e45777b3f5dac..8041155f30214 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1582,10 +1582,11 @@ static bool qca_prevent_wake(struct hci_dev *hdev)
struct hci_uart *hu = hci_get_drvdata(hdev);
bool wakeup;
- /* UART driver handles the interrupt from BT SoC.So we need to use
- * device handle of UART driver to get the status of device may wakeup.
+ /* BT SoC attached through the serial bus is handled by the serdev driver.
+ * So we need to use the device handle of the serdev driver to get the
+ * status of device may wakeup.
*/
- wakeup = device_may_wakeup(hu->serdev->ctrl->dev.parent);
+ wakeup = device_may_wakeup(&hu->serdev->ctrl->dev);
bt_dev_dbg(hu->hdev, "wakeup status : %d", wakeup);
return !wakeup;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 139/567] s390/ap: fix status returned by ap_aqic()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 138/567] Bluetooth: hci_qca: get wakeup status from serdev device handle Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 140/567] s390/ap: fix status returned by ap_qact() Greg Kroah-Hartman
` (431 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Halil Pasic, Janosch Frank,
Harald Freudenberger, Heiko Carstens, Sasha Levin
From: Halil Pasic <pasic@linux.ibm.com>
[ Upstream commit 394740d7645ea767795074287769dd26dbd4d782 ]
There function ap_aqic() tries to grab the status from the
wrong part of the register. Thus we always end up with
zeros. Which is wrong, among others, because we detect
failures via status.response_code.
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reported-by: Janosch Frank <frankja@linux.ibm.com>
Fixes: 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables")
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/include/asm/ap.h | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h
index 3afbee21dc1f1..8a8c0b157b551 100644
--- a/arch/s390/include/asm/ap.h
+++ b/arch/s390/include/asm/ap.h
@@ -236,7 +236,10 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid,
union {
unsigned long value;
struct ap_qirq_ctrl qirqctrl;
- struct ap_queue_status status;
+ struct {
+ u32 _pad;
+ struct ap_queue_status status;
+ };
} reg1;
void *reg2 = ind;
@@ -250,7 +253,7 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid,
" lgr %[reg1],1\n" /* gr1 (status) into reg1 */
: [reg1] "+&d" (reg1)
: [reg0] "d" (reg0), [reg2] "d" (reg2)
- : "cc", "0", "1", "2");
+ : "cc", "memory", "0", "1", "2");
return reg1.status;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 140/567] s390/ap: fix status returned by ap_qact()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 139/567] s390/ap: fix status returned by ap_aqic() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 141/567] libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() Greg Kroah-Hartman
` (430 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Halil Pasic, Harald Freudenberger,
Heiko Carstens, Sasha Levin
From: Halil Pasic <pasic@linux.ibm.com>
[ Upstream commit a2522c80f074c35254974fec39fffe8b8d75befe ]
Since commit 159491f3b509 ("s390/ap: rework assembler functions to use
unions for in/out register variables") the function ap_qact() tries to
grab the status from the wrong part of the register. Thus we always end
up with zeros. Which is wrong, among others, because we detect failures
via status.response_code.
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reported-by: Harald Freudenberger <freude@linux.ibm.com>
Fixes: 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables")
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/include/asm/ap.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h
index 8a8c0b157b551..859e6d87b108b 100644
--- a/arch/s390/include/asm/ap.h
+++ b/arch/s390/include/asm/ap.h
@@ -290,7 +290,10 @@ static inline struct ap_queue_status ap_qact(ap_qid_t qid, int ifbit,
unsigned long reg0 = qid | (5UL << 24) | ((ifbit & 0x01) << 22);
union {
unsigned long value;
- struct ap_queue_status status;
+ struct {
+ u32 _pad;
+ struct ap_queue_status status;
+ };
} reg1;
unsigned long reg2;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 141/567] libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 140/567] s390/ap: fix status returned by ap_qact() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 142/567] rds: rds_rm_zerocopy_callback() correct order for list_add_tail() Greg Kroah-Hartman
` (429 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Leoshkevich, Andrii Nakryiko,
Sasha Levin
From: Ilya Leoshkevich <iii@linux.ibm.com>
[ Upstream commit 17bcd27a08a21397698edf143084d7c87ce17946 ]
The code assumes that everything that comes after nlmsgerr are nlattrs.
When calculating their size, it does not account for the initial
nlmsghdr. This may lead to accessing uninitialized memory.
Fixes: bbf48c18ee0c ("libbpf: add error reporting in XDP")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20230210001210.395194-8-iii@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/nlattr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c
index f57e77a6e40fd..2dbe7b99f28f1 100644
--- a/tools/lib/bpf/nlattr.c
+++ b/tools/lib/bpf/nlattr.c
@@ -178,7 +178,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh)
hlen += nlmsg_len(&err->msg);
attr = (struct nlattr *) ((void *) err + hlen);
- alen = nlh->nlmsg_len - hlen;
+ alen = (void *)nlh + nlh->nlmsg_len - (void *)attr;
if (libbpf_nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen,
extack_policy) != 0) {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 142/567] rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 141/567] libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:57 ` [PATCH 5.15 143/567] crypto: rsa-pkcs1pad - Use akcipher_request_complete Greg Kroah-Hartman
` (428 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Pietro Borrello,
David S. Miller, Sasha Levin
From: Pietro Borrello <borrello@diag.uniroma1.it>
[ Upstream commit 68762148d1b011d47bc2ceed7321739b5aea1e63 ]
rds_rm_zerocopy_callback() uses list_add_tail() with swapped
arguments. This links the list head with the new entry, losing
the references to the remaining part of the list.
Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification")
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/message.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/rds/message.c b/net/rds/message.c
index b363ef13c75ef..8fa3d19c2e667 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -118,7 +118,7 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs,
ck = &info->zcookies;
memset(ck, 0, sizeof(*ck));
WARN_ON(!rds_zcookie_add(info, cookie));
- list_add_tail(&q->zcookie_head, &info->rs_zcookie_next);
+ list_add_tail(&info->rs_zcookie_next, &q->zcookie_head);
spin_unlock_irqrestore(&q->lock, flags);
/* caller invokes rds_wake_sk_sleep() */
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 143/567] crypto: rsa-pkcs1pad - Use akcipher_request_complete
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 142/567] rds: rds_rm_zerocopy_callback() correct order for list_add_tail() Greg Kroah-Hartman
@ 2023-03-07 16:57 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 144/567] m68k: /proc/hardware should depend on PROC_FS Greg Kroah-Hartman
` (427 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Herbert Xu, Sasha Levin
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 ]
Use the akcipher_request_complete helper instead of calling the
completion function directly. In fact the previous code was buggy
in that EINPROGRESS was never passed back to the original caller.
Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/rsa-pkcs1pad.c | 34 +++++++++++++++-------------------
1 file changed, 15 insertions(+), 19 deletions(-)
diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
index 9d804831c8b3f..a4ebbb889274e 100644
--- a/crypto/rsa-pkcs1pad.c
+++ b/crypto/rsa-pkcs1pad.c
@@ -214,16 +214,14 @@ static void pkcs1pad_encrypt_sign_complete_cb(
struct crypto_async_request *child_async_req, int err)
{
struct akcipher_request *req = child_async_req->data;
- struct crypto_async_request async_req;
if (err == -EINPROGRESS)
- return;
+ goto out;
+
+ err = pkcs1pad_encrypt_sign_complete(req, err);
- async_req.data = req->base.data;
- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
- async_req.flags = child_async_req->flags;
- req->base.complete(&async_req,
- pkcs1pad_encrypt_sign_complete(req, err));
+out:
+ akcipher_request_complete(req, err);
}
static int pkcs1pad_encrypt(struct akcipher_request *req)
@@ -332,15 +330,14 @@ static void pkcs1pad_decrypt_complete_cb(
struct crypto_async_request *child_async_req, int err)
{
struct akcipher_request *req = child_async_req->data;
- struct crypto_async_request async_req;
if (err == -EINPROGRESS)
- return;
+ goto out;
+
+ err = pkcs1pad_decrypt_complete(req, err);
- async_req.data = req->base.data;
- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
- async_req.flags = child_async_req->flags;
- req->base.complete(&async_req, pkcs1pad_decrypt_complete(req, err));
+out:
+ akcipher_request_complete(req, err);
}
static int pkcs1pad_decrypt(struct akcipher_request *req)
@@ -512,15 +509,14 @@ static void pkcs1pad_verify_complete_cb(
struct crypto_async_request *child_async_req, int err)
{
struct akcipher_request *req = child_async_req->data;
- struct crypto_async_request async_req;
if (err == -EINPROGRESS)
- return;
+ goto out;
- async_req.data = req->base.data;
- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
- async_req.flags = child_async_req->flags;
- req->base.complete(&async_req, pkcs1pad_verify_complete(req, err));
+ err = pkcs1pad_verify_complete(req, err);
+
+out:
+ akcipher_request_complete(req, err);
}
/*
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 144/567] m68k: /proc/hardware should depend on PROC_FS
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2023-03-07 16:57 ` [PATCH 5.15 143/567] crypto: rsa-pkcs1pad - Use akcipher_request_complete Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 145/567] RISC-V: time: initialize hrtimer based broadcast clock event device Greg Kroah-Hartman
` (426 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Geert Uytterhoeven,
Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 1e5b5df65af99013b4d31607ddb3ca5731dbe44d ]
When CONFIG_PROC_FS is not set, there is a build error for an unused
function. Make PROC_HARDWARE depend on PROC_FS to prevent this error.
In file included from ../arch/m68k/kernel/setup.c:3:
../arch/m68k/kernel/setup_mm.c:477:12: error: 'hardware_proc_show' defined but not used [-Werror=unused-function]
477 | static int hardware_proc_show(struct seq_file *m, void *v)
| ^~~~~~~~~~~~~~~~~~
Fixes: 66d857b08b8c ("m68k: merge m68k and m68knommu arch directories") # v3.0
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20230209010825.24136-1-rdunlap@infradead.org
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/m68k/Kconfig.devices | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/m68k/Kconfig.devices b/arch/m68k/Kconfig.devices
index 6a87b4a5fcac2..e6e3efac18407 100644
--- a/arch/m68k/Kconfig.devices
+++ b/arch/m68k/Kconfig.devices
@@ -19,6 +19,7 @@ config HEARTBEAT
# We have a dedicated heartbeat LED. :-)
config PROC_HARDWARE
bool "/proc/hardware support"
+ depends on PROC_FS
help
Say Y here to support the /proc/hardware file, which gives you
access to information about the machine you're running on,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 145/567] RISC-V: time: initialize hrtimer based broadcast clock event device
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 144/567] m68k: /proc/hardware should depend on PROC_FS Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 146/567] wifi: iwl3945: Add missing check for create_singlethread_workqueue Greg Kroah-Hartman
` (425 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Holland, Conor Dooley,
Anup Patel, Palmer Dabbelt, Daniel Lezcano, Sasha Levin
From: Conor Dooley <conor.dooley@microchip.com>
[ Upstream commit 8b3b8fbb4896984b5564789a42240e4b3caddb61 ]
Similarly to commit 022eb8ae8b5e ("ARM: 8938/1: kernel: initialize
broadcast hrtimer based clock event device"), RISC-V needs to initiate
hrtimer based broadcast clock event device before C3STOP can be used.
Otherwise, the introduction of C3STOP for the RISC-V arch timer in
commit 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped
during CPU suspend") leaves us without any broadcast timer registered.
This prevents the kernel from entering oneshot mode, which breaks timer
behaviour, for example clock_nanosleep().
A test app that sleeps each cpu for 6, 5, 4, 3 ms respectively, HZ=250
& C3STOP enabled, the sleep times are rounded up to the next jiffy:
== CPU: 1 == == CPU: 2 == == CPU: 3 == == CPU: 4 ==
Mean: 7.974992 Mean: 7.976534 Mean: 7.962591 Mean: 3.952179
Std Dev: 0.154374 Std Dev: 0.156082 Std Dev: 0.171018 Std Dev: 0.076193
Hi: 9.472000 Hi: 10.495000 Hi: 8.864000 Hi: 4.736000
Lo: 6.087000 Lo: 6.380000 Lo: 4.872000 Lo: 3.403000
Samples: 521 Samples: 521 Samples: 521 Samples: 521
Link: https://lore.kernel.org/linux-riscv/YzYTNQRxLr7Q9JR0@spud/
Fixes: 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend")
Suggested-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Samuel Holland <samuel@sholland.org>
Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
Link: https://lore.kernel.org/r/20230103141102.772228-2-apatel@ventanamicro.com
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/time.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/riscv/kernel/time.c b/arch/riscv/kernel/time.c
index 8217b0f67c6cb..1cf21db4fcc77 100644
--- a/arch/riscv/kernel/time.c
+++ b/arch/riscv/kernel/time.c
@@ -5,6 +5,7 @@
*/
#include <linux/of_clk.h>
+#include <linux/clockchips.h>
#include <linux/clocksource.h>
#include <linux/delay.h>
#include <asm/sbi.h>
@@ -29,6 +30,8 @@ void __init time_init(void)
of_clk_init(NULL);
timer_probe();
+
+ tick_setup_hrtimer_broadcast();
}
void clocksource_arch_init(struct clocksource *cs)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 146/567] wifi: iwl3945: Add missing check for create_singlethread_workqueue
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 145/567] RISC-V: time: initialize hrtimer based broadcast clock event device Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 147/567] wifi: iwl4965: Add missing check for create_singlethread_workqueue() Greg Kroah-Hartman
` (424 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Stanislaw Gruszka,
Kalle Valo, Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb ]
Add the check for the return value of the create_singlethread_workqueue
in order to avoid NULL pointer dereference.
Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230208063032.42763-2-jiasheng@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
index 45abb25b65a9f..04c149ff745e9 100644
--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
@@ -3378,10 +3378,12 @@ static DEVICE_ATTR(dump_errors, 0200, NULL, il3945_dump_error_log);
*
*****************************************************************************/
-static void
+static int
il3945_setup_deferred_work(struct il_priv *il)
{
il->workqueue = create_singlethread_workqueue(DRV_NAME);
+ if (!il->workqueue)
+ return -ENOMEM;
init_waitqueue_head(&il->wait_command_queue);
@@ -3398,6 +3400,8 @@ il3945_setup_deferred_work(struct il_priv *il)
timer_setup(&il->watchdog, il_bg_watchdog, 0);
tasklet_setup(&il->irq_tasklet, il3945_irq_tasklet);
+
+ return 0;
}
static void
@@ -3717,7 +3721,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
}
il_set_rxon_channel(il, &il->bands[NL80211_BAND_2GHZ].channels[5]);
- il3945_setup_deferred_work(il);
+ err = il3945_setup_deferred_work(il);
+ if (err)
+ goto out_remove_sysfs;
+
il3945_setup_handlers(il);
il_power_initialize(il);
@@ -3729,7 +3736,7 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
err = il3945_setup_mac(il);
if (err)
- goto out_remove_sysfs;
+ goto out_destroy_workqueue;
il_dbgfs_register(il, DRV_NAME);
@@ -3738,9 +3745,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
return 0;
-out_remove_sysfs:
+out_destroy_workqueue:
destroy_workqueue(il->workqueue);
il->workqueue = NULL;
+out_remove_sysfs:
sysfs_remove_group(&pdev->dev.kobj, &il3945_attribute_group);
out_release_irq:
free_irq(il->pci_dev->irq, il);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 147/567] wifi: iwl4965: Add missing check for create_singlethread_workqueue()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 146/567] wifi: iwl3945: Add missing check for create_singlethread_workqueue Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 148/567] wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() Greg Kroah-Hartman
` (423 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Stanislaw Gruszka,
Kalle Valo, Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 ]
Add the check for the return value of the create_singlethread_workqueue()
in order to avoid NULL pointer dereference.
Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230209010748.45454-1-jiasheng@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
index 0223532fd56a0..ff04282e3db03 100644
--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
@@ -6211,10 +6211,12 @@ il4965_bg_txpower_work(struct work_struct *work)
mutex_unlock(&il->mutex);
}
-static void
+static int
il4965_setup_deferred_work(struct il_priv *il)
{
il->workqueue = create_singlethread_workqueue(DRV_NAME);
+ if (!il->workqueue)
+ return -ENOMEM;
init_waitqueue_head(&il->wait_command_queue);
@@ -6233,6 +6235,8 @@ il4965_setup_deferred_work(struct il_priv *il)
timer_setup(&il->watchdog, il_bg_watchdog, 0);
tasklet_setup(&il->irq_tasklet, il4965_irq_tasklet);
+
+ return 0;
}
static void
@@ -6617,7 +6621,10 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
goto out_disable_msi;
}
- il4965_setup_deferred_work(il);
+ err = il4965_setup_deferred_work(il);
+ if (err)
+ goto out_free_irq;
+
il4965_setup_handlers(il);
/*********************************************
@@ -6655,6 +6662,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
out_destroy_workqueue:
destroy_workqueue(il->workqueue);
il->workqueue = NULL;
+out_free_irq:
free_irq(il->pci_dev->irq, il);
out_disable_msi:
pci_disable_msi(il->pci_dev);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 148/567] wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 147/567] wifi: iwl4965: Add missing check for create_singlethread_workqueue() Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 149/567] selftests/bpf: Fix out-of-srctree build Greg Kroah-Hartman
` (422 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Kalle Valo, Sasha Levin
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 ]
This code re-uses "i" to be the iterator for both the inside and outside
loops. It means the outside loop will exit earlier than intended.
Fixes: d219b7eb3792 ("mwifiex: handle BT coex event to adjust Rx BA window size")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/Y+ERnaDaZD7RtLvX@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/11n.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
index cf08a4af84d6d..b99381ebb82a1 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n.c
@@ -890,7 +890,7 @@ mwifiex_send_delba_txbastream_tbl(struct mwifiex_private *priv, u8 tid)
*/
void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter)
{
- u8 i;
+ u8 i, j;
u32 tx_win_size;
struct mwifiex_private *priv;
@@ -921,8 +921,8 @@ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter)
if (tx_win_size != priv->add_ba_param.tx_win_size) {
if (!priv->media_connected)
continue;
- for (i = 0; i < MAX_NUM_TID; i++)
- mwifiex_send_delba_txbastream_tbl(priv, i);
+ for (j = 0; j < MAX_NUM_TID; j++)
+ mwifiex_send_delba_txbastream_tbl(priv, j);
}
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 149/567] selftests/bpf: Fix out-of-srctree build
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 148/567] wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 150/567] ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models Greg Kroah-Hartman
` (421 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilya Leoshkevich, Daniel Borkmann,
Sasha Levin
From: Ilya Leoshkevich <iii@linux.ibm.com>
[ Upstream commit 0b0757244754ea1d0721195c824770f5576e119e ]
Building BPF selftests out of srctree fails with:
make: *** No rule to make target '/linux-build//ima_setup.sh', needed by 'ima_setup.sh'. Stop.
The culprit is the rule that defines convenient shorthands like
"make test_progs", which builds $(OUTPUT)/test_progs. These shorthands
make sense only for binaries that are built though; scripts that live
in the source tree do not end up in $(OUTPUT).
Therefore drop $(TEST_PROGS) and $(TEST_PROGS_EXTENDED) from the rule.
The issue exists for a while, but it became a problem only after commit
d68ae4982cb7 ("selftests/bpf: Install all required files to run selftests"),
which added dependencies on these scripts.
Fixes: 03dcb78460c2 ("selftests/bpf: Add simple per-test targets to Makefile")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20230208231211.283606-1-iii@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/Makefile | 2 --
1 file changed, 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 638966ae8ad97..0d845a0c8599a 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -144,8 +144,6 @@ endif
# NOTE: Semicolon at the end is critical to override lib.mk's default static
# rule for binaries.
$(notdir $(TEST_GEN_PROGS) \
- $(TEST_PROGS) \
- $(TEST_PROGS_EXTENDED) \
$(TEST_GEN_PROGS_EXTENDED) \
$(TEST_CUSTOM_PROGS)): %: $(OUTPUT)/% ;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 150/567] ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 149/567] selftests/bpf: Fix out-of-srctree build Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 151/567] ACPI: resource: Do IRQ override on all TongFang GMxRGxx Greg Kroah-Hartman
` (420 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Niederer, Rafael J. Wysocki,
Sasha Levin
From: Adam Niederer <adam.niederer@gmail.com>
[ Upstream commit cb18703c179713056bd7e3bdfc2260ab4e8658f0 ]
Fix a regression introduced by commit 9946e39fe8d0 ("ACPI: resource: skip
IRQ override on AMD Zen platforms") on MAINGEAR Vector Pro 2 systems, which
causes the built-in keyboard to not work. This restores the functionality
by adding an IRQ override.
No other IRQs were being overridden before, so this should be all that is
needed for these systems. I have personally tested this on the 15" model
(MG-VCP2-15A3070T), and I have confirmation that the issue is present on
the 17" model (MG-VCP2-17A3070T).
Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms")
Signed-off-by: Adam Niederer <adam.niederer@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 33921949bd8fd..b153e434a796d 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -446,6 +446,24 @@ static const struct dmi_system_id schenker_gm_rg[] = {
{ }
};
+static const struct dmi_system_id maingear_laptop[] = {
+ {
+ .ident = "MAINGEAR Vector Pro 2 15",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-15A3070T"),
+ }
+ },
+ {
+ .ident = "MAINGEAR Vector Pro 2 17",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-17A3070T"),
+ },
+ },
+ { }
+};
+
struct irq_override_cmp {
const struct dmi_system_id *system;
unsigned char irq;
@@ -461,6 +479,7 @@ static const struct irq_override_cmp override_table[] = {
{ lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true },
{ lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true },
{ schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
+ { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
};
static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 151/567] ACPI: resource: Do IRQ override on all TongFang GMxRGxx
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 150/567] ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 152/567] crypto: crypto4xx - Call dma_unmap_page when done Greg Kroah-Hartman
` (419 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Werner Sembach, Rafael J. Wysocki,
Sasha Levin
From: Werner Sembach <wse@tuxedocomputers.com>
[ Upstream commit 17bb7046e7ce038a73ee97eaa804e0300c5199e2 ]
Apply commit 7592b79ba4a9 ("ACPI: resource: do IRQ override on XMG Core 15")
override for all vendors using this mainboard.
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index b153e434a796d..f6317bc417ab1 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -435,11 +435,10 @@ static const struct dmi_system_id lenovo_laptop[] = {
{ }
};
-static const struct dmi_system_id schenker_gm_rg[] = {
+static const struct dmi_system_id tongfang_gm_rg[] = {
{
- .ident = "XMG CORE 15 (M22)",
+ .ident = "TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD",
.matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"),
DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"),
},
},
@@ -478,7 +477,7 @@ static const struct irq_override_cmp override_table[] = {
{ asus_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false },
{ lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true },
{ lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true },
- { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
+ { tongfang_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
{ maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 152/567] crypto: crypto4xx - Call dma_unmap_page when done
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 151/567] ACPI: resource: Do IRQ override on all TongFang GMxRGxx Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 153/567] wifi: mac80211: make rate u32 in sta_set_rate_info_rx() Greg Kroah-Hartman
` (418 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herbert Xu, Christian Lamparter,
Sasha Levin
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit bcdda4301bdc4955d45f7e1ffefb6207967b067e ]
In crypto4xx_cipher_done, we should be unmapping the dst page, not
mapping it.
This was flagged by a sparse warning about the unused addr variable.
While we're at it, also fix a sparse warning regarding the unused
ctx variable in crypto4xx_ahash_done (by actually using it).
Fixes: 049359d65527 ("crypto: amcc - Add crypt4xx driver")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/amcc/crypto4xx_core.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
index 8278d98074e9a..e1556a3582a30 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -522,7 +522,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev,
{
struct skcipher_request *req;
struct scatterlist *dst;
- dma_addr_t addr;
req = skcipher_request_cast(pd_uinfo->async_req);
@@ -531,8 +530,8 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev,
req->cryptlen, req->dst);
} else {
dst = pd_uinfo->dest_va;
- addr = dma_map_page(dev->core_dev->device, sg_page(dst),
- dst->offset, dst->length, DMA_FROM_DEVICE);
+ dma_unmap_page(dev->core_dev->device, pd->dest, dst->length,
+ DMA_FROM_DEVICE);
}
if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) {
@@ -557,10 +556,9 @@ static void crypto4xx_ahash_done(struct crypto4xx_device *dev,
struct ahash_request *ahash_req;
ahash_req = ahash_request_cast(pd_uinfo->async_req);
- ctx = crypto_tfm_ctx(ahash_req->base.tfm);
+ ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(ahash_req));
- crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo,
- crypto_tfm_ctx(ahash_req->base.tfm));
+ crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, ctx);
crypto4xx_ret_sg_desc(dev, pd_uinfo);
if (pd_uinfo->state & PD_ENTRY_BUSY)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 153/567] wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 152/567] crypto: crypto4xx - Call dma_unmap_page when done Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 154/567] thermal/drivers/hisi: Drop second sensor hi3660 Greg Kroah-Hartman
` (417 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shayne Chen, Johannes Berg, Sasha Levin
From: Shayne Chen <shayne.chen@mediatek.com>
[ Upstream commit 59336e07b287d91dc4ec265e07724e8f7e3d0209 ]
The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to
u16 after being assigned to rate variable, which causes information loss
in STA_STATS_FIELD_TYPE and later bitfields.
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Link: https://lore.kernel.org/r/20230209110659.25447-1-shayne.chen@mediatek.com
Fixes: 41cbb0f5a295 ("mac80211: add support for HE")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/sta_info.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f1e263b2c2957..14db465289c53 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2190,7 +2190,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
{
- u16 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
+ u32 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
if (rate == STA_STATS_RATE_INVALID)
return -EINVAL;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 154/567] thermal/drivers/hisi: Drop second sensor hi3660
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 153/567] wifi: mac80211: make rate u32 in sta_set_rate_info_rx() Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 155/567] can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error Greg Kroah-Hartman
` (416 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yongqin Liu, Daniel Lezcano,
Rafael J. Wysocki, Sasha Levin
From: Yongqin Liu <yongqin.liu@linaro.org>
[ Upstream commit 15cc25829a97c3957e520e971868aacc84341317 ]
The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm
allocators") exposes a panic "BRK handler: Fatal exception" on the
hi3660_thermal_probe funciton.
This is because the function allocates memory for only one
sensors array entry, but tries to fill up a second one.
Fix this by removing the unneeded second access.
Fixes: 7d3a2a2bbadb ("thermal/drivers/hisi: Fix number of sensors on hi3660")
Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>
Link: https://lore.kernel.org/linux-mm/20221101223321.1326815-5-keescook@chromium.org/
Link: https://lore.kernel.org/r/20230210141507.71014-1-yongqin.liu@linaro.org
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/hisi_thermal.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c
index 9a21ac0ceb112..29ff1e66dd6e9 100644
--- a/drivers/thermal/hisi_thermal.c
+++ b/drivers/thermal/hisi_thermal.c
@@ -435,10 +435,6 @@ static int hi3660_thermal_probe(struct hisi_thermal_data *data)
data->sensor[0].irq_name = "tsensor_a73";
data->sensor[0].data = data;
- data->sensor[1].id = HI3660_LITTLE_SENSOR;
- data->sensor[1].irq_name = "tsensor_a53";
- data->sensor[1].data = data;
-
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 155/567] can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 154/567] thermal/drivers/hisi: Drop second sensor hi3660 Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 156/567] bpf: Fix global subprog context argument resolution logic Greg Kroah-Hartman
` (415 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Jungclaus, Marc Kleine-Budde,
Sasha Levin
From: Frank Jungclaus <frank.jungclaus@esd.eu>
[ Upstream commit 118469f88180438ef43dee93d71f77c00e7b425d ]
Move the supply for cf->data[3] (bit stream position of CAN error), in
case of a bus- or protocol-error, outside of the "switch (ecc &
SJA1000_ECC_MASK){}"-statement, because this bit stream position is
independent of the error type.
Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
Signed-off-by: Frank Jungclaus <frank.jungclaus@esd.eu>
Link: https://lore.kernel.org/all/20230216190450.3901254-2-frank.jungclaus@esd.eu
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/esd_usb2.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 9ed048cb07e6d..1abdf88597de0 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -278,7 +278,6 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
cf->data[2] |= CAN_ERR_PROT_STUFF;
break;
default:
- cf->data[3] = ecc & SJA1000_ECC_SEG;
break;
}
@@ -286,6 +285,9 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
if (!(ecc & SJA1000_ECC_DIR))
cf->data[2] |= CAN_ERR_PROT_TX;
+ /* Bit stream position in CAN frame as the error was detected */
+ cf->data[3] = ecc & SJA1000_ECC_SEG;
+
if (priv->can.state == CAN_STATE_ERROR_WARNING ||
priv->can.state == CAN_STATE_ERROR_PASSIVE) {
cf->data[1] = (txerr > rxerr) ?
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 156/567] bpf: Fix global subprog context argument resolution logic
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 155/567] can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 157/567] irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts Greg Kroah-Hartman
` (414 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Daniel Borkmann,
Stanislav Fomichev, Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit d384dce281ed1b504fae2e279507827638d56fa3 ]
KPROBE program's user-facing context type is defined as typedef
bpf_user_pt_regs_t. This leads to a problem when trying to passing
kprobe/uprobe/usdt context argument into global subprog, as kernel
always strip away mods and typedefs of user-supplied type, but takes
expected type from bpf_ctx_convert as is, which causes mismatch.
Current way to work around this is to define a fake struct with the same
name as expected typedef:
struct bpf_user_pt_regs_t {};
__noinline my_global_subprog(struct bpf_user_pt_regs_t *ctx) { ... }
This patch fixes the issue by resolving expected type, if it's not
a struct. It still leaves the above work-around working for backwards
compatibility.
Fixes: 91cc1a99740e ("bpf: Annotate context types")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/20230216045954.3002473-2-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/btf.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 0c2fa93bd8d27..1f9369b677fe2 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -4468,6 +4468,7 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf,
if (!ctx_struct)
/* should not happen */
return NULL;
+again:
ctx_tname = btf_name_by_offset(btf_vmlinux, ctx_struct->name_off);
if (!ctx_tname) {
/* should not happen */
@@ -4481,8 +4482,16 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf,
* int socket_filter_bpf_prog(struct __sk_buff *skb)
* { // no fields of skb are ever used }
*/
- if (strcmp(ctx_tname, tname))
- return NULL;
+ if (strcmp(ctx_tname, tname)) {
+ /* bpf_user_pt_regs_t is a typedef, so resolve it to
+ * underlying struct and check name again
+ */
+ if (!btf_type_is_modifier(ctx_struct))
+ return NULL;
+ while (btf_type_is_modifier(ctx_struct))
+ ctx_struct = btf_type_by_id(btf_vmlinux, ctx_struct->type);
+ goto again;
+ }
return ctx_type;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 157/567] irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 156/567] bpf: Fix global subprog context argument resolution logic Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 158/567] irqchip/irq-bcm7120-l2: " Greg Kroah-Hartman
` (413 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli,
Philippe Mathieu-Daudé,
Marc Zyngier, Sasha Levin
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit 94debe03e8afa1267f95a9001786a6aa506b9ff3 ]
When support for the level triggered interrupt controller flavor was
added with c0ca7262088e, we forgot to update the flags to be set to
contain IRQ_LEVEL. While the flow handler is correct, the output from
/proc/interrupts does not show such interrupts as being level triggered
when they are, correct that.
Fixes: c0ca7262088e ("irqchip/brcmstb-l2: Add support for the BCM7271 L2 controller")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20221216230934.2478345-2-f.fainelli@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-brcmstb-l2.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index 8e0911561f2d1..fddea72272464 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -161,6 +161,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
*init_params)
{
unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
+ unsigned int set = 0;
struct brcmstb_l2_intc_data *data;
struct irq_chip_type *ct;
int ret;
@@ -208,9 +209,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))
flags |= IRQ_GC_BE_IO;
+ if (init_params->handler == handle_level_irq)
+ set |= IRQ_LEVEL;
+
/* Allocate a single Generic IRQ chip for this node */
ret = irq_alloc_domain_generic_chips(data->domain, 32, 1,
- np->full_name, init_params->handler, clr, 0, flags);
+ np->full_name, init_params->handler, clr, set, flags);
if (ret) {
pr_err("failed to allocate generic irq chip\n");
goto out_free_domain;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 158/567] irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 157/567] irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 159/567] selftests/net: Interpret UDP_GRO cmsg data as an int value Greg Kroah-Hartman
` (412 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli,
Philippe Mathieu-Daudé,
Marc Zyngier, Sasha Levin
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit 13a157b38ca5b4f9eed81442b8821db293755961 ]
When support for the interrupt controller was added with a5042de2688d,
we forgot to update the flags to be set to contain IRQ_LEVEL. While the
flow handler is correct, the output from /proc/interrupts does not show
such interrupts as being level triggered when they are, correct that.
Fixes: a5042de2688d ("irqchip: bcm7120-l2: Add Broadcom BCM7120-style Level 2 interrupt controller")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20221216230934.2478345-3-f.fainelli@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-bcm7120-l2.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index f23d7651ea847..e91b38a6fc3df 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -271,7 +271,8 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn,
flags |= IRQ_GC_BE_IO;
ret = irq_alloc_domain_generic_chips(data->domain, IRQS_PER_WORD, 1,
- dn->full_name, handle_level_irq, clr, 0, flags);
+ dn->full_name, handle_level_irq, clr,
+ IRQ_LEVEL, flags);
if (ret) {
pr_err("failed to allocate generic irq chip\n");
goto out_free_domain;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 159/567] selftests/net: Interpret UDP_GRO cmsg data as an int value
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 158/567] irqchip/irq-bcm7120-l2: " Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 160/567] l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() Greg Kroah-Hartman
` (411 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Sitnicki,
David S. Miller, Sasha Levin
From: Jakub Sitnicki <jakub@cloudflare.com>
[ Upstream commit 436864095a95fcc611c20c44a111985fa9848730 ]
Data passed to user-space with a (SOL_UDP, UDP_GRO) cmsg carries an
int (see udp_cmsg_recv), not a u16 value, as strace confirms:
recvmsg(8, {msg_name=...,
msg_iov=[{iov_base="\0\0..."..., iov_len=96000}],
msg_iovlen=1,
msg_control=[{cmsg_len=20, <-- sizeof(cmsghdr) + 4
cmsg_level=SOL_UDP,
cmsg_type=0x68}], <-- UDP_GRO
msg_controllen=24,
msg_flags=0}, 0) = 11200
Interpreting the data as an u16 value won't work on big-endian platforms.
Since it is too late to back out of this API decision [1], fix the test.
[1]: https://lore.kernel.org/netdev/20230131174601.203127-1-jakub@cloudflare.com/
Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/udpgso_bench_rx.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c
index 4058c7451e70d..f35a924d4a303 100644
--- a/tools/testing/selftests/net/udpgso_bench_rx.c
+++ b/tools/testing/selftests/net/udpgso_bench_rx.c
@@ -214,11 +214,10 @@ static void do_verify_udp(const char *data, int len)
static int recv_msg(int fd, char *buf, int len, int *gso_size)
{
- char control[CMSG_SPACE(sizeof(uint16_t))] = {0};
+ char control[CMSG_SPACE(sizeof(int))] = {0};
struct msghdr msg = {0};
struct iovec iov = {0};
struct cmsghdr *cmsg;
- uint16_t *gsosizeptr;
int ret;
iov.iov_base = buf;
@@ -237,8 +236,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size)
cmsg = CMSG_NXTHDR(&msg, cmsg)) {
if (cmsg->cmsg_level == SOL_UDP
&& cmsg->cmsg_type == UDP_GRO) {
- gsosizeptr = (uint16_t *) CMSG_DATA(cmsg);
- *gso_size = *gsosizeptr;
+ *gso_size = *(int *)CMSG_DATA(cmsg);
break;
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 160/567] l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 159/567] selftests/net: Interpret UDP_GRO cmsg data as an int value Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 161/567] net: bcmgenet: fix MoCA LED control Greg Kroah-Hartman
` (410 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Wang, Shigeru Yoshida,
Guillaume Nault, David S. Miller, Sasha Levin
From: Shigeru Yoshida <syoshida@redhat.com>
[ Upstream commit 9ca5e7ecab064f1f47da07f7c1ddf40e4bc0e5ac ]
When a file descriptor of pppol2tp socket is passed as file descriptor
of UDP socket, a recursive deadlock occurs in l2tp_tunnel_register().
This situation is reproduced by the following program:
int main(void)
{
int sock;
struct sockaddr_pppol2tp addr;
sock = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
if (sock < 0) {
perror("socket");
return 1;
}
addr.sa_family = AF_PPPOX;
addr.sa_protocol = PX_PROTO_OL2TP;
addr.pppol2tp.pid = 0;
addr.pppol2tp.fd = sock;
addr.pppol2tp.addr.sin_family = PF_INET;
addr.pppol2tp.addr.sin_port = htons(0);
addr.pppol2tp.addr.sin_addr.s_addr = inet_addr("192.168.0.1");
addr.pppol2tp.s_tunnel = 1;
addr.pppol2tp.s_session = 0;
addr.pppol2tp.d_tunnel = 0;
addr.pppol2tp.d_session = 0;
if (connect(sock, (const struct sockaddr *)&addr, sizeof(addr)) < 0) {
perror("connect");
return 1;
}
return 0;
}
This program causes the following lockdep warning:
============================================
WARNING: possible recursive locking detected
6.2.0-rc5-00205-gc96618275234 #56 Not tainted
--------------------------------------------
repro/8607 is trying to acquire lock:
ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: l2tp_tunnel_register+0x2b7/0x11c0
but task is already holding lock:
ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_PPPOX);
lock(sk_lock-AF_PPPOX);
*** DEADLOCK ***
May be due to missing lock nesting notation
1 lock held by repro/8607:
#0: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30
stack backtrace:
CPU: 0 PID: 8607 Comm: repro Not tainted 6.2.0-rc5-00205-gc96618275234 #56
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x100/0x178
__lock_acquire.cold+0x119/0x3b9
? lockdep_hardirqs_on_prepare+0x410/0x410
lock_acquire+0x1e0/0x610
? l2tp_tunnel_register+0x2b7/0x11c0
? lock_downgrade+0x710/0x710
? __fget_files+0x283/0x3e0
lock_sock_nested+0x3a/0xf0
? l2tp_tunnel_register+0x2b7/0x11c0
l2tp_tunnel_register+0x2b7/0x11c0
? sprintf+0xc4/0x100
? l2tp_tunnel_del_work+0x6b0/0x6b0
? debug_object_deactivate+0x320/0x320
? lockdep_init_map_type+0x16d/0x7a0
? lockdep_init_map_type+0x16d/0x7a0
? l2tp_tunnel_create+0x2bf/0x4b0
? l2tp_tunnel_create+0x3c6/0x4b0
pppol2tp_connect+0x14e1/0x1a30
? pppol2tp_put_sk+0xd0/0xd0
? aa_sk_perm+0x2b7/0xa80
? aa_af_perm+0x260/0x260
? bpf_lsm_socket_connect+0x9/0x10
? pppol2tp_put_sk+0xd0/0xd0
__sys_connect_file+0x14f/0x190
__sys_connect+0x133/0x160
? __sys_connect_file+0x190/0x190
? lockdep_hardirqs_on+0x7d/0x100
? ktime_get_coarse_real_ts64+0x1b7/0x200
? ktime_get_coarse_real_ts64+0x147/0x200
? __audit_syscall_entry+0x396/0x500
__x64_sys_connect+0x72/0xb0
do_syscall_64+0x38/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
This patch fixes the issue by getting/creating the tunnel before
locking the pppol2tp socket.
Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()")
Cc: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/l2tp/l2tp_ppp.c | 125 ++++++++++++++++++++++++--------------------
1 file changed, 67 insertions(+), 58 deletions(-)
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index bf35710127dd0..9cef8e080f644 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -651,54 +651,22 @@ static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)
return mtu - PPPOL2TP_HEADER_OVERHEAD;
}
-/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
- */
-static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
- int sockaddr_len, int flags)
+static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net,
+ const struct l2tp_connect_info *info,
+ bool *new_tunnel)
{
- struct sock *sk = sock->sk;
- struct pppox_sock *po = pppox_sk(sk);
- struct l2tp_session *session = NULL;
- struct l2tp_connect_info info;
struct l2tp_tunnel *tunnel;
- struct pppol2tp_session *ps;
- struct l2tp_session_cfg cfg = { 0, };
- bool drop_refcnt = false;
- bool drop_tunnel = false;
- bool new_session = false;
- bool new_tunnel = false;
int error;
- error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info);
- if (error < 0)
- return error;
+ *new_tunnel = false;
- lock_sock(sk);
-
- /* Check for already bound sockets */
- error = -EBUSY;
- if (sk->sk_state & PPPOX_CONNECTED)
- goto end;
-
- /* We don't supporting rebinding anyway */
- error = -EALREADY;
- if (sk->sk_user_data)
- goto end; /* socket is already attached */
-
- /* Don't bind if tunnel_id is 0 */
- error = -EINVAL;
- if (!info.tunnel_id)
- goto end;
-
- tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id);
- if (tunnel)
- drop_tunnel = true;
+ tunnel = l2tp_tunnel_get(net, info->tunnel_id);
/* Special case: create tunnel context if session_id and
* peer_session_id is 0. Otherwise look up tunnel using supplied
* tunnel id.
*/
- if (!info.session_id && !info.peer_session_id) {
+ if (!info->session_id && !info->peer_session_id) {
if (!tunnel) {
struct l2tp_tunnel_cfg tcfg = {
.encap = L2TP_ENCAPTYPE_UDP,
@@ -707,40 +675,82 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
/* Prevent l2tp_tunnel_register() from trying to set up
* a kernel socket.
*/
- if (info.fd < 0) {
- error = -EBADF;
- goto end;
- }
+ if (info->fd < 0)
+ return ERR_PTR(-EBADF);
- error = l2tp_tunnel_create(info.fd,
- info.version,
- info.tunnel_id,
- info.peer_tunnel_id, &tcfg,
+ error = l2tp_tunnel_create(info->fd,
+ info->version,
+ info->tunnel_id,
+ info->peer_tunnel_id, &tcfg,
&tunnel);
if (error < 0)
- goto end;
+ return ERR_PTR(error);
l2tp_tunnel_inc_refcount(tunnel);
- error = l2tp_tunnel_register(tunnel, sock_net(sk),
- &tcfg);
+ error = l2tp_tunnel_register(tunnel, net, &tcfg);
if (error < 0) {
kfree(tunnel);
- goto end;
+ return ERR_PTR(error);
}
- drop_tunnel = true;
- new_tunnel = true;
+
+ *new_tunnel = true;
}
} else {
/* Error if we can't find the tunnel */
- error = -ENOENT;
if (!tunnel)
- goto end;
+ return ERR_PTR(-ENOENT);
/* Error if socket is not prepped */
- if (!tunnel->sock)
- goto end;
+ if (!tunnel->sock) {
+ l2tp_tunnel_dec_refcount(tunnel);
+ return ERR_PTR(-ENOENT);
+ }
}
+ return tunnel;
+}
+
+/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
+ */
+static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ int sockaddr_len, int flags)
+{
+ struct sock *sk = sock->sk;
+ struct pppox_sock *po = pppox_sk(sk);
+ struct l2tp_session *session = NULL;
+ struct l2tp_connect_info info;
+ struct l2tp_tunnel *tunnel;
+ struct pppol2tp_session *ps;
+ struct l2tp_session_cfg cfg = { 0, };
+ bool drop_refcnt = false;
+ bool new_session = false;
+ bool new_tunnel = false;
+ int error;
+
+ error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info);
+ if (error < 0)
+ return error;
+
+ /* Don't bind if tunnel_id is 0 */
+ if (!info.tunnel_id)
+ return -EINVAL;
+
+ tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel);
+ if (IS_ERR(tunnel))
+ return PTR_ERR(tunnel);
+
+ lock_sock(sk);
+
+ /* Check for already bound sockets */
+ error = -EBUSY;
+ if (sk->sk_state & PPPOX_CONNECTED)
+ goto end;
+
+ /* We don't supporting rebinding anyway */
+ error = -EALREADY;
+ if (sk->sk_user_data)
+ goto end; /* socket is already attached */
+
if (tunnel->peer_tunnel_id == 0)
tunnel->peer_tunnel_id = info.peer_tunnel_id;
@@ -841,8 +851,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
}
if (drop_refcnt)
l2tp_session_dec_refcount(session);
- if (drop_tunnel)
- l2tp_tunnel_dec_refcount(tunnel);
+ l2tp_tunnel_dec_refcount(tunnel);
release_sock(sk);
return error;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 161/567] net: bcmgenet: fix MoCA LED control
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 160/567] l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 162/567] selftest: fib_tests: Always cleanup before exit Greg Kroah-Hartman
` (409 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Doug Berger, Florian Fainelli,
David S. Miller, Sasha Levin
From: Doug Berger <opendmb@gmail.com>
[ Upstream commit a7515af9fb8f0890fe540b108def4a86b9e8330a ]
When the bcmgenet_mii_config() code was refactored it was missed
that the LED control for the MoCA interface got overwritten by
the port_ctrl value. Its previous programming is restored here.
Fixes: 4f8d81b77e66 ("net: bcmgenet: Refactor register access in bcmgenet_mii_config")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/genet/bcmmii.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index dbd2ede53f946..f61f832ea19ca 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -165,15 +165,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable)
static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
{
- u32 reg;
-
- if (!GENET_IS_V5(priv)) {
- /* Speed settings are set in bcmgenet_mii_setup() */
- reg = bcmgenet_sys_readl(priv, SYS_PORT_CTRL);
- reg |= LED_ACT_SOURCE_MAC;
- bcmgenet_sys_writel(priv, reg, SYS_PORT_CTRL);
- }
-
if (priv->hw_params->flags & GENET_HAS_MOCA_LINK_DET)
fixed_phy_set_link_update(priv->dev->phydev,
bcmgenet_fixed_phy_link_update);
@@ -206,6 +197,8 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
if (!phy_name) {
phy_name = "MoCA";
+ if (!GENET_IS_V5(priv))
+ port_ctrl |= LED_ACT_SOURCE_MAC;
bcmgenet_moca_phy_setup(priv);
}
break;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 162/567] selftest: fib_tests: Always cleanup before exit
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 161/567] net: bcmgenet: fix MoCA LED control Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 163/567] sefltests: netdevsim: wait for devlink instance after netns removal Greg Kroah-Hartman
` (408 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roxana Nicolescu, Paolo Abeni, Sasha Levin
From: Roxana Nicolescu <roxana.nicolescu@canonical.com>
[ Upstream commit b60417a9f2b890a8094477b2204d4f73c535725e ]
Usage of `set -e` before executing a command causes immediate exit
on failure, without cleanup up the resources allocated at setup.
This can affect the next tests that use the same resources,
leading to a chain of failures.
A simple fix is to always call cleanup function when the script exists.
This approach is already used by other existing tests.
Fixes: 1056691b2680 ("selftests: fib_tests: Make test results more verbose")
Signed-off-by: Roxana Nicolescu <roxana.nicolescu@canonical.com>
Link: https://lore.kernel.org/r/20230220110400.26737-2-roxana.nicolescu@canonical.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/fib_tests.sh | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index 7df066bf74b87..c64b0b1217621 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -1921,6 +1921,8 @@ EOF
################################################################################
# main
+trap cleanup EXIT
+
while getopts :t:pPhv o
do
case $o in
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 163/567] sefltests: netdevsim: wait for devlink instance after netns removal
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 162/567] selftest: fib_tests: Always cleanup before exit Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 164/567] drm: Fix potential null-ptr-deref due to drmm_mode_config_init() Greg Kroah-Hartman
` (407 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amir Tzin, Jiri Pirko, Pavan Chebbi,
Paolo Abeni, Sasha Levin
From: Jiri Pirko <jiri@nvidia.com>
[ Upstream commit f922c7b1c1c45740d329bf248936fdb78c0cff6e ]
When devlink instance is put into network namespace and that network
namespace gets deleted, devlink instance is moved back into init_ns.
This is done as a part of cleanup_net() routine. Since cleanup_net()
is called asynchronously from workqueue, there is no guarantee that
the devlink instance move is done after "ip netns del" returns.
So fix this race by making sure that the devlink instance is present
before any other operation.
Reported-by: Amir Tzin <amirtz@nvidia.com>
Fixes: b74c37fd35a2 ("selftests: netdevsim: add tests for devlink reload with resources")
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://lore.kernel.org/r/20230220132336.198597-1-jiri@resnulli.us
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/drivers/net/netdevsim/devlink.sh | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh
index a08c02abde121..7f7d20f222070 100755
--- a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh
+++ b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh
@@ -17,6 +17,18 @@ SYSFS_NET_DIR=/sys/bus/netdevsim/devices/$DEV_NAME/net/
DEBUGFS_DIR=/sys/kernel/debug/netdevsim/$DEV_NAME/
DL_HANDLE=netdevsim/$DEV_NAME
+wait_for_devlink()
+{
+ "$@" | grep -q $DL_HANDLE
+}
+
+devlink_wait()
+{
+ local timeout=$1
+
+ busywait "$timeout" wait_for_devlink devlink dev
+}
+
fw_flash_test()
{
RET=0
@@ -256,6 +268,9 @@ netns_reload_test()
ip netns del testns2
ip netns del testns1
+ # Wait until netns async cleanup is done.
+ devlink_wait 2000
+
log_test "netns reload test"
}
@@ -348,6 +363,9 @@ resource_test()
ip netns del testns2
ip netns del testns1
+ # Wait until netns async cleanup is done.
+ devlink_wait 2000
+
log_test "resource test"
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 164/567] drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 163/567] sefltests: netdevsim: wait for devlink instance after netns removal Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 165/567] drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats Greg Kroah-Hartman
` (406 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shang XiaoJing, Thomas Zimmermann,
Sasha Levin
From: Shang XiaoJing <shangxiaojing@huawei.com>
[ Upstream commit 834c23e4f798dcdc8af251b3c428ceef94741991 ]
drmm_mode_config_init() will call drm_mode_create_standard_properties()
and won't check the ret value. When drm_mode_create_standard_properties()
failed due to alloc, property will be a NULL pointer and may causes the
null-ptr-deref. Fix the null-ptr-deref by adding the ret value check.
Found null-ptr-deref while testing insert module bochs:
general protection fault, probably for non-canonical address
0xdffffc000000000c: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm]
Call Trace:
<TASK>
__drm_connector_init+0xb6c/0x1100 [drm]
bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]
pci_device_probe+0x17d/0x340
really_probe+0x1db/0x5d0
__driver_probe_device+0x1e7/0x250
driver_probe_device+0x4a/0x120
__driver_attach+0xcd/0x2c0
bus_for_each_dev+0x11a/0x1b0
bus_add_driver+0x3d7/0x500
driver_register+0x18e/0x320
do_one_initcall+0xc4/0x3e0
do_init_module+0x1b4/0x630
load_module+0x5dca/0x7230
__do_sys_finit_module+0x100/0x170
do_syscall_64+0x3f/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7ff65af9f839
Fixes: 6b4959f43a04 ("drm/atomic: atomic plane properties")
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20221118021651.2460-1-shangxiaojing@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_mode_config.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c
index 37b4b9f0e468a..1bd4f0b2cc4d3 100644
--- a/drivers/gpu/drm/drm_mode_config.c
+++ b/drivers/gpu/drm/drm_mode_config.c
@@ -398,6 +398,8 @@ static void drm_mode_config_init_release(struct drm_device *dev, void *ptr)
*/
int drmm_mode_config_init(struct drm_device *dev)
{
+ int ret;
+
mutex_init(&dev->mode_config.mutex);
drm_modeset_lock_init(&dev->mode_config.connection_mutex);
mutex_init(&dev->mode_config.idr_mutex);
@@ -419,7 +421,11 @@ int drmm_mode_config_init(struct drm_device *dev)
init_llist_head(&dev->mode_config.connector_free_list);
INIT_WORK(&dev->mode_config.connector_free_work, drm_connector_free_work_fn);
- drm_mode_create_standard_properties(dev);
+ ret = drm_mode_create_standard_properties(dev);
+ if (ret) {
+ drm_mode_config_cleanup(dev);
+ return ret;
+ }
/* Just to be sure */
dev->mode_config.num_fb = 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 165/567] drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 164/567] drm: Fix potential null-ptr-deref due to drmm_mode_config_init() Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 166/567] drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec Greg Kroah-Hartman
` (405 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Daniel Vetter,
Sasha Levin
From: Geert Uytterhoeven <geert@linux-m68k.org>
[ Upstream commit 6fb6c979ca628583d4d0c59a0f8ff977e581ecc0 ]
As of commit eae06120f1974e1a ("drm: refuse ADDFB2 ioctl for broken
bigendian drivers"), drivers must set the
quirk_addfb_prefer_host_byte_order quirk to make the drm_mode_addfb()
compat code work correctly on big-endian machines.
While that works fine for big-endian XRGB8888 and ARGB8888, which are
mapped to the existing little-endian BGRX8888 and BGRA8888 formats, it
does not work for big-endian XRGB1555 and RGB565, as the latter are not
listed in the format database.
Fix this by adding the missing formats. Limit this to big-endian
platforms, as there is currently no need to support these formats on
little-endian platforms.
Fixes: 6960e6da9cec3f66 ("drm: fix drm_mode_addfb() on big endian machines.")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/3ee1f8144feb96c28742b22384189f1f83bcfc1a.1669221671.git.geert@linux-m68k.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_fourcc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/drm_fourcc.c b/drivers/gpu/drm/drm_fourcc.c
index 32ee023aed266..7940d948ffdcb 100644
--- a/drivers/gpu/drm/drm_fourcc.c
+++ b/drivers/gpu/drm/drm_fourcc.c
@@ -153,6 +153,10 @@ const struct drm_format_info *__drm_format_info(u32 format)
{ .format = DRM_FORMAT_BGRA5551, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1, .has_alpha = true },
{ .format = DRM_FORMAT_RGB565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 },
{ .format = DRM_FORMAT_BGR565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 },
+#ifdef __BIG_ENDIAN
+ { .format = DRM_FORMAT_XRGB1555 | DRM_FORMAT_BIG_ENDIAN, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 },
+ { .format = DRM_FORMAT_RGB565 | DRM_FORMAT_BIG_ENDIAN, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 },
+#endif
{ .format = DRM_FORMAT_RGB888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 },
{ .format = DRM_FORMAT_BGR888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 },
{ .format = DRM_FORMAT_XRGB8888, .depth = 24, .num_planes = 1, .cpp = { 4, 0, 0 }, .hsub = 1, .vsub = 1 },
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 166/567] drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 165/567] drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 167/567] drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC Greg Kroah-Hartman
` (404 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frieder Schrempf, Alexander Stein,
Robert Foss, Sasha Levin
From: Frieder Schrempf <frieder.schrempf@kontron.de>
[ Upstream commit 4b03d5e0d3e86ee492d54254927d020dc0fe8acf ]
The datasheet specifies a delay of 10 milliseconds, but the current
driver only waits for 1 ms. Fix this to make sure the initialization
sequence meets the spec.
Fixes: ceb515ba29ba ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver")
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20221122081219.20143-1-frieder@fris.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
index c901c0e1a3b04..b3cb910b30852 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
@@ -381,6 +381,8 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
u16 val;
int ret;
+ usleep_range(10000, 11000);
+
/* Get the LVDS format from the bridge state. */
bridge_state = drm_atomic_get_new_bridge_state(state, bridge);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 167/567] drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 166/567] drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 168/567] drm/bridge: megachips: Fix error handling in i2c_register_driver() Greg Kroah-Hartman
` (403 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Marek Vasut,
Sasha Levin
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 7783cc67862f9166c901bfa0f80b717aa8d354dd ]
Freescale/NXP i.MX LCDIF and eLCDIF LCD controllers are only present on
Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXS ||
ARCH_MXC, to prevent asking the user about this driver when configuring
a kernel without Freescale/NXP i.MX support.
Fixes: 45d59d704080cc0c ("drm: Add new driver for MXSFB controller")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Marek Vasut <marex@denx.de>
Signed-off-by: Marek Vasut <marex@denx.de>
Link: https://patchwork.freedesktop.org/patch/msgid/98e74779ca2bc575d91afff03369e86b080c01ac.1669046358.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mxsfb/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig
index ee22cd25d3e3d..e7201e16119a4 100644
--- a/drivers/gpu/drm/mxsfb/Kconfig
+++ b/drivers/gpu/drm/mxsfb/Kconfig
@@ -8,6 +8,7 @@ config DRM_MXSFB
tristate "i.MX (e)LCDIF LCD controller"
depends on DRM && OF
depends on COMMON_CLK
+ depends on ARCH_MXS || ARCH_MXC || COMPILE_TEST
select DRM_MXS
select DRM_KMS_HELPER
select DRM_KMS_CMA_HELPER
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 168/567] drm/bridge: megachips: Fix error handling in i2c_register_driver()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 167/567] drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 169/567] drm/vkms: Fix memory leak in vkms_init() Greg Kroah-Hartman
` (402 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Can, Andrzej Hajda, Ian Ray,
Robert Foss, Sasha Levin
From: Yuan Can <yuancan@huawei.com>
[ Upstream commit 4ecff954c370b82bce45bdca2846c5c5563e8a8a ]
A problem about insmod megachips-stdpxxxx-ge-b850v3-fw.ko failed is
triggered with the following log given:
[ 4497.981497] Error: Driver 'stdp4028-ge-b850v3-fw' is already registered, aborting...
insmod: ERROR: could not insert module megachips-stdpxxxx-ge-b850v3-fw.ko: Device or resource busy
The reason is that stdpxxxx_ge_b850v3_init() returns i2c_add_driver()
directly without checking its return value, if i2c_add_driver() failed,
it returns without calling i2c_del_driver() on the previous i2c driver,
resulting the megachips-stdpxxxx-ge-b850v3-fw can never be installed
later.
A simple call graph is shown as below:
stdpxxxx_ge_b850v3_init()
i2c_add_driver(&stdp4028_ge_b850v3_fw_driver)
i2c_add_driver(&stdp2690_ge_b850v3_fw_driver)
i2c_register_driver()
driver_register()
bus_add_driver()
priv = kzalloc(...) # OOM happened
# return without delete stdp4028_ge_b850v3_fw_driver
Fix by calling i2c_del_driver() on stdp4028_ge_b850v3_fw_driver when
i2c_add_driver() returns error.
Fixes: fcfa0ddc18ed ("drm/bridge: Drivers for megachips-stdpxxxx-ge-b850v3-fw (LVDS-DP++)")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
Tested-by: Ian Ray <ian.ray@ge.com>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20221108091226.114524-1-yuancan@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
index 72248a565579e..e41afcc5326b1 100644
--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
@@ -444,7 +444,11 @@ static int __init stdpxxxx_ge_b850v3_init(void)
if (ret)
return ret;
- return i2c_add_driver(&stdp2690_ge_b850v3_fw_driver);
+ ret = i2c_add_driver(&stdp2690_ge_b850v3_fw_driver);
+ if (ret)
+ i2c_del_driver(&stdp4028_ge_b850v3_fw_driver);
+
+ return ret;
}
module_init(stdpxxxx_ge_b850v3_init);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 169/567] drm/vkms: Fix memory leak in vkms_init()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 168/567] drm/bridge: megachips: Fix error handling in i2c_register_driver() Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 170/567] drm/vkms: Fix null-ptr-deref in vkms_release() Greg Kroah-Hartman
` (401 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Can, Melissa Wen, Melissa Wen,
Sasha Levin
From: Yuan Can <yuancan@huawei.com>
[ Upstream commit 0d0b368b9d104b437e1f4850ae94bdb9a3601e89 ]
A memory leak was reported after the vkms module install failed.
unreferenced object 0xffff88810bc28520 (size 16):
comm "modprobe", pid 9662, jiffies 4298009455 (age 42.590s)
hex dump (first 16 bytes):
01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff ...d............
backtrace:
[<00000000e7561ff8>] kmalloc_trace+0x27/0x60
[<000000000b1954a0>] 0xffffffffc45200a9
[<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0
[<000000001505ee87>] do_init_module+0x1a4/0x680
[<00000000958079ad>] load_module+0x6249/0x7110
[<00000000117e4696>] __do_sys_finit_module+0x140/0x200
[<00000000f74b12d2>] do_syscall_64+0x35/0x80
[<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
The reason is that the vkms_init() returns without checking the return
value of vkms_create(), and if the vkms_create() failed, the config
allocated at the beginning of vkms_init() is leaked.
vkms_init()
config = kmalloc(...) # config allocated
...
return vkms_create() # vkms_create failed and config is leaked
Fix this problem by checking return value of vkms_create() and free the
config if error happened.
Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-2-yuancan@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vkms/vkms_drv.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index 0ffe5f0e33f75..dfe983eaa07ff 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -218,6 +218,7 @@ static int vkms_create(struct vkms_config *config)
static int __init vkms_init(void)
{
+ int ret;
struct vkms_config *config;
config = kmalloc(sizeof(*config), GFP_KERNEL);
@@ -230,7 +231,11 @@ static int __init vkms_init(void)
config->writeback = enable_writeback;
config->overlay = enable_overlay;
- return vkms_create(config);
+ ret = vkms_create(config);
+ if (ret)
+ kfree(config);
+
+ return ret;
}
static void vkms_destroy(struct vkms_config *config)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 170/567] drm/vkms: Fix null-ptr-deref in vkms_release()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 169/567] drm/vkms: Fix memory leak in vkms_init() Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 171/567] drm/vc4: dpi: Add option for inverting pixel clock and output enable Greg Kroah-Hartman
` (400 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Can, Melissa Wen, Melissa Wen,
Sasha Levin
From: Yuan Can <yuancan@huawei.com>
[ Upstream commit 2fe2a8f40c21161ffe7653cc234e7934db5b7cc5 ]
A null-ptr-deref is triggered when it tries to destroy the workqueue in
vkms->output.composer_workq in vkms_release().
KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24
RIP: 0010:destroy_workqueue+0x2f/0x710
...
Call Trace:
<TASK>
? vkms_config_debugfs_init+0x50/0x50 [vkms]
__devm_drm_dev_alloc+0x15a/0x1c0 [drm]
vkms_init+0x245/0x1000 [vkms]
do_one_initcall+0xd0/0x4f0
do_init_module+0x1a4/0x680
load_module+0x6249/0x7110
__do_sys_finit_module+0x140/0x200
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
The reason is that an OOM happened which triggers the destroy of the
workqueue, however, the workqueue is alloced in the later process,
thus a null-ptr-deref happened. A simple call graph is shown as below:
vkms_init()
vkms_create()
devm_drm_dev_alloc()
__devm_drm_dev_alloc()
devm_drm_dev_init()
devm_add_action_or_reset()
devm_add_action() # an error happened
devm_drm_dev_init_release()
drm_dev_put()
kref_put()
drm_dev_release()
vkms_release()
destroy_workqueue() # null-ptr-deref happened
vkms_modeset_init()
vkms_output_init()
vkms_crtc_init() # where the workqueue get allocated
Fix this by checking if composer_workq is NULL before passing it to
the destroy_workqueue() in vkms_release().
Fixes: 6c234fe37c57 ("drm/vkms: Implement CRC debugfs API")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-3-yuancan@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vkms/vkms_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
index dfe983eaa07ff..f716c5796f5fc 100644
--- a/drivers/gpu/drm/vkms/vkms_drv.c
+++ b/drivers/gpu/drm/vkms/vkms_drv.c
@@ -57,7 +57,8 @@ static void vkms_release(struct drm_device *dev)
{
struct vkms_device *vkms = drm_device_to_vkms_device(dev);
- destroy_workqueue(vkms->output.composer_workq);
+ if (vkms->output.composer_workq)
+ destroy_workqueue(vkms->output.composer_workq);
}
static void vkms_atomic_commit_tail(struct drm_atomic_state *old_state)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 171/567] drm/vc4: dpi: Add option for inverting pixel clock and output enable
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 170/567] drm/vkms: Fix null-ptr-deref in vkms_release() Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 172/567] drm/vc4: dpi: Fix format mapping for RGB565 Greg Kroah-Hartman
` (399 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Stevenson, Maxime Ripard, Sasha Levin
From: Dave Stevenson <dave.stevenson@raspberrypi.com>
[ Upstream commit 3c2707632146b22e97b0fbf6778bab8add2eaa1d ]
DRM provides flags for inverting pixel clock and output enable
signals, but these were not mapped to the relevant registers.
Add those mappings.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Link: https://lore.kernel.org/r/20220613144800.326124-10-maxime@cerno.tech
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Stable-dep-of: 0870d86eac8a ("drm/vc4: dpi: Fix format mapping for RGB565")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_dpi.c | 66 ++++++++++++++++++++---------------
1 file changed, 38 insertions(+), 28 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_dpi.c b/drivers/gpu/drm/vc4/vc4_dpi.c
index a90f2545baee0..0e25add2df071 100644
--- a/drivers/gpu/drm/vc4/vc4_dpi.c
+++ b/drivers/gpu/drm/vc4/vc4_dpi.c
@@ -148,35 +148,45 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder)
}
drm_connector_list_iter_end(&conn_iter);
- if (connector && connector->display_info.num_bus_formats) {
- u32 bus_format = connector->display_info.bus_formats[0];
-
- switch (bus_format) {
- case MEDIA_BUS_FMT_RGB888_1X24:
- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB,
- DPI_FORMAT);
- break;
- case MEDIA_BUS_FMT_BGR888_1X24:
- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB,
- DPI_FORMAT);
- dpi_c |= VC4_SET_FIELD(DPI_ORDER_BGR, DPI_ORDER);
- break;
- case MEDIA_BUS_FMT_RGB666_1X24_CPADHI:
- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_2,
- DPI_FORMAT);
- break;
- case MEDIA_BUS_FMT_RGB666_1X18:
- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_1,
- DPI_FORMAT);
- break;
- case MEDIA_BUS_FMT_RGB565_1X16:
- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_3,
- DPI_FORMAT);
- break;
- default:
- DRM_ERROR("Unknown media bus format %d\n", bus_format);
- break;
+ if (connector) {
+ if (connector->display_info.num_bus_formats) {
+ u32 bus_format = connector->display_info.bus_formats[0];
+
+ switch (bus_format) {
+ case MEDIA_BUS_FMT_RGB888_1X24:
+ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB,
+ DPI_FORMAT);
+ break;
+ case MEDIA_BUS_FMT_BGR888_1X24:
+ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB,
+ DPI_FORMAT);
+ dpi_c |= VC4_SET_FIELD(DPI_ORDER_BGR,
+ DPI_ORDER);
+ break;
+ case MEDIA_BUS_FMT_RGB666_1X24_CPADHI:
+ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_2,
+ DPI_FORMAT);
+ break;
+ case MEDIA_BUS_FMT_RGB666_1X18:
+ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_1,
+ DPI_FORMAT);
+ break;
+ case MEDIA_BUS_FMT_RGB565_1X16:
+ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_3,
+ DPI_FORMAT);
+ break;
+ default:
+ DRM_ERROR("Unknown media bus format %d\n",
+ bus_format);
+ break;
+ }
}
+
+ if (connector->display_info.bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE)
+ dpi_c |= DPI_PIXEL_CLK_INVERT;
+
+ if (connector->display_info.bus_flags & DRM_BUS_FLAG_DE_LOW)
+ dpi_c |= DPI_OUTPUT_ENABLE_INVERT;
} else {
/* Default to 24bit if no connector found. */
dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB, DPI_FORMAT);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 172/567] drm/vc4: dpi: Fix format mapping for RGB565
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 171/567] drm/vc4: dpi: Add option for inverting pixel clock and output enable Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 173/567] drm: tidss: Fix pixel format definition Greg Kroah-Hartman
` (398 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Stevenson, Laurent Pinchart,
Maxime Ripard, Sasha Levin
From: Dave Stevenson <dave.stevenson@raspberrypi.com>
[ Upstream commit 0870d86eac8a9abd89a0be1b719d5dc5bac936f0 ]
The mapping is incorrect for RGB565_1X16 as it should be
DPI_FORMAT_18BIT_666_RGB_1 instead of DPI_FORMAT_18BIT_666_RGB_3.
Fixes: 08302c35b59d ("drm/vc4: Add DPI driver")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/20221013-rpi-dpi-improvements-v3-7-eb76e26a772d@cerno.tech
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_dpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vc4/vc4_dpi.c b/drivers/gpu/drm/vc4/vc4_dpi.c
index 0e25add2df071..9c8a71d7426a0 100644
--- a/drivers/gpu/drm/vc4/vc4_dpi.c
+++ b/drivers/gpu/drm/vc4/vc4_dpi.c
@@ -172,7 +172,7 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder)
DPI_FORMAT);
break;
case MEDIA_BUS_FMT_RGB565_1X16:
- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_3,
+ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_1,
DPI_FORMAT);
break;
default:
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 173/567] drm: tidss: Fix pixel format definition
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 172/567] drm/vc4: dpi: Fix format mapping for RGB565 Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 174/567] gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() Greg Kroah-Hartman
` (397 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randolph Sapp, Aradhya Bhatia,
Andrew Davis, Tomi Valkeinen, Sasha Levin
From: Randolph Sapp <rs@ti.com>
[ Upstream commit 2df0433b18f2735a49d2c3a968b40fa2881137c0 ]
There was a long-standing bug from a typo that created 2 ARGB1555 and
ABGR1555 pixel format entries. Weston 10 has a sanity check that alerted
me to this issue.
According to the Supported Pixel Data formats table we have the later
entries should have been for Alpha-X instead.
Signed-off-by: Randolph Sapp <rs@ti.com>
Fixes: 32a1795f57eecc ("drm/tidss: New driver for TI Keystone platform Display SubSystem")
Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
Acked-by: Andrew Davis <afd@ti.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221202001803.1765805-1-rs@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tidss/tidss_dispc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
index 60b92df615aa5..f54517698710f 100644
--- a/drivers/gpu/drm/tidss/tidss_dispc.c
+++ b/drivers/gpu/drm/tidss/tidss_dispc.c
@@ -1855,8 +1855,8 @@ static const struct {
{ DRM_FORMAT_XBGR4444, 0x21, },
{ DRM_FORMAT_RGBX4444, 0x22, },
- { DRM_FORMAT_ARGB1555, 0x25, },
- { DRM_FORMAT_ABGR1555, 0x26, },
+ { DRM_FORMAT_XRGB1555, 0x25, },
+ { DRM_FORMAT_XBGR1555, 0x26, },
{ DRM_FORMAT_XRGB8888, 0x27, },
{ DRM_FORMAT_XBGR8888, 0x28, },
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 174/567] gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 173/567] drm: tidss: Fix pixel format definition Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 175/567] hwmon: (ftsteutates) Fix scaling of measurements Greg Kroah-Hartman
` (396 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Liang He, Philipp Zabel, Sasha Levin
From: Liang He <windhl@126.com>
[ Upstream commit 9afdf98cfdfa2ba8ec068cf08c5fcdc1ed8daf3f ]
In ipu_add_client_devices(), we need to call of_node_put() for
reference returned by of_graph_get_port_by_id() in fail path.
Fixes: 17e052175039 ("gpu: ipu-v3: Do not bail out on missing optional port nodes")
Signed-off-by: Liang He <windhl@126.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://lore.kernel.org/r/20220720152227.1288413-1-windhl@126.com
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20220720152227.1288413-1-windhl@126.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/ipu-v3/ipu-common.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 118318513e2d2..c35eac1116f5f 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -1165,6 +1165,7 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base)
pdev = platform_device_alloc(reg->name, id++);
if (!pdev) {
ret = -ENOMEM;
+ of_node_put(of_node);
goto err_register;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 175/567] hwmon: (ftsteutates) Fix scaling of measurements
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 174/567] gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 176/567] drm/msm/hdmi: Add missing check for alloc_ordered_workqueue Greg Kroah-Hartman
` (395 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Armin Wolf, Guenter Roeck, Sasha Levin
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit ca8fd8c16a8b77dfcf7f6ce52d2c863220693a78 ]
A user complained that the ftsteutates driver was displaying
bogus values since its introduction. This happens because the
sensor measurements need to be scaled in order to produce
meaningful results:
- the fan speed needs to be multiplied by 60 since its in RPS
- the temperature is in degrees celsius and needs an offset of 64
- the voltage is in 1/256 of 3.3V
The offical datasheet says the voltage needs to be divided by 256,
but this is likely an off-by-one-error, since even the BIOS
devides by 255 (otherwise 3.3V could not be measured).
The voltage channels additionally need a board-specific multiplier,
however this can be done by the driver since its board-specific.
The reason the missing scaling of measurements is the way Fujitsu
used this driver when it was still out-of-tree. Back then, all
scaling was done in userspace by libsensors, even the generic one.
Tested on a Fujitsu DS3401-B1.
Fixes: 08426eda58e0 ("hwmon: Add driver for FTS BMC chip "Teutates"")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://lore.kernel.org/r/20221224041855.83981-2-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/hwmon/ftsteutates.rst | 4 ++++
drivers/hwmon/ftsteutates.c | 19 +++++++++++++------
2 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/Documentation/hwmon/ftsteutates.rst b/Documentation/hwmon/ftsteutates.rst
index 58a2483d8d0da..198fa8e2819da 100644
--- a/Documentation/hwmon/ftsteutates.rst
+++ b/Documentation/hwmon/ftsteutates.rst
@@ -22,6 +22,10 @@ enhancements. It can monitor up to 4 voltages, 16 temperatures and
8 fans. It also contains an integrated watchdog which is currently
implemented in this driver.
+The 4 voltages require a board-specific multiplier, since the BMC can
+only measure voltages up to 3.3V and thus relies on voltage dividers.
+Consult your motherboard manual for details.
+
To clear a temperature or fan alarm, execute the following command with the
correct path to the alarm file::
diff --git a/drivers/hwmon/ftsteutates.c b/drivers/hwmon/ftsteutates.c
index ceffc76a0c515..2998d8cdce006 100644
--- a/drivers/hwmon/ftsteutates.c
+++ b/drivers/hwmon/ftsteutates.c
@@ -12,6 +12,7 @@
#include <linux/i2c.h>
#include <linux/init.h>
#include <linux/jiffies.h>
+#include <linux/math.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/slab.h>
@@ -347,13 +348,15 @@ static ssize_t in_value_show(struct device *dev,
{
struct fts_data *data = dev_get_drvdata(dev);
int index = to_sensor_dev_attr(devattr)->index;
- int err;
+ int value, err;
err = fts_update_device(data);
if (err < 0)
return err;
- return sprintf(buf, "%u\n", data->volt[index]);
+ value = DIV_ROUND_CLOSEST(data->volt[index] * 3300, 255);
+
+ return sprintf(buf, "%d\n", value);
}
static ssize_t temp_value_show(struct device *dev,
@@ -361,13 +364,15 @@ static ssize_t temp_value_show(struct device *dev,
{
struct fts_data *data = dev_get_drvdata(dev);
int index = to_sensor_dev_attr(devattr)->index;
- int err;
+ int value, err;
err = fts_update_device(data);
if (err < 0)
return err;
- return sprintf(buf, "%u\n", data->temp_input[index]);
+ value = (data->temp_input[index] - 64) * 1000;
+
+ return sprintf(buf, "%d\n", value);
}
static ssize_t temp_fault_show(struct device *dev,
@@ -436,13 +441,15 @@ static ssize_t fan_value_show(struct device *dev,
{
struct fts_data *data = dev_get_drvdata(dev);
int index = to_sensor_dev_attr(devattr)->index;
- int err;
+ int value, err;
err = fts_update_device(data);
if (err < 0)
return err;
- return sprintf(buf, "%u\n", data->fan_input[index]);
+ value = data->fan_input[index] * 60;
+
+ return sprintf(buf, "%d\n", value);
}
static ssize_t fan_source_show(struct device *dev,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 176/567] drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 175/567] hwmon: (ftsteutates) Fix scaling of measurements Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 177/567] pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins Greg Kroah-Hartman
` (394 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Dmitry Baryshkov,
Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit afe4cb96153a0d8003e4e4ebd91b5c543e10df84 ]
Add check for the return value of alloc_ordered_workqueue as it may return
NULL pointer and cause NULL pointer dereference in `hdmi_hdcp.c` and
`hdmi_hpd.c`.
Fixes: c6a57a50ad56 ("drm/msm/hdmi: add hdmi hdcp support (V3)")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/517211/
Link: https://lore.kernel.org/r/20230106023011.3985-1-jiasheng@iscas.ac.cn
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/hdmi/hdmi.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
index e1a9b52d0a292..2c944419e1758 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
@@ -264,6 +264,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)
devm_pm_runtime_enable(&pdev->dev);
hdmi->workq = alloc_ordered_workqueue("msm_hdmi", 0);
+ if (!hdmi->workq) {
+ ret = -ENOMEM;
+ goto fail;
+ }
hdmi->i2c = msm_hdmi_i2c_init(hdmi);
if (IS_ERR(hdmi->i2c)) {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 177/567] pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 176/567] drm/msm/hdmi: Add missing check for alloc_ordered_workqueue Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 178/567] pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain Greg Kroah-Hartman
` (393 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Skladowski, Marijn Suijten,
Linus Walleij, Sasha Levin
From: Adam Skladowski <a39.skl@gmail.com>
[ Upstream commit a7cc0e2685082a0d79baec02df184dfa83cbfac3 ]
Adjust names of function for wcss pins, also fix third gpio in bt group.
Fixes: bcd11493f0ab ("pinctrl: qcom: Add a pinctrl driver for MSM8976 and 8956")
Signed-off-by: Adam Skladowski <a39.skl@gmail.com>
Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
Link: https://lore.kernel.org/r/20221231164250.74550-1-a39.skl@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/qcom/pinctrl-msm8976.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/pinctrl/qcom/pinctrl-msm8976.c b/drivers/pinctrl/qcom/pinctrl-msm8976.c
index ec43edf9b660a..e11d845847190 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm8976.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm8976.c
@@ -733,7 +733,7 @@ static const char * const codec_int2_groups[] = {
"gpio74",
};
static const char * const wcss_bt_groups[] = {
- "gpio39", "gpio47", "gpio88",
+ "gpio39", "gpio47", "gpio48",
};
static const char * const sdc3_groups[] = {
"gpio39", "gpio40", "gpio41",
@@ -958,9 +958,9 @@ static const struct msm_pingroup msm8976_groups[] = {
PINGROUP(37, NA, NA, NA, qdss_tracedata_b, NA, NA, NA, NA, NA),
PINGROUP(38, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b, NA),
PINGROUP(39, wcss_bt, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
- PINGROUP(40, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
- PINGROUP(41, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
- PINGROUP(42, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
+ PINGROUP(40, wcss_wlan2, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
+ PINGROUP(41, wcss_wlan1, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
+ PINGROUP(42, wcss_wlan0, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA),
PINGROUP(43, wcss_wlan, sdc3, NA, NA, qdss_tracedata_a, NA, NA, NA, NA),
PINGROUP(44, wcss_wlan, sdc3, NA, NA, NA, NA, NA, NA, NA),
PINGROUP(45, wcss_fm, NA, qdss_tracectl_a, NA, NA, NA, NA, NA, NA),
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 178/567] pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 177/567] pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 179/567] pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups Greg Kroah-Hartman
` (392 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Linus Walleij, Sasha Levin
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit dcef18c8ac40aa85bb339f64c1dd31dd458b06fb ]
of_irq_find_parent() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
Fixes: d86f4d71e42a ("pinctrl: stm32: check irq controller availability at probe")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20230102082503.3944927-1-linmq006@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/stm32/pinctrl-stm32.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index d3fa8cf0d72c4..abb12a5c3c329 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -1334,6 +1334,7 @@ static struct irq_domain *stm32_pctrl_get_irq_domain(struct device_node *np)
return ERR_PTR(-ENXIO);
domain = irq_find_host(parent);
+ of_node_put(parent);
if (!domain)
/* domain not registered yet */
return ERR_PTR(-EPROBE_DEFER);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 179/567] pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 178/567] pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 180/567] drm/vc4: hvs: Set AXI panic modes Greg Kroah-Hartman
` (391 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Linus Walleij, Sasha Levin
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit c818ae563bf99457f02e8170aabd6b174f629f65 ]
of_find_node_by_phandle() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
Fixes: d3e5116119bd ("pinctrl: add pinctrl driver for Rockchip SoCs")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://lore.kernel.org/r/20230102112845.3982407-1-linmq006@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-rockchip.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index c33cbf7568db5..a6f4aca9c61c4 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -2499,6 +2499,7 @@ static int rockchip_pinctrl_parse_groups(struct device_node *np,
np_config = of_find_node_by_phandle(be32_to_cpup(phandle));
ret = pinconf_generic_parse_dt_config(np_config, NULL,
&grp->data[j].configs, &grp->data[j].nconfigs);
+ of_node_put(np_config);
if (ret)
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 180/567] drm/vc4: hvs: Set AXI panic modes
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 179/567] pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 181/567] drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 Greg Kroah-Hartman
` (390 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Stevenson, Maxime Ripard, Sasha Levin
From: Dave Stevenson <dave.stevenson@raspberrypi.com>
[ Upstream commit df993fced230daa8452892406f3180c93ebf7e7b ]
The HVS can change AXI request mode based on how full the COB
FIFOs are.
Until now the vc4 driver has been relying on the firmware to
have set these to sensible values.
With HVS channel 2 now being used for live video, change the
panic mode for all channels to be explicitly set by the driver,
and the same for all channels.
Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-2-1f8e0770798b@cerno.tech
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hvs.c | 11 +++++++++++
drivers/gpu/drm/vc4/vc4_regs.h | 6 ++++++
2 files changed, 17 insertions(+)
diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
index 9d88bfb50c9b0..3856ac289d380 100644
--- a/drivers/gpu/drm/vc4/vc4_hvs.c
+++ b/drivers/gpu/drm/vc4/vc4_hvs.c
@@ -718,6 +718,17 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
SCALER_DISPCTRL_DSPEISLUR(2) |
SCALER_DISPCTRL_SCLEIRQ);
+ /* Set AXI panic mode.
+ * VC4 panics when < 2 lines in FIFO.
+ * VC5 panics when less than 1 line in the FIFO.
+ */
+ dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK |
+ SCALER_DISPCTRL_PANIC1_MASK |
+ SCALER_DISPCTRL_PANIC2_MASK);
+ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC0);
+ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1);
+ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2);
+
HVS_WRITE(SCALER_DISPCTRL, dispctrl);
ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h
index 8ac2f088106a6..fe6d0e21ddd8d 100644
--- a/drivers/gpu/drm/vc4/vc4_regs.h
+++ b/drivers/gpu/drm/vc4/vc4_regs.h
@@ -220,6 +220,12 @@
#define SCALER_DISPCTRL 0x00000000
/* Global register for clock gating the HVS */
# define SCALER_DISPCTRL_ENABLE BIT(31)
+# define SCALER_DISPCTRL_PANIC0_MASK VC4_MASK(25, 24)
+# define SCALER_DISPCTRL_PANIC0_SHIFT 24
+# define SCALER_DISPCTRL_PANIC1_MASK VC4_MASK(27, 26)
+# define SCALER_DISPCTRL_PANIC1_SHIFT 26
+# define SCALER_DISPCTRL_PANIC2_MASK VC4_MASK(29, 28)
+# define SCALER_DISPCTRL_PANIC2_SHIFT 28
# define SCALER_DISPCTRL_DSP3_MUX_MASK VC4_MASK(19, 18)
# define SCALER_DISPCTRL_DSP3_MUX_SHIFT 18
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 181/567] drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 180/567] drm/vc4: hvs: Set AXI panic modes Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 182/567] drm/vc4: hdmi: Correct interlaced timings again Greg Kroah-Hartman
` (389 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Stevenson, Maxime Ripard, Sasha Levin
From: Dave Stevenson <dave.stevenson@raspberrypi.com>
[ Upstream commit 902973dc1a049c0d7bf0c222b8f2b3876f01b4a2 ]
Same as the xRGB8888 formats, HVS5 has managed to swap the colour
channels for the xRGB1555 formats as well. Add the relevant
config for pixel_order_hvs5.
Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-6-1f8e0770798b@cerno.tech
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_plane.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 8574acefd40e7..4404059810d0a 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -72,11 +72,13 @@ static const struct hvs_format {
.drm = DRM_FORMAT_ARGB1555,
.hvs = HVS_PIXEL_FORMAT_RGBA5551,
.pixel_order = HVS_PIXEL_ORDER_ABGR,
+ .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
},
{
.drm = DRM_FORMAT_XRGB1555,
.hvs = HVS_PIXEL_FORMAT_RGBA5551,
.pixel_order = HVS_PIXEL_ORDER_ABGR,
+ .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB,
},
{
.drm = DRM_FORMAT_RGB888,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 182/567] drm/vc4: hdmi: Correct interlaced timings again
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 181/567] drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 183/567] drm/msm: clean event_thread->worker in case of an error Greg Kroah-Hartman
` (388 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Stevenson, Maxime Ripard, Sasha Levin
From: Dave Stevenson <dave.stevenson@raspberrypi.com>
[ Upstream commit 771d6539f27bd55f43d8a95d53a7eeaaffa2681c ]
The back porch timings were correct, only the sync offset was wrong.
Correct timing is now reported for 1080i and 576i, but the h offset is
incorrect for 480i for non-obvious reasons.
Fixes: fb10dc451c0f ("drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes")
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-14-1f8e0770798b@cerno.tech
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 665f772f9ffc4..7a8353d7ab36a 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -785,11 +785,12 @@ static void vc5_hdmi_set_timings(struct vc4_hdmi *vc4_hdmi,
VC4_SET_FIELD(mode->crtc_vdisplay, VC5_HDMI_VERTA_VAL));
u32 vertb = (VC4_SET_FIELD(mode->htotal >> (2 - pixel_rep),
VC5_HDMI_VERTB_VSPO) |
- VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end,
+ VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end +
+ interlaced,
VC4_HDMI_VERTB_VBP));
u32 vertb_even = (VC4_SET_FIELD(0, VC5_HDMI_VERTB_VSPO) |
VC4_SET_FIELD(mode->crtc_vtotal -
- mode->crtc_vsync_end - interlaced,
+ mode->crtc_vsync_end,
VC4_HDMI_VERTB_VBP));
unsigned char gcp;
bool gcp_en;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 183/567] drm/msm: clean event_thread->worker in case of an error
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 182/567] drm/vc4: hdmi: Correct interlaced timings again Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 184/567] scsi: qla2xxx: edif: Fix I/O timeout due to over-subscription Greg Kroah-Hartman
` (387 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Abhinav Kumar,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit c79bb6b92defdcb834ceeeed9c1cf591beb1b71a ]
If worker creation fails, nullify the event_thread->worker, so that
msm_drm_uninit() doesn't try accessing invalid memory location. While we
are at it, remove duplicate assignment to the ret variable.
Fixes: 1041dee2178f ("drm/msm: use kthread_create_worker instead of kthread_run")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/490106/
Link: https://lore.kernel.org/r/20220617233328.1143665-2-dmitry.baryshkov@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 916361c30d774..6c4d519450b9c 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -609,7 +609,7 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
if (IS_ERR(priv->event_thread[i].worker)) {
ret = PTR_ERR(priv->event_thread[i].worker);
DRM_DEV_ERROR(dev, "failed to create crtc_event kthread\n");
- ret = PTR_ERR(priv->event_thread[i].worker);
+ priv->event_thread[i].worker = NULL;
goto err_msm_uninit;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 184/567] scsi: qla2xxx: edif: Fix I/O timeout due to over-subscription
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 183/567] drm/msm: clean event_thread->worker in case of an error Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 185/567] scsi: qla2xxx: Fix exchange oversubscription Greg Kroah-Hartman
` (386 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Himanshu Madhani, Quinn Tran,
Nilesh Javali, Martin K. Petersen, Sasha Levin
From: Quinn Tran <qutran@marvell.com>
[ Upstream commit 63ab6cb582fad3757a03f466db671729b97f2df8 ]
The current edif code does not keep track of FW IOCB resources. This led
to IOCB queue full on error recovery (I/O timeout). Make use of the
existing code that tracks IOCB resources to prevent over-subscription.
Link: https://lore.kernel.org/r/20220608115849.16693-2-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: 41e5afe51f75 ("scsi: qla2xxx: Fix exchange oversubscription")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_edif.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
index 8e9237434e8b1..a7e2118b3a841 100644
--- a/drivers/scsi/qla2xxx/qla_edif.c
+++ b/drivers/scsi/qla2xxx/qla_edif.c
@@ -2898,6 +2898,12 @@ qla28xx_start_scsi_edif(srb_t *sp)
tot_dsds = nseg;
req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
+
+ sp->iores.res_type = RESOURCE_INI;
+ sp->iores.iocb_cnt = req_cnt;
+ if (qla_get_iocbs(sp->qpair, &sp->iores))
+ goto queuing_error;
+
if (req->cnt < (req_cnt + 2)) {
cnt = IS_SHADOW_REG_CAPABLE(ha) ? *req->out_ptr :
rd_reg_dword(req->req_q_out);
@@ -3089,6 +3095,7 @@ qla28xx_start_scsi_edif(srb_t *sp)
mempool_free(sp->u.scmd.ct6_ctx, ha->ctx_mempool);
sp->u.scmd.ct6_ctx = NULL;
}
+ qla_put_iocbs(sp->qpair, &sp->iores);
spin_unlock_irqrestore(lock, flags);
return QLA_FUNCTION_FAILED;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 185/567] scsi: qla2xxx: Fix exchange oversubscription
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 184/567] scsi: qla2xxx: edif: Fix I/O timeout due to over-subscription Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 186/567] scsi: qla2xxx: Fix exchange oversubscription for management commands Greg Kroah-Hartman
` (385 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen, Sasha Levin
From: Quinn Tran <qutran@marvell.com>
[ Upstream commit 41e5afe51f75f2858f5563145348f6c26d307b8f ]
In large environment, it is possible to experience command timeout and
escalation of path recovery. Currently the driver does not track the number
of exchanges/commands sent to FW. If there is a delay for commands at the
head of the queue, then this will create back pressure for commands at the
back of the queue.
Check for exchange availability before command submission.
Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking")
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_def.h | 6 +++-
drivers/scsi/qla2xxx/qla_edif.c | 7 +++--
drivers/scsi/qla2xxx/qla_init.c | 13 ++++++++
drivers/scsi/qla2xxx/qla_inline.h | 52 +++++++++++++++++++++----------
drivers/scsi/qla2xxx/qla_iocb.c | 28 ++++++++++-------
drivers/scsi/qla2xxx/qla_isr.c | 3 +-
drivers/scsi/qla2xxx/qla_nvme.c | 15 ++++++++-
7 files changed, 88 insertions(+), 36 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 307ffdfe048be..5b499b0e2c867 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -655,7 +655,7 @@ enum {
struct iocb_resource {
u8 res_type;
- u8 pad;
+ u8 exch_cnt;
u16 iocb_cnt;
};
@@ -3707,6 +3707,10 @@ struct qla_fw_resources {
u16 iocbs_limit;
u16 iocbs_qp_limit;
u16 iocbs_used;
+ u16 exch_total;
+ u16 exch_limit;
+ u16 exch_used;
+ u16 pad;
};
#define QLA_IOCB_PCT_LIMIT 95
diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
index a7e2118b3a841..f81cf85dcdc7b 100644
--- a/drivers/scsi/qla2xxx/qla_edif.c
+++ b/drivers/scsi/qla2xxx/qla_edif.c
@@ -2899,9 +2899,10 @@ qla28xx_start_scsi_edif(srb_t *sp)
tot_dsds = nseg;
req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
- sp->iores.res_type = RESOURCE_INI;
+ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
+ sp->iores.exch_cnt = 1;
sp->iores.iocb_cnt = req_cnt;
- if (qla_get_iocbs(sp->qpair, &sp->iores))
+ if (qla_get_fw_resources(sp->qpair, &sp->iores))
goto queuing_error;
if (req->cnt < (req_cnt + 2)) {
@@ -3095,7 +3096,7 @@ qla28xx_start_scsi_edif(srb_t *sp)
mempool_free(sp->u.scmd.ct6_ctx, ha->ctx_mempool);
sp->u.scmd.ct6_ctx = NULL;
}
- qla_put_iocbs(sp->qpair, &sp->iores);
+ qla_put_fw_resources(sp->qpair, &sp->iores);
spin_unlock_irqrestore(lock, flags);
return QLA_FUNCTION_FAILED;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 30798ab84db91..b61aa5a1a21dc 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -128,12 +128,14 @@ static void qla24xx_abort_iocb_timeout(void *data)
sp->cmd_sp)) {
qpair->req->outstanding_cmds[handle] = NULL;
cmdsp_found = 1;
+ qla_put_fw_resources(qpair, &sp->cmd_sp->iores);
}
/* removing the abort */
if (qpair->req->outstanding_cmds[handle] == sp) {
qpair->req->outstanding_cmds[handle] = NULL;
sp_found = 1;
+ qla_put_fw_resources(qpair, &sp->iores);
break;
}
}
@@ -2002,6 +2004,7 @@ qla2x00_tmf_iocb_timeout(void *data)
for (h = 1; h < sp->qpair->req->num_outstanding_cmds; h++) {
if (sp->qpair->req->outstanding_cmds[h] == sp) {
sp->qpair->req->outstanding_cmds[h] = NULL;
+ qla_put_fw_resources(sp->qpair, &sp->iores);
break;
}
}
@@ -3945,6 +3948,12 @@ void qla_init_iocb_limit(scsi_qla_host_t *vha)
ha->base_qpair->fwres.iocbs_limit = limit;
ha->base_qpair->fwres.iocbs_qp_limit = limit / num_qps;
ha->base_qpair->fwres.iocbs_used = 0;
+
+ ha->base_qpair->fwres.exch_total = ha->orig_fw_xcb_count;
+ ha->base_qpair->fwres.exch_limit = (ha->orig_fw_xcb_count *
+ QLA_IOCB_PCT_LIMIT) / 100;
+ ha->base_qpair->fwres.exch_used = 0;
+
for (i = 0; i < ha->max_qpairs; i++) {
if (ha->queue_pair_map[i]) {
ha->queue_pair_map[i]->fwres.iocbs_total =
@@ -3953,6 +3962,10 @@ void qla_init_iocb_limit(scsi_qla_host_t *vha)
ha->queue_pair_map[i]->fwres.iocbs_qp_limit =
limit / num_qps;
ha->queue_pair_map[i]->fwres.iocbs_used = 0;
+ ha->queue_pair_map[i]->fwres.exch_total = ha->orig_fw_xcb_count;
+ ha->queue_pair_map[i]->fwres.exch_limit =
+ (ha->orig_fw_xcb_count * QLA_IOCB_PCT_LIMIT) / 100;
+ ha->queue_pair_map[i]->fwres.exch_used = 0;
}
}
}
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 5185dc5daf80d..2d5a275d8b000 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -380,13 +380,16 @@ qla2xxx_get_fc4_priority(struct scsi_qla_host *vha)
enum {
RESOURCE_NONE,
- RESOURCE_INI,
+ RESOURCE_IOCB = BIT_0,
+ RESOURCE_EXCH = BIT_1, /* exchange */
+ RESOURCE_FORCE = BIT_2,
};
static inline int
-qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores)
+qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores)
{
u16 iocbs_used, i;
+ u16 exch_used;
struct qla_hw_data *ha = qp->vha->hw;
if (!ql2xenforce_iocb_limit) {
@@ -394,10 +397,7 @@ qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores)
return 0;
}
- if ((iores->iocb_cnt + qp->fwres.iocbs_used) < qp->fwres.iocbs_qp_limit) {
- qp->fwres.iocbs_used += iores->iocb_cnt;
- return 0;
- } else {
+ if ((iores->iocb_cnt + qp->fwres.iocbs_used) >= qp->fwres.iocbs_qp_limit) {
/* no need to acquire qpair lock. It's just rough calculation */
iocbs_used = ha->base_qpair->fwres.iocbs_used;
for (i = 0; i < ha->max_qpairs; i++) {
@@ -405,30 +405,48 @@ qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores)
iocbs_used += ha->queue_pair_map[i]->fwres.iocbs_used;
}
- if ((iores->iocb_cnt + iocbs_used) < qp->fwres.iocbs_limit) {
- qp->fwres.iocbs_used += iores->iocb_cnt;
- return 0;
- } else {
+ if ((iores->iocb_cnt + iocbs_used) >= qp->fwres.iocbs_limit) {
+ iores->res_type = RESOURCE_NONE;
+ return -ENOSPC;
+ }
+ }
+
+ if (iores->res_type & RESOURCE_EXCH) {
+ exch_used = ha->base_qpair->fwres.exch_used;
+ for (i = 0; i < ha->max_qpairs; i++) {
+ if (ha->queue_pair_map[i])
+ exch_used += ha->queue_pair_map[i]->fwres.exch_used;
+ }
+
+ if ((exch_used + iores->exch_cnt) >= qp->fwres.exch_limit) {
iores->res_type = RESOURCE_NONE;
return -ENOSPC;
}
}
+ qp->fwres.iocbs_used += iores->iocb_cnt;
+ qp->fwres.exch_used += iores->exch_cnt;
+ return 0;
}
static inline void
-qla_put_iocbs(struct qla_qpair *qp, struct iocb_resource *iores)
+qla_put_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores)
{
- switch (iores->res_type) {
- case RESOURCE_NONE:
- break;
- default:
+ if (iores->res_type & RESOURCE_IOCB) {
if (qp->fwres.iocbs_used >= iores->iocb_cnt) {
qp->fwres.iocbs_used -= iores->iocb_cnt;
} else {
- // should not happen
+ /* should not happen */
qp->fwres.iocbs_used = 0;
}
- break;
+ }
+
+ if (iores->res_type & RESOURCE_EXCH) {
+ if (qp->fwres.exch_used >= iores->exch_cnt) {
+ qp->fwres.exch_used -= iores->exch_cnt;
+ } else {
+ /* should not happen */
+ qp->fwres.exch_used = 0;
+ }
}
iores->res_type = RESOURCE_NONE;
}
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 42ce4e1fe7441..399ec8da2d73c 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -1589,9 +1589,10 @@ qla24xx_start_scsi(srb_t *sp)
tot_dsds = nseg;
req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
- sp->iores.res_type = RESOURCE_INI;
+ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
+ sp->iores.exch_cnt = 1;
sp->iores.iocb_cnt = req_cnt;
- if (qla_get_iocbs(sp->qpair, &sp->iores))
+ if (qla_get_fw_resources(sp->qpair, &sp->iores))
goto queuing_error;
if (req->cnt < (req_cnt + 2)) {
@@ -1678,7 +1679,7 @@ qla24xx_start_scsi(srb_t *sp)
if (tot_dsds)
scsi_dma_unmap(cmd);
- qla_put_iocbs(sp->qpair, &sp->iores);
+ qla_put_fw_resources(sp->qpair, &sp->iores);
spin_unlock_irqrestore(&ha->hardware_lock, flags);
return QLA_FUNCTION_FAILED;
@@ -1793,9 +1794,10 @@ qla24xx_dif_start_scsi(srb_t *sp)
tot_prot_dsds = nseg;
tot_dsds += nseg;
- sp->iores.res_type = RESOURCE_INI;
+ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
+ sp->iores.exch_cnt = 1;
sp->iores.iocb_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
- if (qla_get_iocbs(sp->qpair, &sp->iores))
+ if (qla_get_fw_resources(sp->qpair, &sp->iores))
goto queuing_error;
if (req->cnt < (req_cnt + 2)) {
@@ -1883,7 +1885,7 @@ qla24xx_dif_start_scsi(srb_t *sp)
}
/* Cleanup will be performed by the caller (queuecommand) */
- qla_put_iocbs(sp->qpair, &sp->iores);
+ qla_put_fw_resources(sp->qpair, &sp->iores);
spin_unlock_irqrestore(&ha->hardware_lock, flags);
return QLA_FUNCTION_FAILED;
@@ -1952,9 +1954,10 @@ qla2xxx_start_scsi_mq(srb_t *sp)
tot_dsds = nseg;
req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
- sp->iores.res_type = RESOURCE_INI;
+ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
+ sp->iores.exch_cnt = 1;
sp->iores.iocb_cnt = req_cnt;
- if (qla_get_iocbs(sp->qpair, &sp->iores))
+ if (qla_get_fw_resources(sp->qpair, &sp->iores))
goto queuing_error;
if (req->cnt < (req_cnt + 2)) {
@@ -2041,7 +2044,7 @@ qla2xxx_start_scsi_mq(srb_t *sp)
if (tot_dsds)
scsi_dma_unmap(cmd);
- qla_put_iocbs(sp->qpair, &sp->iores);
+ qla_put_fw_resources(sp->qpair, &sp->iores);
spin_unlock_irqrestore(&qpair->qp_lock, flags);
return QLA_FUNCTION_FAILED;
@@ -2171,9 +2174,10 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp)
tot_prot_dsds = nseg;
tot_dsds += nseg;
- sp->iores.res_type = RESOURCE_INI;
+ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
+ sp->iores.exch_cnt = 1;
sp->iores.iocb_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
- if (qla_get_iocbs(sp->qpair, &sp->iores))
+ if (qla_get_fw_resources(sp->qpair, &sp->iores))
goto queuing_error;
if (req->cnt < (req_cnt + 2)) {
@@ -2260,7 +2264,7 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp)
}
/* Cleanup will be performed by the caller (queuecommand) */
- qla_put_iocbs(sp->qpair, &sp->iores);
+ qla_put_fw_resources(sp->qpair, &sp->iores);
spin_unlock_irqrestore(&qpair->qp_lock, flags);
return QLA_FUNCTION_FAILED;
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 59f5918dca95f..c545f39362ffc 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3184,7 +3184,7 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
}
return;
}
- qla_put_iocbs(sp->qpair, &sp->iores);
+ qla_put_fw_resources(sp->qpair, &sp->iores);
if (sp->cmd_type != TYPE_SRB) {
req->outstanding_cmds[handle] = NULL;
@@ -3605,7 +3605,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
default:
sp = qla2x00_get_sp_from_handle(vha, func, req, pkt);
if (sp) {
- qla_put_iocbs(sp->qpair, &sp->iores);
sp->done(sp, res);
return 0;
}
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 3e167dc4eec72..b66e19a8545c9 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -438,13 +438,24 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp)
goto queuing_error;
}
req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
+
+ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH;
+ sp->iores.exch_cnt = 1;
+ sp->iores.iocb_cnt = req_cnt;
+ if (qla_get_fw_resources(sp->qpair, &sp->iores)) {
+ rval = -EBUSY;
+ goto queuing_error;
+ }
+
if (req->cnt < (req_cnt + 2)) {
if (IS_SHADOW_REG_CAPABLE(ha)) {
cnt = *req->out_ptr;
} else {
cnt = rd_reg_dword_relaxed(req->req_q_out);
- if (qla2x00_check_reg16_for_disconnect(vha, cnt))
+ if (qla2x00_check_reg16_for_disconnect(vha, cnt)) {
+ rval = -EBUSY;
goto queuing_error;
+ }
}
if (req->ring_index < cnt)
@@ -589,6 +600,8 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp)
wrt_reg_dword(req->req_q_in, req->ring_index);
queuing_error:
+ if (rval)
+ qla_put_fw_resources(sp->qpair, &sp->iores);
spin_unlock_irqrestore(&qpair->qp_lock, flags);
return rval;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 186/567] scsi: qla2xxx: Fix exchange oversubscription for management commands
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 185/567] scsi: qla2xxx: Fix exchange oversubscription Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 187/567] ASoC: fsl_sai: Update to modern clocking terminology Greg Kroah-Hartman
` (384 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Martin K. Petersen, Sasha Levin
From: Quinn Tran <qutran@marvell.com>
[ Upstream commit 5f63a163ed2f12c34dd4ae9b2757962ec7bb86e5 ]
Add resource checking for management (non-I/O) commands.
Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking")
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_dfs.c | 10 ++++-
drivers/scsi/qla2xxx/qla_inline.h | 5 ++-
drivers/scsi/qla2xxx/qla_iocb.c | 67 +++++++++++++++++++++++++++++++
drivers/scsi/qla2xxx/qla_isr.c | 1 +
4 files changed, 80 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c
index 85bd0e468d43e..8f6f56c9584ce 100644
--- a/drivers/scsi/qla2xxx/qla_dfs.c
+++ b/drivers/scsi/qla2xxx/qla_dfs.c
@@ -235,7 +235,7 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused)
uint16_t mb[MAX_IOCB_MB_REG];
int rc;
struct qla_hw_data *ha = vha->hw;
- u16 iocbs_used, i;
+ u16 iocbs_used, i, exch_used;
rc = qla24xx_res_count_wait(vha, mb, SIZEOF_IOCB_MB_REG);
if (rc != QLA_SUCCESS) {
@@ -263,13 +263,19 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused)
if (ql2xenforce_iocb_limit) {
/* lock is not require. It's an estimate. */
iocbs_used = ha->base_qpair->fwres.iocbs_used;
+ exch_used = ha->base_qpair->fwres.exch_used;
for (i = 0; i < ha->max_qpairs; i++) {
- if (ha->queue_pair_map[i])
+ if (ha->queue_pair_map[i]) {
iocbs_used += ha->queue_pair_map[i]->fwres.iocbs_used;
+ exch_used += ha->queue_pair_map[i]->fwres.exch_used;
+ }
}
seq_printf(s, "Driver: estimate iocb used [%d] high water limit [%d]\n",
iocbs_used, ha->base_qpair->fwres.iocbs_limit);
+
+ seq_printf(s, "estimate exchange used[%d] high water limit [%d] n",
+ exch_used, ha->base_qpair->fwres.exch_limit);
}
return 0;
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 2d5a275d8b000..b0ee307b5d4b9 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -380,7 +380,7 @@ qla2xxx_get_fc4_priority(struct scsi_qla_host *vha)
enum {
RESOURCE_NONE,
- RESOURCE_IOCB = BIT_0,
+ RESOURCE_IOCB = BIT_0,
RESOURCE_EXCH = BIT_1, /* exchange */
RESOURCE_FORCE = BIT_2,
};
@@ -396,6 +396,8 @@ qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores)
iores->res_type = RESOURCE_NONE;
return 0;
}
+ if (iores->res_type & RESOURCE_FORCE)
+ goto force;
if ((iores->iocb_cnt + qp->fwres.iocbs_used) >= qp->fwres.iocbs_qp_limit) {
/* no need to acquire qpair lock. It's just rough calculation */
@@ -423,6 +425,7 @@ qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores)
return -ENOSPC;
}
}
+force:
qp->fwres.iocbs_used += iores->iocb_cnt;
qp->fwres.exch_used += iores->exch_cnt;
return 0;
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 399ec8da2d73c..4f48f098ea5a6 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -3817,6 +3817,65 @@ qla24xx_prlo_iocb(srb_t *sp, struct logio_entry_24xx *logio)
logio->vp_index = sp->fcport->vha->vp_idx;
}
+int qla_get_iocbs_resource(struct srb *sp)
+{
+ bool get_exch;
+ bool push_it_through = false;
+
+ if (!ql2xenforce_iocb_limit) {
+ sp->iores.res_type = RESOURCE_NONE;
+ return 0;
+ }
+ sp->iores.res_type = RESOURCE_NONE;
+
+ switch (sp->type) {
+ case SRB_TM_CMD:
+ case SRB_PRLI_CMD:
+ case SRB_ADISC_CMD:
+ push_it_through = true;
+ fallthrough;
+ case SRB_LOGIN_CMD:
+ case SRB_ELS_CMD_RPT:
+ case SRB_ELS_CMD_HST:
+ case SRB_ELS_CMD_HST_NOLOGIN:
+ case SRB_CT_CMD:
+ case SRB_NVME_LS:
+ case SRB_ELS_DCMD:
+ get_exch = true;
+ break;
+
+ case SRB_FXIOCB_DCMD:
+ case SRB_FXIOCB_BCMD:
+ sp->iores.res_type = RESOURCE_NONE;
+ return 0;
+
+ case SRB_SA_UPDATE:
+ case SRB_SA_REPLACE:
+ case SRB_MB_IOCB:
+ case SRB_ABT_CMD:
+ case SRB_NACK_PLOGI:
+ case SRB_NACK_PRLI:
+ case SRB_NACK_LOGO:
+ case SRB_LOGOUT_CMD:
+ case SRB_CTRL_VP:
+ push_it_through = true;
+ fallthrough;
+ default:
+ get_exch = false;
+ }
+
+ sp->iores.res_type |= RESOURCE_IOCB;
+ sp->iores.iocb_cnt = 1;
+ if (get_exch) {
+ sp->iores.res_type |= RESOURCE_EXCH;
+ sp->iores.exch_cnt = 1;
+ }
+ if (push_it_through)
+ sp->iores.res_type |= RESOURCE_FORCE;
+
+ return qla_get_fw_resources(sp->qpair, &sp->iores);
+}
+
int
qla2x00_start_sp(srb_t *sp)
{
@@ -3831,6 +3890,12 @@ qla2x00_start_sp(srb_t *sp)
return -EIO;
spin_lock_irqsave(qp->qp_lock_ptr, flags);
+ rval = qla_get_iocbs_resource(sp);
+ if (rval) {
+ spin_unlock_irqrestore(qp->qp_lock_ptr, flags);
+ return -EAGAIN;
+ }
+
pkt = __qla2x00_alloc_iocbs(sp->qpair, sp);
if (!pkt) {
rval = EAGAIN;
@@ -3931,6 +3996,8 @@ qla2x00_start_sp(srb_t *sp)
wmb();
qla2x00_start_iocbs(vha, qp->req);
done:
+ if (rval)
+ qla_put_fw_resources(sp->qpair, &sp->iores);
spin_unlock_irqrestore(qp->qp_lock_ptr, flags);
return rval;
}
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index c545f39362ffc..5589251c87f0a 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3099,6 +3099,7 @@ qla25xx_process_bidir_status_iocb(scsi_qla_host_t *vha, void *pkt,
}
bsg_reply->reply_payload_rcv_len = 0;
+ qla_put_fw_resources(sp->qpair, &sp->iores);
done:
/* Return the vendor specific reply to API */
bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = rval;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 187/567] ASoC: fsl_sai: Update to modern clocking terminology
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 186/567] scsi: qla2xxx: Fix exchange oversubscription for management commands Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 188/567] ASoC: fsl_sai: initialize is_dsp_mode flag Greg Kroah-Hartman
` (383 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Brown, Fabio Estevam, Sasha Levin
From: Mark Brown <broonie@kernel.org>
[ Upstream commit 361284a4eb598eaf28e8458c542f214d3689b134 ]
As part of moving to remove the old style defines for the bus clocks update
the fsl_sai driver to use more modern terminology for clocking.
Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Link: https://lore.kernel.org/r/20210921213542.31688-6-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: a23924b7dd7b ("ASoC: fsl_sai: initialize is_dsp_mode flag")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_sai.c | 34 +++++++++++++++++-----------------
sound/soc/fsl/fsl_sai.h | 2 +-
2 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
index 5ba06df2ace51..5ec504ff060a5 100644
--- a/sound/soc/fsl/fsl_sai.c
+++ b/sound/soc/fsl/fsl_sai.c
@@ -297,23 +297,23 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai,
return -EINVAL;
}
- /* DAI clock master masks */
- switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
- case SND_SOC_DAIFMT_CBS_CFS:
+ /* DAI clock provider masks */
+ switch (fmt & SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK) {
+ case SND_SOC_DAIFMT_CBC_CFC:
val_cr2 |= FSL_SAI_CR2_BCD_MSTR;
val_cr4 |= FSL_SAI_CR4_FSD_MSTR;
- sai->is_slave_mode = false;
+ sai->is_consumer_mode = false;
break;
- case SND_SOC_DAIFMT_CBM_CFM:
- sai->is_slave_mode = true;
+ case SND_SOC_DAIFMT_CBP_CFP:
+ sai->is_consumer_mode = true;
break;
- case SND_SOC_DAIFMT_CBS_CFM:
+ case SND_SOC_DAIFMT_CBC_CFP:
val_cr2 |= FSL_SAI_CR2_BCD_MSTR;
- sai->is_slave_mode = false;
+ sai->is_consumer_mode = false;
break;
- case SND_SOC_DAIFMT_CBM_CFS:
+ case SND_SOC_DAIFMT_CBP_CFC:
val_cr4 |= FSL_SAI_CR4_FSD_MSTR;
- sai->is_slave_mode = true;
+ sai->is_consumer_mode = true;
break;
default:
return -EINVAL;
@@ -356,8 +356,8 @@ static int fsl_sai_set_bclk(struct snd_soc_dai *dai, bool tx, u32 freq)
u32 id;
int ret = 0;
- /* Don't apply to slave mode */
- if (sai->is_slave_mode)
+ /* Don't apply to consumer mode */
+ if (sai->is_consumer_mode)
return 0;
/*
@@ -462,7 +462,7 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream,
pins = DIV_ROUND_UP(channels, slots);
- if (!sai->is_slave_mode) {
+ if (!sai->is_consumer_mode) {
if (sai->bclk_ratio)
ret = fsl_sai_set_bclk(cpu_dai, tx,
sai->bclk_ratio *
@@ -502,12 +502,12 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream,
val_cr4 |= FSL_SAI_CR4_CHMOD;
/*
- * For SAI master mode, when Tx(Rx) sync with Rx(Tx) clock, Rx(Tx) will
+ * For SAI provider mode, when Tx(Rx) sync with Rx(Tx) clock, Rx(Tx) will
* generate bclk and frame clock for Tx(Rx), we should set RCR4(TCR4),
* RCR5(TCR5) for playback(capture), or there will be sync error.
*/
- if (!sai->is_slave_mode && fsl_sai_dir_is_synced(sai, adir)) {
+ if (!sai->is_consumer_mode && fsl_sai_dir_is_synced(sai, adir)) {
regmap_update_bits(sai->regmap, FSL_SAI_xCR4(!tx, ofs),
FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK |
FSL_SAI_CR4_CHMOD_MASK,
@@ -543,7 +543,7 @@ static int fsl_sai_hw_free(struct snd_pcm_substream *substream,
regmap_update_bits(sai->regmap, FSL_SAI_xCR3(tx, ofs),
FSL_SAI_CR3_TRCE_MASK, 0);
- if (!sai->is_slave_mode &&
+ if (!sai->is_consumer_mode &&
sai->mclk_streams & BIT(substream->stream)) {
clk_disable_unprepare(sai->mclk_clk[sai->mclk_id[tx]]);
sai->mclk_streams &= ~BIT(substream->stream);
@@ -577,7 +577,7 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir)
* This is a hardware bug, and will be fix in the
* next sai version.
*/
- if (!sai->is_slave_mode) {
+ if (!sai->is_consumer_mode) {
/* Software Reset */
regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR);
/* Clear SR bit to finish the reset */
diff --git a/sound/soc/fsl/fsl_sai.h b/sound/soc/fsl/fsl_sai.h
index f471467dfb3e4..93da86009c750 100644
--- a/sound/soc/fsl/fsl_sai.h
+++ b/sound/soc/fsl/fsl_sai.h
@@ -259,7 +259,7 @@ struct fsl_sai {
struct clk *bus_clk;
struct clk *mclk_clk[FSL_SAI_MCLK_MAX];
- bool is_slave_mode;
+ bool is_consumer_mode;
bool is_lsb_first;
bool is_dsp_mode;
bool synchronous[2];
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 188/567] ASoC: fsl_sai: initialize is_dsp_mode flag
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 187/567] ASoC: fsl_sai: Update to modern clocking terminology Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 189/567] drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() Greg Kroah-Hartman
` (382 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shengjiu Wang, Iuliana Prodan,
Mark Brown, Sasha Levin
From: Shengjiu Wang <shengjiu.wang@nxp.com>
[ Upstream commit a23924b7dd7b748fff8e305e1daf590fed2af21b ]
Initialize is_dsp_mode flag in the beginning of function
fsl_sai_set_dai_fmt_tr().
When the DAIFMT is DAIFMT_DSP_B the first time, is_dsp_mode is
true, then the second time DAIFMT is DAIFMT_I2S, is_dsp_mode
still true, which is a wrong state. So need to initialize
is_dsp_mode flag every time.
Fixes: a3f7dcc9cc03 ("ASoC: fsl-sai: Add SND_SOC_DAIFMT_DSP_A/B support.")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Link: https://lore.kernel.org/r/1673852874-32200-1-git-send-email-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_sai.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
index 5ec504ff060a5..6a12cbd43084b 100644
--- a/sound/soc/fsl/fsl_sai.c
+++ b/sound/soc/fsl/fsl_sai.c
@@ -231,6 +231,7 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai,
if (!sai->is_lsb_first)
val_cr4 |= FSL_SAI_CR4_MF;
+ sai->is_dsp_mode = false;
/* DAI mode */
switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
case SND_SOC_DAIFMT_I2S:
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 189/567] drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 188/567] ASoC: fsl_sai: initialize is_dsp_mode flag Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 190/567] ALSA: hda/ca0132: minor fix for allocation size Greg Kroah-Hartman
` (381 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akhil P Oommen, Rob Clark, Sasha Levin
From: Akhil P Oommen <quic_akhilpo@quicinc.com>
[ Upstream commit dbeedbcb268d055d8895aceca427f897e12c2b50 ]
Fix the below kernel panic due to null pointer access:
[ 18.504431] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048
[ 18.513464] Mem abort info:
[ 18.516346] ESR = 0x0000000096000005
[ 18.520204] EC = 0x25: DABT (current EL), IL = 32 bits
[ 18.525706] SET = 0, FnV = 0
[ 18.528878] EA = 0, S1PTW = 0
[ 18.532117] FSC = 0x05: level 1 translation fault
[ 18.537138] Data abort info:
[ 18.540110] ISV = 0, ISS = 0x00000005
[ 18.544060] CM = 0, WnR = 0
[ 18.547109] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000112826000
[ 18.553738] [0000000000000048] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[ 18.562690] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
**Snip**
[ 18.696758] Call trace:
[ 18.699278] adreno_gpu_cleanup+0x30/0x88
[ 18.703396] a6xx_destroy+0xc0/0x130
[ 18.707066] a6xx_gpu_init+0x308/0x424
[ 18.710921] adreno_bind+0x178/0x288
[ 18.714590] component_bind_all+0xe0/0x214
[ 18.718797] msm_drm_bind+0x1d4/0x614
[ 18.722566] try_to_bring_up_aggregate_device+0x16c/0x1b8
[ 18.728105] __component_add+0xa0/0x158
[ 18.732048] component_add+0x20/0x2c
[ 18.735719] adreno_probe+0x40/0xc0
[ 18.739300] platform_probe+0xb4/0xd4
[ 18.743068] really_probe+0xfc/0x284
[ 18.746738] __driver_probe_device+0xc0/0xec
[ 18.751129] driver_probe_device+0x48/0x110
[ 18.755421] __device_attach_driver+0xa8/0xd0
[ 18.759900] bus_for_each_drv+0x90/0xdc
[ 18.763843] __device_attach+0xfc/0x174
[ 18.767786] device_initial_probe+0x20/0x2c
[ 18.772090] bus_probe_device+0x40/0xa0
[ 18.776032] deferred_probe_work_func+0x94/0xd0
[ 18.780686] process_one_work+0x190/0x3d0
[ 18.784805] worker_thread+0x280/0x3d4
[ 18.788659] kthread+0x104/0x1c0
[ 18.791981] ret_from_fork+0x10/0x20
[ 18.795654] Code: f9400408 aa0003f3 aa1f03f4 91142015 (f9402516)
[ 18.801913] ---[ end trace 0000000000000000 ]---
[ 18.809039] Kernel panic - not syncing: Oops: Fatal exception
Fixes: 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}")
Signed-off-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/515605/
Link: https://lore.kernel.org/r/20221221203925.v2.1.Ib978de92c4bd000b515486aad72e96c2481f84d0@changeid
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index bba68776cb25d..3fa01938f4b29 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -952,13 +952,13 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu)
{
struct msm_gpu *gpu = &adreno_gpu->base;
- struct msm_drm_private *priv = gpu->dev->dev_private;
+ struct msm_drm_private *priv = gpu->dev ? gpu->dev->dev_private : NULL;
unsigned int i;
for (i = 0; i < ARRAY_SIZE(adreno_gpu->info->fw); i++)
release_firmware(adreno_gpu->fw[i]);
- if (pm_runtime_enabled(&priv->gpu_pdev->dev))
+ if (priv && pm_runtime_enabled(&priv->gpu_pdev->dev))
pm_runtime_disable(&priv->gpu_pdev->dev);
msm_gpu_cleanup(&adreno_gpu->base);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 190/567] ALSA: hda/ca0132: minor fix for allocation size
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 189/567] drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 191/567] drm/msm/gem: Add check for kmalloc Greg Kroah-Hartman
` (380 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey V. Vissarionov, Takashi Iwai,
Sasha Levin
From: Alexey V. Vissarionov <gremlin@altlinux.org>
[ Upstream commit 3ee0fe7fa39b14d1cea455b7041f2df933bd97d2 ]
Although the "dma_chan" pointer occupies more or equal space compared
to "*dma_chan", the allocation size should use the size of variable
itself.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 01ef7dbffb41 ("ALSA: hda - Update CA0132 codec to load DSP firmware binary")
Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>
Link: https://lore.kernel.org/r/20230117111522.GA15213@altlinux.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_ca0132.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 801dd8d44953b..c0cb6e49a9b65 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -2455,7 +2455,7 @@ static int dspio_set_uint_param(struct hda_codec *codec, int mod_id,
static int dspio_alloc_dma_chan(struct hda_codec *codec, unsigned int *dma_chan)
{
int status = 0;
- unsigned int size = sizeof(dma_chan);
+ unsigned int size = sizeof(*dma_chan);
codec_dbg(codec, " dspio_alloc_dma_chan() -- begin\n");
status = dspio_scp(codec, MASTERCONTROL, 0x20,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 191/567] drm/msm/gem: Add check for kmalloc
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 190/567] ALSA: hda/ca0132: minor fix for allocation size Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 192/567] drm/msm/dpu: Disallow unallocated resources to be returned Greg Kroah-Hartman
` (379 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Dmitry Baryshkov,
Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit d839f0811a31322c087a859c2b181e2383daa7be ]
Add the check for the return value of kmalloc in order to avoid
NULL pointer dereference in copy_from_user.
Fixes: 20224d715a88 ("drm/msm/submit: Move copy_from_user ahead of locking bos")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/514678/
Link: https://lore.kernel.org/r/20221212091117.43511-1-jiasheng@iscas.ac.cn
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_gem_submit.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 1f74bab9e231a..83e6ccad77286 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -220,6 +220,10 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit,
goto out;
}
submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL);
+ if (!submit->cmd[i].relocs) {
+ ret = -ENOMEM;
+ goto out;
+ }
ret = copy_from_user(submit->cmd[i].relocs, userptr, sz);
if (ret) {
ret = -EFAULT;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 192/567] drm/msm/dpu: Disallow unallocated resources to be returned
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 191/567] drm/msm/gem: Add check for kmalloc Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 193/567] drm/bridge: lt9611: fix sleep mode setup Greg Kroah-Hartman
` (378 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marijn Suijten, Dmitry Baryshkov,
Sasha Levin
From: Marijn Suijten <marijn.suijten@somainline.org>
[ Upstream commit abc40122d9a69f56c04efb5a7485795f5ac799d1 ]
In the event that the topology requests resources that have not been
created by the system (because they are typically not represented in
dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC
blocks, until their allocation/assignment is being sanity-checked in
"drm/msm/dpu: Reject topologies for which no DSC blocks are available")
remain NULL but will still be returned out of
dpu_rm_get_assigned_resources, where the caller expects to get an array
containing num_blks valid pointers (but instead gets these NULLs).
To prevent this from happening, where null-pointer dereferences
typically result in a hard-to-debug platform lockup, num_blks shouldn't
increase past NULL blocks and will print an error and break instead.
After all, max_blks represents the static size of the maximum number of
blocks whereas the actual amount varies per platform.
^1: which can happen after a git rebase ended up moving additions to
_dpu_cfg to a different struct which has the same patch context.
Fixes: bb00a452d6f7 ("drm/msm/dpu: Refactor resource manager")
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/517636/
Link: https://lore.kernel.org/r/20230109231556.344977-1-marijn.suijten@somainline.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c
index 24fbaf562d418..932275b2dfe74 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c
@@ -663,6 +663,11 @@ int dpu_rm_get_assigned_resources(struct dpu_rm *rm,
blks_size, enc_id);
break;
}
+ if (!hw_blks[i]) {
+ DPU_ERROR("Allocated resource %d unavailable to assign to enc %d\n",
+ type, enc_id);
+ break;
+ }
blks[num_blks++] = hw_blks[i];
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 193/567] drm/bridge: lt9611: fix sleep mode setup
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 192/567] drm/msm/dpu: Disallow unallocated resources to be returned Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 194/567] drm/bridge: lt9611: fix HPD reenablement Greg Kroah-Hartman
` (377 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Dmitry Baryshkov,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit ae2d329f104b75a0a78dcaded29fe6283289cdf9 ]
On atomic_post_disable the bridge goes to the low power state. However
the code disables too much of the chip, so the HPD event is not being
detected and delivered to the host. Reduce the power saving in order to
get the HPD event.
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-2-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/lontium-lt9611.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
index 1dcc28a4d8537..5e5641ac5ea3d 100644
--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
+++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
@@ -446,12 +446,11 @@ static void lt9611_sleep_setup(struct lt9611 *lt9611)
{ 0x8023, 0x01 },
{ 0x8157, 0x03 }, /* set addr pin as output */
{ 0x8149, 0x0b },
- { 0x8151, 0x30 }, /* disable IRQ */
+
{ 0x8102, 0x48 }, /* MIPI Rx power down */
{ 0x8123, 0x80 },
{ 0x8130, 0x00 },
- { 0x8100, 0x01 }, /* bandgap power down */
- { 0x8101, 0x00 }, /* system clk power down */
+ { 0x8011, 0x0a },
};
regmap_multi_reg_write(lt9611->regmap,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 194/567] drm/bridge: lt9611: fix HPD reenablement
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 193/567] drm/bridge: lt9611: fix sleep mode setup Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 195/567] drm/bridge: lt9611: fix polarity programming Greg Kroah-Hartman
` (376 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Dmitry Baryshkov,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit a7790f6bd38f3642b60ae3504a2c749135b89451 ]
The driver will reset the bridge in the atomic_pre_enable(). However
this will also drop the HPD interrupt state. Instead of resetting the
bridge, properly wake it up. This fixes the HPD interrupt delivery after
the disable/enable cycle.
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-3-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/lontium-lt9611.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
index 5e5641ac5ea3d..fe660d667daf6 100644
--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
+++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
@@ -880,12 +880,18 @@ static enum drm_mode_status lt9611_bridge_mode_valid(struct drm_bridge *bridge,
static void lt9611_bridge_pre_enable(struct drm_bridge *bridge)
{
struct lt9611 *lt9611 = bridge_to_lt9611(bridge);
+ static const struct reg_sequence reg_cfg[] = {
+ { 0x8102, 0x12 },
+ { 0x8123, 0x40 },
+ { 0x8130, 0xea },
+ { 0x8011, 0xfa },
+ };
if (!lt9611->sleep)
return;
- lt9611_reset(lt9611);
- regmap_write(lt9611->regmap, 0x80ee, 0x01);
+ regmap_multi_reg_write(lt9611->regmap,
+ reg_cfg, ARRAY_SIZE(reg_cfg));
lt9611->sleep = false;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 195/567] drm/bridge: lt9611: fix polarity programming
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 194/567] drm/bridge: lt9611: fix HPD reenablement Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 196/567] drm/bridge: lt9611: fix programming of video modes Greg Kroah-Hartman
` (375 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Dmitry Baryshkov,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 0b157efa384ea417304b1da284ee2f603c607fc3 ]
Fix programming of hsync and vsync polarities
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-4-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/lontium-lt9611.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
index fe660d667daf6..4c56407c4cf04 100644
--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
+++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
@@ -205,7 +205,6 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod
/* stage 2 */
{ 0x834a, 0x40 },
- { 0x831d, 0x10 },
/* MK limit */
{ 0x832d, 0x38 },
@@ -220,11 +219,19 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod
{ 0x8325, 0x00 },
{ 0x832a, 0x01 },
{ 0x834a, 0x10 },
- { 0x831d, 0x10 },
- { 0x8326, 0x37 },
};
+ u8 pol = 0x10;
- regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
+ if (mode->flags & DRM_MODE_FLAG_NHSYNC)
+ pol |= 0x2;
+ if (mode->flags & DRM_MODE_FLAG_NVSYNC)
+ pol |= 0x1;
+ regmap_write(lt9611->regmap, 0x831d, pol);
+
+ if (mode->hdisplay == 3840)
+ regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2));
+ else
+ regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
switch (mode->hdisplay) {
case 640:
@@ -234,7 +241,7 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod
regmap_write(lt9611->regmap, 0x8326, 0x37);
break;
case 3840:
- regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2));
+ regmap_write(lt9611->regmap, 0x8326, 0x37);
break;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 196/567] drm/bridge: lt9611: fix programming of video modes
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 195/567] drm/bridge: lt9611: fix polarity programming Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 197/567] drm/bridge: lt9611: fix clock calculation Greg Kroah-Hartman
` (374 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Dmitry Baryshkov,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit ad188aa47edaa033a270e1a3efae43836ff47569 ]
Program the upper part of the hfront_porch into the proper register.
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-5-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/lontium-lt9611.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
index 4c56407c4cf04..4925566dfc54f 100644
--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
+++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
@@ -185,7 +185,8 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611,
regmap_write(lt9611->regmap, 0x8319, (u8)(hfront_porch % 256));
- regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256));
+ regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256) |
+ ((hfront_porch / 256) << 4));
regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256));
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 197/567] drm/bridge: lt9611: fix clock calculation
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 196/567] drm/bridge: lt9611: fix programming of video modes Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 198/567] drm/bridge: lt9611: pass a pointer to the of node Greg Kroah-Hartman
` (373 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Dmitry Baryshkov,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 2576eb26494eb0509dd9ceb0cd27771a7a5e3674 ]
Instead of having several fixed values for the pcr register, calculate
it before programming. This allows the bridge to support most of the
display modes.
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-6-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/lontium-lt9611.c | 32 +++++++++++--------------
1 file changed, 14 insertions(+), 18 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
index 4925566dfc54f..bb13511dd4263 100644
--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
+++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
@@ -190,8 +190,9 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611,
regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256));
}
-static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode)
+static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int postdiv)
{
+ unsigned int pcr_m = mode->clock * 5 * postdiv / 27000;
const struct reg_sequence reg_cfg[] = {
{ 0x830b, 0x01 },
{ 0x830c, 0x10 },
@@ -234,24 +235,14 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod
else
regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
- switch (mode->hdisplay) {
- case 640:
- regmap_write(lt9611->regmap, 0x8326, 0x14);
- break;
- case 1920:
- regmap_write(lt9611->regmap, 0x8326, 0x37);
- break;
- case 3840:
- regmap_write(lt9611->regmap, 0x8326, 0x37);
- break;
- }
+ regmap_write(lt9611->regmap, 0x8326, pcr_m);
/* pcr rst */
regmap_write(lt9611->regmap, 0x8011, 0x5a);
regmap_write(lt9611->regmap, 0x8011, 0xfa);
}
-static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode)
+static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int *postdiv)
{
unsigned int pclk = mode->clock;
const struct reg_sequence reg_cfg[] = {
@@ -269,12 +260,16 @@ static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode
regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
- if (pclk > 150000)
+ if (pclk > 150000) {
regmap_write(lt9611->regmap, 0x812d, 0x88);
- else if (pclk > 70000)
+ *postdiv = 1;
+ } else if (pclk > 70000) {
regmap_write(lt9611->regmap, 0x812d, 0x99);
- else
+ *postdiv = 2;
+ } else {
regmap_write(lt9611->regmap, 0x812d, 0xaa);
+ *postdiv = 4;
+ }
/*
* first divide pclk by 2 first
@@ -917,14 +912,15 @@ static void lt9611_bridge_mode_set(struct drm_bridge *bridge,
{
struct lt9611 *lt9611 = bridge_to_lt9611(bridge);
struct hdmi_avi_infoframe avi_frame;
+ unsigned int postdiv;
int ret;
lt9611_bridge_pre_enable(bridge);
lt9611_mipi_input_digital(lt9611, mode);
- lt9611_pll_setup(lt9611, mode);
+ lt9611_pll_setup(lt9611, mode, &postdiv);
lt9611_mipi_video_setup(lt9611, mode);
- lt9611_pcr_setup(lt9611, mode);
+ lt9611_pcr_setup(lt9611, mode, postdiv);
ret = drm_hdmi_avi_infoframe_from_display_mode(&avi_frame,
<9611->connector,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 198/567] drm/bridge: lt9611: pass a pointer to the of node
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 197/567] drm/bridge: lt9611: fix clock calculation Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 199/567] drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness Greg Kroah-Hartman
` (372 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Dmitry Baryshkov,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit b0a7f8736789935f62d6df32d441cdf05a5c05d2 ]
Pass a pointer to the OF node while registering lt9611 MIPI device.
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-7-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/lontium-lt9611.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
index bb13511dd4263..0c6dea9ccb728 100644
--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
+++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
@@ -759,7 +759,7 @@ static const struct drm_connector_funcs lt9611_bridge_connector_funcs = {
static struct mipi_dsi_device *lt9611_attach_dsi(struct lt9611 *lt9611,
struct device_node *dsi_node)
{
- const struct mipi_dsi_device_info info = { "lt9611", 0, NULL };
+ const struct mipi_dsi_device_info info = { "lt9611", 0, lt9611->dev->of_node};
struct mipi_dsi_device *dsi;
struct mipi_dsi_host *host;
int ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 199/567] drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 198/567] drm/bridge: lt9611: pass a pointer to the of node Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 200/567] drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags Greg Kroah-Hartman
` (371 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Mentz, Richard Acayan,
Caleb Connolly, Neil Armstrong, Sam Ravnborg, Sasha Levin
From: Daniel Mentz <danielmentz@google.com>
[ Upstream commit c9d27c6be518b4ef2966d9564654ef99292ea1b3 ]
The MIPI DCS specification demands that brightness values are sent in
big endian byte order. It also states that one parameter (i.e. one byte)
shall be sent/received for 8 bit wide values, and two parameters shall
be used for values that are between 9 and 16 bits wide.
Add new functions to properly handle 16-bit brightness in big endian,
since the two 8- and 16-bit cases are distinct from each other.
[richard: use separate functions instead of switch/case]
[richard: split into 16-bit component]
Fixes: 1a9d759331b8 ("drm/dsi: Implement DCS set/get display brightness")
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Link: https://android.googlesource.com/kernel/msm/+/754affd62d0ee268c686c53169b1dbb7deac8550
[richard: fix 16-bit brightness_get]
Signed-off-by: Richard Acayan <mailingradian@gmail.com>
Tested-by: Caleb Connolly <caleb@connolly.tech>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230116224909.23884-2-mailingradian@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_mipi_dsi.c | 52 ++++++++++++++++++++++++++++++++++
include/drm/drm_mipi_dsi.h | 4 +++
2 files changed, 56 insertions(+)
diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
index 2c43d54766f34..19fb1d93a4f07 100644
--- a/drivers/gpu/drm/drm_mipi_dsi.c
+++ b/drivers/gpu/drm/drm_mipi_dsi.c
@@ -1143,6 +1143,58 @@ int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi,
}
EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness);
+/**
+ * mipi_dsi_dcs_set_display_brightness_large() - sets the 16-bit brightness value
+ * of the display
+ * @dsi: DSI peripheral device
+ * @brightness: brightness value
+ *
+ * Return: 0 on success or a negative error code on failure.
+ */
+int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi,
+ u16 brightness)
+{
+ u8 payload[2] = { brightness >> 8, brightness & 0xff };
+ ssize_t err;
+
+ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_DISPLAY_BRIGHTNESS,
+ payload, sizeof(payload));
+ if (err < 0)
+ return err;
+
+ return 0;
+}
+EXPORT_SYMBOL(mipi_dsi_dcs_set_display_brightness_large);
+
+/**
+ * mipi_dsi_dcs_get_display_brightness_large() - gets the current 16-bit
+ * brightness value of the display
+ * @dsi: DSI peripheral device
+ * @brightness: brightness value
+ *
+ * Return: 0 on success or a negative error code on failure.
+ */
+int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi,
+ u16 *brightness)
+{
+ u8 brightness_be[2];
+ ssize_t err;
+
+ err = mipi_dsi_dcs_read(dsi, MIPI_DCS_GET_DISPLAY_BRIGHTNESS,
+ brightness_be, sizeof(brightness_be));
+ if (err <= 0) {
+ if (err == 0)
+ err = -ENODATA;
+
+ return err;
+ }
+
+ *brightness = (brightness_be[0] << 8) | brightness_be[1];
+
+ return 0;
+}
+EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness_large);
+
static int mipi_dsi_drv_probe(struct device *dev)
{
struct mipi_dsi_driver *drv = to_mipi_dsi_driver(dev->driver);
diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h
index af7ba8071eb08..1d263eb0b2e12 100644
--- a/include/drm/drm_mipi_dsi.h
+++ b/include/drm/drm_mipi_dsi.h
@@ -288,6 +288,10 @@ int mipi_dsi_dcs_set_display_brightness(struct mipi_dsi_device *dsi,
u16 brightness);
int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi,
u16 *brightness);
+int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi,
+ u16 brightness);
+int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi,
+ u16 *brightness);
/**
* struct mipi_dsi_driver - DSI driver
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 200/567] drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 199/567] drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 201/567] drm/msm/dsi: Allow 2 CTRLs on v2.5.0 Greg Kroah-Hartman
` (370 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Nicolas Boichat,
Sébastien Szymanski, Jagan Teki, Frieder Schrempf,
Sasha Levin
From: Jagan Teki <jagan@amarulasolutions.com>
[ Upstream commit 996e1defca34485dd2bd70b173f069aab5f21a65 ]
HFP/HBP/HSA/EOT_PACKET modes in Exynos DSI host specifies
0 = Enable and 1 = Disable.
The logic for checking these mode flags was correct before
the MIPI_DSI*_NO_* mode flag conversion.
This patch is trying to fix this MIPI_DSI*_NO_* mode flags handling
Exynos DSI host and update the mode_flags in relevant panel drivers.
Fixes: 0f3b68b66a6d ("drm/dsi: Add _NO_ to MIPI_DSI_* flags disabling features")
Reviewed-by: Marek Vasut <marex@denx.de>
Reviewed-by: Nicolas Boichat <drinkcat@chromium.org>
Reported-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Marek Vasut <marex@denx.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20221212145745.15387-1-jagan@amarulasolutions.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/exynos/exynos_drm_dsi.c | 8 ++++----
drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c | 4 +++-
drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c | 3 ++-
drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 --
4 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index 8d137857818ca..e0465b604f210 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -809,15 +809,15 @@ static int exynos_dsi_init_link(struct exynos_dsi *dsi)
reg |= DSIM_AUTO_MODE;
if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_HSE)
reg |= DSIM_HSE_MODE;
- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HFP))
+ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HFP)
reg |= DSIM_HFP_MODE;
- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HBP))
+ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HBP)
reg |= DSIM_HBP_MODE;
- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HSA))
+ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HSA)
reg |= DSIM_HSA_MODE;
}
- if (!(dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET))
+ if (dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET)
reg |= DSIM_EOT_DISABLE;
switch (dsi->format) {
diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
index 0ab1b7ec84cda..166d7d41cd9b5 100644
--- a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
+++ b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c
@@ -692,7 +692,9 @@ static int s6e3ha2_probe(struct mipi_dsi_device *dsi)
dsi->lanes = 4;
dsi->format = MIPI_DSI_FMT_RGB888;
- dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS;
+ dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS |
+ MIPI_DSI_MODE_VIDEO_NO_HFP | MIPI_DSI_MODE_VIDEO_NO_HBP |
+ MIPI_DSI_MODE_VIDEO_NO_HSA | MIPI_DSI_MODE_NO_EOT_PACKET;
ctx->supplies[0].supply = "vdd3";
ctx->supplies[1].supply = "vci";
diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
index ccc8ed6fe3aed..2fc46fdd0e7a0 100644
--- a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
+++ b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c
@@ -446,7 +446,8 @@ static int s6e63j0x03_probe(struct mipi_dsi_device *dsi)
dsi->lanes = 1;
dsi->format = MIPI_DSI_FMT_RGB888;
- dsi->mode_flags = MIPI_DSI_MODE_NO_EOT_PACKET;
+ dsi->mode_flags = MIPI_DSI_MODE_VIDEO_NO_HFP |
+ MIPI_DSI_MODE_VIDEO_NO_HBP | MIPI_DSI_MODE_VIDEO_NO_HSA;
ctx->supplies[0].supply = "vdd3";
ctx->supplies[1].supply = "vci";
diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
index 9b3599d6d2dea..737b8ca22b374 100644
--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
+++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c
@@ -990,8 +990,6 @@ static int s6e8aa0_probe(struct mipi_dsi_device *dsi)
dsi->lanes = 4;
dsi->format = MIPI_DSI_FMT_RGB888;
dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST
- | MIPI_DSI_MODE_VIDEO_NO_HFP | MIPI_DSI_MODE_VIDEO_NO_HBP
- | MIPI_DSI_MODE_VIDEO_NO_HSA | MIPI_DSI_MODE_NO_EOT_PACKET
| MIPI_DSI_MODE_VSYNC_FLUSH | MIPI_DSI_MODE_VIDEO_AUTO_VERT;
ret = s6e8aa0_parse_dt(ctx);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 201/567] drm/msm/dsi: Allow 2 CTRLs on v2.5.0
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 200/567] drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 202/567] drm/msm: use strscpy instead of strncpy Greg Kroah-Hartman
` (369 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Sasha Levin
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit 1ae654ded7c5a19dc13f57a4fe4434fef879b6f9 ]
v2.5.0 support was originally added for SC7280, but this hw is also
present on SM8350, which has one more DSI host. Bump up the dsi count
and fill in the register of the secondary host to allow it to probe.
This should not have any adverse effects on SC7280, as the secondary
CTRL will only be touched if it's defined, anyway.
Fixes: 65c391b31994 ("drm/msm/dsi: Add DSI support for SC7280")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/519513/
Link: https://lore.kernel.org/r/20230120210101.2146852-1-konrad.dybcio@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
index ce3901439c69c..68a3f8fea9fe6 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
@@ -209,8 +209,8 @@ static const struct msm_dsi_config sc7280_dsi_cfg = {
},
.bus_clk_names = dsi_sc7280_bus_clk_names,
.num_bus_clks = ARRAY_SIZE(dsi_sc7280_bus_clk_names),
- .io_start = { 0xae94000 },
- .num_dsi = 1,
+ .io_start = { 0xae94000, 0xae96000 },
+ .num_dsi = 2,
};
static const struct msm_dsi_host_cfg_ops msm_dsi_v2_host_ops = {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 202/567] drm/msm: use strscpy instead of strncpy
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 201/567] drm/msm/dsi: Allow 2 CTRLs on v2.5.0 Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:58 ` [PATCH 5.15 203/567] drm/msm/dpu: Add check for cstate Greg Kroah-Hartman
` (368 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Abhinav Kumar,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit d7fd8634f48d76aa799ed57beb7d87dab91bde80 ]
Using strncpy can result in non-NULL-terminated destination string. Use
strscpy instead. This fixes following warning:
drivers/gpu/drm/msm/msm_fence.c: In function ‘msm_fence_context_alloc’:
drivers/gpu/drm/msm/msm_fence.c:25:9: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation]
25 | strncpy(fctx->name, name, sizeof(fctx->name));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fixes: f97decac5f4c ("drm/msm: Support multiple ringbuffers")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/518787/
Link: https://lore.kernel.org/r/20230118020152.1689213-1-dmitry.baryshkov@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_fence.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c
index f2cece542c3f7..76439678919c2 100644
--- a/drivers/gpu/drm/msm/msm_fence.c
+++ b/drivers/gpu/drm/msm/msm_fence.c
@@ -21,7 +21,7 @@ msm_fence_context_alloc(struct drm_device *dev, volatile uint32_t *fenceptr,
return ERR_PTR(-ENOMEM);
fctx->dev = dev;
- strncpy(fctx->name, name, sizeof(fctx->name));
+ strscpy(fctx->name, name, sizeof(fctx->name));
fctx->context = dma_fence_context_alloc(1);
fctx->fenceptr = fenceptr;
spin_lock_init(&fctx->spinlock);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 203/567] drm/msm/dpu: Add check for cstate
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 202/567] drm/msm: use strscpy instead of strncpy Greg Kroah-Hartman
@ 2023-03-07 16:58 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 204/567] drm/msm/dpu: Add check for pstates Greg Kroah-Hartman
` (367 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Abhinav Kumar,
Dmitry Baryshkov, Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit c96988b7d99327bb08bd9efd29a203b22cd88ace ]
As kzalloc may fail and return NULL pointer,
it should be better to check cstate
in order to avoid the NULL pointer dereference
in __drm_atomic_helper_crtc_reset.
Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/514163/
Link: https://lore.kernel.org/r/20221206080517.43786-1-jiasheng@iscas.ac.cn
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
index 2186fc947e5b5..c76305beff6e5 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
@@ -770,7 +770,10 @@ static void dpu_crtc_reset(struct drm_crtc *crtc)
if (crtc->state)
dpu_crtc_destroy_state(crtc, crtc->state);
- __drm_atomic_helper_crtc_reset(crtc, &cstate->base);
+ if (cstate)
+ __drm_atomic_helper_crtc_reset(crtc, &cstate->base);
+ else
+ __drm_atomic_helper_crtc_reset(crtc, NULL);
}
/**
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 204/567] drm/msm/dpu: Add check for pstates
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2023-03-07 16:58 ` [PATCH 5.15 203/567] drm/msm/dpu: Add check for cstate Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 205/567] drm/msm/mdp5: Add check for kzalloc Greg Kroah-Hartman
` (366 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Abhinav Kumar,
Dmitry Baryshkov, Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit 93340e10b9c5fc86730d149636e0aa8b47bb5a34 ]
As kzalloc may fail and return NULL pointer,
it should be better to check pstates
in order to avoid the NULL pointer dereference.
Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/514160/
Link: https://lore.kernel.org/r/20221206080236.43687-1-jiasheng@iscas.ac.cn
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
index c76305beff6e5..4194689b6b35d 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
@@ -941,6 +941,8 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
bool needs_dirtyfb = dpu_crtc_needs_dirtyfb(crtc_state);
pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL);
+ if (!pstates)
+ return -ENOMEM;
if (!crtc_state->enable || !crtc_state->active) {
DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n",
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 205/567] drm/msm/mdp5: Add check for kzalloc
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 204/567] drm/msm/dpu: Add check for pstates Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 206/567] pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback() Greg Kroah-Hartman
` (365 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Dmitry Baryshkov,
Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit 13fcfcb2a9a4787fe4e49841d728f6f2e9fa6911 ]
As kzalloc may fail and return NULL pointer,
it should be better to check the return value
in order to avoid the NULL pointer dereference.
Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/514154/
Link: https://lore.kernel.org/r/20221206074819.18134-1-jiasheng@iscas.ac.cn
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
index 31447da0af25c..2b15f10eeae02 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
@@ -1138,7 +1138,10 @@ static void mdp5_crtc_reset(struct drm_crtc *crtc)
if (crtc->state)
mdp5_crtc_destroy_state(crtc, crtc->state);
- __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base);
+ if (mdp5_cstate)
+ __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base);
+ else
+ __drm_atomic_helper_crtc_reset(crtc, NULL);
}
static const struct drm_crtc_funcs mdp5_crtc_no_lm_cursor_funcs = {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 206/567] pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 205/567] drm/msm/mdp5: Add check for kzalloc Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 207/567] pinctrl: mediatek: fix coding style Greg Kroah-Hartman
` (364 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Stefan Wahren,
Florian Fainelli, Bartosz Golaszewski, Linus Walleij,
Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 2d578dd27871372f7159dd3206149ec616700d87 ]
Remove wrong of_node_put() in bcm2835_of_gpio_ranges_fallback(),
there is no counterpart of_node_get() for it.
Fixes: d2b67744fd99 ("pinctrl: bcm2835: implement hook for missing gpio-ranges")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Stefan Wahren <stefan.wahren@i2se.com>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://lore.kernel.org/r/20230113215352.44272-3-andriy.shevchenko@linux.intel.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index a2938995c7c14..2c10086fd155b 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -356,8 +356,6 @@ static int bcm2835_of_gpio_ranges_fallback(struct gpio_chip *gc,
{
struct pinctrl_dev *pctldev = of_pinctrl_get(np);
- of_node_put(np);
-
if (!pctldev)
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 207/567] pinctrl: mediatek: fix coding style
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 206/567] pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback() Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 208/567] pinctrl: mediatek: Initialize variable pullen and pullup to zero Greg Kroah-Hartman
` (363 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhiyong Tao, Chen-Yu Tsai,
Linus Walleij, Sasha Levin
From: Zhiyong Tao <zhiyong.tao@mediatek.com>
[ Upstream commit 25a74c0f4bf1338af29a32383fb4e1a960ec5063 ]
Fix Camel spelling coding style to avoid checkpatch
warning in a following patch.
Signed-off-by: Zhiyong Tao <zhiyong.tao@mediatek.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20210924080632.28410-4-zhiyong.tao@mediatek.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Stable-dep-of: a298c70a10c6 ("pinctrl: mediatek: Initialize variable pullen and pullup to zero")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/pinctrl-paris.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
index 02e2a259edd39..fc3487fccb948 100644
--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
+++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
@@ -572,7 +572,7 @@ static int mtk_hw_get_value_wrap(struct mtk_pinctrl *hw, unsigned int gpio, int
mtk_hw_get_value_wrap(hw, gpio, PINCTRL_PIN_REG_DRV)
ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
- unsigned int gpio, char *buf, unsigned int bufLen)
+ unsigned int gpio, char *buf, unsigned int buf_len)
{
int pinmux, pullup, pullen, len = 0, r1 = -1, r0 = -1;
const struct mtk_pin_desc *desc;
@@ -608,7 +608,7 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
} else if (pullen != MTK_DISABLE && pullen != MTK_ENABLE) {
pullen = 0;
}
- len += scnprintf(buf + len, bufLen - len,
+ len += scnprintf(buf + len, buf_len - len,
"%03d: %1d%1d%1d%1d%02d%1d%1d%1d%1d",
gpio,
pinmux,
@@ -622,10 +622,10 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
pullup);
if (r1 != -1) {
- len += scnprintf(buf + len, bufLen - len, " (%1d %1d)\n",
+ len += scnprintf(buf + len, buf_len - len, " (%1d %1d)\n",
r1, r0);
} else {
- len += scnprintf(buf + len, bufLen - len, "\n");
+ len += scnprintf(buf + len, buf_len - len, "\n");
}
return len;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 208/567] pinctrl: mediatek: Initialize variable pullen and pullup to zero
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 207/567] pinctrl: mediatek: fix coding style Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 209/567] pinctrl: mediatek: Initialize variable *buf " Greg Kroah-Hartman
` (362 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guodong Liu,
AngeloGioacchino Del Regno, Linus Walleij, Sasha Levin
From: Guodong Liu <Guodong.Liu@mediatek.com>
[ Upstream commit a298c70a10c604a6b3df5a0aa56597b705ba0f6b ]
Coverity spotted that pullen and pullup is not initialized to zero in
mtk_pctrl_show_one_pin. The uninitialized variable pullen is used in
assignment statement "rsel = pullen;" in mtk_pctrl_show_one_pin, and
Uninitialized variable pullup is used when calling scnprintf. Fix this
coverity by initializing pullen and pullup as zero.
Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.")
Signed-off-by: Guodong Liu <Guodong.Liu@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230118062036.26258-2-Guodong.Liu@mediatek.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
index fc3487fccb948..d151612f4a18c 100644
--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
+++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
@@ -574,7 +574,7 @@ static int mtk_hw_get_value_wrap(struct mtk_pinctrl *hw, unsigned int gpio, int
ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
unsigned int gpio, char *buf, unsigned int buf_len)
{
- int pinmux, pullup, pullen, len = 0, r1 = -1, r0 = -1;
+ int pinmux, pullup = 0, pullen = 0, len = 0, r1 = -1, r0 = -1;
const struct mtk_pin_desc *desc;
if (gpio >= hw->soc->npins)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 209/567] pinctrl: mediatek: Initialize variable *buf to zero
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 208/567] pinctrl: mediatek: Initialize variable pullen and pullup to zero Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 210/567] gpu: host1x: Dont skip assigning syncpoints to channels Greg Kroah-Hartman
` (361 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guodong Liu,
AngeloGioacchino Del Regno, Linus Walleij, Sasha Levin
From: Guodong Liu <Guodong.Liu@mediatek.com>
[ Upstream commit 2e34f82ba214134ecf590fbe0cdbd87401645a8a ]
Coverity spotted that *buf is not initialized to zero in
mtk_pctrl_dbg_show. Using uninitialized variable *buf as argument to %s
when calling seq_printf. Fix this coverity by initializing *buf as zero.
Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.")
Signed-off-by: Guodong Liu <Guodong.Liu@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230118062036.26258-3-Guodong.Liu@mediatek.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
index d151612f4a18c..0fa1c36148c23 100644
--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
+++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
@@ -637,7 +637,7 @@ static void mtk_pctrl_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s,
unsigned int gpio)
{
struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev);
- char buf[PIN_DBG_BUF_SZ];
+ char buf[PIN_DBG_BUF_SZ] = { 0 };
(void)mtk_pctrl_show_one_pin(hw, gpio, buf, PIN_DBG_BUF_SZ);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 210/567] gpu: host1x: Dont skip assigning syncpoints to channels
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 209/567] pinctrl: mediatek: Initialize variable *buf " Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 211/567] drm/tegra: firewall: Check for is_addr_reg existence in IMM check Greg Kroah-Hartman
` (360 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Thierry Reding,
Sasha Levin
From: Mikko Perttunen <mperttunen@nvidia.com>
[ Upstream commit eb258cc1fd458e584082be987dbc6ec42668c05e ]
The code to write the syncpoint channel assignment register
incorrectly skips the write if hypervisor registers are not available.
The register, however, is within the guest aperture so remove the
check and assign syncpoints properly even on virtualized systems.
Fixes: c3f52220f276 ("gpu: host1x: Enable Tegra186 syncpoint protection")
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/host1x/hw/syncpt_hw.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/gpu/host1x/hw/syncpt_hw.c b/drivers/gpu/host1x/hw/syncpt_hw.c
index dd39d67ccec36..8cf35b2eff3db 100644
--- a/drivers/gpu/host1x/hw/syncpt_hw.c
+++ b/drivers/gpu/host1x/hw/syncpt_hw.c
@@ -106,9 +106,6 @@ static void syncpt_assign_to_channel(struct host1x_syncpt *sp,
#if HOST1X_HW >= 6
struct host1x *host = sp->host;
- if (!host->hv_regs)
- return;
-
host1x_sync_writel(host,
HOST1X_SYNC_SYNCPT_CH_APP_CH(ch ? ch->id : 0xff),
HOST1X_SYNC_SYNCPT_CH_APP(sp->id));
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 211/567] drm/tegra: firewall: Check for is_addr_reg existence in IMM check
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 210/567] gpu: host1x: Dont skip assigning syncpoints to channels Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 212/567] drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update() Greg Kroah-Hartman
` (359 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikko Perttunen, Thierry Reding,
Sasha Levin
From: Mikko Perttunen <mperttunen@nvidia.com>
[ Upstream commit 1b5c09de25e8c08655c270a70e5e74e93b6bad1f ]
In the IMM opcode check, don't call is_addr_reg if it's not set.
Fixes: 8cc95f3fd35e ("drm/tegra: Add job firewall")
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/firewall.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/tegra/firewall.c b/drivers/gpu/drm/tegra/firewall.c
index 1824d2db0e2ce..d53f890fa6893 100644
--- a/drivers/gpu/drm/tegra/firewall.c
+++ b/drivers/gpu/drm/tegra/firewall.c
@@ -97,6 +97,9 @@ static int fw_check_regs_imm(struct tegra_drm_firewall *fw, u32 offset)
{
bool is_addr;
+ if (!fw->client->ops->is_addr_reg)
+ return 0;
+
is_addr = fw->client->ops->is_addr_reg(fw->client->base.dev, fw->class,
offset);
if (is_addr)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 212/567] drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 211/567] drm/tegra: firewall: Check for is_addr_reg existence in IMM check Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 213/567] drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd Greg Kroah-Hartman
` (358 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Abhinav Kumar,
Sasha Levin
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 1d233b1cb149ec78c20fac58331b27bb460f9558 ]
The function dpu_plane_sspp_atomic_update() updates pdpu->is_rt_pipe
flag, but after the commit 854f6f1c653b ("drm/msm/dpu: update the qos
remap only if the client type changes") it sets the flag late, after all
the qos functions have updated QoS programming. Move the flag update
back to the place where it happened before the mentioned commit to let
the pipe be programmed according to its current RT/non-RT state.
Fixes: 854f6f1c653b ("drm/msm/dpu: update the qos remap only if the client type changes")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/516239/
Link: https://lore.kernel.org/r/20221229191856.3508092-2-dmitry.baryshkov@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
index e32fe89c203cd..59390dc3d1b8c 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
@@ -1089,7 +1089,7 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane)
struct dpu_plane_state *pstate = to_dpu_plane_state(state);
struct drm_crtc *crtc = state->crtc;
struct drm_framebuffer *fb = state->fb;
- bool is_rt_pipe, update_qos_remap;
+ bool is_rt_pipe;
const struct dpu_format *fmt =
to_dpu_format(msm_framebuffer_format(fb));
@@ -1100,6 +1100,9 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane)
pstate->pending = true;
is_rt_pipe = (dpu_crtc_get_client_type(crtc) != NRT_CLIENT);
+ pstate->needs_qos_remap |= (is_rt_pipe != pdpu->is_rt_pipe);
+ pdpu->is_rt_pipe = is_rt_pipe;
+
_dpu_plane_set_qos_ctrl(plane, false, DPU_PLANE_QOS_PANIC_CTRL);
DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FP_FMT "->crtc%u " DRM_RECT_FMT
@@ -1205,14 +1208,8 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane)
_dpu_plane_set_ot_limit(plane, crtc);
}
- update_qos_remap = (is_rt_pipe != pdpu->is_rt_pipe) ||
- pstate->needs_qos_remap;
-
- if (update_qos_remap) {
- if (is_rt_pipe != pdpu->is_rt_pipe)
- pdpu->is_rt_pipe = is_rt_pipe;
- else if (pstate->needs_qos_remap)
- pstate->needs_qos_remap = false;
+ if (pstate->needs_qos_remap) {
+ pstate->needs_qos_remap = false;
_dpu_plane_set_qos_remap(plane);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 213/567] drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 212/567] drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update() Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 214/567] drm/mediatek: Use NULL instead of 0 for NULL pointer Greg Kroah-Hartman
` (357 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xinlei Lee, Sam Ravnborg,
AngeloGioacchino Del Regno, Chun-Kuang Hu, Sasha Levin
From: Xinlei Lee <xinlei.lee@mediatek.com>
[ Upstream commit 91aeaed2c1147e3b1157dc084d23f190856a6c23 ]
According to Figure 16 Turnaround Procedure on page 36 in [1], you
can see the status of LP-00 -> LP10 -> LP11. This state can correspond
to the state of DSI from LP00 -> LP11 in mtk_dsi_lane_ready function
in mtk_dsi.c.
LP-00 -> LP10 -> LP11 takes about 2*TLPX time (refer to [1] page 51
to see that TLPX is 50ns)
The delay at the end of the mtk_dsi_lane_ready function should be
greater than the 2*TLPX specified by the DSI spec, and less than
the time specified by the DSI_RX (generally 6ms to 40ms), to avoid
problems caused by the RX specification
[1]:mipi_D-PHY_specification_v1-1
Fixes: 39e8d062b03c ("drm/mediatek: Keep dsi as LP00 before dcs cmds transfer")
Signed-off-by: Xinlei Lee <xinlei.lee@mediatek.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/1673330093-6771-2-git-send-email-xinlei.lee@mediatek.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mediatek/mtk_dsi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index a6d28533f1b12..98b1204c92906 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -709,7 +709,7 @@ static void mtk_dsi_lane_ready(struct mtk_dsi *dsi)
mtk_dsi_clk_ulp_mode_leave(dsi);
mtk_dsi_lane0_ulp_mode_leave(dsi);
mtk_dsi_clk_hs_mode(dsi, 0);
- msleep(20);
+ usleep_range(1000, 3000);
/* The reaction time after pulling up the mipi signal for dsi_rx */
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 214/567] drm/mediatek: Use NULL instead of 0 for NULL pointer
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 213/567] drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 215/567] drm/mediatek: Drop unbalanced obj unref Greg Kroah-Hartman
` (356 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miles Chen,
AngeloGioacchino Del Regno, Chun-Kuang Hu, Sasha Levin
From: Miles Chen <miles.chen@mediatek.com>
[ Upstream commit 4744cde06f57dd6fbaac468663b1fe2f653eaa16 ]
Use NULL for NULL pointer to fix the following sparse warning:
drivers/gpu/drm/mediatek/mtk_drm_gem.c:265:27: sparse: warning: Using plain integer as NULL pointer
Fixes: 3df64d7b0a4f ("drm/mediatek: Implement gem prime vmap/vunmap function")
Signed-off-by: Miles Chen <miles.chen@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230111024443.24559-1-miles.chen@mediatek.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
index d0544962cfc1a..fd85e6bfb9545 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
@@ -261,6 +261,6 @@ void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, struct dma_buf_map *ma
return;
vunmap(vaddr);
- mtk_gem->kvaddr = 0;
+ mtk_gem->kvaddr = NULL;
kfree(mtk_gem->pages);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 215/567] drm/mediatek: Drop unbalanced obj unref
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 214/567] drm/mediatek: Use NULL instead of 0 for NULL pointer Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 216/567] drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc Greg Kroah-Hartman
` (355 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rob Clark, Chun-Kuang Hu, Sasha Levin
From: Rob Clark <robdclark@chromium.org>
[ Upstream commit 4deef811828e87e26a978d5d6433b261d4713849 ]
In the error path, mtk_drm_gem_object_mmap() is dropping an obj
reference that it doesn't own.
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230119231255.2883365-1-robdclark@gmail.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
index fd85e6bfb9545..726a34c4725c4 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
@@ -164,8 +164,6 @@ static int mtk_drm_gem_object_mmap(struct drm_gem_object *obj,
ret = dma_mmap_attrs(priv->dma_dev, vma, mtk_gem->cookie,
mtk_gem->dma_addr, obj->size, mtk_gem->dma_attrs);
- if (ret)
- drm_gem_vm_close(vma);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 216/567] drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 215/567] drm/mediatek: Drop unbalanced obj unref Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 217/567] drm/mediatek: Clean dangling pointer on bind error path Greg Kroah-Hartman
` (354 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie,
AngeloGioacchino Del Regno, Chun-Kuang Hu, Sasha Levin
From: ruanjinjie <ruanjinjie@huawei.com>
[ Upstream commit 5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c ]
As the devm_kcalloc may return NULL, the return value needs to be checked
to avoid NULL poineter dereference.
Fixes: 31c5558dae05 ("drm/mediatek: Refactor plane init")
Signed-off-by: ruanjinjie <ruanjinjie@huawei.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221205095115.2905090-1-ruanjinjie@huawei.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index 34bb6c713a908..6497c9fcd2af7 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -889,6 +889,8 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
mtk_crtc->planes = devm_kcalloc(dev, num_comp_planes,
sizeof(struct drm_plane), GFP_KERNEL);
+ if (!mtk_crtc->planes)
+ return -ENOMEM;
for (i = 0; i < mtk_crtc->ddp_comp_nr; i++) {
ret = mtk_drm_crtc_init_comp_planes(drm_dev, mtk_crtc, i,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 217/567] drm/mediatek: Clean dangling pointer on bind error path
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 216/567] drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 218/567] ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() Greg Kroah-Hartman
` (353 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nícolas F . R . A . Prado,
AngeloGioacchino Del Regno, Chun-Kuang Hu, Sasha Levin
From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
[ Upstream commit 36aa8c61af55675ed967900fbe5deb32d776f051 ]
mtk_drm_bind() can fail, in which case drm_dev_put() is called,
destroying the drm_device object. However a pointer to it was still
being held in the private object, and that pointer would be passed along
to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that
point, resulting in a panic. Clean the pointer when destroying the
object in the error path to prevent this from happening.
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221122143949.3493104-1-nfraprado@collabora.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
index aec39724ebeb6..8b3928c2c7d78 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -376,6 +376,7 @@ static int mtk_drm_bind(struct device *dev)
err_deinit:
mtk_drm_kms_deinit(drm);
err_free:
+ private->drm = NULL;
drm_dev_put(drm);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 218/567] ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 217/567] drm/mediatek: Clean dangling pointer on bind error path Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 219/567] gpio: vf610: connect GPIO label to dev name Greg Kroah-Hartman
` (352 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Charles Keepax,
Pierre-Louis Bossart, Kuninori Morimoto, Mark Brown, Sasha Levin
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
[ Upstream commit ffe4c0f0bfaa571a676a0e946d4a6a0607f94294 ]
commit d3268a40d4b19f ("ASoC: soc-compress.c: fix NULL dereference")
enables DPCM capture, but it should independent from playback.
This patch fixup it.
Fixes: d3268a40d4b1 ("ASoC: soc-compress.c: fix NULL dereference")
Link: https://lore.kernel.org/r/87tu0i6j7j.wl-kuninori.morimoto.gx@renesas.com
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/871qnkvo1s.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-compress.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index 2050728063a15..e352b06a7b7a3 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -590,7 +590,7 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
rtd->fe_compr = 1;
if (rtd->dai_link->dpcm_playback)
be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
- else if (rtd->dai_link->dpcm_capture)
+ if (rtd->dai_link->dpcm_capture)
be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops));
} else {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 219/567] gpio: vf610: connect GPIO label to dev name
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 218/567] ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 220/567] spi: dw_bt1: fix MUX_MMIO dependencies Greg Kroah-Hartman
` (351 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Clark Wang, Haibo Chen,
Linus Walleij, Bartosz Golaszewski, Sasha Levin
From: Haibo Chen <haibo.chen@nxp.com>
[ Upstream commit 6f8ecb7f85f441eb7d78ba2a4df45ee8a821934e ]
Current GPIO label is fixed, so can't distinguish different GPIO
controllers through labels. Use dev name instead.
Fixes: 7f2691a19627 ("gpio: vf610: add gpiolib/IRQ chip driver for Vybrid")
Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-vf610.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index 47e191e11c696..edb28af7ba3b0 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -304,7 +304,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
gc = &port->gc;
gc->of_node = np;
gc->parent = dev;
- gc->label = "vf610-gpio";
+ gc->label = dev_name(dev);
gc->ngpio = VF610_GPIO_PER_PORT;
gc->base = of_alias_get_id(np, "gpio") * VF610_GPIO_PER_PORT;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 220/567] spi: dw_bt1: fix MUX_MMIO dependencies
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 219/567] gpio: vf610: connect GPIO label to dev name Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 221/567] ASoC: mchp-spdifrx: fix controls which rely on rsr register Greg Kroah-Hartman
` (350 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Serge Semin,
Mark Brown, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit d4bde04318c0d33705e9a77d4c7df72f262011e0 ]
Selecting a symbol with additional dependencies requires
adding the same dependency here:
WARNING: unmet direct dependencies detected for MUX_MMIO
Depends on [n]: MULTIPLEXER [=y] && OF [=n]
Selected by [y]:
- SPI_DW_BT1 [=y] && SPI [=y] && SPI_MASTER [=y] && SPI_DESIGNWARE [=y] && (MIPS_BAIKAL_T1 || COMPILE_TEST [=y])
Drop the 'select' here to avoid the problem. Anyone using
the dw-bt1 SPI driver should make sure they include the
mux driver as well now.
Fixes: 7218838109fe ("spi: dw-bt1: Fix undefined devm_mux_control_get symbol")
Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
Link: https://lore.kernel.org/all/20221218192523.c6vnfo26ua6xqf26@mobilestation/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Link: https://lore.kernel.org/r/20230130140156.3620863-1-arnd@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/Kconfig | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 83e352b0c8f9a..4fc23236d3bd2 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -272,7 +272,6 @@ config SPI_DW_BT1
tristate "Baikal-T1 SPI driver for DW SPI core"
depends on MIPS_BAIKAL_T1 || COMPILE_TEST
select MULTIPLEXER
- select MUX_MMIO
help
Baikal-T1 SoC is equipped with three DW APB SSI-based MMIO SPI
controllers. Two of them are pretty much normal: with IRQ, DMA,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 221/567] ASoC: mchp-spdifrx: fix controls which rely on rsr register
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 220/567] spi: dw_bt1: fix MUX_MMIO dependencies Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 222/567] ASoC: mchp-spdifrx: fix return value in case completion times out Greg Kroah-Hartman
` (349 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Mark Brown, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit fa09fa60385abbf99342494b280da8b4aebbc0e9 ]
The SPDIFRX block is clocked by 2 clocks: peripheral and generic clocks.
Peripheral clock feeds user interface (registers) and generic clock feeds
the receiver.
To enable the receiver the generic clock needs to be enabled and also the
ENABLE bit of MCHP_SPDIFRX_MR register need to be set.
The signal control exported by mchp-spdifrx driver reports wrong status
when the receiver is disabled. This can happen when requesting the signal
and the capture was not previously started. To solve this the receiver
needs to be enabled (by enabling generic clock and setting ENABLE bit of
MR register) before reading the signal status.
As with this fix there are 2 paths now that need to control the generic
clock and ENABLE bit of SPDIFRX_MR register (one path though controls, one
path though configuration) a mutex has been introduced. We can't rely on
subsystem locking as the controls are protected by
struct snd_card::controls_rwsem semaphore and configuration is protected
by a different lock (embedded in snd_pcm_stream_lock_irq()).
The introduction of mutex is also extended to other controls which rely on
SPDIFRX_RSR.ULOCK bit as it has been discovered experimentally that having
both clocks enabled but not the receiver (through ENABLE bit of SPDIFRX.MR)
leads to inconsistent values of SPDIFRX_RSR.ULOCK. Thus on some controls we
rely on software state (dev->trigger_enabled protected by mutex) to
retrieve proper values.
Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230130120647.638049-2-claudiu.beznea@microchip.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/atmel/mchp-spdifrx.c | 192 ++++++++++++++++++++++++---------
1 file changed, 142 insertions(+), 50 deletions(-)
diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c
index 2a62d9a2fa0d0..3962ce00ad34a 100644
--- a/sound/soc/atmel/mchp-spdifrx.c
+++ b/sound/soc/atmel/mchp-spdifrx.c
@@ -233,11 +233,13 @@ struct mchp_spdifrx_dev {
struct mchp_spdifrx_mixer_control control;
spinlock_t blockend_lock; /* protect access to blockend_refcount */
int blockend_refcount;
+ struct mutex mlock;
struct device *dev;
struct regmap *regmap;
struct clk *pclk;
struct clk *gclk;
unsigned int fmt;
+ unsigned int trigger_enabled;
unsigned int gclk_enabled:1;
};
@@ -353,47 +355,40 @@ static int mchp_spdifrx_trigger(struct snd_pcm_substream *substream, int cmd,
struct snd_soc_dai *dai)
{
struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
- u32 mr;
- int running;
- int ret;
-
- regmap_read(dev->regmap, SPDIFRX_MR, &mr);
- running = !!(mr & SPDIFRX_MR_RXEN_ENABLE);
+ int ret = 0;
switch (cmd) {
case SNDRV_PCM_TRIGGER_START:
case SNDRV_PCM_TRIGGER_RESUME:
case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
- if (!running) {
- mr &= ~SPDIFRX_MR_RXEN_MASK;
- mr |= SPDIFRX_MR_RXEN_ENABLE;
- /* enable overrun interrupts */
- regmap_write(dev->regmap, SPDIFRX_IER,
- SPDIFRX_IR_OVERRUN);
- }
+ mutex_lock(&dev->mlock);
+ /* Enable overrun interrupts */
+ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_OVERRUN);
+
+ /* Enable receiver. */
+ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK,
+ SPDIFRX_MR_RXEN_ENABLE);
+ dev->trigger_enabled = true;
+ mutex_unlock(&dev->mlock);
break;
case SNDRV_PCM_TRIGGER_STOP:
case SNDRV_PCM_TRIGGER_SUSPEND:
case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
- if (running) {
- mr &= ~SPDIFRX_MR_RXEN_MASK;
- mr |= SPDIFRX_MR_RXEN_DISABLE;
- /* disable overrun interrupts */
- regmap_write(dev->regmap, SPDIFRX_IDR,
- SPDIFRX_IR_OVERRUN);
- }
+ mutex_lock(&dev->mlock);
+ /* Disable overrun interrupts */
+ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_OVERRUN);
+
+ /* Disable receiver. */
+ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK,
+ SPDIFRX_MR_RXEN_DISABLE);
+ dev->trigger_enabled = false;
+ mutex_unlock(&dev->mlock);
break;
default:
- return -EINVAL;
+ ret = -EINVAL;
}
- ret = regmap_write(dev->regmap, SPDIFRX_MR, mr);
- if (ret) {
- dev_err(dev->dev, "unable to enable/disable RX: %d\n", ret);
- return ret;
- }
-
- return 0;
+ return ret;
}
static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream,
@@ -413,13 +408,6 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream,
return -EINVAL;
}
- regmap_read(dev->regmap, SPDIFRX_MR, &mr);
-
- if (mr & SPDIFRX_MR_RXEN_ENABLE) {
- dev_err(dev->dev, "PCM already running\n");
- return -EBUSY;
- }
-
if (params_channels(params) != SPDIFRX_CHANNELS) {
dev_err(dev->dev, "unsupported number of channels: %d\n",
params_channels(params));
@@ -445,6 +433,13 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream,
return -EINVAL;
}
+ mutex_lock(&dev->mlock);
+ if (dev->trigger_enabled) {
+ dev_err(dev->dev, "PCM already running\n");
+ ret = -EBUSY;
+ goto unlock;
+ }
+
if (dev->gclk_enabled) {
clk_disable_unprepare(dev->gclk);
dev->gclk_enabled = 0;
@@ -455,19 +450,24 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream,
dev_err(dev->dev,
"unable to set gclk min rate: rate %u * ratio %u + 1\n",
params_rate(params), SPDIFRX_GCLK_RATIO_MIN);
- return ret;
+ goto unlock;
}
ret = clk_prepare_enable(dev->gclk);
if (ret) {
dev_err(dev->dev, "unable to enable gclk: %d\n", ret);
- return ret;
+ goto unlock;
}
dev->gclk_enabled = 1;
dev_dbg(dev->dev, "GCLK range min set to %d\n",
params_rate(params) * SPDIFRX_GCLK_RATIO_MIN + 1);
- return regmap_write(dev->regmap, SPDIFRX_MR, mr);
+ ret = regmap_write(dev->regmap, SPDIFRX_MR, mr);
+
+unlock:
+ mutex_unlock(&dev->mlock);
+
+ return ret;
}
static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream,
@@ -475,10 +475,12 @@ static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream,
{
struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
+ mutex_lock(&dev->mlock);
if (dev->gclk_enabled) {
clk_disable_unprepare(dev->gclk);
dev->gclk_enabled = 0;
}
+ mutex_unlock(&dev->mlock);
return 0;
}
@@ -627,10 +629,24 @@ static int mchp_spdifrx_ulock_get(struct snd_kcontrol *kcontrol,
u32 val;
bool ulock_old = ctrl->ulock;
- regmap_read(dev->regmap, SPDIFRX_RSR, &val);
- ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK);
+ mutex_lock(&dev->mlock);
+
+ /*
+ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled
+ * and the receiver is disabled. Thus we take into account the
+ * dev->trigger_enabled here to return a real status.
+ */
+ if (dev->trigger_enabled) {
+ regmap_read(dev->regmap, SPDIFRX_RSR, &val);
+ ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK);
+ } else {
+ ctrl->ulock = 0;
+ }
+
uvalue->value.integer.value[0] = ctrl->ulock;
+ mutex_unlock(&dev->mlock);
+
return ulock_old != ctrl->ulock;
}
@@ -643,8 +659,22 @@ static int mchp_spdifrx_badf_get(struct snd_kcontrol *kcontrol,
u32 val;
bool badf_old = ctrl->badf;
- regmap_read(dev->regmap, SPDIFRX_RSR, &val);
- ctrl->badf = !!(val & SPDIFRX_RSR_BADF);
+ mutex_lock(&dev->mlock);
+
+ /*
+ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled
+ * and the receiver is disabled. Thus we take into account the
+ * dev->trigger_enabled here to return a real status.
+ */
+ if (dev->trigger_enabled) {
+ regmap_read(dev->regmap, SPDIFRX_RSR, &val);
+ ctrl->badf = !!(val & SPDIFRX_RSR_BADF);
+ } else {
+ ctrl->badf = 0;
+ }
+
+ mutex_unlock(&dev->mlock);
+
uvalue->value.integer.value[0] = ctrl->badf;
return badf_old != ctrl->badf;
@@ -656,11 +686,48 @@ static int mchp_spdifrx_signal_get(struct snd_kcontrol *kcontrol,
struct snd_soc_dai *dai = snd_kcontrol_chip(kcontrol);
struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
struct mchp_spdifrx_mixer_control *ctrl = &dev->control;
- u32 val;
+ u32 val = ~0U, loops = 10;
+ int ret;
bool signal_old = ctrl->signal;
- regmap_read(dev->regmap, SPDIFRX_RSR, &val);
- ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL);
+ mutex_lock(&dev->mlock);
+
+ /*
+ * To get the signal we need to have receiver enabled. This
+ * could be enabled also from trigger() function thus we need to
+ * take care of not disabling the receiver when it runs.
+ */
+ if (!dev->trigger_enabled) {
+ ret = clk_prepare_enable(dev->gclk);
+ if (ret)
+ goto unlock;
+
+ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK,
+ SPDIFRX_MR_RXEN_ENABLE);
+
+ /* Wait for RSR.ULOCK bit. */
+ while (--loops) {
+ regmap_read(dev->regmap, SPDIFRX_RSR, &val);
+ if (!(val & SPDIFRX_RSR_ULOCK))
+ break;
+ usleep_range(100, 150);
+ }
+
+ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK,
+ SPDIFRX_MR_RXEN_DISABLE);
+
+ clk_disable_unprepare(dev->gclk);
+ } else {
+ regmap_read(dev->regmap, SPDIFRX_RSR, &val);
+ }
+
+unlock:
+ mutex_unlock(&dev->mlock);
+
+ if (!(val & SPDIFRX_RSR_ULOCK))
+ ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL);
+ else
+ ctrl->signal = 0;
uvalue->value.integer.value[0] = ctrl->signal;
return signal_old != ctrl->signal;
@@ -685,18 +752,32 @@ static int mchp_spdifrx_rate_get(struct snd_kcontrol *kcontrol,
u32 val;
int rate;
- regmap_read(dev->regmap, SPDIFRX_RSR, &val);
-
- /* if the receiver is not locked, ISF data is invalid */
- if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) {
+ mutex_lock(&dev->mlock);
+
+ /*
+ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled
+ * and the receiver is disabled. Thus we take into account the
+ * dev->trigger_enabled here to return a real status.
+ */
+ if (dev->trigger_enabled) {
+ regmap_read(dev->regmap, SPDIFRX_RSR, &val);
+ /* If the receiver is not locked, ISF data is invalid. */
+ if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) {
+ ucontrol->value.integer.value[0] = 0;
+ goto unlock;
+ }
+ } else {
+ /* Reveicer is not locked, IFS data is invalid. */
ucontrol->value.integer.value[0] = 0;
- return 0;
+ goto unlock;
}
rate = clk_get_rate(dev->gclk);
ucontrol->value.integer.value[0] = rate / (32 * SPDIFRX_RSR_IFS(val));
+unlock:
+ mutex_unlock(&dev->mlock);
return 0;
}
@@ -912,7 +993,18 @@ static int mchp_spdifrx_probe(struct platform_device *pdev)
"failed to get the PMC generated clock: %d\n", err);
return err;
}
+
+ /*
+ * Signal control need a valid rate on gclk. hw_params() configures
+ * it propertly but requesting signal before any hw_params() has been
+ * called lead to invalid value returned for signal. Thus, configure
+ * gclk at a valid rate, here, in initialization, to simplify the
+ * control path.
+ */
+ clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1);
+
spin_lock_init(&dev->blockend_lock);
+ mutex_init(&dev->mlock);
dev->dev = &pdev->dev;
dev->regmap = regmap;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 222/567] ASoC: mchp-spdifrx: fix return value in case completion times out
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 221/567] ASoC: mchp-spdifrx: fix controls which rely on rsr register Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 223/567] ASoC: mchp-spdifrx: fix controls that works with completion mechanism Greg Kroah-Hartman
` (348 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Mark Brown, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit a4c4161d6eae3ef5f486d1638ef452d9bc1376b0 ]
wait_for_completion_interruptible_timeout() returns 0 in case of
timeout. Check this into account when returning from function.
Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230130120647.638049-3-claudiu.beznea@microchip.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/atmel/mchp-spdifrx.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c
index 3962ce00ad34a..076a78fd0b125 100644
--- a/sound/soc/atmel/mchp-spdifrx.c
+++ b/sound/soc/atmel/mchp-spdifrx.c
@@ -524,9 +524,10 @@ static int mchp_spdifrx_cs_get(struct mchp_spdifrx_dev *dev,
ret = wait_for_completion_interruptible_timeout(&ch_stat->done,
msecs_to_jiffies(100));
/* IP might not be started or valid stream might not be present */
- if (ret < 0) {
+ if (ret <= 0) {
dev_dbg(dev->dev, "channel status for channel %d timeout\n",
channel);
+ return ret ? : -ETIMEDOUT;
}
memcpy(uvalue->value.iec958.status, ch_stat->data,
@@ -580,7 +581,7 @@ static int mchp_spdifrx_subcode_ch_get(struct mchp_spdifrx_dev *dev,
dev_dbg(dev->dev, "user data for channel %d timeout\n",
channel);
mchp_spdifrx_isr_blockend_dis(dev);
- return ret;
+ return ret ? : -ETIMEDOUT;
}
spin_lock_irqsave(&user_data->lock, flags);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 223/567] ASoC: mchp-spdifrx: fix controls that works with completion mechanism
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 222/567] ASoC: mchp-spdifrx: fix return value in case completion times out Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 224/567] ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove() Greg Kroah-Hartman
` (347 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Mark Brown, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit d3681df44e856aab523a6eb7ba15b5e41efcbb1c ]
Channel status get and channel subcode get controls relies on data
returned by controls when certain IRQs are raised. To achieve that
completions are used b/w controls and interrupt service routine. The
concurrent accesses to these controls are protected by
struct snd_card::controls_rwsem.
Issues identified:
- reinit_completion() may be called while waiting for completion
which should be avoided
- in case of multiple threads waiting, the complete() call in interrupt
will signal only one waiting thread per interrupt which may lead to
timeout for the others
- in case of channel status get as the CSC interrupt is not refcounted
ISR may disable interrupt for threads that were just enabled it.
To solve these the access to controls were protected by a mutex. Along
with this there is no need for spinlock to protect the software cache
reads/updates b/w controls and ISR as the update is happening only when
requested from control, and only one reader can reach the control.
Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230130120647.638049-4-claudiu.beznea@microchip.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/atmel/mchp-spdifrx.c | 143 ++++++++++++++++++---------------
1 file changed, 77 insertions(+), 66 deletions(-)
diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c
index 076a78fd0b125..eb1b8724e11f4 100644
--- a/sound/soc/atmel/mchp-spdifrx.c
+++ b/sound/soc/atmel/mchp-spdifrx.c
@@ -217,7 +217,6 @@ struct mchp_spdifrx_ch_stat {
struct mchp_spdifrx_user_data {
unsigned char data[SPDIFRX_UD_BITS / 8];
struct completion done;
- spinlock_t lock; /* protect access to user data */
};
struct mchp_spdifrx_mixer_control {
@@ -231,8 +230,6 @@ struct mchp_spdifrx_mixer_control {
struct mchp_spdifrx_dev {
struct snd_dmaengine_dai_dma_data capture;
struct mchp_spdifrx_mixer_control control;
- spinlock_t blockend_lock; /* protect access to blockend_refcount */
- int blockend_refcount;
struct mutex mlock;
struct device *dev;
struct regmap *regmap;
@@ -277,37 +274,11 @@ static void mchp_spdifrx_channel_user_data_read(struct mchp_spdifrx_dev *dev,
}
}
-/* called from non-atomic context only */
-static void mchp_spdifrx_isr_blockend_en(struct mchp_spdifrx_dev *dev)
-{
- unsigned long flags;
-
- spin_lock_irqsave(&dev->blockend_lock, flags);
- dev->blockend_refcount++;
- /* don't enable BLOCKEND interrupt if it's already enabled */
- if (dev->blockend_refcount == 1)
- regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_BLOCKEND);
- spin_unlock_irqrestore(&dev->blockend_lock, flags);
-}
-
-/* called from atomic/non-atomic context */
-static void mchp_spdifrx_isr_blockend_dis(struct mchp_spdifrx_dev *dev)
-{
- unsigned long flags;
-
- spin_lock_irqsave(&dev->blockend_lock, flags);
- dev->blockend_refcount--;
- /* don't enable BLOCKEND interrupt if it's already enabled */
- if (dev->blockend_refcount == 0)
- regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND);
- spin_unlock_irqrestore(&dev->blockend_lock, flags);
-}
-
static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id)
{
struct mchp_spdifrx_dev *dev = dev_id;
struct mchp_spdifrx_mixer_control *ctrl = &dev->control;
- u32 sr, imr, pending, idr = 0;
+ u32 sr, imr, pending;
irqreturn_t ret = IRQ_NONE;
int ch;
@@ -322,13 +293,10 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id)
if (pending & SPDIFRX_IR_BLOCKEND) {
for (ch = 0; ch < SPDIFRX_CHANNELS; ch++) {
- spin_lock(&ctrl->user_data[ch].lock);
mchp_spdifrx_channel_user_data_read(dev, ch);
- spin_unlock(&ctrl->user_data[ch].lock);
-
complete(&ctrl->user_data[ch].done);
}
- mchp_spdifrx_isr_blockend_dis(dev);
+ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND);
ret = IRQ_HANDLED;
}
@@ -336,7 +304,7 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id)
if (pending & SPDIFRX_IR_CSC(ch)) {
mchp_spdifrx_channel_status_read(dev, ch);
complete(&ctrl->ch_stat[ch].done);
- idr |= SPDIFRX_IR_CSC(ch);
+ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_CSC(ch));
ret = IRQ_HANDLED;
}
}
@@ -346,8 +314,6 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id)
ret = IRQ_HANDLED;
}
- regmap_write(dev->regmap, SPDIFRX_IDR, idr);
-
return ret;
}
@@ -517,23 +483,51 @@ static int mchp_spdifrx_cs_get(struct mchp_spdifrx_dev *dev,
{
struct mchp_spdifrx_mixer_control *ctrl = &dev->control;
struct mchp_spdifrx_ch_stat *ch_stat = &ctrl->ch_stat[channel];
- int ret;
+ int ret = 0;
+
+ mutex_lock(&dev->mlock);
- regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_CSC(channel));
- /* check for new data available */
- ret = wait_for_completion_interruptible_timeout(&ch_stat->done,
- msecs_to_jiffies(100));
- /* IP might not be started or valid stream might not be present */
- if (ret <= 0) {
- dev_dbg(dev->dev, "channel status for channel %d timeout\n",
- channel);
- return ret ? : -ETIMEDOUT;
+ /*
+ * We may reach this point with both clocks enabled but the receiver
+ * still disabled. To void waiting for completion and return with
+ * timeout check the dev->trigger_enabled.
+ *
+ * To retrieve data:
+ * - if the receiver is enabled CSC IRQ will update the data in software
+ * caches (ch_stat->data)
+ * - otherwise we just update it here the software caches with latest
+ * available information and return it; in this case we don't need
+ * spin locking as the IRQ is disabled and will not be raised from
+ * anywhere else.
+ */
+
+ if (dev->trigger_enabled) {
+ reinit_completion(&ch_stat->done);
+ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_CSC(channel));
+ /* Check for new data available */
+ ret = wait_for_completion_interruptible_timeout(&ch_stat->done,
+ msecs_to_jiffies(100));
+ /* Valid stream might not be present */
+ if (ret <= 0) {
+ dev_dbg(dev->dev, "channel status for channel %d timeout\n",
+ channel);
+ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_CSC(channel));
+ ret = ret ? : -ETIMEDOUT;
+ goto unlock;
+ } else {
+ ret = 0;
+ }
+ } else {
+ /* Update software cache with latest channel status. */
+ mchp_spdifrx_channel_status_read(dev, channel);
}
memcpy(uvalue->value.iec958.status, ch_stat->data,
sizeof(ch_stat->data));
- return 0;
+unlock:
+ mutex_unlock(&dev->mlock);
+ return ret;
}
static int mchp_spdifrx_cs1_get(struct snd_kcontrol *kcontrol,
@@ -567,29 +561,49 @@ static int mchp_spdifrx_subcode_ch_get(struct mchp_spdifrx_dev *dev,
int channel,
struct snd_ctl_elem_value *uvalue)
{
- unsigned long flags;
struct mchp_spdifrx_mixer_control *ctrl = &dev->control;
struct mchp_spdifrx_user_data *user_data = &ctrl->user_data[channel];
- int ret;
+ int ret = 0;
+
+ mutex_lock(&dev->mlock);
+
+ /*
+ * We may reach this point with both clocks enabled but the receiver
+ * still disabled. To void waiting for completion to just timeout we
+ * check here the dev->trigger_enabled flag.
+ *
+ * To retrieve data:
+ * - if the receiver is enabled we need to wait for blockend IRQ to read
+ * data to and update it for us in software caches
+ * - otherwise reading the SPDIFRX_CHUD() registers is enough.
+ */
- reinit_completion(&user_data->done);
- mchp_spdifrx_isr_blockend_en(dev);
- ret = wait_for_completion_interruptible_timeout(&user_data->done,
- msecs_to_jiffies(100));
- /* IP might not be started or valid stream might not be present */
- if (ret <= 0) {
- dev_dbg(dev->dev, "user data for channel %d timeout\n",
- channel);
- mchp_spdifrx_isr_blockend_dis(dev);
- return ret ? : -ETIMEDOUT;
+ if (dev->trigger_enabled) {
+ reinit_completion(&user_data->done);
+ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_BLOCKEND);
+ ret = wait_for_completion_interruptible_timeout(&user_data->done,
+ msecs_to_jiffies(100));
+ /* Valid stream might not be present. */
+ if (ret <= 0) {
+ dev_dbg(dev->dev, "user data for channel %d timeout\n",
+ channel);
+ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND);
+ ret = ret ? : -ETIMEDOUT;
+ goto unlock;
+ } else {
+ ret = 0;
+ }
+ } else {
+ /* Update software cache with last available data. */
+ mchp_spdifrx_channel_user_data_read(dev, channel);
}
- spin_lock_irqsave(&user_data->lock, flags);
memcpy(uvalue->value.iec958.subcode, user_data->data,
sizeof(user_data->data));
- spin_unlock_irqrestore(&user_data->lock, flags);
- return 0;
+unlock:
+ mutex_unlock(&dev->mlock);
+ return ret;
}
static int mchp_spdifrx_subcode_ch1_get(struct snd_kcontrol *kcontrol,
@@ -890,11 +904,9 @@ static int mchp_spdifrx_dai_probe(struct snd_soc_dai *dai)
SPDIFRX_MR_AUTORST_NOACTION |
SPDIFRX_MR_PACK_DISABLED);
- dev->blockend_refcount = 0;
for (ch = 0; ch < SPDIFRX_CHANNELS; ch++) {
init_completion(&ctrl->ch_stat[ch].done);
init_completion(&ctrl->user_data[ch].done);
- spin_lock_init(&ctrl->user_data[ch].lock);
}
/* Add controls */
@@ -1004,7 +1016,6 @@ static int mchp_spdifrx_probe(struct platform_device *pdev)
*/
clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1);
- spin_lock_init(&dev->blockend_lock);
mutex_init(&dev->mlock);
dev->dev = &pdev->dev;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 224/567] ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 223/567] ASoC: mchp-spdifrx: fix controls that works with completion mechanism Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 225/567] ASoC: rsnd: fixup #endif position Greg Kroah-Hartman
` (346 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Mark Brown, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit aaecdc32b7e35b4f9b457fb3509414aa9a932589 ]
CSC interrupts which might be used in controls are on bits 8 and 9 of
SPDIFRX_IDR register. Thus disable all the interrupts that are exported
by driver.
Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230130120647.638049-5-claudiu.beznea@microchip.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/atmel/mchp-spdifrx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c
index eb1b8724e11f4..03b7037239b85 100644
--- a/sound/soc/atmel/mchp-spdifrx.c
+++ b/sound/soc/atmel/mchp-spdifrx.c
@@ -921,7 +921,7 @@ static int mchp_spdifrx_dai_remove(struct snd_soc_dai *dai)
struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
/* Disable interrupts */
- regmap_write(dev->regmap, SPDIFRX_IDR, 0xFF);
+ regmap_write(dev->regmap, SPDIFRX_IDR, GENMASK(14, 0));
clk_disable_unprepare(dev->pclk);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 225/567] ASoC: rsnd: fixup #endif position
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 224/567] ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove() Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 226/567] ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params() Greg Kroah-Hartman
` (345 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuninori Morimoto, Mark Brown, Sasha Levin
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
[ Upstream commit 49123b51cd896e00b256a27c2ce9e6bfe1bbc22f ]
commit 1f9c82b5ab83ff2 ("ASoC: rsnd: add debugfs support") added
CONFIG_DEBUG_FS related definitions on rsnd.h, but it should be
added inside of RSND_H. This patch fixup it.
Fixes: 1f9c82b5ab83 ("ASoC: rsnd: add debugfs support")
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/877cx26t7r.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sh/rcar/rsnd.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index d9cd190d7e198..f8ef6836ef84e 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -901,8 +901,6 @@ void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type);
if (!IS_BUILTIN(RSND_DEBUG_NO_DAI_CALL)) \
dev_dbg(dev, param)
-#endif
-
#ifdef CONFIG_DEBUG_FS
int rsnd_debugfs_probe(struct snd_soc_component *component);
void rsnd_debugfs_reg_show(struct seq_file *m, phys_addr_t _addr,
@@ -913,3 +911,5 @@ void rsnd_debugfs_mod_reg_show(struct seq_file *m, struct rsnd_mod *mod,
#else
#define rsnd_debugfs_probe NULL
#endif
+
+#endif /* RSND_H */
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 226/567] ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 225/567] ASoC: rsnd: fixup #endif position Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 227/567] ASoC: dt-bindings: meson: fix gx-card codec node regex Greg Kroah-Hartman
` (344 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Claudiu Beznea,
Mark Brown, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit 218674a45930c700486d27b765bf2f1b43f8cbf7 ]
Clang warns:
../sound/soc/atmel/mchp-spdifrx.c:455:3: error: variable 'mr' is uninitialized when used here [-Werror,-Wuninitialized]
mr |= SPDIFRX_MR_ENDIAN_BIG;
^~
../sound/soc/atmel/mchp-spdifrx.c:432:8: note: initialize the variable 'mr' to silence this warning
u32 mr;
^
= 0
1 error generated.
Zero initialize mr so that these bitwise OR and assignment operation
works unconditionally.
Fixes: fa09fa60385a ("ASoC: mchp-spdifrx: fix controls which rely on rsr register")
Link: https://github.com/ClangBuiltLinux/linux/issues/1797
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230202-mchp-spdifrx-fix-uninit-mr-v1-1-629a045d7a2f@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/atmel/mchp-spdifrx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c
index 03b7037239b85..39a3c2a33bdbb 100644
--- a/sound/soc/atmel/mchp-spdifrx.c
+++ b/sound/soc/atmel/mchp-spdifrx.c
@@ -362,7 +362,7 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream,
struct snd_soc_dai *dai)
{
struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
- u32 mr;
+ u32 mr = 0;
int ret;
dev_dbg(dev->dev, "%s() rate=%u format=%#x width=%u channels=%u\n",
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 227/567] ASoC: dt-bindings: meson: fix gx-card codec node regex
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 226/567] ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params() Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 228/567] hwmon: (ltc2945) Handle error case in ltc2945_value_store Greg Kroah-Hartman
` (343 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jerome Brunet, Krzysztof Kozlowski,
Mark Brown, Sasha Levin
From: Jerome Brunet <jbrunet@baylibre.com>
[ Upstream commit 480b26226873c88e482575ceb0d0a38d76e1be57 ]
'codec' is a valid node name when there is a single codec
in the link. Fix the node regular expression to apply this.
Fixes: fd00366b8e41 ("ASoC: meson: gx: add sound card dt-binding documentation")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20230202183653.486216-3-jbrunet@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../devicetree/bindings/sound/amlogic,gx-sound-card.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml
index 2e35aeaa8781d..89e3819c6127a 100644
--- a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml
+++ b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml
@@ -61,7 +61,7 @@ patternProperties:
description: phandle of the CPU DAI
patternProperties:
- "^codec-[0-9]+$":
+ "^codec(-[0-9]+)?$":
type: object
description: |-
Codecs:
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 228/567] hwmon: (ltc2945) Handle error case in ltc2945_value_store
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 227/567] ASoC: dt-bindings: meson: fix gx-card codec node regex Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 229/567] drm/amdgpu: fix enum odm_combine_mode mismatch Greg Kroah-Hartman
` (342 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Cormier, Guenter Roeck,
Sasha Levin
From: Jonathan Cormier <jcormier@criticallink.com>
[ Upstream commit 178b01eccfb0b8149682f61388400bd3d903dddc ]
ltc2945_val_to_reg errors were not being handled
which would have resulted in register being set to
0 (clamped) instead of being left alone.
Fixes: 6700ce035f83 ("hwmon: Driver for Linear Technologies LTC2945")
Signed-off-by: Jonathan Cormier <jcormier@criticallink.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/ltc2945.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hwmon/ltc2945.c b/drivers/hwmon/ltc2945.c
index 9adebb59f6042..c06ab7317431f 100644
--- a/drivers/hwmon/ltc2945.c
+++ b/drivers/hwmon/ltc2945.c
@@ -248,6 +248,8 @@ static ssize_t ltc2945_value_store(struct device *dev,
/* convert to register value, then clamp and write result */
regval = ltc2945_val_to_reg(dev, reg, val);
+ if (regval < 0)
+ return regval;
if (is_power_reg(reg)) {
regval = clamp_val(regval, 0, 0xffffff);
regbuf[0] = regval >> 16;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 229/567] drm/amdgpu: fix enum odm_combine_mode mismatch
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 228/567] hwmon: (ltc2945) Handle error case in ltc2945_value_store Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 230/567] scsi: mpt3sas: Fix a memory leak Greg Kroah-Hartman
` (341 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Alex Deucher, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 087bad7eb1f6945f8232f132953ecc2bda8bd38d ]
A conversion from 'bool' to 'enum odm_combine_mode' was incomplete,
and gcc warns about this with many instances of
display/dc/dml/dcn20/display_mode_vba_20.c:3899:44: warning: implicit conversion from 'enum <anonymous>' to 'enum
odm_combine_mode' [-Wenum-conversion]
3899 | locals->ODMCombineEnablePerState[i][k] = false;
Change the ones that we get a warning for, using the same numerical
values to leave the behavior unchanged.
Fixes: 5fc11598166d ("drm/amd/display: expand dml structs")
Link: https://lore.kernel.org/all/20201026210039.3884312-3-arnd@kernel.org/
Link: https://lore.kernel.org/all/20210927100659.1431744-1-arnd@kernel.org/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 8 ++++----
.../amd/display/dc/dml/dcn20/display_mode_vba_20v2.c | 10 +++++-----
.../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 12 ++++++------
3 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c
index d3b5b6fedf042..6266b0788387e 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c
@@ -3897,14 +3897,14 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2
* (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
- locals->ODMCombineEnablePerState[i][k] = false;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine;
if (mode_lib->vba.ODMCapability) {
if (locals->PlaneRequiredDISPCLKWithoutODMCombine > mode_lib->vba.MaxDispclkRoundedDownToDFSGranularity) {
- locals->ODMCombineEnablePerState[i][k] = true;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
} else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) {
- locals->ODMCombineEnablePerState[i][k] = true;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
}
}
@@ -3957,7 +3957,7 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
locals->RequiredDISPCLK[i][j] = 0.0;
locals->DISPCLK_DPPCLK_Support[i][j] = true;
for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) {
- locals->ODMCombineEnablePerState[i][k] = false;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) {
locals->NoOfDPP[i][j][k] = 1;
locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k]
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c
index 63bbdf8b8678b..0053a6d5178c9 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c
@@ -4008,17 +4008,17 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode
mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2
* (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
- locals->ODMCombineEnablePerState[i][k] = false;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine;
if (mode_lib->vba.ODMCapability) {
if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) {
- locals->ODMCombineEnablePerState[i][k] = true;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
} else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN20_MAX_DSC_IMAGE_WIDTH)) {
- locals->ODMCombineEnablePerState[i][k] = true;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
} else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) {
- locals->ODMCombineEnablePerState[i][k] = true;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
}
}
@@ -4071,7 +4071,7 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode
locals->RequiredDISPCLK[i][j] = 0.0;
locals->DISPCLK_DPPCLK_Support[i][j] = true;
for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) {
- locals->ODMCombineEnablePerState[i][k] = false;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) {
locals->NoOfDPP[i][j][k] = 1;
locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k]
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
index 4136eb8256cb5..26f839ce710f5 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c
@@ -3979,17 +3979,17 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2
* (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
- locals->ODMCombineEnablePerState[i][k] = false;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine;
if (mode_lib->vba.ODMCapability) {
if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) {
- locals->ODMCombineEnablePerState[i][k] = true;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
} else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN21_MAX_DSC_IMAGE_WIDTH)) {
- locals->ODMCombineEnablePerState[i][k] = true;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
} else if (locals->HActive[k] > DCN21_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) {
- locals->ODMCombineEnablePerState[i][k] = true;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1;
mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine;
}
}
@@ -4042,7 +4042,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
locals->RequiredDISPCLK[i][j] = 0.0;
locals->DISPCLK_DPPCLK_Support[i][j] = true;
for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) {
- locals->ODMCombineEnablePerState[i][k] = false;
+ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled;
if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) {
locals->NoOfDPP[i][j][k] = 1;
locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k]
@@ -5218,7 +5218,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
mode_lib->vba.ODMCombineEnabled[k] =
locals->ODMCombineEnablePerState[mode_lib->vba.VoltageLevel][k];
} else {
- mode_lib->vba.ODMCombineEnabled[k] = false;
+ mode_lib->vba.ODMCombineEnabled[k] = dm_odm_combine_mode_disabled;
}
mode_lib->vba.DSCEnabled[k] =
locals->RequiresDSC[mode_lib->vba.VoltageLevel][k];
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 230/567] scsi: mpt3sas: Fix a memory leak
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 229/567] drm/amdgpu: fix enum odm_combine_mode mismatch Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 231/567] scsi: aic94xx: Add missing check for dma_map_single() Greg Kroah-Hartman
` (340 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomas Henzl, Martin K. Petersen,
Sasha Levin
From: Tomas Henzl <thenzl@redhat.com>
[ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ]
Add a forgotten kfree().
Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission")
Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 766c3a59a900a..9e674b748e78a 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -5682,6 +5682,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
}
dma_pool_destroy(ioc->pcie_sgl_dma_pool);
}
+ kfree(ioc->pcie_sg_lookup);
+ ioc->pcie_sg_lookup = NULL;
+
if (ioc->config_page) {
dexitprintk(ioc,
ioc_info(ioc, "config_page(0x%p): free\n",
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 231/567] scsi: aic94xx: Add missing check for dma_map_single()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 230/567] scsi: mpt3sas: Fix a memory leak Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 232/567] HID: multitouch: Add quirks for flipped axes Greg Kroah-Hartman
` (339 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Jason Yan,
Martin K. Petersen, Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit 32fe45274edb5926abc0fac7263d9f889d02d9cf ]
Add check for dma_map_single() and return error if it fails in order to
avoid invalid DMA address.
Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver")
Link: https://lore.kernel.org/r/20230128110832.6792-1-jiasheng@iscas.ac.cn
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/aic94xx/aic94xx_task.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c
index c6b63eae28f51..ce48f34f412f0 100644
--- a/drivers/scsi/aic94xx/aic94xx_task.c
+++ b/drivers/scsi/aic94xx/aic94xx_task.c
@@ -50,6 +50,9 @@ static int asd_map_scatterlist(struct sas_task *task,
dma_addr_t dma = dma_map_single(&asd_ha->pcidev->dev, p,
task->total_xfer_len,
task->data_dir);
+ if (dma_mapping_error(&asd_ha->pcidev->dev, dma))
+ return -ENOMEM;
+
sg_arr[0].bus_addr = cpu_to_le64((u64)dma);
sg_arr[0].size = cpu_to_le32(task->total_xfer_len);
sg_arr[0].flags |= ASD_SG_EL_LIST_EOL;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 232/567] HID: multitouch: Add quirks for flipped axes
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 231/567] scsi: aic94xx: Add missing check for dma_map_single() Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 233/567] HID: retain initial quirks set up when creating HID devices Greg Kroah-Hartman
` (338 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Allen Ballway, Jiri Kosina, Sasha Levin
From: Allen Ballway <ballway@chromium.org>
[ Upstream commit a2f416bf062a38bb76cccd526d2d286b8e4db4d9 ]
Certain touchscreen devices, such as the ELAN9034, are oriented
incorrectly and report touches on opposite points on the X and Y axes.
For example, a 100x200 screen touched at (10,20) would report (90, 180)
and vice versa.
This is fixed by adding device quirks to transform the touch points
into the correct spaces, from X -> MAX(X) - X, and Y -> MAX(Y) - Y.
Signed-off-by: Allen Ballway <ballway@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Stable-dep-of: 03a86105556e ("HID: retain initial quirks set up when creating HID devices")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-multitouch.c | 39 ++++++++++++++++++---
drivers/hid/hid-quirks.c | 6 ++++
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 43 ++++++++++++++++++++++++
drivers/hid/i2c-hid/i2c-hid.h | 3 ++
4 files changed, 87 insertions(+), 4 deletions(-)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 6b86d368d5e74..592ffdd546fb4 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -71,6 +71,7 @@ MODULE_LICENSE("GPL");
#define MT_QUIRK_SEPARATE_APP_REPORT BIT(19)
#define MT_QUIRK_FORCE_MULTI_INPUT BIT(20)
#define MT_QUIRK_DISABLE_WAKEUP BIT(21)
+#define MT_QUIRK_ORIENTATION_INVERT BIT(22)
#define MT_INPUTMODE_TOUCHSCREEN 0x02
#define MT_INPUTMODE_TOUCHPAD 0x03
@@ -1009,6 +1010,7 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input,
struct mt_usages *slot)
{
struct input_mt *mt = input->mt;
+ struct hid_device *hdev = td->hdev;
__s32 quirks = app->quirks;
bool valid = true;
bool confidence_state = true;
@@ -1086,6 +1088,10 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input,
int orientation = wide;
int max_azimuth;
int azimuth;
+ int x;
+ int y;
+ int cx;
+ int cy;
if (slot->a != DEFAULT_ZERO) {
/*
@@ -1104,6 +1110,9 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input,
if (azimuth > max_azimuth * 2)
azimuth -= max_azimuth * 4;
orientation = -azimuth;
+ if (quirks & MT_QUIRK_ORIENTATION_INVERT)
+ orientation = -orientation;
+
}
if (quirks & MT_QUIRK_TOUCH_SIZE_SCALING) {
@@ -1115,10 +1124,23 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input,
minor = minor >> 1;
}
- input_event(input, EV_ABS, ABS_MT_POSITION_X, *slot->x);
- input_event(input, EV_ABS, ABS_MT_POSITION_Y, *slot->y);
- input_event(input, EV_ABS, ABS_MT_TOOL_X, *slot->cx);
- input_event(input, EV_ABS, ABS_MT_TOOL_Y, *slot->cy);
+ x = hdev->quirks & HID_QUIRK_X_INVERT ?
+ input_abs_get_max(input, ABS_MT_POSITION_X) - *slot->x :
+ *slot->x;
+ y = hdev->quirks & HID_QUIRK_Y_INVERT ?
+ input_abs_get_max(input, ABS_MT_POSITION_Y) - *slot->y :
+ *slot->y;
+ cx = hdev->quirks & HID_QUIRK_X_INVERT ?
+ input_abs_get_max(input, ABS_MT_POSITION_X) - *slot->cx :
+ *slot->cx;
+ cy = hdev->quirks & HID_QUIRK_Y_INVERT ?
+ input_abs_get_max(input, ABS_MT_POSITION_Y) - *slot->cy :
+ *slot->cy;
+
+ input_event(input, EV_ABS, ABS_MT_POSITION_X, x);
+ input_event(input, EV_ABS, ABS_MT_POSITION_Y, y);
+ input_event(input, EV_ABS, ABS_MT_TOOL_X, cx);
+ input_event(input, EV_ABS, ABS_MT_TOOL_Y, cy);
input_event(input, EV_ABS, ABS_MT_DISTANCE, !*slot->tip_state);
input_event(input, EV_ABS, ABS_MT_ORIENTATION, orientation);
input_event(input, EV_ABS, ABS_MT_PRESSURE, *slot->p);
@@ -1738,6 +1760,15 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
if (id->vendor == HID_ANY_ID && id->product == HID_ANY_ID)
td->serial_maybe = true;
+
+ /* Orientation is inverted if the X or Y axes are
+ * flipped, but normalized if both are inverted.
+ */
+ if (hdev->quirks & (HID_QUIRK_X_INVERT | HID_QUIRK_Y_INVERT) &&
+ !((hdev->quirks & HID_QUIRK_X_INVERT)
+ && (hdev->quirks & HID_QUIRK_Y_INVERT)))
+ td->mtclass.quirks = MT_QUIRK_ORIENTATION_INVERT;
+
/* This allows the driver to correctly support devices
* that emit events over several HID messages.
*/
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 4a8c32148e58f..bad1c1e3adec4 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -19,6 +19,7 @@
#include <linux/input/elan-i2c-ids.h>
#include "hid-ids.h"
+#include "i2c-hid/i2c-hid.h"
/*
* Alphabetically sorted by vendor then product.
@@ -1278,6 +1279,11 @@ unsigned long hid_lookup_quirk(const struct hid_device *hdev)
quirks = hid_gets_squirk(hdev);
mutex_unlock(&dquirks_lock);
+ /* Get quirks specific to I2C devices */
+ if (IS_ENABLED(CONFIG_I2C_DMI_CORE) && IS_ENABLED(CONFIG_DMI) &&
+ hdev->bus == BUS_I2C)
+ quirks |= i2c_hid_get_dmi_quirks(hdev->vendor, hdev->product);
+
return quirks;
}
EXPORT_SYMBOL_GPL(hid_lookup_quirk);
diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
index 8e0f67455c098..554a7dc285365 100644
--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
@@ -10,8 +10,10 @@
#include <linux/types.h>
#include <linux/dmi.h>
#include <linux/mod_devicetable.h>
+#include <linux/hid.h>
#include "i2c-hid.h"
+#include "../hid-ids.h"
struct i2c_hid_desc_override {
@@ -416,6 +418,28 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
{ } /* Terminate list */
};
+static const struct hid_device_id i2c_hid_elan_flipped_quirks = {
+ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, USB_VENDOR_ID_ELAN, 0x2dcd),
+ HID_QUIRK_X_INVERT | HID_QUIRK_Y_INVERT
+};
+
+/*
+ * This list contains devices which have specific issues based on the system
+ * they're on and not just the device itself. The driver_data will have a
+ * specific hid device to match against.
+ */
+static const struct dmi_system_id i2c_hid_dmi_quirk_table[] = {
+ {
+ .ident = "DynaBook K50/FR",
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dynabook Inc."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "dynabook K50/FR"),
+ },
+ .driver_data = (void *)&i2c_hid_elan_flipped_quirks,
+ },
+ { } /* Terminate list */
+};
+
struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name)
{
@@ -450,3 +474,22 @@ char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name,
*size = override->hid_report_desc_size;
return override->hid_report_desc;
}
+
+u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)
+{
+ u32 quirks = 0;
+ const struct dmi_system_id *system_id =
+ dmi_first_match(i2c_hid_dmi_quirk_table);
+
+ if (system_id) {
+ const struct hid_device_id *device_id =
+ (struct hid_device_id *)(system_id->driver_data);
+
+ if (device_id && device_id->vendor == vendor &&
+ device_id->product == product)
+ quirks = device_id->driver_data;
+ }
+
+ return quirks;
+}
+EXPORT_SYMBOL_GPL(i2c_hid_get_dmi_quirks);
diff --git a/drivers/hid/i2c-hid/i2c-hid.h b/drivers/hid/i2c-hid/i2c-hid.h
index 236cc062d5ef8..7b93b6c21f126 100644
--- a/drivers/hid/i2c-hid/i2c-hid.h
+++ b/drivers/hid/i2c-hid/i2c-hid.h
@@ -9,6 +9,7 @@
struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name);
char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name,
unsigned int *size);
+u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product);
#else
static inline struct i2c_hid_desc
*i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name)
@@ -16,6 +17,8 @@ static inline struct i2c_hid_desc
static inline char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name,
unsigned int *size)
{ return NULL; }
+static inline u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)
+{ return 0; }
#endif
/**
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 233/567] HID: retain initial quirks set up when creating HID devices
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 232/567] HID: multitouch: Add quirks for flipped axes Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 234/567] ASoC: codecs: Change bulk clock voting to optional voting in digital codecs Greg Kroah-Hartman
` (337 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Allen Ballway,
Dmitry Torokhov, Alistair Francis, Benjamin Tissoires,
Sasha Levin
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[ Upstream commit 03a86105556e23650e4470c09f91cf7c360d5e28 ]
In certain circumstances, such as when creating I2C-connected HID
devices, we want to pass and retain some quirks (axis inversion, etc).
The source of such quirks may be device tree, or DMI data, or something
else not readily available to the HID core itself and therefore cannot
be reconstructed easily. To allow this, introduce "initial_quirks" field
in hid_device structure and use it when determining the final set of
quirks.
This fixes the problem with i2c-hid setting up device-tree sourced
quirks too late and losing them on device rebind, and also allows to
sever the tie between hid-code and i2c-hid when applying DMI-based
quirks.
Fixes: b60d3c803d76 ("HID: i2c-hid-of: Expose the touchscreen-inverted properties")
Fixes: a2f416bf062a ("HID: multitouch: Add quirks for flipped axes")
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Tested-by: Allen Ballway <ballway@chromium.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Alistair Francis <alistair@alistair23.me>
Link: https://lore.kernel.org/r/Y+LYwu3Zs13hdVDy@google.com
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-quirks.c | 8 +-------
drivers/hid/i2c-hid/i2c-hid-core.c | 6 ++++--
drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 1 -
include/linux/hid.h | 1 +
4 files changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index bad1c1e3adec4..c7c06aa958c4d 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -19,7 +19,6 @@
#include <linux/input/elan-i2c-ids.h>
#include "hid-ids.h"
-#include "i2c-hid/i2c-hid.h"
/*
* Alphabetically sorted by vendor then product.
@@ -1218,7 +1217,7 @@ EXPORT_SYMBOL_GPL(hid_quirks_exit);
static unsigned long hid_gets_squirk(const struct hid_device *hdev)
{
const struct hid_device_id *bl_entry;
- unsigned long quirks = 0;
+ unsigned long quirks = hdev->initial_quirks;
if (hid_match_id(hdev, hid_ignore_list))
quirks |= HID_QUIRK_IGNORE;
@@ -1279,11 +1278,6 @@ unsigned long hid_lookup_quirk(const struct hid_device *hdev)
quirks = hid_gets_squirk(hdev);
mutex_unlock(&dquirks_lock);
- /* Get quirks specific to I2C devices */
- if (IS_ENABLED(CONFIG_I2C_DMI_CORE) && IS_ENABLED(CONFIG_DMI) &&
- hdev->bus == BUS_I2C)
- quirks |= i2c_hid_get_dmi_quirks(hdev->vendor, hdev->product);
-
return quirks;
}
EXPORT_SYMBOL_GPL(hid_lookup_quirk);
diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 65c1f20ec420a..7c61bb9291e4e 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -1012,6 +1012,10 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops,
hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID);
hid->product = le16_to_cpu(ihid->hdesc.wProductID);
+ hid->initial_quirks = quirks;
+ hid->initial_quirks |= i2c_hid_get_dmi_quirks(hid->vendor,
+ hid->product);
+
snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X",
client->name, (u16)hid->vendor, (u16)hid->product);
strlcpy(hid->phys, dev_name(&client->dev), sizeof(hid->phys));
@@ -1025,8 +1029,6 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops,
goto err_mem_free;
}
- hid->quirks |= quirks;
-
return 0;
err_mem_free:
diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
index 554a7dc285365..210f17c3a0be0 100644
--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
@@ -492,4 +492,3 @@ u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)
return quirks;
}
-EXPORT_SYMBOL_GPL(i2c_hid_get_dmi_quirks);
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 26742ca14609a..3cfbffd94a058 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -599,6 +599,7 @@ struct hid_device { /* device report descriptor */
unsigned long status; /* see STAT flags above */
unsigned claimed; /* Claimed by hidinput, hiddev? */
unsigned quirks; /* Various quirks the device can pull on us */
+ unsigned initial_quirks; /* Initial set of quirks supplied when creating device */
bool io_started; /* If IO has started */
struct list_head inputs; /* The list of inputs */
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 234/567] ASoC: codecs: Change bulk clock voting to optional voting in digital codecs
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 233/567] HID: retain initial quirks set up when creating HID devices Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 235/567] ASoC: codecs: rx-macro: move clk provider to managed variants Greg Kroah-Hartman
` (336 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivasa Rao Mandadapu,
Venkata Prasad Potturu, Srinivas Kandagatla, Mark Brown,
Sasha Levin
From: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
[ Upstream commit 9f589cf0f91485c8591775acad056c80378a2d34 ]
Change bulk clock frequency voting to optional bulk voting in va, rx and tx macros
to accommodate both ADSP and ADSP bypass based lpass architectures.
Signed-off-by: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
Co-developed-by: Venkata Prasad Potturu <potturu@codeaurora.org>
Signed-off-by: Venkata Prasad Potturu <potturu@codeaurora.org>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/1635234188-7746-6-git-send-email-srivasam@codeaurora.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: e7621434378c ("ASoC: codecs: lpass: fix incorrect mclk rate")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/lpass-rx-macro.c | 2 +-
sound/soc/codecs/lpass-tx-macro.c | 2 +-
sound/soc/codecs/lpass-va-macro.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
index 23452900b9ae1..3c4f1fb219a44 100644
--- a/sound/soc/codecs/lpass-rx-macro.c
+++ b/sound/soc/codecs/lpass-rx-macro.c
@@ -3535,7 +3535,7 @@ static int rx_macro_probe(struct platform_device *pdev)
rx->clks[3].id = "npl";
rx->clks[4].id = "fsgen";
- ret = devm_clk_bulk_get(dev, RX_NUM_CLKS_MAX, rx->clks);
+ ret = devm_clk_bulk_get_optional(dev, RX_NUM_CLKS_MAX, rx->clks);
if (ret) {
dev_err(dev, "Error getting RX Clocks (%d)\n", ret);
return ret;
diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
index feafb8a90ffe9..8d1126802ddfa 100644
--- a/sound/soc/codecs/lpass-tx-macro.c
+++ b/sound/soc/codecs/lpass-tx-macro.c
@@ -1801,7 +1801,7 @@ static int tx_macro_probe(struct platform_device *pdev)
tx->clks[3].id = "npl";
tx->clks[4].id = "fsgen";
- ret = devm_clk_bulk_get(dev, TX_NUM_CLKS_MAX, tx->clks);
+ ret = devm_clk_bulk_get_optional(dev, TX_NUM_CLKS_MAX, tx->clks);
if (ret) {
dev_err(dev, "Error getting RX Clocks (%d)\n", ret);
return ret;
diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c
index 08702a21212c1..9b9bae9b92be1 100644
--- a/sound/soc/codecs/lpass-va-macro.c
+++ b/sound/soc/codecs/lpass-va-macro.c
@@ -1408,7 +1408,7 @@ static int va_macro_probe(struct platform_device *pdev)
va->clks[1].id = "dcodec";
va->clks[2].id = "mclk";
- ret = devm_clk_bulk_get(dev, VA_NUM_CLKS_MAX, va->clks);
+ ret = devm_clk_bulk_get_optional(dev, VA_NUM_CLKS_MAX, va->clks);
if (ret) {
dev_err(dev, "Error getting VA Clocks (%d)\n", ret);
return ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 235/567] ASoC: codecs: rx-macro: move clk provider to managed variants
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 234/567] ASoC: codecs: Change bulk clock voting to optional voting in digital codecs Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 236/567] ASoC: codecs: tx-macro: " Greg Kroah-Hartman
` (335 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Mark Brown,
Sasha Levin
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
[ Upstream commit 70a5e96bad592145ba25365689a2d7d8dedb3bd9 ]
move clk provider registration to managed api variants, this should help
with some code tidyup.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20220224111718.6264-3-srinivas.kandagatla@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: e7621434378c ("ASoC: codecs: lpass: fix incorrect mclk rate")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/lpass-rx-macro.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
index 3c4f1fb219a44..f3e5755a49a1d 100644
--- a/sound/soc/codecs/lpass-rx-macro.c
+++ b/sound/soc/codecs/lpass-rx-macro.c
@@ -3479,10 +3479,9 @@ static const struct clk_ops swclk_gate_ops = {
};
-static struct clk *rx_macro_register_mclk_output(struct rx_macro *rx)
+static int rx_macro_register_mclk_output(struct rx_macro *rx)
{
struct device *dev = rx->dev;
- struct device_node *np = dev->of_node;
const char *parent_clk_name = NULL;
const char *clk_name = "lpass-rx-mclk";
struct clk_hw *hw;
@@ -3498,13 +3497,11 @@ static struct clk *rx_macro_register_mclk_output(struct rx_macro *rx)
init.num_parents = 1;
rx->hw.init = &init;
hw = &rx->hw;
- ret = clk_hw_register(rx->dev, hw);
+ ret = devm_clk_hw_register(rx->dev, hw);
if (ret)
- return ERR_PTR(ret);
-
- of_clk_add_provider(np, of_clk_src_simple_get, hw->clk);
+ return ret;
- return NULL;
+ return devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, hw);
}
static const struct snd_soc_component_driver rx_macro_component_drv = {
@@ -3562,22 +3559,26 @@ static int rx_macro_probe(struct platform_device *pdev)
if (ret)
return ret;
- rx_macro_register_mclk_output(rx);
+ ret = rx_macro_register_mclk_output(rx);
+ if (ret)
+ goto err;
ret = devm_snd_soc_register_component(dev, &rx_macro_component_drv,
rx_macro_dai,
ARRAY_SIZE(rx_macro_dai));
if (ret)
- clk_bulk_disable_unprepare(RX_NUM_CLKS_MAX, rx->clks);
+ goto err;
return ret;
+err:
+ clk_bulk_disable_unprepare(RX_NUM_CLKS_MAX, rx->clks);
+ return ret;
}
static int rx_macro_remove(struct platform_device *pdev)
{
struct rx_macro *rx = dev_get_drvdata(&pdev->dev);
- of_clk_del_provider(pdev->dev.of_node);
clk_bulk_disable_unprepare(RX_NUM_CLKS_MAX, rx->clks);
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 236/567] ASoC: codecs: tx-macro: move clk provider to managed variants
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 235/567] ASoC: codecs: rx-macro: move clk provider to managed variants Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 237/567] ASoC: codecs: rx-macro: move to individual clks from bulk Greg Kroah-Hartman
` (334 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Mark Brown,
Sasha Levin
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
[ Upstream commit db8665a3e904f579840417f9414415c4dd54ac84 ]
move clk provider registration to managed api variants, this should help
with some code tidyup.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20220224111718.6264-4-srinivas.kandagatla@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: e7621434378c ("ASoC: codecs: lpass: fix incorrect mclk rate")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/lpass-tx-macro.c | 17 +++++++----------
1 file changed, 7 insertions(+), 10 deletions(-)
diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
index 8d1126802ddfa..4192f91612e16 100644
--- a/sound/soc/codecs/lpass-tx-macro.c
+++ b/sound/soc/codecs/lpass-tx-macro.c
@@ -1745,10 +1745,9 @@ static const struct clk_ops swclk_gate_ops = {
};
-static struct clk *tx_macro_register_mclk_output(struct tx_macro *tx)
+static int tx_macro_register_mclk_output(struct tx_macro *tx)
{
struct device *dev = tx->dev;
- struct device_node *np = dev->of_node;
const char *parent_clk_name = NULL;
const char *clk_name = "lpass-tx-mclk";
struct clk_hw *hw;
@@ -1764,13 +1763,11 @@ static struct clk *tx_macro_register_mclk_output(struct tx_macro *tx)
init.num_parents = 1;
tx->hw.init = &init;
hw = &tx->hw;
- ret = clk_hw_register(tx->dev, hw);
+ ret = devm_clk_hw_register(dev, hw);
if (ret)
- return ERR_PTR(ret);
-
- of_clk_add_provider(np, of_clk_src_simple_get, hw->clk);
+ return ret;
- return NULL;
+ return devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, hw);
}
static const struct snd_soc_component_driver tx_macro_component_drv = {
@@ -1828,7 +1825,9 @@ static int tx_macro_probe(struct platform_device *pdev)
if (ret)
return ret;
- tx_macro_register_mclk_output(tx);
+ ret = tx_macro_register_mclk_output(tx);
+ if (ret)
+ goto err;
ret = devm_snd_soc_register_component(dev, &tx_macro_component_drv,
tx_macro_dai,
@@ -1846,8 +1845,6 @@ static int tx_macro_remove(struct platform_device *pdev)
{
struct tx_macro *tx = dev_get_drvdata(&pdev->dev);
- of_clk_del_provider(pdev->dev.of_node);
-
clk_bulk_disable_unprepare(TX_NUM_CLKS_MAX, tx->clks);
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 237/567] ASoC: codecs: rx-macro: move to individual clks from bulk
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 236/567] ASoC: codecs: tx-macro: " Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 238/567] ASoC: codecs: tx-macro: " Greg Kroah-Hartman
` (333 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Mark Brown,
Sasha Levin
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
[ Upstream commit 43b647d9940454263421f9a1c756680bdf1d443c ]
Using bulk clocks and referencing them individually using array index is
not great for readers.
So move them to individual clocks handling and also remove some unnecessary
error handling in the code.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20220224111718.6264-5-srinivas.kandagatla@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: e7621434378c ("ASoC: codecs: lpass: fix incorrect mclk rate")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/lpass-rx-macro.c | 85 +++++++++++++++++++++++--------
1 file changed, 64 insertions(+), 21 deletions(-)
diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
index f3e5755a49a1d..213ededb6f9ee 100644
--- a/sound/soc/codecs/lpass-rx-macro.c
+++ b/sound/soc/codecs/lpass-rx-macro.c
@@ -608,7 +608,11 @@ struct rx_macro {
int softclip_clk_users;
struct regmap *regmap;
- struct clk_bulk_data clks[RX_NUM_CLKS_MAX];
+ struct clk *mclk;
+ struct clk *npl;
+ struct clk *macro;
+ struct clk *dcodec;
+ struct clk *fsgen;
struct clk_hw hw;
};
#define to_rx_macro(_hw) container_of(_hw, struct rx_macro, hw)
@@ -3488,7 +3492,7 @@ static int rx_macro_register_mclk_output(struct rx_macro *rx)
struct clk_init_data init;
int ret;
- parent_clk_name = __clk_get_name(rx->clks[2].clk);
+ parent_clk_name = __clk_get_name(rx->mclk);
init.name = clk_name;
init.ops = &swclk_gate_ops;
@@ -3526,17 +3530,25 @@ static int rx_macro_probe(struct platform_device *pdev)
if (!rx)
return -ENOMEM;
- rx->clks[0].id = "macro";
- rx->clks[1].id = "dcodec";
- rx->clks[2].id = "mclk";
- rx->clks[3].id = "npl";
- rx->clks[4].id = "fsgen";
+ rx->macro = devm_clk_get_optional(dev, "macro");
+ if (IS_ERR(rx->macro))
+ return PTR_ERR(rx->macro);
- ret = devm_clk_bulk_get_optional(dev, RX_NUM_CLKS_MAX, rx->clks);
- if (ret) {
- dev_err(dev, "Error getting RX Clocks (%d)\n", ret);
- return ret;
- }
+ rx->dcodec = devm_clk_get_optional(dev, "dcodec");
+ if (IS_ERR(rx->dcodec))
+ return PTR_ERR(rx->dcodec);
+
+ rx->mclk = devm_clk_get(dev, "mclk");
+ if (IS_ERR(rx->mclk))
+ return PTR_ERR(rx->mclk);
+
+ rx->npl = devm_clk_get(dev, "npl");
+ if (IS_ERR(rx->npl))
+ return PTR_ERR(rx->npl);
+
+ rx->fsgen = devm_clk_get(dev, "fsgen");
+ if (IS_ERR(rx->fsgen))
+ return PTR_ERR(rx->fsgen);
base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(base))
@@ -3552,26 +3564,52 @@ static int rx_macro_probe(struct platform_device *pdev)
rx->dev = dev;
/* set MCLK and NPL rates */
- clk_set_rate(rx->clks[2].clk, MCLK_FREQ);
- clk_set_rate(rx->clks[3].clk, 2 * MCLK_FREQ);
+ clk_set_rate(rx->mclk, MCLK_FREQ);
+ clk_set_rate(rx->npl, 2 * MCLK_FREQ);
- ret = clk_bulk_prepare_enable(RX_NUM_CLKS_MAX, rx->clks);
+ ret = clk_prepare_enable(rx->macro);
if (ret)
- return ret;
+ goto err;
+
+ ret = clk_prepare_enable(rx->dcodec);
+ if (ret)
+ goto err_dcodec;
+
+ ret = clk_prepare_enable(rx->mclk);
+ if (ret)
+ goto err_mclk;
+
+ ret = clk_prepare_enable(rx->npl);
+ if (ret)
+ goto err_npl;
+
+ ret = clk_prepare_enable(rx->fsgen);
+ if (ret)
+ goto err_fsgen;
ret = rx_macro_register_mclk_output(rx);
if (ret)
- goto err;
+ goto err_clkout;
ret = devm_snd_soc_register_component(dev, &rx_macro_component_drv,
rx_macro_dai,
ARRAY_SIZE(rx_macro_dai));
if (ret)
- goto err;
+ goto err_clkout;
- return ret;
+ return 0;
+
+err_clkout:
+ clk_disable_unprepare(rx->fsgen);
+err_fsgen:
+ clk_disable_unprepare(rx->npl);
+err_npl:
+ clk_disable_unprepare(rx->mclk);
+err_mclk:
+ clk_disable_unprepare(rx->dcodec);
+err_dcodec:
+ clk_disable_unprepare(rx->macro);
err:
- clk_bulk_disable_unprepare(RX_NUM_CLKS_MAX, rx->clks);
return ret;
}
@@ -3579,7 +3617,12 @@ static int rx_macro_remove(struct platform_device *pdev)
{
struct rx_macro *rx = dev_get_drvdata(&pdev->dev);
- clk_bulk_disable_unprepare(RX_NUM_CLKS_MAX, rx->clks);
+ clk_disable_unprepare(rx->mclk);
+ clk_disable_unprepare(rx->npl);
+ clk_disable_unprepare(rx->fsgen);
+ clk_disable_unprepare(rx->macro);
+ clk_disable_unprepare(rx->dcodec);
+
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 238/567] ASoC: codecs: tx-macro: move to individual clks from bulk
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 237/567] ASoC: codecs: rx-macro: move to individual clks from bulk Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 239/567] ASoC: codecs: lpass: fix incorrect mclk rate Greg Kroah-Hartman
` (332 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Mark Brown,
Sasha Levin
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
[ Upstream commit 512864c4ffa70522b9c44d5b40c15273330ae9c7 ]
Using bulk clocks and referencing them individually using array index is
not great for readers.
So move them to individual clocks handling and also remove some unnecessary
error handling in the code.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20220224111718.6264-6-srinivas.kandagatla@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: e7621434378c ("ASoC: codecs: lpass: fix incorrect mclk rate")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/lpass-tx-macro.c | 87 +++++++++++++++++++++++--------
1 file changed, 65 insertions(+), 22 deletions(-)
diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
index 4192f91612e16..d604e2b0109b0 100644
--- a/sound/soc/codecs/lpass-tx-macro.c
+++ b/sound/soc/codecs/lpass-tx-macro.c
@@ -6,6 +6,7 @@
#include <linux/clk.h>
#include <linux/io.h>
#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
#include <linux/regmap.h>
#include <sound/soc.h>
#include <sound/soc-dapm.h>
@@ -258,7 +259,11 @@ struct tx_macro {
unsigned long active_ch_cnt[TX_MACRO_MAX_DAIS];
unsigned long active_decimator[TX_MACRO_MAX_DAIS];
struct regmap *regmap;
- struct clk_bulk_data clks[TX_NUM_CLKS_MAX];
+ struct clk *mclk;
+ struct clk *npl;
+ struct clk *macro;
+ struct clk *dcodec;
+ struct clk *fsgen;
struct clk_hw hw;
bool dec_active[NUM_DECIMATORS];
bool reset_swr;
@@ -1754,7 +1759,7 @@ static int tx_macro_register_mclk_output(struct tx_macro *tx)
struct clk_init_data init;
int ret;
- parent_clk_name = __clk_get_name(tx->clks[2].clk);
+ parent_clk_name = __clk_get_name(tx->mclk);
init.name = clk_name;
init.ops = &swclk_gate_ops;
@@ -1792,17 +1797,25 @@ static int tx_macro_probe(struct platform_device *pdev)
if (!tx)
return -ENOMEM;
- tx->clks[0].id = "macro";
- tx->clks[1].id = "dcodec";
- tx->clks[2].id = "mclk";
- tx->clks[3].id = "npl";
- tx->clks[4].id = "fsgen";
+ tx->macro = devm_clk_get_optional(dev, "macro");
+ if (IS_ERR(tx->macro))
+ return PTR_ERR(tx->macro);
- ret = devm_clk_bulk_get_optional(dev, TX_NUM_CLKS_MAX, tx->clks);
- if (ret) {
- dev_err(dev, "Error getting RX Clocks (%d)\n", ret);
- return ret;
- }
+ tx->dcodec = devm_clk_get_optional(dev, "dcodec");
+ if (IS_ERR(tx->dcodec))
+ return PTR_ERR(tx->dcodec);
+
+ tx->mclk = devm_clk_get(dev, "mclk");
+ if (IS_ERR(tx->mclk))
+ return PTR_ERR(tx->mclk);
+
+ tx->npl = devm_clk_get(dev, "npl");
+ if (IS_ERR(tx->npl))
+ return PTR_ERR(tx->npl);
+
+ tx->fsgen = devm_clk_get(dev, "fsgen");
+ if (IS_ERR(tx->fsgen))
+ return PTR_ERR(tx->fsgen);
base = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(base))
@@ -1818,26 +1831,52 @@ static int tx_macro_probe(struct platform_device *pdev)
tx->dev = dev;
/* set MCLK and NPL rates */
- clk_set_rate(tx->clks[2].clk, MCLK_FREQ);
- clk_set_rate(tx->clks[3].clk, 2 * MCLK_FREQ);
+ clk_set_rate(tx->mclk, MCLK_FREQ);
+ clk_set_rate(tx->npl, 2 * MCLK_FREQ);
- ret = clk_bulk_prepare_enable(TX_NUM_CLKS_MAX, tx->clks);
+ ret = clk_prepare_enable(tx->macro);
if (ret)
- return ret;
+ goto err;
+
+ ret = clk_prepare_enable(tx->dcodec);
+ if (ret)
+ goto err_dcodec;
+
+ ret = clk_prepare_enable(tx->mclk);
+ if (ret)
+ goto err_mclk;
+
+ ret = clk_prepare_enable(tx->npl);
+ if (ret)
+ goto err_npl;
+
+ ret = clk_prepare_enable(tx->fsgen);
+ if (ret)
+ goto err_fsgen;
ret = tx_macro_register_mclk_output(tx);
if (ret)
- goto err;
+ goto err_clkout;
ret = devm_snd_soc_register_component(dev, &tx_macro_component_drv,
tx_macro_dai,
ARRAY_SIZE(tx_macro_dai));
if (ret)
- goto err;
- return ret;
-err:
- clk_bulk_disable_unprepare(TX_NUM_CLKS_MAX, tx->clks);
+ goto err_clkout;
+ return 0;
+
+err_clkout:
+ clk_disable_unprepare(tx->fsgen);
+err_fsgen:
+ clk_disable_unprepare(tx->npl);
+err_npl:
+ clk_disable_unprepare(tx->mclk);
+err_mclk:
+ clk_disable_unprepare(tx->dcodec);
+err_dcodec:
+ clk_disable_unprepare(tx->macro);
+err:
return ret;
}
@@ -1845,7 +1884,11 @@ static int tx_macro_remove(struct platform_device *pdev)
{
struct tx_macro *tx = dev_get_drvdata(&pdev->dev);
- clk_bulk_disable_unprepare(TX_NUM_CLKS_MAX, tx->clks);
+ clk_disable_unprepare(tx->macro);
+ clk_disable_unprepare(tx->dcodec);
+ clk_disable_unprepare(tx->mclk);
+ clk_disable_unprepare(tx->npl);
+ clk_disable_unprepare(tx->fsgen);
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 239/567] ASoC: codecs: lpass: fix incorrect mclk rate
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 238/567] ASoC: codecs: tx-macro: " Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 240/567] spi: bcm63xx-hsspi: Endianness fix for ARM based SoC Greg Kroah-Hartman
` (331 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Mark Brown,
Sasha Levin
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
[ Upstream commit e7621434378c40b62ef858c14ae6415fb6469a8e ]
For some reason we ended up with incorrect mclk rate which should be
1920000 instead of 96000, So far we were getting lucky as the same clk
is set to 192000 by wsa and va macro. This issue is discovered when there
is no wsa macro active and only rx or tx path is tested.
Fix this by setting correct rate.
Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro")
Fixes: af3d54b99764 ("ASoC: codecs: lpass-rx-macro: add support for lpass rx macro")
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20230209122806.18923-7-srinivas.kandagatla@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/lpass-rx-macro.c | 4 ++--
sound/soc/codecs/lpass-tx-macro.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
index 213ededb6f9ee..72a0db09c7131 100644
--- a/sound/soc/codecs/lpass-rx-macro.c
+++ b/sound/soc/codecs/lpass-rx-macro.c
@@ -363,7 +363,7 @@
#define CDC_RX_DSD1_CFG2 (0x0F8C)
#define RX_MAX_OFFSET (0x0F8C)
-#define MCLK_FREQ 9600000
+#define MCLK_FREQ 19200000
#define RX_MACRO_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\
SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\
@@ -3565,7 +3565,7 @@ static int rx_macro_probe(struct platform_device *pdev)
/* set MCLK and NPL rates */
clk_set_rate(rx->mclk, MCLK_FREQ);
- clk_set_rate(rx->npl, 2 * MCLK_FREQ);
+ clk_set_rate(rx->npl, MCLK_FREQ);
ret = clk_prepare_enable(rx->macro);
if (ret)
diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
index d604e2b0109b0..2b7ba78551fab 100644
--- a/sound/soc/codecs/lpass-tx-macro.c
+++ b/sound/soc/codecs/lpass-tx-macro.c
@@ -200,7 +200,7 @@
#define TX_MACRO_AMIC_UNMUTE_DELAY_MS 100
#define TX_MACRO_DMIC_HPF_DELAY_MS 300
#define TX_MACRO_AMIC_HPF_DELAY_MS 300
-#define MCLK_FREQ 9600000
+#define MCLK_FREQ 19200000
enum {
TX_MACRO_AIF_INVALID = 0,
@@ -1832,7 +1832,7 @@ static int tx_macro_probe(struct platform_device *pdev)
/* set MCLK and NPL rates */
clk_set_rate(tx->mclk, MCLK_FREQ);
- clk_set_rate(tx->npl, 2 * MCLK_FREQ);
+ clk_set_rate(tx->npl, MCLK_FREQ);
ret = clk_prepare_enable(tx->macro);
if (ret)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 240/567] spi: bcm63xx-hsspi: Endianness fix for ARM based SoC
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 239/567] ASoC: codecs: lpass: fix incorrect mclk rate Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 241/567] spi: bcm63xx-hsspi: Fix multi-bit mode setting Greg Kroah-Hartman
` (330 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kursad Oney, William Zhang,
Florian Fainelli, Mark Brown, Sasha Levin
From: William Zhang <william.zhang@broadcom.com>
[ Upstream commit 85a84a61699990db6a025b5073f337f49933a875 ]
HSSPI controller uses big endian for the opcode in the message to the
controller ping pong buffer. Use cpu_to_be16 to properly handle the
endianness for both big and little endian host.
Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver")
Signed-off-by: Kursad Oney <kursad.oney@broadcom.com>
Signed-off-by: William Zhang <william.zhang@broadcom.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20230207065826.285013-7-william.zhang@broadcom.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-bcm63xx-hsspi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
index b871fd810d801..a74345ed0e2ff 100644
--- a/drivers/spi/spi-bcm63xx-hsspi.c
+++ b/drivers/spi/spi-bcm63xx-hsspi.c
@@ -194,7 +194,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)
tx += curr_step;
}
- __raw_writew(opcode | curr_step, bs->fifo);
+ __raw_writew((u16)cpu_to_be16(opcode | curr_step), bs->fifo);
/* enable interrupt */
__raw_writel(HSSPI_PINGx_CMD_DONE(0),
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 241/567] spi: bcm63xx-hsspi: Fix multi-bit mode setting
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 240/567] spi: bcm63xx-hsspi: Endianness fix for ARM based SoC Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 242/567] hwmon: (mlxreg-fan) Return zero speed for broken fan Greg Kroah-Hartman
` (329 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, William Zhang, Mark Brown, Sasha Levin
From: William Zhang <william.zhang@broadcom.com>
[ Upstream commit 811ff802aaf878ebbbaeac0307a0164fa21e7d40 ]
Currently the driver always sets the controller to dual data bit mode
for both tx and rx data in the profile mode control register even for
single data bit transfer. Luckily the opcode is set correctly according
to SPI transfer data bit width so it does not actually cause issues.
This change fixes the problem by setting tx and rx data bit mode field
correctly according to the actual SPI transfer tx and rx data bit width.
Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver")
Signed-off-by: William Zhang <william.zhang@broadcom.com>
Link: https://lore.kernel.org/r/20230209200246.141520-11-william.zhang@broadcom.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-bcm63xx-hsspi.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
index a74345ed0e2ff..9ec33745c1472 100644
--- a/drivers/spi/spi-bcm63xx-hsspi.c
+++ b/drivers/spi/spi-bcm63xx-hsspi.c
@@ -163,6 +163,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)
int step_size = HSSPI_BUFFER_LEN;
const u8 *tx = t->tx_buf;
u8 *rx = t->rx_buf;
+ u32 val = 0;
bcm63xx_hsspi_set_clk(bs, spi, t->speed_hz);
bcm63xx_hsspi_set_cs(bs, spi->chip_select, true);
@@ -178,11 +179,16 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)
step_size -= HSSPI_OPCODE_LEN;
if ((opcode == HSSPI_OP_READ && t->rx_nbits == SPI_NBITS_DUAL) ||
- (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL))
+ (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL)) {
opcode |= HSSPI_OP_MULTIBIT;
- __raw_writel(1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT |
- 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT | 0xff,
+ if (t->rx_nbits == SPI_NBITS_DUAL)
+ val |= 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT;
+ if (t->tx_nbits == SPI_NBITS_DUAL)
+ val |= 1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT;
+ }
+
+ __raw_writel(val | 0xff,
bs->regs + HSSPI_PROFILE_MODE_CTRL_REG(chip_select));
while (pending > 0) {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 242/567] hwmon: (mlxreg-fan) Return zero speed for broken fan
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 241/567] spi: bcm63xx-hsspi: Fix multi-bit mode setting Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 243/567] ASoC: tlv320adcx140: fix ti,gpio-config DT property init Greg Kroah-Hartman
` (328 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Pasternak, Guenter Roeck, Sasha Levin
From: Vadim Pasternak <vadimp@nvidia.com>
[ Upstream commit a1ffd3c46267ee5c807acd780e15df9bb692223f ]
Currently for broken fan driver returns value calculated based on error
code (0xFF) in related fan speed register.
Thus, for such fan user gets fan{n}_fault to 1 and fan{n}_input with
misleading value.
Add check for fan fault prior return speed value and return zero if
fault is detected.
Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20230212145730.24247-1-vadimp@nvidia.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/mlxreg-fan.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
index 89fe7b9fe26be..6ecc45c06849c 100644
--- a/drivers/hwmon/mlxreg-fan.c
+++ b/drivers/hwmon/mlxreg-fan.c
@@ -151,6 +151,12 @@ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
if (err)
return err;
+ if (MLXREG_FAN_GET_FAULT(regval, tacho->mask)) {
+ /* FAN is broken - return zero for FAN speed. */
+ *val = 0;
+ return 0;
+ }
+
*val = MLXREG_FAN_GET_RPM(regval, fan->divider,
fan->samples);
break;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 243/567] ASoC: tlv320adcx140: fix ti,gpio-config DT property init
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 242/567] hwmon: (mlxreg-fan) Return zero speed for broken fan Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 244/567] dm: remove flush_scheduled_work() during local_exit() Greg Kroah-Hartman
` (327 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steffen Aschbacher,
Alexandru Ardelean, Mark Brown, Sasha Levin
From: Steffen Aschbacher <steffen.aschbacher@stihl.de>
[ Upstream commit 771725efe5e2e5396dd9d1220437e5f9d6b9ca9d ]
When the 'ti,gpio-config' property is not defined, the
device_property_count_u32() will return an error, rather than zero.
The current check, only handles a return value of zero, which assumes that
the property is defined and has nothing defined.
This change extends the check to also check for an error case (most likely
to be hit by the case that the 'ti,gpio-config' is not defined).
In case that the 'ti,gpio-config' and the returned 'gpio_count' is not
correct, there is a 'if (gpio_count != ADCX140_NUM_GPIO_CFGS)' check, a few
lines lower that will return -EINVAL.
This means that someone tried to define 'ti,gpio-config', but with the
wrong number of GPIOs.
Fixes: d5214321498a ("ASoC: tlv320adcx140: Add support for configuring GPIO pin")
Signed-off-by: Steffen Aschbacher <steffen.aschbacher@stihl.de>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Link: https://lore.kernel.org/r/20230213073805.14640-1-alex@shruggie.ro
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/tlv320adcx140.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c
index 32b120d624b25..06d2502b13478 100644
--- a/sound/soc/codecs/tlv320adcx140.c
+++ b/sound/soc/codecs/tlv320adcx140.c
@@ -870,7 +870,7 @@ static int adcx140_configure_gpio(struct adcx140_priv *adcx140)
gpio_count = device_property_count_u32(adcx140->dev,
"ti,gpio-config");
- if (gpio_count == 0)
+ if (gpio_count <= 0)
return 0;
if (gpio_count != ADCX140_NUM_GPIO_CFGS)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 244/567] dm: remove flush_scheduled_work() during local_exit()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 243/567] ASoC: tlv320adcx140: fix ti,gpio-config DT property init Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 245/567] NFSv4: keep state manager thread active if swap is enabled Greg Kroah-Hartman
` (326 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Sasha Levin
From: Mike Snitzer <snitzer@kernel.org>
[ Upstream commit 0b22ff5360f5c4e11050b89206370fdf7dc0a226 ]
Commit acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred
device removal") switched from using system workqueue to a single
workqueue local to DM. But it didn't eliminate the call to
flush_scheduled_work() that was introduced purely for the benefit of
deferred device removal with commit 2c140a246dc ("dm: allow remove to
be deferred").
Since DM core uses its own workqueue (and queue_work) there is no need
to call flush_scheduled_work() from local_exit(). local_exit()'s
destroy_workqueue(deferred_remove_workqueue) handles flushing work
started with queue_work().
Fixes: acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred device removal")
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 9dd2c2da075d9..82c561e3fc145 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -226,7 +226,6 @@ static int __init local_init(void)
static void local_exit(void)
{
- flush_scheduled_work();
destroy_workqueue(deferred_remove_workqueue);
unregister_blkdev(_major, _name);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 245/567] NFSv4: keep state manager thread active if swap is enabled
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 244/567] dm: remove flush_scheduled_work() during local_exit() Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 246/567] nfs4trace: fix state manager flag printing Greg Kroah-Hartman
` (325 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, NeilBrown, Trond Myklebust, Sasha Levin
From: NeilBrown <neilb@suse.de>
[ Upstream commit 4dc73c679114a2f408567e2e44770ed934190db2 ]
If we are swapping over NFSv4, we may not be able to allocate memory to
start the state-manager thread at the time when we need it.
So keep it always running when swap is enabled, and just signal it to
start.
This requires updating and testing the cl_swapper count on the root
rpc_clnt after following all ->cl_parent links.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Stable-dep-of: b46d80bd2d6e ("nfs4trace: fix state manager flag printing")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/file.c | 15 ++++++++++++---
fs/nfs/nfs4_fs.h | 1 +
fs/nfs/nfs4proc.c | 20 ++++++++++++++++++++
fs/nfs/nfs4state.c | 40 +++++++++++++++++++++++++++++++++-------
include/linux/nfs_xdr.h | 2 ++
net/sunrpc/clnt.c | 2 ++
6 files changed, 70 insertions(+), 10 deletions(-)
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index ad5114e480097..dd53d0f97c57d 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -484,8 +484,9 @@ static int nfs_swap_activate(struct swap_info_struct *sis, struct file *file,
{
unsigned long blocks;
long long isize;
- struct rpc_clnt *clnt = NFS_CLIENT(file->f_mapping->host);
- struct inode *inode = file->f_mapping->host;
+ struct inode *inode = file_inode(file);
+ struct rpc_clnt *clnt = NFS_CLIENT(inode);
+ struct nfs_client *cl = NFS_SERVER(inode)->nfs_client;
spin_lock(&inode->i_lock);
blocks = inode->i_blocks;
@@ -498,14 +499,22 @@ static int nfs_swap_activate(struct swap_info_struct *sis, struct file *file,
*span = sis->pages;
+
+ if (cl->rpc_ops->enable_swap)
+ cl->rpc_ops->enable_swap(inode);
+
return rpc_clnt_swap_activate(clnt);
}
static void nfs_swap_deactivate(struct file *file)
{
- struct rpc_clnt *clnt = NFS_CLIENT(file->f_mapping->host);
+ struct inode *inode = file_inode(file);
+ struct rpc_clnt *clnt = NFS_CLIENT(inode);
+ struct nfs_client *cl = NFS_SERVER(inode)->nfs_client;
rpc_clnt_swap_deactivate(clnt);
+ if (cl->rpc_ops->disable_swap)
+ cl->rpc_ops->disable_swap(file_inode(file));
}
const struct address_space_operations nfs_file_aops = {
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index f8672a34fd635..0a1e1c64b131a 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -42,6 +42,7 @@ enum nfs4_client_state {
NFS4CLNT_LEASE_MOVED,
NFS4CLNT_DELEGATION_EXPIRED,
NFS4CLNT_RUN_MANAGER,
+ NFS4CLNT_MANAGER_AVAILABLE,
NFS4CLNT_RECALL_RUNNING,
NFS4CLNT_RECALL_ANY_LAYOUT_READ,
NFS4CLNT_RECALL_ANY_LAYOUT_RW,
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index b6b1fad031c78..5b671ca429d2b 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -10530,6 +10530,24 @@ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size)
return error + error2 + error3;
}
+static void nfs4_enable_swap(struct inode *inode)
+{
+ /* The state manager thread must always be running.
+ * It will notice the client is a swapper, and stay put.
+ */
+ struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
+
+ nfs4_schedule_state_manager(clp);
+}
+
+static void nfs4_disable_swap(struct inode *inode)
+{
+ /* The state manager thread will now exit once it is
+ * woken.
+ */
+ wake_up_var(&NFS_SERVER(inode)->nfs_client->cl_state);
+}
+
static const struct inode_operations nfs4_dir_inode_operations = {
.create = nfs_create,
.lookup = nfs_lookup,
@@ -10607,6 +10625,8 @@ const struct nfs_rpc_ops nfs_v4_clientops = {
.create_server = nfs4_create_server,
.clone_server = nfs_clone_server,
.discover_trunking = nfs4_discover_trunking,
+ .enable_swap = nfs4_enable_swap,
+ .disable_swap = nfs4_disable_swap,
};
static const struct xattr_handler nfs4_xattr_nfs4_acl_handler = {
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 0cd803b4d90ce..7223816bc5d53 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1209,10 +1209,17 @@ void nfs4_schedule_state_manager(struct nfs_client *clp)
{
struct task_struct *task;
char buf[INET6_ADDRSTRLEN + sizeof("-manager") + 1];
+ struct rpc_clnt *cl = clp->cl_rpcclient;
+
+ while (cl != cl->cl_parent)
+ cl = cl->cl_parent;
set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
- if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
+ if (test_and_set_bit(NFS4CLNT_MANAGER_AVAILABLE, &clp->cl_state) != 0) {
+ wake_up_var(&clp->cl_state);
return;
+ }
+ set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state);
__module_get(THIS_MODULE);
refcount_inc(&clp->cl_count);
@@ -1230,6 +1237,7 @@ void nfs4_schedule_state_manager(struct nfs_client *clp)
if (!nfs_client_init_is_complete(clp))
nfs_mark_client_ready(clp, PTR_ERR(task));
nfs4_clear_state_manager_bit(clp);
+ clear_bit(NFS4CLNT_MANAGER_AVAILABLE, &clp->cl_state);
nfs_put_client(clp);
module_put(THIS_MODULE);
}
@@ -2689,12 +2697,8 @@ static void nfs4_state_manager(struct nfs_client *clp)
clear_bit(NFS4CLNT_RECALL_RUNNING, &clp->cl_state);
}
- /* Did we race with an attempt to give us more work? */
- if (!test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state))
- return;
- if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
- return;
- memflags = memalloc_nofs_save();
+ return;
+
} while (refcount_read(&clp->cl_count) > 1 && !signalled());
goto out_drain;
@@ -2715,9 +2719,31 @@ static void nfs4_state_manager(struct nfs_client *clp)
static int nfs4_run_state_manager(void *ptr)
{
struct nfs_client *clp = ptr;
+ struct rpc_clnt *cl = clp->cl_rpcclient;
+
+ while (cl != cl->cl_parent)
+ cl = cl->cl_parent;
allow_signal(SIGKILL);
+again:
+ set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state);
nfs4_state_manager(clp);
+ if (atomic_read(&cl->cl_swapper)) {
+ wait_var_event_interruptible(&clp->cl_state,
+ test_bit(NFS4CLNT_RUN_MANAGER,
+ &clp->cl_state));
+ if (atomic_read(&cl->cl_swapper) &&
+ test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state))
+ goto again;
+ /* Either no longer a swapper, or were signalled */
+ }
+ clear_bit(NFS4CLNT_MANAGER_AVAILABLE, &clp->cl_state);
+
+ if (refcount_read(&clp->cl_count) > 1 && !signalled() &&
+ test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state) &&
+ !test_and_set_bit(NFS4CLNT_MANAGER_AVAILABLE, &clp->cl_state))
+ goto again;
+
nfs_put_client(clp);
module_put_and_exit(0);
return 0;
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 783f871b4e12d..7fcd56c6ded65 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1806,6 +1806,8 @@ struct nfs_rpc_ops {
struct nfs_server *(*clone_server)(struct nfs_server *, struct nfs_fh *,
struct nfs_fattr *, rpc_authflavor_t);
int (*discover_trunking)(struct nfs_server *, struct nfs_fh *);
+ void (*enable_swap)(struct inode *inode);
+ void (*disable_swap)(struct inode *inode);
};
/*
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index bbeb80e1133df..6622dc1fa8f2f 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -3117,6 +3117,8 @@ rpc_clnt_swap_activate_callback(struct rpc_clnt *clnt,
int
rpc_clnt_swap_activate(struct rpc_clnt *clnt)
{
+ while (clnt != clnt->cl_parent)
+ clnt = clnt->cl_parent;
if (atomic_inc_return(&clnt->cl_swapper) == 1)
return rpc_clnt_iterate_for_each_xprt(clnt,
rpc_clnt_swap_activate_callback, NULL);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 246/567] nfs4trace: fix state manager flag printing
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 245/567] NFSv4: keep state manager thread active if swap is enabled Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 247/567] NFS: fix disabling of swap Greg Kroah-Hartman
` (324 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker,
Sasha Levin
From: Benjamin Coddington <bcodding@redhat.com>
[ Upstream commit b46d80bd2d6e7e063c625a20de54248afe8d4889 ]
__print_flags wants a mask, not the enum value. Add two more flags.
Fixes: 511ba52e4c01 ("NFS4: Trace state recovery operation")
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4trace.h | 42 ++++++++++++++++++++++--------------------
1 file changed, 22 insertions(+), 20 deletions(-)
diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
index 7a2567aa2b86d..bcd18e96b44fa 100644
--- a/fs/nfs/nfs4trace.h
+++ b/fs/nfs/nfs4trace.h
@@ -584,32 +584,34 @@ TRACE_DEFINE_ENUM(NFS4CLNT_MOVED);
TRACE_DEFINE_ENUM(NFS4CLNT_LEASE_MOVED);
TRACE_DEFINE_ENUM(NFS4CLNT_DELEGATION_EXPIRED);
TRACE_DEFINE_ENUM(NFS4CLNT_RUN_MANAGER);
+TRACE_DEFINE_ENUM(NFS4CLNT_MANAGER_AVAILABLE);
TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_RUNNING);
TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_ANY_LAYOUT_READ);
TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_ANY_LAYOUT_RW);
+TRACE_DEFINE_ENUM(NFS4CLNT_DELEGRETURN_DELAYED);
#define show_nfs4_clp_state(state) \
__print_flags(state, "|", \
- { NFS4CLNT_MANAGER_RUNNING, "MANAGER_RUNNING" }, \
- { NFS4CLNT_CHECK_LEASE, "CHECK_LEASE" }, \
- { NFS4CLNT_LEASE_EXPIRED, "LEASE_EXPIRED" }, \
- { NFS4CLNT_RECLAIM_REBOOT, "RECLAIM_REBOOT" }, \
- { NFS4CLNT_RECLAIM_NOGRACE, "RECLAIM_NOGRACE" }, \
- { NFS4CLNT_DELEGRETURN, "DELEGRETURN" }, \
- { NFS4CLNT_SESSION_RESET, "SESSION_RESET" }, \
- { NFS4CLNT_LEASE_CONFIRM, "LEASE_CONFIRM" }, \
- { NFS4CLNT_SERVER_SCOPE_MISMATCH, \
- "SERVER_SCOPE_MISMATCH" }, \
- { NFS4CLNT_PURGE_STATE, "PURGE_STATE" }, \
- { NFS4CLNT_BIND_CONN_TO_SESSION, \
- "BIND_CONN_TO_SESSION" }, \
- { NFS4CLNT_MOVED, "MOVED" }, \
- { NFS4CLNT_LEASE_MOVED, "LEASE_MOVED" }, \
- { NFS4CLNT_DELEGATION_EXPIRED, "DELEGATION_EXPIRED" }, \
- { NFS4CLNT_RUN_MANAGER, "RUN_MANAGER" }, \
- { NFS4CLNT_RECALL_RUNNING, "RECALL_RUNNING" }, \
- { NFS4CLNT_RECALL_ANY_LAYOUT_READ, "RECALL_ANY_LAYOUT_READ" }, \
- { NFS4CLNT_RECALL_ANY_LAYOUT_RW, "RECALL_ANY_LAYOUT_RW" })
+ { BIT(NFS4CLNT_MANAGER_RUNNING), "MANAGER_RUNNING" }, \
+ { BIT(NFS4CLNT_CHECK_LEASE), "CHECK_LEASE" }, \
+ { BIT(NFS4CLNT_LEASE_EXPIRED), "LEASE_EXPIRED" }, \
+ { BIT(NFS4CLNT_RECLAIM_REBOOT), "RECLAIM_REBOOT" }, \
+ { BIT(NFS4CLNT_RECLAIM_NOGRACE), "RECLAIM_NOGRACE" }, \
+ { BIT(NFS4CLNT_DELEGRETURN), "DELEGRETURN" }, \
+ { BIT(NFS4CLNT_SESSION_RESET), "SESSION_RESET" }, \
+ { BIT(NFS4CLNT_LEASE_CONFIRM), "LEASE_CONFIRM" }, \
+ { BIT(NFS4CLNT_SERVER_SCOPE_MISMATCH), "SERVER_SCOPE_MISMATCH" }, \
+ { BIT(NFS4CLNT_PURGE_STATE), "PURGE_STATE" }, \
+ { BIT(NFS4CLNT_BIND_CONN_TO_SESSION), "BIND_CONN_TO_SESSION" }, \
+ { BIT(NFS4CLNT_MOVED), "MOVED" }, \
+ { BIT(NFS4CLNT_LEASE_MOVED), "LEASE_MOVED" }, \
+ { BIT(NFS4CLNT_DELEGATION_EXPIRED), "DELEGATION_EXPIRED" }, \
+ { BIT(NFS4CLNT_RUN_MANAGER), "RUN_MANAGER" }, \
+ { BIT(NFS4CLNT_MANAGER_AVAILABLE), "MANAGER_AVAILABLE" }, \
+ { BIT(NFS4CLNT_RECALL_RUNNING), "RECALL_RUNNING" }, \
+ { BIT(NFS4CLNT_RECALL_ANY_LAYOUT_READ), "RECALL_ANY_LAYOUT_READ" }, \
+ { BIT(NFS4CLNT_RECALL_ANY_LAYOUT_RW), "RECALL_ANY_LAYOUT_RW" }, \
+ { BIT(NFS4CLNT_DELEGRETURN_DELAYED), "DELERETURN_DELAYED" })
TRACE_EVENT(nfs4_state_mgr,
TP_PROTO(
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 247/567] NFS: fix disabling of swap
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 246/567] nfs4trace: fix state manager flag printing Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 248/567] spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() Greg Kroah-Hartman
` (323 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Kornievskaia, NeilBrown,
Anna Schumaker, Sasha Levin
From: NeilBrown <neilb@suse.de>
[ Upstream commit 5bab56fff53ce161ed859d9559a10361d4f79578 ]
When swap is activated to a file on an NFSv4 mount we arrange that the
state manager thread is always present as starting a new thread requires
memory allocations that might block waiting for swap.
Unfortunately the code for allowing the state manager thread to exit when
swap is disabled was not tested properly and does not work.
This can be seen by examining /proc/fs/nfsfs/servers after disabling swap
and unmounting the filesystem. The servers file will still list one
entry. Also a "ps" listing will show the state manager thread is still
present.
There are two problems.
1/ rpc_clnt_swap_deactivate() doesn't walk up the ->cl_parent list to
find the primary client on which the state manager runs.
2/ The thread is not woken up properly and it immediately goes back to
sleep without checking whether it is really needed. Using
nfs4_schedule_state_manager() ensures a proper wake-up.
Reported-by: Olga Kornievskaia <aglo@umich.edu>
Fixes: 4dc73c679114 ("NFSv4: keep state manager thread active if swap is enabled")
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 4 +++-
net/sunrpc/clnt.c | 2 ++
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 5b671ca429d2b..27cafeada8651 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -10545,7 +10545,9 @@ static void nfs4_disable_swap(struct inode *inode)
/* The state manager thread will now exit once it is
* woken.
*/
- wake_up_var(&NFS_SERVER(inode)->nfs_client->cl_state);
+ struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
+
+ nfs4_schedule_state_manager(clp);
}
static const struct inode_operations nfs4_dir_inode_operations = {
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 6622dc1fa8f2f..ad3e9a40b0610 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -3138,6 +3138,8 @@ rpc_clnt_swap_deactivate_callback(struct rpc_clnt *clnt,
void
rpc_clnt_swap_deactivate(struct rpc_clnt *clnt)
{
+ while (clnt != clnt->cl_parent)
+ clnt = clnt->cl_parent;
if (atomic_dec_if_positive(&clnt->cl_swapper) == 0)
rpc_clnt_iterate_for_each_xprt(clnt,
rpc_clnt_swap_deactivate_callback, NULL);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 248/567] spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 247/567] NFS: fix disabling of swap Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 249/567] ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared Greg Kroah-Hartman
` (322 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Jassi Brar,
Mark Brown, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit e6a0b671880207566e1ece983bf989dde60bc1d7 ]
wait_for_completion_timeout() never returns a <0 value. It returns either
on timeout or a positive value (at least 1, or number of jiffies left
till timeout)
So, fix the error handling path and return -ETIMEDOUT should a timeout
occur.
Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
Link: https://lore.kernel.org/r/c2040bf3cfa201fd8890cfab14fa5a701ffeca14.1676466072.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-synquacer.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-synquacer.c b/drivers/spi/spi-synquacer.c
index 47cbe73137c23..dc188f9202c97 100644
--- a/drivers/spi/spi-synquacer.c
+++ b/drivers/spi/spi-synquacer.c
@@ -472,10 +472,9 @@ static int synquacer_spi_transfer_one(struct spi_master *master,
read_fifo(sspi);
}
- if (status < 0) {
- dev_err(sspi->dev, "failed to transfer. status: 0x%x\n",
- status);
- return status;
+ if (status == 0) {
+ dev_err(sspi->dev, "failed to transfer. Timeout.\n");
+ return -ETIMEDOUT;
}
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 249/567] ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 248/567] spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 250/567] HID: bigben: use spinlock to protect concurrent accesses Greg Kroah-Hartman
` (321 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lucas Tanure, Charles Keepax,
AngeloGioacchino Del Regno, Mark Brown, Sasha Levin
From: Lucas Tanure <lucas.tanure@collabora.com>
[ Upstream commit fdff966bfde7cf0c85562d2bfb1ff1ba83da5f7b ]
Add struct snd_pcm_substream forward declaration
Fixes: 078a85f2806f ("ASoC: dapm: Only power up active channels from a DAI")
Signed-off-by: Lucas Tanure <lucas.tanure@collabora.com>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230215132851.1626881-1-lucas.tanure@collabora.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/sound/soc-dapm.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
index c3039e97929a5..32e93d55acf73 100644
--- a/include/sound/soc-dapm.h
+++ b/include/sound/soc-dapm.h
@@ -16,6 +16,7 @@
#include <sound/asoc.h>
struct device;
+struct snd_pcm_substream;
struct snd_soc_pcm_runtime;
struct soc_enum;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 250/567] HID: bigben: use spinlock to protect concurrent accesses
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 249/567] ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 251/567] HID: bigben_worker() remove unneeded check on report_field Greg Kroah-Hartman
` (320 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello, Benjamin Tissoires,
Sasha Levin
From: Pietro Borrello <borrello@diag.uniroma1.it>
[ Upstream commit 9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 ]
bigben driver has a worker that may access data concurrently.
Proct the accesses using a spinlock.
Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-1-7860c5763c38@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-bigbenff.c | 52 ++++++++++++++++++++++++++++++++++++--
1 file changed, 50 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
index e8b16665860d6..ed3d2d7bc1dd4 100644
--- a/drivers/hid/hid-bigbenff.c
+++ b/drivers/hid/hid-bigbenff.c
@@ -174,6 +174,7 @@ static __u8 pid0902_rdesc_fixed[] = {
struct bigben_device {
struct hid_device *hid;
struct hid_report *report;
+ spinlock_t lock;
bool removed;
u8 led_state; /* LED1 = 1 .. LED4 = 8 */
u8 right_motor_on; /* right motor off/on 0/1 */
@@ -190,12 +191,27 @@ static void bigben_worker(struct work_struct *work)
struct bigben_device *bigben = container_of(work,
struct bigben_device, worker);
struct hid_field *report_field = bigben->report->field[0];
+ bool do_work_led = false;
+ bool do_work_ff = false;
+ u8 *buf;
+ u32 len;
+ unsigned long flags;
if (bigben->removed || !report_field)
return;
+ buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL);
+ if (!buf)
+ return;
+
+ len = hid_report_len(bigben->report);
+
+ /* LED work */
+ spin_lock_irqsave(&bigben->lock, flags);
+
if (bigben->work_led) {
bigben->work_led = false;
+ do_work_led = true;
report_field->value[0] = 0x01; /* 1 = led message */
report_field->value[1] = 0x08; /* reserved value, always 8 */
report_field->value[2] = bigben->led_state;
@@ -204,11 +220,22 @@ static void bigben_worker(struct work_struct *work)
report_field->value[5] = 0x00; /* padding */
report_field->value[6] = 0x00; /* padding */
report_field->value[7] = 0x00; /* padding */
- hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT);
+ hid_output_report(bigben->report, buf);
+ }
+
+ spin_unlock_irqrestore(&bigben->lock, flags);
+
+ if (do_work_led) {
+ hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len,
+ bigben->report->type, HID_REQ_SET_REPORT);
}
+ /* FF work */
+ spin_lock_irqsave(&bigben->lock, flags);
+
if (bigben->work_ff) {
bigben->work_ff = false;
+ do_work_ff = true;
report_field->value[0] = 0x02; /* 2 = rumble effect message */
report_field->value[1] = 0x08; /* reserved value, always 8 */
report_field->value[2] = bigben->right_motor_on;
@@ -217,8 +244,17 @@ static void bigben_worker(struct work_struct *work)
report_field->value[5] = 0x00; /* padding */
report_field->value[6] = 0x00; /* padding */
report_field->value[7] = 0x00; /* padding */
- hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT);
+ hid_output_report(bigben->report, buf);
+ }
+
+ spin_unlock_irqrestore(&bigben->lock, flags);
+
+ if (do_work_ff) {
+ hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len,
+ bigben->report->type, HID_REQ_SET_REPORT);
}
+
+ kfree(buf);
}
static int hid_bigben_play_effect(struct input_dev *dev, void *data,
@@ -228,6 +264,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data,
struct bigben_device *bigben = hid_get_drvdata(hid);
u8 right_motor_on;
u8 left_motor_force;
+ unsigned long flags;
if (!bigben) {
hid_err(hid, "no device data\n");
@@ -242,9 +279,12 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data,
if (right_motor_on != bigben->right_motor_on ||
left_motor_force != bigben->left_motor_force) {
+ spin_lock_irqsave(&bigben->lock, flags);
bigben->right_motor_on = right_motor_on;
bigben->left_motor_force = left_motor_force;
bigben->work_ff = true;
+ spin_unlock_irqrestore(&bigben->lock, flags);
+
schedule_work(&bigben->worker);
}
@@ -259,6 +299,7 @@ static void bigben_set_led(struct led_classdev *led,
struct bigben_device *bigben = hid_get_drvdata(hid);
int n;
bool work;
+ unsigned long flags;
if (!bigben) {
hid_err(hid, "no device data\n");
@@ -267,6 +308,7 @@ static void bigben_set_led(struct led_classdev *led,
for (n = 0; n < NUM_LEDS; n++) {
if (led == bigben->leds[n]) {
+ spin_lock_irqsave(&bigben->lock, flags);
if (value == LED_OFF) {
work = (bigben->led_state & BIT(n));
bigben->led_state &= ~BIT(n);
@@ -274,6 +316,7 @@ static void bigben_set_led(struct led_classdev *led,
work = !(bigben->led_state & BIT(n));
bigben->led_state |= BIT(n);
}
+ spin_unlock_irqrestore(&bigben->lock, flags);
if (work) {
bigben->work_led = true;
@@ -307,8 +350,12 @@ static enum led_brightness bigben_get_led(struct led_classdev *led)
static void bigben_remove(struct hid_device *hid)
{
struct bigben_device *bigben = hid_get_drvdata(hid);
+ unsigned long flags;
+ spin_lock_irqsave(&bigben->lock, flags);
bigben->removed = true;
+ spin_unlock_irqrestore(&bigben->lock, flags);
+
cancel_work_sync(&bigben->worker);
hid_hw_stop(hid);
}
@@ -362,6 +409,7 @@ static int bigben_probe(struct hid_device *hid,
set_bit(FF_RUMBLE, hidinput->input->ffbit);
INIT_WORK(&bigben->worker, bigben_worker);
+ spin_lock_init(&bigben->lock);
error = input_ff_create_memless(hidinput->input, NULL,
hid_bigben_play_effect);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 251/567] HID: bigben_worker() remove unneeded check on report_field
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 250/567] HID: bigben: use spinlock to protect concurrent accesses Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 252/567] HID: bigben: use spinlock to safely schedule workers Greg Kroah-Hartman
` (319 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello, Benjamin Tissoires,
Sasha Levin
From: Pietro Borrello <borrello@diag.uniroma1.it>
[ Upstream commit 27d2a2fd844ec7da70d19fabb482304fd1e0595b ]
bigben_worker() checks report_field to be non-NULL.
The check has been added in commit
918aa1ef104d ("HID: bigbenff: prevent null pointer dereference")
to prevent a NULL pointer crash.
However, the true root cause was a missing check for output
reports, patched in commit
c7bf714f8755 ("HID: check empty report_list in bigben_probe()"),
where the type-confused report list_entry was overlapping with
a NULL pointer, which was then causing the crash.
Fixes: 918aa1ef104d ("HID: bigbenff: prevent null pointer dereference")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-2-7860c5763c38@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-bigbenff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
index ed3d2d7bc1dd4..b98c5f31c184b 100644
--- a/drivers/hid/hid-bigbenff.c
+++ b/drivers/hid/hid-bigbenff.c
@@ -197,7 +197,7 @@ static void bigben_worker(struct work_struct *work)
u32 len;
unsigned long flags;
- if (bigben->removed || !report_field)
+ if (bigben->removed)
return;
buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 252/567] HID: bigben: use spinlock to safely schedule workers
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 251/567] HID: bigben_worker() remove unneeded check on report_field Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 253/567] hid: bigben_probe(): validate report count Greg Kroah-Hartman
` (318 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello, Benjamin Tissoires,
Sasha Levin
From: Pietro Borrello <borrello@diag.uniroma1.it>
[ Upstream commit 76ca8da989c7d97a7f76c75d475fe95a584439d7 ]
Use spinlocks to deal with workers introducing a wrapper
bigben_schedule_work(), and several spinlock checks.
Otherwise, bigben_set_led() may schedule bigben->worker after the
structure has been freed, causing a use-after-free.
Fixes: 4eb1b01de5b9 ("HID: hid-bigbenff: fix race condition for scheduled work during removal")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-3-7860c5763c38@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-bigbenff.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
index b98c5f31c184b..9d6560db762b1 100644
--- a/drivers/hid/hid-bigbenff.c
+++ b/drivers/hid/hid-bigbenff.c
@@ -185,6 +185,15 @@ struct bigben_device {
struct work_struct worker;
};
+static inline void bigben_schedule_work(struct bigben_device *bigben)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&bigben->lock, flags);
+ if (!bigben->removed)
+ schedule_work(&bigben->worker);
+ spin_unlock_irqrestore(&bigben->lock, flags);
+}
static void bigben_worker(struct work_struct *work)
{
@@ -197,9 +206,6 @@ static void bigben_worker(struct work_struct *work)
u32 len;
unsigned long flags;
- if (bigben->removed)
- return;
-
buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL);
if (!buf)
return;
@@ -285,7 +291,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data,
bigben->work_ff = true;
spin_unlock_irqrestore(&bigben->lock, flags);
- schedule_work(&bigben->worker);
+ bigben_schedule_work(bigben);
}
return 0;
@@ -320,7 +326,7 @@ static void bigben_set_led(struct led_classdev *led,
if (work) {
bigben->work_led = true;
- schedule_work(&bigben->worker);
+ bigben_schedule_work(bigben);
}
return;
}
@@ -450,7 +456,7 @@ static int bigben_probe(struct hid_device *hid,
bigben->left_motor_force = 0;
bigben->work_led = true;
bigben->work_ff = true;
- schedule_work(&bigben->worker);
+ bigben_schedule_work(bigben);
hid_info(hid, "LED and force feedback support for BigBen gamepad\n");
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 253/567] hid: bigben_probe(): validate report count
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 252/567] HID: bigben: use spinlock to safely schedule workers Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 254/567] drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() Greg Kroah-Hartman
` (317 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello, Benjamin Tissoires,
Sasha Levin
From: Pietro Borrello <borrello@diag.uniroma1.it>
[ Upstream commit b94335f899542a0da5fafc38af8edcaf90195843 ]
bigben_probe() does not validate that the output report has the
needed report values in the first field.
A malicious device registering a report with one field and a single
value causes an head OOB write in bigben_worker() when
accessing report_field->value[1] to report_field->value[7].
Use hid_validate_values() which takes care of all the needed checks.
Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230211-bigben-oob-v1-1-d2849688594c@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-bigbenff.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
index 9d6560db762b1..a02cb517b4c47 100644
--- a/drivers/hid/hid-bigbenff.c
+++ b/drivers/hid/hid-bigbenff.c
@@ -371,7 +371,6 @@ static int bigben_probe(struct hid_device *hid,
{
struct bigben_device *bigben;
struct hid_input *hidinput;
- struct list_head *report_list;
struct led_classdev *led;
char *name;
size_t name_sz;
@@ -396,14 +395,12 @@ static int bigben_probe(struct hid_device *hid,
return error;
}
- report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
- if (list_empty(report_list)) {
+ bigben->report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 8);
+ if (!bigben->report) {
hid_err(hid, "no output report found\n");
error = -ENODEV;
goto error_hw_stop;
}
- bigben->report = list_entry(report_list->next,
- struct hid_report, list);
if (list_empty(&hid->inputs)) {
hid_err(hid, "no inputs found\n");
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 254/567] drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 253/567] hid: bigben_probe(): validate report count Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 255/567] nfsd: fix race to check ls_layouts Greg Kroah-Hartman
` (316 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Asahi Lina,
Javier Martinez Canillas, Sasha Levin
From: Asahi Lina <lina@asahilina.net>
[ Upstream commit ddddedaa0db99481c5e5abe628ad54f65e8765bc ]
Other functions touching shmem->sgt take the pages lock, so do that here
too. drm_gem_shmem_get_pages() & co take the same lock, so move to the
_locked() variants to avoid recursive locking.
Discovered while auditing locking to write the Rust abstractions.
Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects")
Fixes: 4fa3d66f132b ("drm/shmem: Do dma_unmap_sg before purging pages")
Signed-off-by: Asahi Lina <lina@asahilina.net>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230205125124.2260-1-lina@asahilina.net
(cherry picked from commit aa8c85affe3facd3842c8912186623415931cc72)
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_gem_shmem_helper.c | 54 ++++++++++++++++----------
1 file changed, 34 insertions(+), 20 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
index 15c3849e995bd..1af541c12a45f 100644
--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -651,23 +651,7 @@ struct sg_table *drm_gem_shmem_get_sg_table(struct drm_gem_shmem_object *shmem)
}
EXPORT_SYMBOL_GPL(drm_gem_shmem_get_sg_table);
-/**
- * drm_gem_shmem_get_pages_sgt - Pin pages, dma map them, and return a
- * scatter/gather table for a shmem GEM object.
- * @shmem: shmem GEM object
- *
- * This function returns a scatter/gather table suitable for driver usage. If
- * the sg table doesn't exist, the pages are pinned, dma-mapped, and a sg
- * table created.
- *
- * This is the main function for drivers to get at backing storage, and it hides
- * and difference between dma-buf imported and natively allocated objects.
- * drm_gem_shmem_get_sg_table() should not be directly called by drivers.
- *
- * Returns:
- * A pointer to the scatter/gather table of pinned pages or errno on failure.
- */
-struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
+static struct sg_table *drm_gem_shmem_get_pages_sgt_locked(struct drm_gem_shmem_object *shmem)
{
struct drm_gem_object *obj = &shmem->base;
int ret;
@@ -678,7 +662,7 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
WARN_ON(obj->import_attach);
- ret = drm_gem_shmem_get_pages(shmem);
+ ret = drm_gem_shmem_get_pages_locked(shmem);
if (ret)
return ERR_PTR(ret);
@@ -700,10 +684,40 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
sg_free_table(sgt);
kfree(sgt);
err_put_pages:
- drm_gem_shmem_put_pages(shmem);
+ drm_gem_shmem_put_pages_locked(shmem);
return ERR_PTR(ret);
}
-EXPORT_SYMBOL_GPL(drm_gem_shmem_get_pages_sgt);
+
+/**
+ * drm_gem_shmem_get_pages_sgt - Pin pages, dma map them, and return a
+ * scatter/gather table for a shmem GEM object.
+ * @shmem: shmem GEM object
+ *
+ * This function returns a scatter/gather table suitable for driver usage. If
+ * the sg table doesn't exist, the pages are pinned, dma-mapped, and a sg
+ * table created.
+ *
+ * This is the main function for drivers to get at backing storage, and it hides
+ * and difference between dma-buf imported and natively allocated objects.
+ * drm_gem_shmem_get_sg_table() should not be directly called by drivers.
+ *
+ * Returns:
+ * A pointer to the scatter/gather table of pinned pages or errno on failure.
+ */
+struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
+{
+ int ret;
+ struct sg_table *sgt;
+
+ ret = mutex_lock_interruptible(&shmem->pages_lock);
+ if (ret)
+ return ERR_PTR(ret);
+ sgt = drm_gem_shmem_get_pages_sgt_locked(shmem);
+ mutex_unlock(&shmem->pages_lock);
+
+ return sgt;
+}
+EXPORT_SYMBOL(drm_gem_shmem_get_pages_sgt);
/**
* drm_gem_shmem_prime_import_sg_table - Produce a shmem GEM object from
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 255/567] nfsd: fix race to check ls_layouts
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 254/567] drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 256/567] cifs: Fix lost destroy smbd connection when MR allocate failed Greg Kroah-Hartman
` (315 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Jeff Layton,
Chuck Lever, Sasha Levin
From: Benjamin Coddington <bcodding@redhat.com>
[ Upstream commit fb610c4dbc996415d57d7090957ecddd4fd64fb6 ]
Its possible for __break_lease to find the layout's lease before we've
added the layout to the owner's ls_layouts list. In that case, setting
ls_recalled = true without actually recalling the layout will cause the
server to never send a recall callback.
Move the check for ls_layouts before setting ls_recalled.
Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls")
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4layouts.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index a97873f2d22b0..2673019d30ecd 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -322,11 +322,11 @@ nfsd4_recall_file_layout(struct nfs4_layout_stateid *ls)
if (ls->ls_recalled)
goto out_unlock;
- ls->ls_recalled = true;
- atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls);
if (list_empty(&ls->ls_layouts))
goto out_unlock;
+ ls->ls_recalled = true;
+ atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls);
trace_nfsd_layout_recall(&ls->ls_stid.sc_stateid);
refcount_inc(&ls->ls_stid.sc_count);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 256/567] cifs: Fix lost destroy smbd connection when MR allocate failed
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 255/567] nfsd: fix race to check ls_layouts Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 257/567] cifs: Fix warning and UAF when destroy the MR list Greg Kroah-Hartman
` (314 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Xiaoxu, Paulo Alcantara (SUSE),
David Howells, Tom Talpey, Steve French, Sasha Levin
From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
[ Upstream commit e9d3401d95d62a9531082cd2453ed42f2740e3fd ]
If the MR allocate failed, the smb direct connection info is NULL,
then smbd_destroy() will directly return, then the connection info
will be leaked.
Let's set the smb direct connection info to the server before call
smbd_destroy().
Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration")
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Acked-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: David Howells <dhowells@redhat.com>
Reviewed-by: Tom Talpey <tom@talpey.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/smbdirect.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
index cb93cccbf0c41..58f086aabc888 100644
--- a/fs/cifs/smbdirect.c
+++ b/fs/cifs/smbdirect.c
@@ -1702,6 +1702,7 @@ static struct smbd_connection *_smbd_get_connection(
allocate_mr_failed:
/* At this point, need to a full transport shutdown */
+ server->smbd_conn = info;
smbd_destroy(server);
return NULL;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 257/567] cifs: Fix warning and UAF when destroy the MR list
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 256/567] cifs: Fix lost destroy smbd connection when MR allocate failed Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 258/567] gfs2: jdata writepage fix Greg Kroah-Hartman
` (313 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (SUSE),
Tom Talpey, Zhang Xiaoxu, Steve French, Sasha Levin
From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
[ Upstream commit 3e161c2791f8e661eed24a2c624087084d910215 ]
If the MR allocate failed, the MR recovery work not initialized
and list not cleared. Then will be warning and UAF when release
the MR:
WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110
CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82
RIP: 0010:__flush_work.isra.0+0xf7/0x110
Call Trace:
<TASK>
__cancel_work_timer+0x2ba/0x2e0
smbd_destroy+0x4e1/0x990
_smbd_get_connection+0x1cbd/0x2110
smbd_get_connection+0x21/0x40
cifs_get_tcp_session+0x8ef/0xda0
mount_get_conns+0x60/0x750
cifs_mount+0x103/0xd00
cifs_smb3_do_mount+0x1dd/0xcb0
smb3_get_tree+0x1d5/0x300
vfs_get_tree+0x41/0xf0
path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990
Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824
CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82
Call Trace:
dump_stack_lvl+0x34/0x44
print_report+0x171/0x472
kasan_report+0xad/0x130
smbd_destroy+0x4fc/0x990
_smbd_get_connection+0x1cbd/0x2110
smbd_get_connection+0x21/0x40
cifs_get_tcp_session+0x8ef/0xda0
mount_get_conns+0x60/0x750
cifs_mount+0x103/0xd00
cifs_smb3_do_mount+0x1dd/0xcb0
smb3_get_tree+0x1d5/0x300
vfs_get_tree+0x41/0xf0
path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Allocated by task 824:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_kmalloc+0x7a/0x90
_smbd_get_connection+0x1b6f/0x2110
smbd_get_connection+0x21/0x40
cifs_get_tcp_session+0x8ef/0xda0
mount_get_conns+0x60/0x750
cifs_mount+0x103/0xd00
cifs_smb3_do_mount+0x1dd/0xcb0
smb3_get_tree+0x1d5/0x300
vfs_get_tree+0x41/0xf0
path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Freed by task 824:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x40
____kasan_slab_free+0x143/0x1b0
__kmem_cache_free+0xc8/0x330
_smbd_get_connection+0x1c6a/0x2110
smbd_get_connection+0x21/0x40
cifs_get_tcp_session+0x8ef/0xda0
mount_get_conns+0x60/0x750
cifs_mount+0x103/0xd00
cifs_smb3_do_mount+0x1dd/0xcb0
smb3_get_tree+0x1d5/0x300
vfs_get_tree+0x41/0xf0
path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Let's initialize the MR recovery work before MR allocate to prevent
the warning, remove the MRs from the list to prevent the UAF.
Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration")
Acked-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Tom Talpey <tom@talpey.com>
Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/smbdirect.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
index 58f086aabc888..a9a5d27b8d38b 100644
--- a/fs/cifs/smbdirect.c
+++ b/fs/cifs/smbdirect.c
@@ -2251,6 +2251,7 @@ static int allocate_mr_list(struct smbd_connection *info)
atomic_set(&info->mr_ready_count, 0);
atomic_set(&info->mr_used_count, 0);
init_waitqueue_head(&info->wait_for_mr_cleanup);
+ INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work);
/* Allocate more MRs (2x) than hardware responder_resources */
for (i = 0; i < info->responder_resources * 2; i++) {
smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL);
@@ -2278,13 +2279,13 @@ static int allocate_mr_list(struct smbd_connection *info)
list_add_tail(&smbdirect_mr->list, &info->mr_list);
atomic_inc(&info->mr_ready_count);
}
- INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work);
return 0;
out:
kfree(smbdirect_mr);
list_for_each_entry_safe(smbdirect_mr, tmp, &info->mr_list, list) {
+ list_del(&smbdirect_mr->list);
ib_dereg_mr(smbdirect_mr->mr);
kfree(smbdirect_mr->sgl);
kfree(smbdirect_mr);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 258/567] gfs2: jdata writepage fix
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 257/567] cifs: Fix warning and UAF when destroy the MR list Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 259/567] perf llvm: Fix inadvertent file creation Greg Kroah-Hartman
` (312 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andreas Gruenbacher, Sasha Levin
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit cbb60951ce18c9b6e91d2eb97deb41d8ff616622 ]
The ->writepage() and ->writepages() operations are supposed to write
entire pages. However, on filesystems with a block size smaller than
PAGE_SIZE, __gfs2_jdata_writepage() only adds the first block to the
current transaction instead of adding the entire page. Fix that.
Fixes: 18ec7d5c3f43 ("[GFS2] Make journaled data files identical to normal files on disk")
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/aops.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 4bbfb156e6a40..ee212c9310ad0 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -152,7 +152,6 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w
{
struct inode *inode = page->mapping->host;
struct gfs2_inode *ip = GFS2_I(inode);
- struct gfs2_sbd *sdp = GFS2_SB(inode);
if (PageChecked(page)) {
ClearPageChecked(page);
@@ -160,7 +159,7 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w
create_empty_buffers(page, inode->i_sb->s_blocksize,
BIT(BH_Dirty)|BIT(BH_Uptodate));
}
- gfs2_page_add_databufs(ip, page, 0, sdp->sd_vfs->s_blocksize);
+ gfs2_page_add_databufs(ip, page, 0, PAGE_SIZE);
}
return gfs2_write_jdata_page(page, wbc);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 259/567] perf llvm: Fix inadvertent file creation
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 258/567] gfs2: jdata writepage fix Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 260/567] leds: led-core: Fix refcount leak in of_led_get() Greg Kroah-Hartman
` (311 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Alexander Shishkin,
Andrii Nakryiko, bpf, Ingo Molnar, Jiri Olsa, llvm, Mark Rutland,
Namhyung Kim, Nathan Chancellor, Nick Desaulniers,
Peter Zijlstra, Tom Rix, Arnaldo Carvalho de Melo, Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit 9f19aab47ced012eddef1e2bc96007efc7713b61 ]
The LLVM template is first echo-ed into command_out and then
command_out executed. The echo surrounds the template with double
quotes, however, the template itself may contain quotes. This is
generally innocuous but in tools/perf/tests/bpf-script-test-prologue.c
we see:
...
SEC("func=null_lseek file->f_mode offset orig")
...
where the first double quote ends the double quote of the echo, then
the > redirects output into a file called f_mode.
To avoid this inadvertent behavior substitute redirects and similar
characters to be ASCII control codes, then substitute the output in
the echo back again.
Fixes: 5eab5a7ee032acaa ("perf llvm: Display eBPF compiling command in debug output")
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: bpf@vger.kernel.org
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: llvm@lists.linux.dev
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tom Rix <trix@redhat.com>
Link: https://lore.kernel.org/r/20230105082609.344538-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/llvm-utils.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
index 96c8ef60f4f84..8ee3a947b1599 100644
--- a/tools/perf/util/llvm-utils.c
+++ b/tools/perf/util/llvm-utils.c
@@ -531,14 +531,37 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
pr_debug("llvm compiling command template: %s\n", template);
+ /*
+ * Below, substitute control characters for values that can cause the
+ * echo to misbehave, then substitute the values back.
+ */
err = -ENOMEM;
- if (asprintf(&command_echo, "echo -n \"%s\"", template) < 0)
+ if (asprintf(&command_echo, "echo -n \a%s\a", template) < 0)
goto errout;
+#define SWAP_CHAR(a, b) do { if (*p == a) *p = b; } while (0)
+ for (char *p = command_echo; *p; p++) {
+ SWAP_CHAR('<', '\001');
+ SWAP_CHAR('>', '\002');
+ SWAP_CHAR('"', '\003');
+ SWAP_CHAR('\'', '\004');
+ SWAP_CHAR('|', '\005');
+ SWAP_CHAR('&', '\006');
+ SWAP_CHAR('\a', '"');
+ }
err = read_from_pipe(command_echo, (void **) &command_out, NULL);
if (err)
goto errout;
+ for (char *p = command_out; *p; p++) {
+ SWAP_CHAR('\001', '<');
+ SWAP_CHAR('\002', '>');
+ SWAP_CHAR('\003', '"');
+ SWAP_CHAR('\004', '\'');
+ SWAP_CHAR('\005', '|');
+ SWAP_CHAR('\006', '&');
+ }
+#undef SWAP_CHAR
pr_debug("llvm compiling command : %s\n", command_out);
err = read_from_pipe(template, &obj_buf, &obj_buf_sz);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 260/567] leds: led-core: Fix refcount leak in of_led_get()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 259/567] perf llvm: Fix inadvertent file creation Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 261/567] perf inject: Use perf_data__read() for auxtrace Greg Kroah-Hartman
` (310 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Lee Jones, Sasha Levin
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit da1afe8e6099980fe1e2fd7436dca284af9d3f29 ]
class_find_device_by_of_node() calls class_find_device(), it will take
the reference, use the put_device() to drop the reference when not need
anymore.
Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221220121807.1543790-1-linmq006@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/led-class.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index 6e88df4c87fa8..1024b1562aafc 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -235,6 +235,7 @@ struct led_classdev *of_led_get(struct device_node *np, int index)
led_dev = class_find_device_by_of_node(leds_class, led_node);
of_node_put(led_node);
+ put_device(led_dev);
if (!led_dev)
return ERR_PTR(-EPROBE_DEFER);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 261/567] perf inject: Use perf_data__read() for auxtrace
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 260/567] leds: led-core: Fix refcount leak in of_led_get() Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 262/567] perf intel-pt: Add documentation for Event Trace and TNT disable Greg Kroah-Hartman
` (309 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, James Clark,
Namhyung Kim, Ian Rogers, Ingo Molnar, Jiri Olsa, Leo Yan,
Peter Zijlstra, Stephane Eranian, Arnaldo Carvalho de Melo,
Sasha Levin
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 1746212daeba95e9ae1639227dc0c3591d41deeb ]
In copy_bytes(), it reads the data from the (input) fd and writes it to
the output file. But it does with the read(2) unconditionally which
caused a problem of mixing buffered vs unbuffered I/O together.
You can see the problem when using pipes.
$ perf record -e intel_pt// -o- true | perf inject -b > /dev/null
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.000 MB - ]
0x45c0 [0x30]: failed to process type: 71
It should use perf_data__read() to honor the 'use_stdio' setting.
Fixes: 601366678c93618f ("perf data: Allow to use stdio functions for pipe mode")
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: James Clark <james.clark@arm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: https://lore.kernel.org/r/20230131023350.1903992-2-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-inject.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
index 50c2e6892b3e9..f15c146e00548 100644
--- a/tools/perf/builtin-inject.c
+++ b/tools/perf/builtin-inject.c
@@ -142,14 +142,14 @@ static int perf_event__repipe_event_update(struct perf_tool *tool,
#ifdef HAVE_AUXTRACE_SUPPORT
-static int copy_bytes(struct perf_inject *inject, int fd, off_t size)
+static int copy_bytes(struct perf_inject *inject, struct perf_data *data, off_t size)
{
char buf[4096];
ssize_t ssz;
int ret;
while (size > 0) {
- ssz = read(fd, buf, min(size, (off_t)sizeof(buf)));
+ ssz = perf_data__read(data, buf, min(size, (off_t)sizeof(buf)));
if (ssz < 0)
return -errno;
ret = output_bytes(inject, buf, ssz);
@@ -187,7 +187,7 @@ static s64 perf_event__repipe_auxtrace(struct perf_session *session,
ret = output_bytes(inject, event, event->header.size);
if (ret < 0)
return ret;
- ret = copy_bytes(inject, perf_data__fd(session->data),
+ ret = copy_bytes(inject, session->data,
event->auxtrace.size);
} else {
ret = output_bytes(inject, event,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 262/567] perf intel-pt: Add documentation for Event Trace and TNT disable
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 261/567] perf inject: Use perf_data__read() for auxtrace Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 16:59 ` [PATCH 5.15 263/567] perf intel-pt: Add link to the perf wikis Intel PT page Greg Kroah-Hartman
` (308 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Alexander Shishkin,
Andi Kleen, Jiri Olsa, Arnaldo Carvalho de Melo, Sasha Levin
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 24e3599c5a88e0e2995e3f5c9305f80195942dc9 ]
Add documentation for Event Trace and TNT disable to the perf Intel PT man
page.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Link: https://lore.kernel.org/r/20220124084201.2699795-26-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: aeb802f872a7 ("perf intel-pt: Do not try to queue auxtrace data on pipe")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/Documentation/perf-intel-pt.txt | 104 ++++++++++++++++++++-
1 file changed, 102 insertions(+), 2 deletions(-)
diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt
index db465fa7ee918..48460923a0e4e 100644
--- a/tools/perf/Documentation/perf-intel-pt.txt
+++ b/tools/perf/Documentation/perf-intel-pt.txt
@@ -108,9 +108,10 @@ displayed as follows:
perf script --itrace=ibxwpe -F+flags
-The flags are "bcrosyiABExgh" which stand for branch, call, return, conditional,
+The flags are "bcrosyiABExghDt" which stand for branch, call, return, conditional,
system, asynchronous, interrupt, transaction abort, trace begin, trace end,
-in transaction, VM-entry, and VM-exit respectively.
+in transaction, VM-entry, VM-exit, interrupt disabled, and interrupt disable
+toggle respectively.
perf script also supports higher level ways to dump instruction traces:
@@ -472,6 +473,30 @@ pwr_evt Enable power events. The power events provide information about
which contains "1" if the feature is supported and
"0" otherwise.
+event Enable Event Trace. The events provide information about asynchronous
+ events.
+
+ Support for this feature is indicated by:
+
+ /sys/bus/event_source/devices/intel_pt/caps/event_trace
+
+ which contains "1" if the feature is supported and
+ "0" otherwise.
+
+notnt Disable TNT packets. Without TNT packets, it is not possible to walk
+ executable code to reconstruct control flow, however FUP, TIP, TIP.PGE
+ and TIP.PGD packets still indicate asynchronous control flow, and (if
+ return compression is disabled - see noretcomp) return statements.
+ The advantage of eliminating TNT packets is reducing the size of the
+ trace and corresponding tracing overhead.
+
+ Support for this feature is indicated by:
+
+ /sys/bus/event_source/devices/intel_pt/caps/tnt_disable
+
+ which contains "1" if the feature is supported and
+ "0" otherwise.
+
AUX area sampling option
~~~~~~~~~~~~~~~~~~~~~~~~
@@ -865,6 +890,8 @@ The letters are:
p synthesize "power" events (incl. PSB events)
c synthesize branches events (calls only)
r synthesize branches events (returns only)
+ o synthesize PEBS-via-PT events
+ I synthesize Event Trace events
e synthesize tracing error events
d create a debug log
g synthesize a call chain (use with i or x)
@@ -1338,6 +1365,79 @@ There were none.
:17006 17006 [001] 11500.262869216: ffffffff8220116e error_entry+0xe ([guest.kernel.kallsyms]) pushq %rax
+Event Trace
+-----------
+
+Event Trace records information about asynchronous events, for example interrupts,
+faults, VM exits and entries. The information is recorded in CFE and EVD packets,
+and also the Interrupt Flag is recorded on the MODE.Exec packet. The CFE packet
+contains a type field to identify one of the following:
+
+ 1 INTR interrupt, fault, exception, NMI
+ 2 IRET interrupt return
+ 3 SMI system management interrupt
+ 4 RSM resume from system management mode
+ 5 SIPI startup interprocessor interrupt
+ 6 INIT INIT signal
+ 7 VMENTRY VM-Entry
+ 8 VMEXIT VM-Entry
+ 9 VMEXIT_INTR VM-Exit due to interrupt
+ 10 SHUTDOWN Shutdown
+
+For more details, refer to the Intel 64 and IA-32 Architectures Software
+Developer Manuals (version 076 or later).
+
+The capability to do Event Trace is indicated by the
+/sys/bus/event_source/devices/intel_pt/caps/event_trace file.
+
+Event trace is selected for recording using the "event" config term. e.g.
+
+ perf record -e intel_pt/event/u uname
+
+Event trace events are output using the --itrace I option. e.g.
+
+ perf script --itrace=Ie
+
+perf script displays events containing CFE type, vector and event data,
+in the form:
+
+ evt: hw int (t) cfe: INTR IP: 1 vector: 3 PFA: 0x8877665544332211
+
+The IP flag indicates if the event binds to an IP, which includes any case where
+flow control packet generation is enabled, as well as when CFE packet IP bit is
+set.
+
+perf script displays events containing changes to the Interrupt Flag in the form:
+
+ iflag: t IFLAG: 1->0 via branch
+
+where "via branch" indicates a branch (interrupt or return from interrupt) and
+"non branch" indicates an instruction such as CFI, STI or POPF).
+
+In addition, the current state of the interrupt flag is indicated by the presence
+or absence of the "D" (interrupt disabled) perf script flag. If the interrupt
+flag is changed, then the "t" flag is also included i.e.
+
+ no flag, interrupts enabled IF=1
+ t interrupts become disabled IF=1 -> IF=0
+ D interrupts are disabled IF=0
+ Dt interrupts become enabled IF=0 -> IF=1
+
+The intel-pt-events.py script illustrates how to access Event Trace information
+using a Python script.
+
+
+TNT Disable
+-----------
+
+TNT packets are disabled using the "notnt" config term. e.g.
+
+ perf record -e intel_pt/notnt/u uname
+
+In that case the --itrace q option is forced because walking executable code
+to reconstruct the control flow is not possible.
+
+
SEE ALSO
--------
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 263/567] perf intel-pt: Add link to the perf wikis Intel PT page
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 262/567] perf intel-pt: Add documentation for Event Trace and TNT disable Greg Kroah-Hartman
@ 2023-03-07 16:59 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 264/567] perf intel-pt: Add support for emulated ptwrite Greg Kroah-Hartman
` (307 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 16:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Jiri Olsa,
Arnaldo Carvalho de Melo, Sasha Levin
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 9e5e641045ff09ded4eb52828c4c7e110635422a ]
Add an EXAMPLE section and link to the perf wiki's Intel PT page.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Link: http://lore.kernel.org/lkml/20220426133213.248475-1-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: aeb802f872a7 ("perf intel-pt: Do not try to queue auxtrace data on pipe")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/Documentation/perf-intel-pt.txt | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt
index 48460923a0e4e..d44e6a332dfb1 100644
--- a/tools/perf/Documentation/perf-intel-pt.txt
+++ b/tools/perf/Documentation/perf-intel-pt.txt
@@ -1438,6 +1438,13 @@ In that case the --itrace q option is forced because walking executable code
to reconstruct the control flow is not possible.
+EXAMPLE
+-------
+
+Examples can be found on perf wiki page "Perf tools support for Intel® Processor Trace":
+
+https://perf.wiki.kernel.org/index.php/Perf_tools_support_for_Intel%C2%AE_Processor_Trace
+
SEE ALSO
--------
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 264/567] perf intel-pt: Add support for emulated ptwrite
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2023-03-07 16:59 ` [PATCH 5.15 263/567] perf intel-pt: Add link to the perf wikis Intel PT page Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 265/567] perf intel-pt: Do not try to queue auxtrace data on pipe Greg Kroah-Hartman
` (306 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Jiri Olsa,
Arnaldo Carvalho de Melo, Sasha Levin
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit d7015e50a9ed180dcc3947635bb2b5711c37f48b ]
ptwrite is an Intel x86 instruction that writes arbitrary values into an
Intel PT trace. It is not supported on all hardware, so provide an
alternative that makes use of TNT packets to convey the payload data.
TNT packets encode Taken/Not-taken conditional branch information, so
taking branches based on the payload value will encode the value into
the TNT packet. Refer to the changes to the documentation file
perf-intel-pt.txt in this patch for an example.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20220509152400.376613-2-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: aeb802f872a7 ("perf intel-pt: Do not try to queue auxtrace data on pipe")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/Documentation/perf-intel-pt.txt | 88 +++++++++++++++++
.../util/intel-pt-decoder/intel-pt-decoder.c | 99 ++++++++++++++++++-
.../util/intel-pt-decoder/intel-pt-decoder.h | 1 +
.../intel-pt-decoder/intel-pt-insn-decoder.c | 1 +
.../intel-pt-decoder/intel-pt-insn-decoder.h | 1 +
tools/perf/util/intel-pt.c | 37 ++++++-
6 files changed, 224 insertions(+), 3 deletions(-)
diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt
index d44e6a332dfb1..5415c4993c6b4 100644
--- a/tools/perf/Documentation/perf-intel-pt.txt
+++ b/tools/perf/Documentation/perf-intel-pt.txt
@@ -457,6 +457,8 @@ ptw Enable PTWRITE packets which are produced when a ptwrite instruction
which contains "1" if the feature is supported and
"0" otherwise.
+ As an alternative, refer to "Emulated PTWRITE" further below.
+
fup_on_ptw Enable a FUP packet to follow the PTWRITE packet. The FUP packet
provides the address of the ptwrite instruction. In the absence of
fup_on_ptw, the decoder will use the address of the previous branch
@@ -1438,6 +1440,92 @@ In that case the --itrace q option is forced because walking executable code
to reconstruct the control flow is not possible.
+Emulated PTWRITE
+----------------
+
+Later perf tools support a method to emulate the ptwrite instruction, which
+can be useful if hardware does not support the ptwrite instruction.
+
+Instead of using the ptwrite instruction, a function is used which produces
+a trace that encodes the payload data into TNT packets. Here is an example
+of the function:
+
+ #include <stdint.h>
+
+ void perf_emulate_ptwrite(uint64_t x)
+ __attribute__((externally_visible, noipa, no_instrument_function, naked));
+
+ #define PERF_EMULATE_PTWRITE_8_BITS \
+ "1: shl %rax\n" \
+ " jc 1f\n" \
+ "1: shl %rax\n" \
+ " jc 1f\n" \
+ "1: shl %rax\n" \
+ " jc 1f\n" \
+ "1: shl %rax\n" \
+ " jc 1f\n" \
+ "1: shl %rax\n" \
+ " jc 1f\n" \
+ "1: shl %rax\n" \
+ " jc 1f\n" \
+ "1: shl %rax\n" \
+ " jc 1f\n" \
+ "1: shl %rax\n" \
+ " jc 1f\n"
+
+ /* Undefined instruction */
+ #define PERF_EMULATE_PTWRITE_UD2 ".byte 0x0f, 0x0b\n"
+
+ #define PERF_EMULATE_PTWRITE_MAGIC PERF_EMULATE_PTWRITE_UD2 ".ascii \"perf,ptwrite \"\n"
+
+ void perf_emulate_ptwrite(uint64_t x __attribute__ ((__unused__)))
+ {
+ /* Assumes SysV ABI : x passed in rdi */
+ __asm__ volatile (
+ "jmp 1f\n"
+ PERF_EMULATE_PTWRITE_MAGIC
+ "1: mov %rdi, %rax\n"
+ PERF_EMULATE_PTWRITE_8_BITS
+ PERF_EMULATE_PTWRITE_8_BITS
+ PERF_EMULATE_PTWRITE_8_BITS
+ PERF_EMULATE_PTWRITE_8_BITS
+ PERF_EMULATE_PTWRITE_8_BITS
+ PERF_EMULATE_PTWRITE_8_BITS
+ PERF_EMULATE_PTWRITE_8_BITS
+ PERF_EMULATE_PTWRITE_8_BITS
+ "1: ret\n"
+ );
+ }
+
+For example, a test program with the function above:
+
+ #include <stdio.h>
+ #include <stdint.h>
+ #include <stdlib.h>
+
+ #include "perf_emulate_ptwrite.h"
+
+ int main(int argc, char *argv[])
+ {
+ uint64_t x = 0;
+
+ if (argc > 1)
+ x = strtoull(argv[1], NULL, 0);
+ perf_emulate_ptwrite(x);
+ return 0;
+ }
+
+Can be compiled and traced:
+
+ $ gcc -Wall -Wextra -O3 -g -o eg_ptw eg_ptw.c
+ $ perf record -e intel_pt//u ./eg_ptw 0x1234567890abcdef
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.017 MB perf.data ]
+ $ perf script --itrace=ew
+ eg_ptw 19875 [007] 8061.235912: ptwrite: IP: 0 payload: 0x1234567890abcdef 55701249a196 perf_emulate_ptwrite+0x16 (/home/user/eg_ptw)
+ $
+
+
EXAMPLE
-------
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
index b0034ee4bba50..a7daec6cdc7b2 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -137,6 +137,7 @@ struct intel_pt_decoder {
bool in_psb;
bool hop;
bool leap;
+ bool emulated_ptwrite;
bool vm_time_correlation;
bool vm_tm_corr_dry_run;
bool vm_tm_corr_reliable;
@@ -473,6 +474,8 @@ static int intel_pt_ext_err(int code)
return INTEL_PT_ERR_LOST;
case -ELOOP:
return INTEL_PT_ERR_NELOOP;
+ case -ECONNRESET:
+ return INTEL_PT_ERR_EPTW;
default:
return INTEL_PT_ERR_UNK;
}
@@ -489,6 +492,7 @@ static const char *intel_pt_err_msgs[] = {
[INTEL_PT_ERR_LOST] = "Lost trace data",
[INTEL_PT_ERR_UNK] = "Unknown error!",
[INTEL_PT_ERR_NELOOP] = "Never-ending loop (refer perf config intel-pt.max-loops)",
+ [INTEL_PT_ERR_EPTW] = "Broken emulated ptwrite",
};
int intel_pt__strerror(int code, char *buf, size_t buflen)
@@ -1402,17 +1406,108 @@ static int intel_pt_walk_tip(struct intel_pt_decoder *decoder)
return intel_pt_bug(decoder);
}
+struct eptw_data {
+ int bit_countdown;
+ uint64_t payload;
+};
+
+static int intel_pt_eptw_lookahead_cb(struct intel_pt_pkt_info *pkt_info)
+{
+ struct eptw_data *data = pkt_info->data;
+ int nr_bits;
+
+ switch (pkt_info->packet.type) {
+ case INTEL_PT_PAD:
+ case INTEL_PT_MNT:
+ case INTEL_PT_MODE_EXEC:
+ case INTEL_PT_MODE_TSX:
+ case INTEL_PT_MTC:
+ case INTEL_PT_FUP:
+ case INTEL_PT_CYC:
+ case INTEL_PT_CBR:
+ case INTEL_PT_TSC:
+ case INTEL_PT_TMA:
+ case INTEL_PT_PIP:
+ case INTEL_PT_VMCS:
+ case INTEL_PT_PSB:
+ case INTEL_PT_PSBEND:
+ case INTEL_PT_PTWRITE:
+ case INTEL_PT_PTWRITE_IP:
+ case INTEL_PT_EXSTOP:
+ case INTEL_PT_EXSTOP_IP:
+ case INTEL_PT_MWAIT:
+ case INTEL_PT_PWRE:
+ case INTEL_PT_PWRX:
+ case INTEL_PT_BBP:
+ case INTEL_PT_BIP:
+ case INTEL_PT_BEP:
+ case INTEL_PT_BEP_IP:
+ case INTEL_PT_CFE:
+ case INTEL_PT_CFE_IP:
+ case INTEL_PT_EVD:
+ break;
+
+ case INTEL_PT_TNT:
+ nr_bits = data->bit_countdown;
+ if (nr_bits > pkt_info->packet.count)
+ nr_bits = pkt_info->packet.count;
+ data->payload <<= nr_bits;
+ data->payload |= pkt_info->packet.payload >> (64 - nr_bits);
+ data->bit_countdown -= nr_bits;
+ return !data->bit_countdown;
+
+ case INTEL_PT_TIP_PGE:
+ case INTEL_PT_TIP_PGD:
+ case INTEL_PT_TIP:
+ case INTEL_PT_BAD:
+ case INTEL_PT_OVF:
+ case INTEL_PT_TRACESTOP:
+ default:
+ return 1;
+ }
+
+ return 0;
+}
+
+static int intel_pt_emulated_ptwrite(struct intel_pt_decoder *decoder)
+{
+ int n = 64 - decoder->tnt.count;
+ struct eptw_data data = {
+ .bit_countdown = n,
+ .payload = decoder->tnt.payload >> n,
+ };
+
+ decoder->emulated_ptwrite = false;
+ intel_pt_log("Emulated ptwrite detected\n");
+
+ intel_pt_pkt_lookahead(decoder, intel_pt_eptw_lookahead_cb, &data);
+ if (data.bit_countdown)
+ return -ECONNRESET;
+
+ decoder->state.type = INTEL_PT_PTW;
+ decoder->state.from_ip = decoder->ip;
+ decoder->state.to_ip = 0;
+ decoder->state.ptw_payload = data.payload;
+ return 0;
+}
+
static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder)
{
struct intel_pt_insn intel_pt_insn;
int err;
while (1) {
+ if (decoder->emulated_ptwrite)
+ return intel_pt_emulated_ptwrite(decoder);
err = intel_pt_walk_insn(decoder, &intel_pt_insn, 0);
- if (err == INTEL_PT_RETURN)
+ if (err == INTEL_PT_RETURN) {
+ decoder->emulated_ptwrite = intel_pt_insn.emulated_ptwrite;
return 0;
- if (err)
+ }
+ if (err) {
+ decoder->emulated_ptwrite = false;
return err;
+ }
if (intel_pt_insn.op == INTEL_PT_OP_RET) {
if (!decoder->return_compression) {
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
index 4b5e79fcf557f..0a641aba3c7cb 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
@@ -55,6 +55,7 @@ enum {
INTEL_PT_ERR_LOST,
INTEL_PT_ERR_UNK,
INTEL_PT_ERR_NELOOP,
+ INTEL_PT_ERR_EPTW,
INTEL_PT_ERR_MAX,
};
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
index 593f20e9774c0..9f29cf7210773 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
@@ -32,6 +32,7 @@ static void intel_pt_insn_decoder(struct insn *insn,
int ext;
intel_pt_insn->rel = 0;
+ intel_pt_insn->emulated_ptwrite = false;
if (insn_is_avx(insn)) {
intel_pt_insn->op = INTEL_PT_OP_OTHER;
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.h
index c2861cfdd768d..e3338b56a75f2 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.h
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.h
@@ -37,6 +37,7 @@ enum intel_pt_insn_branch {
struct intel_pt_insn {
enum intel_pt_insn_op op;
enum intel_pt_insn_branch branch;
+ bool emulated_ptwrite;
int length;
int32_t rel;
unsigned char buf[INTEL_PT_INSN_BUF_SZ];
diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index 6324195467056..89863efedc82c 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -506,6 +506,7 @@ struct intel_pt_cache_entry {
u64 byte_cnt;
enum intel_pt_insn_op op;
enum intel_pt_insn_branch branch;
+ bool emulated_ptwrite;
int length;
int32_t rel;
char insn[INTEL_PT_INSN_BUF_SZ];
@@ -592,6 +593,7 @@ static int intel_pt_cache_add(struct dso *dso, struct machine *machine,
e->byte_cnt = byte_cnt;
e->op = intel_pt_insn->op;
e->branch = intel_pt_insn->branch;
+ e->emulated_ptwrite = intel_pt_insn->emulated_ptwrite;
e->length = intel_pt_insn->length;
e->rel = intel_pt_insn->rel;
memcpy(e->insn, intel_pt_insn->buf, INTEL_PT_INSN_BUF_SZ);
@@ -678,6 +680,28 @@ static int intel_pt_get_guest(struct intel_pt_queue *ptq)
return 0;
}
+static inline bool intel_pt_jmp_16(struct intel_pt_insn *intel_pt_insn)
+{
+ return intel_pt_insn->rel == 16 && intel_pt_insn->branch == INTEL_PT_BR_UNCONDITIONAL;
+}
+
+#define PTWRITE_MAGIC "\x0f\x0bperf,ptwrite "
+#define PTWRITE_MAGIC_LEN 16
+
+static bool intel_pt_emulated_ptwrite(struct dso *dso, struct machine *machine, u64 offset)
+{
+ unsigned char buf[PTWRITE_MAGIC_LEN];
+ ssize_t len;
+
+ len = dso__data_read_offset(dso, machine, offset, buf, PTWRITE_MAGIC_LEN);
+ if (len == PTWRITE_MAGIC_LEN && !memcmp(buf, PTWRITE_MAGIC, PTWRITE_MAGIC_LEN)) {
+ intel_pt_log("Emulated ptwrite signature found\n");
+ return true;
+ }
+ intel_pt_log("Emulated ptwrite signature not found\n");
+ return false;
+}
+
static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn,
uint64_t *insn_cnt_ptr, uint64_t *ip,
uint64_t to_ip, uint64_t max_insn_cnt,
@@ -740,6 +764,7 @@ static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn,
*ip += e->byte_cnt;
intel_pt_insn->op = e->op;
intel_pt_insn->branch = e->branch;
+ intel_pt_insn->emulated_ptwrite = e->emulated_ptwrite;
intel_pt_insn->length = e->length;
intel_pt_insn->rel = e->rel;
memcpy(intel_pt_insn->buf, e->insn,
@@ -771,8 +796,18 @@ static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn,
insn_cnt += 1;
- if (intel_pt_insn->branch != INTEL_PT_BR_NO_BRANCH)
+ if (intel_pt_insn->branch != INTEL_PT_BR_NO_BRANCH) {
+ bool eptw;
+ u64 offs;
+
+ if (!intel_pt_jmp_16(intel_pt_insn))
+ goto out;
+ /* Check for emulated ptwrite */
+ offs = offset + intel_pt_insn->length;
+ eptw = intel_pt_emulated_ptwrite(al.map->dso, machine, offs);
+ intel_pt_insn->emulated_ptwrite = eptw;
goto out;
+ }
if (max_insn_cnt && insn_cnt >= max_insn_cnt)
goto out_no_cache;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 265/567] perf intel-pt: Do not try to queue auxtrace data on pipe
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 264/567] perf intel-pt: Add support for emulated ptwrite Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 266/567] perf tools: Fix auto-complete on aarch64 Greg Kroah-Hartman
` (305 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, James Clark,
Namhyung Kim, Ian Rogers, Ingo Molnar, Jiri Olsa, Leo Yan,
Peter Zijlstra, Stephane Eranian, Arnaldo Carvalho de Melo,
Sasha Levin
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit aeb802f872a7c42e4381f36041e77d1745908255 ]
When it processes AUXTRACE_INFO, it calls to auxtrace_queue_data() to
collect AUXTRACE data first. That won't work with pipe since it needs
lseek() to read the scattered aux data.
$ perf record -o- -e intel_pt// true | perf report -i- --itrace=i100
# To display the perf.data header info, please use --header/--header-only options.
#
0x4118 [0xa0]: failed to process type: 70
Error:
failed to process sample
For the pipe mode, it can handle the aux data as it gets. But there's
no guarantee it can get the aux data in time. So the following warning
will be shown at the beginning:
WARNING: Intel PT with pipe mode is not recommended.
The output cannot relied upon. In particular,
time stamps and the order of events may be incorrect.
Fixes: dbd134322e74f19d ("perf intel-pt: Add support for decoding AUX area samples")
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: James Clark <james.clark@arm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: https://lore.kernel.org/r/20230131023350.1903992-3-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/Documentation/perf-intel-pt.txt | 30 ++++++++++++++++++++++
tools/perf/util/auxtrace.c | 3 +++
tools/perf/util/intel-pt.c | 6 +++++
3 files changed, 39 insertions(+)
diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt
index 5415c4993c6b4..de63c418e4d1f 100644
--- a/tools/perf/Documentation/perf-intel-pt.txt
+++ b/tools/perf/Documentation/perf-intel-pt.txt
@@ -1526,6 +1526,36 @@ Can be compiled and traced:
$
+Pipe mode
+---------
+Pipe mode is a problem for Intel PT and possibly other auxtrace users.
+It's not recommended to use a pipe as data output with Intel PT because
+of the following reason.
+
+Essentially the auxtrace buffers do not behave like the regular perf
+event buffers. That is because the head and tail are updated by
+software, but in the auxtrace case the data is written by hardware.
+So the head and tail do not get updated as data is written.
+
+In the Intel PT case, the head and tail are updated only when the trace
+is disabled by software, for example:
+ - full-trace, system wide : when buffer passes watermark
+ - full-trace, not system-wide : when buffer passes watermark or
+ context switches
+ - snapshot mode : as above but also when a snapshot is made
+ - sample mode : as above but also when a sample is made
+
+That means finished-round ordering doesn't work. An auxtrace buffer
+can turn up that has data that extends back in time, possibly to the
+very beginning of tracing.
+
+For a perf.data file, that problem is solved by going through the trace
+and queuing up the auxtrace buffers in advance.
+
+For pipe mode, the order of events and timestamps can presumably
+be messed up.
+
+
EXAMPLE
-------
diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
index 0ef4cbf21e627..344b65a8f7687 100644
--- a/tools/perf/util/auxtrace.c
+++ b/tools/perf/util/auxtrace.c
@@ -1107,6 +1107,9 @@ int auxtrace_queue_data(struct perf_session *session, bool samples, bool events)
if (auxtrace__dont_decode(session))
return 0;
+ if (perf_data__is_pipe(session->data))
+ return 0;
+
if (!session->auxtrace || !session->auxtrace->queue_data)
return -EINVAL;
diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index 89863efedc82c..7a2ce387079e3 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -3942,6 +3942,12 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
intel_pt_setup_pebs_events(pt);
+ if (perf_data__is_pipe(session->data)) {
+ pr_warning("WARNING: Intel PT with pipe mode is not recommended.\n"
+ " The output cannot relied upon. In particular,\n"
+ " timestamps and the order of events may be incorrect.\n");
+ }
+
if (pt->sampling_mode || list_empty(&session->auxtrace_index))
err = auxtrace_queue_data(session, true, true);
else
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 266/567] perf tools: Fix auto-complete on aarch64
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 265/567] perf intel-pt: Do not try to queue auxtrace data on pipe Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 267/567] sparc: allow PM configs for sparc32 COMPILE_TEST Greg Kroah-Hartman
` (304 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Yicong Yang,
Alexander Shishkin, Ingo Molnar, Jin Yao, Jiri Olsa,
Mark Rutland, Namhyung Kim, Peter Zijlstra, linux-arm-kernel,
linuxarm, prime.zeng, Arnaldo Carvalho de Melo, Sasha Levin
From: Yicong Yang <yangyicong@hisilicon.com>
[ Upstream commit ffd1240e8f0814262ceb957dbe961f6e0aef1e7a ]
On aarch64 CPU related events are not under event_source/devices/cpu/events,
they're under event_source/devices/armv8_pmuv3_0/events on my machine.
Using current auto-complete script will generate below error:
[root@localhost bin]# perf stat -e
ls: cannot access '/sys/bus/event_source/devices/cpu/events': No such file or directory
Fix this by not testing /sys/bus/event_source/devices/cpu/events on
aarch64 machine.
Fixes: 74cd5815d9af6e6c ("perf tool: Improve bash command line auto-complete for multiple events with comma")
Reviewed-by: James Clark <james.clark@arm.com>
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jin Yao <yao.jin@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linuxarm@huawei.com
Cc: prime.zeng@hisilicon.com
Link: https://lore.kernel.org/r/20230207035057.43394-1-yangyicong@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/perf-completion.sh | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/tools/perf/perf-completion.sh b/tools/perf/perf-completion.sh
index fdf75d45efff7..978249d7868c2 100644
--- a/tools/perf/perf-completion.sh
+++ b/tools/perf/perf-completion.sh
@@ -165,7 +165,12 @@ __perf_main ()
local cur1=${COMP_WORDS[COMP_CWORD]}
local raw_evts=$($cmd list --raw-dump)
- local arr s tmp result
+ local arr s tmp result cpu_evts
+
+ # aarch64 doesn't have /sys/bus/event_source/devices/cpu/events
+ if [[ `uname -m` != aarch64 ]]; then
+ cpu_evts=$(ls /sys/bus/event_source/devices/cpu/events)
+ fi
if [[ "$cur1" == */* && ${cur1#*/} =~ ^[A-Z] ]]; then
OLD_IFS="$IFS"
@@ -183,9 +188,9 @@ __perf_main ()
fi
done
- evts=${result}" "$(ls /sys/bus/event_source/devices/cpu/events)
+ evts=${result}" "${cpu_evts}
else
- evts=${raw_evts}" "$(ls /sys/bus/event_source/devices/cpu/events)
+ evts=${raw_evts}" "${cpu_evts}
fi
if [[ "$cur1" == , ]]; then
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 267/567] sparc: allow PM configs for sparc32 COMPILE_TEST
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 266/567] perf tools: Fix auto-complete on aarch64 Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 268/567] selftests/ftrace: Fix bash specific "==" operator Greg Kroah-Hartman
` (303 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Arnd Bergmann,
Sam Ravnborg, David S. Miller, Kirill Tkhai, Andrew Morton,
Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 7be6a87c2473957090995b7eb541e31d57a2c801 ]
When doing randconfig builds for sparc32 with COMPILE_TEST, some
(non-Sparc) drivers cause kconfig warnings with the Kconfig symbols PM,
PM_GENERIC_DOMAINS, or PM_GENERIC_DOMAINS_OF.
This is due to arch/sparc/Kconfig not using the PM Kconfig for
Sparc32:
if SPARC64
source "kernel/power/Kconfig"
endif
Arnd suggested adding "|| COMPILE_TEST" to the conditional,
instead of trying to track down every driver that selects
any of these PM symbols.
Fixes the following kconfig warnings:
WARNING: unmet direct dependencies detected for PM
Depends on [n]: SPARC64 [=n]
Selected by [y]:
- SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
WARNING: unmet direct dependencies detected for PM
Depends on [n]: SPARC64 [=n]
Selected by [y]:
- SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS
Depends on [n]: SPARC64 [=n] && PM [=y]
Selected by [y]:
- QCOM_GDSC [=y] && COMMON_CLK [=y] && PM [=y]
- SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
- MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
- BCM2835_POWER [=y] && (ARCH_BCM2835 || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
- BCM_PMB [=y] && (ARCH_BCMBCA || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
- ROCKCHIP_PM_DOMAINS [=y] && (ARCH_ROCKCHIP || COMPILE_TEST [=y]) && PM [=y]
Selected by [m]:
- ARM_SCPI_POWER_DOMAIN [=m] && (ARM_SCPI_PROTOCOL [=m] || COMPILE_TEST [=y] && OF [=y]) && PM [=y]
- MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
- QCOM_AOSS_QMP [=m] && (ARCH_QCOM || COMPILE_TEST [=y]) && MAILBOX [=y] && COMMON_CLK [=y] && PM [=y]
WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS_OF
Depends on [n]: SPARC64 [=n] && PM_GENERIC_DOMAINS [=y] && OF [=y]
Selected by [y]:
- MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
Selected by [m]:
- MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
Link: https://lkml.kernel.org/r/20230205004357.29459-1-rdunlap@infradead.org
Fixes: bdde6b3c8ba4 ("sparc64: Hibernation support")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Kirill Tkhai <tkhai@yandex.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index b120ed947f50b..eff9116bf7be3 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -286,7 +286,7 @@ config FORCE_MAX_ZONEORDER
This config option is actually maximum order plus one. For example,
a value of 13 means that the largest free memory block is 2^12 pages.
-if SPARC64
+if SPARC64 || COMPILE_TEST
source "kernel/power/Kconfig"
endif
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 268/567] selftests/ftrace: Fix bash specific "==" operator
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 267/567] sparc: allow PM configs for sparc32 COMPILE_TEST Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 269/567] printf: fix errname.c list Greg Kroah-Hartman
` (302 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google),
Steven Rostedt (Google),
Shuah Khan, Sasha Levin
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
[ Upstream commit 1e6b485c922fbedf41d5a9f4e6449c5aeb923a32 ]
Since commit a1d6cd88c897 ("selftests/ftrace: event_triggers: wait
longer for test_event_enable") introduced bash specific "=="
comparation operator, that test will fail when we run it on a
posix-shell. `checkbashisms` warned it as below.
possible bashism in ftrace/func_event_triggers.tc line 45 (should be 'b = a'):
if [ "$e" == $val ]; then
This replaces it with "=".
Fixes: a1d6cd88c897 ("selftests/ftrace: event_triggers: wait longer for test_event_enable")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/ftrace/test.d/ftrace/func_event_triggers.tc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
index 27a68bbe778be..d9b8127950771 100644
--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
+++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
@@ -42,7 +42,7 @@ test_event_enabled() {
while [ $check_times -ne 0 ]; do
e=`cat $EVENT_ENABLE`
- if [ "$e" == $val ]; then
+ if [ "$e" = $val ]; then
return 0
fi
sleep $SLEEP_TIME
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 269/567] printf: fix errname.c list
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 268/567] selftests/ftrace: Fix bash specific "==" operator Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 270/567] objtool: add UACCESS exceptions for __tsan_volatile_read/write Greg Kroah-Hartman
` (301 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Mladek, Rasmus Villemoes,
Uwe Kleine-König, Andy Shevchenko, Arnd Bergmann,
Sergey Senozhatsky, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 0c2baf6509af1d11310ae4c1c839481a6e9a4bc4 ]
On most architectures, gcc -Wextra warns about the list of error
numbers containing both EDEADLK and EDEADLOCK:
lib/errname.c:15:67: warning: initialized field overwritten [-Woverride-init]
15 | #define E(err) [err + BUILD_BUG_ON_ZERO(err <= 0 || err > 300)] = "-" #err
| ^~~
lib/errname.c:172:2: note: in expansion of macro 'E'
172 | E(EDEADLK), /* EDEADLOCK */
| ^
On parisc, a similar error happens with -ECANCELLED, which is an
alias for ECANCELED.
Make the EDEADLK printing conditional on the number being distinct
from EDEADLOCK, and remove the -ECANCELLED bit completely as it
can never be hit.
To ensure these are correct, add static_assert lines that verify
all the remaining aliases are in fact identical to the canonical
name.
Fixes: 57f5677e535b ("printf: add support for printing symbolic error names")
Cc: Petr Mladek <pmladek@suse.com>
Suggested-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Acked-by: Uwe Kleine-König <uwe@kleine-koenig.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/all/20210514213456.745039-1-arnd@kernel.org/
Link: https://lore.kernel.org/all/20210927123409.1109737-1-arnd@kernel.org/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Acked-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20230206194126.380350-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/errname.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/lib/errname.c b/lib/errname.c
index 05cbf731545f0..67739b174a8cc 100644
--- a/lib/errname.c
+++ b/lib/errname.c
@@ -21,6 +21,7 @@ static const char *names_0[] = {
E(EADDRNOTAVAIL),
E(EADV),
E(EAFNOSUPPORT),
+ E(EAGAIN), /* EWOULDBLOCK */
E(EALREADY),
E(EBADE),
E(EBADF),
@@ -31,15 +32,17 @@ static const char *names_0[] = {
E(EBADSLT),
E(EBFONT),
E(EBUSY),
-#ifdef ECANCELLED
- E(ECANCELLED),
-#endif
+ E(ECANCELED), /* ECANCELLED */
E(ECHILD),
E(ECHRNG),
E(ECOMM),
E(ECONNABORTED),
+ E(ECONNREFUSED), /* EREFUSED */
E(ECONNRESET),
+ E(EDEADLK), /* EDEADLOCK */
+#if EDEADLK != EDEADLOCK /* mips, sparc, powerpc */
E(EDEADLOCK),
+#endif
E(EDESTADDRREQ),
E(EDOM),
E(EDOTDOT),
@@ -166,14 +169,17 @@ static const char *names_0[] = {
E(EUSERS),
E(EXDEV),
E(EXFULL),
-
- E(ECANCELED), /* ECANCELLED */
- E(EAGAIN), /* EWOULDBLOCK */
- E(ECONNREFUSED), /* EREFUSED */
- E(EDEADLK), /* EDEADLOCK */
};
#undef E
+#ifdef EREFUSED /* parisc */
+static_assert(EREFUSED == ECONNREFUSED);
+#endif
+#ifdef ECANCELLED /* parisc */
+static_assert(ECANCELLED == ECANCELED);
+#endif
+static_assert(EAGAIN == EWOULDBLOCK); /* everywhere */
+
#define E(err) [err - 512 + BUILD_BUG_ON_ZERO(err < 512 || err > 550)] = "-" #err
static const char *names_512[] = {
E(ERESTARTSYS),
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 270/567] objtool: add UACCESS exceptions for __tsan_volatile_read/write
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 269/567] printf: fix errname.c list Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 271/567] mfd: cs5535: Dont build on UML Greg Kroah-Hartman
` (300 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Marco Elver,
Alexander Potapenko, Andrey Konovalov, Andrey Ryabinin,
Dmitry Vyukov, Josh Poimboeuf, Kuan-Ying Lee,
Peter Zijlstra (Intel),
Vincenzo Frascino, Andrew Morton, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit d5d469247264e56960705dc5ae7e1d014861fe40 ]
A lot of the tsan helpers are already excempt from the UACCESS warnings,
but some more functions were added that need the same thing:
kernel/kcsan/core.o: warning: objtool: __tsan_volatile_read16+0x0: call to __tsan_unaligned_read16() with UACCESS enabled
kernel/kcsan/core.o: warning: objtool: __tsan_volatile_write16+0x0: call to __tsan_unaligned_write16() with UACCESS enabled
vmlinux.o: warning: objtool: __tsan_unaligned_volatile_read16+0x4: call to __tsan_unaligned_read16() with UACCESS enabled
vmlinux.o: warning: objtool: __tsan_unaligned_volatile_write16+0x4: call to __tsan_unaligned_write16() with UACCESS enabled
As Marco points out, these functions don't even call each other
explicitly but instead gcc (but not clang) notices the functions
being identical and turns one symbol into a direct branch to the
other.
Link: https://lkml.kernel.org/r/20230215130058.3836177-4-arnd@kernel.org
Fixes: 75d75b7a4d54 ("kcsan: Support distinguishing volatile accesses")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/objtool/check.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 3ef767284b3f0..2fc0270e3c1f7 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -908,6 +908,8 @@ static const char *uaccess_safe_builtin[] = {
"__tsan_atomic64_compare_exchange_val",
"__tsan_atomic_thread_fence",
"__tsan_atomic_signal_fence",
+ "__tsan_unaligned_read16",
+ "__tsan_unaligned_write16",
/* KCOV */
"write_comp_data",
"check_kcov_mode",
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 271/567] mfd: cs5535: Dont build on UML
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 270/567] objtool: add UACCESS exceptions for __tsan_volatile_read/write Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 272/567] mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() Greg Kroah-Hartman
` (299 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Lee Jones, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 5ec32a3e4053c1a726b45381d56aa9e39eaf3911 ]
The cs5535-mfd driver uses CPU-specific data that is not available
for ARCH=um builds, so don't allow it to be built for UML.
Prevents these build errors:
In file included from ../arch/x86/include/asm/olpc.h:7,
from ../drivers/mfd/cs5535-mfd.c:17:
../arch/x86/include/asm/geode.h: In function ‘is_geode_gx’:
../arch/x86/include/asm/geode.h:16:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’
16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) &&
../arch/x86/include/asm/geode.h:16:46: error: ‘X86_VENDOR_NSC’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’?
16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) &&
../arch/x86/include/asm/geode.h:17:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’
17 | (boot_cpu_data.x86 == 5) &&
../arch/x86/include/asm/geode.h:18:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’
18 | (boot_cpu_data.x86_model == 5));
../arch/x86/include/asm/geode.h: In function ‘is_geode_lx’:
../arch/x86/include/asm/geode.h:23:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’
23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) &&
../arch/x86/include/asm/geode.h:23:46: error: ‘X86_VENDOR_AMD’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’?
23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) &&
../arch/x86/include/asm/geode.h:24:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’
24 | (boot_cpu_data.x86 == 5) &&
../arch/x86/include/asm/geode.h:25:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’
25 | (boot_cpu_data.x86_model == 10));
Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221201012541.11809-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 5dd7ea0ebd46c..ef550d33af920 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -15,6 +15,7 @@ config MFD_CS5535
tristate "AMD CS5535 and CS5536 southbridge core functions"
select MFD_CORE
depends on PCI && (X86_32 || (X86 && COMPILE_TEST))
+ depends on !UML
help
This is the core driver for CS5535/CS5536 MFD functions. This is
necessary for using the board's GPIO and MFGPT functionality.
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 272/567] mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 271/567] mfd: cs5535: Dont build on UML Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 273/567] dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0 Greg Kroah-Hartman
` (298 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qiheng Lin, Lee Jones, Sasha Levin
From: Qiheng Lin <linqiheng@huawei.com>
[ Upstream commit 8b450dcff23aa254844492831a8e2b508a9d522d ]
`req` is allocated in pcf50633_adc_async_read(), but
adc_enqueue_request() could fail to insert the `req` into queue.
We need to check the return value and free it in the case of failure.
Fixes: 08c3e06a5eb2 ("mfd: PCF50633 adc driver")
Signed-off-by: Qiheng Lin <linqiheng@huawei.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20221208061555.8776-1-linqiheng@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/pcf50633-adc.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c
index 5cd653e615125..191b1bc6141c2 100644
--- a/drivers/mfd/pcf50633-adc.c
+++ b/drivers/mfd/pcf50633-adc.c
@@ -136,6 +136,7 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg,
void *callback_param)
{
struct pcf50633_adc_request *req;
+ int ret;
/* req is freed when the result is ready, in interrupt handler */
req = kmalloc(sizeof(*req), GFP_KERNEL);
@@ -147,7 +148,11 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg,
req->callback = callback;
req->callback_param = callback_param;
- return adc_enqueue_request(pcf, req);
+ ret = adc_enqueue_request(pcf, req);
+ if (ret)
+ kfree(req);
+
+ return ret;
}
EXPORT_SYMBOL_GPL(pcf50633_adc_async_read);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 273/567] dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 272/567] mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 274/567] dmaengine: HISI_DMA should depend on ARCH_HISI Greg Kroah-Hartman
` (297 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fenghua Yu, Dave Jiang, Vinod Koul,
Sasha Levin
From: Fenghua Yu <fenghua.yu@intel.com>
[ Upstream commit 9735bde36487da43d3c3fc910df49639f72decbf ]
On DSA/IAX 1.0, TC-A and TC-B in GRPCFG are set as 1 to have best
performance and cannot be changed through sysfs knobs unless override
option is given.
The same values should be set on DSA 2.0 as well.
Fixes: ea7c8f598c32 ("dmaengine: idxd: restore traffic class defaults after wq reset")
Fixes: ade8a86b512c ("dmaengine: idxd: Set defaults for GRPCFG traffic class")
Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/20221209172141.562648-1-fenghua.yu@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/idxd/device.c | 2 +-
drivers/dma/idxd/init.c | 2 +-
drivers/dma/idxd/sysfs.c | 4 ++--
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
index 37b07c679c0ee..535f021911c55 100644
--- a/drivers/dma/idxd/device.c
+++ b/drivers/dma/idxd/device.c
@@ -702,7 +702,7 @@ static void idxd_groups_clear_state(struct idxd_device *idxd)
group->use_rdbuf_limit = false;
group->rdbufs_allowed = 0;
group->rdbufs_reserved = 0;
- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) {
+ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) {
group->tc_a = 1;
group->tc_b = 1;
} else {
diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
index 6263d9825250b..e0e0c7f286b67 100644
--- a/drivers/dma/idxd/init.c
+++ b/drivers/dma/idxd/init.c
@@ -340,7 +340,7 @@ static int idxd_setup_groups(struct idxd_device *idxd)
}
idxd->groups[i] = group;
- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) {
+ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) {
group->tc_a = 1;
group->tc_b = 1;
} else {
diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
index 33d94c67fedb9..489a9d8850764 100644
--- a/drivers/dma/idxd/sysfs.c
+++ b/drivers/dma/idxd/sysfs.c
@@ -327,7 +327,7 @@ static ssize_t group_traffic_class_a_store(struct device *dev,
if (idxd->state == IDXD_DEV_ENABLED)
return -EPERM;
- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override)
+ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override)
return -EPERM;
if (val < 0 || val > 7)
@@ -369,7 +369,7 @@ static ssize_t group_traffic_class_b_store(struct device *dev,
if (idxd->state == IDXD_DEV_ENABLED)
return -EPERM;
- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override)
+ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override)
return -EPERM;
if (val < 0 || val > 7)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 274/567] dmaengine: HISI_DMA should depend on ARCH_HISI
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 273/567] dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0 Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 275/567] iio: light: tsl2563: Do not hardcode interrupt trigger type Greg Kroah-Hartman
` (296 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Vinod Koul, Sasha Levin
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit dcca9d045c0852584ad092123c7f6e6526a633b1 ]
The HiSilicon DMA Engine is only present on HiSilicon SoCs. Hence add a
dependency on ARCH_HISI, to prevent asking the user about this driver
when configuring a kernel without HiSilicon SoC support.
Fixes: e9f08b65250d73ab ("dmaengine: hisilicon: Add Kunpeng DMA engine support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/363a1816d36cd3cf604d88ec90f97c75f604de64.1669044190.git.geert+renesas@glider.be
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 80c2c03cb0141..95344ae49e532 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -236,7 +236,7 @@ config FSL_RAID
config HISI_DMA
tristate "HiSilicon DMA Engine support"
- depends on ARM64 || COMPILE_TEST
+ depends on ARCH_HISI || COMPILE_TEST
depends on PCI_MSI
select DMA_ENGINE
select DMA_VIRTUAL_CHANNELS
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 275/567] iio: light: tsl2563: Do not hardcode interrupt trigger type
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 274/567] dmaengine: HISI_DMA should depend on ARCH_HISI Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 276/567] usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe() Greg Kroah-Hartman
` (295 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ferry Toth, Andy Shevchenko,
Jonathan Cameron, Sasha Levin
From: Ferry Toth <ftoth@exalondelft.nl>
[ Upstream commit 027641b52fe37b64af61025298ce160c8b9b7a73 ]
Instead of hardcoding IRQ trigger type to IRQF_TRIGGER_RAISING,
let's respect the settings specified in the firmware description.
To be compatible with the older firmware descriptions, if trigger
type is not set up there, we'll set it to default (raising edge).
Fixes: 388be4883952 ("staging:iio: tsl2563 abi fixes and interrupt handling")
Fixes: bdab1001738f ("staging:iio:light:tsl2563 remove old style event registration.")
Signed-off-by: Ferry Toth <ftoth@exalondelft.nl>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20221207190348.9347-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/tsl2563.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c
index 5bf2bfbc5379e..af616352fe715 100644
--- a/drivers/iio/light/tsl2563.c
+++ b/drivers/iio/light/tsl2563.c
@@ -705,6 +705,7 @@ static int tsl2563_probe(struct i2c_client *client,
struct iio_dev *indio_dev;
struct tsl2563_chip *chip;
struct tsl2563_platform_data *pdata = client->dev.platform_data;
+ unsigned long irq_flags;
int err = 0;
u8 id = 0;
@@ -760,10 +761,15 @@ static int tsl2563_probe(struct i2c_client *client,
indio_dev->info = &tsl2563_info_no_irq;
if (client->irq) {
+ irq_flags = irq_get_trigger_type(client->irq);
+ if (irq_flags == IRQF_TRIGGER_NONE)
+ irq_flags = IRQF_TRIGGER_RISING;
+ irq_flags |= IRQF_ONESHOT;
+
err = devm_request_threaded_irq(&client->dev, client->irq,
NULL,
&tsl2563_event_handler,
- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+ irq_flags,
"tsl2563_event",
indio_dev);
if (err) {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 276/567] usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 275/567] iio: light: tsl2563: Do not hardcode interrupt trigger type Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 277/567] i2c: designware: fix i2c_dw_clk_rate() return size to be u32 Greg Kroah-Hartman
` (294 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gaosheng Cui, Sasha Levin
From: Gaosheng Cui <cuigaosheng1@huawei.com>
[ Upstream commit a8d3392e0e5cfeb03f0cea1f2bc3f5f183c1deb4 ]
When request_irq(ires1->start) failed in w5300_hw_probe(), irq
ires->start has not been freed, and on the clean_up3 error path,
we also need to free ires1->start irq, fix it.
In addition, We should add free_irq in fusb300_remove(), and give
the lables a proper name so that they can be understood easily,
so add free_irq in fusb300_remove(), and update clean_up3 to
err_alloc_request.
Fixes: 0fe6f1d1f612 ("usb: udc: add Faraday fusb300 driver")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Link: https://lore.kernel.org/r/20221123014121.1989721-1-cuigaosheng1@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/fusb300_udc.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c
index 9af8b415f303b..5e9e8e56e2d09 100644
--- a/drivers/usb/gadget/udc/fusb300_udc.c
+++ b/drivers/usb/gadget/udc/fusb300_udc.c
@@ -1347,6 +1347,7 @@ static int fusb300_remove(struct platform_device *pdev)
usb_del_gadget_udc(&fusb300->gadget);
iounmap(fusb300->reg);
free_irq(platform_get_irq(pdev, 0), fusb300);
+ free_irq(platform_get_irq(pdev, 1), fusb300);
fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
@@ -1432,7 +1433,7 @@ static int fusb300_probe(struct platform_device *pdev)
IRQF_SHARED, udc_name, fusb300);
if (ret < 0) {
pr_err("request_irq1 error (%d)\n", ret);
- goto clean_up;
+ goto err_request_irq1;
}
INIT_LIST_HEAD(&fusb300->gadget.ep_list);
@@ -1471,7 +1472,7 @@ static int fusb300_probe(struct platform_device *pdev)
GFP_KERNEL);
if (fusb300->ep0_req == NULL) {
ret = -ENOMEM;
- goto clean_up3;
+ goto err_alloc_request;
}
init_controller(fusb300);
@@ -1486,7 +1487,10 @@ static int fusb300_probe(struct platform_device *pdev)
err_add_udc:
fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
-clean_up3:
+err_alloc_request:
+ free_irq(ires1->start, fusb300);
+
+err_request_irq1:
free_irq(ires->start, fusb300);
clean_up:
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 277/567] i2c: designware: fix i2c_dw_clk_rate() return size to be u32
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 276/567] usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 278/567] soundwire: cadence: Dont overflow the command FIFOs Greg Kroah-Hartman
` (293 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hanna Hawa, Andy Shevchenko,
Jarkko Nikula, Wolfram Sang, Sasha Levin
From: Hanna Hawa <hhhawa@amazon.com>
[ Upstream commit f2e1fa99550dd7a882229e2c2cd9ecab4ce773d0 ]
Make i2c_dw_clk_rate() to return u32 instead of unsigned long, as the
function return the value of get_clk_rate_khz() which returns u32.
Fixes: b33af11de236 ("i2c: designware: Do not require clock when SSCN and FFCN are provided")
Signed-off-by: Hanna Hawa <hhhawa@amazon.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-designware-common.c | 2 +-
drivers/i2c/busses/i2c-designware-core.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c
index 4af65f101dac4..4e752321b95e0 100644
--- a/drivers/i2c/busses/i2c-designware-common.c
+++ b/drivers/i2c/busses/i2c-designware-common.c
@@ -465,7 +465,7 @@ void __i2c_dw_disable(struct dw_i2c_dev *dev)
dev_warn(dev->dev, "timeout in disabling adapter\n");
}
-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev)
+u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev)
{
/*
* Clock is not necessary if we got LCNT/HCNT values directly from
diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
index 9be81dbebede7..59b36e0644f31 100644
--- a/drivers/i2c/busses/i2c-designware-core.h
+++ b/drivers/i2c/busses/i2c-designware-core.h
@@ -310,7 +310,7 @@ int i2c_dw_init_regmap(struct dw_i2c_dev *dev);
u32 i2c_dw_scl_hcnt(u32 ic_clk, u32 tSYMBOL, u32 tf, int cond, int offset);
u32 i2c_dw_scl_lcnt(u32 ic_clk, u32 tLOW, u32 tf, int offset);
int i2c_dw_set_sda_hold(struct dw_i2c_dev *dev);
-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev);
+u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev);
int i2c_dw_prepare_clk(struct dw_i2c_dev *dev, bool prepare);
int i2c_dw_acquire_lock(struct dw_i2c_dev *dev);
void i2c_dw_release_lock(struct dw_i2c_dev *dev);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 278/567] soundwire: cadence: Dont overflow the command FIFOs
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 277/567] i2c: designware: fix i2c_dw_clk_rate() return size to be u32 Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 279/567] driver core: fix potential null-ptr-deref in device_add() Greg Kroah-Hartman
` (292 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Fitzgerald,
Pierre-Louis Bossart, Vinod Koul, Sasha Levin
From: Richard Fitzgerald <rf@opensource.cirrus.com>
[ Upstream commit 7cbfee2e2e40d2be54196362a845a3ea0a3f877d ]
The command FIFOs in the Cadence IP can be configured during design
up to 32 entries, and the code in cadence_master.c was assuming the
full 32-entry FIFO. But all current Intel implementations use an 8-entry
FIFO.
Up to now the longest message used was 6 entries so this wasn't
causing any problem. But future Cirrus Logic codecs have downloadable
firmware or tuning blobs. It is more efficient for the codec driver to
issue long transfers that can take advantage of any queuing in the
Soundwire controller and avoid the overhead of repeatedly writing the
page registers.
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Fixes: 2f52a5177caa ("soundwire: cdns: Add cadence library")
Link: https://lore.kernel.org/r/20221202161812.4186897-2-rf@opensource.cirrus.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soundwire/cadence_master.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
index 18d2f9b3e2010..0339e6df6eb78 100644
--- a/drivers/soundwire/cadence_master.c
+++ b/drivers/soundwire/cadence_master.c
@@ -127,7 +127,8 @@ MODULE_PARM_DESC(cdns_mcp_int_mask, "Cadence MCP IntMask");
#define CDNS_MCP_CMD_BASE 0x80
#define CDNS_MCP_RESP_BASE 0x80
-#define CDNS_MCP_CMD_LEN 0x20
+/* FIFO can hold 8 commands */
+#define CDNS_MCP_CMD_LEN 8
#define CDNS_MCP_CMD_WORD_LEN 0x4
#define CDNS_MCP_CMD_SSP_TAG BIT(31)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 279/567] driver core: fix potential null-ptr-deref in device_add()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 278/567] soundwire: cadence: Dont overflow the command FIFOs Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 280/567] kobject: modify kobject_get_path() to take a const * Greg Kroah-Hartman
` (291 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit f6837f34a34973ef6600c08195ed300e24e97317 ]
I got the following null-ptr-deref report while doing fault injection test:
BUG: kernel NULL pointer dereference, address: 0000000000000058
CPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+
RIP: 0010:klist_put+0x2d/0xd0
Call Trace:
<TASK>
klist_remove+0xf1/0x1c0
device_release_driver_internal+0x196/0x210
bus_remove_device+0x1bd/0x240
device_add+0xd3d/0x1100
w1_add_master_device+0x476/0x490 [wire]
ds2482_probe+0x303/0x3e0 [ds2482]
This is how it happened:
w1_alloc_dev()
// The dev->driver is set to w1_master_driver.
memcpy(&dev->dev, device, sizeof(struct device));
device_add()
bus_add_device()
dpm_sysfs_add() // It fails, calls bus_remove_device.
// error path
bus_remove_device()
// The dev->driver is not null, but driver is not bound.
__device_release_driver()
klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref.
// normal path
bus_probe_device() // It's not called yet.
device_bind_driver()
If dev->driver is set, in the error path after calling bus_add_device()
in device_add(), bus_remove_device() is called, then the device will be
detached from driver. But device_bind_driver() is not called yet, so it
causes null-ptr-deref while access the 'knode_driver'. To fix this, set
dev->driver to null in the error path before calling bus_remove_device().
Fixes: 57eee3d23e88 ("Driver core: Call device_pm_add() after bus_add_device() in device_add()")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221205034904.2077765-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 10e027e926926..e6a7b93760e45 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -3428,6 +3428,7 @@ int device_add(struct device *dev)
device_pm_remove(dev);
dpm_sysfs_remove(dev);
DPMError:
+ dev->driver = NULL;
bus_remove_device(dev);
BusError:
device_remove_attrs(dev);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 280/567] kobject: modify kobject_get_path() to take a const *
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 279/567] driver core: fix potential null-ptr-deref in device_add() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 281/567] kobject: Fix slab-out-of-bounds in fill_kobj_path() Greg Kroah-Hartman
` (290 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Sasha Levin
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 33a0a1e3b3d17445832177981dc7a1c6a5b009f8 ]
kobject_get_path() does not modify the kobject passed to it, so make the
pointer constant.
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Link: https://lore.kernel.org/r/20221001165315.2690141-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 3bb2a01caa81 ("kobject: Fix slab-out-of-bounds in fill_kobj_path()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/kobject.h | 2 +-
lib/kobject.c | 10 +++++-----
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index ea30529fba08a..d38916e598a59 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -116,7 +116,7 @@ extern void kobject_put(struct kobject *kobj);
extern const void *kobject_namespace(struct kobject *kobj);
extern void kobject_get_ownership(struct kobject *kobj,
kuid_t *uid, kgid_t *gid);
-extern char *kobject_get_path(struct kobject *kobj, gfp_t flag);
+extern char *kobject_get_path(const struct kobject *kobj, gfp_t flag);
/**
* kobject_has_children - Returns whether a kobject has children.
diff --git a/lib/kobject.c b/lib/kobject.c
index ea53b30cf4837..94ff7fd5d80bc 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -126,10 +126,10 @@ static int create_dir(struct kobject *kobj)
return 0;
}
-static int get_kobj_path_length(struct kobject *kobj)
+static int get_kobj_path_length(const struct kobject *kobj)
{
int length = 1;
- struct kobject *parent = kobj;
+ const struct kobject *parent = kobj;
/* walk up the ancestors until we hit the one pointing to the
* root.
@@ -144,9 +144,9 @@ static int get_kobj_path_length(struct kobject *kobj)
return length;
}
-static void fill_kobj_path(struct kobject *kobj, char *path, int length)
+static void fill_kobj_path(const struct kobject *kobj, char *path, int length)
{
- struct kobject *parent;
+ const struct kobject *parent;
--length;
for (parent = kobj; parent; parent = parent->parent) {
@@ -168,7 +168,7 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length)
*
* Return: The newly allocated memory, caller must free with kfree().
*/
-char *kobject_get_path(struct kobject *kobj, gfp_t gfp_mask)
+char *kobject_get_path(const struct kobject *kobj, gfp_t gfp_mask)
{
char *path;
int len;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 281/567] kobject: Fix slab-out-of-bounds in fill_kobj_path()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 280/567] kobject: modify kobject_get_path() to take a const * Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 282/567] alpha/boot/tools/objstrip: fix the check for ELF header Greg Kroah-Hartman
` (289 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Hai, Sasha Levin
From: Wang Hai <wanghai38@huawei.com>
[ Upstream commit 3bb2a01caa813d3a1845d378bbe4169ef280d394 ]
In kobject_get_path(), if kobj->name is changed between calls
get_kobj_path_length() and fill_kobj_path() and the length becomes
longer, then fill_kobj_path() will have an out-of-bounds bug.
The actual current problem occurs when the ixgbe probe.
In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name
length becomes longer, out-of-bounds will occur.
cpu0 cpu1
ixgbe_probe
register_netdev(netdev)
netdev_register_kobject
device_add
kobject_uevent // Sending ADD events
systemd-udevd // rename netdev
dev_change_name
device_rename
kobject_rename
ixgbe_mii_bus_init |
mdiobus_register |
__mdiobus_register |
device_register |
device_add |
kobject_uevent |
kobject_get_path |
len = get_kobj_path_length // old name |
path = kzalloc(len, gfp_mask); |
kobj->name = name;
/* name length becomes
* longer
*/
fill_kobj_path /* kobj path length is
* longer than path,
* resulting in out of
* bounds when filling path
*/
This is the kasan report:
==================================================================
BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0
Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673
Workqueue: events work_for_cpu_fn
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x48
print_address_description.constprop.0+0x86/0x1e7
print_report+0x36/0x4f
kasan_report+0xad/0x130
kasan_check_range+0x35/0x1c0
memcpy+0x39/0x60
fill_kobj_path+0x50/0xc0
kobject_get_path+0x5a/0xc0
kobject_uevent_env+0x140/0x460
device_add+0x5c7/0x910
__mdiobus_register+0x14e/0x490
ixgbe_probe.cold+0x441/0x574 [ixgbe]
local_pci_probe+0x78/0xc0
work_for_cpu_fn+0x26/0x40
process_one_work+0x3b6/0x6a0
worker_thread+0x368/0x520
kthread+0x165/0x1a0
ret_from_fork+0x1f/0x30
This reproducer triggers that bug:
while:
do
rmmod ixgbe
sleep 0.5
modprobe ixgbe
sleep 0.5
When calling fill_kobj_path() to fill path, if the name length of
kobj becomes longer, return failure and retry. This fixes the problem.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/kobject.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/lib/kobject.c b/lib/kobject.c
index 94ff7fd5d80bc..184a3dab26991 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -144,7 +144,7 @@ static int get_kobj_path_length(const struct kobject *kobj)
return length;
}
-static void fill_kobj_path(const struct kobject *kobj, char *path, int length)
+static int fill_kobj_path(const struct kobject *kobj, char *path, int length)
{
const struct kobject *parent;
@@ -153,12 +153,16 @@ static void fill_kobj_path(const struct kobject *kobj, char *path, int length)
int cur = strlen(kobject_name(parent));
/* back up enough to print this name with '/' */
length -= cur;
+ if (length <= 0)
+ return -EINVAL;
memcpy(path + length, kobject_name(parent), cur);
*(path + --length) = '/';
}
pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj),
kobj, __func__, path);
+
+ return 0;
}
/**
@@ -173,13 +177,17 @@ char *kobject_get_path(const struct kobject *kobj, gfp_t gfp_mask)
char *path;
int len;
+retry:
len = get_kobj_path_length(kobj);
if (len == 0)
return NULL;
path = kzalloc(len, gfp_mask);
if (!path)
return NULL;
- fill_kobj_path(kobj, path, len);
+ if (fill_kobj_path(kobj, path, len)) {
+ kfree(path);
+ goto retry;
+ }
return path;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 282/567] alpha/boot/tools/objstrip: fix the check for ELF header
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 281/567] kobject: Fix slab-out-of-bounds in fill_kobj_path() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 283/567] media: uvcvideo: Do not check for V4L2_CTRL_WHICH_DEF_VAL Greg Kroah-Hartman
` (288 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Al Viro, Sasha Levin
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 1878787797cbb019eeefe6f905514dcd557302b6 ]
Just memcmp() with ELFMAG - that's the normal way to do it in userland
code, which that thing is. Besides, that has the benefit of actually
building - str_has_prefix() is *NOT* present in <string.h>.
Fixes: 5f14596e55de "alpha: Replace strncmp with str_has_prefix"
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/boot/tools/objstrip.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/alpha/boot/tools/objstrip.c b/arch/alpha/boot/tools/objstrip.c
index 08b430d25a315..7cf92d172dce9 100644
--- a/arch/alpha/boot/tools/objstrip.c
+++ b/arch/alpha/boot/tools/objstrip.c
@@ -148,7 +148,7 @@ main (int argc, char *argv[])
#ifdef __ELF__
elf = (struct elfhdr *) buf;
- if (elf->e_ident[0] == 0x7f && str_has_prefix((char *)elf->e_ident + 1, "ELF")) {
+ if (memcmp(&elf->e_ident[EI_MAG0], ELFMAG, SELFMAG) == 0) {
if (elf->e_type != ET_EXEC) {
fprintf(stderr, "%s: %s is not an ELF executable\n",
prog_name, inname);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 283/567] media: uvcvideo: Do not check for V4L2_CTRL_WHICH_DEF_VAL
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 282/567] alpha/boot/tools/objstrip: fix the check for ELF header Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 284/567] media: uvcvideo: Remove s_ctrl and g_ctrl Greg Kroah-Hartman
` (287 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Ricardo Ribalda,
Laurent Pinchart, Mauro Carvalho Chehab, Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit a2f8a484fbc96b8209a760cb3f2c95ca49c2cdb1 ]
The framework already checks for us if V4L2_CTRL_WHICH_DEF_VAL is
written.
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_v4l2.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 63842eb223a18..d2e633f6ec671 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -1106,10 +1106,6 @@ static int uvc_ioctl_s_try_ext_ctrls(struct uvc_fh *handle,
unsigned int i;
int ret;
- /* Default value cannot be changed */
- if (ctrls->which == V4L2_CTRL_WHICH_DEF_VAL)
- return -EINVAL;
-
ret = uvc_ctrl_begin(chain);
if (ret < 0)
return ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 284/567] media: uvcvideo: Remove s_ctrl and g_ctrl
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 283/567] media: uvcvideo: Do not check for V4L2_CTRL_WHICH_DEF_VAL Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 285/567] media: uvcvideo: refactor __uvc_ctrl_add_mapping Greg Kroah-Hartman
` (286 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Ricardo Ribalda,
Laurent Pinchart, Mauro Carvalho Chehab, Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 0c6bcbdfefa83b8a1e9659b3c127758dce0fe7ac ]
If we do not implement these callbacks the framework will call the
ext_ctrl callbaks instead, which are a superset of this functions.
Suggested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_v4l2.c | 56 --------------------------------
1 file changed, 56 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index d2e633f6ec671..6955ed080d7dc 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -1000,60 +1000,6 @@ static int uvc_ioctl_query_ext_ctrl(struct file *file, void *fh,
return 0;
}
-static int uvc_ioctl_g_ctrl(struct file *file, void *fh,
- struct v4l2_control *ctrl)
-{
- struct uvc_fh *handle = fh;
- struct uvc_video_chain *chain = handle->chain;
- struct v4l2_ext_control xctrl;
- int ret;
-
- memset(&xctrl, 0, sizeof(xctrl));
- xctrl.id = ctrl->id;
-
- ret = uvc_ctrl_begin(chain);
- if (ret < 0)
- return ret;
-
- ret = uvc_ctrl_get(chain, &xctrl);
- uvc_ctrl_rollback(handle);
- if (ret < 0)
- return ret;
-
- ctrl->value = xctrl.value;
- return 0;
-}
-
-static int uvc_ioctl_s_ctrl(struct file *file, void *fh,
- struct v4l2_control *ctrl)
-{
- struct uvc_fh *handle = fh;
- struct uvc_video_chain *chain = handle->chain;
- struct v4l2_ext_control xctrl;
- int ret;
-
- memset(&xctrl, 0, sizeof(xctrl));
- xctrl.id = ctrl->id;
- xctrl.value = ctrl->value;
-
- ret = uvc_ctrl_begin(chain);
- if (ret < 0)
- return ret;
-
- ret = uvc_ctrl_set(handle, &xctrl);
- if (ret < 0) {
- uvc_ctrl_rollback(handle);
- return ret;
- }
-
- ret = uvc_ctrl_commit(handle, &xctrl, 1);
- if (ret < 0)
- return ret;
-
- ctrl->value = xctrl.value;
- return 0;
-}
-
static int uvc_ioctl_g_ext_ctrls(struct file *file, void *fh,
struct v4l2_ext_controls *ctrls)
{
@@ -1539,8 +1485,6 @@ const struct v4l2_ioctl_ops uvc_ioctl_ops = {
.vidioc_s_input = uvc_ioctl_s_input,
.vidioc_queryctrl = uvc_ioctl_queryctrl,
.vidioc_query_ext_ctrl = uvc_ioctl_query_ext_ctrl,
- .vidioc_g_ctrl = uvc_ioctl_g_ctrl,
- .vidioc_s_ctrl = uvc_ioctl_s_ctrl,
.vidioc_g_ext_ctrls = uvc_ioctl_g_ext_ctrls,
.vidioc_s_ext_ctrls = uvc_ioctl_s_ext_ctrls,
.vidioc_try_ext_ctrls = uvc_ioctl_try_ext_ctrls,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 285/567] media: uvcvideo: refactor __uvc_ctrl_add_mapping
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 284/567] media: uvcvideo: Remove s_ctrl and g_ctrl Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 286/567] media: uvcvideo: Add support for V4L2_CTRL_TYPE_CTRL_CLASS Greg Kroah-Hartman
` (285 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Ricardo Ribalda,
Laurent Pinchart, Mauro Carvalho Chehab, Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 866c6bdd5663d4df7cf384b381b6ef8ba9ffd0e4 ]
Pass the chain instead of the device. We want to keep the reference to
the chain that controls belong to.
We need to delay the initialization of the controls after the chains
have been initialized.
This is a cleanup needed for the next patches.
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 41 ++++++++++++++++++++----------
drivers/media/usb/uvc/uvc_driver.c | 8 +++---
2 files changed, 32 insertions(+), 17 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 5bb29fc49538e..6b089103878ac 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -2066,7 +2066,7 @@ static int uvc_ctrl_add_info(struct uvc_device *dev, struct uvc_control *ctrl,
/*
* Add a control mapping to a given control.
*/
-static int __uvc_ctrl_add_mapping(struct uvc_device *dev,
+static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
struct uvc_control *ctrl, const struct uvc_control_mapping *mapping)
{
struct uvc_control_mapping *map;
@@ -2095,7 +2095,7 @@ static int __uvc_ctrl_add_mapping(struct uvc_device *dev,
map->set = uvc_set_le_value;
list_add_tail(&map->list, &ctrl->info.mappings);
- uvc_dbg(dev, CONTROL, "Adding mapping '%s' to control %pUl/%u\n",
+ uvc_dbg(chain->dev, CONTROL, "Adding mapping '%s' to control %pUl/%u\n",
map->name, ctrl->info.entity, ctrl->info.selector);
return 0;
@@ -2177,7 +2177,7 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
goto done;
}
- ret = __uvc_ctrl_add_mapping(dev, ctrl, mapping);
+ ret = __uvc_ctrl_add_mapping(chain, ctrl, mapping);
if (ret < 0)
atomic_dec(&dev->nmappings);
@@ -2253,7 +2253,8 @@ static void uvc_ctrl_prune_entity(struct uvc_device *dev,
* Add control information and hardcoded stock control mappings to the given
* device.
*/
-static void uvc_ctrl_init_ctrl(struct uvc_device *dev, struct uvc_control *ctrl)
+static void uvc_ctrl_init_ctrl(struct uvc_video_chain *chain,
+ struct uvc_control *ctrl)
{
const struct uvc_control_info *info = uvc_ctrls;
const struct uvc_control_info *iend = info + ARRAY_SIZE(uvc_ctrls);
@@ -2272,14 +2273,14 @@ static void uvc_ctrl_init_ctrl(struct uvc_device *dev, struct uvc_control *ctrl)
for (; info < iend; ++info) {
if (uvc_entity_match_guid(ctrl->entity, info->entity) &&
ctrl->index == info->index) {
- uvc_ctrl_add_info(dev, ctrl, info);
+ uvc_ctrl_add_info(chain->dev, ctrl, info);
/*
* Retrieve control flags from the device. Ignore errors
* and work with default flag values from the uvc_ctrl
* array when the device doesn't properly implement
* GET_INFO on standard controls.
*/
- uvc_ctrl_get_flags(dev, ctrl, &ctrl->info);
+ uvc_ctrl_get_flags(chain->dev, ctrl, &ctrl->info);
break;
}
}
@@ -2290,22 +2291,20 @@ static void uvc_ctrl_init_ctrl(struct uvc_device *dev, struct uvc_control *ctrl)
for (; mapping < mend; ++mapping) {
if (uvc_entity_match_guid(ctrl->entity, mapping->entity) &&
ctrl->info.selector == mapping->selector)
- __uvc_ctrl_add_mapping(dev, ctrl, mapping);
+ __uvc_ctrl_add_mapping(chain, ctrl, mapping);
}
}
/*
* Initialize device controls.
*/
-int uvc_ctrl_init_device(struct uvc_device *dev)
+static int uvc_ctrl_init_chain(struct uvc_video_chain *chain)
{
struct uvc_entity *entity;
unsigned int i;
- INIT_WORK(&dev->async_ctrl.work, uvc_ctrl_status_event_work);
-
/* Walk the entities list and instantiate controls */
- list_for_each_entry(entity, &dev->entities, list) {
+ list_for_each_entry(entity, &chain->entities, chain) {
struct uvc_control *ctrl;
unsigned int bControlSize = 0, ncontrols;
u8 *bmControls = NULL;
@@ -2325,7 +2324,7 @@ int uvc_ctrl_init_device(struct uvc_device *dev)
}
/* Remove bogus/blacklisted controls */
- uvc_ctrl_prune_entity(dev, entity);
+ uvc_ctrl_prune_entity(chain->dev, entity);
/* Count supported controls and allocate the controls array */
ncontrols = memweight(bmControls, bControlSize);
@@ -2347,7 +2346,7 @@ int uvc_ctrl_init_device(struct uvc_device *dev)
ctrl->entity = entity;
ctrl->index = i;
- uvc_ctrl_init_ctrl(dev, ctrl);
+ uvc_ctrl_init_ctrl(chain, ctrl);
ctrl++;
}
}
@@ -2355,6 +2354,22 @@ int uvc_ctrl_init_device(struct uvc_device *dev)
return 0;
}
+int uvc_ctrl_init_device(struct uvc_device *dev)
+{
+ struct uvc_video_chain *chain;
+ int ret;
+
+ INIT_WORK(&dev->async_ctrl.work, uvc_ctrl_status_event_work);
+
+ list_for_each_entry(chain, &dev->chains, list) {
+ ret = uvc_ctrl_init_chain(chain);
+ if (ret)
+ return ret;
+ }
+
+ return 0;
+}
+
/*
* Cleanup device controls.
*/
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index 72fff7264b549..ceae2eabc0a1c 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -2455,14 +2455,14 @@ static int uvc_probe(struct usb_interface *intf,
if (v4l2_device_register(&intf->dev, &dev->vdev) < 0)
goto error;
- /* Initialize controls. */
- if (uvc_ctrl_init_device(dev) < 0)
- goto error;
-
/* Scan the device for video chains. */
if (uvc_scan_device(dev) < 0)
goto error;
+ /* Initialize controls. */
+ if (uvc_ctrl_init_device(dev) < 0)
+ goto error;
+
/* Register video device nodes. */
if (uvc_register_chains(dev) < 0)
goto error;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 286/567] media: uvcvideo: Add support for V4L2_CTRL_TYPE_CTRL_CLASS
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 285/567] media: uvcvideo: refactor __uvc_ctrl_add_mapping Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 287/567] media: uvcvideo: Use control names from framework Greg Kroah-Hartman
` (284 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Ricardo Ribalda,
Laurent Pinchart, Mauro Carvalho Chehab, Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 9b31ea808a4468d5d606d1f82c58b7e7bfb99f66 ]
Create all the class controls for the device defined controls.
Fixes v4l2-compliance:
Control ioctls (Input 0):
fail: v4l2-test-controls.cpp(216): missing control class for class 00980000
fail: v4l2-test-controls.cpp(216): missing control tclass for class 009a0000
test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: FAIL
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 90 ++++++++++++++++++++++++++++++++
drivers/media/usb/uvc/uvcvideo.h | 1 +
2 files changed, 91 insertions(+)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 6b089103878ac..769088a7f9375 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -357,6 +357,11 @@ static const struct uvc_control_info uvc_ctrls[] = {
},
};
+static const u32 uvc_control_classes[] = {
+ V4L2_CID_CAMERA_CLASS,
+ V4L2_CID_USER_CLASS,
+};
+
static const struct uvc_menu_info power_line_frequency_controls[] = {
{ 0, "Disabled" },
{ 1, "50 Hz" },
@@ -1044,6 +1049,49 @@ static int __uvc_ctrl_get(struct uvc_video_chain *chain,
return 0;
}
+static int __uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id,
+ u32 found_id)
+{
+ bool find_next = req_id & V4L2_CTRL_FLAG_NEXT_CTRL;
+ unsigned int i;
+
+ req_id &= V4L2_CTRL_ID_MASK;
+
+ for (i = 0; i < ARRAY_SIZE(uvc_control_classes); i++) {
+ if (!(chain->ctrl_class_bitmap & BIT(i)))
+ continue;
+ if (!find_next) {
+ if (uvc_control_classes[i] == req_id)
+ return i;
+ continue;
+ }
+ if (uvc_control_classes[i] > req_id &&
+ uvc_control_classes[i] < found_id)
+ return i;
+ }
+
+ return -ENODEV;
+}
+
+static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id,
+ u32 found_id, struct v4l2_queryctrl *v4l2_ctrl)
+{
+ int idx;
+
+ idx = __uvc_query_v4l2_class(chain, req_id, found_id);
+ if (idx < 0)
+ return -ENODEV;
+
+ memset(v4l2_ctrl, 0, sizeof(*v4l2_ctrl));
+ v4l2_ctrl->id = uvc_control_classes[idx];
+ strscpy(v4l2_ctrl->name, v4l2_ctrl_get_name(v4l2_ctrl->id),
+ sizeof(v4l2_ctrl->name));
+ v4l2_ctrl->type = V4L2_CTRL_TYPE_CTRL_CLASS;
+ v4l2_ctrl->flags = V4L2_CTRL_FLAG_WRITE_ONLY
+ | V4L2_CTRL_FLAG_READ_ONLY;
+ return 0;
+}
+
static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
struct uvc_control *ctrl,
struct uvc_control_mapping *mapping,
@@ -1147,12 +1195,31 @@ int uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
if (ret < 0)
return -ERESTARTSYS;
+ /* Check if the ctrl is a know class */
+ if (!(v4l2_ctrl->id & V4L2_CTRL_FLAG_NEXT_CTRL)) {
+ ret = uvc_query_v4l2_class(chain, v4l2_ctrl->id, 0, v4l2_ctrl);
+ if (!ret)
+ goto done;
+ }
+
ctrl = uvc_find_control(chain, v4l2_ctrl->id, &mapping);
if (ctrl == NULL) {
ret = -EINVAL;
goto done;
}
+ /*
+ * If we're enumerating control with V4L2_CTRL_FLAG_NEXT_CTRL, check if
+ * a class should be inserted between the previous control and the one
+ * we have just found.
+ */
+ if (v4l2_ctrl->id & V4L2_CTRL_FLAG_NEXT_CTRL) {
+ ret = uvc_query_v4l2_class(chain, v4l2_ctrl->id, mapping->id,
+ v4l2_ctrl);
+ if (!ret)
+ goto done;
+ }
+
ret = __uvc_query_v4l2_ctrl(chain, ctrl, mapping, v4l2_ctrl);
done:
mutex_unlock(&chain->ctrl_mutex);
@@ -1446,6 +1513,11 @@ static int uvc_ctrl_add_event(struct v4l2_subscribed_event *sev, unsigned elems)
if (ret < 0)
return -ERESTARTSYS;
+ if (__uvc_query_v4l2_class(handle->chain, sev->id, 0) >= 0) {
+ ret = 0;
+ goto done;
+ }
+
ctrl = uvc_find_control(handle->chain, sev->id, &mapping);
if (ctrl == NULL) {
ret = -EINVAL;
@@ -1479,7 +1551,10 @@ static void uvc_ctrl_del_event(struct v4l2_subscribed_event *sev)
struct uvc_fh *handle = container_of(sev->fh, struct uvc_fh, vfh);
mutex_lock(&handle->chain->ctrl_mutex);
+ if (__uvc_query_v4l2_class(handle->chain, sev->id, 0) >= 0)
+ goto done;
list_del(&sev->node);
+done:
mutex_unlock(&handle->chain->ctrl_mutex);
}
@@ -1597,6 +1672,9 @@ int uvc_ctrl_get(struct uvc_video_chain *chain,
struct uvc_control *ctrl;
struct uvc_control_mapping *mapping;
+ if (__uvc_query_v4l2_class(chain, xctrl->id, 0) >= 0)
+ return -EACCES;
+
ctrl = uvc_find_control(chain, xctrl->id, &mapping);
if (ctrl == NULL)
return -EINVAL;
@@ -1616,6 +1694,9 @@ int uvc_ctrl_set(struct uvc_fh *handle,
s32 max;
int ret;
+ if (__uvc_query_v4l2_class(chain, xctrl->id, 0) >= 0)
+ return -EACCES;
+
ctrl = uvc_find_control(chain, xctrl->id, &mapping);
if (ctrl == NULL)
return -EINVAL;
@@ -2071,6 +2152,7 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
{
struct uvc_control_mapping *map;
unsigned int size;
+ unsigned int i;
/* Most mappings come from static kernel data and need to be duplicated.
* Mappings that come from userspace will be unnecessarily duplicated,
@@ -2094,6 +2176,14 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
if (map->set == NULL)
map->set = uvc_set_le_value;
+ for (i = 0; i < ARRAY_SIZE(uvc_control_classes); i++) {
+ if (V4L2_CTRL_ID2WHICH(uvc_control_classes[i]) ==
+ V4L2_CTRL_ID2WHICH(map->id)) {
+ chain->ctrl_class_bitmap |= BIT(i);
+ break;
+ }
+ }
+
list_add_tail(&map->list, &ctrl->info.mappings);
uvc_dbg(chain->dev, CONTROL, "Adding mapping '%s' to control %pUl/%u\n",
map->name, ctrl->info.entity, ctrl->info.selector);
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index c3ea6a53869f5..2c57a50f6a79b 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -476,6 +476,7 @@ struct uvc_video_chain {
struct v4l2_prio_state prio; /* V4L2 priority state */
u32 caps; /* V4L2 chain-wide caps */
+ u8 ctrl_class_bitmap; /* Bitmap of valid classes */
};
struct uvc_stats_frame {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 287/567] media: uvcvideo: Use control names from framework
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 286/567] media: uvcvideo: Add support for V4L2_CTRL_TYPE_CTRL_CLASS Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 288/567] media: uvcvideo: Check controls flags before accessing them Greg Kroah-Hartman
` (283 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Hans Verkuil,
Ricardo Ribalda, Laurent Pinchart, Mauro Carvalho Chehab,
Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 70fa906d6fceb07a49198d2f31cadecc76787419 ]
The framework already contains a map of IDs to names, lets use it when
possible.
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Suggested-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 57 ++++++++++++--------------------
drivers/media/usb/uvc/uvc_v4l2.c | 8 ++++-
drivers/media/usb/uvc/uvcvideo.h | 2 +-
3 files changed, 30 insertions(+), 37 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 769088a7f9375..748f87af5e43e 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -432,7 +432,6 @@ static void uvc_ctrl_set_rel_speed(struct uvc_control_mapping *mapping,
static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
{
.id = V4L2_CID_BRIGHTNESS,
- .name = "Brightness",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_BRIGHTNESS_CONTROL,
.size = 16,
@@ -442,7 +441,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_CONTRAST,
- .name = "Contrast",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_CONTRAST_CONTROL,
.size = 16,
@@ -452,7 +450,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_HUE,
- .name = "Hue",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_HUE_CONTROL,
.size = 16,
@@ -464,7 +461,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_SATURATION,
- .name = "Saturation",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_SATURATION_CONTROL,
.size = 16,
@@ -474,7 +470,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_SHARPNESS,
- .name = "Sharpness",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_SHARPNESS_CONTROL,
.size = 16,
@@ -484,7 +479,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_GAMMA,
- .name = "Gamma",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_GAMMA_CONTROL,
.size = 16,
@@ -494,7 +488,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_BACKLIGHT_COMPENSATION,
- .name = "Backlight Compensation",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_BACKLIGHT_COMPENSATION_CONTROL,
.size = 16,
@@ -504,7 +497,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_GAIN,
- .name = "Gain",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_GAIN_CONTROL,
.size = 16,
@@ -514,7 +506,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_POWER_LINE_FREQUENCY,
- .name = "Power Line Frequency",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
.size = 2,
@@ -526,7 +517,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_HUE_AUTO,
- .name = "Hue, Auto",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_HUE_AUTO_CONTROL,
.size = 1,
@@ -537,7 +527,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_EXPOSURE_AUTO,
- .name = "Exposure, Auto",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_AE_MODE_CONTROL,
.size = 4,
@@ -550,7 +539,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_EXPOSURE_AUTO_PRIORITY,
- .name = "Exposure, Auto Priority",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_AE_PRIORITY_CONTROL,
.size = 1,
@@ -560,7 +548,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_EXPOSURE_ABSOLUTE,
- .name = "Exposure (Absolute)",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_EXPOSURE_TIME_ABSOLUTE_CONTROL,
.size = 32,
@@ -572,7 +559,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_AUTO_WHITE_BALANCE,
- .name = "White Balance Temperature, Auto",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_WHITE_BALANCE_TEMPERATURE_AUTO_CONTROL,
.size = 1,
@@ -583,7 +569,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_WHITE_BALANCE_TEMPERATURE,
- .name = "White Balance Temperature",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_WHITE_BALANCE_TEMPERATURE_CONTROL,
.size = 16,
@@ -595,7 +580,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_AUTO_WHITE_BALANCE,
- .name = "White Balance Component, Auto",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_WHITE_BALANCE_COMPONENT_AUTO_CONTROL,
.size = 1,
@@ -607,7 +591,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_BLUE_BALANCE,
- .name = "White Balance Blue Component",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_WHITE_BALANCE_COMPONENT_CONTROL,
.size = 16,
@@ -619,7 +602,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_RED_BALANCE,
- .name = "White Balance Red Component",
.entity = UVC_GUID_UVC_PROCESSING,
.selector = UVC_PU_WHITE_BALANCE_COMPONENT_CONTROL,
.size = 16,
@@ -631,7 +613,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_FOCUS_ABSOLUTE,
- .name = "Focus (absolute)",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_FOCUS_ABSOLUTE_CONTROL,
.size = 16,
@@ -643,7 +624,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_FOCUS_AUTO,
- .name = "Focus, Auto",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_FOCUS_AUTO_CONTROL,
.size = 1,
@@ -654,7 +634,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_IRIS_ABSOLUTE,
- .name = "Iris, Absolute",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_IRIS_ABSOLUTE_CONTROL,
.size = 16,
@@ -664,7 +643,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_IRIS_RELATIVE,
- .name = "Iris, Relative",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_IRIS_RELATIVE_CONTROL,
.size = 8,
@@ -674,7 +652,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_ZOOM_ABSOLUTE,
- .name = "Zoom, Absolute",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_ZOOM_ABSOLUTE_CONTROL,
.size = 16,
@@ -684,7 +661,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_ZOOM_CONTINUOUS,
- .name = "Zoom, Continuous",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_ZOOM_RELATIVE_CONTROL,
.size = 0,
@@ -696,7 +672,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_PAN_ABSOLUTE,
- .name = "Pan (Absolute)",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_PANTILT_ABSOLUTE_CONTROL,
.size = 32,
@@ -706,7 +681,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_TILT_ABSOLUTE,
- .name = "Tilt (Absolute)",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_PANTILT_ABSOLUTE_CONTROL,
.size = 32,
@@ -716,7 +690,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_PAN_SPEED,
- .name = "Pan (Speed)",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_PANTILT_RELATIVE_CONTROL,
.size = 16,
@@ -728,7 +701,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_TILT_SPEED,
- .name = "Tilt (Speed)",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_PANTILT_RELATIVE_CONTROL,
.size = 16,
@@ -740,7 +712,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_PRIVACY,
- .name = "Privacy",
.entity = UVC_GUID_UVC_CAMERA,
.selector = UVC_CT_PRIVACY_CONTROL,
.size = 1,
@@ -750,7 +721,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = {
},
{
.id = V4L2_CID_PRIVACY,
- .name = "Privacy",
.entity = UVC_GUID_EXT_GPIO_CONTROLLER,
.selector = UVC_CT_PRIVACY_CONTROL,
.size = 1,
@@ -1092,6 +1062,20 @@ static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id,
return 0;
}
+static const char *uvc_map_get_name(const struct uvc_control_mapping *map)
+{
+ const char *name;
+
+ if (map->name)
+ return map->name;
+
+ name = v4l2_ctrl_get_name(map->id);
+ if (name)
+ return name;
+
+ return "Unknown Control";
+}
+
static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
struct uvc_control *ctrl,
struct uvc_control_mapping *mapping,
@@ -1105,7 +1089,8 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
memset(v4l2_ctrl, 0, sizeof(*v4l2_ctrl));
v4l2_ctrl->id = mapping->id;
v4l2_ctrl->type = mapping->v4l2_type;
- strscpy(v4l2_ctrl->name, mapping->name, sizeof(v4l2_ctrl->name));
+ strscpy(v4l2_ctrl->name, uvc_map_get_name(mapping),
+ sizeof(v4l2_ctrl->name));
v4l2_ctrl->flags = 0;
if (!(ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR))
@@ -2186,7 +2171,8 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
list_add_tail(&map->list, &ctrl->info.mappings);
uvc_dbg(chain->dev, CONTROL, "Adding mapping '%s' to control %pUl/%u\n",
- map->name, ctrl->info.entity, ctrl->info.selector);
+ uvc_map_get_name(map), ctrl->info.entity,
+ ctrl->info.selector);
return 0;
}
@@ -2204,7 +2190,7 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
if (mapping->id & ~V4L2_CTRL_ID_MASK) {
uvc_dbg(dev, CONTROL,
"Can't add mapping '%s', control id 0x%08x is invalid\n",
- mapping->name, mapping->id);
+ uvc_map_get_name(mapping), mapping->id);
return -EINVAL;
}
@@ -2251,7 +2237,7 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
if (mapping->id == map->id) {
uvc_dbg(dev, CONTROL,
"Can't add mapping '%s', control id 0x%08x already exists\n",
- mapping->name, mapping->id);
+ uvc_map_get_name(mapping), mapping->id);
ret = -EEXIST;
goto done;
}
@@ -2262,7 +2248,7 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
atomic_dec(&dev->nmappings);
uvc_dbg(dev, CONTROL,
"Can't add mapping '%s', maximum mappings count (%u) exceeded\n",
- mapping->name, UVC_MAX_CONTROL_MAPPINGS);
+ uvc_map_get_name(mapping), UVC_MAX_CONTROL_MAPPINGS);
ret = -ENOMEM;
goto done;
}
@@ -2471,6 +2457,7 @@ static void uvc_ctrl_cleanup_mappings(struct uvc_device *dev,
list_for_each_entry_safe(mapping, nm, &ctrl->info.mappings, list) {
list_del(&mapping->list);
kfree(mapping->menu_info);
+ kfree(mapping->name);
kfree(mapping);
}
}
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 6955ed080d7dc..533c4a0645ee4 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -40,7 +40,13 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
return -ENOMEM;
map->id = xmap->id;
- memcpy(map->name, xmap->name, sizeof(map->name));
+ /* Non standard control id. */
+ if (v4l2_ctrl_get_name(map->id) == NULL) {
+ map->name = kmemdup(xmap->name, sizeof(xmap->name),
+ GFP_KERNEL);
+ if (!map->name)
+ return -ENOMEM;
+ }
memcpy(map->entity, xmap->entity, sizeof(map->entity));
map->selector = xmap->selector;
map->size = xmap->size;
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index 2c57a50f6a79b..33befa48fb493 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -241,7 +241,7 @@ struct uvc_control_mapping {
struct list_head ev_subs;
u32 id;
- u8 name[32];
+ char *name;
u8 entity[16];
u8 selector;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 288/567] media: uvcvideo: Check controls flags before accessing them
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 287/567] media: uvcvideo: Use control names from framework Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 289/567] media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible() Greg Kroah-Hartman
` (282 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Ricardo Ribalda,
Laurent Pinchart, Mauro Carvalho Chehab, Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit ee929d5a10ca433a1c21b9aaeb70a67c5507c101 ]
We can figure out if reading/writing a set of controls can fail without
accessing them by checking their flags.
This way we can honor the API closer:
If an error is found when validating the list of controls passed with
VIDIOC_G_EXT_CTRLS, then error_idx shall be set to ctrls->count to
indicate to userspace that no actual hardware was touched.
Fixes v4l2-compliance:
Control ioctls (Input 0):
warn: v4l2-test-controls.cpp(765): g_ext_ctrls(0) invalid error_idx 0
fail: v4l2-test-controls.cpp(645): invalid error index write only control
test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 22 ++++++++++++++++++
drivers/media/usb/uvc/uvc_v4l2.c | 39 ++++++++++++++++++++++++++++----
drivers/media/usb/uvc/uvcvideo.h | 2 ++
3 files changed, 58 insertions(+), 5 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 748f87af5e43e..fcfbd0f726936 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1062,6 +1062,28 @@ static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id,
return 0;
}
+int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
+ bool read)
+{
+ struct uvc_control_mapping *mapping;
+ struct uvc_control *ctrl;
+
+ if (__uvc_query_v4l2_class(chain, v4l2_id, 0) >= 0)
+ return -EACCES;
+
+ ctrl = uvc_find_control(chain, v4l2_id, &mapping);
+ if (!ctrl)
+ return -EINVAL;
+
+ if (!(ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR) && read)
+ return -EACCES;
+
+ if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR) && !read)
+ return -EACCES;
+
+ return 0;
+}
+
static const char *uvc_map_get_name(const struct uvc_control_mapping *map)
{
const char *name;
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 533c4a0645ee4..7dd387e96c9de 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -1006,6 +1006,26 @@ static int uvc_ioctl_query_ext_ctrl(struct file *file, void *fh,
return 0;
}
+static int uvc_ctrl_check_access(struct uvc_video_chain *chain,
+ struct v4l2_ext_controls *ctrls,
+ unsigned long ioctl)
+{
+ struct v4l2_ext_control *ctrl = ctrls->controls;
+ unsigned int i;
+ int ret = 0;
+
+ for (i = 0; i < ctrls->count; ++ctrl, ++i) {
+ ret = uvc_ctrl_is_accessible(chain, ctrl->id,
+ ioctl == VIDIOC_G_EXT_CTRLS);
+ if (ret)
+ break;
+ }
+
+ ctrls->error_idx = ioctl == VIDIOC_TRY_EXT_CTRLS ? i : ctrls->count;
+
+ return ret;
+}
+
static int uvc_ioctl_g_ext_ctrls(struct file *file, void *fh,
struct v4l2_ext_controls *ctrls)
{
@@ -1015,6 +1035,10 @@ static int uvc_ioctl_g_ext_ctrls(struct file *file, void *fh,
unsigned int i;
int ret;
+ ret = uvc_ctrl_check_access(chain, ctrls, VIDIOC_G_EXT_CTRLS);
+ if (ret < 0)
+ return ret;
+
if (ctrls->which == V4L2_CTRL_WHICH_DEF_VAL) {
for (i = 0; i < ctrls->count; ++ctrl, ++i) {
struct v4l2_queryctrl qc = { .id = ctrl->id };
@@ -1051,13 +1075,17 @@ static int uvc_ioctl_g_ext_ctrls(struct file *file, void *fh,
static int uvc_ioctl_s_try_ext_ctrls(struct uvc_fh *handle,
struct v4l2_ext_controls *ctrls,
- bool commit)
+ unsigned long ioctl)
{
struct v4l2_ext_control *ctrl = ctrls->controls;
struct uvc_video_chain *chain = handle->chain;
unsigned int i;
int ret;
+ ret = uvc_ctrl_check_access(chain, ctrls, ioctl);
+ if (ret < 0)
+ return ret;
+
ret = uvc_ctrl_begin(chain);
if (ret < 0)
return ret;
@@ -1066,14 +1094,15 @@ static int uvc_ioctl_s_try_ext_ctrls(struct uvc_fh *handle,
ret = uvc_ctrl_set(handle, ctrl);
if (ret < 0) {
uvc_ctrl_rollback(handle);
- ctrls->error_idx = commit ? ctrls->count : i;
+ ctrls->error_idx = ioctl == VIDIOC_S_EXT_CTRLS ?
+ ctrls->count : i;
return ret;
}
}
ctrls->error_idx = 0;
- if (commit)
+ if (ioctl == VIDIOC_S_EXT_CTRLS)
return uvc_ctrl_commit(handle, ctrls->controls, ctrls->count);
else
return uvc_ctrl_rollback(handle);
@@ -1084,7 +1113,7 @@ static int uvc_ioctl_s_ext_ctrls(struct file *file, void *fh,
{
struct uvc_fh *handle = fh;
- return uvc_ioctl_s_try_ext_ctrls(handle, ctrls, true);
+ return uvc_ioctl_s_try_ext_ctrls(handle, ctrls, VIDIOC_S_EXT_CTRLS);
}
static int uvc_ioctl_try_ext_ctrls(struct file *file, void *fh,
@@ -1092,7 +1121,7 @@ static int uvc_ioctl_try_ext_ctrls(struct file *file, void *fh,
{
struct uvc_fh *handle = fh;
- return uvc_ioctl_s_try_ext_ctrls(handle, ctrls, false);
+ return uvc_ioctl_s_try_ext_ctrls(handle, ctrls, VIDIOC_TRY_EXT_CTRLS);
}
static int uvc_ioctl_querymenu(struct file *file, void *fh,
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index 33befa48fb493..d414a22244057 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -901,6 +901,8 @@ static inline int uvc_ctrl_rollback(struct uvc_fh *handle)
int uvc_ctrl_get(struct uvc_video_chain *chain, struct v4l2_ext_control *xctrl);
int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl);
+int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
+ bool read);
int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
struct uvc_xu_control_query *xqry);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 289/567] media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 288/567] media: uvcvideo: Check controls flags before accessing them Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 290/567] coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR Greg Kroah-Hartman
` (281 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Ricardo Ribalda,
Hans Verkuil, Sasha Levin
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 9f582f0418ed1c18f92c9e4628075d6ec9a7d9fb ]
Check for inactive controls in uvc_ctrl_is_accessible().
Use the new value for the master_id controls if present, otherwise
use the existing value to determine if it is OK to set the control.
Doing this here avoids attempting to set an inactive control, which
will return an error from the USB device, which returns an invalid
errorcode.
This fixes:
warn: v4l2-test-controls.cpp(483): s_ctrl returned EIO
warn: v4l2-test-controls.cpp(483): s_ctrl returned EIO
test VIDIOC_G/S_CTRL: OK
warn: v4l2-test-controls.cpp(739): s_ext_ctrls returned EIO
warn: v4l2-test-controls.cpp(739): s_ext_ctrls returned EIO
warn: v4l2-test-controls.cpp(816): s_ext_ctrls returned EIO
test VIDIOC_G/S/TRY_EXT_CTRLS: OK
Tested with:
v4l2-ctl -c auto_exposure=1
OK
v4l2-ctl -c exposure_time_absolute=251
OK
v4l2-ctl -c auto_exposure=3
OK
v4l2-ctl -c exposure_time_absolute=251
VIDIOC_S_EXT_CTRLS: failed: Input/output error
exposure_time_absolute: Input/output error
ERROR
v4l2-ctl -c auto_exposure=3,exposure_time_absolute=251,auto_exposure=1
v4l2-ctl -C auto_exposure,exposure_time_absolute
auto_exposure: 1
exposure_time_absolute: 251
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 42 +++++++++++++++++++++++++++++++-
drivers/media/usb/uvc/uvc_v4l2.c | 3 +--
drivers/media/usb/uvc/uvcvideo.h | 3 ++-
3 files changed, 44 insertions(+), 4 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index fcfbd0f726936..4b3a44264b2ce 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1062,11 +1062,28 @@ static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id,
return 0;
}
+/*
+ * Check if control @v4l2_id can be accessed by the given control @ioctl
+ * (VIDIOC_G_EXT_CTRLS, VIDIOC_TRY_EXT_CTRLS or VIDIOC_S_EXT_CTRLS).
+ *
+ * For set operations on slave controls, check if the master's value is set to
+ * manual, either in the others controls set in the same ioctl call, or from
+ * the master's current value. This catches VIDIOC_S_EXT_CTRLS calls that set
+ * both the master and slave control, such as for instance setting
+ * auto_exposure=1, exposure_time_absolute=251.
+ */
int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
- bool read)
+ const struct v4l2_ext_controls *ctrls,
+ unsigned long ioctl)
{
+ struct uvc_control_mapping *master_map = NULL;
+ struct uvc_control *master_ctrl = NULL;
struct uvc_control_mapping *mapping;
struct uvc_control *ctrl;
+ bool read = ioctl == VIDIOC_G_EXT_CTRLS;
+ s32 val;
+ int ret;
+ int i;
if (__uvc_query_v4l2_class(chain, v4l2_id, 0) >= 0)
return -EACCES;
@@ -1081,6 +1098,29 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR) && !read)
return -EACCES;
+ if (ioctl != VIDIOC_S_EXT_CTRLS || !mapping->master_id)
+ return 0;
+
+ /*
+ * Iterate backwards in cases where the master control is accessed
+ * multiple times in the same ioctl. We want the last value.
+ */
+ for (i = ctrls->count - 1; i >= 0; i--) {
+ if (ctrls->controls[i].id == mapping->master_id)
+ return ctrls->controls[i].value ==
+ mapping->master_manual ? 0 : -EACCES;
+ }
+
+ __uvc_find_control(ctrl->entity, mapping->master_id, &master_map,
+ &master_ctrl, 0);
+
+ if (!master_ctrl || !(master_ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR))
+ return 0;
+
+ ret = __uvc_ctrl_get(chain, master_ctrl, master_map, &val);
+ if (ret >= 0 && val != mapping->master_manual)
+ return -EACCES;
+
return 0;
}
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 7dd387e96c9de..077e1eb7535be 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -1015,8 +1015,7 @@ static int uvc_ctrl_check_access(struct uvc_video_chain *chain,
int ret = 0;
for (i = 0; i < ctrls->count; ++ctrl, ++i) {
- ret = uvc_ctrl_is_accessible(chain, ctrl->id,
- ioctl == VIDIOC_G_EXT_CTRLS);
+ ret = uvc_ctrl_is_accessible(chain, ctrl->id, ctrls, ioctl);
if (ret)
break;
}
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index d414a22244057..d7c4f6f5fca92 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -902,7 +902,8 @@ static inline int uvc_ctrl_rollback(struct uvc_fh *handle)
int uvc_ctrl_get(struct uvc_video_chain *chain, struct v4l2_ext_control *xctrl);
int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl);
int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
- bool read);
+ const struct v4l2_ext_controls *ctrls,
+ unsigned long ioctl);
int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
struct uvc_xu_control_query *xqry);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 290/567] coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 289/567] media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 291/567] coresight: cti: Prevent negative values of enable count Greg Kroah-Hartman
` (280 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junhao He, Mike Leach,
Anshuman Khandual, Suzuki K Poulose, Sasha Levin
From: Junhao He <hejunhao3@huawei.com>
[ Upstream commit 589d928248b72f8377d45904a14bcf686aa8bbeb ]
The TRCSEQRSTEVR and TRCSEQSTR registers are not implemented if the
TRCIDR5.NUMSEQSTATE == 0. Skip accessing the registers in such cases.
Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
Signed-off-by: Junhao He <hejunhao3@huawei.com>
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20230114091632.60095-1-hejunhao3@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../hwtracing/coresight/coresight-etm4x-core.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index e24252eaf8e40..aa64efa0e05f2 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -384,8 +384,10 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
etm4x_relaxed_write32(csa, config->vipcssctlr, TRCVIPCSSCTLR);
for (i = 0; i < drvdata->nrseqstate - 1; i++)
etm4x_relaxed_write32(csa, config->seq_ctrl[i], TRCSEQEVRn(i));
- etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
- etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
+ if (drvdata->nrseqstate) {
+ etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
+ }
etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
for (i = 0; i < drvdata->nr_cntr; i++) {
etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
@@ -1618,8 +1620,10 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata)
for (i = 0; i < drvdata->nrseqstate - 1; i++)
state->trcseqevr[i] = etm4x_read32(csa, TRCSEQEVRn(i));
- state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
- state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
+ if (drvdata->nrseqstate) {
+ state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
+ state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
+ }
state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
for (i = 0; i < drvdata->nr_cntr; i++) {
@@ -1731,8 +1735,10 @@ static void etm4_cpu_restore(struct etmv4_drvdata *drvdata)
for (i = 0; i < drvdata->nrseqstate - 1; i++)
etm4x_relaxed_write32(csa, state->trcseqevr[i], TRCSEQEVRn(i));
- etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
- etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
+ if (drvdata->nrseqstate) {
+ etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
+ }
etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
for (i = 0; i < drvdata->nr_cntr; i++) {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 291/567] coresight: cti: Prevent negative values of enable count
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 290/567] coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 292/567] coresight: cti: Add PM runtime call in enable_store Greg Kroah-Hartman
` (279 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinlong Mao, James Clark,
Mike Leach, Suzuki K Poulose, Sasha Levin
From: James Clark <james.clark@arm.com>
[ Upstream commit 3244fb6dbbf1ffc114cdf382cc167bdd8c18088a ]
Writing 0 to the enable control repeatedly results in a negative value
for enable_req_count. After this, writing 1 to the enable control
appears to not work until the count returns to positive.
Change it so that it's impossible for enable_req_count to be < 0.
Return an error to indicate that the disable request was invalid.
Fixes: 835d722ba10a ("coresight: cti: Initial CoreSight CTI Driver")
Tested-by: Jinlong Mao <quic_jinlmao@quicinc.com>
Signed-off-by: James Clark <james.clark@arm.com>
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20230110110736.2709917-2-james.clark@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-cti-core.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c
index dcd607a0c41a1..932e17f00c0ba 100644
--- a/drivers/hwtracing/coresight/coresight-cti-core.c
+++ b/drivers/hwtracing/coresight/coresight-cti-core.c
@@ -151,9 +151,16 @@ static int cti_disable_hw(struct cti_drvdata *drvdata)
{
struct cti_config *config = &drvdata->config;
struct coresight_device *csdev = drvdata->csdev;
+ int ret = 0;
spin_lock(&drvdata->spinlock);
+ /* don't allow negative refcounts, return an error */
+ if (!atomic_read(&drvdata->config.enable_req_count)) {
+ ret = -EINVAL;
+ goto cti_not_disabled;
+ }
+
/* check refcount - disable on 0 */
if (atomic_dec_return(&drvdata->config.enable_req_count) > 0)
goto cti_not_disabled;
@@ -171,12 +178,12 @@ static int cti_disable_hw(struct cti_drvdata *drvdata)
coresight_disclaim_device_unlocked(csdev);
CS_LOCK(drvdata->base);
spin_unlock(&drvdata->spinlock);
- return 0;
+ return ret;
/* not disabled this call */
cti_not_disabled:
spin_unlock(&drvdata->spinlock);
- return 0;
+ return ret;
}
void cti_write_single_reg(struct cti_drvdata *drvdata, int offset, u32 value)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 292/567] coresight: cti: Add PM runtime call in enable_store
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 291/567] coresight: cti: Prevent negative values of enable count Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 293/567] ACPI: resource: Add helper function acpi_dev_get_memory_resources() Greg Kroah-Hartman
` (278 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mao Jinlong, James Clark,
Suzuki K Poulose, Sasha Levin
From: Mao Jinlong <quic_jinlmao@quicinc.com>
[ Upstream commit eff674a9b86a6ffdd10c3af3863545acf7f1ce4f ]
In commit 6746eae4bbad ("coresight: cti: Fix hang in cti_disable_hw()")
PM runtime calls are removed from cti_enable_hw/cti_disable_hw. When
enabling CTI by writing enable sysfs node, clock for accessing CTI
register won't be enabled. Device will crash due to register access
issue. Add PM runtime call in enable_store to fix this issue.
Fixes: 6746eae4bbad ("coresight: cti: Fix hang in cti_disable_hw()")
Signed-off-by: Mao Jinlong <quic_jinlmao@quicinc.com>
[Change to only call pm_runtime_put if a disable happened]
Tested-by: Jinlong Mao <quic_jinlmao@quicinc.com>
Signed-off-by: James Clark <james.clark@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20230110110736.2709917-3-james.clark@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-cti-sysfs.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-cti-sysfs.c b/drivers/hwtracing/coresight/coresight-cti-sysfs.c
index 7ff7e7780bbfb..92fc3000872a1 100644
--- a/drivers/hwtracing/coresight/coresight-cti-sysfs.c
+++ b/drivers/hwtracing/coresight/coresight-cti-sysfs.c
@@ -108,10 +108,19 @@ static ssize_t enable_store(struct device *dev,
if (ret)
return ret;
- if (val)
+ if (val) {
+ ret = pm_runtime_resume_and_get(dev->parent);
+ if (ret)
+ return ret;
ret = cti_enable(drvdata->csdev);
- else
+ if (ret)
+ pm_runtime_put(dev->parent);
+ } else {
ret = cti_disable(drvdata->csdev);
+ if (!ret)
+ pm_runtime_put(dev->parent);
+ }
+
if (ret)
return ret;
return size;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 293/567] ACPI: resource: Add helper function acpi_dev_get_memory_resources()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 292/567] coresight: cti: Add PM runtime call in enable_store Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 294/567] usb: typec: intel_pmc_mux: Use the helper acpi_dev_get_memory_resources() Greg Kroah-Hartman
` (277 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Rafael J. Wysocki,
Sasha Levin
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
[ Upstream commit 6bb057bfd9d509755349cd2a6ca5e5e6e6071304 ]
Wrapper function that finds all memory type resources by
using acpi_dev_get_resources(). It removes the need for the
drivers to check the resource data type separately.
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c3194949ae8f ("usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 17 +++++++++++++++++
include/linux/acpi.h | 1 +
2 files changed, 18 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index f6317bc417ab1..3b9f894873365 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -788,6 +788,23 @@ int acpi_dev_get_dma_resources(struct acpi_device *adev, struct list_head *list)
}
EXPORT_SYMBOL_GPL(acpi_dev_get_dma_resources);
+/**
+ * acpi_dev_get_memory_resources - Get current memory resources of a device.
+ * @adev: ACPI device node to get the resources for.
+ * @list: Head of the resultant list of resources (must be empty).
+ *
+ * This is a helper function that locates all memory type resources of @adev
+ * with acpi_dev_get_resources().
+ *
+ * The number of resources in the output list is returned on success, an error
+ * code reflecting the error condition is returned otherwise.
+ */
+int acpi_dev_get_memory_resources(struct acpi_device *adev, struct list_head *list)
+{
+ return acpi_dev_get_resources(adev, list, is_memory, NULL);
+}
+EXPORT_SYMBOL_GPL(acpi_dev_get_memory_resources);
+
/**
* acpi_dev_filter_resource_type - Filter ACPI resource according to resource
* types
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 2d7df5cea2494..a23a5aea9c817 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -484,6 +484,7 @@ int acpi_dev_get_resources(struct acpi_device *adev, struct list_head *list,
void *preproc_data);
int acpi_dev_get_dma_resources(struct acpi_device *adev,
struct list_head *list);
+int acpi_dev_get_memory_resources(struct acpi_device *adev, struct list_head *list);
int acpi_dev_filter_resource_type(struct acpi_resource *ares,
unsigned long types);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 294/567] usb: typec: intel_pmc_mux: Use the helper acpi_dev_get_memory_resources()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 293/567] ACPI: resource: Add helper function acpi_dev_get_memory_resources() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 295/567] usb: typec: intel_pmc_mux: Dont leak the ACPI device reference count Greg Kroah-Hartman
` (276 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Rafael J. Wysocki,
Sasha Levin
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
[ Upstream commit 1538dc8c1561f0de4ba57a69e2a421a1a3951618 ]
It removes the need to check the resource data type
separately.
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c3194949ae8f ("usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/mux/intel_pmc_mux.c | 11 +----------
1 file changed, 1 insertion(+), 10 deletions(-)
diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c
index a2f5cfdcf02ac..8af60f0720435 100644
--- a/drivers/usb/typec/mux/intel_pmc_mux.c
+++ b/drivers/usb/typec/mux/intel_pmc_mux.c
@@ -563,15 +563,6 @@ static int pmc_usb_register_port(struct pmc_usb *pmc, int index,
return ret;
}
-static int is_memory(struct acpi_resource *res, void *data)
-{
- struct resource_win win = {};
- struct resource *r = &win.res;
-
- return !(acpi_dev_resource_memory(res, r) ||
- acpi_dev_resource_address_space(res, &win));
-}
-
/* IOM ACPI IDs and IOM_PORT_STATUS_OFFSET */
static const struct acpi_device_id iom_acpi_ids[] = {
/* TigerLake */
@@ -605,7 +596,7 @@ static int pmc_usb_probe_iom(struct pmc_usb *pmc)
return -ENODEV;
INIT_LIST_HEAD(&resource_list);
- ret = acpi_dev_get_resources(adev, &resource_list, is_memory, NULL);
+ ret = acpi_dev_get_memory_resources(adev, &resource_list);
if (ret < 0)
return ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 295/567] usb: typec: intel_pmc_mux: Dont leak the ACPI device reference count
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 294/567] usb: typec: intel_pmc_mux: Use the helper acpi_dev_get_memory_resources() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 296/567] PCI/IOV: Enlarge virtfn sysfs name buffer Greg Kroah-Hartman
` (275 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Heikki Krogerus,
Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit c3194949ae8fcbe2b7e38670e7c6a5cfd2605edc ]
When acpi_dev_get_memory_resources() fails, the reference count is
left bumped. Drop it as it's done in the other error paths.
Fixes: 43d596e32276 ("usb: typec: intel_pmc_mux: Check the port status before connect")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20230102202933.15968-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/mux/intel_pmc_mux.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c
index 8af60f0720435..a7313c2d9f0fe 100644
--- a/drivers/usb/typec/mux/intel_pmc_mux.c
+++ b/drivers/usb/typec/mux/intel_pmc_mux.c
@@ -597,8 +597,10 @@ static int pmc_usb_probe_iom(struct pmc_usb *pmc)
INIT_LIST_HEAD(&resource_list);
ret = acpi_dev_get_memory_resources(adev, &resource_list);
- if (ret < 0)
+ if (ret < 0) {
+ acpi_dev_put(adev);
return ret;
+ }
rentry = list_first_entry_or_null(&resource_list, struct resource_entry, node);
if (rentry)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 296/567] PCI/IOV: Enlarge virtfn sysfs name buffer
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 295/567] usb: typec: intel_pmc_mux: Dont leak the ACPI device reference count Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 297/567] PCI: switchtec: Return -EFAULT for copy_to_user() errors Greg Kroah-Hartman
` (274 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey V. Vissarionov,
Bjorn Helgaas, Sasha Levin
From: Alexey V. Vissarionov <gremlin@altlinux.org>
[ Upstream commit ea0b5aa5f184cf8293c93163f0fb00505190d431 ]
The sysfs link name "virtfn%u" constructed by pci_iov_sysfs_link() requires
17 bytes to contain the longest possible string. Increase VIRTFN_ID_LEN to
accommodate that.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[bhelgaas: commit log, comment at #define]
Fixes: dd7cc44d0bce ("PCI: add SR-IOV API for Physical Function driver")
Link: https://lore.kernel.org/r/20221218033347.23743-1-gremlin@altlinux.org
Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/iov.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index dafdc652fcd06..ef71c1a204004 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -14,7 +14,7 @@
#include <linux/delay.h>
#include "pci.h"
-#define VIRTFN_ID_LEN 16
+#define VIRTFN_ID_LEN 17 /* "virtfn%u\0" for 2^32 - 1 */
int pci_iov_virtfn_bus(struct pci_dev *dev, int vf_id)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 297/567] PCI: switchtec: Return -EFAULT for copy_to_user() errors
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 296/567] PCI/IOV: Enlarge virtfn sysfs name buffer Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 298/567] tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown() Greg Kroah-Hartman
` (273 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Helgaas, Logan Gunthorpe, Sasha Levin
From: Bjorn Helgaas <bhelgaas@google.com>
[ Upstream commit ddc10938e08cd7aac63d8385f7305f7889df5179 ]
switchtec_dev_read() didn't handle copy_to_user() errors correctly: it
assigned "rc = -EFAULT", but actually returned either "size", -ENXIO, or
-EBADMSG instead.
Update the failure cases to unlock mrpc_mutex and return -EFAULT directly.
Link: https://lore.kernel.org/r/20221216162126.207863-3-helgaas@kernel.org
Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver")
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/switch/switchtec.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index 0b301f8be9ed5..d021ef3fb165b 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -552,21 +552,20 @@ static ssize_t switchtec_dev_read(struct file *filp, char __user *data,
rc = copy_to_user(data, &stuser->return_code,
sizeof(stuser->return_code));
if (rc) {
- rc = -EFAULT;
- goto out;
+ mutex_unlock(&stdev->mrpc_mutex);
+ return -EFAULT;
}
data += sizeof(stuser->return_code);
rc = copy_to_user(data, &stuser->data,
size - sizeof(stuser->return_code));
if (rc) {
- rc = -EFAULT;
- goto out;
+ mutex_unlock(&stdev->mrpc_mutex);
+ return -EFAULT;
}
stuser_set_state(stuser, MRPC_IDLE);
-out:
mutex_unlock(&stdev->mrpc_mutex);
if (stuser->status == SWITCHTEC_MRPC_STATUS_DONE)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 298/567] tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 297/567] PCI: switchtec: Return -EFAULT for copy_to_user() errors Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 299/567] tty: serial: fsl_lpuart: clear LPUART Status Register " Greg Kroah-Hartman
` (272 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sherry Sun, Sasha Levin
From: Sherry Sun <sherry.sun@nxp.com>
[ Upstream commit 1d4bd0e4ae4ba95892bef919a8d4d3f08f122d7e ]
UARTBAUD_RDMAE and UARTBAUD_TDMAE are enabled in lpuart32_startup(), but
lpuart32_shutdown() not disable them, only free the dma ring buffer and
release the dma channels, so here disable the Rx/Tx DMA first in
lpuart32_shutdown().
Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant")
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Link: https://lore.kernel.org/r/20221125101953.18753-3-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/fsl_lpuart.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index fc311df9f1c9d..24f9001d10242 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1807,6 +1807,11 @@ static void lpuart32_shutdown(struct uart_port *port)
spin_lock_irqsave(&port->lock, flags);
+ /* disable Rx/Tx DMA */
+ temp = lpuart32_read(port, UARTBAUD);
+ temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE);
+ lpuart32_write(port, temp, UARTBAUD);
+
/* disable Rx/Tx and interrupts */
temp = lpuart32_read(port, UARTCTRL);
temp &= ~(UARTCTRL_TE | UARTCTRL_RE |
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 299/567] tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 298/567] tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 300/567] tty: serial: qcom-geni-serial: stop operations in progress at shutdown Greg Kroah-Hartman
` (271 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sherry Sun, Sasha Levin
From: Sherry Sun <sherry.sun@nxp.com>
[ Upstream commit 4029dfc034febb54f6dd8ea83568accc943bc088 ]
The LPUART Status Register needs to be cleared when closing the uart
port to get a clean environment when reopening the uart.
Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support")
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Link: https://lore.kernel.org/r/20221125101953.18753-4-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/fsl_lpuart.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 24f9001d10242..ccfd6dd5fbf4e 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1807,6 +1807,10 @@ static void lpuart32_shutdown(struct uart_port *port)
spin_lock_irqsave(&port->lock, flags);
+ /* clear status */
+ temp = lpuart32_read(&sport->port, UARTSTAT);
+ lpuart32_write(&sport->port, temp, UARTSTAT);
+
/* disable Rx/Tx DMA */
temp = lpuart32_read(port, UARTBAUD);
temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 300/567] tty: serial: qcom-geni-serial: stop operations in progress at shutdown
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 299/567] tty: serial: fsl_lpuart: clear LPUART Status Register " Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 301/567] serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init() Greg Kroah-Hartman
` (270 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Konrad Dybcio,
Sasha Levin
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
[ Upstream commit d8aca2f96813d51df574a811eda9a2cbed00f261 ]
We don't stop transmissions in progress at shutdown. This is fine with
FIFO SE mode but with DMA (support for which we'll introduce later) it
causes trouble so fix it now.
Fixes: e83766334f96 ("tty: serial: qcom_geni_serial: No need to stop tx/rx on UART shutdown")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20221229155030.418800-2-brgl@bgdev.pl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/qcom_geni_serial.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index ce1c81731a2a8..e5ca3c3c27d21 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -893,6 +893,8 @@ static int setup_fifos(struct qcom_geni_serial_port *port)
static void qcom_geni_serial_shutdown(struct uart_port *uport)
{
disable_irq(uport->irq);
+ qcom_geni_serial_stop_tx(uport);
+ qcom_geni_serial_stop_rx(uport);
}
static int qcom_geni_serial_port_setup(struct uart_port *uport)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 301/567] serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 300/567] tty: serial: qcom-geni-serial: stop operations in progress at shutdown Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 302/567] Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol" Greg Kroah-Hartman
` (269 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yi Yang, Sasha Levin
From: Yi Yang <yiyang13@huawei.com>
[ Upstream commit 38f28cfe9d08e3a47ef008798b275fef8118fc20 ]
Add the missing clk_disable_unprepare() before return from
tegra_uart_hw_init() in the error handling path.
When request_irq() fails in tegra_uart_startup(), 'tup->uart_clk'
has been enabled, fix it by adding clk_disable_unprepare().
Fixes: cc9ca4d95846 ("serial: tegra: Only print FIFO error message when an error occurs")
Fixes: d781ec21bae6 ("serial: tegra: report clk rate errors")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Link: https://lore.kernel.org/r/20221126020852.113378-1-yiyang13@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/serial-tegra.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index 79187ff9ac131..25f34f86a0852 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -1047,6 +1047,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup)
if (tup->cdata->fifo_mode_enable_status) {
ret = tegra_uart_wait_fifo_mode_enabled(tup);
if (ret < 0) {
+ clk_disable_unprepare(tup->uart_clk);
dev_err(tup->uport.dev,
"Failed to enable FIFO mode: %d\n", ret);
return ret;
@@ -1068,6 +1069,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup)
*/
ret = tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD);
if (ret < 0) {
+ clk_disable_unprepare(tup->uart_clk);
dev_err(tup->uport.dev, "Failed to set baud rate\n");
return ret;
}
@@ -1227,10 +1229,13 @@ static int tegra_uart_startup(struct uart_port *u)
dev_name(u->dev), tup);
if (ret < 0) {
dev_err(u->dev, "Failed to register ISR for IRQ %d\n", u->irq);
- goto fail_hw_init;
+ goto fail_request_irq;
}
return 0;
+fail_request_irq:
+ /* tup->uart_clk is already enabled in tegra_uart_hw_init */
+ clk_disable_unprepare(tup->uart_clk);
fail_hw_init:
if (!tup->use_rx_pio)
tegra_uart_dma_channel_free(tup, true);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 302/567] Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol"
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 301/567] serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 303/567] eeprom: idt_89hpesx: Fix error handling in idt_init() Greg Kroah-Hartman
` (268 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Duoming Zhou, Sasha Levin
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit 70fae37a09268455b8ab4f64647086b61da6f39c ]
This reverts commit be826ada52f1fcabed5b5217c94609ebf5967211.
The function monitor_card() is a timer handler that runs in an
atomic context, but it calls usleep_range() that can sleep.
As a result, the sleep-in-atomic-context bugs will happen.
The process is shown below:
(atomic context)
monitor_card()
set_protocol()
usleep_range() //sleep
The origin commit c1986ee9bea3 ("[PATCH] New Omnikey Cardman
4000 driver") works fine.
Fixes: be826ada52f1 ("char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20230118141000.5580-1-duoming@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/pcmcia/cm4000_cs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 8f1bce0b4fe50..7057b7bacc8cf 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -530,7 +530,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq)
DEBUGP(5, dev, "NumRecBytes is valid\n");
break;
}
- usleep_range(10000, 11000);
+ /* can not sleep as this is in atomic context */
+ mdelay(10);
}
if (i == 100) {
DEBUGP(5, dev, "Timeout waiting for NumRecBytes getting "
@@ -550,7 +551,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq)
}
break;
}
- usleep_range(10000, 11000);
+ /* can not sleep as this is in atomic context */
+ mdelay(10);
}
/* check whether it is a short PTS reply? */
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 303/567] eeprom: idt_89hpesx: Fix error handling in idt_init()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 302/567] Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol" Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 304/567] applicom: Fix PCI device refcount leak in applicom_init() Greg Kroah-Hartman
` (267 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuan Can, Serge Semin, Sasha Levin
From: Yuan Can <yuancan@huawei.com>
[ Upstream commit d717a3ab282f51ec45142f911f7ef8a55c057de5 ]
A problem about idt_89hpesx create debugfs failed is triggered with the
following log given:
[ 4973.269647] debugfs: Directory 'idt_csr' with parent '/' already present!
The reason is that idt_init() returns i2c_add_driver() directly without
checking its return value, if i2c_add_driver() failed, it returns without
destroy the newly created debugfs, resulting the debugfs of idt_csr can
never be created later.
idt_init()
debugfs_create_dir() # create debugfs directory
i2c_add_driver()
driver_register()
bus_add_driver()
priv = kzalloc(...) # OOM happened
# return without destroy debugfs directory
Fix by removing debugfs when i2c_add_driver() returns error.
Fixes: cfad6425382e ("eeprom: Add IDT 89HPESx EEPROM/CSR driver")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Link: https://lore.kernel.org/r/20221110020030.47711-1-yuancan@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/eeprom/idt_89hpesx.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c
index 7f430742ce2b8..5298be4cc14c1 100644
--- a/drivers/misc/eeprom/idt_89hpesx.c
+++ b/drivers/misc/eeprom/idt_89hpesx.c
@@ -1568,12 +1568,20 @@ static struct i2c_driver idt_driver = {
*/
static int __init idt_init(void)
{
+ int ret;
+
/* Create Debugfs directory first */
if (debugfs_initialized())
csr_dbgdir = debugfs_create_dir("idt_csr", NULL);
/* Add new i2c-device driver */
- return i2c_add_driver(&idt_driver);
+ ret = i2c_add_driver(&idt_driver);
+ if (ret) {
+ debugfs_remove_recursive(csr_dbgdir);
+ return ret;
+ }
+
+ return 0;
}
module_init(idt_init);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 304/567] applicom: Fix PCI device refcount leak in applicom_init()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 303/567] eeprom: idt_89hpesx: Fix error handling in idt_init() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 305/567] firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() Greg Kroah-Hartman
` (266 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiongfeng Wang, Sasha Levin
From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
[ Upstream commit ce4273d89c52167d6fe20572136c58117eae0657 ]
As comment of pci_get_class() says, it returns a pci_device with its
refcount increased and decreased the refcount for the input parameter
@from if it is not NULL.
If we break the loop in applicom_init() with 'dev' not NULL, we need to
call pci_dev_put() to decrease the refcount. Add the missing
pci_dev_put() to avoid refcount leak.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Link: https://lore.kernel.org/r/20221122114035.24194-1-wangxiongfeng2@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/applicom.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index deb85a334c937..260573c283209 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -197,8 +197,10 @@ static int __init applicom_init(void)
if (!pci_match_id(applicom_pci_tbl, dev))
continue;
- if (pci_enable_device(dev))
+ if (pci_enable_device(dev)) {
+ pci_dev_put(dev);
return -EIO;
+ }
RamIO = ioremap(pci_resource_start(dev, 0), LEN_RAM_IO);
@@ -207,6 +209,7 @@ static int __init applicom_init(void)
"space at 0x%llx\n",
(unsigned long long)pci_resource_start(dev, 0));
pci_disable_device(dev);
+ pci_dev_put(dev);
return -EIO;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 305/567] firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 304/567] applicom: Fix PCI device refcount leak in applicom_init() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 306/567] VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF Greg Kroah-Hartman
` (265 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Dinh Nguyen, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 9175ee1a99d57ec07d66ff572e1d5a724477ab37 ]
In error path in stratix10_svc_drv_probe(), gen_pool_destroy() should be called
to destroy the memory pool that created by svc_create_memory_pool().
Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Link: https://lore.kernel.org/r/20221129163602.462369-1-dinguyen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/stratix10-svc.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
index 7dd0ac1a0cfc7..4fdd75f1e86ea 100644
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -994,13 +994,17 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
/* allocate service controller and supporting channel */
controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL);
- if (!controller)
- return -ENOMEM;
+ if (!controller) {
+ ret = -ENOMEM;
+ goto err_destroy_pool;
+ }
chans = devm_kmalloc_array(dev, SVC_NUM_CHANNEL,
sizeof(*chans), GFP_KERNEL | __GFP_ZERO);
- if (!chans)
- return -ENOMEM;
+ if (!chans) {
+ ret = -ENOMEM;
+ goto err_destroy_pool;
+ }
controller->dev = dev;
controller->num_chans = SVC_NUM_CHANNEL;
@@ -1015,7 +1019,7 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL);
if (ret) {
dev_err(dev, "failed to allocate FIFO\n");
- return ret;
+ goto err_destroy_pool;
}
spin_lock_init(&controller->svc_fifo_lock);
@@ -1060,6 +1064,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
platform_device_put(svc->stratix10_svc_rsu);
err_free_kfifo:
kfifo_free(&controller->svc_fifo);
+err_destroy_pool:
+ gen_pool_destroy(genpool);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 306/567] VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 305/567] firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 307/567] misc/mei/hdcp: Use correct macros to initialize uuid_le Greg Kroah-Hartman
` (264 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzkaller, George Kennedy,
Vishnu Dasa, Sasha Levin
From: George Kennedy <george.kennedy@oracle.com>
[ Upstream commit 1a726cb47fd204109c767409fa9ca15a96328f14 ]
The call to get_user_pages_fast() in vmci_host_setup_notify() can return
NULL context->notify_page causing a GPF. To avoid GPF check if
context->notify_page == NULL and return error if so.
general protection fault, probably for non-canonical address
0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x0005088000000300-
0x0005088000000307]
CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1
Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014
RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0
Call Trace:
<TASK>
vmci_host_unlocked_ioctl+0x362/0x1f40
__x64_sys_ioctl+0x1a1/0x230
do_syscall_64+0x3a/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fixes: a1d88436d53a ("VMCI: Fix two UVA mapping bugs")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
Link: https://lore.kernel.org/r/1669666705-24012-1-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/vmw_vmci/vmci_host.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
index da1e2a773823e..857b9851402a6 100644
--- a/drivers/misc/vmw_vmci/vmci_host.c
+++ b/drivers/misc/vmw_vmci/vmci_host.c
@@ -242,6 +242,8 @@ static int vmci_host_setup_notify(struct vmci_ctx *context,
context->notify_page = NULL;
return VMCI_ERROR_GENERIC;
}
+ if (context->notify_page == NULL)
+ return VMCI_ERROR_UNAVAILABLE;
/*
* Map the locked page and set up notify pointer.
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 307/567] misc/mei/hdcp: Use correct macros to initialize uuid_le
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 306/567] VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 308/567] driver core: fix resource leak in device_add() Greg Kroah-Hartman
` (263 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Tomas Winkler, Sasha Levin
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 512ba04d8211dd1a54dd36adc3ecc527a28069c5 ]
GUID_INIT() is for internal guid_t type and shouldn't be used
for the uuid_le. I.o.w. relying on the implementation details
is layering violation. Use correct macros to initialize uuid_le.
Fixes: 64e9bbdd9588 ("misc/mei/hdcp: Client driver for HDCP application")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Tomas Winkler <tomas.winkler@intel.com>
Link: https://lore.kernel.org/r/20221228160500.21220-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/mei/hdcp/mei_hdcp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c
index ec2a4fce85818..5c4295d366eae 100644
--- a/drivers/misc/mei/hdcp/mei_hdcp.c
+++ b/drivers/misc/mei/hdcp/mei_hdcp.c
@@ -859,8 +859,8 @@ static void mei_hdcp_remove(struct mei_cl_device *cldev)
dev_warn(&cldev->dev, "mei_cldev_disable() failed\n");
}
-#define MEI_UUID_HDCP GUID_INIT(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \
- 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04)
+#define MEI_UUID_HDCP UUID_LE(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \
+ 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04)
static const struct mei_cl_device_id mei_hdcp_tbl[] = {
{ .uuid = MEI_UUID_HDCP, .version = MEI_CL_VERSION_ANY },
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 308/567] driver core: fix resource leak in device_add()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 307/567] misc/mei/hdcp: Use correct macros to initialize uuid_le Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 309/567] drivers: base: transport_class: fix possible memory leak Greg Kroah-Hartman
` (262 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhengchao Shao, Sasha Levin
From: Zhengchao Shao <shaozhengchao@huawei.com>
[ Upstream commit 6977b1a5d67097eaa4d02b0c126c04cc6e8917c0 ]
When calling kobject_add() failed in device_add(), it will call
cleanup_glue_dir() to free resource. But in kobject_add(),
dev->kobj.parent has been set to NULL. This will cause resource leak.
The process is as follows:
device_add()
get_device_parent()
class_dir_create_and_add()
kobject_add() //kobject_get()
...
dev->kobj.parent = kobj;
...
kobject_add() //failed, but set dev->kobj.parent = NULL
...
glue_dir = get_glue_dir(dev) //glue_dir = NULL, and goto
//"Error" label
...
cleanup_glue_dir() //becaues glue_dir is NULL, not call
//kobject_put()
The preceding problem may cause insmod mac80211_hwsim.ko to failed.
sysfs: cannot create duplicate filename '/devices/virtual/mac80211_hwsim'
Call Trace:
<TASK>
dump_stack_lvl+0x8e/0xd1
sysfs_warn_dup.cold+0x1c/0x29
sysfs_create_dir_ns+0x224/0x280
kobject_add_internal+0x2aa/0x880
kobject_add+0x135/0x1a0
get_device_parent+0x3d7/0x590
device_add+0x2aa/0x1cb0
device_create_groups_vargs+0x1eb/0x260
device_create+0xdc/0x110
mac80211_hwsim_new_radio+0x31e/0x4790 [mac80211_hwsim]
init_mac80211_hwsim+0x48d/0x1000 [mac80211_hwsim]
do_one_initcall+0x10f/0x630
do_init_module+0x19f/0x5e0
load_module+0x64b7/0x6eb0
__do_sys_finit_module+0x140/0x200
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
</TASK>
kobject_add_internal failed for mac80211_hwsim with -EEXIST, don't try to
register things with the same name in the same directory.
Fixes: cebf8fd16900 ("driver core: fix race between creating/querying glue dir and its cleanup")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Link: https://lore.kernel.org/r/20221123012042.335252-1-shaozhengchao@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index e6a7b93760e45..adf003a7e8d6a 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -3328,7 +3328,7 @@ int device_add(struct device *dev)
/* we require the name to be set before, and pass NULL */
error = kobject_add(&dev->kobj, dev->kobj.parent, NULL);
if (error) {
- glue_dir = get_glue_dir(dev);
+ glue_dir = kobj;
goto Error;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 309/567] drivers: base: transport_class: fix possible memory leak
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 308/567] driver core: fix resource leak in device_add() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 310/567] drivers: base: transport_class: fix resource leak when transport_add_device() fails Greg Kroah-Hartman
` (261 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit a86367803838b369fe5486ac18771d14723c258c ]
Current some drivers(like iscsi) call transport_register_device()
failed, they don't call transport_destroy_device() to release the
memory allocated in transport_setup_device(), because they don't
know what was done, it should be internal thing to release the
resource in register function. So fix this leak by calling destroy
function inside register function.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221110102307.3492557-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/transport_class.h | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/include/linux/transport_class.h b/include/linux/transport_class.h
index 63076fb835e34..2efc271a96fa6 100644
--- a/include/linux/transport_class.h
+++ b/include/linux/transport_class.h
@@ -70,8 +70,14 @@ void transport_destroy_device(struct device *);
static inline int
transport_register_device(struct device *dev)
{
+ int ret;
+
transport_setup_device(dev);
- return transport_add_device(dev);
+ ret = transport_add_device(dev);
+ if (ret)
+ transport_destroy_device(dev);
+
+ return ret;
}
static inline void
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 310/567] drivers: base: transport_class: fix resource leak when transport_add_device() fails
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 309/567] drivers: base: transport_class: fix possible memory leak Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 311/567] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle Greg Kroah-Hartman
` (260 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Sasha Levin
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit e5da06b27ff5a148e42265c8e306670a9d913969 ]
The normal call sequence of using transport class is:
Add path:
transport_setup_device()
transport_setup_classdev() // call sas_host_setup() here
transport_add_device() // if fails, need call transport_destroy_device()
transport_configure_device()
Remove path:
transport_remove_device()
transport_remove_classdev // call sas_host_remove() here
transport_destroy_device()
If transport_add_device() fails, need call transport_destroy_device()
to free memory, but in this case, ->remove() is not called, and the
resources allocated in ->setup() are leaked. So fix these leaks by
calling ->remove() in transport_add_class_device() if it returns error.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221115031638.3816551-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/transport_class.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/drivers/base/transport_class.c b/drivers/base/transport_class.c
index ccc86206e5087..09ee2a1e35bbd 100644
--- a/drivers/base/transport_class.c
+++ b/drivers/base/transport_class.c
@@ -155,12 +155,27 @@ static int transport_add_class_device(struct attribute_container *cont,
struct device *dev,
struct device *classdev)
{
+ struct transport_class *tclass = class_to_transport_class(cont->class);
int error = attribute_container_add_class_device(classdev);
struct transport_container *tcont =
attribute_container_to_transport_container(cont);
- if (!error && tcont->statistics)
+ if (error)
+ goto err_remove;
+
+ if (tcont->statistics) {
error = sysfs_create_group(&classdev->kobj, tcont->statistics);
+ if (error)
+ goto err_del;
+ }
+
+ return 0;
+
+err_del:
+ attribute_container_class_device_del(classdev);
+err_remove:
+ if (tclass->remove)
+ tclass->remove(tcont, dev, classdev);
return error;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 311/567] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 310/567] drivers: base: transport_class: fix resource leak when transport_add_device() fails Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 312/567] fotg210-udc: Add missing completion handler Greg Kroah-Hartman
` (259 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chen Zhongjin, Sasha Levin
From: Chen Zhongjin <chenzhongjin@huawei.com>
[ Upstream commit 18e126e97c961f7a93823795c879d7c085fe5098 ]
KASAN reported a null-ptr-deref error:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 1373 Comm: modprobe
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:dmi_sysfs_entry_release
...
Call Trace:
<TASK>
kobject_put
dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs
dmi_decode_table (drivers/firmware/dmi_scan.c:133)
dmi_walk (drivers/firmware/dmi_scan.c:1115)
dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs
do_one_initcall (init/main.c:1296)
...
Kernel panic - not syncing: Fatal exception
Kernel Offset: 0x4000000 from 0xffffffff81000000
---[ end Kernel panic - not syncing: Fatal exception ]---
It is because previous patch added kobject_put() to release the memory
which will call dmi_sysfs_entry_release() and list_del().
However, list_add_tail(entry->list) is called after the error block,
so the list_head is uninitialized and cannot be deleted.
Move error handling to after list_add_tail to fix this.
Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Link: https://lore.kernel.org/r/20221111015326.251650-2-chenzhongjin@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/dmi-sysfs.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c
index 4a93fb490cb46..3d57b08320df9 100644
--- a/drivers/firmware/dmi-sysfs.c
+++ b/drivers/firmware/dmi-sysfs.c
@@ -602,16 +602,16 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh,
*ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL,
"%d-%d", dh->type, entry->instance);
- if (*ret) {
- kobject_put(&entry->kobj);
- return;
- }
-
/* Thread on the global list for cleanup */
spin_lock(&entry_list_lock);
list_add_tail(&entry->list, &entry_list);
spin_unlock(&entry_list_lock);
+ if (*ret) {
+ kobject_put(&entry->kobj);
+ return;
+ }
+
/* Handle specializations by type */
switch (dh->type) {
case DMI_ENTRY_SYSTEM_EVENT_LOG:
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 312/567] fotg210-udc: Add missing completion handler
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 311/567] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 313/567] dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers Greg Kroah-Hartman
` (258 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabian Vogt, Linus Walleij, Sasha Levin
From: Fabian Vogt <fabian@ritter-vogt.de>
[ Upstream commit e55f67391fa986f7357edba0ca59e668d99c3a5f ]
This is used when responding to GET_STATUS requests. Without this, it
crashes on completion.
Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20230123073508.2350402-2-linus.walleij@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/fotg210-udc.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index d0e051beb3af9..6f7ade156437a 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -706,6 +706,20 @@ static int fotg210_is_epnstall(struct fotg210_ep *ep)
return value & INOUTEPMPSR_STL_EP ? 1 : 0;
}
+/* For EP0 requests triggered by this driver (currently GET_STATUS response) */
+static void fotg210_ep0_complete(struct usb_ep *_ep, struct usb_request *req)
+{
+ struct fotg210_ep *ep;
+ struct fotg210_udc *fotg210;
+
+ ep = container_of(_ep, struct fotg210_ep, ep);
+ fotg210 = ep->fotg210;
+
+ if (req->status || req->actual != req->length) {
+ dev_warn(&fotg210->gadget.dev, "EP0 request failed: %d\n", req->status);
+ }
+}
+
static void fotg210_get_status(struct fotg210_udc *fotg210,
struct usb_ctrlrequest *ctrl)
{
@@ -1172,6 +1186,8 @@ static int fotg210_udc_probe(struct platform_device *pdev)
if (fotg210->ep0_req == NULL)
goto err_map;
+ fotg210->ep0_req->complete = fotg210_ep0_complete;
+
fotg210_init(fotg210);
fotg210_disable_unplug(fotg210);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 313/567] dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 312/567] fotg210-udc: Add missing completion handler Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 314/567] usb: early: xhci-dbc: Fix a potential out-of-bound memory access Greg Kroah-Hartman
` (257 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam, Serge Semin,
Lorenzo Pieralisi, Bjorn Helgaas, Vinod Koul, Sasha Levin
From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
[ Upstream commit 13b6299cf66165a442089fa895a7f70250703584 ]
Interleaved DMA transfer support was added by 85e7518f42c8 ("dmaengine:
dw-edma: Add device_prep_interleave_dma() support"), but depending on the
selected channel, either source or destination address are left
uninitialized which was obviously wrong.
Initialize the destination address of the eDMA burst descriptors for
DEV_TO_MEM interleaved operations and the source address for MEM_TO_DEV
operations.
Link: https://lore.kernel.org/r/20230113171409.30470-5-Sergey.Semin@baikalelectronics.ru
Fixes: 85e7518f42c8 ("dmaengine: dw-edma: Add device_prep_interleave_dma() support")
Tested-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Acked-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-edma/dw-edma-core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
index 36b3fe1b6b0f9..97f5e4e93cfc6 100644
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -438,6 +438,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
* and destination addresses are increased
* by the same portion (data length)
*/
+ } else if (xfer->type == EDMA_XFER_INTERLEAVED) {
+ burst->dar = dst_addr;
}
} else {
burst->dar = dst_addr;
@@ -453,6 +455,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer)
* and destination addresses are increased
* by the same portion (data length)
*/
+ } else if (xfer->type == EDMA_XFER_INTERLEAVED) {
+ burst->sar = src_addr;
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 314/567] usb: early: xhci-dbc: Fix a potential out-of-bound memory access
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 313/567] dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 315/567] tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case Greg Kroah-Hartman
` (256 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Sasha Levin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit a4a97ab3db5c081eb6e7dba91306adefb461e0bd ]
If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the
string is not guaranteed to be NULL terminated when xdbc_trace() is called.
Reserve an extra byte, which will be zeroed automatically because 'buf' is
a static variable, in order to avoid troubles, should it happen.
Fixes: aeb9dd1de98c ("usb/early: Add driver for xhci debug capability")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/d6a7562c5e839a195cee85db6dc81817f9372cb1.1675016180.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/early/xhci-dbc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c
index 6c0434100e38c..b0c4071f0b167 100644
--- a/drivers/usb/early/xhci-dbc.c
+++ b/drivers/usb/early/xhci-dbc.c
@@ -871,7 +871,8 @@ static int xdbc_bulk_write(const char *bytes, int size)
static void early_xdbc_write(struct console *con, const char *str, u32 n)
{
- static char buf[XDBC_MAX_PACKET];
+ /* static variables are zeroed, so buf is always NULL terminated */
+ static char buf[XDBC_MAX_PACKET + 1];
int chunk, ret;
int use_cr = 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 315/567] tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 314/567] usb: early: xhci-dbc: Fix a potential out-of-bound memory access Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 316/567] RDMA/cxgb4: add null-ptr-check after ip_dev_find() Greg Kroah-Hartman
` (255 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sherry Sun, Sasha Levin
From: Sherry Sun <sherry.sun@nxp.com>
[ Upstream commit 9ad9df8447547febe9dd09b040f4528a09e495f0 ]
The RXWATER value must be greater than 0 according to the LPUART
reference manual. And when the number of datawords in the receive
FIFO is greater than RXWATER, an interrupt or a DMA request is
generated, so no need to set the different value for lpuart interrupt
case and dma case. Here delete the wrong RXWATER setting for dma case
directly.
Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant")
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Link: https://lore.kernel.org/r/20230130064449.9564-4-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/fsl_lpuart.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index ccfd6dd5fbf4e..08096d33af8a6 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1700,12 +1700,6 @@ static void lpuart32_configure(struct lpuart_port *sport)
{
unsigned long temp;
- if (sport->lpuart_dma_rx_use) {
- /* RXWATER must be 0 */
- temp = lpuart32_read(&sport->port, UARTWATER);
- temp &= ~(UARTWATER_WATER_MASK << UARTWATER_RXWATER_OFF);
- lpuart32_write(&sport->port, temp, UARTWATER);
- }
temp = lpuart32_read(&sport->port, UARTCTRL);
if (!sport->lpuart_dma_rx_use)
temp |= UARTCTRL_RIE;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 316/567] RDMA/cxgb4: add null-ptr-check after ip_dev_find()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 315/567] tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 317/567] usb: musb: mediatek: dont unregister something that wasnt registered Greg Kroah-Hartman
` (254 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich,
Leon Romanovsky, Sasha Levin
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit ef42520240aacfc0d46c8d780c051d135a8dc9b7 ]
ip_dev_find() may return NULL and assign it to pdev which is
dereferenced later.
Fix this by checking the return value of ip_dev_find() for NULL
similar to the way it is done with other instances of said function.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://lore.kernel.org/r/20230201172103.17261-1-n.zhandarovich@fintech.ru
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/cxgb4/cm.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 291471d12197f..56f46a16e6575 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -4150,6 +4150,10 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
if (neigh->dev->flags & IFF_LOOPBACK) {
pdev = ip_dev_find(&init_net, iph->daddr);
+ if (!pdev) {
+ pr_err("%s - failed to find device!\n", __func__);
+ goto free_dst;
+ }
e = cxgb4_l2t_get(dev->rdev.lldi.l2t, neigh,
pdev, 0);
pi = (struct port_info *)netdev_priv(pdev);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 317/567] usb: musb: mediatek: dont unregister something that wasnt registered
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 316/567] RDMA/cxgb4: add null-ptr-check after ip_dev_find() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 318/567] usb: gadget: configfs: use to_config_usb_cfg() in os_desc_link() Greg Kroah-Hartman
` (253 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Sasha Levin
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit ba883de971d1ad018f3083d9195b8abe54d87407 ]
This function only calls mtk_otg_switch_init() when the ->port_mode
is MUSB_OTG so the clean up code should only call mtk_otg_switch_exit()
for that mode.
Fixes: 0990366bab3c ("usb: musb: Add support for MediaTek musb controller")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://lore.kernel.org/r/Y8/3TqpqiSr0RxFH@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/musb/mediatek.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/musb/mediatek.c b/drivers/usb/musb/mediatek.c
index 6b92d037d8fc8..4f52b92c45974 100644
--- a/drivers/usb/musb/mediatek.c
+++ b/drivers/usb/musb/mediatek.c
@@ -346,7 +346,8 @@ static int mtk_musb_init(struct musb *musb)
err_phy_power_on:
phy_exit(glue->phy);
err_phy_init:
- mtk_otg_switch_exit(glue);
+ if (musb->port_mode == MUSB_OTG)
+ mtk_otg_switch_exit(glue);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 318/567] usb: gadget: configfs: use to_config_usb_cfg() in os_desc_link()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 317/567] usb: musb: mediatek: dont unregister something that wasnt registered Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 319/567] usb: gadget: configfs: use to_usb_function_instance() in cfg (un)link func Greg Kroah-Hartman
` (252 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jack Pham, Linyu Yuan, Sasha Levin
From: Linyu Yuan <quic_linyyuan@quicinc.com>
[ Upstream commit 5d143ec451429891385a21617b292f2ceaa684ea ]
replace open-coded container_of() with to_config_usb_cfg() helper.
Reviewed-by: Jack Pham <quic_jackp@quicinc.com>
Signed-off-by: Linyu Yuan <quic_linyyuan@quicinc.com>
Link: https://lore.kernel.org/r/1637211213-16400-4-git-send-email-quic_linyyuan@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 89e7252d6c7e ("usb: gadget: configfs: Restrict symlink creation is UDC already binded")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/configfs.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 5ade844db4046..7d3b93dc154fe 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -890,9 +890,7 @@ static int os_desc_link(struct config_item *os_desc_ci,
struct gadget_info *gi = container_of(to_config_group(os_desc_ci),
struct gadget_info, os_desc_group);
struct usb_composite_dev *cdev = &gi->cdev;
- struct config_usb_cfg *c_target =
- container_of(to_config_group(usb_cfg_ci),
- struct config_usb_cfg, group);
+ struct config_usb_cfg *c_target = to_config_usb_cfg(usb_cfg_ci);
struct usb_configuration *c;
int ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 319/567] usb: gadget: configfs: use to_usb_function_instance() in cfg (un)link func
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 318/567] usb: gadget: configfs: use to_config_usb_cfg() in os_desc_link() Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 320/567] usb: gadget: configfs: remove using list iterator after loop body as a ptr Greg Kroah-Hartman
` (251 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jack Pham, Linyu Yuan, Sasha Levin
From: Linyu Yuan <quic_linyyuan@quicinc.com>
[ Upstream commit 5284acccc4a501f38dbeceabaa0340401c107654 ]
replace open-coded container_of() with to_usb_function_instance() helper.
Reviewed-by: Jack Pham <quic_jackp@quicinc.com>
Signed-off-by: Linyu Yuan <quic_linyyuan@quicinc.com>
Link: https://lore.kernel.org/r/1637211213-16400-5-git-send-email-quic_linyyuan@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 89e7252d6c7e ("usb: gadget: configfs: Restrict symlink creation is UDC already binded")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/configfs.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 7d3b93dc154fe..8166e771e8663 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -416,9 +416,8 @@ static int config_usb_cfg_link(
struct usb_composite_dev *cdev = cfg->c.cdev;
struct gadget_info *gi = container_of(cdev, struct gadget_info, cdev);
- struct config_group *group = to_config_group(usb_func_ci);
- struct usb_function_instance *fi = container_of(group,
- struct usb_function_instance, group);
+ struct usb_function_instance *fi =
+ to_usb_function_instance(usb_func_ci);
struct usb_function_instance *a_fi;
struct usb_function *f;
int ret;
@@ -467,9 +466,8 @@ static void config_usb_cfg_unlink(
struct usb_composite_dev *cdev = cfg->c.cdev;
struct gadget_info *gi = container_of(cdev, struct gadget_info, cdev);
- struct config_group *group = to_config_group(usb_func_ci);
- struct usb_function_instance *fi = container_of(group,
- struct usb_function_instance, group);
+ struct usb_function_instance *fi =
+ to_usb_function_instance(usb_func_ci);
struct usb_function *f;
/*
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 320/567] usb: gadget: configfs: remove using list iterator after loop body as a ptr
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 319/567] usb: gadget: configfs: use to_usb_function_instance() in cfg (un)link func Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 321/567] usb: gadget: configfs: Restrict symlink creation is UDC already binded Greg Kroah-Hartman
` (250 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jakob Koschel, Sasha Levin
From: Jakob Koschel <jakobkoschel@gmail.com>
[ Upstream commit 36f4c25ce32ed8a2e6304ebee6246b7f0b3b9a6f ]
If the list does not contain the expected element, the value of
list_for_each_entry() iterator will not point to a valid structure.
To avoid type confusion in such case, the list iterator
scope will be limited to list_for_each_entry() loop.
In preparation to limiting scope of a list iterator to the list traversal
loop, use a dedicated pointer to point to the found element [1].
Determining if an element was found is then simply checking if
the pointer is != NULL instead of using the potentially bogus pointer.
Link: https://lore.kernel.org/all/YhdfEIwI4EdtHdym@kroah.com/
Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
Link: https://lore.kernel.org/r/20220308171818.384491-18-jakobkoschel@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 89e7252d6c7e ("usb: gadget: configfs: Restrict symlink creation is UDC already binded")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/configfs.c | 24 ++++++++++++++----------
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 8166e771e8663..891d8e4023221 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -418,7 +418,7 @@ static int config_usb_cfg_link(
struct usb_function_instance *fi =
to_usb_function_instance(usb_func_ci);
- struct usb_function_instance *a_fi;
+ struct usb_function_instance *a_fi = NULL, *iter;
struct usb_function *f;
int ret;
@@ -428,11 +428,13 @@ static int config_usb_cfg_link(
* from another gadget or a random directory.
* Also a function instance can only be linked once.
*/
- list_for_each_entry(a_fi, &gi->available_func, cfs_list) {
- if (a_fi == fi)
- break;
+ list_for_each_entry(iter, &gi->available_func, cfs_list) {
+ if (iter != fi)
+ continue;
+ a_fi = iter;
+ break;
}
- if (a_fi != fi) {
+ if (!a_fi) {
ret = -EINVAL;
goto out;
}
@@ -889,15 +891,17 @@ static int os_desc_link(struct config_item *os_desc_ci,
struct gadget_info, os_desc_group);
struct usb_composite_dev *cdev = &gi->cdev;
struct config_usb_cfg *c_target = to_config_usb_cfg(usb_cfg_ci);
- struct usb_configuration *c;
+ struct usb_configuration *c = NULL, *iter;
int ret;
mutex_lock(&gi->lock);
- list_for_each_entry(c, &cdev->configs, list) {
- if (c == &c_target->c)
- break;
+ list_for_each_entry(iter, &cdev->configs, list) {
+ if (iter != &c_target->c)
+ continue;
+ c = iter;
+ break;
}
- if (c != &c_target->c) {
+ if (!c) {
ret = -EINVAL;
goto out;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 321/567] usb: gadget: configfs: Restrict symlink creation is UDC already binded
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 320/567] usb: gadget: configfs: remove using list iterator after loop body as a ptr Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 322/567] iommu/vt-d: Set No Execute Enable bit in PASID table entry Greg Kroah-Hartman
` (249 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krishna Kurapati PSSNV,
Udipto Goswami, Sasha Levin
From: Udipto Goswami <quic_ugoswami@quicinc.com>
[ Upstream commit 89e7252d6c7e7eeb31971cd7df987316ecc64ff5 ]
During enumeration or composition switch,a userspace process
agnostic of the conventions of configs can try to create function
symlinks even after the UDC is bound to current config which is
not correct. Potentially it can create duplicates within the
current config.
Prevent this by adding a check if udc_name already exists, then bail
out of cfg_link.
Following is an example:
Step1:
ln -s X1 ffs.a
-->cfg_link
--> usb_get_function(ffs.a)
->ffs_alloc
CFG->FUNC_LIST: <ffs.a>
C->FUNCTION: <empty>
Step2:
echo udc.name > /config/usb_gadget/g1/UDC
--> UDC_store
->composite_bind
->usb_add_function
CFG->FUNC_LIST: <empty>
C->FUNCTION: <ffs.a>
Step3:
ln -s Y1 ffs.a
-->cfg_link
-->usb_get_function(ffs.a)
->ffs_alloc
CFG->FUNC_LIST: <ffs.a>
C->FUNCTION: <ffs.a>
both the lists corresponds to the same function instance ffs.a
but the usb_function* pointer is different because in step 3
ffs_alloc has created a new reference to usb_function* for
ffs.a and added it to cfg_list.
Step4:
Now a composition switch involving <ffs.b,ffs.a> is executed.
the composition switch will involve 3 things:
1. unlinking the previous functions existing
2. creating new symlinks
3. writing UDC
However, the composition switch is generally taken care by
userspace process which creates the symlinks in its own
nomenclature(X*) and removes only those.
So it won't be able to remove Y1 which user had created
by own.
Due to this the new symlinks cannot be created for ffs.a
since the entry already exists in CFG->FUNC_LIST.
The state of the CFG->FUNC_LIST is as follows:
CFG->FUNC_LIST: <ffs.a>
Fixes: 88af8bbe4ef7 ("usb: gadget: the start of the configfs interface")
Signed-off-by: Krishna Kurapati PSSNV <quic_kriskura@quicinc.com>
Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com>
Link: https://lore.kernel.org/r/20230201132308.31523-1-quic_ugoswami@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/configfs.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 891d8e4023221..5cbf4084daedc 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -428,6 +428,12 @@ static int config_usb_cfg_link(
* from another gadget or a random directory.
* Also a function instance can only be linked once.
*/
+
+ if (gi->composite.gadget_driver.udc_name) {
+ ret = -EINVAL;
+ goto out;
+ }
+
list_for_each_entry(iter, &gi->available_func, cfs_list) {
if (iter != fi)
continue;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 322/567] iommu/vt-d: Set No Execute Enable bit in PASID table entry
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 321/567] usb: gadget: configfs: Restrict symlink creation is UDC already binded Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:00 ` [PATCH 5.15 323/567] power: supply: remove faulty cooling logic Greg Kroah-Hartman
` (248 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashok Raj, Lu Baolu, Kevin Tian,
Joerg Roedel, Sasha Levin
From: Lu Baolu <baolu.lu@linux.intel.com>
[ Upstream commit e06d24435596c8afcaa81c0c498f5b0ec4ee2b7c ]
Setup No Execute Enable bit (Bit 133) of a scalable mode PASID entry.
This is to allow the use of XD bit of the first level page table.
Fixes: ddf09b6d43ec ("iommu/vt-d: Setup pasid entries for iova over first level")
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20230126095438.354205-1-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/pasid.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
index 0060bd089dc7f..9a3dd55aaa1c2 100644
--- a/drivers/iommu/intel/pasid.c
+++ b/drivers/iommu/intel/pasid.c
@@ -425,6 +425,16 @@ static inline void pasid_set_page_snoop(struct pasid_entry *pe, bool value)
pasid_set_bits(&pe->val[1], 1 << 23, value << 23);
}
+/*
+ * Setup No Execute Enable bit (Bit 133) of a scalable mode PASID
+ * entry. It is required when XD bit of the first level page table
+ * entry is about to be set.
+ */
+static inline void pasid_set_nxe(struct pasid_entry *pe)
+{
+ pasid_set_bits(&pe->val[2], 1 << 5, 1 << 5);
+}
+
/*
* Setup the Page Snoop (PGSNP) field (Bit 88) of a scalable mode
* PASID entry.
@@ -631,6 +641,7 @@ int intel_pasid_setup_first_level(struct intel_iommu *iommu,
pasid_set_domain_id(pte, did);
pasid_set_address_width(pte, iommu->agaw);
pasid_set_page_snoop(pte, !!ecap_smpwc(iommu->ecap));
+ pasid_set_nxe(pte);
/* Setup Present and PASID Granular Transfer Type: */
pasid_set_translation_type(pte, PASID_ENTRY_PGTT_FL_ONLY);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 323/567] power: supply: remove faulty cooling logic
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 322/567] iommu/vt-d: Set No Execute Enable bit in PASID table entry Greg Kroah-Hartman
@ 2023-03-07 17:00 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 324/567] RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() Greg Kroah-Hartman
` (247 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Kemnade, Sebastian Reichel,
Sasha Levin
From: Andreas Kemnade <andreas@kemnade.info>
[ Upstream commit c85c191694cb1cf290b11059b3d2de8a2732ffd0 ]
The rn5t618 power driver fails to register
a cooling device because POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX
is missing but availability is not checked before registering
cooling device. After improved error checking in the thermal
code, the registration of the power supply fails entirely.
Checking for availability of _MAX before registering cooling device
fixes the rn5t618 problem. But the whole logic feels questionable.
First, the logic is inverted here:
the code tells: max_current = max_cooling but
0 = max_cooling, so there needs to be some inversion
in the code which cannot be found. Comparing with other
cooling devices, it can be found that value for fan speed is not
inverted, value for cpufreq cooling is inverted (similar situation
as here lowest frequency = max cooling)
Second, analyzing usage of _MAX: it is seems that maximum capabilities
of charging controller are specified and not of the battery. Probably
there is not too much mismatch in the drivers actually implementing
that. So nothing has exploded yet. So there is no easy and safe way
to specifify a max cooling value now.
Conclusion for now (as a regression fix) just remove the cooling device
registration and do it properly later on.
Fixes: e49a1e1ee078 ("thermal/core: fix error code in __thermal_cooling_device_register()")
Fixes: 952aeeb3ee28 ("power_supply: Register power supply for thermal cooling device")
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/power_supply_core.c | 97 ------------------------
1 file changed, 97 deletions(-)
diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index 3f9c60c5b250b..8161fad081a96 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -1014,87 +1014,6 @@ static void psy_unregister_thermal(struct power_supply *psy)
thermal_zone_device_unregister(psy->tzd);
}
-/* thermal cooling device callbacks */
-static int ps_get_max_charge_cntl_limit(struct thermal_cooling_device *tcd,
- unsigned long *state)
-{
- struct power_supply *psy;
- union power_supply_propval val;
- int ret;
-
- psy = tcd->devdata;
- ret = power_supply_get_property(psy,
- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val);
- if (ret)
- return ret;
-
- *state = val.intval;
-
- return ret;
-}
-
-static int ps_get_cur_charge_cntl_limit(struct thermal_cooling_device *tcd,
- unsigned long *state)
-{
- struct power_supply *psy;
- union power_supply_propval val;
- int ret;
-
- psy = tcd->devdata;
- ret = power_supply_get_property(psy,
- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
- if (ret)
- return ret;
-
- *state = val.intval;
-
- return ret;
-}
-
-static int ps_set_cur_charge_cntl_limit(struct thermal_cooling_device *tcd,
- unsigned long state)
-{
- struct power_supply *psy;
- union power_supply_propval val;
- int ret;
-
- psy = tcd->devdata;
- val.intval = state;
- ret = psy->desc->set_property(psy,
- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
-
- return ret;
-}
-
-static const struct thermal_cooling_device_ops psy_tcd_ops = {
- .get_max_state = ps_get_max_charge_cntl_limit,
- .get_cur_state = ps_get_cur_charge_cntl_limit,
- .set_cur_state = ps_set_cur_charge_cntl_limit,
-};
-
-static int psy_register_cooler(struct power_supply *psy)
-{
- int i;
-
- /* Register for cooling device if psy can control charging */
- for (i = 0; i < psy->desc->num_properties; i++) {
- if (psy->desc->properties[i] ==
- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT) {
- psy->tcd = thermal_cooling_device_register(
- (char *)psy->desc->name,
- psy, &psy_tcd_ops);
- return PTR_ERR_OR_ZERO(psy->tcd);
- }
- }
- return 0;
-}
-
-static void psy_unregister_cooler(struct power_supply *psy)
-{
- if (IS_ERR_OR_NULL(psy->tcd))
- return;
- thermal_cooling_device_unregister(psy->tcd);
-}
#else
static int psy_register_thermal(struct power_supply *psy)
{
@@ -1104,15 +1023,6 @@ static int psy_register_thermal(struct power_supply *psy)
static void psy_unregister_thermal(struct power_supply *psy)
{
}
-
-static int psy_register_cooler(struct power_supply *psy)
-{
- return 0;
-}
-
-static void psy_unregister_cooler(struct power_supply *psy)
-{
-}
#endif
static struct power_supply *__must_check
@@ -1188,10 +1098,6 @@ __power_supply_register(struct device *parent,
if (rc)
goto register_thermal_failed;
- rc = psy_register_cooler(psy);
- if (rc)
- goto register_cooler_failed;
-
rc = power_supply_create_triggers(psy);
if (rc)
goto create_triggers_failed;
@@ -1221,8 +1127,6 @@ __power_supply_register(struct device *parent,
add_hwmon_sysfs_failed:
power_supply_remove_triggers(psy);
create_triggers_failed:
- psy_unregister_cooler(psy);
-register_cooler_failed:
psy_unregister_thermal(psy);
register_thermal_failed:
wakeup_init_failed:
@@ -1374,7 +1278,6 @@ void power_supply_unregister(struct power_supply *psy)
sysfs_remove_link(&psy->dev.kobj, "powers");
power_supply_remove_hwmon_sysfs(psy);
power_supply_remove_triggers(psy);
- psy_unregister_cooler(psy);
psy_unregister_thermal(psy);
device_init_wakeup(&psy->dev, false);
device_unregister(&psy->dev);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 324/567] RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2023-03-07 17:00 ` [PATCH 5.15 323/567] power: supply: remove faulty cooling logic Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 325/567] usb: max-3421: Fix setting of I/O pins Greg Kroah-Hartman
` (246 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich,
Leon Romanovsky, Sasha Levin
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit 283861a4c52c1ea4df3dd1b6fc75a50796ce3524 ]
If get_ep_from_tid() fails to lookup non-NULL value for ep, ep is
dereferenced later regardless of whether it is empty.
This patch adds a simple sanity check to fix the issue.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://lore.kernel.org/r/20230202184850.29882-1-n.zhandarovich@fintech.ru
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/cxgb4/cm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 56f46a16e6575..a3e4913904b75 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2682,6 +2682,9 @@ static int pass_establish(struct c4iw_dev *dev, struct sk_buff *skb)
u16 tcp_opt = ntohs(req->tcp_opt);
ep = get_ep_from_tid(dev, tid);
+ if (!ep)
+ return 0;
+
pr_debug("ep %p tid %u\n", ep, ep->hwtid);
ep->snd_seq = be32_to_cpu(req->snd_isn);
ep->rcv_seq = be32_to_cpu(req->rcv_isn);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 325/567] usb: max-3421: Fix setting of I/O pins
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 324/567] RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 326/567] RDMA/irdma: Cap MSIX used to online CPUs + 1 Greg Kroah-Hartman
` (245 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mark Tomlinson, Sasha Levin
From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
[ Upstream commit a7efe3fc7cbe27c6eb2c2a3ab612194f8f800f4c ]
To update the I/O pins, the registers are read/modified/written. The
read operation incorrectly always read the first register. Although
wrong, there wasn't any impact as all the output pins are always
written, and the inputs are read only anyway.
Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.")
Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20230207033337.18112-1-mark.tomlinson@alliedtelesis.co.nz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/max3421-hcd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index 30de85a707fef..994dc562b2db0 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1436,7 +1436,7 @@ max3421_spi_thread(void *dev_id)
* use spi_wr_buf().
*/
for (i = 0; i < ARRAY_SIZE(max3421_hcd->iopins); ++i) {
- u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1);
+ u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1 + i);
val = ((val & 0xf0) |
(max3421_hcd->iopins[i] & 0x0f));
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 326/567] RDMA/irdma: Cap MSIX used to online CPUs + 1
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 325/567] usb: max-3421: Fix setting of I/O pins Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 327/567] serial: fsl_lpuart: fix RS485 RTS polariy inverse issue Greg Kroah-Hartman
` (244 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mustafa Ismail, Shiraz Saleem,
Sindhu Devale, Leon Romanovsky, Sasha Levin
From: Mustafa Ismail <mustafa.ismail@intel.com>
[ Upstream commit 9cd9842c46996ef62173c36619c746f57416bcb0 ]
The irdma driver can use a maximum number of msix vectors equal
to num_online_cpus() + 1 and the kernel warning stack below is shown
if that number is exceeded.
The kernel throws a warning as the driver tries to update the affinity
hint with a CPU mask greater than the max CPU IDs. Fix this by capping
the MSIX vectors to num_online_cpus() + 1.
WARNING: CPU: 7 PID: 23655 at include/linux/cpumask.h:106 irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma]
RIP: 0010:irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma]
Call Trace:
irdma_rt_init_hw+0xa62/0x1290 [irdma]
? irdma_alloc_local_mac_entry+0x1a0/0x1a0 [irdma]
? __is_kernel_percpu_address+0x63/0x310
? rcu_read_lock_held_common+0xe/0xb0
? irdma_lan_unregister_qset+0x280/0x280 [irdma]
? irdma_request_reset+0x80/0x80 [irdma]
? ice_get_qos_params+0x84/0x390 [ice]
irdma_probe+0xa40/0xfc0 [irdma]
? rcu_read_lock_bh_held+0xd0/0xd0
? irdma_remove+0x140/0x140 [irdma]
? rcu_read_lock_sched_held+0x62/0xe0
? down_write+0x187/0x3d0
? auxiliary_match_id+0xf0/0x1a0
? irdma_remove+0x140/0x140 [irdma]
auxiliary_bus_probe+0xa6/0x100
__driver_probe_device+0x4a4/0xd50
? __device_attach_driver+0x2c0/0x2c0
driver_probe_device+0x4a/0x110
__driver_attach+0x1aa/0x350
bus_for_each_dev+0x11d/0x1b0
? subsys_dev_iter_init+0xe0/0xe0
bus_add_driver+0x3b1/0x610
driver_register+0x18e/0x410
? 0xffffffffc0b88000
irdma_init_module+0x50/0xaa [irdma]
do_one_initcall+0x103/0x5f0
? perf_trace_initcall_level+0x420/0x420
? do_init_module+0x4e/0x700
? __kasan_kmalloc+0x7d/0xa0
? kmem_cache_alloc_trace+0x188/0x2b0
? kasan_unpoison+0x21/0x50
do_init_module+0x1d1/0x700
load_module+0x3867/0x5260
? layout_and_allocate+0x3990/0x3990
? rcu_read_lock_held_common+0xe/0xb0
? rcu_read_lock_sched_held+0x62/0xe0
? rcu_read_lock_bh_held+0xd0/0xd0
? __vmalloc_node_range+0x46b/0x890
? lock_release+0x5c8/0xba0
? alloc_vm_area+0x120/0x120
? selinux_kernel_module_from_file+0x2a5/0x300
? __inode_security_revalidate+0xf0/0xf0
? __do_sys_init_module+0x1db/0x260
__do_sys_init_module+0x1db/0x260
? load_module+0x5260/0x5260
? do_syscall_64+0x22/0x450
do_syscall_64+0xa5/0x450
entry_SYSCALL_64_after_hwframe+0x66/0xdb
Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions")
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Sindhu Devale <sindhu.devale@intel.com>
Link: https://lore.kernel.org/r/20230207201938.1329-1-sindhu.devale@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/hw.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c
index c14f19cff5343..b918f80d2e2c6 100644
--- a/drivers/infiniband/hw/irdma/hw.c
+++ b/drivers/infiniband/hw/irdma/hw.c
@@ -483,6 +483,8 @@ static enum irdma_status_code irdma_save_msix_info(struct irdma_pci_f *rf)
iw_qvlist->num_vectors = rf->msix_count;
if (rf->msix_count <= num_online_cpus())
rf->msix_shared = true;
+ else if (rf->msix_count > num_online_cpus() + 1)
+ rf->msix_count = num_online_cpus() + 1;
pmsix = rf->msix_entries;
for (i = 0, ceq_idx = 0; i < rf->msix_count; i++, iw_qvinfo++) {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 327/567] serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 326/567] RDMA/irdma: Cap MSIX used to online CPUs + 1 Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 328/567] tty: serial: imx: Handle RS485 DE signal active high Greg Kroah-Hartman
` (243 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sherry Sun, Shenwei Wang, Sasha Levin
From: Shenwei Wang <shenwei.wang@nxp.com>
[ Upstream commit 3957b9501a5a8fa709ae4a47483714491471f6db ]
The previous 'commit 846651eca073 ("serial: fsl_lpuart: RS485 RTS
polariy is inverse")' only fixed the inverse issue on lpuart 8bit
platforms.
This is a follow-up patch to fix the RS485 polarity inverse
issue on lpuart 32bit platforms.
Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485")
Reported-by: Sherry Sun <sherry.sun@nxp.com>
Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
Link: https://lore.kernel.org/r/20230207162420.3647904-1-shenwei.wang@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/fsl_lpuart.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 08096d33af8a6..f4d9dc4648da4 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1406,9 +1406,9 @@ static int lpuart32_config_rs485(struct uart_port *port,
* Note: UART is assumed to be active high.
*/
if (rs485->flags & SER_RS485_RTS_ON_SEND)
- modem &= ~UARTMODEM_TXRTSPOL;
- else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
modem |= UARTMODEM_TXRTSPOL;
+ else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
+ modem &= ~UARTMODEM_TXRTSPOL;
}
/* Store the new configuration */
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 328/567] tty: serial: imx: Handle RS485 DE signal active high
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 327/567] serial: fsl_lpuart: fix RS485 RTS polariy inverse issue Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 329/567] tty: serial: imx: disable Ageing Timer interrupt request irq Greg Kroah-Hartman
` (242 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Niedermaier,
Fabio Estevam, Marek Vasut, Sasha Levin
From: Marek Vasut <marex@denx.de>
[ Upstream commit 79d0224f6bf296d04cd843cfc49921b19c97bb09 ]
The default polarity of RS485 DE signal is active high. This driver does
not handle such case properly. Currently, when a pin is multiplexed as a
UART CTS_B on boot, this pin is pulled HIGH by the i.MX UART CTS circuit,
which activates DE signal on the RS485 transceiver and thus behave as if
the RS485 was transmitting data, so the system blocks the RS485 bus when
it starts and until user application takes over. This behavior is not OK.
The problem consists of two separate parts.
First, the i.MX UART IP requires UCR1 UARTEN and UCR2 RXEN to be set for
UCR2 CTSC and CTS bits to have any effect. The UCR2 CTSC bit permits the
driver to set CTS (RTS_B or RS485 DE signal) to either level sychronous
to the internal UART IP clock. Compared to other options, like GPIO CTS
control, this has the benefit of being synchronous to the UART IP clock
and thus without glitches or bus delays. The reason for the CTS design
is likely because when the Receiver is disabled, the UART IP can never
indicate that it is ready to receive data by assering CTS signal, so
the CTS is always pulled HIGH by default.
When the port is closed by user space, imx_uart_stop_rx() clears UCR2
RXEN bit, and imx_uart_shutdown() clears UCR1 UARTEN bit. This disables
UART Receiver and UART itself, and forces CTS signal HIGH, which leads
to the RS485 bus being blocked because RS485 DE is incorrectly active.
The proposed solution for this problem is to keep the Receiver running
even after the port is closed, but in loopback mode. This disconnects
the RX FIFO input from the RXD external signal, and since UCR2 TXEN is
cleared, the UART Transmitter is disabled, so nothing can feed data in
the RX FIFO. Because the Receiver is still enabled, the UCR2 CTSC and
CTS bits still have effect and the CTS (RS485 DE) control is retained.
Note that in case of RS485 DE signal active low, there is no problem and
no special handling is necessary. The CTS signal defaults to HIGH, thus
the RS485 is by default set to Receive and the bus is not blocked.
Note that while there is the possibility to control CTS using GPIO with
either CTS polarity, this has the downside of not being synchronous to
the UART IP clock and thus glitchy and susceptible to slow DE switching.
Second, on boot, before the UART driver probe callback is called, the
driver core triggers pinctrl_init_done() and configures the IOMUXC to
default state. At this point, UCR1 UARTEN and UCR2 RXEN are both still
cleared, but UART CTS_B (RS485 DE) is configured as CTS function, thus
the RTS signal is pulled HIGH by the UART IP CTS circuit.
One part of the solution here is to enable UCR1 UARTEN and UCR2 RXEN and
UTS loopback in this driver probe callback, thus unblocking the CTSC and
CTS control early on. But this is still too late, since the pin control
is already configured and CTS has been pulled HIGH for a short period
of time.
When Linux kernel boots and this driver is bound, the pin control is set
to special "init" state if the state is available, and driver can switch
the "default" state afterward when ready. This state can be used to set
the CTS line as a GPIO in DT temporarily, and a GPIO hog can force such
GPIO to LOW, thus keeping the RS485 DE line LOW early on boot. Once the
driver takes over and UCR1 UARTEN and UCR2 RXEN and UTS loopback are all
enabled, the driver can switch to "default" pin control state and control
the CTS line as function instead. DT binding example is below:
"
&gpio6 {
rts-init-hog {
gpio-hog;
gpios = <5 0>;
output-low;
line-name = "rs485-de";
};
};
&uart5 { /* DHCOM UART2 */
pinctrl-0 = <&pinctrl_uart5>;
pinctrl-1 = <&pinctrl_uart5_init>;
pinctrl-names = "default", "init";
...
};
pinctrl_uart5_init: uart5-init-grp {
fsl,pins = <
...
MX6QDL_PAD_CSI0_DAT19__GPIO6_IO05 0x30b1
>;
};
pinctrl_uart5: uart5-grp {
fsl,pins = <
...
MX6QDL_PAD_CSI0_DAT19__UART5_CTS_B 0x30b1
>;
};
"
Tested-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Reviewed-by: Fabio Estevam <festevam@denx.de>
Signed-off-by: Marek Vasut <marex@denx.de>
Link: https://lore.kernel.org/r/20220929144400.13571-1-marex@denx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: ef25e16ea967 ("tty: serial: imx: disable Ageing Timer interrupt request irq")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/imx.c | 64 ++++++++++++++++++++++++++++++++++++----
1 file changed, 58 insertions(+), 6 deletions(-)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 711edb835c274..136da4bebe85a 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -484,7 +484,7 @@ static void imx_uart_stop_tx(struct uart_port *port)
static void imx_uart_stop_rx(struct uart_port *port)
{
struct imx_port *sport = (struct imx_port *)port;
- u32 ucr1, ucr2, ucr4;
+ u32 ucr1, ucr2, ucr4, uts;
ucr1 = imx_uart_readl(sport, UCR1);
ucr2 = imx_uart_readl(sport, UCR2);
@@ -500,7 +500,18 @@ static void imx_uart_stop_rx(struct uart_port *port)
imx_uart_writel(sport, ucr1, UCR1);
imx_uart_writel(sport, ucr4, UCR4);
- ucr2 &= ~UCR2_RXEN;
+ /* See SER_RS485_ENABLED/UTS_LOOP comment in imx_uart_probe() */
+ if (port->rs485.flags & SER_RS485_ENABLED &&
+ port->rs485.flags & SER_RS485_RTS_ON_SEND &&
+ sport->have_rtscts && !sport->have_rtsgpio) {
+ uts = imx_uart_readl(sport, imx_uart_uts_reg(sport));
+ uts |= UTS_LOOP;
+ imx_uart_writel(sport, uts, imx_uart_uts_reg(sport));
+ ucr2 |= UCR2_RXEN;
+ } else {
+ ucr2 &= ~UCR2_RXEN;
+ }
+
imx_uart_writel(sport, ucr2, UCR2);
}
@@ -1383,7 +1394,7 @@ static int imx_uart_startup(struct uart_port *port)
int retval, i;
unsigned long flags;
int dma_is_inited = 0;
- u32 ucr1, ucr2, ucr3, ucr4;
+ u32 ucr1, ucr2, ucr3, ucr4, uts;
retval = clk_prepare_enable(sport->clk_per);
if (retval)
@@ -1488,6 +1499,11 @@ static int imx_uart_startup(struct uart_port *port)
imx_uart_writel(sport, ucr2, UCR2);
}
+ /* See SER_RS485_ENABLED/UTS_LOOP comment in imx_uart_probe() */
+ uts = imx_uart_readl(sport, imx_uart_uts_reg(sport));
+ uts &= ~UTS_LOOP;
+ imx_uart_writel(sport, uts, imx_uart_uts_reg(sport));
+
spin_unlock_irqrestore(&sport->port.lock, flags);
return 0;
@@ -1497,7 +1513,7 @@ static void imx_uart_shutdown(struct uart_port *port)
{
struct imx_port *sport = (struct imx_port *)port;
unsigned long flags;
- u32 ucr1, ucr2, ucr4;
+ u32 ucr1, ucr2, ucr4, uts;
if (sport->dma_is_enabled) {
dmaengine_terminate_sync(sport->dma_chan_tx);
@@ -1541,7 +1557,18 @@ static void imx_uart_shutdown(struct uart_port *port)
spin_lock_irqsave(&sport->port.lock, flags);
ucr1 = imx_uart_readl(sport, UCR1);
- ucr1 &= ~(UCR1_TRDYEN | UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN | UCR1_RXDMAEN | UCR1_ATDMAEN);
+ ucr1 &= ~(UCR1_TRDYEN | UCR1_RRDYEN | UCR1_RTSDEN | UCR1_RXDMAEN | UCR1_ATDMAEN);
+ /* See SER_RS485_ENABLED/UTS_LOOP comment in imx_uart_probe() */
+ if (port->rs485.flags & SER_RS485_ENABLED &&
+ port->rs485.flags & SER_RS485_RTS_ON_SEND &&
+ sport->have_rtscts && !sport->have_rtsgpio) {
+ uts = imx_uart_readl(sport, imx_uart_uts_reg(sport));
+ uts |= UTS_LOOP;
+ imx_uart_writel(sport, uts, imx_uart_uts_reg(sport));
+ ucr1 |= UCR1_UARTEN;
+ } else {
+ ucr1 &= ~UCR1_UARTEN;
+ }
imx_uart_writel(sport, ucr1, UCR1);
ucr4 = imx_uart_readl(sport, UCR4);
@@ -2189,7 +2216,7 @@ static int imx_uart_probe(struct platform_device *pdev)
void __iomem *base;
u32 dma_buf_conf[2];
int ret = 0;
- u32 ucr1;
+ u32 ucr1, ucr2, uts;
struct resource *res;
int txirq, rxirq, rtsirq;
@@ -2321,6 +2348,31 @@ static int imx_uart_probe(struct platform_device *pdev)
ucr1 &= ~(UCR1_ADEN | UCR1_TRDYEN | UCR1_IDEN | UCR1_RRDYEN | UCR1_RTSDEN);
imx_uart_writel(sport, ucr1, UCR1);
+ /*
+ * In case RS485 is enabled without GPIO RTS control, the UART IP
+ * is used to control CTS signal. Keep both the UART and Receiver
+ * enabled, otherwise the UART IP pulls CTS signal always HIGH no
+ * matter how the UCR2 CTSC and CTS bits are set. To prevent any
+ * data from being fed into the RX FIFO, enable loopback mode in
+ * UTS register, which disconnects the RX path from external RXD
+ * pin and connects it to the Transceiver, which is disabled, so
+ * no data can be fed to the RX FIFO that way.
+ */
+ if (sport->port.rs485.flags & SER_RS485_ENABLED &&
+ sport->have_rtscts && !sport->have_rtsgpio) {
+ uts = imx_uart_readl(sport, imx_uart_uts_reg(sport));
+ uts |= UTS_LOOP;
+ imx_uart_writel(sport, uts, imx_uart_uts_reg(sport));
+
+ ucr1 = imx_uart_readl(sport, UCR1);
+ ucr1 |= UCR1_UARTEN;
+ imx_uart_writel(sport, ucr1, UCR1);
+
+ ucr2 = imx_uart_readl(sport, UCR2);
+ ucr2 |= UCR2_RXEN;
+ imx_uart_writel(sport, ucr2, UCR2);
+ }
+
if (!imx_uart_is_imx1(sport) && sport->dte_mode) {
/*
* The DCEDTE bit changes the direction of DSR, DCD, DTR and RI
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 329/567] tty: serial: imx: disable Ageing Timer interrupt request irq
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 328/567] tty: serial: imx: Handle RS485 DE signal active high Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 330/567] driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links Greg Kroah-Hartman
` (241 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sherry Sun, Peng Fan, Jason Liu,
Sasha Levin
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit ef25e16ea9674b713a68c3bda821556ce9901254 ]
There maybe pending USR interrupt before requesting irq, however
uart_add_one_port has not executed, so there will be kernel panic:
[ 0.795668] Unable to handle kernel NULL pointer dereference at virtual addre
ss 0000000000000080
[ 0.802701] Mem abort info:
[ 0.805367] ESR = 0x0000000096000004
[ 0.808950] EC = 0x25: DABT (current EL), IL = 32 bits
[ 0.814033] SET = 0, FnV = 0
[ 0.816950] EA = 0, S1PTW = 0
[ 0.819950] FSC = 0x04: level 0 translation fault
[ 0.824617] Data abort info:
[ 0.827367] ISV = 0, ISS = 0x00000004
[ 0.831033] CM = 0, WnR = 0
[ 0.833866] [0000000000000080] user address but active_mm is swapper
[ 0.839951] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[ 0.845953] Modules linked in:
[ 0.848869] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.1+g56321e101aca #1
[ 0.855617] Hardware name: Freescale i.MX8MP EVK (DT)
[ 0.860452] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 0.867117] pc : __imx_uart_rxint.constprop.0+0x11c/0x2c0
[ 0.872283] lr : imx_uart_int+0xf8/0x1ec
The issue only happends in the inmate linux when Jailhouse hypervisor
enabled. The test procedure is:
while true; do
jailhouse enable imx8mp.cell
jailhouse cell linux xxxx
sleep 10
jailhouse cell destroy 1
jailhouse disable
sleep 5
done
And during the upper test, press keys to the 2nd linux console.
When `jailhouse cell destroy 1`, the 2nd linux has no chance to put
the uart to a quiese state, so USR1/2 may has pending interrupts. Then
when `jailhosue cell linux xx` to start 2nd linux again, the issue
trigger.
In order to disable irqs before requesting them, both UCR1 and UCR2 irqs
should be disabled, so here fix that, disable the Ageing Timer interrupt
in UCR2 as UCR1 does.
Fixes: 8a61f0c70ae6 ("serial: imx: Disable irqs before requesting them")
Suggested-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Sherry Sun <sherry.sun@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Jason Liu <jason.hui.liu@nxp.com>
Link: https://lore.kernel.org/r/20230206013016.29352-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/imx.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 136da4bebe85a..77a4f4af3b8d5 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2348,6 +2348,11 @@ static int imx_uart_probe(struct platform_device *pdev)
ucr1 &= ~(UCR1_ADEN | UCR1_TRDYEN | UCR1_IDEN | UCR1_RRDYEN | UCR1_RTSDEN);
imx_uart_writel(sport, ucr1, UCR1);
+ /* Disable Ageing Timer interrupt */
+ ucr2 = imx_uart_readl(sport, UCR2);
+ ucr2 &= ~UCR2_ATEN;
+ imx_uart_writel(sport, ucr2, UCR2);
+
/*
* In case RS485 is enabled without GPIO RTS control, the UART IP
* is used to control CTS signal. Keep both the UART and Receiver
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 330/567] driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 329/567] tty: serial: imx: disable Ageing Timer interrupt request irq Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 19:09 ` Saravana Kannan
2023-03-07 17:01 ` [PATCH 5.15 331/567] dmaengine: dw-edma: Fix readq_ch() return value truncation Greg Kroah-Hartman
` (240 subsequent siblings)
570 siblings, 1 reply; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saravana Kannan, Colin Foster,
Sudeep Holla, Douglas Anderson, Geert Uytterhoeven, Sasha Levin,
Luca Weiss
From: Saravana Kannan <saravanak@google.com>
[ Upstream commit 67cad5c67019c38126b749621665b6723d3ae7e6 ]
fw_devlink uses DL_FLAG_SYNC_STATE_ONLY device link flag for two
purposes:
1. To allow a parent device to proxy its child device's dependency on a
supplier so that the supplier doesn't get its sync_state() callback
before the child device/consumer can be added and probed. In this
usage scenario, we need to ignore cycles for ensure correctness of
sync_state() callbacks.
2. When there are dependency cycles in firmware, we don't know which of
those dependencies are valid. So, we have to ignore them all wrt
probe ordering while still making sure the sync_state() callbacks
come correctly.
However, when detecting dependency cycles, there can be multiple
dependency cycles between two devices that we need to detect. For
example:
A -> B -> A and A -> C -> B -> A.
To detect multiple cycles correct, we need to be able to differentiate
DL_FLAG_SYNC_STATE_ONLY device links used for (1) vs (2) above.
To allow this differentiation, add a DL_FLAG_CYCLE that can be use to
mark use case (2). We can then use the DL_FLAG_CYCLE to decide which
DL_FLAG_SYNC_STATE_ONLY device links to follow when looking for
dependency cycles.
Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies")
Signed-off-by: Saravana Kannan <saravanak@google.com>
Tested-by: Colin Foster <colin.foster@in-advantage.com>
Tested-by: Sudeep Holla <sudeep.holla@arm.com>
Tested-by: Douglas Anderson <dianders@chromium.org>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcom/sm7225-fairphone-fp4
Link: https://lore.kernel.org/r/20230207014207.1678715-6-saravanak@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/core.c | 28 ++++++++++++++++++----------
include/linux/device.h | 1 +
2 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index adf003a7e8d6a..178a21e985197 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -269,6 +269,12 @@ static bool device_is_ancestor(struct device *dev, struct device *target)
return false;
}
+static inline bool device_link_flag_is_sync_state_only(u32 flags)
+{
+ return (flags & ~(DL_FLAG_INFERRED | DL_FLAG_CYCLE)) ==
+ (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED);
+}
+
/**
* device_is_dependent - Check if one device depends on another one
* @dev: Device to check dependencies for.
@@ -295,8 +301,7 @@ int device_is_dependent(struct device *dev, void *target)
return ret;
list_for_each_entry(link, &dev->links.consumers, s_node) {
- if ((link->flags & ~DL_FLAG_INFERRED) ==
- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED))
+ if (device_link_flag_is_sync_state_only(link->flags))
continue;
if (link->consumer == target)
@@ -369,8 +374,7 @@ static int device_reorder_to_tail(struct device *dev, void *not_used)
device_for_each_child(dev, NULL, device_reorder_to_tail);
list_for_each_entry(link, &dev->links.consumers, s_node) {
- if ((link->flags & ~DL_FLAG_INFERRED) ==
- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED))
+ if (device_link_flag_is_sync_state_only(link->flags))
continue;
device_reorder_to_tail(link->consumer, NULL);
}
@@ -621,7 +625,8 @@ postcore_initcall(devlink_class_init);
DL_FLAG_AUTOREMOVE_SUPPLIER | \
DL_FLAG_AUTOPROBE_CONSUMER | \
DL_FLAG_SYNC_STATE_ONLY | \
- DL_FLAG_INFERRED)
+ DL_FLAG_INFERRED | \
+ DL_FLAG_CYCLE)
#define DL_ADD_VALID_FLAGS (DL_MANAGED_LINK_FLAGS | DL_FLAG_STATELESS | \
DL_FLAG_PM_RUNTIME | DL_FLAG_RPM_ACTIVE)
@@ -690,8 +695,6 @@ struct device_link *device_link_add(struct device *consumer,
if (!consumer || !supplier || consumer == supplier ||
flags & ~DL_ADD_VALID_FLAGS ||
(flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) ||
- (flags & DL_FLAG_SYNC_STATE_ONLY &&
- (flags & ~DL_FLAG_INFERRED) != DL_FLAG_SYNC_STATE_ONLY) ||
(flags & DL_FLAG_AUTOPROBE_CONSUMER &&
flags & (DL_FLAG_AUTOREMOVE_CONSUMER |
DL_FLAG_AUTOREMOVE_SUPPLIER)))
@@ -707,6 +710,10 @@ struct device_link *device_link_add(struct device *consumer,
if (!(flags & DL_FLAG_STATELESS))
flags |= DL_FLAG_MANAGED;
+ if (flags & DL_FLAG_SYNC_STATE_ONLY &&
+ !device_link_flag_is_sync_state_only(flags))
+ return NULL;
+
device_links_write_lock();
device_pm_lock();
@@ -1627,7 +1634,7 @@ static void fw_devlink_relax_link(struct device_link *link)
if (!(link->flags & DL_FLAG_INFERRED))
return;
- if (link->flags == (DL_FLAG_MANAGED | FW_DEVLINK_FLAGS_PERMISSIVE))
+ if (device_link_flag_is_sync_state_only(link->flags))
return;
pm_runtime_drop_link(link);
@@ -1695,8 +1702,8 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup)
return ret;
list_for_each_entry(link, &con->links.consumers, s_node) {
- if ((link->flags & ~DL_FLAG_INFERRED) ==
- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED))
+ if (!(link->flags & DL_FLAG_CYCLE) &&
+ device_link_flag_is_sync_state_only(link->flags))
continue;
if (!fw_devlink_relax_cycle(link->consumer, sup))
@@ -1705,6 +1712,7 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup)
ret = 1;
fw_devlink_relax_link(link);
+ link->flags |= DL_FLAG_CYCLE;
}
return ret;
}
diff --git a/include/linux/device.h b/include/linux/device.h
index e270cb740b9e7..636ef7caa021d 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -326,6 +326,7 @@ enum device_link_state {
#define DL_FLAG_MANAGED BIT(6)
#define DL_FLAG_SYNC_STATE_ONLY BIT(7)
#define DL_FLAG_INFERRED BIT(8)
+#define DL_FLAG_CYCLE BIT(9)
/**
* enum dl_dev_state - Device driver presence tracking information.
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* Re: [PATCH 5.15 330/567] driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
2023-03-07 17:01 ` [PATCH 5.15 330/567] driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links Greg Kroah-Hartman
@ 2023-03-07 19:09 ` Saravana Kannan
2023-03-08 7:13 ` Greg Kroah-Hartman
0 siblings, 1 reply; 578+ messages in thread
From: Saravana Kannan @ 2023-03-07 19:09 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Colin Foster, Sudeep Holla, Douglas Anderson,
Geert Uytterhoeven, Sasha Levin, Luca Weiss
On Tue, Mar 7, 2023 at 11:02 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> From: Saravana Kannan <saravanak@google.com>
>
> [ Upstream commit 67cad5c67019c38126b749621665b6723d3ae7e6 ]
>
> fw_devlink uses DL_FLAG_SYNC_STATE_ONLY device link flag for two
> purposes:
>
> 1. To allow a parent device to proxy its child device's dependency on a
> supplier so that the supplier doesn't get its sync_state() callback
> before the child device/consumer can be added and probed. In this
> usage scenario, we need to ignore cycles for ensure correctness of
> sync_state() callbacks.
>
> 2. When there are dependency cycles in firmware, we don't know which of
> those dependencies are valid. So, we have to ignore them all wrt
> probe ordering while still making sure the sync_state() callbacks
> come correctly.
>
> However, when detecting dependency cycles, there can be multiple
> dependency cycles between two devices that we need to detect. For
> example:
>
> A -> B -> A and A -> C -> B -> A.
>
> To detect multiple cycles correct, we need to be able to differentiate
> DL_FLAG_SYNC_STATE_ONLY device links used for (1) vs (2) above.
>
> To allow this differentiation, add a DL_FLAG_CYCLE that can be use to
> mark use case (2). We can then use the DL_FLAG_CYCLE to decide which
> DL_FLAG_SYNC_STATE_ONLY device links to follow when looking for
> dependency cycles.
>
> Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies")
> Signed-off-by: Saravana Kannan <saravanak@google.com>
> Tested-by: Colin Foster <colin.foster@in-advantage.com>
> Tested-by: Sudeep Holla <sudeep.holla@arm.com>
> Tested-by: Douglas Anderson <dianders@chromium.org>
> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
> Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcom/sm7225-fairphone-fp4
> Link: https://lore.kernel.org/r/20230207014207.1678715-6-saravanak@google.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
These fw_devlink patches weren't tested with 5.15. It's also an
extensive refactor. So I'm a little worried if it'll be finicky and
break things in a kernel that's a year old.
Unless someone specifically wants these patches in 5.15, I'd prefer we
don't pick it up in 5.15.
-Saravana
> drivers/base/core.c | 28 ++++++++++++++++++----------
> include/linux/device.h | 1 +
> 2 files changed, 19 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/base/core.c b/drivers/base/core.c
> index adf003a7e8d6a..178a21e985197 100644
> --- a/drivers/base/core.c
> +++ b/drivers/base/core.c
> @@ -269,6 +269,12 @@ static bool device_is_ancestor(struct device *dev, struct device *target)
> return false;
> }
>
> +static inline bool device_link_flag_is_sync_state_only(u32 flags)
> +{
> + return (flags & ~(DL_FLAG_INFERRED | DL_FLAG_CYCLE)) ==
> + (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED);
> +}
> +
> /**
> * device_is_dependent - Check if one device depends on another one
> * @dev: Device to check dependencies for.
> @@ -295,8 +301,7 @@ int device_is_dependent(struct device *dev, void *target)
> return ret;
>
> list_for_each_entry(link, &dev->links.consumers, s_node) {
> - if ((link->flags & ~DL_FLAG_INFERRED) ==
> - (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED))
> + if (device_link_flag_is_sync_state_only(link->flags))
> continue;
>
> if (link->consumer == target)
> @@ -369,8 +374,7 @@ static int device_reorder_to_tail(struct device *dev, void *not_used)
>
> device_for_each_child(dev, NULL, device_reorder_to_tail);
> list_for_each_entry(link, &dev->links.consumers, s_node) {
> - if ((link->flags & ~DL_FLAG_INFERRED) ==
> - (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED))
> + if (device_link_flag_is_sync_state_only(link->flags))
> continue;
> device_reorder_to_tail(link->consumer, NULL);
> }
> @@ -621,7 +625,8 @@ postcore_initcall(devlink_class_init);
> DL_FLAG_AUTOREMOVE_SUPPLIER | \
> DL_FLAG_AUTOPROBE_CONSUMER | \
> DL_FLAG_SYNC_STATE_ONLY | \
> - DL_FLAG_INFERRED)
> + DL_FLAG_INFERRED | \
> + DL_FLAG_CYCLE)
>
> #define DL_ADD_VALID_FLAGS (DL_MANAGED_LINK_FLAGS | DL_FLAG_STATELESS | \
> DL_FLAG_PM_RUNTIME | DL_FLAG_RPM_ACTIVE)
> @@ -690,8 +695,6 @@ struct device_link *device_link_add(struct device *consumer,
> if (!consumer || !supplier || consumer == supplier ||
> flags & ~DL_ADD_VALID_FLAGS ||
> (flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) ||
> - (flags & DL_FLAG_SYNC_STATE_ONLY &&
> - (flags & ~DL_FLAG_INFERRED) != DL_FLAG_SYNC_STATE_ONLY) ||
> (flags & DL_FLAG_AUTOPROBE_CONSUMER &&
> flags & (DL_FLAG_AUTOREMOVE_CONSUMER |
> DL_FLAG_AUTOREMOVE_SUPPLIER)))
> @@ -707,6 +710,10 @@ struct device_link *device_link_add(struct device *consumer,
> if (!(flags & DL_FLAG_STATELESS))
> flags |= DL_FLAG_MANAGED;
>
> + if (flags & DL_FLAG_SYNC_STATE_ONLY &&
> + !device_link_flag_is_sync_state_only(flags))
> + return NULL;
> +
> device_links_write_lock();
> device_pm_lock();
>
> @@ -1627,7 +1634,7 @@ static void fw_devlink_relax_link(struct device_link *link)
> if (!(link->flags & DL_FLAG_INFERRED))
> return;
>
> - if (link->flags == (DL_FLAG_MANAGED | FW_DEVLINK_FLAGS_PERMISSIVE))
> + if (device_link_flag_is_sync_state_only(link->flags))
> return;
>
> pm_runtime_drop_link(link);
> @@ -1695,8 +1702,8 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup)
> return ret;
>
> list_for_each_entry(link, &con->links.consumers, s_node) {
> - if ((link->flags & ~DL_FLAG_INFERRED) ==
> - (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED))
> + if (!(link->flags & DL_FLAG_CYCLE) &&
> + device_link_flag_is_sync_state_only(link->flags))
> continue;
>
> if (!fw_devlink_relax_cycle(link->consumer, sup))
> @@ -1705,6 +1712,7 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup)
> ret = 1;
>
> fw_devlink_relax_link(link);
> + link->flags |= DL_FLAG_CYCLE;
> }
> return ret;
> }
> diff --git a/include/linux/device.h b/include/linux/device.h
> index e270cb740b9e7..636ef7caa021d 100644
> --- a/include/linux/device.h
> +++ b/include/linux/device.h
> @@ -326,6 +326,7 @@ enum device_link_state {
> #define DL_FLAG_MANAGED BIT(6)
> #define DL_FLAG_SYNC_STATE_ONLY BIT(7)
> #define DL_FLAG_INFERRED BIT(8)
> +#define DL_FLAG_CYCLE BIT(9)
>
> /**
> * enum dl_dev_state - Device driver presence tracking information.
> --
> 2.39.2
>
>
>
^ permalink raw reply [flat|nested] 578+ messages in thread* Re: [PATCH 5.15 330/567] driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
2023-03-07 19:09 ` Saravana Kannan
@ 2023-03-08 7:13 ` Greg Kroah-Hartman
0 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-08 7:13 UTC (permalink / raw)
To: Saravana Kannan
Cc: stable, patches, Colin Foster, Sudeep Holla, Douglas Anderson,
Geert Uytterhoeven, Sasha Levin, Luca Weiss
On Tue, Mar 07, 2023 at 11:09:01AM -0800, Saravana Kannan wrote:
> On Tue, Mar 7, 2023 at 11:02 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > From: Saravana Kannan <saravanak@google.com>
> >
> > [ Upstream commit 67cad5c67019c38126b749621665b6723d3ae7e6 ]
> >
> > fw_devlink uses DL_FLAG_SYNC_STATE_ONLY device link flag for two
> > purposes:
> >
> > 1. To allow a parent device to proxy its child device's dependency on a
> > supplier so that the supplier doesn't get its sync_state() callback
> > before the child device/consumer can be added and probed. In this
> > usage scenario, we need to ignore cycles for ensure correctness of
> > sync_state() callbacks.
> >
> > 2. When there are dependency cycles in firmware, we don't know which of
> > those dependencies are valid. So, we have to ignore them all wrt
> > probe ordering while still making sure the sync_state() callbacks
> > come correctly.
> >
> > However, when detecting dependency cycles, there can be multiple
> > dependency cycles between two devices that we need to detect. For
> > example:
> >
> > A -> B -> A and A -> C -> B -> A.
> >
> > To detect multiple cycles correct, we need to be able to differentiate
> > DL_FLAG_SYNC_STATE_ONLY device links used for (1) vs (2) above.
> >
> > To allow this differentiation, add a DL_FLAG_CYCLE that can be use to
> > mark use case (2). We can then use the DL_FLAG_CYCLE to decide which
> > DL_FLAG_SYNC_STATE_ONLY device links to follow when looking for
> > dependency cycles.
> >
> > Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies")
> > Signed-off-by: Saravana Kannan <saravanak@google.com>
> > Tested-by: Colin Foster <colin.foster@in-advantage.com>
> > Tested-by: Sudeep Holla <sudeep.holla@arm.com>
> > Tested-by: Douglas Anderson <dianders@chromium.org>
> > Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
> > Tested-by: Luca Weiss <luca.weiss@fairphone.com> # qcom/sm7225-fairphone-fp4
> > Link: https://lore.kernel.org/r/20230207014207.1678715-6-saravanak@google.com
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
>
> These fw_devlink patches weren't tested with 5.15. It's also an
> extensive refactor. So I'm a little worried if it'll be finicky and
> break things in a kernel that's a year old.
>
> Unless someone specifically wants these patches in 5.15, I'd prefer we
> don't pick it up in 5.15.
Good point, I'll go drop this from the 5.15.y queue.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 578+ messages in thread
* [PATCH 5.15 331/567] dmaengine: dw-edma: Fix readq_ch() return value truncation
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 330/567] driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 332/567] phy: rockchip-typec: fix tcphy_get_mode error case Greg Kroah-Hartman
` (239 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serge Semin, Bjorn Helgaas, Sasha Levin
From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
[ Upstream commit 5fdca4a995bcd4cf61bda40af154a730589dc524 ]
Previously, readq_ch() did a 64-bit readq(), but truncated the result by
storing it in the u32 "value". Change "value" to u64 to avoid the
truncation.
Note: the method is currently unused, so the bug hasn't caused any problem
so far.
Fixes: 04e0a39fc10f ("dmaengine: dw-edma: Add writeq() and readq() for 64 bits architectures")
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-edma/dw-edma-v0-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c
index b5b8f8181e776..043a4f3115fa3 100644
--- a/drivers/dma/dw-edma/dw-edma-v0-core.c
+++ b/drivers/dma/dw-edma/dw-edma-v0-core.c
@@ -192,7 +192,7 @@ static inline void writeq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch,
static inline u64 readq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch,
const void __iomem *addr)
{
- u32 value;
+ u64 value;
if (dw->mf == EDMA_MF_EDMA_LEGACY) {
u32 viewport_sel;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 332/567] phy: rockchip-typec: fix tcphy_get_mode error case
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 331/567] dmaengine: dw-edma: Fix readq_ch() return value truncation Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 333/567] iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() Greg Kroah-Hartman
` (238 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neill Kapron, Lee Jones, Vinod Koul,
Sasha Levin
From: Neill Kapron <nkapron@google.com>
[ Upstream commit 4ca651df07183e29cdad7272255e23aec0169a1b ]
The existing logic in tcphy_get_mode() can cause the phy to be
incorrectly configured to USB UFP or DisplayPort mode when
extcon_get_state returns an error code.
extcon_get_state() can return 0, 1, or a negative error code.
It is possible to get into the failing state with an extcon driver
which does not support the extcon connector id specified as the
second argument to extcon_get_state().
tcphy_get_mode()
->extcon_get_state()
-->find_cable_index_by_id()
--->return -EINVAL;
Fixes: e96be45cb84e ("phy: Add USB Type-C PHY driver for rk3399")
Signed-off-by: Neill Kapron <nkapron@google.com>
Reviewed-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/20230126001013.3707873-1-nkapron@google.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-typec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c
index d2bbdc96a1672..5b9a254c45524 100644
--- a/drivers/phy/rockchip/phy-rockchip-typec.c
+++ b/drivers/phy/rockchip/phy-rockchip-typec.c
@@ -821,10 +821,10 @@ static int tcphy_get_mode(struct rockchip_typec_phy *tcphy)
mode = MODE_DFP_USB;
id = EXTCON_USB_HOST;
- if (ufp) {
+ if (ufp > 0) {
mode = MODE_UFP_USB;
id = EXTCON_USB;
- } else if (dp) {
+ } else if (dp > 0) {
mode = MODE_DFP_DP;
id = EXTCON_DISP_DP;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 333/567] iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 332/567] phy: rockchip-typec: fix tcphy_get_mode error case Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 334/567] iommu: Fix error unwind in iommu_group_alloc() Greg Kroah-Hartman
` (237 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Leon Romanovsky, Sasha Levin
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit 4ca446b127c568b59cb8d9748b6f70499624bb18 ]
This condition needs to match the previous "if (epcp->state == LISTEN) {"
exactly to avoid a NULL dereference of either "listen_ep" or "ep". The
problem is that "epcp" has been re-assigned so just testing
"if (epcp->state == LISTEN) {" a second time is not sufficient.
Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://lore.kernel.org/r/Y+usKuWIKr4dimZh@kili
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/cxgb4/restrack.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/cxgb4/restrack.c b/drivers/infiniband/hw/cxgb4/restrack.c
index ff645b955a082..fd22c85d35f4f 100644
--- a/drivers/infiniband/hw/cxgb4/restrack.c
+++ b/drivers/infiniband/hw/cxgb4/restrack.c
@@ -238,7 +238,7 @@ int c4iw_fill_res_cm_id_entry(struct sk_buff *msg,
if (rdma_nl_put_driver_u64_hex(msg, "history", epcp->history))
goto err_cancel_table;
- if (epcp->state == LISTEN) {
+ if (listen_ep) {
if (rdma_nl_put_driver_u32(msg, "stid", listen_ep->stid))
goto err_cancel_table;
if (rdma_nl_put_driver_u32(msg, "backlog", listen_ep->backlog))
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 334/567] iommu: Fix error unwind in iommu_group_alloc()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 333/567] iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 335/567] dmaengine: sf-pdma: pdma_desc memory leak fix Greg Kroah-Hartman
` (236 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Lu Baolu,
Joerg Roedel, Sasha Levin
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 4daa861174d56023c2068ddb03de0752f07fa199 ]
If either iommu_group_grate_file() fails then the
iommu_group is leaked.
Destroy it on these error paths.
Found by kselftest/iommu/iommufd_fail_nth
Fixes: bc7d12b91bd3 ("iommu: Implement reserved_regions iommu-group sysfs file")
Fixes: c52c72d3dee8 ("iommu: Add sysfs attribyte for domain type")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/0-v1-8f616bee028d+8b-iommu_group_alloc_leak_jgg@nvidia.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/iommu.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 7f409e9eea4b7..d06dbf035c7c7 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -656,12 +656,16 @@ struct iommu_group *iommu_group_alloc(void)
ret = iommu_group_create_file(group,
&iommu_group_attr_reserved_regions);
- if (ret)
+ if (ret) {
+ kobject_put(group->devices_kobj);
return ERR_PTR(ret);
+ }
ret = iommu_group_create_file(group, &iommu_group_attr_type);
- if (ret)
+ if (ret) {
+ kobject_put(group->devices_kobj);
return ERR_PTR(ret);
+ }
pr_debug("Allocated group %d\n", group->id);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 335/567] dmaengine: sf-pdma: pdma_desc memory leak fix
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 334/567] iommu: Fix error unwind in iommu_group_alloc() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 336/567] dmaengine: dw-axi-dmac: Do not dereference NULL structure Greg Kroah-Hartman
` (235 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shravan Chippa, Conor Dooley,
Vinod Koul, Sasha Levin
From: Shravan Chippa <shravan.chippa@microchip.com>
[ Upstream commit b02e07015a5ac7bbc029da931ae17914b8ae0339 ]
Commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a
DMA channel") changed sf_pdma_prep_dma_memcpy() to unconditionally
allocate a new sf_pdma_desc each time it is called.
The driver previously recycled descs, by checking the in_use flag, only
allocating additional descs if the existing one was in use. This logic
was removed in commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread
support for a DMA channel"), but sf_pdma_free_desc() was not changed to
handle the new behaviour.
As a result, each time sf_pdma_prep_dma_memcpy() is called, the previous
descriptor is leaked, over time leading to memory starvation:
unreferenced object 0xffffffe008447300 (size 192):
comm "irq/39-mchp_dsc", pid 343, jiffies 4294906910 (age 981.200s)
hex dump (first 32 bytes):
00 00 00 ff 00 00 00 00 b8 c1 00 00 00 00 00 00 ................
00 00 70 08 10 00 00 00 00 00 00 c0 00 00 00 00 ..p.............
backtrace:
[<00000000064a04f4>] kmemleak_alloc+0x1e/0x28
[<00000000018927a7>] kmem_cache_alloc+0x11e/0x178
[<000000002aea8d16>] sf_pdma_prep_dma_memcpy+0x40/0x112
Add the missing kfree() to sf_pdma_free_desc(), and remove the redundant
in_use flag.
Fixes: b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel")
Signed-off-by: Shravan Chippa <shravan.chippa@microchip.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20230120100623.3530634-1-shravan.chippa@microchip.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/sf-pdma/sf-pdma.c | 3 +--
drivers/dma/sf-pdma/sf-pdma.h | 1 -
2 files changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/dma/sf-pdma/sf-pdma.c b/drivers/dma/sf-pdma/sf-pdma.c
index ab0ad7a2f2015..dcf2b7a4183c1 100644
--- a/drivers/dma/sf-pdma/sf-pdma.c
+++ b/drivers/dma/sf-pdma/sf-pdma.c
@@ -96,7 +96,6 @@ sf_pdma_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dest, dma_addr_t src,
if (!desc)
return NULL;
- desc->in_use = true;
desc->dirn = DMA_MEM_TO_MEM;
desc->async_tx = vchan_tx_prep(&chan->vchan, &desc->vdesc, flags);
@@ -290,7 +289,7 @@ static void sf_pdma_free_desc(struct virt_dma_desc *vdesc)
struct sf_pdma_desc *desc;
desc = to_sf_pdma_desc(vdesc);
- desc->in_use = false;
+ kfree(desc);
}
static void sf_pdma_donebh_tasklet(struct tasklet_struct *t)
diff --git a/drivers/dma/sf-pdma/sf-pdma.h b/drivers/dma/sf-pdma/sf-pdma.h
index 0c20167b097d0..02a229a3ae225 100644
--- a/drivers/dma/sf-pdma/sf-pdma.h
+++ b/drivers/dma/sf-pdma/sf-pdma.h
@@ -82,7 +82,6 @@ struct sf_pdma_desc {
u64 src_addr;
struct virt_dma_desc vdesc;
struct sf_pdma_chan *chan;
- bool in_use;
enum dma_transfer_direction dirn;
struct dma_async_tx_descriptor *async_tx;
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 336/567] dmaengine: dw-axi-dmac: Do not dereference NULL structure
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 335/567] dmaengine: sf-pdma: pdma_desc memory leak fix Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 337/567] iommu/vt-d: Fix error handling in sva enable/disable paths Greg Kroah-Hartman
` (234 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugeniy Paltsev, Vinod Koul,
dmaengine, Kees Cook, Andy Shevchenko, Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit be4d46edeee4b2459d2f53f37ada88bbfb634b6c ]
If "vdesc" is NULL, it cannot be used with vd_to_axi_desc(). Leave
"bytes" unchanged at 0. Seen under GCC 13 with -Warray-bounds:
../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c: In function 'dma_chan_tx_status':
../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c:329:46: warning: array subscript 0 is outside array bounds of 'struct
virt_dma_desc[46116860184273879]' [-Warray-bounds=]
329 | bytes = vd_to_axi_desc(vdesc)->length;
| ^~
Fixes: 8e55444da65c ("dmaengine: dw-axi-dmac: Support burst residue granularity")
Cc: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
Cc: Vinod Koul <vkoul@kernel.org>
Cc: dmaengine@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20230127223623.never.507-kees@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
index 41654b2f6c600..cfc47efcb5d93 100644
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -288,8 +288,6 @@ dma_chan_tx_status(struct dma_chan *dchan, dma_cookie_t cookie,
len = vd_to_axi_desc(vdesc)->hw_desc[0].len;
completed_length = completed_blocks * len;
bytes = length - completed_length;
- } else {
- bytes = vd_to_axi_desc(vdesc)->length;
}
spin_unlock_irqrestore(&chan->vc.lock, flags);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 337/567] iommu/vt-d: Fix error handling in sva enable/disable paths
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 336/567] dmaengine: dw-axi-dmac: Do not dereference NULL structure Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 338/567] iommu/vt-d: Remove duplicate identity domain flag Greg Kroah-Hartman
` (233 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kevin Tian, Lu Baolu, Joerg Roedel,
Sasha Levin
From: Lu Baolu <baolu.lu@linux.intel.com>
[ Upstream commit 60b1daa3b168fbc648ae2ad28a84759223e49e18 ]
Roll back all previous actions in error paths of intel_iommu_enable_sva()
and intel_iommu_disable_sva().
Fixes: d5b9e4bfe0d8 ("iommu/vt-d: Report prq to io-pgfault framework")
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20230208051559.700109-1-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/iommu.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 751ff91af0ff6..5a4163f71a933 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -5405,8 +5405,12 @@ static int intel_iommu_enable_sva(struct device *dev)
return -EINVAL;
ret = iopf_queue_add_device(iommu->iopf_queue, dev);
- if (!ret)
- ret = iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev);
+ if (ret)
+ return ret;
+
+ ret = iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev);
+ if (ret)
+ iopf_queue_remove_device(iommu->iopf_queue, dev);
return ret;
}
@@ -5418,8 +5422,12 @@ static int intel_iommu_disable_sva(struct device *dev)
int ret;
ret = iommu_unregister_device_fault_handler(dev);
- if (!ret)
- ret = iopf_queue_remove_device(iommu->iopf_queue, dev);
+ if (ret)
+ return ret;
+
+ ret = iopf_queue_remove_device(iommu->iopf_queue, dev);
+ if (ret)
+ iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev);
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 338/567] iommu/vt-d: Remove duplicate identity domain flag
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 337/567] iommu/vt-d: Fix error handling in sva enable/disable paths Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 339/567] iommu/vt-d: Check FL and SL capability sanity in scalable mode Greg Kroah-Hartman
` (232 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lu Baolu, Kevin Tian, Joerg Roedel,
Sasha Levin
From: Lu Baolu <baolu.lu@linux.intel.com>
[ Upstream commit b34380a6d767c54480a937951e6189a7f9699443 ]
The iommu_domain data structure already has the "type" field to keep the
type of a domain. It's unnecessary to have the DOMAIN_FLAG_STATIC_IDENTITY
flag in the vt-d implementation. This cleans it up with no functionality
change.
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20210926114535.923263-1-baolu.lu@linux.intel.com
Link: https://lore.kernel.org/r/20211014053839.727419-4-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Stable-dep-of: 257ec2907419 ("iommu/vt-d: Allow to use flush-queue when first level is default")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/iommu.c | 9 ++++-----
include/linux/intel-iommu.h | 3 ---
2 files changed, 4 insertions(+), 8 deletions(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 5a4163f71a933..6be0fb10cb8a9 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -514,7 +514,7 @@ static inline void free_devinfo_mem(void *vaddr)
static inline int domain_type_is_si(struct dmar_domain *domain)
{
- return domain->flags & DOMAIN_FLAG_STATIC_IDENTITY;
+ return domain->domain.type == IOMMU_DOMAIN_IDENTITY;
}
static inline bool domain_use_first_level(struct dmar_domain *domain)
@@ -1922,7 +1922,7 @@ static bool first_level_by_default(void)
return scalable_mode_support() && intel_cap_flts_sanity();
}
-static struct dmar_domain *alloc_domain(int flags)
+static struct dmar_domain *alloc_domain(unsigned int type)
{
struct dmar_domain *domain;
@@ -1932,7 +1932,6 @@ static struct dmar_domain *alloc_domain(int flags)
memset(domain, 0, sizeof(*domain));
domain->nid = NUMA_NO_NODE;
- domain->flags = flags;
if (first_level_by_default())
domain->flags |= DOMAIN_FLAG_USE_FIRST_LEVEL;
domain->has_iotlb_device = false;
@@ -2753,7 +2752,7 @@ static int __init si_domain_init(int hw)
struct device *dev;
int i, nid, ret;
- si_domain = alloc_domain(DOMAIN_FLAG_STATIC_IDENTITY);
+ si_domain = alloc_domain(IOMMU_DOMAIN_IDENTITY);
if (!si_domain)
return -EFAULT;
@@ -4555,7 +4554,7 @@ static struct iommu_domain *intel_iommu_domain_alloc(unsigned type)
case IOMMU_DOMAIN_DMA:
case IOMMU_DOMAIN_DMA_FQ:
case IOMMU_DOMAIN_UNMANAGED:
- dmar_domain = alloc_domain(0);
+ dmar_domain = alloc_domain(type);
if (!dmar_domain) {
pr_err("Can't allocate dmar_domain\n");
return NULL;
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index 81da7107e3bd0..0cf00786a164f 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -515,9 +515,6 @@ struct context_entry {
u64 hi;
};
-/* si_domain contains mulitple devices */
-#define DOMAIN_FLAG_STATIC_IDENTITY BIT(0)
-
/*
* When VT-d works in the scalable mode, it allows DMA translation to
* happen through either first level or second level page table. This
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 339/567] iommu/vt-d: Check FL and SL capability sanity in scalable mode
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 338/567] iommu/vt-d: Remove duplicate identity domain flag Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 340/567] iommu/vt-d: Use second level for GPA->HPA translation Greg Kroah-Hartman
` (231 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lu Baolu, Kevin Tian, Joerg Roedel,
Sasha Levin
From: Lu Baolu <baolu.lu@linux.intel.com>
[ Upstream commit 7afd7f6aa21a2929aff3a059b741933ee1819c6b ]
An iommu domain could be allocated and mapped before it's attached to any
device. This requires that in scalable mode, when the domain is allocated,
the format (FL or SL) of the page table must be determined. In order to
achieve this, the platform should support consistent SL or FL capabilities
on all IOMMU's. This adds a check for this and aborts IOMMU probing if it
doesn't meet this requirement.
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20210926114535.923263-1-baolu.lu@linux.intel.com
Link: https://lore.kernel.org/r/20211014053839.727419-5-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Stable-dep-of: 257ec2907419 ("iommu/vt-d: Allow to use flush-queue when first level is default")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/cap_audit.c | 13 +++++++++++++
drivers/iommu/intel/cap_audit.h | 1 +
2 files changed, 14 insertions(+)
diff --git a/drivers/iommu/intel/cap_audit.c b/drivers/iommu/intel/cap_audit.c
index b12e421a2f1ab..b39d223926a49 100644
--- a/drivers/iommu/intel/cap_audit.c
+++ b/drivers/iommu/intel/cap_audit.c
@@ -163,6 +163,14 @@ static int cap_audit_static(struct intel_iommu *iommu, enum cap_audit_type type)
check_irq_capabilities(iommu, i);
}
+ /*
+ * If the system is sane to support scalable mode, either SL or FL
+ * should be sane.
+ */
+ if (intel_cap_smts_sanity() &&
+ !intel_cap_flts_sanity() && !intel_cap_slts_sanity())
+ return -EOPNOTSUPP;
+
out:
rcu_read_unlock();
return 0;
@@ -203,3 +211,8 @@ bool intel_cap_flts_sanity(void)
{
return ecap_flts(intel_iommu_ecap_sanity);
}
+
+bool intel_cap_slts_sanity(void)
+{
+ return ecap_slts(intel_iommu_ecap_sanity);
+}
diff --git a/drivers/iommu/intel/cap_audit.h b/drivers/iommu/intel/cap_audit.h
index 74cfccae0e817..d07b75938961f 100644
--- a/drivers/iommu/intel/cap_audit.h
+++ b/drivers/iommu/intel/cap_audit.h
@@ -111,6 +111,7 @@ bool intel_cap_smts_sanity(void);
bool intel_cap_pasid_sanity(void);
bool intel_cap_nest_sanity(void);
bool intel_cap_flts_sanity(void);
+bool intel_cap_slts_sanity(void);
static inline bool scalable_mode_support(void)
{
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 340/567] iommu/vt-d: Use second level for GPA->HPA translation
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 339/567] iommu/vt-d: Check FL and SL capability sanity in scalable mode Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 341/567] iommu/vt-d: Allow to use flush-queue when first level is default Greg Kroah-Hartman
` (230 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lu Baolu, Kevin Tian, Joerg Roedel,
Sasha Levin
From: Lu Baolu <baolu.lu@linux.intel.com>
[ Upstream commit 032c5ee40e9fc68ed650a3f86f23259376ec93fc ]
The IOMMU VT-d implementation uses the first level for GPA->HPA translation
by default. Although both the first level and the second level could handle
the DMA translation, they're different in some way. For example, the second
level translation has separate controls for the Access/Dirty page tracking.
With the first level translation, there's no such control. On the other
hand, the second level translation has the page-level control for forcing
snoop, but the first level only has global control with pasid granularity.
This uses the second level for GPA->HPA translation so that we can provide
a consistent hardware interface for use cases like dirty page tracking for
live migration.
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20210926114535.923263-1-baolu.lu@linux.intel.com
Link: https://lore.kernel.org/r/20211014053839.727419-6-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Stable-dep-of: 257ec2907419 ("iommu/vt-d: Allow to use flush-queue when first level is default")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/iommu.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 6be0fb10cb8a9..850b0590c24a5 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -1917,9 +1917,18 @@ static void free_dmar_iommu(struct intel_iommu *iommu)
* Check and return whether first level is used by default for
* DMA translation.
*/
-static bool first_level_by_default(void)
+static bool first_level_by_default(unsigned int type)
{
- return scalable_mode_support() && intel_cap_flts_sanity();
+ /* Only SL is available in legacy mode */
+ if (!scalable_mode_support())
+ return false;
+
+ /* Only level (either FL or SL) is available, just use it */
+ if (intel_cap_flts_sanity() ^ intel_cap_slts_sanity())
+ return intel_cap_flts_sanity();
+
+ /* Both levels are available, decide it based on domain type */
+ return type != IOMMU_DOMAIN_UNMANAGED;
}
static struct dmar_domain *alloc_domain(unsigned int type)
@@ -1932,7 +1941,7 @@ static struct dmar_domain *alloc_domain(unsigned int type)
memset(domain, 0, sizeof(*domain));
domain->nid = NUMA_NO_NODE;
- if (first_level_by_default())
+ if (first_level_by_default(type))
domain->flags |= DOMAIN_FLAG_USE_FIRST_LEVEL;
domain->has_iotlb_device = false;
INIT_LIST_HEAD(&domain->devices);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 341/567] iommu/vt-d: Allow to use flush-queue when first level is default
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 340/567] iommu/vt-d: Use second level for GPA->HPA translation Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 342/567] IB/hfi1: Fix math bugs in hfi1_can_pin_pages() Greg Kroah-Hartman
` (229 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanjay Kumar, Tina Zhang,
Kevin Tian, Lu Baolu, Joerg Roedel, Sasha Levin
From: Tina Zhang <tina.zhang@intel.com>
[ Upstream commit 257ec290741924f8df678927d0dfecb1deebb9c5 ]
Commit 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode
is on") forced default domains to be strict mode as long as IOMMU
caching-mode is flagged. The reason for doing this is that when vIOMMU
uses VT-d caching mode to synchronize shadowing page tables, the strict
mode shows better performance.
However, this optimization is orthogonal to the first-level page table
because the Intel VT-d architecture does not define the caching mode of
the first-level page table. Refer to VT-d spec, section 6.1, "When the
CM field is reported as Set, any software updates to remapping
structures other than first-stage mapping (including updates to not-
present entries or present entries whose programming resulted in
translation faults) requires explicit invalidation of the caches."
Exclude the first-level page table from this optimization.
Generally using first-stage translation in vIOMMU implies nested
translation enabled in the physical IOMMU. In this case the first-stage
page table is wholly captured by the guest. The vIOMMU only needs to
transfer the cache invalidations on vIOMMU to the physical IOMMU.
Forcing the default domain to strict mode will cause more frequent
cache invalidations, resulting in performance degradation. In a real
performance benchmark test measured by iperf receive, the performance
result on Sapphire Rapids 100Gb NIC shows:
w/ this fix ~51 Gbits/s, w/o this fix ~39.3 Gbits/s.
Theoretically a first-stage IOMMU page table can still be shadowed
in absence of the caching mode, e.g. with host write-protecting guest
IOMMU page table to synchronize changed PTEs with the physical
IOMMU page table. In this case the shadowing overhead is decoupled
from emulating IOTLB invalidation then the overhead of the latter part
is solely decided by the frequency of IOTLB invalidations. Hence
allowing guest default dma domain to be lazy can also benefit the
overall performance by reducing the total VM-exit numbers.
Fixes: 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode is on")
Reported-by: Sanjay Kumar <sanjay.k.kumar@intel.com>
Suggested-by: Sanjay Kumar <sanjay.k.kumar@intel.com>
Signed-off-by: Tina Zhang <tina.zhang@intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20230214025618.2292889-1-tina.zhang@intel.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/iommu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 850b0590c24a5..9666391240928 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -4423,7 +4423,8 @@ int __init intel_iommu_init(void)
* is likely to be much lower than the overhead of synchronizing
* the virtual and physical IOMMU page-tables.
*/
- if (cap_caching_mode(iommu->cap)) {
+ if (cap_caching_mode(iommu->cap) &&
+ !first_level_by_default(IOMMU_DOMAIN_DMA)) {
pr_info_once("IOMMU batching disallowed due to virtualization\n");
iommu_set_dma_strict();
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 342/567] IB/hfi1: Fix math bugs in hfi1_can_pin_pages()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 341/567] iommu/vt-d: Allow to use flush-queue when first level is default Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 343/567] IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors Greg Kroah-Hartman
` (228 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brendan Cunningham, Patrick Kelsey,
Dennis Dalessandro, Jason Gunthorpe, Sasha Levin
From: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
[ Upstream commit a0d198f79a8d033bd46605b779859193649f1f99 ]
Fix arithmetic and logic errors in hfi1_can_pin_pages() that would allow
hfi1 to attempt pinning pages in cases where it should not because of
resource limits or lack of required capability.
Fixes: 2c97ce4f3c29 ("IB/hfi1: Add pin query function")
Link: https://lore.kernel.org/r/167656658362.2223096.10954762619837718026.stgit@awfm-02.cornelisnetworks.com
Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
Signed-off-by: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/user_pages.c | 61 ++++++++++++++++---------
1 file changed, 40 insertions(+), 21 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/user_pages.c b/drivers/infiniband/hw/hfi1/user_pages.c
index 7bce963e2ae69..36aaedc651456 100644
--- a/drivers/infiniband/hw/hfi1/user_pages.c
+++ b/drivers/infiniband/hw/hfi1/user_pages.c
@@ -29,33 +29,52 @@ MODULE_PARM_DESC(cache_size, "Send and receive side cache size limit (in MB)");
bool hfi1_can_pin_pages(struct hfi1_devdata *dd, struct mm_struct *mm,
u32 nlocked, u32 npages)
{
- unsigned long ulimit = rlimit(RLIMIT_MEMLOCK), pinned, cache_limit,
- size = (cache_size * (1UL << 20)); /* convert to bytes */
- unsigned int usr_ctxts =
- dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt;
- bool can_lock = capable(CAP_IPC_LOCK);
+ unsigned long ulimit_pages;
+ unsigned long cache_limit_pages;
+ unsigned int usr_ctxts;
/*
- * Calculate per-cache size. The calculation below uses only a quarter
- * of the available per-context limit. This leaves space for other
- * pinning. Should we worry about shared ctxts?
+ * Perform RLIMIT_MEMLOCK based checks unless CAP_IPC_LOCK is present.
*/
- cache_limit = (ulimit / usr_ctxts) / 4;
-
- /* If ulimit isn't set to "unlimited" and is smaller than cache_size. */
- if (ulimit != (-1UL) && size > cache_limit)
- size = cache_limit;
-
- /* Convert to number of pages */
- size = DIV_ROUND_UP(size, PAGE_SIZE);
-
- pinned = atomic64_read(&mm->pinned_vm);
+ if (!capable(CAP_IPC_LOCK)) {
+ ulimit_pages =
+ DIV_ROUND_DOWN_ULL(rlimit(RLIMIT_MEMLOCK), PAGE_SIZE);
+
+ /*
+ * Pinning these pages would exceed this process's locked memory
+ * limit.
+ */
+ if (atomic64_read(&mm->pinned_vm) + npages > ulimit_pages)
+ return false;
+
+ /*
+ * Only allow 1/4 of the user's RLIMIT_MEMLOCK to be used for HFI
+ * caches. This fraction is then equally distributed among all
+ * existing user contexts. Note that if RLIMIT_MEMLOCK is
+ * 'unlimited' (-1), the value of this limit will be > 2^42 pages
+ * (2^64 / 2^12 / 2^8 / 2^2).
+ *
+ * The effectiveness of this check may be reduced if I/O occurs on
+ * some user contexts before all user contexts are created. This
+ * check assumes that this process is the only one using this
+ * context (e.g., the corresponding fd was not passed to another
+ * process for concurrent access) as there is no per-context,
+ * per-process tracking of pinned pages. It also assumes that each
+ * user context has only one cache to limit.
+ */
+ usr_ctxts = dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt;
+ if (nlocked + npages > (ulimit_pages / usr_ctxts / 4))
+ return false;
+ }
- /* First, check the absolute limit against all pinned pages. */
- if (pinned + npages >= ulimit && !can_lock)
+ /*
+ * Pinning these pages would exceed the size limit for this cache.
+ */
+ cache_limit_pages = cache_size * (1024 * 1024) / PAGE_SIZE;
+ if (nlocked + npages > cache_limit_pages)
return false;
- return ((nlocked + npages) <= size) || can_lock;
+ return true;
}
int hfi1_acquire_user_pages(struct mm_struct *mm, unsigned long vaddr, size_t npages,
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 343/567] IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 342/567] IB/hfi1: Fix math bugs in hfi1_can_pin_pages() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 344/567] remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers Greg Kroah-Hartman
` (227 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brendan Cunningham, Patrick Kelsey,
Dennis Dalessandro, Jason Gunthorpe, Sasha Levin
From: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
[ Upstream commit fd8958efe8779d3db19c9124fce593ce681ac709 ]
Fix three sources of error involving struct sdma_txreq.num_descs.
When _extend_sdma_tx_descs() extends the descriptor array, it uses the
value of tx->num_descs to determine how many existing entries from the
tx's original, internal descriptor array to copy to the newly allocated
one. As this value was incremented before the call, the copy loop will
access one entry past the internal descriptor array, copying its contents
into the corresponding slot in the new array.
If the call to _extend_sdma_tx_descs() fails, _pad_smda_tx_descs() then
invokes __sdma_tx_clean() which uses the value of tx->num_desc to drive a
loop that unmaps all descriptor entries in use. As this value was
incremented before the call, the unmap loop will invoke sdma_unmap_desc()
on a descriptor entry whose contents consist of whatever random data was
copied into it during (1), leading to cascading further calls into the
kernel and driver using arbitrary data.
_sdma_close_tx() was using tx->num_descs instead of tx->num_descs - 1.
Fix all of the above by:
- Only increment .num_descs after .descp is extended.
- Use .num_descs - 1 instead of .num_descs for last .descp entry.
Fixes: f4d26d81ad7f ("staging/rdma/hfi1: Add coalescing support for SDMA TX descriptors")
Link: https://lore.kernel.org/r/167656658879.2223096.10026561343022570690.stgit@awfm-02.cornelisnetworks.com
Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
Signed-off-by: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hfi1/sdma.c | 4 ++--
drivers/infiniband/hw/hfi1/sdma.h | 15 +++++++--------
2 files changed, 9 insertions(+), 10 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
index a95b654f52540..8ed20392e9f0d 100644
--- a/drivers/infiniband/hw/hfi1/sdma.c
+++ b/drivers/infiniband/hw/hfi1/sdma.c
@@ -3160,8 +3160,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
{
int rval = 0;
- tx->num_desc++;
- if ((unlikely(tx->num_desc == tx->desc_limit))) {
+ if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) {
rval = _extend_sdma_tx_descs(dd, tx);
if (rval) {
__sdma_txclean(dd, tx);
@@ -3174,6 +3173,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
SDMA_MAP_NONE,
dd->sdma_pad_phys,
sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)));
+ tx->num_desc++;
_sdma_close_tx(dd, tx);
return rval;
}
diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h
index d8170fcbfbdd5..b023fc461bd51 100644
--- a/drivers/infiniband/hw/hfi1/sdma.h
+++ b/drivers/infiniband/hw/hfi1/sdma.h
@@ -631,14 +631,13 @@ static inline void sdma_txclean(struct hfi1_devdata *dd, struct sdma_txreq *tx)
static inline void _sdma_close_tx(struct hfi1_devdata *dd,
struct sdma_txreq *tx)
{
- tx->descp[tx->num_desc].qw[0] |=
- SDMA_DESC0_LAST_DESC_FLAG;
- tx->descp[tx->num_desc].qw[1] |=
- dd->default_desc1;
+ u16 last_desc = tx->num_desc - 1;
+
+ tx->descp[last_desc].qw[0] |= SDMA_DESC0_LAST_DESC_FLAG;
+ tx->descp[last_desc].qw[1] |= dd->default_desc1;
if (tx->flags & SDMA_TXREQ_F_URGENT)
- tx->descp[tx->num_desc].qw[1] |=
- (SDMA_DESC1_HEAD_TO_HOST_FLAG |
- SDMA_DESC1_INT_REQ_FLAG);
+ tx->descp[last_desc].qw[1] |= (SDMA_DESC1_HEAD_TO_HOST_FLAG |
+ SDMA_DESC1_INT_REQ_FLAG);
}
static inline int _sdma_txadd_daddr(
@@ -655,6 +654,7 @@ static inline int _sdma_txadd_daddr(
type,
addr, len);
WARN_ON(len > tx->tlen);
+ tx->num_desc++;
tx->tlen -= len;
/* special cases for last */
if (!tx->tlen) {
@@ -666,7 +666,6 @@ static inline int _sdma_txadd_daddr(
_sdma_close_tx(dd, tx);
}
}
- tx->num_desc++;
return rval;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 344/567] remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 343/567] IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 345/567] media: ti: cal: fix possible memory leak in cal_ctx_create() Greg Kroah-Hartman
` (226 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sibi Sankar, Manivannan Sadhasivam,
Bjorn Andersson, Sasha Levin, Amit Pundir
From: Sibi Sankar <quic_sibis@quicinc.com>
[ Upstream commit 57f72170a2b2a362c35bb9407fc844eac5afdec1 ]
Any access to the dynamically allocated metadata region by the application
processor after assigning it to the remote Q6 will result in a XPU
violation. Fix this by replacing the dynamically allocated memory region
with a no-map carveout and unmap the modem metadata memory region before
passing control to the remote Q6.
Reported-and-tested-by: Amit Pundir <amit.pundir@linaro.org>
Fixes: 6c5a9dc2481b ("remoteproc: qcom: Make secure world call for mem ownership switch")
Signed-off-by: Sibi Sankar <quic_sibis@quicinc.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230117085840.32356-7-quic_sibis@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/qcom_q6v5_mss.c | 59 +++++++++++++++++++++++++++---
1 file changed, 53 insertions(+), 6 deletions(-)
diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
index ca1c7387776b5..93eefefd514c7 100644
--- a/drivers/remoteproc/qcom_q6v5_mss.c
+++ b/drivers/remoteproc/qcom_q6v5_mss.c
@@ -17,6 +17,7 @@
#include <linux/module.h>
#include <linux/of_address.h>
#include <linux/of_device.h>
+#include <linux/of_reserved_mem.h>
#include <linux/platform_device.h>
#include <linux/pm_domain.h>
#include <linux/pm_runtime.h>
@@ -192,6 +193,9 @@ struct q6v5 {
size_t mba_size;
size_t dp_size;
+ phys_addr_t mdata_phys;
+ size_t mdata_size;
+
phys_addr_t mpss_phys;
phys_addr_t mpss_reloc;
size_t mpss_size;
@@ -832,15 +836,35 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw)
if (IS_ERR(metadata))
return PTR_ERR(metadata);
- ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs);
- if (!ptr) {
- kfree(metadata);
- dev_err(qproc->dev, "failed to allocate mdt buffer\n");
- return -ENOMEM;
+ if (qproc->mdata_phys) {
+ if (size > qproc->mdata_size) {
+ ret = -EINVAL;
+ dev_err(qproc->dev, "metadata size outside memory range\n");
+ goto free_metadata;
+ }
+
+ phys = qproc->mdata_phys;
+ ptr = memremap(qproc->mdata_phys, size, MEMREMAP_WC);
+ if (!ptr) {
+ ret = -EBUSY;
+ dev_err(qproc->dev, "unable to map memory region: %pa+%zx\n",
+ &qproc->mdata_phys, size);
+ goto free_metadata;
+ }
+ } else {
+ ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs);
+ if (!ptr) {
+ ret = -ENOMEM;
+ dev_err(qproc->dev, "failed to allocate mdt buffer\n");
+ goto free_metadata;
+ }
}
memcpy(ptr, metadata, size);
+ if (qproc->mdata_phys)
+ memunmap(ptr);
+
/* Hypervisor mapping to access metadata by modem */
mdata_perm = BIT(QCOM_SCM_VMID_HLOS);
ret = q6v5_xfer_mem_ownership(qproc, &mdata_perm, false, true,
@@ -869,7 +893,9 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw)
"mdt buffer not reclaimed system may become unstable\n");
free_dma_attrs:
- dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs);
+ if (!qproc->mdata_phys)
+ dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs);
+free_metadata:
kfree(metadata);
return ret < 0 ? ret : 0;
@@ -1615,6 +1641,7 @@ static int q6v5_init_reset(struct q6v5 *qproc)
static int q6v5_alloc_memory_region(struct q6v5 *qproc)
{
struct device_node *child;
+ struct reserved_mem *rmem;
struct device_node *node;
struct resource r;
int ret;
@@ -1661,6 +1688,26 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc)
qproc->mpss_phys = qproc->mpss_reloc = r.start;
qproc->mpss_size = resource_size(&r);
+ if (!child) {
+ node = of_parse_phandle(qproc->dev->of_node, "memory-region", 2);
+ } else {
+ child = of_get_child_by_name(qproc->dev->of_node, "metadata");
+ node = of_parse_phandle(child, "memory-region", 0);
+ of_node_put(child);
+ }
+
+ if (!node)
+ return 0;
+
+ rmem = of_reserved_mem_lookup(node);
+ if (!rmem) {
+ dev_err(qproc->dev, "unable to resolve metadata region\n");
+ return -EINVAL;
+ }
+
+ qproc->mdata_phys = rmem->base;
+ qproc->mdata_size = rmem->size;
+
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 345/567] media: ti: cal: fix possible memory leak in cal_ctx_create()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 344/567] remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 346/567] media: platform: ti: Add missing check for devm_regulator_get Greg Kroah-Hartman
` (225 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gaosheng Cui, Laurent Pinchart,
Mauro Carvalho Chehab, Sasha Levin
From: Gaosheng Cui <cuigaosheng1@huawei.com>
[ Upstream commit 7acd650a0484d92985a0d6d867d980c6dd019885 ]
The memory of ctx is allocated in cal_ctx_create(), but it will
not be freed when cal_ctx_v4l2_init() fails, so add kfree() when
cal_ctx_v4l2_init() fails to fix it.
Fixes: d68a94e98a89 ("media: ti-vpe: cal: Split video device initialization and registration")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/ti-vpe/cal.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
index 8e469d518a742..35d62eb1321fb 100644
--- a/drivers/media/platform/ti-vpe/cal.c
+++ b/drivers/media/platform/ti-vpe/cal.c
@@ -940,8 +940,10 @@ static struct cal_ctx *cal_ctx_create(struct cal_dev *cal, int inst)
ctx->datatype = CAL_CSI2_CTX_DT_ANY;
ret = cal_ctx_v4l2_init(ctx);
- if (ret)
+ if (ret) {
+ kfree(ctx);
return NULL;
+ }
return ctx;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 346/567] media: platform: ti: Add missing check for devm_regulator_get
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 345/567] media: ti: cal: fix possible memory leak in cal_ctx_create() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 347/567] powerpc: Remove linker flag from KBUILD_AFLAGS Greg Kroah-Hartman
` (224 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Laurent Pinchart,
Mauro Carvalho Chehab, Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit da8e05f84a11c3cc3b0ba0a3c62d20e358002d99 ]
Add check for the return value of devm_regulator_get since it may return
error pointer.
Fixes: 448de7e7850b ("[media] omap3isp: OMAP3 ISP core")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/omap3isp/isp.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 20f59c59ff8a2..3222c98b83630 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -2306,7 +2306,16 @@ static int isp_probe(struct platform_device *pdev)
/* Regulators */
isp->isp_csiphy1.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy1");
+ if (IS_ERR(isp->isp_csiphy1.vdd)) {
+ ret = PTR_ERR(isp->isp_csiphy1.vdd);
+ goto error;
+ }
+
isp->isp_csiphy2.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy2");
+ if (IS_ERR(isp->isp_csiphy2.vdd)) {
+ ret = PTR_ERR(isp->isp_csiphy2.vdd);
+ goto error;
+ }
/* Clocks
*
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 347/567] powerpc: Remove linker flag from KBUILD_AFLAGS
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 346/567] media: platform: ti: Add missing check for devm_regulator_get Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 348/567] s390/vdso: remove -nostdlib compiler flag Greg Kroah-Hartman
` (223 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Nick Desaulniers,
Linux Kernel Functional Testing, Anders Roxell, Michael Ellerman,
Masahiro Yamada, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit 31f48f16264bc70962fb3e7ec62da64d0a2ba04a ]
When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it
points out that KBUILD_AFLAGS contains a linker flag, which will be
unused:
clang: error: -Wl,-a32: 'linker' input unused [-Werror,-Wunused-command-line-argument]
This was likely supposed to be '-Wa,-a$(BITS)'. However, this change is
unnecessary, as all supported versions of clang and gcc will pass '-a64'
or '-a32' to GNU as based on the value of '-m'; the behavior of the
latest stable release of the oldest supported major version of each
compiler is shown below and each compiler's latest release exhibits the
same behavior (GCC 12.2.0 and Clang 15.0.6).
$ powerpc64-linux-gcc --version | head -1
powerpc64-linux-gcc (GCC) 5.5.0
$ powerpc64-linux-gcc -m64 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as '
.../as -a64 -mppc64 -many -mbig -o /dev/null /tmp/cctwuBzZ.s
$ powerpc64-linux-gcc -m32 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as '
.../as -a32 -mppc -many -mbig -o /dev/null /tmp/ccaZP4mF.sg
$ clang --version | head -1
Ubuntu clang version 11.1.0-++20211011094159+1fdec59bffc1-1~exp1~20211011214622.5
$ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \
-x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as
"/usr/bin/powerpc64-linux-gnu-as" "-a64" "-mppc64" "-many" "-o" "/dev/null" "/tmp/null-80267c.s"
$ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \
-x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as
"/usr/bin/powerpc64-linux-gnu-as" "-a32" "-mppc" "-many" "-o" "/dev/null" "/tmp/null-ab8f8d.s"
Remove this flag altogether to avoid future issues.
Fixes: 1421dc6d4829 ("powerpc/kbuild: Use flags variables rather than overriding LD/CC/AS")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Anders Roxell <anders.roxell@linaro.org>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 7859ae56fcdcd..a8e52e64c1a5b 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -92,7 +92,7 @@ aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mlittle-endian
ifeq ($(HAS_BIARCH),y)
KBUILD_CFLAGS += -m$(BITS)
-KBUILD_AFLAGS += -m$(BITS) -Wl,-a$(BITS)
+KBUILD_AFLAGS += -m$(BITS)
KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION)
endif
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 348/567] s390/vdso: remove -nostdlib compiler flag
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 347/567] powerpc: Remove linker flag from KBUILD_AFLAGS Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 349/567] s390/vdso: Drop -shared from KBUILD_CFLAGS_64 Greg Kroah-Hartman
` (222 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masahiro Yamada, Heiko Carstens,
Sasha Levin
From: Masahiro Yamada <masahiroy@kernel.org>
[ Upstream commit 7b737adc10d269e7fdf714ae2caa2281b6a801cf ]
The -nostdlib option requests the compiler to not use the standard
system startup files or libraries when linking. It is effective only
when $(CC) is used as a linker driver.
Since commit 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to
link vDSO"), $(LD) is directly used, hence -nostdlib is unneeded.
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Link: https://lore.kernel.org/r/20211107162111.323701-1-masahiroy@kernel.org
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Stable-dep-of: fd8589dce810 ("s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kernel/vdso32/Makefile | 2 +-
arch/s390/kernel/vdso64/Makefile | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile
index e3e6ac5686df5..245bddfe9bc0e 100644
--- a/arch/s390/kernel/vdso32/Makefile
+++ b/arch/s390/kernel/vdso32/Makefile
@@ -22,7 +22,7 @@ KBUILD_AFLAGS_32 += -m31 -s
KBUILD_CFLAGS_32 := $(filter-out -m64,$(KBUILD_CFLAGS))
KBUILD_CFLAGS_32 += -m31 -fPIC -shared -fno-common -fno-builtin
-LDFLAGS_vdso32.so.dbg += -fPIC -shared -nostdlib -soname=linux-vdso32.so.1 \
+LDFLAGS_vdso32.so.dbg += -fPIC -shared -soname=linux-vdso32.so.1 \
--hash-style=both --build-id=sha1 -melf_s390 -T
$(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)
diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
index 0dea82b87e54b..9e2b95a222a98 100644
--- a/arch/s390/kernel/vdso64/Makefile
+++ b/arch/s390/kernel/vdso64/Makefile
@@ -26,7 +26,7 @@ KBUILD_AFLAGS_64 += -m64 -s
KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS))
KBUILD_CFLAGS_64 += -m64 -fPIC -shared -fno-common -fno-builtin
-ldflags-y := -fPIC -shared -nostdlib -soname=linux-vdso64.so.1 \
+ldflags-y := -fPIC -shared -soname=linux-vdso64.so.1 \
--hash-style=both --build-id=sha1 -T
$(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_64)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 349/567] s390/vdso: Drop -shared from KBUILD_CFLAGS_64
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 348/567] s390/vdso: remove -nostdlib compiler flag Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 350/567] builddeb: clean generated package content Greg Kroah-Hartman
` (221 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Heiko Carstens,
Sven Schnelle, Linux Kernel Functional Testing, Anders Roxell,
Masahiro Yamada, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit fd8589dce8107e2ce62e92f76089654462dd67b4 ]
When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it
points out that there is a linking phase flag added to CFLAGS, which
will only be used for compiling
clang-16: error: argument unused during compilation: '-shared' [-Werror,-Wunused-command-line-argument]
'-shared' is already present in ldflags-y so it can just be dropped.
Fixes: 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kernel/vdso64/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
index 9e2b95a222a98..1605ba45ac4c0 100644
--- a/arch/s390/kernel/vdso64/Makefile
+++ b/arch/s390/kernel/vdso64/Makefile
@@ -25,7 +25,7 @@ KBUILD_AFLAGS_64 := $(filter-out -m64,$(KBUILD_AFLAGS))
KBUILD_AFLAGS_64 += -m64 -s
KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS))
-KBUILD_CFLAGS_64 += -m64 -fPIC -shared -fno-common -fno-builtin
+KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin
ldflags-y := -fPIC -shared -soname=linux-vdso64.so.1 \
--hash-style=both --build-id=sha1 -T
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 350/567] builddeb: clean generated package content
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 349/567] s390/vdso: Drop -shared from KBUILD_CFLAGS_64 Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 351/567] media: max9286: Fix memleak in max9286_v4l2_register() Greg Kroah-Hartman
` (220 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bastian Germann, Masahiro Yamada,
Sasha Levin
From: Bastian Germann <bage@linutronix.de>
[ Upstream commit c9f9cf2560e40b62015c6c4a04be60f55ce5240e ]
For each binary Debian package, a directory with the package name is
created in the debian directory. Correct the generated file matches in the
package's clean target, which were renamed without adjusting the target.
Fixes: 1694e94e4f46 ("builddeb: match temporary directory name to the package name")
Signed-off-by: Bastian Germann <bage@linutronix.de>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/package/mkdebian | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
index 60a2a63a5e900..32d528a367868 100755
--- a/scripts/package/mkdebian
+++ b/scripts/package/mkdebian
@@ -236,7 +236,7 @@ binary-arch: build-arch
KBUILD_BUILD_VERSION=${revision} -f \$(srctree)/Makefile intdeb-pkg
clean:
- rm -rf debian/*tmp debian/files
+ rm -rf debian/files debian/linux-*
\$(MAKE) clean
binary: binary-arch
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 351/567] media: max9286: Fix memleak in max9286_v4l2_register()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 350/567] builddeb: clean generated package content Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 352/567] media: ov2740: Fix memleak in ov2740_init_controls() Greg Kroah-Hartman
` (219 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shang XiaoJing, Laurent Pinchart,
Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
From: Shang XiaoJing <shangxiaojing@huawei.com>
[ Upstream commit 8636c5fc7658c7c6299fb8b352d24ea4b9ba99e2 ]
There is a kmemleak when testing the media/i2c/max9286.c with bpf mock
device:
kmemleak: 5 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
unreferenced object 0xffff88810defc400 (size 256):
comm "python3", pid 278, jiffies 4294737563 (age 31.978s)
hex dump (first 32 bytes):
28 06 a7 0a 81 88 ff ff 00 fe 22 12 81 88 ff ff (.........".....
10 c4 ef 0d 81 88 ff ff 10 c4 ef 0d 81 88 ff ff ................
backtrace:
[<00000000191de6a7>] __kmalloc_node+0x44/0x1b0
[<000000002f4912b7>] kvmalloc_node+0x34/0x180
[<0000000057dc4cae>] v4l2_ctrl_new+0x325/0x10f0 [videodev]
[<0000000026030272>] v4l2_ctrl_new_std+0x16f/0x210 [videodev]
[<00000000f0d9ea2f>] max9286_probe+0x76e/0xbff [max9286]
[<00000000ea8f6455>] i2c_device_probe+0x28d/0x680
[<0000000087529af3>] really_probe+0x17c/0x3f0
[<00000000b08be526>] __driver_probe_device+0xe3/0x170
[<000000004382edea>] driver_probe_device+0x49/0x120
[<000000007bde528a>] __device_attach_driver+0xf7/0x150
[<000000009f9c6ab4>] bus_for_each_drv+0x114/0x180
[<00000000c8aaf588>] __device_attach+0x1e5/0x2d0
[<0000000041cc06b9>] bus_probe_device+0x126/0x140
[<000000002309860d>] device_add+0x810/0x1130
[<000000002827bf98>] i2c_new_client_device+0x359/0x4f0
[<00000000593bdc85>] of_i2c_register_device+0xf1/0x110
max9286_v4l2_register() calls v4l2_ctrl_new_std(), but won't free the
created v412_ctrl when fwnode_graph_get_endpoint_by_id() failed, which
causes the memleak. Call v4l2_ctrl_handler_free() to free the v412_ctrl.
Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver")
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/max9286.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
index ce943702ffe9c..b9513e93ac617 100644
--- a/drivers/media/i2c/max9286.c
+++ b/drivers/media/i2c/max9286.c
@@ -928,6 +928,7 @@ static int max9286_v4l2_register(struct max9286_priv *priv)
err_put_node:
fwnode_handle_put(ep);
err_async:
+ v4l2_ctrl_handler_free(&priv->ctrls);
max9286_v4l2_notifier_unregister(priv);
return ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 352/567] media: ov2740: Fix memleak in ov2740_init_controls()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 351/567] media: max9286: Fix memleak in max9286_v4l2_register() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 353/567] media: ov5675: Fix memleak in ov5675_init_controls() Greg Kroah-Hartman
` (218 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shang XiaoJing, Sakari Ailus,
Mauro Carvalho Chehab, Sasha Levin
From: Shang XiaoJing <shangxiaojing@huawei.com>
[ Upstream commit 2d899592ed7829d0d5140853bac4d58742a6b8af ]
There is a kmemleak when testing the media/i2c/ov2740.c with bpf mock
device:
unreferenced object 0xffff8881090e19e0 (size 16):
comm "51-i2c-ov2740", pid 278, jiffies 4294781584 (age 23.613s)
hex dump (first 16 bytes):
00 f3 7c 0b 81 88 ff ff 80 75 6a 09 81 88 ff ff ..|......uj.....
backtrace:
[<000000004e9fad8f>] __kmalloc_node+0x44/0x1b0
[<0000000039c802f4>] kvmalloc_node+0x34/0x180
[<000000009b8b5c63>] v4l2_ctrl_handler_init_class+0x11d/0x180
[videodev]
[<0000000038644056>] ov2740_probe+0x37d/0x84f [ov2740]
[<0000000092489f59>] i2c_device_probe+0x28d/0x680
[<000000001038babe>] really_probe+0x17c/0x3f0
[<0000000098c7af1c>] __driver_probe_device+0xe3/0x170
[<00000000e1b3dc24>] device_driver_attach+0x34/0x80
[<000000005a04a34d>] bind_store+0x10b/0x1a0
[<00000000ce25d4f2>] drv_attr_store+0x49/0x70
[<000000007d9f4e9a>] sysfs_kf_write+0x8c/0xb0
[<00000000be6cff0f>] kernfs_fop_write_iter+0x216/0x2e0
[<0000000031ddb40a>] vfs_write+0x658/0x810
[<0000000041beecdd>] ksys_write+0xd6/0x1b0
[<0000000023755840>] do_syscall_64+0x38/0x90
[<00000000b2cc2da2>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
ov2740_init_controls() won't clean all the allocated resources in fail
path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
prevent memleak.
Fixes: 866edc895171 ("media: i2c: Add ov2740 image sensor driver")
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov2740.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov2740.c b/drivers/media/i2c/ov2740.c
index 934c9d65cb097..4b1ab3e07910e 100644
--- a/drivers/media/i2c/ov2740.c
+++ b/drivers/media/i2c/ov2740.c
@@ -603,8 +603,10 @@ static int ov2740_init_controls(struct ov2740 *ov2740)
V4L2_CID_TEST_PATTERN,
ARRAY_SIZE(ov2740_test_pattern_menu) - 1,
0, 0, ov2740_test_pattern_menu);
- if (ctrl_hdlr->error)
+ if (ctrl_hdlr->error) {
+ v4l2_ctrl_handler_free(ctrl_hdlr);
return ctrl_hdlr->error;
+ }
ov2740->sd.ctrl_handler = ctrl_hdlr;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 353/567] media: ov5675: Fix memleak in ov5675_init_controls()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 352/567] media: ov2740: Fix memleak in ov2740_init_controls() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 354/567] media: i2c: ov772x: Fix memleak in ov772x_probe() Greg Kroah-Hartman
` (217 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shang XiaoJing, Sakari Ailus,
Mauro Carvalho Chehab, Sasha Levin
From: Shang XiaoJing <shangxiaojing@huawei.com>
[ Upstream commit dd74ed6c213003533e3abf4c204374ef01d86978 ]
There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock
device:
AssertionError: unreferenced object 0xffff888107362160 (size 16):
comm "python3", pid 277, jiffies 4294832798 (age 20.722s)
hex dump (first 16 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000abe7d67c>] __kmalloc_node+0x44/0x1b0
[<000000008a725aac>] kvmalloc_node+0x34/0x180
[<000000009a53cd11>] v4l2_ctrl_handler_init_class+0x11d/0x180
[videodev]
[<0000000055b46db0>] ov5675_probe+0x38b/0x897 [ov5675]
[<00000000153d886c>] i2c_device_probe+0x28d/0x680
[<000000004afb7e8f>] really_probe+0x17c/0x3f0
[<00000000ff2f18e4>] __driver_probe_device+0xe3/0x170
[<000000000a001029>] driver_probe_device+0x49/0x120
[<00000000e39743c7>] __device_attach_driver+0xf7/0x150
[<00000000d32fd070>] bus_for_each_drv+0x114/0x180
[<000000009083ac41>] __device_attach+0x1e5/0x2d0
[<0000000015b4a830>] bus_probe_device+0x126/0x140
[<000000007813deaf>] device_add+0x810/0x1130
[<000000007becb867>] i2c_new_client_device+0x386/0x540
[<000000007f9cf4b4>] of_i2c_register_device+0xf1/0x110
[<00000000ebfdd032>] of_i2c_notify+0xfc/0x1f0
ov5675_init_controls() won't clean all the allocated resources in fail
path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
prevent memleak.
Fixes: bf27502b1f3b ("media: ov5675: Add support for OV5675 sensor")
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov5675.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov5675.c b/drivers/media/i2c/ov5675.c
index da5850b7ad07f..2104589dd4343 100644
--- a/drivers/media/i2c/ov5675.c
+++ b/drivers/media/i2c/ov5675.c
@@ -791,8 +791,10 @@ static int ov5675_init_controls(struct ov5675 *ov5675)
v4l2_ctrl_new_std(ctrl_hdlr, &ov5675_ctrl_ops,
V4L2_CID_VFLIP, 0, 1, 1, 0);
- if (ctrl_hdlr->error)
+ if (ctrl_hdlr->error) {
+ v4l2_ctrl_handler_free(ctrl_hdlr);
return ctrl_hdlr->error;
+ }
ov5675->sd.ctrl_handler = ctrl_hdlr;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 354/567] media: i2c: ov772x: Fix memleak in ov772x_probe()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 353/567] media: ov5675: Fix memleak in ov5675_init_controls() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 355/567] media: i2c: imx219: Split common registers from mode tables Greg Kroah-Hartman
` (216 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Can, Laurent Pinchart,
Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
From: Yuan Can <yuancan@huawei.com>
[ Upstream commit 7485edb2b6ca5960205c0a49bedfd09bba30e521 ]
A memory leak was reported when testing ov772x with bpf mock device:
AssertionError: unreferenced object 0xffff888109afa7a8 (size 8):
comm "python3", pid 279, jiffies 4294805921 (age 20.681s)
hex dump (first 8 bytes):
80 22 88 15 81 88 ff ff ."......
backtrace:
[<000000009990b438>] __kmalloc_node+0x44/0x1b0
[<000000009e32f7d7>] kvmalloc_node+0x34/0x180
[<00000000faf48134>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev]
[<00000000da376937>] ov772x_probe+0x1c3/0x68c [ov772x]
[<000000003f0d225e>] i2c_device_probe+0x28d/0x680
[<00000000e0b6db89>] really_probe+0x17c/0x3f0
[<000000001b19fcee>] __driver_probe_device+0xe3/0x170
[<0000000048370519>] driver_probe_device+0x49/0x120
[<000000005ead07a0>] __device_attach_driver+0xf7/0x150
[<0000000043f452b8>] bus_for_each_drv+0x114/0x180
[<00000000358e5596>] __device_attach+0x1e5/0x2d0
[<0000000043f83c5d>] bus_probe_device+0x126/0x140
[<00000000ee0f3046>] device_add+0x810/0x1130
[<00000000e0278184>] i2c_new_client_device+0x359/0x4f0
[<0000000070baf34f>] of_i2c_register_device+0xf1/0x110
[<00000000a9f2159d>] of_i2c_notify+0x100/0x160
unreferenced object 0xffff888119825c00 (size 256):
comm "python3", pid 279, jiffies 4294805921 (age 20.681s)
hex dump (first 32 bytes):
00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff .........^......
10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff .\.......\......
backtrace:
[<000000009990b438>] __kmalloc_node+0x44/0x1b0
[<000000009e32f7d7>] kvmalloc_node+0x34/0x180
[<0000000073d88e0b>] v4l2_ctrl_new.cold+0x19b/0x86f [videodev]
[<00000000b1f576fb>] v4l2_ctrl_new_std+0x16f/0x210 [videodev]
[<00000000caf7ac99>] ov772x_probe+0x1fa/0x68c [ov772x]
[<000000003f0d225e>] i2c_device_probe+0x28d/0x680
[<00000000e0b6db89>] really_probe+0x17c/0x3f0
[<000000001b19fcee>] __driver_probe_device+0xe3/0x170
[<0000000048370519>] driver_probe_device+0x49/0x120
[<000000005ead07a0>] __device_attach_driver+0xf7/0x150
[<0000000043f452b8>] bus_for_each_drv+0x114/0x180
[<00000000358e5596>] __device_attach+0x1e5/0x2d0
[<0000000043f83c5d>] bus_probe_device+0x126/0x140
[<00000000ee0f3046>] device_add+0x810/0x1130
[<00000000e0278184>] i2c_new_client_device+0x359/0x4f0
[<0000000070baf34f>] of_i2c_register_device+0xf1/0x110
The reason is that if priv->hdl.error is set, ov772x_probe() jumps to the
error_mutex_destroy without doing v4l2_ctrl_handler_free(), and all
resources allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std()
are leaked.
Fixes: 1112babde214 ("media: i2c: Copy ov772x soc_camera sensor driver")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov772x.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/media/i2c/ov772x.c b/drivers/media/i2c/ov772x.c
index 78602a2f70b0f..e05b48c90faed 100644
--- a/drivers/media/i2c/ov772x.c
+++ b/drivers/media/i2c/ov772x.c
@@ -1462,7 +1462,7 @@ static int ov772x_probe(struct i2c_client *client)
priv->subdev.ctrl_handler = &priv->hdl;
if (priv->hdl.error) {
ret = priv->hdl.error;
- goto error_mutex_destroy;
+ goto error_ctrl_free;
}
priv->clk = clk_get(&client->dev, NULL);
@@ -1515,7 +1515,6 @@ static int ov772x_probe(struct i2c_client *client)
clk_put(priv->clk);
error_ctrl_free:
v4l2_ctrl_handler_free(&priv->hdl);
-error_mutex_destroy:
mutex_destroy(&priv->lock);
return ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 355/567] media: i2c: imx219: Split common registers from mode tables
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 354/567] media: i2c: ov772x: Fix memleak in ov772x_probe() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 356/567] media: i2c: imx219: Fix binning for RAW8 capture Greg Kroah-Hartman
` (215 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Ford, Dave Stevenson,
Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
From: Adam Ford <aford173@gmail.com>
[ Upstream commit 8508455961d5a9e8907bcfd8dcd58f19d9b6ce47 ]
There are four modes, and each mode has a table of registers.
Some of the registers are common to all modes, so create new
tables for these common registers to reduce duplicate code.
Signed-off-by: Adam Ford <aford173@gmail.com>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Stable-dep-of: ef86447e775f ("media: i2c: imx219: Fix binning for RAW8 capture")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/imx219.c | 206 +++++++++++--------------------------
1 file changed, 59 insertions(+), 147 deletions(-)
diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
index e10af3f74b38f..faa5dab3c2ec8 100644
--- a/drivers/media/i2c/imx219.c
+++ b/drivers/media/i2c/imx219.c
@@ -145,23 +145,61 @@ struct imx219_mode {
struct imx219_reg_list reg_list;
};
-/*
- * Register sets lifted off the i2C interface from the Raspberry Pi firmware
- * driver.
- * 3280x2464 = mode 2, 1920x1080 = mode 1, 1640x1232 = mode 4, 640x480 = mode 7.
- */
-static const struct imx219_reg mode_3280x2464_regs[] = {
- {0x0100, 0x00},
+static const struct imx219_reg imx219_common_regs[] = {
+ {0x0100, 0x00}, /* Mode Select */
+
+ /* To Access Addresses 3000-5fff, send the following commands */
{0x30eb, 0x0c},
{0x30eb, 0x05},
{0x300a, 0xff},
{0x300b, 0xff},
{0x30eb, 0x05},
{0x30eb, 0x09},
- {0x0114, 0x01},
- {0x0128, 0x00},
- {0x012a, 0x18},
+
+ /* PLL Clock Table */
+ {0x0301, 0x05}, /* VTPXCK_DIV */
+ {0x0303, 0x01}, /* VTSYSCK_DIV */
+ {0x0304, 0x03}, /* PREPLLCK_VT_DIV 0x03 = AUTO set */
+ {0x0305, 0x03}, /* PREPLLCK_OP_DIV 0x03 = AUTO set */
+ {0x0306, 0x00}, /* PLL_VT_MPY */
+ {0x0307, 0x39},
+ {0x030b, 0x01}, /* OP_SYS_CLK_DIV */
+ {0x030c, 0x00}, /* PLL_OP_MPY */
+ {0x030d, 0x72},
+
+ /* Undocumented registers */
+ {0x455e, 0x00},
+ {0x471e, 0x4b},
+ {0x4767, 0x0f},
+ {0x4750, 0x14},
+ {0x4540, 0x00},
+ {0x47b4, 0x14},
+ {0x4713, 0x30},
+ {0x478b, 0x10},
+ {0x478f, 0x10},
+ {0x4793, 0x10},
+ {0x4797, 0x0e},
+ {0x479b, 0x0e},
+
+ /* Frame Bank Register Group "A" */
+ {0x0162, 0x0d}, /* Line_Length_A */
+ {0x0163, 0x78},
+ {0x0170, 0x01}, /* X_ODD_INC_A */
+ {0x0171, 0x01}, /* Y_ODD_INC_A */
+
+ /* Output setup registers */
+ {0x0114, 0x01}, /* CSI 2-Lane Mode */
+ {0x0128, 0x00}, /* DPHY Auto Mode */
+ {0x012a, 0x18}, /* EXCK_Freq */
{0x012b, 0x00},
+};
+
+/*
+ * Register sets lifted off the i2C interface from the Raspberry Pi firmware
+ * driver.
+ * 3280x2464 = mode 2, 1920x1080 = mode 1, 1640x1232 = mode 4, 640x480 = mode 7.
+ */
+static const struct imx219_reg mode_3280x2464_regs[] = {
{0x0164, 0x00},
{0x0165, 0x00},
{0x0166, 0x0c},
@@ -174,53 +212,15 @@ static const struct imx219_reg mode_3280x2464_regs[] = {
{0x016d, 0xd0},
{0x016e, 0x09},
{0x016f, 0xa0},
- {0x0170, 0x01},
- {0x0171, 0x01},
- {0x0174, 0x00},
+ {0x0174, 0x00}, /* No-Binning */
{0x0175, 0x00},
- {0x0301, 0x05},
- {0x0303, 0x01},
- {0x0304, 0x03},
- {0x0305, 0x03},
- {0x0306, 0x00},
- {0x0307, 0x39},
- {0x030b, 0x01},
- {0x030c, 0x00},
- {0x030d, 0x72},
{0x0624, 0x0c},
{0x0625, 0xd0},
{0x0626, 0x09},
{0x0627, 0xa0},
- {0x455e, 0x00},
- {0x471e, 0x4b},
- {0x4767, 0x0f},
- {0x4750, 0x14},
- {0x4540, 0x00},
- {0x47b4, 0x14},
- {0x4713, 0x30},
- {0x478b, 0x10},
- {0x478f, 0x10},
- {0x4793, 0x10},
- {0x4797, 0x0e},
- {0x479b, 0x0e},
- {0x0162, 0x0d},
- {0x0163, 0x78},
};
static const struct imx219_reg mode_1920_1080_regs[] = {
- {0x0100, 0x00},
- {0x30eb, 0x05},
- {0x30eb, 0x0c},
- {0x300a, 0xff},
- {0x300b, 0xff},
- {0x30eb, 0x05},
- {0x30eb, 0x09},
- {0x0114, 0x01},
- {0x0128, 0x00},
- {0x012a, 0x18},
- {0x012b, 0x00},
- {0x0162, 0x0d},
- {0x0163, 0x78},
{0x0164, 0x02},
{0x0165, 0xa8},
{0x0166, 0x0a},
@@ -233,49 +233,15 @@ static const struct imx219_reg mode_1920_1080_regs[] = {
{0x016d, 0x80},
{0x016e, 0x04},
{0x016f, 0x38},
- {0x0170, 0x01},
- {0x0171, 0x01},
- {0x0174, 0x00},
+ {0x0174, 0x00}, /* No-Binning */
{0x0175, 0x00},
- {0x0301, 0x05},
- {0x0303, 0x01},
- {0x0304, 0x03},
- {0x0305, 0x03},
- {0x0306, 0x00},
- {0x0307, 0x39},
- {0x030b, 0x01},
- {0x030c, 0x00},
- {0x030d, 0x72},
{0x0624, 0x07},
{0x0625, 0x80},
{0x0626, 0x04},
{0x0627, 0x38},
- {0x455e, 0x00},
- {0x471e, 0x4b},
- {0x4767, 0x0f},
- {0x4750, 0x14},
- {0x4540, 0x00},
- {0x47b4, 0x14},
- {0x4713, 0x30},
- {0x478b, 0x10},
- {0x478f, 0x10},
- {0x4793, 0x10},
- {0x4797, 0x0e},
- {0x479b, 0x0e},
};
static const struct imx219_reg mode_1640_1232_regs[] = {
- {0x0100, 0x00},
- {0x30eb, 0x0c},
- {0x30eb, 0x05},
- {0x300a, 0xff},
- {0x300b, 0xff},
- {0x30eb, 0x05},
- {0x30eb, 0x09},
- {0x0114, 0x01},
- {0x0128, 0x00},
- {0x012a, 0x18},
- {0x012b, 0x00},
{0x0164, 0x00},
{0x0165, 0x00},
{0x0166, 0x0c},
@@ -288,53 +254,15 @@ static const struct imx219_reg mode_1640_1232_regs[] = {
{0x016d, 0x68},
{0x016e, 0x04},
{0x016f, 0xd0},
- {0x0170, 0x01},
- {0x0171, 0x01},
- {0x0174, 0x01},
+ {0x0174, 0x01}, /* x2-Binning */
{0x0175, 0x01},
- {0x0301, 0x05},
- {0x0303, 0x01},
- {0x0304, 0x03},
- {0x0305, 0x03},
- {0x0306, 0x00},
- {0x0307, 0x39},
- {0x030b, 0x01},
- {0x030c, 0x00},
- {0x030d, 0x72},
{0x0624, 0x06},
{0x0625, 0x68},
{0x0626, 0x04},
{0x0627, 0xd0},
- {0x455e, 0x00},
- {0x471e, 0x4b},
- {0x4767, 0x0f},
- {0x4750, 0x14},
- {0x4540, 0x00},
- {0x47b4, 0x14},
- {0x4713, 0x30},
- {0x478b, 0x10},
- {0x478f, 0x10},
- {0x4793, 0x10},
- {0x4797, 0x0e},
- {0x479b, 0x0e},
- {0x0162, 0x0d},
- {0x0163, 0x78},
};
static const struct imx219_reg mode_640_480_regs[] = {
- {0x0100, 0x00},
- {0x30eb, 0x05},
- {0x30eb, 0x0c},
- {0x300a, 0xff},
- {0x300b, 0xff},
- {0x30eb, 0x05},
- {0x30eb, 0x09},
- {0x0114, 0x01},
- {0x0128, 0x00},
- {0x012a, 0x18},
- {0x012b, 0x00},
- {0x0162, 0x0d},
- {0x0163, 0x78},
{0x0164, 0x03},
{0x0165, 0xe8},
{0x0166, 0x08},
@@ -347,35 +275,12 @@ static const struct imx219_reg mode_640_480_regs[] = {
{0x016d, 0x80},
{0x016e, 0x01},
{0x016f, 0xe0},
- {0x0170, 0x01},
- {0x0171, 0x01},
- {0x0174, 0x03},
+ {0x0174, 0x03}, /* x2-analog binning */
{0x0175, 0x03},
- {0x0301, 0x05},
- {0x0303, 0x01},
- {0x0304, 0x03},
- {0x0305, 0x03},
- {0x0306, 0x00},
- {0x0307, 0x39},
- {0x030b, 0x01},
- {0x030c, 0x00},
- {0x030d, 0x72},
{0x0624, 0x06},
{0x0625, 0x68},
{0x0626, 0x04},
{0x0627, 0xd0},
- {0x455e, 0x00},
- {0x471e, 0x4b},
- {0x4767, 0x0f},
- {0x4750, 0x14},
- {0x4540, 0x00},
- {0x47b4, 0x14},
- {0x4713, 0x30},
- {0x478b, 0x10},
- {0x478f, 0x10},
- {0x4793, 0x10},
- {0x4797, 0x0e},
- {0x479b, 0x0e},
};
static const struct imx219_reg raw8_framefmt_regs[] = {
@@ -1041,6 +946,13 @@ static int imx219_start_streaming(struct imx219 *imx219)
if (ret < 0)
return ret;
+ /* Send all registers that are common to all modes */
+ ret = imx219_write_regs(imx219, imx219_common_regs, ARRAY_SIZE(imx219_common_regs));
+ if (ret) {
+ dev_err(&client->dev, "%s failed to send mfg header\n", __func__);
+ goto err_rpm_put;
+ }
+
/* Apply default values of current mode */
reg_list = &imx219->mode->reg_list;
ret = imx219_write_regs(imx219, reg_list->regs, reg_list->num_of_regs);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 356/567] media: i2c: imx219: Fix binning for RAW8 capture
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 355/567] media: i2c: imx219: Split common registers from mode tables Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 357/567] media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data Greg Kroah-Hartman
` (214 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jai Luthra, Dave Stevenson,
Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
From: Jai Luthra <j-luthra@ti.com>
[ Upstream commit ef86447e775fb1f2ced00d4c7fff2c0a1c63f165 ]
2x2 binning works fine for RAW10 capture, but for RAW8 1232p mode it
leads to corrupted frames [1][2].
Using the special 2x2 analog binning mode fixes the issue, but causes
artefacts for RAW10 1232p capture. So here we choose the binning mode
depending upon the frame format selected.
As both binning modes work fine for 480p RAW8 and RAW10 capture, it can
share the same code path as 1232p for selecting binning mode.
[1] https://forums.raspberrypi.com/viewtopic.php?t=332103
[2] https://github.com/raspberrypi/libcamera-apps/issues/281
Fixes: 22da1d56e982 ("media: i2c: imx219: Add support for RAW8 bit bayer format")
Signed-off-by: Jai Luthra <j-luthra@ti.com>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/imx219.c | 57 ++++++++++++++++++++++++++++++++------
1 file changed, 49 insertions(+), 8 deletions(-)
diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c
index faa5dab3c2ec8..de1f0aa6fff4a 100644
--- a/drivers/media/i2c/imx219.c
+++ b/drivers/media/i2c/imx219.c
@@ -89,6 +89,12 @@
#define IMX219_REG_ORIENTATION 0x0172
+/* Binning Mode */
+#define IMX219_REG_BINNING_MODE 0x0174
+#define IMX219_BINNING_NONE 0x0000
+#define IMX219_BINNING_2X2 0x0101
+#define IMX219_BINNING_2X2_ANALOG 0x0303
+
/* Test Pattern Control */
#define IMX219_REG_TEST_PATTERN 0x0600
#define IMX219_TEST_PATTERN_DISABLE 0
@@ -143,6 +149,9 @@ struct imx219_mode {
/* Default register values */
struct imx219_reg_list reg_list;
+
+ /* 2x2 binning is used */
+ bool binning;
};
static const struct imx219_reg imx219_common_regs[] = {
@@ -212,8 +221,6 @@ static const struct imx219_reg mode_3280x2464_regs[] = {
{0x016d, 0xd0},
{0x016e, 0x09},
{0x016f, 0xa0},
- {0x0174, 0x00}, /* No-Binning */
- {0x0175, 0x00},
{0x0624, 0x0c},
{0x0625, 0xd0},
{0x0626, 0x09},
@@ -233,8 +240,6 @@ static const struct imx219_reg mode_1920_1080_regs[] = {
{0x016d, 0x80},
{0x016e, 0x04},
{0x016f, 0x38},
- {0x0174, 0x00}, /* No-Binning */
- {0x0175, 0x00},
{0x0624, 0x07},
{0x0625, 0x80},
{0x0626, 0x04},
@@ -254,8 +259,6 @@ static const struct imx219_reg mode_1640_1232_regs[] = {
{0x016d, 0x68},
{0x016e, 0x04},
{0x016f, 0xd0},
- {0x0174, 0x01}, /* x2-Binning */
- {0x0175, 0x01},
{0x0624, 0x06},
{0x0625, 0x68},
{0x0626, 0x04},
@@ -275,8 +278,6 @@ static const struct imx219_reg mode_640_480_regs[] = {
{0x016d, 0x80},
{0x016e, 0x01},
{0x016f, 0xe0},
- {0x0174, 0x03}, /* x2-analog binning */
- {0x0175, 0x03},
{0x0624, 0x06},
{0x0625, 0x68},
{0x0626, 0x04},
@@ -390,6 +391,7 @@ static const struct imx219_mode supported_modes[] = {
.num_of_regs = ARRAY_SIZE(mode_3280x2464_regs),
.regs = mode_3280x2464_regs,
},
+ .binning = false,
},
{
/* 1080P 30fps cropped */
@@ -406,6 +408,7 @@ static const struct imx219_mode supported_modes[] = {
.num_of_regs = ARRAY_SIZE(mode_1920_1080_regs),
.regs = mode_1920_1080_regs,
},
+ .binning = false,
},
{
/* 2x2 binned 30fps mode */
@@ -422,6 +425,7 @@ static const struct imx219_mode supported_modes[] = {
.num_of_regs = ARRAY_SIZE(mode_1640_1232_regs),
.regs = mode_1640_1232_regs,
},
+ .binning = true,
},
{
/* 640x480 30fps mode */
@@ -438,6 +442,7 @@ static const struct imx219_mode supported_modes[] = {
.num_of_regs = ARRAY_SIZE(mode_640_480_regs),
.regs = mode_640_480_regs,
},
+ .binning = true,
},
};
@@ -884,6 +889,35 @@ static int imx219_set_framefmt(struct imx219 *imx219)
return -EINVAL;
}
+static int imx219_set_binning(struct imx219 *imx219)
+{
+ if (!imx219->mode->binning) {
+ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE,
+ IMX219_REG_VALUE_16BIT,
+ IMX219_BINNING_NONE);
+ }
+
+ switch (imx219->fmt.code) {
+ case MEDIA_BUS_FMT_SRGGB8_1X8:
+ case MEDIA_BUS_FMT_SGRBG8_1X8:
+ case MEDIA_BUS_FMT_SGBRG8_1X8:
+ case MEDIA_BUS_FMT_SBGGR8_1X8:
+ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE,
+ IMX219_REG_VALUE_16BIT,
+ IMX219_BINNING_2X2_ANALOG);
+
+ case MEDIA_BUS_FMT_SRGGB10_1X10:
+ case MEDIA_BUS_FMT_SGRBG10_1X10:
+ case MEDIA_BUS_FMT_SGBRG10_1X10:
+ case MEDIA_BUS_FMT_SBGGR10_1X10:
+ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE,
+ IMX219_REG_VALUE_16BIT,
+ IMX219_BINNING_2X2);
+ }
+
+ return -EINVAL;
+}
+
static const struct v4l2_rect *
__imx219_get_pad_crop(struct imx219 *imx219,
struct v4l2_subdev_state *sd_state,
@@ -968,6 +1002,13 @@ static int imx219_start_streaming(struct imx219 *imx219)
goto err_rpm_put;
}
+ ret = imx219_set_binning(imx219);
+ if (ret) {
+ dev_err(&client->dev, "%s failed to set binning: %d\n",
+ __func__, ret);
+ goto err_rpm_put;
+ }
+
/* Apply customized values from user */
ret = __v4l2_ctrl_handler_setup(imx219->sd.ctrl_handler);
if (ret)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 357/567] media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 356/567] media: i2c: imx219: Fix binning for RAW8 capture Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 358/567] media: v4l2-jpeg: ignore the unknown APP14 marker Greg Kroah-Hartman
` (213 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming Qian, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Ming Qian <ming.qian@nxp.com>
[ Upstream commit 41959c4f973b837a12061b84d3a436fc64c73a30 ]
The curr pointer has advanced 14 bytes in jpeg_parse_app14_data.
1. jpeg_get_word_be(stream), it goes forward 2 bytes.
2. jpeg_skip(stream, 11), it goes forward 11 bytes.
3. jpeg_get_byte(stream), it goes forward 1 bytes.
so the remain bytes of this segment should be (lp - 2 - 11 - 1),
but not (lp - 2 - 11).
if driver skip 1 extra bytes, the following parsing may go wrong.
Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-jpeg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c
index c2513b775f6a7..75c2af763d55e 100644
--- a/drivers/media/v4l2-core/v4l2-jpeg.c
+++ b/drivers/media/v4l2-core/v4l2-jpeg.c
@@ -474,7 +474,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream,
*tf = ret;
/* skip the rest of the segment, this ensures at least it is complete */
- skip = lp - 2 - 11;
+ skip = lp - 2 - 11 - 1;
return jpeg_skip(stream, skip);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 358/567] media: v4l2-jpeg: ignore the unknown APP14 marker
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 357/567] media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 359/567] media: imx-jpeg: Apply clk_bulk api instead of operating specific clk Greg Kroah-Hartman
` (212 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming Qian, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Ming Qian <ming.qian@nxp.com>
[ Upstream commit 251c0ea6efd3c3ea0f8a55fdd96c749a98639bd3 ]
The legal identifier of APP14 is "Adobe\0",
but sometimes it may be
"This is an unknown APP marker . Compliant decoders must ignore it."
In this case, just ignore it.
It won't affect the decode result.
Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-jpeg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c
index 75c2af763d55e..94435a7b68169 100644
--- a/drivers/media/v4l2-core/v4l2-jpeg.c
+++ b/drivers/media/v4l2-core/v4l2-jpeg.c
@@ -460,7 +460,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream,
/* Check for "Adobe\0" in Ap1..6 */
if (stream->curr + 6 > stream->end ||
strncmp(stream->curr, "Adobe\0", 6))
- return -EINVAL;
+ return jpeg_skip(stream, lp - 2);
/* get to Ap12 */
ret = jpeg_skip(stream, 11);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 359/567] media: imx-jpeg: Apply clk_bulk api instead of operating specific clk
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 358/567] media: v4l2-jpeg: ignore the unknown APP14 marker Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 360/567] media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() Greg Kroah-Hartman
` (211 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming Qian, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Ming Qian <ming.qian@nxp.com>
[ Upstream commit 61fe43dc9f454bc3caa99dbdd8f5fa3ba813981a ]
using the api of clk_bulk can simplify the code.
and the clock of the jpeg codec may be changed,
the clk_bulk api can be compatible with the future change.
Fixes: 4c2e5156d9fa ("media: imx-jpeg: Add pm-runtime support for imx-jpeg")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/imx-jpeg/mxc-jpeg.c | 35 +++++-----------------
drivers/media/platform/imx-jpeg/mxc-jpeg.h | 4 +--
2 files changed, 10 insertions(+), 29 deletions(-)
diff --git a/drivers/media/platform/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/imx-jpeg/mxc-jpeg.c
index 984fcdfa0f098..e515325683a47 100644
--- a/drivers/media/platform/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/imx-jpeg/mxc-jpeg.c
@@ -2105,19 +2105,12 @@ static int mxc_jpeg_probe(struct platform_device *pdev)
jpeg->mode = mode;
/* Get clocks */
- jpeg->clk_ipg = devm_clk_get(dev, "ipg");
- if (IS_ERR(jpeg->clk_ipg)) {
- dev_err(dev, "failed to get clock: ipg\n");
- ret = PTR_ERR(jpeg->clk_ipg);
- goto err_clk;
- }
-
- jpeg->clk_per = devm_clk_get(dev, "per");
- if (IS_ERR(jpeg->clk_per)) {
- dev_err(dev, "failed to get clock: per\n");
- ret = PTR_ERR(jpeg->clk_per);
+ ret = devm_clk_bulk_get_all(&pdev->dev, &jpeg->clks);
+ if (ret < 0) {
+ dev_err(dev, "failed to get clock\n");
goto err_clk;
}
+ jpeg->num_clks = ret;
ret = mxc_jpeg_attach_pm_domains(jpeg);
if (ret < 0) {
@@ -2214,32 +2207,20 @@ static int mxc_jpeg_runtime_resume(struct device *dev)
struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev);
int ret;
- ret = clk_prepare_enable(jpeg->clk_ipg);
- if (ret < 0) {
- dev_err(dev, "failed to enable clock: ipg\n");
- goto err_ipg;
- }
-
- ret = clk_prepare_enable(jpeg->clk_per);
+ ret = clk_bulk_prepare_enable(jpeg->num_clks, jpeg->clks);
if (ret < 0) {
- dev_err(dev, "failed to enable clock: per\n");
- goto err_per;
+ dev_err(dev, "failed to enable clock\n");
+ return ret;
}
return 0;
-
-err_per:
- clk_disable_unprepare(jpeg->clk_ipg);
-err_ipg:
- return ret;
}
static int mxc_jpeg_runtime_suspend(struct device *dev)
{
struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev);
- clk_disable_unprepare(jpeg->clk_ipg);
- clk_disable_unprepare(jpeg->clk_per);
+ clk_bulk_disable_unprepare(jpeg->num_clks, jpeg->clks);
return 0;
}
diff --git a/drivers/media/platform/imx-jpeg/mxc-jpeg.h b/drivers/media/platform/imx-jpeg/mxc-jpeg.h
index 542993eb8d5b0..495000800d552 100644
--- a/drivers/media/platform/imx-jpeg/mxc-jpeg.h
+++ b/drivers/media/platform/imx-jpeg/mxc-jpeg.h
@@ -112,8 +112,8 @@ struct mxc_jpeg_dev {
spinlock_t hw_lock; /* hardware access lock */
unsigned int mode;
struct mutex lock; /* v4l2 ioctls serialization */
- struct clk *clk_ipg;
- struct clk *clk_per;
+ struct clk_bulk_data *clks;
+ int num_clks;
struct platform_device *pdev;
struct device *dev;
void __iomem *base_reg;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 360/567] media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 359/567] media: imx-jpeg: Apply clk_bulk api instead of operating specific clk Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 361/567] media: i2c: ov7670: 0 instead of -EINVAL was returned Greg Kroah-Hartman
` (210 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Duoming Zhou, Sean Young,
Mauro Carvalho Chehab, Sasha Levin
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit 29b0589a865b6f66d141d79b2dd1373e4e50fe17 ]
When the ene device is detaching, function ene_remove() will
be called. But there is no function to cancel tx_sim_timer
in ene_remove(), the timer handler ene_tx_irqsim() could race
with ene_remove(). As a result, the UAF bugs could happen,
the process is shown below.
(cleanup routine) | (timer routine)
| mod_timer(&dev->tx_sim_timer, ..)
ene_remove() | (wait a time)
| ene_tx_irqsim()
| dev->hw_lock //USE
| ene_tx_sample(dev) //USE
Fix by adding del_timer_sync(&dev->tx_sim_timer) in ene_remove(),
The tx_sim_timer could stop before ene device is deallocated.
What's more, The rc_unregister_device() and del_timer_sync()
should be called first in ene_remove() and the deallocated
functions such as free_irq(), release_region() and so on
should be called behind them. Because the rc_unregister_device()
is well synchronized. Otherwise, race conditions may happen. The
situations that may lead to race conditions are shown below.
Firstly, the rx receiver is disabled with ene_rx_disable()
before rc_unregister_device() in ene_remove(), which means it
can be enabled again if a process opens /dev/lirc0 between
ene_rx_disable() and rc_unregister_device().
Secondly, the irqaction descriptor is freed by free_irq()
before the rc device is unregistered, which means irqaction
descriptor may be accessed again after it is deallocated.
Thirdly, the timer can call ene_tx_sample() that can write
to the io ports, which means the io ports could be accessed
again after they are deallocated by release_region().
Therefore, the rc_unregister_device() and del_timer_sync()
should be called first in ene_remove().
Suggested by: Sean Young <sean@mess.org>
Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/ene_ir.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
index e09270916fbca..11ee21a7db8f0 100644
--- a/drivers/media/rc/ene_ir.c
+++ b/drivers/media/rc/ene_ir.c
@@ -1106,6 +1106,8 @@ static void ene_remove(struct pnp_dev *pnp_dev)
struct ene_device *dev = pnp_get_drvdata(pnp_dev);
unsigned long flags;
+ rc_unregister_device(dev->rdev);
+ del_timer_sync(&dev->tx_sim_timer);
spin_lock_irqsave(&dev->hw_lock, flags);
ene_rx_disable(dev);
ene_rx_restore_hw_buffer(dev);
@@ -1113,7 +1115,6 @@ static void ene_remove(struct pnp_dev *pnp_dev)
free_irq(dev->irq, dev);
release_region(dev->hw_io, ENE_IO_SIZE);
- rc_unregister_device(dev->rdev);
kfree(dev);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 361/567] media: i2c: ov7670: 0 instead of -EINVAL was returned
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 360/567] media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 362/567] media: usb: siano: Fix use after free bugs caused by do_submit_urb Greg Kroah-Hartman
` (209 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Sakari Ailus,
Mauro Carvalho Chehab, Sasha Levin
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 6a4c664539e6de9b32b65ddcf767ec1bcc1d7f8a ]
If the media bus is unsupported, then return -EINVAL. Instead it
returned 'ret' which happened to be 0.
This fixes a smatch warning:
ov7670.c:1843 ov7670_parse_dt() warn: missing error code? 'ret'
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 01b8444828fc ("media: v4l2: i2c: ov7670: Implement OF mbus configuration")
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov7670.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
index 1be2c0e5bdc15..23001ede138c1 100644
--- a/drivers/media/i2c/ov7670.c
+++ b/drivers/media/i2c/ov7670.c
@@ -1841,7 +1841,7 @@ static int ov7670_parse_dt(struct device *dev,
if (bus_cfg.bus_type != V4L2_MBUS_PARALLEL) {
dev_err(dev, "Unsupported media bus type\n");
- return ret;
+ return -EINVAL;
}
info->mbus_config = bus_cfg.bus.parallel.flags;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 362/567] media: usb: siano: Fix use after free bugs caused by do_submit_urb
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 361/567] media: i2c: ov7670: 0 instead of -EINVAL was returned Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 363/567] media: saa7134: Use video_unregister_device for radio_dev Greg Kroah-Hartman
` (208 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Duoming Zhou, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit ebad8e731c1c06adf04621d6fd327b860c0861b5 ]
There are UAF bugs caused by do_submit_urb(). One of the KASan reports
is shown below:
[ 36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890
[ 36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49
[ 36.408316]
[ 36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8
[ 36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584
[ 36.416157] Workqueue: 0x0 (events)
[ 36.417654] Call Trace:
[ 36.418546] <TASK>
[ 36.419320] dump_stack_lvl+0x96/0xd0
[ 36.420522] print_address_description+0x75/0x350
[ 36.421992] print_report+0x11b/0x250
[ 36.423174] ? _raw_spin_lock_irqsave+0x87/0xd0
[ 36.424806] ? __virt_addr_valid+0xcf/0x170
[ 36.426069] ? worker_thread+0x4a2/0x890
[ 36.427355] kasan_report+0x131/0x160
[ 36.428556] ? worker_thread+0x4a2/0x890
[ 36.430053] worker_thread+0x4a2/0x890
[ 36.431297] ? worker_clr_flags+0x90/0x90
[ 36.432479] kthread+0x166/0x190
[ 36.433493] ? kthread_blkcg+0x50/0x50
[ 36.434669] ret_from_fork+0x22/0x30
[ 36.435923] </TASK>
[ 36.436684]
[ 36.437215] Allocated by task 24:
[ 36.438289] kasan_set_track+0x50/0x80
[ 36.439436] __kasan_kmalloc+0x89/0xa0
[ 36.440566] smsusb_probe+0x374/0xc90
[ 36.441920] usb_probe_interface+0x2d1/0x4c0
[ 36.443253] really_probe+0x1d5/0x580
[ 36.444539] __driver_probe_device+0xe3/0x130
[ 36.446085] driver_probe_device+0x49/0x220
[ 36.447423] __device_attach_driver+0x19e/0x1b0
[ 36.448931] bus_for_each_drv+0xcb/0x110
[ 36.450217] __device_attach+0x132/0x1f0
[ 36.451470] bus_probe_device+0x59/0xf0
[ 36.452563] device_add+0x4ec/0x7b0
[ 36.453830] usb_set_configuration+0xc63/0xe10
[ 36.455230] usb_generic_driver_probe+0x3b/0x80
[ 36.456166] printk: console [ttyGS0] disabled
[ 36.456569] usb_probe_device+0x90/0x110
[ 36.459523] really_probe+0x1d5/0x580
[ 36.461027] __driver_probe_device+0xe3/0x130
[ 36.462465] driver_probe_device+0x49/0x220
[ 36.463847] __device_attach_driver+0x19e/0x1b0
[ 36.465229] bus_for_each_drv+0xcb/0x110
[ 36.466466] __device_attach+0x132/0x1f0
[ 36.467799] bus_probe_device+0x59/0xf0
[ 36.469010] device_add+0x4ec/0x7b0
[ 36.470125] usb_new_device+0x863/0xa00
[ 36.471374] hub_event+0x18c7/0x2220
[ 36.472746] process_one_work+0x34c/0x5b0
[ 36.474041] worker_thread+0x4b7/0x890
[ 36.475216] kthread+0x166/0x190
[ 36.476267] ret_from_fork+0x22/0x30
[ 36.477447]
[ 36.478160] Freed by task 24:
[ 36.479239] kasan_set_track+0x50/0x80
[ 36.480512] kasan_save_free_info+0x2b/0x40
[ 36.481808] ____kasan_slab_free+0x122/0x1a0
[ 36.483173] __kmem_cache_free+0xc4/0x200
[ 36.484563] smsusb_term_device+0xcd/0xf0
[ 36.485896] smsusb_probe+0xc85/0xc90
[ 36.486976] usb_probe_interface+0x2d1/0x4c0
[ 36.488303] really_probe+0x1d5/0x580
[ 36.489498] __driver_probe_device+0xe3/0x130
[ 36.491140] driver_probe_device+0x49/0x220
[ 36.492475] __device_attach_driver+0x19e/0x1b0
[ 36.493988] bus_for_each_drv+0xcb/0x110
[ 36.495171] __device_attach+0x132/0x1f0
[ 36.496617] bus_probe_device+0x59/0xf0
[ 36.497875] device_add+0x4ec/0x7b0
[ 36.498972] usb_set_configuration+0xc63/0xe10
[ 36.500264] usb_generic_driver_probe+0x3b/0x80
[ 36.501740] usb_probe_device+0x90/0x110
[ 36.503084] really_probe+0x1d5/0x580
[ 36.504241] __driver_probe_device+0xe3/0x130
[ 36.505548] driver_probe_device+0x49/0x220
[ 36.506766] __device_attach_driver+0x19e/0x1b0
[ 36.508368] bus_for_each_drv+0xcb/0x110
[ 36.509646] __device_attach+0x132/0x1f0
[ 36.510911] bus_probe_device+0x59/0xf0
[ 36.512103] device_add+0x4ec/0x7b0
[ 36.513215] usb_new_device+0x863/0xa00
[ 36.514736] hub_event+0x18c7/0x2220
[ 36.516130] process_one_work+0x34c/0x5b0
[ 36.517396] worker_thread+0x4b7/0x890
[ 36.518591] kthread+0x166/0x190
[ 36.519599] ret_from_fork+0x22/0x30
[ 36.520851]
[ 36.521405] Last potentially related work creation:
[ 36.523143] kasan_save_stack+0x3f/0x60
[ 36.524275] kasan_record_aux_stack_noalloc+0x9d/0xb0
[ 36.525831] insert_work+0x25/0x130
[ 36.527039] __queue_work+0x4d4/0x620
[ 36.528236] queue_work_on+0x72/0xb0
[ 36.529344] __usb_hcd_giveback_urb+0x13f/0x1b0
[ 36.530819] dummy_timer+0x350/0x1a40
[ 36.532149] call_timer_fn+0x2c/0x190
[ 36.533567] expire_timers+0x69/0x1f0
[ 36.534736] __run_timers+0x289/0x2d0
[ 36.535841] run_timer_softirq+0x2d/0x60
[ 36.537110] __do_softirq+0x116/0x380
[ 36.538377]
[ 36.538950] Second to last potentially related work creation:
[ 36.540855] kasan_save_stack+0x3f/0x60
[ 36.542084] kasan_record_aux_stack_noalloc+0x9d/0xb0
[ 36.543592] insert_work+0x25/0x130
[ 36.544891] __queue_work+0x4d4/0x620
[ 36.546168] queue_work_on+0x72/0xb0
[ 36.547328] __usb_hcd_giveback_urb+0x13f/0x1b0
[ 36.548805] dummy_timer+0x350/0x1a40
[ 36.550116] call_timer_fn+0x2c/0x190
[ 36.551570] expire_timers+0x69/0x1f0
[ 36.552762] __run_timers+0x289/0x2d0
[ 36.553916] run_timer_softirq+0x2d/0x60
[ 36.555118] __do_softirq+0x116/0x380
[ 36.556239]
[ 36.556807] The buggy address belongs to the object at ffff888005960000
[ 36.556807] which belongs to the cache kmalloc-4k of size 4096
[ 36.560652] The buggy address is located 232 bytes inside of
[ 36.560652] 4096-byte region [ffff888005960000, ffff888005961000)
[ 36.564791]
[ 36.565355] The buggy address belongs to the physical page:
[ 36.567212] page:000000004f0a0731 refcount:1 mapcount:0 mapping:0000000000000000 index:0x00
[ 36.570534] head:000000004f0a0731 order:3 compound_mapcount:0 subpages_mapcount:0 compound0
[ 36.573717] flags: 0x100000000010200(slab|head|node=0|zone=1)
[ 36.575481] raw: 0100000000010200 ffff888001042140 dead000000000122 0000000000000000
[ 36.577842] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
[ 36.580175] page dumped because: kasan: bad access detected
[ 36.581994]
[ 36.582548] Memory state around the buggy address:
[ 36.583983] ffff88800595ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 36.586240] ffff888005960000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 36.588884] >ffff888005960080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 36.591071] ^
[ 36.593295] ffff888005960100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 36.595705] ffff888005960180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 36.598026] ==================================================================
[ 36.600224] Disabling lock debugging due to kernel taint
[ 36.602681] general protection fault, probably for non-canonical address 0x43600a000000060I
[ 36.607129] CPU: 0 PID: 49 Comm: kworker/0:2 Tainted: G B 6.2.0-rc3-15798-8
[ 36.611115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584
[ 36.615026] Workqueue: events do_submit_urb
[ 36.616290] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0
[ 36.618107] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5
[ 36.623522] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046
[ 36.625072] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7
[ 36.627206] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0
[ 36.629813] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f
[ 36.631974] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020
[ 36.634285] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001
[ 36.636438] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
[ 36.639092] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 36.640951] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0
[ 36.643411] Call Trace:
[ 36.644215] <TASK>
[ 36.644902] smscore_getbuffer+0x3e/0x1e0
[ 36.646147] do_submit_urb+0x4f/0x190
[ 36.647449] process_one_work+0x34c/0x5b0
[ 36.648777] worker_thread+0x4b7/0x890
[ 36.649984] ? worker_clr_flags+0x90/0x90
[ 36.651166] kthread+0x166/0x190
[ 36.652151] ? kthread_blkcg+0x50/0x50
[ 36.653547] ret_from_fork+0x22/0x30
[ 36.655051] </TASK>
[ 36.655733] Modules linked in:
[ 36.656787] ---[ end trace 0000000000000000 ]---
[ 36.658328] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0
[ 36.660045] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5
[ 36.665730] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046
[ 36.667448] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7
[ 36.669675] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0
[ 36.672645] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f
[ 36.674921] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020
[ 36.677034] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001
[ 36.679184] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000
[ 36.681655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 36.683383] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0
[ 36.685733] Kernel panic - not syncing: Fatal exception
[ 36.688585] Kernel Offset: 0x1d400000 from 0xffffffff81000000 (relocation range: 0xfffffff)
[ 36.692199] ---[ end Kernel panic - not syncing: Fatal exception ]---
When the siano device is plugged in, it may call the following functions
to initialize the device.
smsusb_probe()-->smsusb_init_device()-->smscore_start_device().
When smscore_start_device() gets failed, the function smsusb_term_device()
will be called and smsusb_device_t will be deallocated. Although we use
usb_kill_urb() in smsusb_stop_streaming() to cancel transfer requests
and wait for them to finish, the worker threads that are scheduled by
smsusb_onresponse() may be still running. As a result, the UAF bugs
could happen.
We add cancel_work_sync() in smsusb_stop_streaming() in order that the
worker threads could finish before the smsusb_device_t is deallocated.
Fixes: dd47fbd40e6e ("[media] smsusb: don't sleep while atomic")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/siano/smsusb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
index df4c5dcba39cd..1babfe6e2c361 100644
--- a/drivers/media/usb/siano/smsusb.c
+++ b/drivers/media/usb/siano/smsusb.c
@@ -179,6 +179,7 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)
for (i = 0; i < MAX_URBS; i++) {
usb_kill_urb(&dev->surbs[i].urb);
+ cancel_work_sync(&dev->surbs[i].wq);
if (dev->surbs[i].cb) {
smscore_putbuffer(dev->coredev, dev->surbs[i].cb);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 363/567] media: saa7134: Use video_unregister_device for radio_dev
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 362/567] media: usb: siano: Fix use after free bugs caused by do_submit_urb Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 364/567] rpmsg: glink: Avoid infinite loop on intent for missing channel Greg Kroah-Hartman
` (207 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tasos Sahanidis, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Tasos Sahanidis <tasos@tasossah.com>
[ Upstream commit bc7635c6435c77a0c168e2cc6535740adfaff4e4 ]
The radio device doesn't use vb2, thus calling vb2_video_unregister_device()
which results in the following warning being printed on module unload.
WARNING: CPU: 1 PID: 215963 at drivers/media/common/videobuf2/videobuf2-v4l2.c:1236 vb2_video_unregister_device+0xc6/0xe0 [videobuf2_v4l2]
Fixes: 11788d9b7e91 ("media: media/pci: use vb2_video_unregister_device()")
Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/saa7134/saa7134-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c
index 96328b0af1641..cf2871306987c 100644
--- a/drivers/media/pci/saa7134/saa7134-core.c
+++ b/drivers/media/pci/saa7134/saa7134-core.c
@@ -978,7 +978,7 @@ static void saa7134_unregister_video(struct saa7134_dev *dev)
}
if (dev->radio_dev) {
if (video_is_registered(dev->radio_dev))
- vb2_video_unregister_device(dev->radio_dev);
+ video_unregister_device(dev->radio_dev);
else
video_device_release(dev->radio_dev);
dev->radio_dev = NULL;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 364/567] rpmsg: glink: Avoid infinite loop on intent for missing channel
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 363/567] media: saa7134: Use video_unregister_device for radio_dev Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 365/567] udf: Define EFSCORRUPTED error code Greg Kroah-Hartman
` (206 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Andersson, Chris Lew,
Bjorn Andersson, Sasha Levin
From: Bjorn Andersson <quic_bjorande@quicinc.com>
[ Upstream commit 3e74ec2f39362bffbd42854acbb67c7f4cb808f9 ]
In the event that an intent advertisement arrives on an unknown channel
the fifo is not advanced, resulting in the same message being handled
over and over.
Fixes: dacbb35e930f ("rpmsg: glink: Receive and store the remote intent buffers")
Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
Reviewed-by: Chris Lew <quic_clew@quicinc.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230214234231.2069751-1-quic_bjorande@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rpmsg/qcom_glink_native.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 13c31372337a2..fd4c2f0fa4b1f 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -929,6 +929,7 @@ static void qcom_glink_handle_intent(struct qcom_glink *glink,
spin_unlock_irqrestore(&glink->idr_lock, flags);
if (!channel) {
dev_err(glink->dev, "intents for non-existing channel\n");
+ qcom_glink_rx_advance(glink, ALIGN(msglen, 8));
return;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 365/567] udf: Define EFSCORRUPTED error code
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 364/567] rpmsg: glink: Avoid infinite loop on intent for missing channel Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 366/567] ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy Greg Kroah-Hartman
` (205 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Sasha Levin
From: Jan Kara <jack@suse.cz>
[ Upstream commit 3d2d7e61553dbcc8ba45201d8ae4f383742c8202 ]
Similarly to other filesystems define EFSCORRUPTED error code for
reporting internal filesystem corruption.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/udf_sb.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
index 4fa620543d302..2205859731dc2 100644
--- a/fs/udf/udf_sb.h
+++ b/fs/udf/udf_sb.h
@@ -51,6 +51,8 @@
#define MF_DUPLICATE_MD 0x01
#define MF_MIRROR_FE_LOADED 0x02
+#define EFSCORRUPTED EUCLEAN
+
struct udf_meta_data {
__u32 s_meta_file_loc;
__u32 s_mirror_file_loc;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 366/567] ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 365/567] udf: Define EFSCORRUPTED error code Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 367/567] blk-iocost: fix divide by 0 error in calc_lcoefs() Greg Kroah-Hartman
` (204 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Markuss Broks, Krzysztof Kozlowski,
Sasha Levin
From: Markuss Broks <markuss.broks@gmail.com>
[ Upstream commit 5d5aa219a790d61cad2c38e1aa32058f16ad2f0b ]
For some reason, the driver adding support for Exynos5420 MIPI phy
back in 2016 wasn't used on Exynos5420, which caused a kernel panic.
Add the proper compatible for it.
Signed-off-by: Markuss Broks <markuss.broks@gmail.com>
Link: https://lore.kernel.org/r/20230121201844.46872-2-markuss.broks@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/exynos5420.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
index e23e8ffb093fa..4fb4804830afe 100644
--- a/arch/arm/boot/dts/exynos5420.dtsi
+++ b/arch/arm/boot/dts/exynos5420.dtsi
@@ -602,7 +602,7 @@ dp_phy: dp-video-phy {
};
mipi_phy: mipi-video-phy {
- compatible = "samsung,s5pv210-mipi-video-phy";
+ compatible = "samsung,exynos5420-mipi-video-phy";
syscon = <&pmu_system_controller>;
#phy-cells = <1>;
};
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 367/567] blk-iocost: fix divide by 0 error in calc_lcoefs()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 366/567] ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 368/567] trace/blktrace: fix memory leak with using debugfs_lookup() Greg Kroah-Hartman
` (203 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Nan, Yu Kuai, Tejun Heo,
Jens Axboe, Sasha Levin
From: Li Nan <linan122@huawei.com>
[ Upstream commit 984af1e66b4126cf145153661cc24c213e2ec231 ]
echo max of u64 to cost.model can cause divide by 0 error.
# echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model
divide error: 0000 [#1] PREEMPT SMP
RIP: 0010:calc_lcoefs+0x4c/0xc0
Call Trace:
<TASK>
ioc_refresh_params+0x2b3/0x4f0
ioc_cost_model_write+0x3cb/0x4c0
? _copy_from_iter+0x6d/0x6c0
? kernfs_fop_write_iter+0xfc/0x270
cgroup_file_write+0xa0/0x200
kernfs_fop_write_iter+0x17d/0x270
vfs_write+0x414/0x620
ksys_write+0x73/0x160
__x64_sys_write+0x1e/0x30
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
calc_lcoefs() uses the input value of cost.model in DIV_ROUND_UP_ULL,
overflow would happen if bps plus IOC_PAGE_SIZE is greater than
ULLONG_MAX, it can cause divide by 0 error.
Fix the problem by setting basecost
Signed-off-by: Li Nan <linan122@huawei.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20230117070806.3857142-5-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-iocost.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index 069193dee95b0..bd7e9ffa5d401 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -870,9 +870,14 @@ static void calc_lcoefs(u64 bps, u64 seqiops, u64 randiops,
*page = *seqio = *randio = 0;
- if (bps)
- *page = DIV64_U64_ROUND_UP(VTIME_PER_SEC,
- DIV_ROUND_UP_ULL(bps, IOC_PAGE_SIZE));
+ if (bps) {
+ u64 bps_pages = DIV_ROUND_UP_ULL(bps, IOC_PAGE_SIZE);
+
+ if (bps_pages)
+ *page = DIV64_U64_ROUND_UP(VTIME_PER_SEC, bps_pages);
+ else
+ *page = 1;
+ }
if (seqiops) {
v = DIV64_U64_ROUND_UP(VTIME_PER_SEC, seqiops);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 368/567] trace/blktrace: fix memory leak with using debugfs_lookup()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 367/567] blk-iocost: fix divide by 0 error in calc_lcoefs() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 369/567] wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() Greg Kroah-Hartman
` (202 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jens Axboe, Steven Rostedt,
Masami Hiramatsu, linux-block, linux-kernel, linux-trace-kernel,
Bart Van Assche, Sasha Levin
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 83e8864fee26f63a7435e941b7c36a20fd6fe93e ]
When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time. To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: linux-block@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-kernel@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20230202141956.2299521-1-gregkh@linuxfoundation.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/blktrace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 16b0d3fa56e00..e6d03cf148597 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -319,8 +319,8 @@ static void blk_trace_free(struct request_queue *q, struct blk_trace *bt)
* under 'q->debugfs_dir', thus lookup and remove them.
*/
if (!bt->dir) {
- debugfs_remove(debugfs_lookup("dropped", q->debugfs_dir));
- debugfs_remove(debugfs_lookup("msg", q->debugfs_dir));
+ debugfs_lookup_and_remove("dropped", q->debugfs_dir);
+ debugfs_lookup_and_remove("msg", q->debugfs_dir);
} else {
debugfs_remove(bt->dir);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 369/567] wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 368/567] trace/blktrace: fix memory leak with using debugfs_lookup() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 370/567] wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() Greg Kroah-Hartman
` (201 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dokyung Song, Jisoo Jang,
Minsuk Kang, Toke Høiland-Jørgensen, Kalle Valo,
Sasha Levin
From: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
[ Upstream commit f099c5c9e2ba08a379bd354a82e05ef839ae29ac ]
This patch fixes a use-after-free in ath9k that occurs in
ath9k_hif_usb_disconnect() when ath9k_destroy_wmi() is trying to access
'drv_priv' that has already been freed by ieee80211_free_hw(), called by
ath9k_htc_hw_deinit(). The patch moves ath9k_destroy_wmi() before
ieee80211_free_hw(). Note that urbs from the driver should be killed
before freeing 'wmi' with ath9k_destroy_wmi() as their callbacks will
access 'wmi'.
Found by a modified version of syzkaller.
==================================================================
BUG: KASAN: use-after-free in ath9k_destroy_wmi+0x38/0x40
Read of size 8 at addr ffff8881069132a0 by task kworker/0:1/7
CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #131
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
dump_stack_lvl+0x8e/0xd1
print_address_description.constprop.0.cold+0x93/0x334
? ath9k_destroy_wmi+0x38/0x40
? ath9k_destroy_wmi+0x38/0x40
kasan_report.cold+0x83/0xdf
? ath9k_destroy_wmi+0x38/0x40
ath9k_destroy_wmi+0x38/0x40
ath9k_hif_usb_disconnect+0x329/0x3f0
? ath9k_hif_usb_suspend+0x120/0x120
? usb_disable_interface+0xfc/0x180
usb_unbind_interface+0x19b/0x7e0
? usb_autoresume_device+0x50/0x50
device_release_driver_internal+0x44d/0x520
bus_remove_device+0x2e5/0x5a0
device_del+0x5b2/0xe30
? __device_link_del+0x370/0x370
? usb_remove_ep_devs+0x43/0x80
? remove_intf_ep_devs+0x112/0x1a0
usb_disable_device+0x1e3/0x5a0
usb_disconnect+0x267/0x870
hub_event+0x168d/0x3950
? rcu_read_lock_sched_held+0xa1/0xd0
? hub_port_debounce+0x2e0/0x2e0
? check_irq_usage+0x860/0xf20
? drain_workqueue+0x281/0x360
? lock_release+0x640/0x640
? rcu_read_lock_sched_held+0xa1/0xd0
? rcu_read_lock_bh_held+0xb0/0xb0
? lockdep_hardirqs_on_prepare+0x273/0x3e0
process_one_work+0x92b/0x1460
? pwq_dec_nr_in_flight+0x330/0x330
? rwlock_bug.part.0+0x90/0x90
worker_thread+0x95/0xe00
? __kthread_parkme+0x115/0x1e0
? process_one_work+0x1460/0x1460
kthread+0x3a1/0x480
? set_kthread_struct+0x120/0x120
ret_from_fork+0x1f/0x30
The buggy address belongs to the page:
page:ffffea00041a44c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106913
flags: 0x200000000000000(node=0|zone=2)
raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 7, ts 38347963444, free_ts 41399957635
prep_new_page+0x1aa/0x240
get_page_from_freelist+0x159a/0x27c0
__alloc_pages+0x2da/0x6a0
alloc_pages+0xec/0x1e0
kmalloc_order+0x39/0xf0
kmalloc_order_trace+0x19/0x120
__kmalloc+0x308/0x390
wiphy_new_nm+0x6f5/0x1dd0
ieee80211_alloc_hw_nm+0x36d/0x2230
ath9k_htc_probe_device+0x9d/0x1e10
ath9k_htc_hw_init+0x34/0x50
ath9k_hif_usb_firmware_cb+0x25f/0x4e0
request_firmware_work_func+0x131/0x240
process_one_work+0x92b/0x1460
worker_thread+0x95/0xe00
kthread+0x3a1/0x480
page last free stack trace:
free_pcp_prepare+0x3d3/0x7f0
free_unref_page+0x1e/0x3d0
device_release+0xa4/0x240
kobject_put+0x186/0x4c0
put_device+0x20/0x30
ath9k_htc_disconnect_device+0x1cf/0x2c0
ath9k_htc_hw_deinit+0x26/0x30
ath9k_hif_usb_disconnect+0x2d9/0x3f0
usb_unbind_interface+0x19b/0x7e0
device_release_driver_internal+0x44d/0x520
bus_remove_device+0x2e5/0x5a0
device_del+0x5b2/0xe30
usb_disable_device+0x1e3/0x5a0
usb_disconnect+0x267/0x870
hub_event+0x168d/0x3950
process_one_work+0x92b/0x1460
Memory state around the buggy address:
ffff888106913180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888106913200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888106913280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888106913300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888106913380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Reported-by: Dokyung Song <dokyungs@yonsei.ac.kr>
Reported-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
Reported-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20221205014308.1617597-1-linuxlovemin@yonsei.ac.kr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/hif_usb.c | 2 --
drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 ++
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index de6c0824c9cab..f521dfa2f1945 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1424,8 +1424,6 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
if (hif_dev->flags & HIF_USB_READY) {
ath9k_htc_hw_deinit(hif_dev->htc_handle, unplugged);
- ath9k_hif_usb_dev_deinit(hif_dev);
- ath9k_destroy_wmi(hif_dev->htc_handle->drv_priv);
ath9k_htc_hw_free(hif_dev->htc_handle);
}
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 07ac88fb1c577..96a3185a96d75 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -988,6 +988,8 @@ void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
ath9k_deinit_device(htc_handle->drv_priv);
ath9k_stop_wmi(htc_handle->drv_priv);
+ ath9k_hif_usb_dealloc_urbs((struct hif_device_usb *)htc_handle->hif_dev);
+ ath9k_destroy_wmi(htc_handle->drv_priv);
ieee80211_free_hw(htc_handle->drv_priv->hw);
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 370/567] wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 369/567] wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 371/567] rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks Greg Kroah-Hartman
` (200 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dokyung Song, Jisoo Jang,
Minsuk Kang, Kalle Valo, Sasha Levin
From: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
[ Upstream commit 0a06cadcc2a0044e4a117cc0e61436fc3a0dad69 ]
This patch fixes a stack-out-of-bounds read in brcmfmac that occurs
when 'buf' that is not null-terminated is passed as an argument of
strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware
version string by memcpy() in brcmf_fil_iovar_data_get().
The patch ensures buf is null-terminated.
Found by a modified version of syzkaller.
[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3
[ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
[ 47.601565][ T1897] ==================================================================
[ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0
[ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897
[ 47.604336][ T1897]
[ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131
[ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event
[ 47.607453][ T1897] Call Trace:
[ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1
[ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334
[ 47.609009][ T1897] ? strsep+0x1b2/0x1f0
[ 47.609434][ T1897] ? strsep+0x1b2/0x1f0
[ 47.609863][ T1897] kasan_report.cold+0x83/0xdf
[ 47.610366][ T1897] ? strsep+0x1b2/0x1f0
[ 47.610882][ T1897] strsep+0x1b2/0x1f0
[ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0
[ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40
[ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100
[ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0
[ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0
[ 47.614704][ T1897] ? find_held_lock+0x2d/0x110
[ 47.615236][ T1897] ? brcmf_usb_deq+0x1a7/0x260
[ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0
[ 47.616288][ T1897] brcmf_attach+0x246/0xd40
[ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0
[ 47.617280][ T1897] ? kmemdup+0x43/0x50
[ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690
[ 47.618244][ T1897] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470
[ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760
[ 47.619429][ T1897] ? usb_probe_device+0x250/0x250
[ 47.619950][ T1897] really_probe+0x205/0xb70
[ 47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130
[ 47.621048][ T1897] __driver_probe_device+0x311/0x4b0
[ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130
[ 47.622209][ T1897] driver_probe_device+0x4e/0x150
[ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0
[ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0
[ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30
[ 47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 47.624907][ T1897] ? trace_hardirqs_on+0x46/0x160
[ 47.625437][ T1897] __device_attach+0x23f/0x3a0
[ 47.625924][ T1897] ? device_bind_driver+0xd0/0xd0
[ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0
[ 47.627057][ T1897] bus_probe_device+0x1da/0x290
[ 47.627557][ T1897] device_add+0xb7b/0x1eb0
[ 47.628027][ T1897] ? wait_for_completion+0x290/0x290
[ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0
[ 47.629249][ T1897] usb_set_configuration+0xf59/0x16f0
[ 47.629829][ T1897] usb_generic_driver_probe+0x82/0xa0
[ 47.630385][ T1897] usb_probe_device+0xbb/0x250
[ 47.630927][ T1897] ? usb_suspend+0x590/0x590
[ 47.631397][ T1897] really_probe+0x205/0xb70
[ 47.631855][ T1897] ? driver_allows_async_probing+0x130/0x130
[ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0
[ 47.633002][ T1897] ? usb_generic_driver_match+0x75/0x90
[ 47.633573][ T1897] ? driver_allows_async_probing+0x130/0x130
[ 47.634170][ T1897] driver_probe_device+0x4e/0x150
[ 47.634703][ T1897] __device_attach_driver+0x1cc/0x2a0
[ 47.635248][ T1897] bus_for_each_drv+0x156/0x1d0
[ 47.635748][ T1897] ? bus_rescan_devices+0x30/0x30
[ 47.636271][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 47.636881][ T1897] ? trace_hardirqs_on+0x46/0x160
[ 47.637396][ T1897] __device_attach+0x23f/0x3a0
[ 47.637904][ T1897] ? device_bind_driver+0xd0/0xd0
[ 47.638426][ T1897] ? kobject_uevent_env+0x287/0x14b0
[ 47.638985][ T1897] bus_probe_device+0x1da/0x290
[ 47.639512][ T1897] device_add+0xb7b/0x1eb0
[ 47.639977][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0
[ 47.640612][ T1897] ? kfree+0x14a/0x6b0
[ 47.641055][ T1897] ? __usb_get_extra_descriptor+0x116/0x160
[ 47.641679][ T1897] usb_new_device.cold+0x49c/0x1029
[ 47.642245][ T1897] ? hub_disconnect+0x450/0x450
[ 47.642756][ T1897] ? rwlock_bug.part.0+0x90/0x90
[ 47.643273][ T1897] ? _raw_spin_unlock_irq+0x24/0x30
[ 47.643822][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 47.644445][ T1897] hub_event+0x1c98/0x3950
[ 47.644939][ T1897] ? hub_port_debounce+0x2e0/0x2e0
[ 47.645467][ T1897] ? check_irq_usage+0x861/0xf20
[ 47.645975][ T1897] ? drain_workqueue+0x280/0x360
[ 47.646506][ T1897] ? lock_release+0x640/0x640
[ 47.646994][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0
[ 47.647572][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 47.648111][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 47.648735][ T1897] process_one_work+0x92b/0x1460
[ 47.649262][ T1897] ? pwq_dec_nr_in_flight+0x330/0x330
[ 47.649816][ T1897] ? rwlock_bug.part.0+0x90/0x90
[ 47.650336][ T1897] worker_thread+0x95/0xe00
[ 47.650830][ T1897] ? __kthread_parkme+0x115/0x1e0
[ 47.651361][ T1897] ? process_one_work+0x1460/0x1460
[ 47.651904][ T1897] kthread+0x3a1/0x480
[ 47.652329][ T1897] ? set_kthread_struct+0x120/0x120
[ 47.652878][ T1897] ret_from_fork+0x1f/0x30
[ 47.653370][ T1897]
[ 47.653608][ T1897]
[ 47.653848][ T1897] addr ffffc90001f6f000 is located in stack of task kworker/0:2/1897 at offset 512 in frame:
[ 47.654891][ T1897] brcmf_c_preinit_dcmds+0x0/0xc40
[ 47.655442][ T1897]
[ 47.655690][ T1897] this frame has 4 objects:
[ 47.656151][ T1897] [48, 56) 'ptr'
[ 47.656159][ T1897] [80, 148) 'revinfo'
[ 47.656534][ T1897] [192, 210) 'eventmask'
[ 47.656953][ T1897] [256, 512) 'buf'
[ 47.657410][ T1897]
[ 47.658035][ T1897] Memory state around the buggy address:
[ 47.658743][ T1897] ffffc90001f6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 47.659577][ T1897] ffffc90001f6ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 47.660394][ T1897] >ffffc90001f6f000: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
[ 47.661199][ T1897] ^
[ 47.661625][ T1897] ffffc90001f6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 47.662455][ T1897] ffffc90001f6f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
[ 47.663318][ T1897] ==================================================================
[ 47.664147][ T1897] Disabling lock debugging due to kernel taint
Reported-by: Dokyung Song <dokyungs@yonsei.ac.kr>
Reported-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
Reported-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Signed-off-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221115043458.37562-1-jisoo.jang@yonsei.ac.kr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
index e3758bd86acf0..57bb1fbedaa87 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
@@ -264,6 +264,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
err);
goto done;
}
+ buf[sizeof(buf) - 1] = '\0';
ptr = (char *)buf;
strsep(&ptr, "\n");
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 371/567] rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 370/567] wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 372/567] rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() Greg Kroah-Hartman
` (199 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steven Rostedt,
Masami Hiramatsu (Google),
Mathieu Desnoyers, Paul E. McKenney, Boqun Feng, Matthew Wilcox,
Thomas Gleixner, Sasha Levin
From: Paul E. McKenney <paulmck@kernel.org>
[ Upstream commit 0cae5ded535c3a80aed94f119bbd4ee3ae284a65 ]
Currently, RCU_LOCKDEP_WARN() checks the condition before checking
to see if lockdep is still enabled. This is necessary to avoid the
false-positive splats fixed by commit 3066820034b5dd ("rcu: Reject
RCU_LOCKDEP_WARN() false positives"). However, the current state can
result in false-positive splats during early boot before lockdep is fully
initialized. This commit therefore checks debug_lockdep_rcu_enabled()
both before and after checking the condition, thus avoiding both sets
of false-positive error reports.
Reported-by: Steven Rostedt <rostedt@goodmis.org>
Reported-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/rcupdate.h | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 1e937a32da33d..13bddb841ceb1 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -313,11 +313,18 @@ static inline int rcu_read_lock_any_held(void)
* RCU_LOCKDEP_WARN - emit lockdep splat if specified condition is met
* @c: condition to check
* @s: informative message
+ *
+ * This checks debug_lockdep_rcu_enabled() before checking (c) to
+ * prevent early boot splats due to lockdep not yet being initialized,
+ * and rechecks it after checking (c) to prevent false-positive splats
+ * due to races with lockdep being disabled. See commit 3066820034b5dd
+ * ("rcu: Reject RCU_LOCKDEP_WARN() false positives") for more detail.
*/
#define RCU_LOCKDEP_WARN(c, s) \
do { \
static bool __section(".data.unlikely") __warned; \
- if ((c) && debug_lockdep_rcu_enabled() && !__warned) { \
+ if (debug_lockdep_rcu_enabled() && (c) && \
+ debug_lockdep_rcu_enabled() && !__warned) { \
__warned = true; \
lockdep_rcu_suspicious(__FILE__, __LINE__, s); \
} \
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 372/567] rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 371/567] rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 373/567] rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug Greg Kroah-Hartman
` (198 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul E. McKenney, Sasha Levin
From: Paul E. McKenney <paulmck@kernel.org>
[ Upstream commit 2d7f00b2f01301d6e41fd4a28030dab0442265be ]
The normal grace period's RCU CPU stall warnings are invoked from the
scheduling-clock interrupt handler, and can thus invoke smp_processor_id()
with impunity, which allows them to directly invoke dump_cpu_task().
In contrast, the expedited grace period's RCU CPU stall warnings are
invoked from process context, which causes the dump_cpu_task() function's
calls to smp_processor_id() to complain bitterly in debug kernels.
This commit therefore causes synchronize_rcu_expedited_wait() to disable
preemption around its call to dump_cpu_task().
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/tree_exp.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
index 16f94118ca34b..f9fb2793b0193 100644
--- a/kernel/rcu/tree_exp.h
+++ b/kernel/rcu/tree_exp.h
@@ -565,7 +565,9 @@ static void synchronize_rcu_expedited_wait(void)
mask = leaf_node_cpu_bit(rnp, cpu);
if (!(READ_ONCE(rnp->expmask) & mask))
continue;
+ preempt_disable(); // For smp_processor_id() in dump_cpu_task().
dump_cpu_task(cpu);
+ preempt_enable();
}
}
jiffies_stall = 3 * rcu_jiffies_till_stall_check() + 3;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 373/567] rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 372/567] rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 374/567] wifi: ath11k: debugfs: fix to work with multiple PCI devices Greg Kroah-Hartman
` (197 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zqiang, Paul E. McKenney, Sasha Levin
From: Zqiang <qiang1.zhang@intel.com>
[ Upstream commit ea5c8987fef20a8cca07e428aa28bc64649c5104 ]
The synchronize_rcu_tasks_rude() function invokes rcu_tasks_rude_wait_gp()
to wait one rude RCU-tasks grace period. The rcu_tasks_rude_wait_gp()
function in turn checks if there is only a single online CPU. If so, it
will immediately return, because a call to synchronize_rcu_tasks_rude()
is by definition a grace period on a single-CPU system. (We could
have blocked!)
Unfortunately, this check uses num_online_cpus() without synchronization,
which can result in too-short grace periods. To see this, consider the
following scenario:
CPU0 CPU1 (going offline)
migration/1 task:
cpu_stopper_thread
-> take_cpu_down
-> _cpu_disable
(dec __num_online_cpus)
->cpuhp_invoke_callback
preempt_disable
access old_data0
task1
del old_data0 .....
synchronize_rcu_tasks_rude()
task1 schedule out
....
task2 schedule in
rcu_tasks_rude_wait_gp()
->__num_online_cpus == 1
->return
....
task1 schedule in
->free old_data0
preempt_enable
When CPU1 decrements __num_online_cpus, its value becomes 1. However,
CPU1 has not finished going offline, and will take one last trip through
the scheduler and the idle loop before it actually stops executing
instructions. Because synchronize_rcu_tasks_rude() is mostly used for
tracing, and because both the scheduler and the idle loop can be traced,
this means that CPU0's prematurely ended grace period might disrupt the
tracing on CPU1. Given that this disruption might include CPU1 executing
instructions in memory that was just now freed (and maybe reallocated),
this is a matter of some concern.
This commit therefore removes that problematic single-CPU check from the
rcu_tasks_rude_wait_gp() function. This dispenses with the single-CPU
optimization, but there is no evidence indicating that this optimization
is important. In addition, synchronize_rcu_tasks_generic() contains a
similar optimization (albeit only for early boot), which also splats.
(As in exactly why are you invoking synchronize_rcu_tasks_rude() so
early in boot, anyway???)
It is OK for the synchronize_rcu_tasks_rude() function's check to be
unsynchronized because the only times that this check can evaluate to
true is when there is only a single CPU running with preemption
disabled.
While in the area, this commit also fixes a minor bug in which a
call to synchronize_rcu_tasks_rude() would instead be attributed to
synchronize_rcu_tasks().
[ paulmck: Add "synchronize_" prefix and "()" suffix. ]
Signed-off-by: Zqiang <qiang1.zhang@intel.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/tasks.h | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index 5533e3106ba01..94b8ee84bc78a 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -171,8 +171,9 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func,
static void synchronize_rcu_tasks_generic(struct rcu_tasks *rtp)
{
/* Complain if the scheduler has not started. */
- WARN_ONCE(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE,
- "synchronize_rcu_tasks called too soon");
+ if (WARN_ONCE(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE,
+ "synchronize_%s() called too soon", rtp->name))
+ return;
/* Wait for the grace period. */
wait_rcu_gp(rtp->call_func);
@@ -688,9 +689,6 @@ static void rcu_tasks_be_rude(struct work_struct *work)
// Wait for one rude RCU-tasks grace period.
static void rcu_tasks_rude_wait_gp(struct rcu_tasks *rtp)
{
- if (num_online_cpus() <= 1)
- return; // Fastpath for only one CPU.
-
rtp->n_ipis += cpumask_weight(cpu_online_mask);
schedule_on_each_cpu(rcu_tasks_be_rude);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 374/567] wifi: ath11k: debugfs: fix to work with multiple PCI devices
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 373/567] rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 375/567] thermal: intel: Fix unsigned comparison with less than zero Greg Kroah-Hartman
` (196 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Robert Marko, Kalle Valo, Sasha Levin
From: Kalle Valo <quic_kvalo@quicinc.com>
[ Upstream commit 323d91d4684d238f6bc3693fed93caf795378fe0 ]
ath11k fails to load if there are multiple ath11k PCI devices with same name:
ath11k_pci 0000:01:00.0: Hardware name qcn9074 hw1.0
debugfs: Directory 'ath11k' with parent '/' already present!
ath11k_pci 0000:01:00.0: failed to create ath11k debugfs
ath11k_pci 0000:01:00.0: failed to create soc core: -17
ath11k_pci 0000:01:00.0: failed to init core: -17
ath11k_pci: probe of 0000:01:00.0 failed with error -17
Fix this by creating a directory for each ath11k device using schema
<bus>-<devname>, for example "pci-0000:06:00.0". This directory created under
the top-level ath11k directory, for example /sys/kernel/debug/ath11k.
The reference to the toplevel ath11k directory is not stored anymore within ath11k, instead
it's retrieved using debugfs_lookup(). If the directory does not exist it will
be created. After the last directory from the ath11k directory is removed, for
example when doing rmmod ath11k, the empty ath11k directory is left in place,
it's a minor cosmetic issue anyway.
Here's an example hierarchy with one WCN6855:
ath11k
`-- pci-0000:06:00.0
|-- mac0
| |-- dfs_block_radar_events
| |-- dfs_simulate_radar
| |-- ext_rx_stats
| |-- ext_tx_stats
| |-- fw_dbglog_config
| |-- fw_stats
| | |-- beacon_stats
| | |-- pdev_stats
| | `-- vdev_stats
| |-- htt_stats
| |-- htt_stats_reset
| |-- htt_stats_type
| `-- pktlog_filter
|-- simulate_fw_crash
`-- soc_dp_stats
I didn't have a test setup where I could connect multiple ath11k devices to the
same the host, so I have only tested this with one device.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9
Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
Tested-by: Robert Marko <robert.marko@sartura.hr>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20221220121231.20120-1-kvalo@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/core.h | 1 -
drivers/net/wireless/ath/ath11k/debugfs.c | 48 +++++++++++++++++++----
2 files changed, 40 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h
index caa8f6eba0097..fda1c2db05d0a 100644
--- a/drivers/net/wireless/ath/ath11k/core.h
+++ b/drivers/net/wireless/ath/ath11k/core.h
@@ -731,7 +731,6 @@ struct ath11k_base {
enum ath11k_dfs_region dfs_region;
#ifdef CONFIG_ATH11K_DEBUGFS
struct dentry *debugfs_soc;
- struct dentry *debugfs_ath11k;
#endif
struct ath11k_soc_dp_stats soc_stats;
diff --git a/drivers/net/wireless/ath/ath11k/debugfs.c b/drivers/net/wireless/ath/ath11k/debugfs.c
index 554feaf1ed5cd..f827035f0dd2e 100644
--- a/drivers/net/wireless/ath/ath11k/debugfs.c
+++ b/drivers/net/wireless/ath/ath11k/debugfs.c
@@ -836,10 +836,6 @@ int ath11k_debugfs_pdev_create(struct ath11k_base *ab)
if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags))
return 0;
- ab->debugfs_soc = debugfs_create_dir(ab->hw_params.name, ab->debugfs_ath11k);
- if (IS_ERR(ab->debugfs_soc))
- return PTR_ERR(ab->debugfs_soc);
-
debugfs_create_file("simulate_fw_crash", 0600, ab->debugfs_soc, ab,
&fops_simulate_fw_crash);
@@ -857,15 +853,51 @@ void ath11k_debugfs_pdev_destroy(struct ath11k_base *ab)
int ath11k_debugfs_soc_create(struct ath11k_base *ab)
{
- ab->debugfs_ath11k = debugfs_create_dir("ath11k", NULL);
+ struct dentry *root;
+ bool dput_needed;
+ char name[64];
+ int ret;
+
+ root = debugfs_lookup("ath11k", NULL);
+ if (!root) {
+ root = debugfs_create_dir("ath11k", NULL);
+ if (IS_ERR_OR_NULL(root))
+ return PTR_ERR(root);
+
+ dput_needed = false;
+ } else {
+ /* a dentry from lookup() needs dput() after we don't use it */
+ dput_needed = true;
+ }
+
+ scnprintf(name, sizeof(name), "%s-%s", ath11k_bus_str(ab->hif.bus),
+ dev_name(ab->dev));
+
+ ab->debugfs_soc = debugfs_create_dir(name, root);
+ if (IS_ERR_OR_NULL(ab->debugfs_soc)) {
+ ret = PTR_ERR(ab->debugfs_soc);
+ goto out;
+ }
+
+ ret = 0;
- return PTR_ERR_OR_ZERO(ab->debugfs_ath11k);
+out:
+ if (dput_needed)
+ dput(root);
+
+ return ret;
}
void ath11k_debugfs_soc_destroy(struct ath11k_base *ab)
{
- debugfs_remove_recursive(ab->debugfs_ath11k);
- ab->debugfs_ath11k = NULL;
+ debugfs_remove_recursive(ab->debugfs_soc);
+ ab->debugfs_soc = NULL;
+
+ /* We are not removing ath11k directory on purpose, even if it
+ * would be empty. This simplifies the directory handling and it's
+ * a minor cosmetic issue to leave an empty ath11k directory to
+ * debugfs.
+ */
}
EXPORT_SYMBOL(ath11k_debugfs_soc_destroy);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 375/567] thermal: intel: Fix unsigned comparison with less than zero
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 374/567] wifi: ath11k: debugfs: fix to work with multiple PCI devices Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 376/567] timers: Prevent union confusion from unexpected restart_syscall() Greg Kroah-Hartman
` (195 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abaci Robot, Yang Li, Zhang Rui,
Rafael J. Wysocki, Sasha Levin
From: Yang Li <yang.lee@linux.alibaba.com>
[ Upstream commit e7fcfe67f9f410736b758969477b17ea285e8e6c ]
The return value from the call to intel_tcc_get_tjmax() is int, which can
be a negative error code. However, the return value is being assigned to
an u32 variable 'tj_max', so making 'tj_max' an int.
Eliminate the following warning:
./drivers/thermal/intel/intel_soc_dts_iosf.c:394:5-11: WARNING: Unsigned expression compared with zero: tj_max < 0
Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3637
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Acked-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/intel/intel_soc_dts_iosf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/thermal/intel/intel_soc_dts_iosf.c b/drivers/thermal/intel/intel_soc_dts_iosf.c
index 342b0bb5a56d9..8651ff1abe754 100644
--- a/drivers/thermal/intel/intel_soc_dts_iosf.c
+++ b/drivers/thermal/intel/intel_soc_dts_iosf.c
@@ -405,7 +405,7 @@ struct intel_soc_dts_sensors *intel_soc_dts_iosf_init(
{
struct intel_soc_dts_sensors *sensors;
bool notification;
- u32 tj_max;
+ int tj_max;
int ret;
int i;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 376/567] timers: Prevent union confusion from unexpected restart_syscall()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 375/567] thermal: intel: Fix unsigned comparison with less than zero Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 377/567] x86/bugs: Reset speculation control settings on init Greg Kroah-Hartman
` (194 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jann Horn, Thomas Gleixner, Sasha Levin
From: Jann Horn <jannh@google.com>
[ Upstream commit 9f76d59173d9d146e96c66886b671c1915a5c5e5 ]
The nanosleep syscalls use the restart_block mechanism, with a quirk:
The `type` and `rmtp`/`compat_rmtp` fields are set up unconditionally on
syscall entry, while the rest of the restart_block is only set up in the
unlikely case that the syscall is actually interrupted by a signal (or
pseudo-signal) that doesn't have a signal handler.
If the restart_block was set up by a previous syscall (futex(...,
FUTEX_WAIT, ...) or poll()) and hasn't been invalidated somehow since then,
this will clobber some of the union fields used by futex_wait_restart() and
do_restart_poll().
If userspace afterwards wrongly calls the restart_syscall syscall,
futex_wait_restart()/do_restart_poll() will read struct fields that have
been clobbered.
This doesn't actually lead to anything particularly interesting because
none of the union fields contain trusted kernel data, and
futex(..., FUTEX_WAIT, ...) and poll() aren't syscalls where it makes much
sense to apply seccomp filters to their arguments.
So the current consequences are just of the "if userspace does bad stuff,
it can damage itself, and that's not a problem" flavor.
But still, it seems like a hazard for future developers, so invalidate the
restart_block when partly setting it up in the nanosleep syscalls.
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20230105134403.754986-1-jannh@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/hrtimer.c | 2 ++
kernel/time/posix-stubs.c | 2 ++
kernel/time/posix-timers.c | 2 ++
3 files changed, 6 insertions(+)
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 23af5eca11b14..97409581e9dac 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -2126,6 +2126,7 @@ SYSCALL_DEFINE2(nanosleep, struct __kernel_timespec __user *, rqtp,
if (!timespec64_valid(&tu))
return -EINVAL;
+ current->restart_block.fn = do_no_restart_syscall;
current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE;
current->restart_block.nanosleep.rmtp = rmtp;
return hrtimer_nanosleep(timespec64_to_ktime(tu), HRTIMER_MODE_REL,
@@ -2147,6 +2148,7 @@ SYSCALL_DEFINE2(nanosleep_time32, struct old_timespec32 __user *, rqtp,
if (!timespec64_valid(&tu))
return -EINVAL;
+ current->restart_block.fn = do_no_restart_syscall;
current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE;
current->restart_block.nanosleep.compat_rmtp = rmtp;
return hrtimer_nanosleep(timespec64_to_ktime(tu), HRTIMER_MODE_REL,
diff --git a/kernel/time/posix-stubs.c b/kernel/time/posix-stubs.c
index fcb3b21d8bdcd..3783d07d60ba0 100644
--- a/kernel/time/posix-stubs.c
+++ b/kernel/time/posix-stubs.c
@@ -146,6 +146,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,
return -EINVAL;
if (flags & TIMER_ABSTIME)
rmtp = NULL;
+ current->restart_block.fn = do_no_restart_syscall;
current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE;
current->restart_block.nanosleep.rmtp = rmtp;
texp = timespec64_to_ktime(t);
@@ -239,6 +240,7 @@ SYSCALL_DEFINE4(clock_nanosleep_time32, clockid_t, which_clock, int, flags,
return -EINVAL;
if (flags & TIMER_ABSTIME)
rmtp = NULL;
+ current->restart_block.fn = do_no_restart_syscall;
current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE;
current->restart_block.nanosleep.compat_rmtp = rmtp;
texp = timespec64_to_ktime(t);
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 5dead89308b74..0c8a87a11b39d 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -1270,6 +1270,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,
return -EINVAL;
if (flags & TIMER_ABSTIME)
rmtp = NULL;
+ current->restart_block.fn = do_no_restart_syscall;
current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE;
current->restart_block.nanosleep.rmtp = rmtp;
@@ -1297,6 +1298,7 @@ SYSCALL_DEFINE4(clock_nanosleep_time32, clockid_t, which_clock, int, flags,
return -EINVAL;
if (flags & TIMER_ABSTIME)
rmtp = NULL;
+ current->restart_block.fn = do_no_restart_syscall;
current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE;
current->restart_block.nanosleep.compat_rmtp = rmtp;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 377/567] x86/bugs: Reset speculation control settings on init
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 376/567] timers: Prevent union confusion from unexpected restart_syscall() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 378/567] wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds Greg Kroah-Hartman
` (193 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawan Gupta, Breno Leitao,
Borislav Petkov (AMD),
Sasha Levin
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 0125acda7d76b943ca55811df40ed6ec0ecf670f ]
Currently, x86_spec_ctrl_base is read at boot time and speculative bits
are set if Kconfig items are enabled. For example, IBRS is enabled if
CONFIG_CPU_IBRS_ENTRY is configured, etc. These MSR bits are not cleared
if the mitigations are disabled.
This is a problem when kexec-ing a kernel that has the mitigation
disabled from a kernel that has the mitigation enabled. In this case,
the MSR bits are not cleared during the new kernel boot. As a result,
this might have some performance degradation that is hard to pinpoint.
This problem does not happen if the machine is (hard) rebooted because
the bit will be cleared by default.
[ bp: Massage. ]
Suggested-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20221128153148.1129350-1-leitao@debian.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/msr-index.h | 4 ++++
arch/x86/kernel/cpu/bugs.c | 10 +++++++++-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index f069ab09c5fc1..3588b799c63f2 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -54,6 +54,10 @@
#define SPEC_CTRL_RRSBA_DIS_S_SHIFT 6 /* Disable RRSBA behavior */
#define SPEC_CTRL_RRSBA_DIS_S BIT(SPEC_CTRL_RRSBA_DIS_S_SHIFT)
+/* A mask for bits which the kernel toggles when controlling mitigations */
+#define SPEC_CTRL_MITIGATIONS_MASK (SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD \
+ | SPEC_CTRL_RRSBA_DIS_S)
+
#define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */
#define PRED_CMD_IBPB BIT(0) /* Indirect Branch Prediction Barrier */
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 544e6c61e17d0..75dd336ac8cda 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -144,9 +144,17 @@ void __init check_bugs(void)
* have unknown values. AMD64_LS_CFG MSR is cached in the early AMD
* init code as it is not enumerated and depends on the family.
*/
- if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
+ if (cpu_feature_enabled(X86_FEATURE_MSR_SPEC_CTRL)) {
rdmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+ /*
+ * Previously running kernel (kexec), may have some controls
+ * turned ON. Clear them and let the mitigations setup below
+ * rediscover them based on configuration.
+ */
+ x86_spec_ctrl_base &= ~SPEC_CTRL_MITIGATIONS_MASK;
+ }
+
/* Select the proper CPU mitigations before patching alternatives: */
spectre_v1_select_mitigation();
spectre_v2_select_mitigation();
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 378/567] wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 377/567] x86/bugs: Reset speculation control settings on init Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 379/567] wifi: mt7601u: fix an integer underflow Greg Kroah-Hartman
` (192 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arend van Spriel, Jisoo Jang,
Kalle Valo, Sasha Levin
From: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
[ Upstream commit 660145d708be52f946a82e5b633c020f58f996de ]
Fix a stack-out-of-bounds read in brcmfmac that occurs
when 'buf' that is not null-terminated is passed as an argument of
strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with
a CLM version string by memcpy() in brcmf_fil_iovar_data_get().
Ensure buf is null-terminated.
Found by a modified version of syzkaller.
[ 33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
[ 33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42 version 5.90.188.22
[ 33.021554][ T1896] ==================================================================
[ 33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110
[ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896
[ 33.023852][ T1896]
[ 33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132
[ 33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[ 33.026065][ T1896] Workqueue: usb_hub_wq hub_event
[ 33.026581][ T1896] Call Trace:
[ 33.026896][ T1896] dump_stack_lvl+0x57/0x7d
[ 33.027372][ T1896] print_address_description.constprop.0.cold+0xf/0x334
[ 33.028037][ T1896] ? strreplace+0xf2/0x110
[ 33.028403][ T1896] ? strreplace+0xf2/0x110
[ 33.028807][ T1896] kasan_report.cold+0x83/0xdf
[ 33.029283][ T1896] ? strreplace+0xf2/0x110
[ 33.029666][ T1896] strreplace+0xf2/0x110
[ 33.029966][ T1896] brcmf_c_preinit_dcmds+0xab1/0xc40
[ 33.030351][ T1896] ? brcmf_c_set_joinpref_default+0x100/0x100
[ 33.030787][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0
[ 33.031223][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 33.031661][ T1896] ? lock_acquire+0x19d/0x4e0
[ 33.032091][ T1896] ? find_held_lock+0x2d/0x110
[ 33.032605][ T1896] ? brcmf_usb_deq+0x1a7/0x260
[ 33.033087][ T1896] ? brcmf_usb_rx_fill_all+0x5a/0xf0
[ 33.033582][ T1896] brcmf_attach+0x246/0xd40
[ 33.034022][ T1896] ? wiphy_new_nm+0x1476/0x1d50
[ 33.034383][ T1896] ? kmemdup+0x30/0x40
[ 33.034722][ T1896] brcmf_usb_probe+0x12de/0x1690
[ 33.035223][ T1896] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470
[ 33.035833][ T1896] usb_probe_interface+0x25f/0x710
[ 33.036315][ T1896] really_probe+0x1be/0xa90
[ 33.036656][ T1896] __driver_probe_device+0x2ab/0x460
[ 33.037026][ T1896] ? usb_match_id.part.0+0x88/0xc0
[ 33.037383][ T1896] driver_probe_device+0x49/0x120
[ 33.037790][ T1896] __device_attach_driver+0x18a/0x250
[ 33.038300][ T1896] ? driver_allows_async_probing+0x120/0x120
[ 33.038986][ T1896] bus_for_each_drv+0x123/0x1a0
[ 33.039906][ T1896] ? bus_rescan_devices+0x20/0x20
[ 33.041412][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 33.041861][ T1896] ? trace_hardirqs_on+0x1c/0x120
[ 33.042330][ T1896] __device_attach+0x207/0x330
[ 33.042664][ T1896] ? device_bind_driver+0xb0/0xb0
[ 33.043026][ T1896] ? kobject_uevent_env+0x230/0x12c0
[ 33.043515][ T1896] bus_probe_device+0x1a2/0x260
[ 33.043914][ T1896] device_add+0xa61/0x1ce0
[ 33.044227][ T1896] ? __mutex_unlock_slowpath+0xe7/0x660
[ 33.044891][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550
[ 33.045531][ T1896] usb_set_configuration+0x984/0x1770
[ 33.046051][ T1896] ? kernfs_create_link+0x175/0x230
[ 33.046548][ T1896] usb_generic_driver_probe+0x69/0x90
[ 33.046931][ T1896] usb_probe_device+0x9c/0x220
[ 33.047434][ T1896] really_probe+0x1be/0xa90
[ 33.047760][ T1896] __driver_probe_device+0x2ab/0x460
[ 33.048134][ T1896] driver_probe_device+0x49/0x120
[ 33.048516][ T1896] __device_attach_driver+0x18a/0x250
[ 33.048910][ T1896] ? driver_allows_async_probing+0x120/0x120
[ 33.049437][ T1896] bus_for_each_drv+0x123/0x1a0
[ 33.049814][ T1896] ? bus_rescan_devices+0x20/0x20
[ 33.050164][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 33.050579][ T1896] ? trace_hardirqs_on+0x1c/0x120
[ 33.050936][ T1896] __device_attach+0x207/0x330
[ 33.051399][ T1896] ? device_bind_driver+0xb0/0xb0
[ 33.051888][ T1896] ? kobject_uevent_env+0x230/0x12c0
[ 33.052314][ T1896] bus_probe_device+0x1a2/0x260
[ 33.052688][ T1896] device_add+0xa61/0x1ce0
[ 33.053121][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550
[ 33.053568][ T1896] usb_new_device.cold+0x463/0xf66
[ 33.053953][ T1896] ? hub_disconnect+0x400/0x400
[ 33.054313][ T1896] ? rwlock_bug.part.0+0x90/0x90
[ 33.054661][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 33.055094][ T1896] hub_event+0x10d5/0x3330
[ 33.055530][ T1896] ? hub_port_debounce+0x280/0x280
[ 33.055934][ T1896] ? __lock_acquire+0x1671/0x5790
[ 33.056387][ T1896] ? wq_calc_node_cpumask+0x170/0x2a0
[ 33.056924][ T1896] ? lock_release+0x640/0x640
[ 33.057383][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0
[ 33.057916][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 33.058402][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 33.059019][ T1896] process_one_work+0x873/0x13e0
[ 33.059488][ T1896] ? lock_release+0x640/0x640
[ 33.059932][ T1896] ? pwq_dec_nr_in_flight+0x320/0x320
[ 33.060446][ T1896] ? rwlock_bug.part.0+0x90/0x90
[ 33.060898][ T1896] worker_thread+0x8b/0xd10
[ 33.061348][ T1896] ? __kthread_parkme+0xd9/0x1d0
[ 33.061810][ T1896] ? process_one_work+0x13e0/0x13e0
[ 33.062288][ T1896] kthread+0x379/0x450
[ 33.062660][ T1896] ? _raw_spin_unlock_irq+0x24/0x30
[ 33.063148][ T1896] ? set_kthread_struct+0x100/0x100
[ 33.063606][ T1896] ret_from_fork+0x1f/0x30
[ 33.064070][ T1896]
[ 33.064313][ T1896]
[ 33.064545][ T1896] addr ffffc90001d6efc8 is located in stack of task kworker/0:2/1896 at offset 512 in frame:
[ 33.065478][ T1896] brcmf_c_preinit_dcmds+0x0/0xc40
[ 33.065973][ T1896]
[ 33.066191][ T1896] this frame has 4 objects:
[ 33.066614][ T1896] [48, 56) 'ptr'
[ 33.066618][ T1896] [80, 148) 'revinfo'
[ 33.066957][ T1896] [192, 210) 'eventmask'
[ 33.067338][ T1896] [256, 512) 'buf'
[ 33.067742][ T1896]
[ 33.068304][ T1896] Memory state around the buggy address:
[ 33.068838][ T1896] ffffc90001d6ee80: f2 00 00 02 f2 f2 f2 f2 f2 00 00 00 00 00 00 00
[ 33.069545][ T1896] ffffc90001d6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 33.070626][ T1896] >ffffc90001d6ef80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3
[ 33.072052][ T1896] ^
[ 33.073043][ T1896] ffffc90001d6f000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 33.074230][ T1896] ffffc90001d6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 33.074914][ T1896] ==================================================================
[ 33.075713][ T1896] Disabling lock debugging due to kernel taint
Reviewed-by: Arend van Spriel<arend.vanspriel@broadcom.com>
Signed-off-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221230075139.56591-1-jisoo.jang@yonsei.ac.kr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
index 57bb1fbedaa87..f29de630908d7 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
@@ -281,15 +281,17 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
if (err) {
brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err);
} else {
+ buf[sizeof(buf) - 1] = '\0';
clmver = (char *)buf;
- /* store CLM version for adding it to revinfo debugfs file */
- memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
/* Replace all newline/linefeed characters with space
* character
*/
strreplace(clmver, '\n', ' ');
+ /* store CLM version for adding it to revinfo debugfs file */
+ memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
+
brcmf_dbg(INFO, "CLM version = %s\n", clmver);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 379/567] wifi: mt7601u: fix an integer underflow
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 378/567] wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 380/567] inet: fix fast path in __inet_hash_connect() Greg Kroah-Hartman
` (191 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jisoo Jang, Jakub Kicinski,
Kalle Valo, Sasha Levin
From: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
[ Upstream commit 803f3176c5df3b5582c27ea690f204abb60b19b9 ]
Fix an integer underflow that leads to a null pointer dereference in
'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet
could be manipulated, which could trigger an integer underflow of
'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently
causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be
bypassed, eventually leading to a dereference of the pointer 'p', which
is a null pointer.
Ensure that 'dma_len' is greater than 'min_seg_len'.
Found by a modified version of syzkaller.
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G W O 5.14.0+
#139
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
RIP: 0010:skb_add_rx_frag+0x143/0x370
Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44
89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02
00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00
RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8
RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010
R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000
R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008
FS: 0000000000000000(0000) GS:ffff88811a800000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
mt7601u_rx_tasklet+0xc73/0x1270
? mt7601u_submit_rx_buf.isra.0+0x510/0x510
? tasklet_action_common.isra.0+0x79/0x2f0
tasklet_action_common.isra.0+0x206/0x2f0
__do_softirq+0x1b5/0x880
? tasklet_unlock+0x30/0x30
run_ksoftirqd+0x26/0x50
smpboot_thread_fn+0x34f/0x7d0
? smpboot_register_percpu_thread+0x370/0x370
kthread+0x3a1/0x480
? set_kthread_struct+0x120/0x120
ret_from_fork+0x1f/0x30
Modules linked in: 88XXau(O) 88x2bu(O)
---[ end trace 57f34f93b4da0f9b ]---
RIP: 0010:skb_add_rx_frag+0x143/0x370
Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44
89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02
00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00
RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8
RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010
R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000
R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008
FS: 0000000000000000(0000) GS:ffff88811a800000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Signed-off-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221229092906.2328282-1-jisoo.jang@yonsei.ac.kr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt7601u/dma.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
index ed78d2cb35e3c..fd3b768ca92bd 100644
--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
+++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
@@ -123,7 +123,8 @@ static u16 mt7601u_rx_next_seg_len(u8 *data, u32 data_len)
if (data_len < min_seg_len ||
WARN_ON_ONCE(!dma_len) ||
WARN_ON_ONCE(dma_len + MT_DMA_HDRS > data_len) ||
- WARN_ON_ONCE(dma_len & 0x3))
+ WARN_ON_ONCE(dma_len & 0x3) ||
+ WARN_ON_ONCE(dma_len < min_seg_len))
return 0;
return MT_DMA_HDRS + dma_len;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 380/567] inet: fix fast path in __inet_hash_connect()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 379/567] wifi: mt7601u: fix an integer underflow Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 381/567] ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB Greg Kroah-Hartman
` (190 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello, Kuniyuki Iwashima,
Eric Dumazet, Paolo Abeni, Sasha Levin
From: Pietro Borrello <borrello@diag.uniroma1.it>
[ Upstream commit 21cbd90a6fab7123905386985e3e4a80236b8714 ]
__inet_hash_connect() has a fast path taken if sk_head(&tb->owners) is
equal to the sk parameter.
sk_head() returns the hlist_entry() with respect to the sk_node field.
However entries in the tb->owners list are inserted with respect to the
sk_bind_node field with sk_add_bind_node().
Thus the check would never pass and the fast path never execute.
This fast path has never been executed or tested as this bug seems
to be present since commit 1da177e4c3f4 ("Linux-2.6.12-rc2"), thus
remove it to reduce code complexity.
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230112-inet_hash_connect_bind_head-v3-1-b591fd212b93@diag.uniroma1.it
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/inet_hashtables.c | 12 +-----------
1 file changed, 1 insertion(+), 11 deletions(-)
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 410b6b7998caf..39b3db5b61190 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -760,17 +760,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
u32 index;
if (port) {
- head = &hinfo->bhash[inet_bhashfn(net, port,
- hinfo->bhash_size)];
- tb = inet_csk(sk)->icsk_bind_hash;
- spin_lock_bh(&head->lock);
- if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
- inet_ehash_nolisten(sk, NULL, NULL);
- spin_unlock_bh(&head->lock);
- return 0;
- }
- spin_unlock(&head->lock);
- /* No definite answer... Walk to established hash table */
+ local_bh_disable();
ret = check_established(death_row, sk, port, NULL);
local_bh_enable();
return ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 381/567] ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 380/567] inet: fix fast path in __inet_hash_connect() Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 382/567] ice: add missing checks for PF vsi type Greg Kroah-Hartman
` (189 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddaraju DH, Tony Nguyen,
Sasha Levin, Gurucharan G
From: Siddaraju DH <siddaraju.dh@intel.com>
[ Upstream commit 8aa4318c3a122b8670bc09af142de3872ca63b88 ]
The PHY provides only 39b timestamp. With current timing
implementation, we discard lower 7b, leaving 32b timestamp.
The driver reconstructs the full 64b timestamp by correlating the
32b timestamp with cached_time for performance. The reconstruction
algorithm does both forward & backward interpolation.
The 32b timeval has overflow duration of 2^32 counts ~= 4.23 second.
Due to interpolation in both direction, its now ~= 2.125 second
IIRC, going with at least half a duration, the cached_time is updated
with periodic thread of 1 second (worst-case) periodicity.
But the 1 second periodicity is based on System-timer.
With PPB adjustments, if the 1588 timers increments at say
double the rate, (2s in-place of 1s), the Nyquist rate/half duration
sampling/update of cached_time with 1 second periodic thread will
lead to incorrect interpolations.
Hence we should restrict the PPB adjustments to at least half duration
of cached_time update which translates to 500,000,000 PPB.
Since the periodicity of the cached-time system thread can vary,
it is good to have some buffer time and considering practicality of
PPB adjustments, limiting the max_adj to 100,000,000.
Signed-off-by: Siddaraju DH <siddaraju.dh@intel.com>
Tested-by: Gurucharan G <gurucharanx.g@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index 9b50e9e6042a5..4d7aa49b7c147 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -1090,7 +1090,7 @@ static void ice_ptp_set_caps(struct ice_pf *pf)
snprintf(info->name, sizeof(info->name) - 1, "%s-%s-clk",
dev_driver_string(dev), dev_name(dev));
info->owner = THIS_MODULE;
- info->max_adj = 999999999;
+ info->max_adj = 100000000;
info->adjtime = ice_ptp_adjtime;
info->adjfine = ice_ptp_adjfine;
info->gettimex64 = ice_ptp_gettimex64;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 382/567] ice: add missing checks for PF vsi type
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 381/567] ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:01 ` [PATCH 5.15 383/567] ACPI: Dont build ACPICA with -Os Greg Kroah-Hartman
` (188 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jesse Brandeburg, Tony Nguyen,
Sasha Levin, Gurucharan G
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
[ Upstream commit 6a8d013e904ad9a66706fcc926ec9993bed7d190 ]
There were a few places we had missed checking the VSI type to make sure
it was definitely a PF VSI, before calling setup functions intended only
for the PF VSI.
This doesn't fix any explicit bugs but cleans up the code in a few
places and removes one explicit != vsi->type check that can be
superseded by this code (it's a super set)
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Gurucharan G <gurucharanx.g@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_main.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 6f674cd117d3d..13afbffc4758a 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -5477,15 +5477,12 @@ int ice_vsi_cfg(struct ice_vsi *vsi)
{
int err;
- if (vsi->netdev) {
+ if (vsi->netdev && vsi->type == ICE_VSI_PF) {
ice_set_rx_mode(vsi->netdev);
- if (vsi->type != ICE_VSI_LB) {
- err = ice_vsi_vlan_setup(vsi);
-
- if (err)
- return err;
- }
+ err = ice_vsi_vlan_setup(vsi);
+ if (err)
+ return err;
}
ice_vsi_cfg_dcb_rings(vsi);
@@ -5651,7 +5648,7 @@ static int ice_up_complete(struct ice_vsi *vsi)
if (vsi->port_info &&
(vsi->port_info->phy.link_info.link_info & ICE_AQ_LINK_UP) &&
- vsi->netdev) {
+ vsi->netdev && vsi->type == ICE_VSI_PF) {
ice_print_link_msg(vsi, true);
netif_tx_start_all_queues(vsi->netdev);
netif_carrier_on(vsi->netdev);
@@ -5661,7 +5658,9 @@ static int ice_up_complete(struct ice_vsi *vsi)
* set the baseline so counters are ready when interface is up
*/
ice_update_eth_stats(vsi);
- ice_service_task_schedule(pf);
+
+ if (vsi->type == ICE_VSI_PF)
+ ice_service_task_schedule(pf);
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 383/567] ACPI: Dont build ACPICA with -Os
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 382/567] ice: add missing checks for PF vsi type Greg Kroah-Hartman
@ 2023-03-07 17:01 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 384/567] thermal: intel: intel_pch: Add support for Wellsburg PCH Greg Kroah-Hartman
` (187 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:01 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Rafael J. Wysocki,
Florent Revest, Len Brown, Masami Hiramatsu, Peter Zijlstra,
Robert Moore, Steven Rostedt, Will Deacon, linux-acpi,
Catalin Marinas, Sasha Levin
From: Mark Rutland <mark.rutland@arm.com>
[ Upstream commit 8f9e0a52810dd83406c768972d022c37e7a18f1f ]
The ACPICA code has been built with '-Os' since the beginning of git
history, though there's no explanatory comment as to why.
This is unfortunate as GCC drops the alignment specificed by
'-falign-functions=N' when '-Os' is used, as reported in GCC bug 88345:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345
This prevents CONFIG_FUNCTION_ALIGNMENT and
CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B from having their expected effect
on the ACPICA code. This is doubly unfortunate as in subsequent patches
arm64 will depend upon CONFIG_FUNCTION_ALIGNMENT for its ftrace
implementation.
Drop the '-Os' flag when building the ACPICA code. With this removed,
the code builds cleanly and works correctly in testing so far.
I've tested this by selecting CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y,
building and booting a kernel using ACPI, and looking for misaligned
text symbols:
* arm64:
Before, v6.2-rc3:
# uname -rm
6.2.0-rc3 aarch64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
5009
Before, v6.2-rc3 + fixed __cold:
# uname -rm
6.2.0-rc3-00001-g2a2bedf8bfa9 aarch64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
919
After:
# uname -rm
6.2.0-rc3-00002-g267bddc38572 aarch64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
323
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l
0
* x86_64:
Before, v6.2-rc3:
# uname -rm
6.2.0-rc3 x86_64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
11537
Before, v6.2-rc3 + fixed __cold:
# uname -rm
6.2.0-rc3-00001-g2a2bedf8bfa9 x86_64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
2805
After:
# uname -rm
6.2.0-rc3-00002-g267bddc38572 x86_64
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l
1357
# grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l
0
With the patch applied, the remaining unaligned text labels are a
combination of static call trampolines and labels in assembly, which can
be dealt with in subsequent patches.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Florent Revest <revest@chromium.org>
Cc: Len Brown <lenb@kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Robert Moore <robert.moore@intel.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Will Deacon <will@kernel.org>
Cc: linux-acpi@vger.kernel.org
Link: https://lore.kernel.org/r/20230123134603.1064407-4-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile
index 59700433a96e5..f919811156b1f 100644
--- a/drivers/acpi/acpica/Makefile
+++ b/drivers/acpi/acpica/Makefile
@@ -3,7 +3,7 @@
# Makefile for ACPICA Core interpreter
#
-ccflags-y := -Os -D_LINUX -DBUILDING_ACPICA
+ccflags-y := -D_LINUX -DBUILDING_ACPICA
ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT
# use acpi.o to put all files here into acpi.o modparam namespace
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 384/567] thermal: intel: intel_pch: Add support for Wellsburg PCH
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2023-03-07 17:01 ` [PATCH 5.15 383/567] ACPI: Dont build ACPICA with -Os Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 385/567] clocksource: Suspend the watchdog temporarily when high read latency detected Greg Kroah-Hartman
` (186 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Zimmermann, Rafael J. Wysocki,
Sasha Levin
From: Tim Zimmermann <tim@linux4.de>
[ Upstream commit 40dc1929089fc844ea06d9f8bdb6211ed4517c2e ]
Add the PCI ID for the Wellsburg C610 series chipset PCH.
The driver can read the temperature from the Wellsburg PCH with only
the PCI ID added and no other modifications.
Signed-off-by: Tim Zimmermann <tim@linux4.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/intel/intel_pch_thermal.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/thermal/intel/intel_pch_thermal.c b/drivers/thermal/intel/intel_pch_thermal.c
index 527c91f5960be..768c66046a599 100644
--- a/drivers/thermal/intel/intel_pch_thermal.c
+++ b/drivers/thermal/intel/intel_pch_thermal.c
@@ -29,6 +29,7 @@
#define PCH_THERMAL_DID_CNL_LP 0x02F9 /* CNL-LP PCH */
#define PCH_THERMAL_DID_CML_H 0X06F9 /* CML-H PCH */
#define PCH_THERMAL_DID_LWB 0xA1B1 /* Lewisburg PCH */
+#define PCH_THERMAL_DID_WBG 0x8D24 /* Wellsburg PCH */
/* Wildcat Point-LP PCH Thermal registers */
#define WPT_TEMP 0x0000 /* Temperature */
@@ -345,6 +346,7 @@ enum board_ids {
board_cnl,
board_cml,
board_lwb,
+ board_wbg,
};
static const struct board_info {
@@ -375,6 +377,10 @@ static const struct board_info {
.name = "pch_lewisburg",
.ops = &pch_dev_ops_wpt,
},
+ [board_wbg] = {
+ .name = "pch_wellsburg",
+ .ops = &pch_dev_ops_wpt,
+ },
};
static int intel_pch_thermal_probe(struct pci_dev *pdev,
@@ -490,6 +496,8 @@ static const struct pci_device_id intel_pch_thermal_id[] = {
.driver_data = board_cml, },
{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_LWB),
.driver_data = board_lwb, },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_WBG),
+ .driver_data = board_wbg, },
{ 0, },
};
MODULE_DEVICE_TABLE(pci, intel_pch_thermal_id);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 385/567] clocksource: Suspend the watchdog temporarily when high read latency detected
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 384/567] thermal: intel: intel_pch: Add support for Wellsburg PCH Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 386/567] crypto: hisilicon: Wipe entire pool on error Greg Kroah-Hartman
` (185 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Feng Tang, Waiman Long, John Stultz,
Thomas Gleixner, Stephen Boyd, Paul E. McKenney, Sasha Levin
From: Feng Tang <feng.tang@intel.com>
[ Upstream commit b7082cdfc464bf9231300605d03eebf943dda307 ]
Bugs have been reported on 8 sockets x86 machines in which the TSC was
wrongly disabled when the system is under heavy workload.
[ 818.380354] clocksource: timekeeping watchdog on CPU336: hpet wd-wd read-back delay of 1203520ns
[ 818.436160] clocksource: wd-tsc-wd read-back delay of 181880ns, clock-skew test skipped!
[ 819.402962] clocksource: timekeeping watchdog on CPU338: hpet wd-wd read-back delay of 324000ns
[ 819.448036] clocksource: wd-tsc-wd read-back delay of 337240ns, clock-skew test skipped!
[ 819.880863] clocksource: timekeeping watchdog on CPU339: hpet read-back delay of 150280ns, attempt 3, marking unstable
[ 819.936243] tsc: Marking TSC unstable due to clocksource watchdog
[ 820.068173] TSC found unstable after boot, most likely due to broken BIOS. Use 'tsc=unstable'.
[ 820.092382] sched_clock: Marking unstable (818769414384, 1195404998)
[ 820.643627] clocksource: Checking clocksource tsc synchronization from CPU 267 to CPUs 0,4,25,70,126,430,557,564.
[ 821.067990] clocksource: Switched to clocksource hpet
This can be reproduced by running memory intensive 'stream' tests,
or some of the stress-ng subcases such as 'ioport'.
The reason for these issues is the when system is under heavy load, the
read latency of the clocksources can be very high. Even lightweight TSC
reads can show high latencies, and latencies are much worse for external
clocksources such as HPET or the APIC PM timer. These latencies can
result in false-positive clocksource-unstable determinations.
These issues were initially reported by a customer running on a production
system, and this problem was reproduced on several generations of Xeon
servers, especially when running the stress-ng test. These Xeon servers
were not production systems, but they did have the latest steppings
and firmware.
Given that the clocksource watchdog is a continual diagnostic check with
frequency of twice a second, there is no need to rush it when the system
is under heavy load. Therefore, when high clocksource read latencies
are detected, suspend the watchdog timer for 5 minutes.
Signed-off-by: Feng Tang <feng.tang@intel.com>
Acked-by: Waiman Long <longman@redhat.com>
Cc: John Stultz <jstultz@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Stephen Boyd <sboyd@kernel.org>
Cc: Feng Tang <feng.tang@intel.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/clocksource.c | 45 ++++++++++++++++++++++++++++-----------
1 file changed, 32 insertions(+), 13 deletions(-)
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index bcad1a1e5dcf1..97ec98041f926 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -378,6 +378,15 @@ void clocksource_verify_percpu(struct clocksource *cs)
}
EXPORT_SYMBOL_GPL(clocksource_verify_percpu);
+static inline void clocksource_reset_watchdog(void)
+{
+ struct clocksource *cs;
+
+ list_for_each_entry(cs, &watchdog_list, wd_list)
+ cs->flags &= ~CLOCK_SOURCE_WATCHDOG;
+}
+
+
static void clocksource_watchdog(struct timer_list *unused)
{
u64 csnow, wdnow, cslast, wdlast, delta;
@@ -385,6 +394,7 @@ static void clocksource_watchdog(struct timer_list *unused)
int64_t wd_nsec, cs_nsec;
struct clocksource *cs;
enum wd_read_status read_ret;
+ unsigned long extra_wait = 0;
u32 md;
spin_lock(&watchdog_lock);
@@ -404,13 +414,30 @@ static void clocksource_watchdog(struct timer_list *unused)
read_ret = cs_watchdog_read(cs, &csnow, &wdnow);
- if (read_ret != WD_READ_SUCCESS) {
- if (read_ret == WD_READ_UNSTABLE)
- /* Clock readout unreliable, so give it up. */
- __clocksource_unstable(cs);
+ if (read_ret == WD_READ_UNSTABLE) {
+ /* Clock readout unreliable, so give it up. */
+ __clocksource_unstable(cs);
continue;
}
+ /*
+ * When WD_READ_SKIP is returned, it means the system is likely
+ * under very heavy load, where the latency of reading
+ * watchdog/clocksource is very big, and affect the accuracy of
+ * watchdog check. So give system some space and suspend the
+ * watchdog check for 5 minutes.
+ */
+ if (read_ret == WD_READ_SKIP) {
+ /*
+ * As the watchdog timer will be suspended, and
+ * cs->last could keep unchanged for 5 minutes, reset
+ * the counters.
+ */
+ clocksource_reset_watchdog();
+ extra_wait = HZ * 300;
+ break;
+ }
+
/* Clocksource initialized ? */
if (!(cs->flags & CLOCK_SOURCE_WATCHDOG) ||
atomic_read(&watchdog_reset_pending)) {
@@ -506,7 +533,7 @@ static void clocksource_watchdog(struct timer_list *unused)
* pair clocksource_stop_watchdog() clocksource_start_watchdog().
*/
if (!timer_pending(&watchdog_timer)) {
- watchdog_timer.expires += WATCHDOG_INTERVAL;
+ watchdog_timer.expires += WATCHDOG_INTERVAL + extra_wait;
add_timer_on(&watchdog_timer, next_cpu);
}
out:
@@ -531,14 +558,6 @@ static inline void clocksource_stop_watchdog(void)
watchdog_running = 0;
}
-static inline void clocksource_reset_watchdog(void)
-{
- struct clocksource *cs;
-
- list_for_each_entry(cs, &watchdog_list, wd_list)
- cs->flags &= ~CLOCK_SOURCE_WATCHDOG;
-}
-
static void clocksource_resume_watchdog(void)
{
atomic_inc(&watchdog_reset_pending);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 386/567] crypto: hisilicon: Wipe entire pool on error
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 385/567] clocksource: Suspend the watchdog temporarily when high read latency detected Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 387/567] net: bcmgenet: Add a check for oversized packets Greg Kroah-Hartman
` (184 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Weili Qian,
Zhou Wang, Herbert Xu, David S. Miller, linux-crypto, Kees Cook,
Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit aa85923a954e7704bc9d3847dabeb8540aa98d13 ]
To work around a Clang __builtin_object_size bug that shows up under
CONFIG_FORTIFY_SOURCE and UBSAN_BOUNDS, move the per-loop-iteration
mem_block wipe into a single wipe of the entire pool structure after
the loop.
Reported-by: Nathan Chancellor <nathan@kernel.org>
Link: https://github.com/ClangBuiltLinux/linux/issues/1780
Cc: Weili Qian <qianweili@huawei.com>
Cc: Zhou Wang <wangzhou1@hisilicon.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: linux-crypto@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Tested-by: Nathan Chancellor <nathan@kernel.org> # build
Link: https://lore.kernel.org/r/20230106041945.never.831-kees@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/sgl.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/crypto/hisilicon/sgl.c b/drivers/crypto/hisilicon/sgl.c
index 057273769f264..3dbe5405d17bc 100644
--- a/drivers/crypto/hisilicon/sgl.c
+++ b/drivers/crypto/hisilicon/sgl.c
@@ -122,9 +122,8 @@ struct hisi_acc_sgl_pool *hisi_acc_create_sgl_pool(struct device *dev,
for (j = 0; j < i; j++) {
dma_free_coherent(dev, block_size, block[j].sgl,
block[j].sgl_dma);
- memset(block + j, 0, sizeof(*block));
}
- kfree(pool);
+ kfree_sensitive(pool);
return ERR_PTR(-ENOMEM);
}
EXPORT_SYMBOL_GPL(hisi_acc_create_sgl_pool);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 387/567] net: bcmgenet: Add a check for oversized packets
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 386/567] crypto: hisilicon: Wipe entire pool on error Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 388/567] m68k: Check syscall_trace_enter() return code Greg Kroah-Hartman
` (183 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli, David S. Miller,
Sasha Levin
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit 5c0862c2c962052ed5055220a00ac1cefb92fbcd ]
Occasionnaly we may get oversized packets from the hardware which
exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early
check which drops the packet to avoid invoking skb_over_panic() and move
on to processing the next packet.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index ea13917537526..92cd2916e8015 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2267,6 +2267,14 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring,
__func__, p_index, ring->c_index,
ring->read_ptr, dma_length_status);
+ if (unlikely(len > RX_BUF_LENGTH)) {
+ netif_err(priv, rx_status, dev, "oversized packet\n");
+ dev->stats.rx_length_errors++;
+ dev->stats.rx_errors++;
+ dev_kfree_skb_any(skb);
+ goto next;
+ }
+
if (unlikely(!(dma_flag & DMA_EOP) || !(dma_flag & DMA_SOP))) {
netif_err(priv, rx_status, dev,
"dropping fragmented packet!\n");
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 388/567] m68k: Check syscall_trace_enter() return code
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 387/567] net: bcmgenet: Add a check for oversized packets Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 389/567] netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj() Greg Kroah-Hartman
` (182 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Schmitz, Geert Uytterhoeven,
Sasha Levin
From: Michael Schmitz <schmitzmic@gmail.com>
[ Upstream commit 2ca8a1de4437f21562e57f9ac123914747a8e7a1 ]
Check return code of syscall_trace_enter(), and skip syscall
if -1. Return code will be left at what had been set by
ptrace or seccomp (in regs->d0).
No regression seen in testing with strace on ARAnyM.
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20230112035529.13521-2-schmitzmic@gmail.com
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/m68k/68000/entry.S | 2 ++
arch/m68k/coldfire/entry.S | 2 ++
arch/m68k/kernel/entry.S | 3 +++
3 files changed, 7 insertions(+)
diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S
index 997b549330156..7d63e2f1555a0 100644
--- a/arch/m68k/68000/entry.S
+++ b/arch/m68k/68000/entry.S
@@ -45,6 +45,8 @@ do_trace:
jbsr syscall_trace_enter
RESTORE_SWITCH_STACK
addql #4,%sp
+ addql #1,%d0
+ jeq ret_from_exception
movel %sp@(PT_OFF_ORIG_D0),%d1
movel #-ENOSYS,%d0
cmpl #NR_syscalls,%d1
diff --git a/arch/m68k/coldfire/entry.S b/arch/m68k/coldfire/entry.S
index 9f337c70243a3..35104c5417ff4 100644
--- a/arch/m68k/coldfire/entry.S
+++ b/arch/m68k/coldfire/entry.S
@@ -90,6 +90,8 @@ ENTRY(system_call)
jbsr syscall_trace_enter
RESTORE_SWITCH_STACK
addql #4,%sp
+ addql #1,%d0
+ jeq ret_from_exception
movel %d3,%a0
jbsr %a0@
movel %d0,%sp@(PT_OFF_D0) /* save the return value */
diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S
index 9434fca68de5d..9f3663facaa0e 100644
--- a/arch/m68k/kernel/entry.S
+++ b/arch/m68k/kernel/entry.S
@@ -184,9 +184,12 @@ do_trace_entry:
jbsr syscall_trace
RESTORE_SWITCH_STACK
addql #4,%sp
+ addql #1,%d0 | optimization for cmpil #-1,%d0
+ jeq ret_from_syscall
movel %sp@(PT_OFF_ORIG_D0),%d0
cmpl #NR_syscalls,%d0
jcs syscall
+ jra ret_from_syscall
badsys:
movel #-ENOSYS,%sp@(PT_OFF_D0)
jra ret_from_syscall
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 389/567] netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 388/567] m68k: Check syscall_trace_enter() return code Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 390/567] tools/power/x86/intel-speed-select: Add Emerald Rapid quirk Greg Kroah-Hartman
` (181 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Pablo Neira Ayuso, Sasha Levin
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit dac7f50a45216d652887fb92d6cd3b7ca7f006ea ]
static analyzer detect null pointer dereference case for 'type'
function __nft_obj_type_get() can return NULL value which require to handle
if type is NULL pointer return -ENOENT.
This is a theoretical issue, since an existing object has a type, but
better add this failsafe check.
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 81bd13b3d8fd4..a02a25b7eae6d 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6794,6 +6794,9 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,
return -EOPNOTSUPP;
type = __nft_obj_type_get(objtype);
+ if (WARN_ON_ONCE(!type))
+ return -ENOENT;
+
nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 390/567] tools/power/x86/intel-speed-select: Add Emerald Rapid quirk
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 389/567] netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj() Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 391/567] wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup Greg Kroah-Hartman
` (180 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Rui, Srinivas Pandruvada,
Hans de Goede, Sasha Levin
From: Zhang Rui <rui.zhang@intel.com>
[ Upstream commit 61f9fdcdcd01f9a996b6db4e7092fcdfe8414ad5 ]
Need memory frequency quirk as Sapphire Rapids in Emerald Rapids.
So add Emerald Rapids CPU model check in is_spr_platform().
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
[srinivas.pandruvada@linux.intel.com: Subject, changelog and code edits]
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/power/x86/intel-speed-select/isst-config.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/power/x86/intel-speed-select/isst-config.c b/tools/power/x86/intel-speed-select/isst-config.c
index bf9fd3549a1d5..cd08ffe0d62b0 100644
--- a/tools/power/x86/intel-speed-select/isst-config.c
+++ b/tools/power/x86/intel-speed-select/isst-config.c
@@ -108,7 +108,7 @@ int is_skx_based_platform(void)
int is_spr_platform(void)
{
- if (cpu_model == 0x8F)
+ if (cpu_model == 0x8F || cpu_model == 0xCF)
return 1;
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 391/567] wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 390/567] tools/power/x86/intel-speed-select: Add Emerald Rapid quirk Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 392/567] ACPI: video: Fix Lenovo Ideapad Z570 DMI match Greg Kroah-Hartman
` (179 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Felix Fietkau,
Sasha Levin
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 1b88b47e898edef0e56e3a2f4e49f052a136153d ]
Free rx_head skb in mt76_dma_rx_cleanup routine in order to avoid
possible memory leak at module unload.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/dma.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index 7aecde35cb9a3..1aa0479c5fa4e 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -486,6 +486,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
bool more;
spin_lock_bh(&q->lock);
+
do {
buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more);
if (!buf)
@@ -493,6 +494,12 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
skb_free_frag(buf);
} while (1);
+
+ if (q->rx_head) {
+ dev_kfree_skb(q->rx_head);
+ q->rx_head = NULL;
+ }
+
spin_unlock_bh(&q->lock);
if (!q->rx_page.va)
@@ -515,12 +522,6 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
mt76_dma_rx_cleanup(dev, q);
mt76_dma_sync_idx(dev, q);
mt76_dma_rx_fill(dev, q);
-
- if (!q->rx_head)
- return;
-
- dev_kfree_skb(q->rx_head);
- q->rx_head = NULL;
}
static void
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 392/567] ACPI: video: Fix Lenovo Ideapad Z570 DMI match
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 391/567] wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 393/567] net/mlx5: fw_tracer: Fix debug print Greg Kroah-Hartman
` (178 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 2d11eae42d52a131f06061015e49dc0f085c5bfc ]
Multiple Ideapad Z570 variants need acpi_backlight=native to force native
use on these pre Windows 8 machines since acpi_video backlight control
does not work here.
The original DMI quirk matches on a product_name of "102434U" but other
variants may have different product_name-s such as e.g. "1024D9U".
Move to checking product_version instead as is more or less standard for
Lenovo DMI quirks for similar reasons.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/video_detect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index b13713199ad94..038542b3a80a7 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -313,7 +313,7 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
.ident = "Lenovo Ideapad Z570",
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
- DMI_MATCH(DMI_PRODUCT_NAME, "102434U"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "Ideapad Z570"),
},
},
{
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 393/567] net/mlx5: fw_tracer: Fix debug print
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 392/567] ACPI: video: Fix Lenovo Ideapad Z570 DMI match Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 394/567] coda: Avoid partial allocation of sig_inputArgs Greg Kroah-Hartman
` (177 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shay Drory, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
From: Shay Drory <shayd@nvidia.com>
[ Upstream commit 988c2352273997a242f15c4fc3711773515006a2 ]
The debug message specify tdsn, but takes as an argument the
tmsn. The correct argument is tmsn, hence, fix the print.
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
index 1c72fc0b7b68a..05c7c2140909f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
@@ -603,7 +603,7 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer,
} else {
cur_string = mlx5_tracer_message_get(tracer, tracer_event);
if (!cur_string) {
- pr_debug("%s Got string event for unknown string tdsm: %d\n",
+ pr_debug("%s Got string event for unknown string tmsn: %d\n",
__func__, tracer_event->string_event.tmsn);
return -1;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 394/567] coda: Avoid partial allocation of sig_inputArgs
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 393/567] net/mlx5: fw_tracer: Fix debug print Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 395/567] uaccess: Add minimum bounds check on kernel buffer size Greg Kroah-Hartman
` (176 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Harkes, coda, codalist,
Kees Cook, Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit 48df133578c70185a95a49390d42df1996ddba2a ]
GCC does not like having a partially allocated object, since it cannot
reason about it for bounds checking when it is passed to other code.
Instead, fully allocate sig_inputArgs. (Alternatively, sig_inputArgs
should be defined as a struct coda_in_hdr, if it is actually not using
any other part of the union.) Seen under GCC 13:
../fs/coda/upcall.c: In function 'coda_upcall':
../fs/coda/upcall.c:801:22: warning: array subscript 'union inputArgs[0]' is partly outside array bounds of 'unsigned char[20]' [-Warray-bounds=]
801 | sig_inputArgs->ih.opcode = CODA_SIGNAL;
| ^~
Cc: Jan Harkes <jaharkes@cs.cmu.edu>
Cc: coda@cs.cmu.edu
Cc: codalist@coda.cs.cmu.edu
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230127223921.never.882-kees@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/coda/upcall.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/coda/upcall.c b/fs/coda/upcall.c
index eb3b1898da462..610484c90260b 100644
--- a/fs/coda/upcall.c
+++ b/fs/coda/upcall.c
@@ -790,7 +790,7 @@ static int coda_upcall(struct venus_comm *vcp,
sig_req = kmalloc(sizeof(struct upc_req), GFP_KERNEL);
if (!sig_req) goto exit;
- sig_inputArgs = kvzalloc(sizeof(struct coda_in_hdr), GFP_KERNEL);
+ sig_inputArgs = kvzalloc(sizeof(*sig_inputArgs), GFP_KERNEL);
if (!sig_inputArgs) {
kfree(sig_req);
goto exit;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 395/567] uaccess: Add minimum bounds check on kernel buffer size
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 394/567] coda: Avoid partial allocation of sig_inputArgs Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 396/567] s390/idle: mark arch_cpu_idle() noinstr Greg Kroah-Hartman
` (175 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Brauner, Rasmus Villemoes,
Arnd Bergmann, Dinh Nguyen, Catalin Marinas, Andrew Morton,
Geert Uytterhoeven, Alexander Potapenko, Aleksa Sarai, Kees Cook,
Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit 04ffde1319a715bd0550ded3580d4ea3bc003776 ]
While there is logic about the difference between ksize and usize,
copy_struct_from_user() didn't check the size of the destination buffer
(when it was known) against ksize. Add this check so there is an upper
bounds check on the possible memset() call, otherwise lower bounds
checks made by callers will trigger bounds warnings under -Warray-bounds.
Seen under GCC 13:
In function 'copy_struct_from_user',
inlined from 'iommufd_fops_ioctl' at
../drivers/iommu/iommufd/main.c:333:8:
../include/linux/fortify-string.h:59:33: warning: '__builtin_memset' offset [57, 4294967294] is out of the bounds [0, 56] of object 'buf' with type 'union ucmd_buffer' [-Warray-bounds=]
59 | #define __underlying_memset __builtin_memset
| ^
../include/linux/fortify-string.h:453:9: note: in expansion of macro '__underlying_memset'
453 | __underlying_memset(p, c, __fortify_size); \
| ^~~~~~~~~~~~~~~~~~~
../include/linux/fortify-string.h:461:25: note: in expansion of macro '__fortify_memset_chk'
461 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \
| ^~~~~~~~~~~~~~~~~~~~
../include/linux/uaccess.h:334:17: note: in expansion of macro 'memset'
334 | memset(dst + size, 0, rest);
| ^~~~~~
../drivers/iommu/iommufd/main.c: In function 'iommufd_fops_ioctl':
../drivers/iommu/iommufd/main.c:311:27: note: 'buf' declared here
311 | union ucmd_buffer buf;
| ^~~
Cc: Christian Brauner <brauner@kernel.org>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Dinh Nguyen <dinguyen@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Alexander Potapenko <glider@google.com>
Acked-by: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/lkml/20230203193523.never.667-kees@kernel.org/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/uaccess.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index ac0394087f7d4..e1d59ca6530da 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -338,6 +338,10 @@ copy_struct_from_user(void *dst, size_t ksize, const void __user *src,
size_t size = min(ksize, usize);
size_t rest = max(ksize, usize) - size;
+ /* Double check if ksize is larger than a known object size. */
+ if (WARN_ON_ONCE(ksize > __builtin_object_size(dst, 1)))
+ return -E2BIG;
+
/* Deal with trailing bytes. */
if (usize < ksize) {
memset(dst + size, 0, rest);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 396/567] s390/idle: mark arch_cpu_idle() noinstr
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 395/567] uaccess: Add minimum bounds check on kernel buffer size Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 397/567] time/debug: Fix memory leak with using debugfs_lookup() Greg Kroah-Hartman
` (174 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sven Schnelle, Heiko Carstens, Sasha Levin
From: Heiko Carstens <hca@linux.ibm.com>
[ Upstream commit a9cbc1b471d291c865907542394f1c483b93a811 ]
linux-next commit ("cpuidle: tracing: Warn about !rcu_is_watching()")
adds a new warning which hits on s390's arch_cpu_idle() function:
RCU not on for: arch_cpu_idle+0x0/0x28
WARNING: CPU: 2 PID: 0 at include/linux/trace_recursion.h:162 arch_ftrace_ops_list_func+0x24c/0x258
Modules linked in:
CPU: 2 PID: 0 Comm: swapper/2 Not tainted 6.2.0-rc6-next-20230202 #4
Hardware name: IBM 8561 T01 703 (z/VM 7.3.0)
Krnl PSW : 0404d00180000000 00000000002b55c0 (arch_ftrace_ops_list_func+0x250/0x258)
R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
Krnl GPRS: c0000000ffffbfff 0000000080000002 0000000000000026 0000000000000000
0000037ffffe3a28 0000037ffffe3a20 0000000000000000 0000000000000000
0000000000000000 0000000000f4acf6 00000000001044f0 0000037ffffe3cb0
0000000000000000 0000000000000000 00000000002b55bc 0000037ffffe3bb8
Krnl Code: 00000000002b55b0: c02000840051 larl %r2,0000000001335652
00000000002b55b6: c0e5fff512d1 brasl %r14,0000000000157b58
#00000000002b55bc: af000000 mc 0,0
>00000000002b55c0: a7f4ffe7 brc 15,00000000002b558e
00000000002b55c4: 0707 bcr 0,%r7
00000000002b55c6: 0707 bcr 0,%r7
00000000002b55c8: eb6ff0480024 stmg %r6,%r15,72(%r15)
00000000002b55ce: b90400ef lgr %r14,%r15
Call Trace:
[<00000000002b55c0>] arch_ftrace_ops_list_func+0x250/0x258
([<00000000002b55bc>] arch_ftrace_ops_list_func+0x24c/0x258)
[<0000000000f5f0fc>] ftrace_common+0x1c/0x20
[<00000000001044f6>] arch_cpu_idle+0x6/0x28
[<0000000000f4acf6>] default_idle_call+0x76/0x128
[<00000000001cc374>] do_idle+0xf4/0x1b0
[<00000000001cc6ce>] cpu_startup_entry+0x36/0x40
[<0000000000119d00>] smp_start_secondary+0x140/0x150
[<0000000000f5d2ae>] restart_int_handler+0x6e/0x90
Mark arch_cpu_idle() noinstr like all other architectures with
CONFIG_ARCH_WANTS_NO_INSTR (should) have it to fix this.
Reviewed-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kernel/idle.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c
index 4bf1ee293f2b3..a0da049e73609 100644
--- a/arch/s390/kernel/idle.c
+++ b/arch/s390/kernel/idle.c
@@ -44,7 +44,7 @@ void account_idle_time_irq(void)
S390_lowcore.last_update_timer = idle->timer_idle_exit;
}
-void arch_cpu_idle(void)
+void noinstr arch_cpu_idle(void)
{
struct s390_idle_data *idle = this_cpu_ptr(&s390_idle);
unsigned long idle_time;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 397/567] time/debug: Fix memory leak with using debugfs_lookup()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 396/567] s390/idle: mark arch_cpu_idle() noinstr Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 398/567] PM: domains: fix " Greg Kroah-Hartman
` (173 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Sasha Levin
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 5b268d8abaec6cbd4bd70d062e769098d96670aa ]
When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time. To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic at
once.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20230202151214.2306822-1-gregkh@linuxfoundation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/test_udelay.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/time/test_udelay.c b/kernel/time/test_udelay.c
index 13b11eb62685e..20d5df631570e 100644
--- a/kernel/time/test_udelay.c
+++ b/kernel/time/test_udelay.c
@@ -149,7 +149,7 @@ module_init(udelay_test_init);
static void __exit udelay_test_exit(void)
{
mutex_lock(&udelay_test_lock);
- debugfs_remove(debugfs_lookup(DEBUGFS_FILENAME, NULL));
+ debugfs_lookup_and_remove(DEBUGFS_FILENAME, NULL);
mutex_unlock(&udelay_test_lock);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 398/567] PM: domains: fix memory leak with using debugfs_lookup()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 397/567] time/debug: Fix memory leak with using debugfs_lookup() Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 399/567] PM: EM: " Greg Kroah-Hartman
` (172 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ulf Hansson, Rafael J. Wysocki, Sasha Levin
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 0b6200e1e9f53dabdc30d0f6c51af9a5f664d32b ]
When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time. To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/power/domain.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 94fe30c187ad8..24a82e252b7e1 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -217,13 +217,10 @@ static void genpd_debug_add(struct generic_pm_domain *genpd);
static void genpd_debug_remove(struct generic_pm_domain *genpd)
{
- struct dentry *d;
-
if (!genpd_debugfs_dir)
return;
- d = debugfs_lookup(genpd->name, genpd_debugfs_dir);
- debugfs_remove(d);
+ debugfs_lookup_and_remove(genpd->name, genpd_debugfs_dir);
}
static void genpd_update_accounting(struct generic_pm_domain *genpd)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 399/567] PM: EM: fix memory leak with using debugfs_lookup()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 398/567] PM: domains: fix " Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 400/567] Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE Greg Kroah-Hartman
` (171 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Sasha Levin
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit a0e8c13ccd6a9a636d27353da62c2410c4eca337 ]
When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time. To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/power/energy_model.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c
index 97e62469a6b32..1b902f986f91c 100644
--- a/kernel/power/energy_model.c
+++ b/kernel/power/energy_model.c
@@ -85,10 +85,7 @@ static void em_debug_create_pd(struct device *dev)
static void em_debug_remove_pd(struct device *dev)
{
- struct dentry *debug_dir;
-
- debug_dir = debugfs_lookup(dev_name(dev), rootdir);
- debugfs_remove_recursive(debug_dir);
+ debugfs_lookup_and_remove(dev_name(dev), rootdir);
}
static int __init em_debug_init(void)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 400/567] Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 399/567] PM: EM: " Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 401/567] hv_netvsc: Check status in SEND_RNDIS_PKT completion message Greg Kroah-Hartman
` (170 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Moises Cardona,
Luiz Augusto von Dentz, Sasha Levin
From: Moises Cardona <moisesmcardona@gmail.com>
[ Upstream commit 1eec3b95b5ce7fb2cdd273ac4f8b24b1ed6776a1 ]
This patch adds VID:PID 13d3:3529 to the btusb.c file.
This VID:PID is found in the Realtek RTL8821CE module
(M.2 module AW-CB304NF on an ASUS E210MA laptop)
Output of /sys/kernel/debug/usb/devices:
T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=02 Dev#= 3 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3529 Rev= 1.10
S: Manufacturer=Realtek
S: Product=Bluetooth Radio
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Signed-off-by: Moises Cardona <moisesmcardona@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 9c32263f872b9..9eb2267bd3a02 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -400,6 +400,10 @@ static const struct usb_device_id blacklist_table[] = {
{ USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
.driver_info = BTUSB_IGNORE },
+ /* Realtek 8821CE Bluetooth devices */
+ { USB_DEVICE(0x13d3, 0x3529), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+
/* Realtek 8822CE Bluetooth devices */
{ USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 401/567] hv_netvsc: Check status in SEND_RNDIS_PKT completion message
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 400/567] Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 402/567] scm: add user copy checks to put_cmsg() Greg Kroah-Hartman
` (169 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Kelley, Haiyang Zhang,
Paolo Abeni, Sasha Levin
From: Michael Kelley <mikelley@microsoft.com>
[ Upstream commit dca5161f9bd052e9e73be90716ffd57e8762c697 ]
Completion responses to SEND_RNDIS_PKT messages are currently processed
regardless of the status in the response, so that resources associated
with the request are freed. While this is appropriate, code bugs that
cause sending a malformed message, or errors on the Hyper-V host, go
undetected. Fix this by checking the status and outputting a rate-limited
message if there is an error.
Signed-off-by: Michael Kelley <mikelley@microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Link: https://lore.kernel.org/r/1676264881-48928-1-git-send-email-mikelley@microsoft.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/hyperv/netvsc.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index fb2448f9a8b17..4156299e039d8 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -814,6 +814,7 @@ static void netvsc_send_completion(struct net_device *ndev,
u32 msglen = hv_pkt_datalen(desc);
struct nvsp_message *pkt_rqst;
u64 cmd_rqst;
+ u32 status;
/* First check if this is a VMBUS completion without data payload */
if (!msglen) {
@@ -885,6 +886,23 @@ static void netvsc_send_completion(struct net_device *ndev,
break;
case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE:
+ if (msglen < sizeof(struct nvsp_message_header) +
+ sizeof(struct nvsp_1_message_send_rndis_packet_complete)) {
+ if (net_ratelimit())
+ netdev_err(ndev, "nvsp_rndis_pkt_complete length too small: %u\n",
+ msglen);
+ return;
+ }
+
+ /* If status indicates an error, output a message so we know
+ * there's a problem. But process the completion anyway so the
+ * resources are released.
+ */
+ status = nvsp_packet->msg.v1_msg.send_rndis_pkt_complete.status;
+ if (status != NVSP_STAT_SUCCESS && net_ratelimit())
+ netdev_err(ndev, "nvsp_rndis_pkt_complete error status: %x\n",
+ status);
+
netvsc_send_tx_complete(ndev, net_device, incoming_channel,
desc, budget);
break;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 402/567] scm: add user copy checks to put_cmsg()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 401/567] hv_netvsc: Check status in SEND_RNDIS_PKT completion message Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 403/567] drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write Greg Kroah-Hartman
` (168 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Kees Cook,
David S. Miller, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 5f1eb1ff58ea122e24adf0bc940f268ed2227462 ]
This is a followup of commit 2558b8039d05 ("net: use a bounce
buffer for copying skb->mark")
x86 and powerpc define user_access_begin, meaning
that they are not able to perform user copy checks
when using user_write_access_begin() / unsafe_copy_to_user()
and friends [1]
Instead of waiting bugs to trigger on other arches,
add a check_object_size() in put_cmsg() to make sure
that new code tested on x86 with CONFIG_HARDENED_USERCOPY=y
will perform more security checks.
[1] We can not generically call check_object_size() from
unsafe_copy_to_user() because UACCESS is enabled at this point.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Kees Cook <keescook@chromium.org>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/scm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/core/scm.c b/net/core/scm.c
index 5c356f0dee30c..acb7d776fa6ec 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -229,6 +229,8 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
if (msg->msg_control_is_user) {
struct cmsghdr __user *cm = msg->msg_control_user;
+ check_object_size(data, cmlen - sizeof(*cm), true);
+
if (!user_write_access_begin(cm, cmlen))
goto efault;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 403/567] drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 402/567] scm: add user copy checks to put_cmsg() Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 404/567] drm/amd/display: Fix potential null-deref in dm_resume Greg Kroah-Hartman
` (167 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wayne Lin, Jasdeep Dhillon,
Ian Chen, Alex Deucher, Sasha Levin
From: Ian Chen <ian.chen@amd.com>
[ Upstream commit 639f6ad6df7f47db48b59956b469a6917a136afb ]
[WHY]
It causes regression AMD source will not write DPCD 340.
Reviewed-by: Wayne Lin <Wayne.Lin@amd.com>
Acked-by: Jasdeep Dhillon <jdhillon@amd.com>
Signed-off-by: Ian Chen <ian.chen@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_link.c | 6 ------
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 14 +++-----------
drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 1 -
3 files changed, 3 insertions(+), 18 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 3c4205248efc2..b727bd7e039d7 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -1665,12 +1665,6 @@ struct dc_link *link_create(const struct link_init_data *init_params)
if (false == dc_link_construct(link, init_params))
goto construct_fail;
- /*
- * Must use preferred_link_setting, not reported_link_cap or verified_link_cap,
- * since struct preferred_link_setting won't be reset after S3.
- */
- link->preferred_link_setting.dpcd_source_device_specific_field_support = true;
-
return link;
construct_fail:
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index a6ff1b17fd22a..6777adb66f9d7 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -4841,18 +4841,10 @@ void dpcd_set_source_specific_data(struct dc_link *link)
uint8_t hblank_size = (uint8_t)link->dc->caps.min_horizontal_blanking_period;
- if (link->preferred_link_setting.dpcd_source_device_specific_field_support) {
- result_write_min_hblank = core_link_write_dpcd(link,
- DP_SOURCE_MINIMUM_HBLANK_SUPPORTED, (uint8_t *)(&hblank_size),
- sizeof(hblank_size));
-
- if (result_write_min_hblank == DC_ERROR_UNEXPECTED)
- link->preferred_link_setting.dpcd_source_device_specific_field_support = false;
- } else {
- DC_LOG_DC("Sink device does not support 00340h DPCD write. Skipping on purpose.\n");
- }
+ result_write_min_hblank = core_link_write_dpcd(link,
+ DP_SOURCE_MINIMUM_HBLANK_SUPPORTED, (uint8_t *)(&hblank_size),
+ sizeof(hblank_size));
}
-
DC_TRACE_LEVEL_MESSAGE(DAL_TRACE_LEVEL_INFORMATION,
WPP_BIT_FLAG_DC_DETECTION_DP_CAPS,
"result=%u link_index=%u enum dce_version=%d DPCD=0x%04X min_hblank=%u branch_dev_id=0x%x branch_dev_name='%c%c%c%c%c%c'",
diff --git a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
index 4f54bde1bb1c7..1948cd9427d7e 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
@@ -109,7 +109,6 @@ struct dc_link_settings {
enum dc_link_spread link_spread;
bool use_link_rate_set;
uint8_t link_rate_set;
- bool dpcd_source_device_specific_field_support;
};
struct dc_lane_settings {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 404/567] drm/amd/display: Fix potential null-deref in dm_resume
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 403/567] drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 405/567] drm/omap: dsi: Fix excessive stack usage Greg Kroah-Hartman
` (166 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Wayne Lin, Jasdeep Dhillon, Roman Li, Alex Deucher, Sasha Levin
From: Roman Li <roman.li@amd.com>
[ Upstream commit 7a7175a2cd84b7874bebbf8e59f134557a34161b ]
[Why]
Fixing smatch error:
dm_resume() error: we previously assumed 'aconnector->dc_link' could be null
[How]
Check if dc_link null at the beginning of the loop,
so further checks can be dropped.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Wayne Lin <Wayne.Lin@amd.com>
Acked-by: Jasdeep Dhillon <jdhillon@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b4293b5a82526..68c98e30fee71 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2687,12 +2687,14 @@ static int dm_resume(void *handle)
drm_for_each_connector_iter(connector, &iter) {
aconnector = to_amdgpu_dm_connector(connector);
+ if (!aconnector->dc_link)
+ continue;
+
/*
* this is the case when traversing through already created
* MST connectors, should be skipped
*/
- if (aconnector->dc_link &&
- aconnector->dc_link->type == dc_connection_mst_branch)
+ if (aconnector->dc_link->type == dc_connection_mst_branch)
continue;
mutex_lock(&aconnector->hpd_lock);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 405/567] drm/omap: dsi: Fix excessive stack usage
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 404/567] drm/amd/display: Fix potential null-deref in dm_resume Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 406/567] HID: Add Mapping for System Microphone Mute Greg Kroah-Hartman
` (165 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomi Valkeinen, kernel test robot,
Arnd Bergmann, Sasha Levin
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit cfca78971b9233aef0891507a98fba62046d4542 ]
dsi_dump_dsi_irqs(), a function used for debugfs prints, has a large
struct in its frame, which can result in:
drivers/gpu/drm/omapdrm/dss/dsi.c:1126:1: warning: the frame size of 1060 bytes is larger than 1024 bytes [-Wframe-larger-than=]
As the performance of the function is of no concern, let's allocate the
struct with kmalloc instead.
Compile-tested only.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20220916082206.167427-1-tomi.valkeinen@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/omapdrm/dss/dsi.c | 26 ++++++++++++++++----------
1 file changed, 16 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index 5f1722b040f46..41da86cd8b64c 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -1039,22 +1039,26 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
{
struct dsi_data *dsi = s->private;
unsigned long flags;
- struct dsi_irq_stats stats;
+ struct dsi_irq_stats *stats;
+
+ stats = kmalloc(sizeof(*stats), GFP_KERNEL);
+ if (!stats)
+ return -ENOMEM;
spin_lock_irqsave(&dsi->irq_stats_lock, flags);
- stats = dsi->irq_stats;
+ *stats = dsi->irq_stats;
memset(&dsi->irq_stats, 0, sizeof(dsi->irq_stats));
dsi->irq_stats.last_reset = jiffies;
spin_unlock_irqrestore(&dsi->irq_stats_lock, flags);
seq_printf(s, "period %u ms\n",
- jiffies_to_msecs(jiffies - stats.last_reset));
+ jiffies_to_msecs(jiffies - stats->last_reset));
- seq_printf(s, "irqs %d\n", stats.irq_count);
+ seq_printf(s, "irqs %d\n", stats->irq_count);
#define PIS(x) \
- seq_printf(s, "%-20s %10d\n", #x, stats.dsi_irqs[ffs(DSI_IRQ_##x)-1]);
+ seq_printf(s, "%-20s %10d\n", #x, stats->dsi_irqs[ffs(DSI_IRQ_##x)-1]);
seq_printf(s, "-- DSI%d interrupts --\n", dsi->module_id + 1);
PIS(VC0);
@@ -1078,10 +1082,10 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
#define PIS(x) \
seq_printf(s, "%-20s %10d %10d %10d %10d\n", #x, \
- stats.vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \
- stats.vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \
- stats.vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \
- stats.vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);
+ stats->vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \
+ stats->vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \
+ stats->vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \
+ stats->vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);
seq_printf(s, "-- VC interrupts --\n");
PIS(CS);
@@ -1097,7 +1101,7 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
#define PIS(x) \
seq_printf(s, "%-20s %10d\n", #x, \
- stats.cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);
+ stats->cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);
seq_printf(s, "-- CIO interrupts --\n");
PIS(ERRSYNCESC1);
@@ -1122,6 +1126,8 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
PIS(ULPSACTIVENOT_ALL1);
#undef PIS
+ kfree(stats);
+
return 0;
}
#endif
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 406/567] HID: Add Mapping for System Microphone Mute
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 405/567] drm/omap: dsi: Fix excessive stack usage Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 407/567] drm/tiny: ili9486: Do not assume 8-bit only SPI controllers Greg Kroah-Hartman
` (164 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jingyuan Liang, Dmitry Torokhov,
Jiri Kosina, Sasha Levin
From: Jingyuan Liang <jingyliang@chromium.org>
[ Upstream commit 2d60f9f4f26785a00273cb81fe60eff129ebd449 ]
HUTRR110 added a new usage code for a key that is supposed to
mute/unmute microphone system-wide.
Map the new usage code(0x01 0xa9) to keycode KEY_MICMUTE.
Additionally hid-debug is adjusted to recognize this keycode as well.
Signed-off-by: Jingyuan Liang <jingyliang@chromium.org>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-debug.c | 1 +
drivers/hid/hid-input.c | 8 ++++++++
2 files changed, 9 insertions(+)
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index f48d3534e0200..03da865e423c7 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -937,6 +937,7 @@ static const char *keys[KEY_MAX + 1] = {
[KEY_KBD_LAYOUT_NEXT] = "KbdLayoutNext",
[KEY_EMOJI_PICKER] = "EmojiPicker",
[KEY_DICTATE] = "Dictate",
+ [KEY_MICMUTE] = "MicrophoneMute",
[KEY_BRIGHTNESS_MIN] = "BrightnessMin",
[KEY_BRIGHTNESS_MAX] = "BrightnessMax",
[KEY_BRIGHTNESS_AUTO] = "BrightnessAuto",
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index f197aed6444a5..0ae959e54462b 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -709,6 +709,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
break;
}
+ if ((usage->hid & 0xf0) == 0xa0) { /* SystemControl */
+ switch (usage->hid & 0xf) {
+ case 0x9: map_key_clear(KEY_MICMUTE); break;
+ default: goto ignore;
+ }
+ break;
+ }
+
if ((usage->hid & 0xf0) == 0xb0) { /* SC - Display */
switch (usage->hid & 0xf) {
case 0x05: map_key_clear(KEY_SWITCHVIDEOMODE); break;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 407/567] drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 406/567] HID: Add Mapping for System Microphone Mute Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 408/567] drm/radeon: free iio for atombios when driver shutdown Greg Kroah-Hartman
` (163 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Carlo Caione,
Kamlesh Gurudasani, Sasha Levin
From: Carlo Caione <ccaione@baylibre.com>
[ Upstream commit 77772e607522daa61f3af74df018559db75c43d6 ]
The pixel data for the ILI9486 is always 16-bits wide and it must be
sent over the SPI bus. When the controller is only able to deal with
8-bit transfers, this 16-bits data needs to be swapped before the
sending to account for the big endian bus, this is on the contrary not
needed when the SPI controller already supports 16-bits transfers.
The decision about swapping the pixel data or not is taken in the MIPI
DBI code by probing the controller capabilities: if the controller only
suppors 8-bit transfers the data is swapped, otherwise it is not.
This swapping/non-swapping is relying on the assumption that when the
controller does support 16-bit transactions then the data is sent
unswapped in 16-bits-per-word over SPI.
The problem with the ILI9486 driver is that it is forcing 8-bit
transactions also for controllers supporting 16-bits, violating the
assumption and corrupting the pixel data.
Align the driver to what is done in the MIPI DBI code by adjusting the
transfer size to the maximum allowed by the SPI controller.
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
Reviewed-by: Kamlesh Gurudasani <kamlesh.gurudasani@gmail.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20221116-s905x_spi_ili9486-v4-2-f86b4463b9e4@baylibre.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tiny/ili9486.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/tiny/ili9486.c b/drivers/gpu/drm/tiny/ili9486.c
index e9a63f4b2993c..e159dfb5f7fe5 100644
--- a/drivers/gpu/drm/tiny/ili9486.c
+++ b/drivers/gpu/drm/tiny/ili9486.c
@@ -43,6 +43,7 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par,
size_t num)
{
struct spi_device *spi = mipi->spi;
+ unsigned int bpw = 8;
void *data = par;
u32 speed_hz;
int i, ret;
@@ -56,8 +57,6 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par,
* The displays are Raspberry Pi HATs and connected to the 8-bit only
* SPI controller, so 16-bit command and parameters need byte swapping
* before being transferred as 8-bit on the big endian SPI bus.
- * Pixel data bytes have already been swapped before this function is
- * called.
*/
buf[0] = cpu_to_be16(*cmd);
gpiod_set_value_cansleep(mipi->dc, 0);
@@ -71,12 +70,18 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par,
for (i = 0; i < num; i++)
buf[i] = cpu_to_be16(par[i]);
num *= 2;
- speed_hz = mipi_dbi_spi_cmd_max_speed(spi, num);
data = buf;
}
+ /*
+ * Check whether pixel data bytes needs to be swapped or not
+ */
+ if (*cmd == MIPI_DCS_WRITE_MEMORY_START && !mipi->swap_bytes)
+ bpw = 16;
+
gpiod_set_value_cansleep(mipi->dc, 1);
- ret = mipi_dbi_spi_transfer(spi, speed_hz, 8, data, num);
+ speed_hz = mipi_dbi_spi_cmd_max_speed(spi, num);
+ ret = mipi_dbi_spi_transfer(spi, speed_hz, bpw, data, num);
free:
kfree(buf);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 408/567] drm/radeon: free iio for atombios when driver shutdown
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 407/567] drm/tiny: ili9486: Do not assume 8-bit only SPI controllers Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 409/567] scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write Greg Kroah-Hartman
` (162 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Liwei Song, Alex Deucher, Sasha Levin
From: Liwei Song <liwei.song@windriver.com>
[ Upstream commit 4773fadedca918faec443daaca5e4ea1c0ced144 ]
Fix below kmemleak when unload radeon driver:
unreferenced object 0xffff9f8608ede200 (size 512):
comm "systemd-udevd", pid 326, jiffies 4294682822 (age 716.338s)
hex dump (first 32 bytes):
00 00 00 00 c4 aa ec aa 14 ab 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000062fadebe>] kmem_cache_alloc_trace+0x2f1/0x500
[<00000000b6883cea>] atom_parse+0x117/0x230 [radeon]
[<00000000158c23fd>] radeon_atombios_init+0xab/0x170 [radeon]
[<00000000683f672e>] si_init+0x57/0x750 [radeon]
[<00000000566cc31f>] radeon_device_init+0x559/0x9c0 [radeon]
[<0000000046efabb3>] radeon_driver_load_kms+0xc1/0x1a0 [radeon]
[<00000000b5155064>] drm_dev_register+0xdd/0x1d0
[<0000000045fec835>] radeon_pci_probe+0xbd/0x100 [radeon]
[<00000000e69ecca3>] pci_device_probe+0xe1/0x160
[<0000000019484b76>] really_probe.part.0+0xc1/0x2c0
[<000000003f2649da>] __driver_probe_device+0x96/0x130
[<00000000231c5bb1>] driver_probe_device+0x24/0xf0
[<0000000000a42377>] __driver_attach+0x77/0x190
[<00000000d7574da6>] bus_for_each_dev+0x7f/0xd0
[<00000000633166d2>] driver_attach+0x1e/0x30
[<00000000313b05b8>] bus_add_driver+0x12c/0x1e0
iio was allocated in atom_index_iio() called by atom_parse(),
but it doesn't got released when the dirver is shutdown.
Fix this kmemleak by free it in radeon_atombios_fini().
Signed-off-by: Liwei Song <liwei.song@windriver.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/radeon_device.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 92905ebb7b459..1c005e0ddd388 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1022,6 +1022,7 @@ void radeon_atombios_fini(struct radeon_device *rdev)
{
if (rdev->mode_info.atom_context) {
kfree(rdev->mode_info.atom_context->scratch);
+ kfree(rdev->mode_info.atom_context->iio);
}
kfree(rdev->mode_info.atom_context);
rdev->mode_info.atom_context = NULL;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 409/567] scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 408/567] drm/radeon: free iio for atombios when driver shutdown Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 410/567] Revert "fbcon: dont lose the console font across generic->chip driver switch" Greg Kroah-Hartman
` (161 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Tee, Martin K. Petersen, Sasha Levin
From: Justin Tee <justin.tee@broadcom.com>
[ Upstream commit 21681b81b9ae548c5dae7ae00d931197a27f480c ]
During the sysfs firmware write process, a use-after-free read warning is
logged from the lpfc_wr_object() routine:
BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc]
Use-after-free read at 0x0000000000cf164d (in kfence-#111):
lpfc_wr_object+0x235/0x310 [lpfc]
lpfc_write_firmware.cold+0x206/0x30d [lpfc]
lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc]
lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc]
kernfs_fop_write_iter+0x121/0x1b0
new_sync_write+0x11c/0x1b0
vfs_write+0x1ef/0x280
ksys_write+0x5f/0xe0
do_syscall_64+0x59/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The driver accessed wr_object pointer data, which was initialized into
mailbox payload memory, after the mailbox object was released back to the
mailbox pool.
Fix by moving the mailbox free calls to the end of the routine ensuring
that we don't reference internal mailbox memory after release.
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_sli.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index df3b190fccd16..7d333167047f5 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -21066,6 +21066,7 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list,
struct lpfc_mbx_wr_object *wr_object;
LPFC_MBOXQ_t *mbox;
int rc = 0, i = 0;
+ int mbox_status = 0;
uint32_t shdr_status, shdr_add_status, shdr_add_status_2;
uint32_t shdr_change_status = 0, shdr_csf = 0;
uint32_t mbox_tmo;
@@ -21111,11 +21112,15 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list,
wr_object->u.request.bde_count = i;
bf_set(lpfc_wr_object_write_length, &wr_object->u.request, written);
if (!phba->sli4_hba.intr_enable)
- rc = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL);
+ mbox_status = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL);
else {
mbox_tmo = lpfc_mbox_tmo_val(phba, mbox);
- rc = lpfc_sli_issue_mbox_wait(phba, mbox, mbox_tmo);
+ mbox_status = lpfc_sli_issue_mbox_wait(phba, mbox, mbox_tmo);
}
+
+ /* The mbox status needs to be maintained to detect MBOX_TIMEOUT. */
+ rc = mbox_status;
+
/* The IOCTL status is embedded in the mailbox subheader. */
shdr_status = bf_get(lpfc_mbox_hdr_status,
&wr_object->header.cfg_shdr.response);
@@ -21130,10 +21135,6 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list,
&wr_object->u.response);
}
- if (!phba->sli4_hba.intr_enable)
- mempool_free(mbox, phba->mbox_mem_pool);
- else if (rc != MBX_TIMEOUT)
- mempool_free(mbox, phba->mbox_mem_pool);
if (shdr_status || shdr_add_status || shdr_add_status_2 || rc) {
lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
"3025 Write Object mailbox failed with "
@@ -21151,6 +21152,12 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list,
lpfc_log_fw_write_cmpl(phba, shdr_status, shdr_add_status,
shdr_add_status_2, shdr_change_status,
shdr_csf);
+
+ if (!phba->sli4_hba.intr_enable)
+ mempool_free(mbox, phba->mbox_mem_pool);
+ else if (mbox_status != MBX_TIMEOUT)
+ mempool_free(mbox, phba->mbox_mem_pool);
+
return rc;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 410/567] Revert "fbcon: dont lose the console font across generic->chip driver switch"
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 409/567] scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 411/567] drm: amd: display: Fix memory leakage Greg Kroah-Hartman
` (160 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann,
Javier Martinez Canillas, Sasha Levin
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 12d5796d55f9fd9e4b621003127c99e176665064 ]
This reverts commit ae1287865f5361fa138d4d3b1b6277908b54eac9.
Always free the console font when deinitializing the framebuffer
console. Subsequent framebuffer consoles will then use the default
font. Rely on userspace to load any user-configured font for these
consoles.
Commit ae1287865f53 ("fbcon: don't lose the console font across
generic->chip driver switch") was introduced to work around losing
the font during graphics-device handover. [1][2] It kept a dangling
pointer with the font data between loading the two consoles, which is
fairly adventurous hack. It also never covered cases when the other
consoles, such as VGA text mode, where involved.
The problem has meanwhile been solved in userspace. Systemd comes
with a udev rule that re-installs the configured font when a console
comes up. [3] So the kernel workaround can be removed.
This also removes one of the two special cases triggered by setting
FBINFO_MISC_FIRMWARE in an fbdev driver.
Tested during device handover from efifb and simpledrm to radeon. Udev
reloads the configured console font for the new driver's terminal.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://bugzilla.redhat.com/show_bug.cgi?id=892340 # 1
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1074624 # 2
Link: https://cgit.freedesktop.org/systemd/systemd/tree/src/vconsole/90-vconsole.rules.in?h=v222 # 3
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221219160516.23436-3-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/fbcon.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index d90d807c67561..b6712655ec1f0 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -989,7 +989,7 @@ static const char *fbcon_startup(void)
set_blitting_type(vc, info);
/* Setup default font */
- if (!p->fontdata && !vc->vc_font.data) {
+ if (!p->fontdata) {
if (!fontname[0] || !(font = find_font(fontname)))
font = get_default_font(info->var.xres,
info->var.yres,
@@ -999,8 +999,6 @@ static const char *fbcon_startup(void)
vc->vc_font.height = font->height;
vc->vc_font.data = (void *)(p->fontdata = font->data);
vc->vc_font.charcount = font->charcount;
- } else {
- p->fontdata = vc->vc_font.data;
}
cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
@@ -1167,9 +1165,9 @@ static void fbcon_init(struct vc_data *vc, int init)
ops->p = &fb_display[fg_console];
}
-static void fbcon_free_font(struct fbcon_display *p, bool freefont)
+static void fbcon_free_font(struct fbcon_display *p)
{
- if (freefont && p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0))
+ if (p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0))
kfree(p->fontdata - FONT_EXTRA_WORDS * sizeof(int));
p->fontdata = NULL;
p->userfont = 0;
@@ -1183,8 +1181,8 @@ static void fbcon_deinit(struct vc_data *vc)
struct fb_info *info;
struct fbcon_ops *ops;
int idx;
- bool free_font = true;
+ fbcon_free_font(p);
idx = con2fb_map[vc->vc_num];
if (idx == -1)
@@ -1195,8 +1193,6 @@ static void fbcon_deinit(struct vc_data *vc)
if (!info)
goto finished;
- if (info->flags & FBINFO_MISC_FIRMWARE)
- free_font = false;
ops = info->fbcon_par;
if (!ops)
@@ -1208,9 +1204,8 @@ static void fbcon_deinit(struct vc_data *vc)
ops->flags &= ~FBCON_FLAGS_INIT;
finished:
- fbcon_free_font(p, free_font);
- if (free_font)
- vc->vc_font.data = NULL;
+ fbcon_free_font(p);
+ vc->vc_font.data = NULL;
if (vc->vc_hi_font_mask && vc->vc_screenbuf)
set_vc_hi_font(vc, false);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 411/567] drm: amd: display: Fix memory leakage
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 410/567] Revert "fbcon: dont lose the console font across generic->chip driver switch" Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 412/567] drm/msm/dsi: Add missing check for alloc_ordered_workqueue Greg Kroah-Hartman
` (159 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Meskhidze, Alex Deucher,
Sasha Levin
From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
[ Upstream commit 6b8701be1f66064ca72733c5f6e13748cdbf8397 ]
This commit fixes memory leakage in dc_construct_ctx() function.
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 6c9378208127d..eca882438f6ef 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -771,6 +771,7 @@ static bool dc_construct_ctx(struct dc *dc,
dc_ctx->perf_trace = dc_perf_trace_create();
if (!dc_ctx->perf_trace) {
+ kfree(dc_ctx);
ASSERT_CRITICAL(false);
return false;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 412/567] drm/msm/dsi: Add missing check for alloc_ordered_workqueue
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 411/567] drm: amd: display: Fix memory leakage Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 413/567] docs/scripts/gdb: add necessary make scripts_gdb step Greg Kroah-Hartman
` (158 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Abhinav Kumar,
Dmitry Baryshkov, Sasha Levin
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit 115906ca7b535afb1fe7b5406c566ccd3873f82b ]
Add check for the return value of alloc_ordered_workqueue as it may return
NULL pointer and cause NULL pointer dereference.
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/517646/
Link: https://lore.kernel.org/r/20230110021651.12770-1-jiasheng@iscas.ac.cn
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/dsi_host.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index eb60ce125a1fc..d3ec4d67a9a35 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -1929,6 +1929,9 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi)
/* setup workqueue */
msm_host->workqueue = alloc_ordered_workqueue("dsi_drm_work", 0);
+ if (!msm_host->workqueue)
+ return -ENOMEM;
+
INIT_WORK(&msm_host->err_work, dsi_err_worker);
INIT_WORK(&msm_host->hpd_work, dsi_hpd_worker);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 413/567] docs/scripts/gdb: add necessary make scripts_gdb step
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 412/567] drm/msm/dsi: Add missing check for alloc_ordered_workqueue Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 414/567] ASoC: soc-compress: Reposition and add pcm_mutex Greg Kroah-Hartman
` (157 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakob Koschel, Jonathan Corbet, Sasha Levin
From: Jakob Koschel <jkl820.git@gmail.com>
[ Upstream commit 6b219431037bf98c9efd49716aea9b68440477a3 ]
In order to debug the kernel successfully with gdb you need to run
'make scripts_gdb' nowadays.
This was changed with the following commit:
Commit 67274c083438340ad16c ("scripts/gdb: delay generation of gdb
constants.py")
In order to have a complete guide for beginners this remark
should be added to the offial documentation.
Signed-off-by: Jakob Koschel <jkl820.git@gmail.com>
Link: https://lore.kernel.org/r/20230112-documentation-gdb-v2-1-292785c43dc9@gmail.com
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/dev-tools/gdb-kernel-debugging.rst | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/Documentation/dev-tools/gdb-kernel-debugging.rst b/Documentation/dev-tools/gdb-kernel-debugging.rst
index 8e0f1fe8d17ad..895285c037c72 100644
--- a/Documentation/dev-tools/gdb-kernel-debugging.rst
+++ b/Documentation/dev-tools/gdb-kernel-debugging.rst
@@ -39,6 +39,10 @@ Setup
this mode. In this case, you should build the kernel with
CONFIG_RANDOMIZE_BASE disabled if the architecture supports KASLR.
+- Build the gdb scripts (required on kernels v5.1 and above)::
+
+ make scripts_gdb
+
- Enable the gdb stub of QEMU/KVM, either
- at VM startup time by appending "-s" to the QEMU command line
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 414/567] ASoC: soc-compress: Reposition and add pcm_mutex
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 413/567] docs/scripts/gdb: add necessary make scripts_gdb step Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 415/567] ASoC: kirkwood: Iterate over array indexes instead of using pointer math Greg Kroah-Hartman
` (156 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinhyung Kang, Mark Brown, Sasha Levin
From: 강신형 <s47.kang@samsung.com>
[ Upstream commit aa9ff6a4955fdba02b54fbc4386db876603703b7 ]
If panic_on_warn is set and compress stream(DPCM) is started,
then kernel panic occurred because card->pcm_mutex isn't held appropriately.
In the following functions, warning were issued at this line
"snd_soc_dpcm_mutex_assert_held".
static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe,
struct snd_soc_pcm_runtime *be, int stream)
{
...
snd_soc_dpcm_mutex_assert_held(fe);
...
}
void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream)
{
...
snd_soc_dpcm_mutex_assert_held(fe);
...
}
void snd_soc_runtime_action(struct snd_soc_pcm_runtime *rtd,
int stream, int action)
{
...
snd_soc_dpcm_mutex_assert_held(rtd);
...
}
int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir,
int event)
{
...
snd_soc_dpcm_mutex_assert_held(fe);
...
}
These functions are called by soc_compr_set_params_fe, soc_compr_open_fe
and soc_compr_free_fe
without pcm_mutex locking. And this is call stack.
[ 414.527841][ T2179] pc : dpcm_process_paths+0x5a4/0x750
[ 414.527848][ T2179] lr : dpcm_process_paths+0x37c/0x750
[ 414.527945][ T2179] Call trace:
[ 414.527949][ T2179] dpcm_process_paths+0x5a4/0x750
[ 414.527955][ T2179] soc_compr_open_fe+0xb0/0x2cc
[ 414.527972][ T2179] snd_compr_open+0x180/0x248
[ 414.527981][ T2179] snd_open+0x15c/0x194
[ 414.528003][ T2179] chrdev_open+0x1b0/0x220
[ 414.528023][ T2179] do_dentry_open+0x30c/0x594
[ 414.528045][ T2179] vfs_open+0x34/0x44
[ 414.528053][ T2179] path_openat+0x914/0xb08
[ 414.528062][ T2179] do_filp_open+0xc0/0x170
[ 414.528068][ T2179] do_sys_openat2+0x94/0x18c
[ 414.528076][ T2179] __arm64_sys_openat+0x78/0xa4
[ 414.528084][ T2179] invoke_syscall+0x48/0x10c
[ 414.528094][ T2179] el0_svc_common+0xbc/0x104
[ 414.528099][ T2179] do_el0_svc+0x34/0xd8
[ 414.528103][ T2179] el0_svc+0x34/0xc4
[ 414.528125][ T2179] el0t_64_sync_handler+0x8c/0xfc
[ 414.528133][ T2179] el0t_64_sync+0x1a0/0x1a4
[ 414.528142][ T2179] Kernel panic - not syncing: panic_on_warn set ...
So, I reposition and add pcm_mutex to resolve lockdep error.
Signed-off-by: Shinhyung Kang <s47.kang@samsung.com>
Link: https://lore.kernel.org/r/016401d90ac4$7b6848c0$7238da40$@samsung.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-compress.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index e352b06a7b7a3..c2703a7598dd5 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -116,6 +116,8 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream)
if (ret < 0)
goto be_err;
+ mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass);
+
/* calculate valid and active FE <-> BE dpcms */
dpcm_process_paths(fe, stream, &list, 1);
fe->dpcm[stream].runtime = fe_substream->runtime;
@@ -151,7 +153,6 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream)
fe->dpcm[stream].state = SND_SOC_DPCM_STATE_OPEN;
fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
- mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass);
snd_soc_runtime_activate(fe, stream);
mutex_unlock(&fe->card->pcm_mutex);
@@ -182,7 +183,6 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream)
mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass);
snd_soc_runtime_deactivate(fe, stream);
- mutex_unlock(&fe->card->pcm_mutex);
fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
@@ -201,6 +201,8 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream)
dpcm_be_disconnect(fe, stream);
+ mutex_unlock(&fe->card->pcm_mutex);
+
fe->dpcm[stream].runtime = NULL;
snd_soc_link_compr_shutdown(cstream, 0);
@@ -376,8 +378,9 @@ static int soc_compr_set_params_fe(struct snd_compr_stream *cstream,
ret = snd_soc_link_compr_set_params(cstream);
if (ret < 0)
goto out;
-
+ mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass);
dpcm_dapm_stream_event(fe, stream, SND_SOC_DAPM_STREAM_START);
+ mutex_unlock(&fe->card->pcm_mutex);
fe->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE;
out:
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 415/567] ASoC: kirkwood: Iterate over array indexes instead of using pointer math
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 414/567] ASoC: soc-compress: Reposition and add pcm_mutex Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 416/567] regulator: max77802: Bounds check regulator id against opmode Greg Kroah-Hartman
` (155 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liam Girdwood, Mark Brown,
Jaroslav Kysela, Takashi Iwai, alsa-devel, Kees Cook,
Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit b3bcedc0402fcdc5c8624c433562d9d1882749d8 ]
Walking the dram->cs array was seen as accesses beyond the first array
item by the compiler. Instead, use the array index directly. This allows
for run-time bounds checking under CONFIG_UBSAN_BOUNDS as well. Seen
with GCC 13 with -fstrict-flex-arrays:
../sound/soc/kirkwood/kirkwood-dma.c: In function
'kirkwood_dma_conf_mbus_windows.constprop':
../sound/soc/kirkwood/kirkwood-dma.c:90:24: warning: array subscript 0 is outside array bounds of 'const struct mbus_dram_window[0]' [-Warray-bounds=]
90 | if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) {
| ~~^~~~~~
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: alsa-devel@alsa-project.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230127224128.never.410-kees@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/kirkwood/kirkwood-dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c
index 700a18561a940..640cebd2983e2 100644
--- a/sound/soc/kirkwood/kirkwood-dma.c
+++ b/sound/soc/kirkwood/kirkwood-dma.c
@@ -86,7 +86,7 @@ kirkwood_dma_conf_mbus_windows(void __iomem *base, int win,
/* try to find matching cs for current dma address */
for (i = 0; i < dram->num_cs; i++) {
- const struct mbus_dram_window *cs = dram->cs + i;
+ const struct mbus_dram_window *cs = &dram->cs[i];
if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) {
writel(cs->base & 0xffff0000,
base + KIRKWOOD_AUDIO_WIN_BASE_REG(win));
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 416/567] regulator: max77802: Bounds check regulator id against opmode
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 415/567] ASoC: kirkwood: Iterate over array indexes instead of using pointer math Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 417/567] regulator: s5m8767: Bounds check id indexing into arrays Greg Kroah-Hartman
` (154 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Javier Martinez Canillas,
Liam Girdwood, Mark Brown, Kees Cook, Javier Martinez Canillas,
Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit 4fd8bcec5fd7c0d586206fa2f42bd67b06cdaa7e ]
Explicitly bounds-check the id before accessing the opmode array. Seen
with GCC 13:
../drivers/regulator/max77802-regulator.c: In function 'max77802_enable':
../drivers/regulator/max77802-regulator.c:217:29: warning: array subscript [0, 41] is outside array bounds of 'unsigned int[42]' [-Warray-bounds=]
217 | if (max77802->opmode[id] == MAX77802_OFF_PWRREQ)
| ~~~~~~~~~~~~~~~~^~~~
../drivers/regulator/max77802-regulator.c:62:22: note: while referencing 'opmode'
62 | unsigned int opmode[MAX77802_REG_MAX];
| ^~~~~~
Cc: Javier Martinez Canillas <javier@dowhile0.org>
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://lore.kernel.org/r/20230127225203.never.864-kees@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/max77802-regulator.c | 34 ++++++++++++++++++--------
1 file changed, 24 insertions(+), 10 deletions(-)
diff --git a/drivers/regulator/max77802-regulator.c b/drivers/regulator/max77802-regulator.c
index 21e0eb0f43f94..befe5f319819b 100644
--- a/drivers/regulator/max77802-regulator.c
+++ b/drivers/regulator/max77802-regulator.c
@@ -94,9 +94,11 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev)
{
unsigned int val = MAX77802_OFF_PWRREQ;
struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
- int id = rdev_get_id(rdev);
+ unsigned int id = rdev_get_id(rdev);
int shift = max77802_get_opmode_shift(id);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
+ return -EINVAL;
max77802->opmode[id] = val;
return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
rdev->desc->enable_mask, val << shift);
@@ -110,7 +112,7 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev)
static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
{
struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
- int id = rdev_get_id(rdev);
+ unsigned int id = rdev_get_id(rdev);
unsigned int val;
int shift = max77802_get_opmode_shift(id);
@@ -127,6 +129,9 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
return -EINVAL;
}
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
+ return -EINVAL;
+
max77802->opmode[id] = val;
return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
rdev->desc->enable_mask, val << shift);
@@ -135,8 +140,10 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
static unsigned max77802_get_mode(struct regulator_dev *rdev)
{
struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
- int id = rdev_get_id(rdev);
+ unsigned int id = rdev_get_id(rdev);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
+ return -EINVAL;
return max77802_map_mode(max77802->opmode[id]);
}
@@ -160,10 +167,13 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev,
unsigned int mode)
{
struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
- int id = rdev_get_id(rdev);
+ unsigned int id = rdev_get_id(rdev);
unsigned int val;
int shift = max77802_get_opmode_shift(id);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
+ return -EINVAL;
+
/*
* If the regulator has been disabled for suspend
* then is invalid to try setting a suspend mode.
@@ -209,9 +219,11 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev,
static int max77802_enable(struct regulator_dev *rdev)
{
struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
- int id = rdev_get_id(rdev);
+ unsigned int id = rdev_get_id(rdev);
int shift = max77802_get_opmode_shift(id);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
+ return -EINVAL;
if (max77802->opmode[id] == MAX77802_OFF_PWRREQ)
max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
@@ -495,7 +507,7 @@ static int max77802_pmic_probe(struct platform_device *pdev)
for (i = 0; i < MAX77802_REG_MAX; i++) {
struct regulator_dev *rdev;
- int id = regulators[i].id;
+ unsigned int id = regulators[i].id;
int shift = max77802_get_opmode_shift(id);
int ret;
@@ -513,10 +525,12 @@ static int max77802_pmic_probe(struct platform_device *pdev)
* the hardware reports OFF as the regulator operating mode.
* Default to operating mode NORMAL in that case.
*/
- if (val == MAX77802_STATUS_OFF)
- max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
- else
- max77802->opmode[id] = val;
+ if (id < ARRAY_SIZE(max77802->opmode)) {
+ if (val == MAX77802_STATUS_OFF)
+ max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
+ else
+ max77802->opmode[id] = val;
+ }
rdev = devm_regulator_register(&pdev->dev,
®ulators[i], &config);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 417/567] regulator: s5m8767: Bounds check id indexing into arrays
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 416/567] regulator: max77802: Bounds check regulator id against opmode Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 418/567] gfs2: Improve gfs2_make_fs_rw error handling Greg Kroah-Hartman
` (153 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Liam Girdwood,
Mark Brown, linux-samsung-soc, Kees Cook, Sasha Levin
From: Kees Cook <keescook@chromium.org>
[ Upstream commit e314e15a0b58f9d051c00b25951073bcdae61953 ]
The compiler has no way to know if "id" is within the array bounds of
the regulators array. Add a check for this and a build-time check that
the regulators and reg_voltage_map arrays are sized the same. Seen with
GCC 13:
../drivers/regulator/s5m8767.c: In function 's5m8767_pmic_probe':
../drivers/regulator/s5m8767.c:936:35: warning: array subscript [0, 36] is outside array bounds of 'struct regulator_desc[37]' [-Warray-bounds=]
936 | regulators[id].vsel_reg =
| ~~~~~~~~~~^~~~
Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-samsung-soc@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20230128005358.never.313-kees@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/s5m8767.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
index 35269f9982105..754c6fcc6e642 100644
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -923,10 +923,14 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
for (i = 0; i < pdata->num_regulators; i++) {
const struct sec_voltage_desc *desc;
- int id = pdata->regulators[i].id;
+ unsigned int id = pdata->regulators[i].id;
int enable_reg, enable_val;
struct regulator_dev *rdev;
+ BUILD_BUG_ON(ARRAY_SIZE(regulators) != ARRAY_SIZE(reg_voltage_map));
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(regulators)))
+ continue;
+
desc = reg_voltage_map[id];
if (desc) {
regulators[id].n_voltages =
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 418/567] gfs2: Improve gfs2_make_fs_rw error handling
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 417/567] regulator: s5m8767: Bounds check id indexing into arrays Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 419/567] hwmon: (coretemp) Simplify platform device handling Greg Kroah-Hartman
` (152 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tetsuo Handa,
syzbot+f51cb4b9afbd87ec06f2, Andreas Gruenbacher, Sasha Levin
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit b66f723bb552ad59c2acb5d45ea45c890f84498b ]
In gfs2_make_fs_rw(), make sure to call gfs2_consist() to report an
inconsistency and mark the filesystem as withdrawn when
gfs2_find_jhead() fails.
At the end of gfs2_make_fs_rw(), when we discover that the filesystem
has been withdrawn, make sure we report an error. This also replaces
the gfs2_withdrawn() check after gfs2_find_jhead().
Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: syzbot+f51cb4b9afbd87ec06f2@syzkaller.appspotmail.com
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/super.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index d615974ce4183..775ac3fb10c67 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -138,8 +138,10 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
return -EIO;
error = gfs2_find_jhead(sdp->sd_jdesc, &head, false);
- if (error || gfs2_withdrawn(sdp))
+ if (error) {
+ gfs2_consist(sdp);
return error;
+ }
if (!(head.lh_flags & GFS2_LOG_HEAD_UNMOUNT)) {
gfs2_consist(sdp);
@@ -151,7 +153,9 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
gfs2_log_pointers_init(sdp, head.lh_blkno);
error = gfs2_quota_init(sdp);
- if (!error && !gfs2_withdrawn(sdp))
+ if (!error && gfs2_withdrawn(sdp))
+ error = -EIO;
+ if (!error)
set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
return error;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 419/567] hwmon: (coretemp) Simplify platform device handling
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 418/567] gfs2: Improve gfs2_make_fs_rw error handling Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 420/567] pinctrl: at91: use devm_kasprintf() to avoid potential leaks Greg Kroah-Hartman
` (151 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Murphy, Janusz Krzysztofik,
Guenter Roeck, Sasha Levin
From: Robin Murphy <robin.murphy@arm.com>
[ Upstream commit 6d03bbff456befeccdd4d663177c4d6c75d0c4ff ]
Coretemp's platform driver is unconventional. All the real work is done
globally by the initcall and CPU hotplug notifiers, while the "driver"
effectively just wraps an allocation and the registration of the hwmon
interface in a long-winded round-trip through the driver core. The whole
logic of dynamically creating and destroying platform devices to bring
the interfaces up and down is error prone, since it assumes
platform_device_add() will synchronously bind the driver and set drvdata
before it returns, thus results in a NULL dereference if drivers_autoprobe
is turned off for the platform bus. Furthermore, the unusual approach of
doing that from within a CPU hotplug notifier, already commented in the
code that it deadlocks suspend, also causes lockdep issues for other
drivers or subsystems which may want to legitimately register a CPU
hotplug notifier from a platform bus notifier.
All of these issues can be solved by ripping this unusual behaviour out
completely, simply tying the platform devices to the lifetime of the
module itself, and directly managing the hwmon interfaces from the
hotplug notifiers. There is a slight user-visible change in that
/sys/bus/platform/drivers/coretemp will no longer appear, and
/sys/devices/platform/coretemp.n will remain present if package n is
hotplugged off, but hwmon users should really only be looking for the
presence of the hwmon interfaces, whose behaviour remains unchanged.
Link: https://lore.kernel.org/lkml/20220922101036.87457-1-janusz.krzysztofik@linux.intel.com/
Link: https://gitlab.freedesktop.org/drm/intel/issues/6641
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
Link: https://lore.kernel.org/r/20230103114620.15319-1-janusz.krzysztofik@linux.intel.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/coretemp.c | 128 ++++++++++++++++++---------------------
1 file changed, 58 insertions(+), 70 deletions(-)
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 42b84ebff0579..eaae5de2ab616 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -550,66 +550,49 @@ static void coretemp_remove_core(struct platform_data *pdata, int indx)
ida_free(&pdata->ida, indx - BASE_SYSFS_ATTR_NO);
}
-static int coretemp_probe(struct platform_device *pdev)
+static int coretemp_device_add(int zoneid)
{
- struct device *dev = &pdev->dev;
+ struct platform_device *pdev;
struct platform_data *pdata;
+ int err;
/* Initialize the per-zone data structures */
- pdata = devm_kzalloc(dev, sizeof(struct platform_data), GFP_KERNEL);
+ pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
if (!pdata)
return -ENOMEM;
- pdata->pkg_id = pdev->id;
+ pdata->pkg_id = zoneid;
ida_init(&pdata->ida);
- platform_set_drvdata(pdev, pdata);
- pdata->hwmon_dev = devm_hwmon_device_register_with_groups(dev, DRVNAME,
- pdata, NULL);
- return PTR_ERR_OR_ZERO(pdata->hwmon_dev);
-}
-
-static int coretemp_remove(struct platform_device *pdev)
-{
- struct platform_data *pdata = platform_get_drvdata(pdev);
- int i;
+ pdev = platform_device_alloc(DRVNAME, zoneid);
+ if (!pdev) {
+ err = -ENOMEM;
+ goto err_free_pdata;
+ }
- for (i = MAX_CORE_DATA - 1; i >= 0; --i)
- if (pdata->core_data[i])
- coretemp_remove_core(pdata, i);
+ err = platform_device_add(pdev);
+ if (err)
+ goto err_put_dev;
- ida_destroy(&pdata->ida);
+ platform_set_drvdata(pdev, pdata);
+ zone_devices[zoneid] = pdev;
return 0;
-}
-static struct platform_driver coretemp_driver = {
- .driver = {
- .name = DRVNAME,
- },
- .probe = coretemp_probe,
- .remove = coretemp_remove,
-};
+err_put_dev:
+ platform_device_put(pdev);
+err_free_pdata:
+ kfree(pdata);
+ return err;
+}
-static struct platform_device *coretemp_device_add(unsigned int cpu)
+static void coretemp_device_remove(int zoneid)
{
- int err, zoneid = topology_logical_die_id(cpu);
- struct platform_device *pdev;
-
- if (zoneid < 0)
- return ERR_PTR(-ENOMEM);
-
- pdev = platform_device_alloc(DRVNAME, zoneid);
- if (!pdev)
- return ERR_PTR(-ENOMEM);
-
- err = platform_device_add(pdev);
- if (err) {
- platform_device_put(pdev);
- return ERR_PTR(err);
- }
+ struct platform_device *pdev = zone_devices[zoneid];
+ struct platform_data *pdata = platform_get_drvdata(pdev);
- zone_devices[zoneid] = pdev;
- return pdev;
+ ida_destroy(&pdata->ida);
+ kfree(pdata);
+ platform_device_unregister(pdev);
}
static int coretemp_cpu_online(unsigned int cpu)
@@ -633,7 +616,10 @@ static int coretemp_cpu_online(unsigned int cpu)
if (!cpu_has(c, X86_FEATURE_DTHERM))
return -ENODEV;
- if (!pdev) {
+ pdata = platform_get_drvdata(pdev);
+ if (!pdata->hwmon_dev) {
+ struct device *hwmon;
+
/* Check the microcode version of the CPU */
if (chk_ucode_version(cpu))
return -EINVAL;
@@ -644,9 +630,11 @@ static int coretemp_cpu_online(unsigned int cpu)
* online. So, initialize per-pkg data structures and
* then bring this core online.
*/
- pdev = coretemp_device_add(cpu);
- if (IS_ERR(pdev))
- return PTR_ERR(pdev);
+ hwmon = hwmon_device_register_with_groups(&pdev->dev, DRVNAME,
+ pdata, NULL);
+ if (IS_ERR(hwmon))
+ return PTR_ERR(hwmon);
+ pdata->hwmon_dev = hwmon;
/*
* Check whether pkgtemp support is available.
@@ -656,7 +644,6 @@ static int coretemp_cpu_online(unsigned int cpu)
coretemp_add_core(pdev, cpu, 1);
}
- pdata = platform_get_drvdata(pdev);
/*
* Check whether a thread sibling is already online. If not add the
* interface for this CPU core.
@@ -675,18 +662,14 @@ static int coretemp_cpu_offline(unsigned int cpu)
struct temp_data *tdata;
int i, indx = -1, target;
- /*
- * Don't execute this on suspend as the device remove locks
- * up the machine.
- */
+ /* No need to tear down any interfaces for suspend */
if (cpuhp_tasks_frozen)
return 0;
/* If the physical CPU device does not exist, just return */
- if (!pdev)
- return 0;
-
pd = platform_get_drvdata(pdev);
+ if (!pd->hwmon_dev)
+ return 0;
for (i = 0; i < NUM_REAL_CORES; i++) {
if (pd->cpu_map[i] == topology_core_id(cpu)) {
@@ -718,13 +701,14 @@ static int coretemp_cpu_offline(unsigned int cpu)
}
/*
- * If all cores in this pkg are offline, remove the device. This
- * will invoke the platform driver remove function, which cleans up
- * the rest.
+ * If all cores in this pkg are offline, remove the interface.
*/
+ tdata = pd->core_data[PKG_SYSFS_ATTR_NO];
if (cpumask_empty(&pd->cpumask)) {
- zone_devices[topology_logical_die_id(cpu)] = NULL;
- platform_device_unregister(pdev);
+ if (tdata)
+ coretemp_remove_core(pd, PKG_SYSFS_ATTR_NO);
+ hwmon_device_unregister(pd->hwmon_dev);
+ pd->hwmon_dev = NULL;
return 0;
}
@@ -732,7 +716,6 @@ static int coretemp_cpu_offline(unsigned int cpu)
* Check whether this core is the target for the package
* interface. We need to assign it to some other cpu.
*/
- tdata = pd->core_data[PKG_SYSFS_ATTR_NO];
if (tdata && tdata->cpu == cpu) {
target = cpumask_first(&pd->cpumask);
mutex_lock(&tdata->update_lock);
@@ -751,7 +734,7 @@ static enum cpuhp_state coretemp_hp_online;
static int __init coretemp_init(void)
{
- int err;
+ int i, err;
/*
* CPUID.06H.EAX[0] indicates whether the CPU has thermal
@@ -767,20 +750,22 @@ static int __init coretemp_init(void)
if (!zone_devices)
return -ENOMEM;
- err = platform_driver_register(&coretemp_driver);
- if (err)
- goto outzone;
+ for (i = 0; i < max_zones; i++) {
+ err = coretemp_device_add(i);
+ if (err)
+ goto outzone;
+ }
err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/coretemp:online",
coretemp_cpu_online, coretemp_cpu_offline);
if (err < 0)
- goto outdrv;
+ goto outzone;
coretemp_hp_online = err;
return 0;
-outdrv:
- platform_driver_unregister(&coretemp_driver);
outzone:
+ while (i--)
+ coretemp_device_remove(i);
kfree(zone_devices);
return err;
}
@@ -788,8 +773,11 @@ module_init(coretemp_init)
static void __exit coretemp_exit(void)
{
+ int i;
+
cpuhp_remove_state(coretemp_hp_online);
- platform_driver_unregister(&coretemp_driver);
+ for (i = 0; i < max_zones; i++)
+ coretemp_device_remove(i);
kfree(zone_devices);
}
module_exit(coretemp_exit)
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 420/567] pinctrl: at91: use devm_kasprintf() to avoid potential leaks
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 419/567] hwmon: (coretemp) Simplify platform device handling Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 421/567] scsi: snic: Fix memory leak with using debugfs_lookup() Greg Kroah-Hartman
` (150 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Linus Walleij, Sasha Levin
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 1c4e5c470a56f7f7c649c0c70e603abc1eab15c4 ]
Use devm_kasprintf() instead of kasprintf() to avoid any potential
leaks. At the moment drivers have no remove functionality thus
there is no need for fixes tag.
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20230203132714.1931596-1-claudiu.beznea@microchip.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-at91-pio4.c | 4 ++--
drivers/pinctrl/pinctrl-at91.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
index 03c32b2c5d303..c86fcdfaf825c 100644
--- a/drivers/pinctrl/pinctrl-at91-pio4.c
+++ b/drivers/pinctrl/pinctrl-at91-pio4.c
@@ -1126,8 +1126,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
pin_desc[i].number = i;
/* Pin naming convention: P(bank_name)(bank_pin_number). */
- pin_desc[i].name = kasprintf(GFP_KERNEL, "P%c%d",
- bank + 'A', line);
+ pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d",
+ bank + 'A', line);
group->name = group_names[i] = pin_desc[i].name;
group->pin = pin_desc[i].number;
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index 6022496bb6a98..3b0341c730ee0 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -1891,7 +1891,7 @@ static int at91_gpio_probe(struct platform_device *pdev)
}
for (i = 0; i < chip->ngpio; i++)
- names[i] = kasprintf(GFP_KERNEL, "pio%c%d", alias_idx + 'A', i);
+ names[i] = devm_kasprintf(&pdev->dev, GFP_KERNEL, "pio%c%d", alias_idx + 'A', i);
chip->names = (const char *const *)names;
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 421/567] scsi: snic: Fix memory leak with using debugfs_lookup()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 420/567] pinctrl: at91: use devm_kasprintf() to avoid potential leaks Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 422/567] HID: logitech-hidpp: Dont restart communication if not necessary Greg Kroah-Hartman
` (149 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karan Tilak Kumar, Sesidhar Baddela,
James E.J. Bottomley, Martin K. Petersen, linux-scsi,
linux-kernel, Sasha Levin
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit ad0e4e2fab928477f74d742e6e77d79245d3d3e7 ]
When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time. To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic at
once.
Link: https://lore.kernel.org/r/20230202141009.2290380-1-gregkh@linuxfoundation.org
Cc: Karan Tilak Kumar <kartilak@cisco.com>
Cc: Sesidhar Baddela <sebaddel@cisco.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/snic/snic_debugfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/snic/snic_debugfs.c b/drivers/scsi/snic/snic_debugfs.c
index 5e0faeba516e5..76baa4f9a06e3 100644
--- a/drivers/scsi/snic/snic_debugfs.c
+++ b/drivers/scsi/snic/snic_debugfs.c
@@ -451,6 +451,6 @@ void snic_trc_debugfs_init(void)
void
snic_trc_debugfs_term(void)
{
- debugfs_remove(debugfs_lookup(TRC_FILE, snic_glob->trc_root));
- debugfs_remove(debugfs_lookup(TRC_ENABLE_FILE, snic_glob->trc_root));
+ debugfs_lookup_and_remove(TRC_FILE, snic_glob->trc_root);
+ debugfs_lookup_and_remove(TRC_ENABLE_FILE, snic_glob->trc_root);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 422/567] HID: logitech-hidpp: Dont restart communication if not necessary
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 421/567] scsi: snic: Fix memory leak with using debugfs_lookup() Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 423/567] drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 Greg Kroah-Hartman
` (148 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bastien Nocera, Benjamin Tissoires,
Sasha Levin
From: Bastien Nocera <hadess@hadess.net>
[ Upstream commit 498ba20690357691103de0f766960355247c78be ]
Don't stop and restart communication with the device unless we need to
modify the connect flags used because of a device quirk.
Signed-off-by: Bastien Nocera <hadess@hadess.net>
Link: https://lore.kernel.org/r/20230125121723.3122-1-hadess@hadess.net
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-logitech-hidpp.c | 32 ++++++++++++++++++++------------
1 file changed, 20 insertions(+), 12 deletions(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 81de88ab2ecc7..601ab673727dc 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4049,6 +4049,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
bool connected;
unsigned int connect_mask = HID_CONNECT_DEFAULT;
struct hidpp_ff_private_data data;
+ bool will_restart = false;
/* report_fixup needs drvdata to be set before we call hid_parse */
hidpp = devm_kzalloc(&hdev->dev, sizeof(*hidpp), GFP_KERNEL);
@@ -4104,6 +4105,10 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
return ret;
}
+ if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT ||
+ hidpp->quirks & HIDPP_QUIRK_UNIFYING)
+ will_restart = true;
+
INIT_WORK(&hidpp->work, delayed_work_cb);
mutex_init(&hidpp->send_mutex);
init_waitqueue_head(&hidpp->wait);
@@ -4118,7 +4123,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
* Plain USB connections need to actually call start and open
* on the transport driver to allow incoming data.
*/
- ret = hid_hw_start(hdev, 0);
+ ret = hid_hw_start(hdev, will_restart ? 0 : connect_mask);
if (ret) {
hid_err(hdev, "hw start failed\n");
goto hid_hw_start_fail;
@@ -4155,6 +4160,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
hidpp->wireless_feature_index = 0;
else if (ret)
goto hid_hw_init_fail;
+ ret = 0;
}
if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) {
@@ -4169,19 +4175,21 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
hidpp_connect_event(hidpp);
- /* Reset the HID node state */
- hid_device_io_stop(hdev);
- hid_hw_close(hdev);
- hid_hw_stop(hdev);
+ if (will_restart) {
+ /* Reset the HID node state */
+ hid_device_io_stop(hdev);
+ hid_hw_close(hdev);
+ hid_hw_stop(hdev);
- if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT)
- connect_mask &= ~HID_CONNECT_HIDINPUT;
+ if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT)
+ connect_mask &= ~HID_CONNECT_HIDINPUT;
- /* Now export the actual inputs and hidraw nodes to the world */
- ret = hid_hw_start(hdev, connect_mask);
- if (ret) {
- hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
- goto hid_hw_start_fail;
+ /* Now export the actual inputs and hidraw nodes to the world */
+ ret = hid_hw_start(hdev, connect_mask);
+ if (ret) {
+ hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
+ goto hid_hw_start_fail;
+ }
}
if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 423/567] drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 422/567] HID: logitech-hidpp: Dont restart communication if not necessary Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 424/567] dm thin: add cond_resched() to various workqueue loops Greg Kroah-Hartman
` (147 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrell Kavanagh, Hans de Goede,
Sasha Levin
From: Darrell Kavanagh <darrell.kavanagh@gmail.com>
[ Upstream commit 38b2d8efd03d2e56431b611e3523f0158306451d ]
Another Lenovo convertable where the panel is installed landscape but is
reported to the kernel as portrait.
Signed-off-by: Darrell Kavanagh <darrell.kavanagh@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230214164659.3583-1-darrell.kavanagh@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index ce739ba45c551..8768073794fbf 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -278,6 +278,12 @@ static const struct dmi_system_id orientation_data[] = {
DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGL"),
},
.driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* Lenovo IdeaPad Duet 3 10IGL5 */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Duet 3 10IGL5"),
+ },
+ .driver_data = (void *)&lcd1200x1920_rightside_up,
}, { /* Lenovo Yoga Book X90F / X91F / X91L */
.matches = {
/* Non exact match to match all versions */
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 424/567] dm thin: add cond_resched() to various workqueue loops
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 423/567] drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 425/567] dm cache: " Greg Kroah-Hartman
` (146 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Sasha Levin
From: Mike Snitzer <snitzer@kernel.org>
[ Upstream commit e4f80303c2353952e6e980b23914e4214487f2a6 ]
Otherwise on resource constrained systems these workqueues may be too
greedy.
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-thin.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index cce26f46ded52..f7124f257703c 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2217,6 +2217,7 @@ static void process_thin_deferred_bios(struct thin_c *tc)
throttle_work_update(&pool->throttle);
dm_pool_issue_prefetches(pool->pmd);
}
+ cond_resched();
}
blk_finish_plug(&plug);
}
@@ -2299,6 +2300,7 @@ static void process_thin_deferred_cells(struct thin_c *tc)
else
pool->process_cell(tc, cell);
}
+ cond_resched();
} while (!list_empty(&cells));
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 425/567] dm cache: add cond_resched() to various workqueue loops
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 424/567] dm thin: add cond_resched() to various workqueue loops Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 426/567] nfsd: zero out pointers after putting nfsd_files on COPY setup error Greg Kroah-Hartman
` (145 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Sasha Levin
From: Mike Snitzer <snitzer@kernel.org>
[ Upstream commit 76227f6dc805e9e960128bcc6276647361e0827c ]
Otherwise on resource constrained systems these workqueues may be too
greedy.
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-cache-target.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index abfe7e37b76f4..24cd28ea2c595 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -1813,6 +1813,7 @@ static void process_deferred_bios(struct work_struct *ws)
else
commit_needed = process_bio(cache, bio) || commit_needed;
+ cond_resched();
}
if (commit_needed)
@@ -1835,6 +1836,7 @@ static void requeue_deferred_bios(struct cache *cache)
while ((bio = bio_list_pop(&bios))) {
bio->bi_status = BLK_STS_DM_REQUEUE;
bio_endio(bio);
+ cond_resched();
}
}
@@ -1875,6 +1877,8 @@ static void check_migrations(struct work_struct *ws)
r = mg_start(cache, op, NULL);
if (r)
break;
+
+ cond_resched();
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 426/567] nfsd: zero out pointers after putting nfsd_files on COPY setup error
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 425/567] dm cache: " Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 427/567] drm/shmem-helper: Revert accidental non-GPL export Greg Kroah-Hartman
` (144 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever, Sasha Levin
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit 1f0001d43d0c0ac2a19a34a914f6595ad97cbc1d ]
At first, I thought this might be a source of nfsd_file overputs, but
the current callers seem to avoid an extra put when nfsd4_verify_copy
returns an error.
Still, it's "bad form" to leave the pointers filled out when we don't
have a reference to them anymore, and that might lead to bugs later.
Zero them out as a defensive coding measure.
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4proc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 0a900b9e39eac..57af9c30eb48d 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1088,8 +1088,10 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
return status;
out_put_dst:
nfsd_file_put(*dst);
+ *dst = NULL;
out_put_src:
nfsd_file_put(*src);
+ *src = NULL;
goto out;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 427/567] drm/shmem-helper: Revert accidental non-GPL export
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 426/567] nfsd: zero out pointers after putting nfsd_files on COPY setup error Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 428/567] wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu Greg Kroah-Hartman
` (143 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Osipenko, Asahi Lina,
Thomas Zimmermann, Sasha Levin
From: Asahi Lina <lina@asahilina.net>
[ Upstream commit 047a754558d640eaa080fce3b22ca9f3d4e04626 ]
The referenced commit added a wrapper for drm_gem_shmem_get_pages_sgt(),
but in the process it accidentally changed the export type from GPL to
non-GPL. Switch it back to GPL.
Reported-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Fixes: ddddedaa0db9 ("drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()")
Signed-off-by: Asahi Lina <lina@asahilina.net>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230227-shmem-export-fix-v1-1-8880b2c25e81@asahilina.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
index 1af541c12a45f..d58e8e12d3ae8 100644
--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -717,7 +717,7 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
return sgt;
}
-EXPORT_SYMBOL(drm_gem_shmem_get_pages_sgt);
+EXPORT_SYMBOL_GPL(drm_gem_shmem_get_pages_sgt);
/**
* drm_gem_shmem_prime_import_sg_table - Produce a shmem GEM object from
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 428/567] wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 427/567] drm/shmem-helper: Revert accidental non-GPL export Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 429/567] firmware: coreboot: framebuffer: Ignore reserved pixel color bits Greg Kroah-Hartman
` (142 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jun ASAKA, Ping-Ke Shih, Kalle Valo
From: Jun ASAKA <JunASAKA@zzy040330.moe>
commit c6015bf3ff1ffb3caa27eb913797438a0fc634a0 upstream.
Fixing transmission failure which results in
"authentication with ... timed out". This can be
fixed by disable the REG_TXPAUSE.
Signed-off-by: Jun ASAKA <JunASAKA@zzy040330.moe>
Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221217030659.12577-1-JunASAKA@zzy040330.moe
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
@@ -1669,6 +1669,11 @@ static void rtl8192e_enable_rf(struct rt
val8 = rtl8xxxu_read8(priv, REG_PAD_CTRL1);
val8 &= ~BIT(0);
rtl8xxxu_write8(priv, REG_PAD_CTRL1, val8);
+
+ /*
+ * Fix transmission failure of rtl8192e.
+ */
+ rtl8xxxu_write8(priv, REG_TXPAUSE, 0x00);
}
struct rtl8xxxu_fileops rtl8192eu_fops = {
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 429/567] firmware: coreboot: framebuffer: Ignore reserved pixel color bits
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 428/567] wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 430/567] block: dont allow multiple bios for IOCB_NOWAIT issue Greg Kroah-Hartman
` (141 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alper Nebi Yasak, Salvatore Bonaccorso
From: Alper Nebi Yasak <alpernebiyasak@gmail.com>
commit e6acaf25cba14661211bb72181c35dd13b24f5b3 upstream.
The coreboot framebuffer doesn't support transparency, its 'reserved'
bit field is merely padding for byte/word alignment of pixel colors [1].
When trying to match the framebuffer to a simplefb format, the kernel
driver unnecessarily requires the format's transparency bit field to
exactly match this padding, even if the former is zero-width.
Due to a coreboot bug [2] (fixed upstream), some boards misreport the
reserved field's size as equal to its position (0x18 for both on a
'Lick' Chromebook), and the driver fails to probe where it would have
otherwise worked fine with e.g. the a8r8g8b8 or x8r8g8b8 formats.
Remove the transparency comparison with reserved bits. When the
bits-per-pixel and other color components match, transparency will
already be in a subset of the reserved field. Not forcing it to match
reserved bits allows the driver to work on the boards which misreport
the reserved field. It also enables using simplefb formats that don't
have transparency bits, although this doesn't currently happen due to
format support and ordering in linux/platform_data/simplefb.h.
[1] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.19/src/commonlib/include/commonlib/coreboot_tables.h#255
[2] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.13/src/drivers/intel/fsp2_0/graphics.c#82
Signed-off-by: Alper Nebi Yasak <alpernebiyasak@gmail.com>
Link: https://lore.kernel.org/r/20230122190433.195941-1-alpernebiyasak@gmail.com
Cc: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/google/framebuffer-coreboot.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/firmware/google/framebuffer-coreboot.c
+++ b/drivers/firmware/google/framebuffer-coreboot.c
@@ -43,9 +43,7 @@ static int framebuffer_probe(struct core
fb->green_mask_pos == formats[i].green.offset &&
fb->green_mask_size == formats[i].green.length &&
fb->blue_mask_pos == formats[i].blue.offset &&
- fb->blue_mask_size == formats[i].blue.length &&
- fb->reserved_mask_pos == formats[i].transp.offset &&
- fb->reserved_mask_size == formats[i].transp.length)
+ fb->blue_mask_size == formats[i].blue.length)
pdata.format = formats[i].name;
}
if (!pdata.format)
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 430/567] block: dont allow multiple bios for IOCB_NOWAIT issue
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 429/567] firmware: coreboot: framebuffer: Ignore reserved pixel color bits Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 431/567] rtc: pm8xxx: fix set-alarm race Greg Kroah-Hartman
` (140 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe, Michael Kelley
From: Jens Axboe <axboe@kernel.dk>
commit 67d59247d4b52c917e373f05a807027756ab216f upstream.
If we're doing a large IO request which needs to be split into multiple
bios for issue, then we can run into the same situation as the below
marked commit fixes - parts will complete just fine, one or more parts
will fail to allocate a request. This will result in a partially
completed read or write request, where the caller gets EAGAIN even though
parts of the IO completed just fine.
Do the same for large bios as we do for splits - fail a NOWAIT request
with EAGAIN. This isn't technically fixing an issue in the below marked
patch, but for stable purposes, we should have either none of them or
both.
This depends on: 613b14884b85 ("block: handle bio_split_to_limits() NULL return")
Cc: stable@vger.kernel.org # 5.15+
Fixes: 9cea62b2cbab ("block: don't allow splitting of a REQ_NOWAIT bio")
Link: https://github.com/axboe/liburing/issues/766
Reported-and-tested-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/fops.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
--- a/block/fops.c
+++ b/block/fops.c
@@ -243,6 +243,24 @@ static ssize_t __blkdev_direct_IO(struct
bio_endio(bio);
break;
}
+ if (iocb->ki_flags & IOCB_NOWAIT) {
+ /*
+ * This is nonblocking IO, and we need to allocate
+ * another bio if we have data left to map. As we
+ * cannot guarantee that one of the sub bios will not
+ * fail getting issued FOR NOWAIT and as error results
+ * are coalesced across all of them, be safe and ask for
+ * a retry of this from blocking context.
+ */
+ if (unlikely(iov_iter_count(iter))) {
+ bio_release_pages(bio, false);
+ bio_clear_flag(bio, BIO_REFFED);
+ bio_put(bio);
+ blk_finish_plug(&plug);
+ return -EAGAIN;
+ }
+ bio->bi_opf |= REQ_NOWAIT;
+ }
if (is_read) {
bio->bi_opf = REQ_OP_READ;
@@ -252,9 +270,6 @@ static ssize_t __blkdev_direct_IO(struct
bio->bi_opf = dio_bio_write_op(iocb);
task_io_account_write(bio->bi_iter.bi_size);
}
- if (iocb->ki_flags & IOCB_NOWAIT)
- bio->bi_opf |= REQ_NOWAIT;
-
dio->size += bio->bi_iter.bi_size;
pos += bio->bi_iter.bi_size;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 431/567] rtc: pm8xxx: fix set-alarm race
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 430/567] block: dont allow multiple bios for IOCB_NOWAIT issue Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 432/567] ipmi:ssif: resend_msg() cannot fail Greg Kroah-Hartman
` (139 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, David Collins,
Alexandre Belloni
From: Johan Hovold <johan+linaro@kernel.org>
commit c88db0eff9722fc2b6c4d172a50471d20e08ecc6 upstream.
Make sure to disable the alarm before updating the four alarm time
registers to avoid spurious alarms during the update.
Note that the disable needs to be done outside of the ctrl_reg_lock
section to prevent a racing alarm interrupt from disabling the newly set
alarm when the lock is released.
Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC")
Cc: stable@vger.kernel.org # 3.1
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: David Collins <quic_collinsd@quicinc.com>
Link: https://lore.kernel.org/r/20230202155448.6715-2-johan+linaro@kernel.org
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-pm8xxx.c | 24 ++++++++++--------------
1 file changed, 10 insertions(+), 14 deletions(-)
--- a/drivers/rtc/rtc-pm8xxx.c
+++ b/drivers/rtc/rtc-pm8xxx.c
@@ -220,7 +220,6 @@ static int pm8xxx_rtc_set_alarm(struct d
{
int rc, i;
u8 value[NUM_8_BIT_RTC_REGS];
- unsigned int ctrl_reg;
unsigned long secs, irq_flags;
struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
@@ -232,6 +231,11 @@ static int pm8xxx_rtc_set_alarm(struct d
secs >>= 8;
}
+ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl,
+ regs->alarm_en, 0);
+ if (rc)
+ return rc;
+
spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
rc = regmap_bulk_write(rtc_dd->regmap, regs->alarm_rw, value,
@@ -241,19 +245,11 @@ static int pm8xxx_rtc_set_alarm(struct d
goto rtc_rw_fail;
}
- rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
- if (rc)
- goto rtc_rw_fail;
-
- if (alarm->enabled)
- ctrl_reg |= regs->alarm_en;
- else
- ctrl_reg &= ~regs->alarm_en;
-
- rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
- if (rc) {
- dev_err(dev, "Write to RTC alarm control register failed\n");
- goto rtc_rw_fail;
+ if (alarm->enabled) {
+ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl,
+ regs->alarm_en, regs->alarm_en);
+ if (rc)
+ goto rtc_rw_fail;
}
dev_dbg(dev, "Alarm Set for h:m:s=%ptRt, y-m-d=%ptRdr\n",
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 432/567] ipmi:ssif: resend_msg() cannot fail
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 431/567] rtc: pm8xxx: fix set-alarm race Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 433/567] ipmi_ssif: Rename idle state and check Greg Kroah-Hartman
` (138 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Corey Minyard
From: Corey Minyard <cminyard@mvista.com>
commit 95767ed78a181d5404202627499f9cde56053b96 upstream.
The resend_msg() function cannot fail, but there was error handling
around using it. Rework the handling of the error, and fix the out of
retries debug reporting that was wrong around this, too.
Cc: stable@vger.kernel.org
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_ssif.c | 28 +++++++---------------------
1 file changed, 7 insertions(+), 21 deletions(-)
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -602,7 +602,7 @@ static void ssif_alert(struct i2c_client
start_get(ssif_info);
}
-static int start_resend(struct ssif_info *ssif_info);
+static void start_resend(struct ssif_info *ssif_info);
static void msg_done_handler(struct ssif_info *ssif_info, int result,
unsigned char *data, unsigned int len)
@@ -909,31 +909,17 @@ static void msg_written_handler(struct s
if (result < 0) {
ssif_info->retries_left--;
if (ssif_info->retries_left > 0) {
- if (!start_resend(ssif_info)) {
- ssif_inc_stat(ssif_info, send_retries);
- return;
- }
- /* request failed, just return the error. */
- ssif_inc_stat(ssif_info, send_errors);
-
- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
- dev_dbg(&ssif_info->client->dev,
- "%s: Out of retries\n", __func__);
- msg_done_handler(ssif_info, -EIO, NULL, 0);
+ start_resend(ssif_info);
return;
}
ssif_inc_stat(ssif_info, send_errors);
- /*
- * Got an error on transmit, let the done routine
- * handle it.
- */
if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
dev_dbg(&ssif_info->client->dev,
- "%s: Error %d\n", __func__, result);
+ "%s: Out of retries\n", __func__);
- msg_done_handler(ssif_info, result, NULL, 0);
+ msg_done_handler(ssif_info, -EIO, NULL, 0);
return;
}
@@ -996,7 +982,7 @@ static void msg_written_handler(struct s
}
}
-static int start_resend(struct ssif_info *ssif_info)
+static void start_resend(struct ssif_info *ssif_info)
{
int command;
@@ -1021,7 +1007,6 @@ static int start_resend(struct ssif_info
ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE,
command, ssif_info->data, I2C_SMBUS_BLOCK_DATA);
- return 0;
}
static int start_send(struct ssif_info *ssif_info,
@@ -1036,7 +1021,8 @@ static int start_send(struct ssif_info *
ssif_info->retries_left = SSIF_SEND_RETRIES;
memcpy(ssif_info->data + 1, data, len);
ssif_info->data_len = len;
- return start_resend(ssif_info);
+ start_resend(ssif_info);
+ return 0;
}
/* Must be called with the message lock held. */
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 433/567] ipmi_ssif: Rename idle state and check
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 432/567] ipmi:ssif: resend_msg() cannot fail Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 434/567] s390/extmem: return correct segment type in __segment_load() Greg Kroah-Hartman
` (137 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Corey Minyard
From: Corey Minyard <cminyard@mvista.com>
commit 8230831c43a328c2be6d28c65d3f77e14c59986b upstream.
Rename the SSIF_IDLE() to IS_SSIF_IDLE(), since that is more clear, and
rename SSIF_NORMAL to SSIF_IDLE, since that's more accurate.
Cc: stable@vger.kernel.org
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_ssif.c | 46 +++++++++++++++++++++---------------------
1 file changed, 23 insertions(+), 23 deletions(-)
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -92,7 +92,7 @@
#define SSIF_WATCH_WATCHDOG_TIMEOUT msecs_to_jiffies(250)
enum ssif_intf_state {
- SSIF_NORMAL,
+ SSIF_IDLE,
SSIF_GETTING_FLAGS,
SSIF_GETTING_EVENTS,
SSIF_CLEARING_FLAGS,
@@ -100,8 +100,8 @@ enum ssif_intf_state {
/* FIXME - add watchdog stuff. */
};
-#define SSIF_IDLE(ssif) ((ssif)->ssif_state == SSIF_NORMAL \
- && (ssif)->curr_msg == NULL)
+#define IS_SSIF_IDLE(ssif) ((ssif)->ssif_state == SSIF_IDLE \
+ && (ssif)->curr_msg == NULL)
/*
* Indexes into stats[] in ssif_info below.
@@ -348,9 +348,9 @@ static void return_hosed_msg(struct ssif
/*
* Must be called with the message lock held. This will release the
- * message lock. Note that the caller will check SSIF_IDLE and start a
- * new operation, so there is no need to check for new messages to
- * start in here.
+ * message lock. Note that the caller will check IS_SSIF_IDLE and
+ * start a new operation, so there is no need to check for new
+ * messages to start in here.
*/
static void start_clear_flags(struct ssif_info *ssif_info, unsigned long *flags)
{
@@ -367,7 +367,7 @@ static void start_clear_flags(struct ssi
if (start_send(ssif_info, msg, 3) != 0) {
/* Error, just go to normal state. */
- ssif_info->ssif_state = SSIF_NORMAL;
+ ssif_info->ssif_state = SSIF_IDLE;
}
}
@@ -382,7 +382,7 @@ static void start_flag_fetch(struct ssif
mb[0] = (IPMI_NETFN_APP_REQUEST << 2);
mb[1] = IPMI_GET_MSG_FLAGS_CMD;
if (start_send(ssif_info, mb, 2) != 0)
- ssif_info->ssif_state = SSIF_NORMAL;
+ ssif_info->ssif_state = SSIF_IDLE;
}
static void check_start_send(struct ssif_info *ssif_info, unsigned long *flags,
@@ -393,7 +393,7 @@ static void check_start_send(struct ssif
flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
ssif_info->curr_msg = NULL;
- ssif_info->ssif_state = SSIF_NORMAL;
+ ssif_info->ssif_state = SSIF_IDLE;
ipmi_ssif_unlock_cond(ssif_info, flags);
ipmi_free_smi_msg(msg);
}
@@ -407,7 +407,7 @@ static void start_event_fetch(struct ssi
msg = ipmi_alloc_smi_msg();
if (!msg) {
- ssif_info->ssif_state = SSIF_NORMAL;
+ ssif_info->ssif_state = SSIF_IDLE;
ipmi_ssif_unlock_cond(ssif_info, flags);
return;
}
@@ -430,7 +430,7 @@ static void start_recv_msg_fetch(struct
msg = ipmi_alloc_smi_msg();
if (!msg) {
- ssif_info->ssif_state = SSIF_NORMAL;
+ ssif_info->ssif_state = SSIF_IDLE;
ipmi_ssif_unlock_cond(ssif_info, flags);
return;
}
@@ -448,9 +448,9 @@ static void start_recv_msg_fetch(struct
/*
* Must be called with the message lock held. This will release the
- * message lock. Note that the caller will check SSIF_IDLE and start a
- * new operation, so there is no need to check for new messages to
- * start in here.
+ * message lock. Note that the caller will check IS_SSIF_IDLE and
+ * start a new operation, so there is no need to check for new
+ * messages to start in here.
*/
static void handle_flags(struct ssif_info *ssif_info, unsigned long *flags)
{
@@ -466,7 +466,7 @@ static void handle_flags(struct ssif_inf
/* Events available. */
start_event_fetch(ssif_info, flags);
else {
- ssif_info->ssif_state = SSIF_NORMAL;
+ ssif_info->ssif_state = SSIF_IDLE;
ipmi_ssif_unlock_cond(ssif_info, flags);
}
}
@@ -568,7 +568,7 @@ static void watch_timeout(struct timer_l
if (ssif_info->watch_timeout) {
mod_timer(&ssif_info->watch_timer,
jiffies + ssif_info->watch_timeout);
- if (SSIF_IDLE(ssif_info)) {
+ if (IS_SSIF_IDLE(ssif_info)) {
start_flag_fetch(ssif_info, flags); /* Releases lock */
return;
}
@@ -756,7 +756,7 @@ static void msg_done_handler(struct ssif
}
switch (ssif_info->ssif_state) {
- case SSIF_NORMAL:
+ case SSIF_IDLE:
ipmi_ssif_unlock_cond(ssif_info, flags);
if (!msg)
break;
@@ -774,7 +774,7 @@ static void msg_done_handler(struct ssif
* Error fetching flags, or invalid length,
* just give up for now.
*/
- ssif_info->ssif_state = SSIF_NORMAL;
+ ssif_info->ssif_state = SSIF_IDLE;
ipmi_ssif_unlock_cond(ssif_info, flags);
dev_warn(&ssif_info->client->dev,
"Error getting flags: %d %d, %x\n",
@@ -809,7 +809,7 @@ static void msg_done_handler(struct ssif
"Invalid response clearing flags: %x %x\n",
data[0], data[1]);
}
- ssif_info->ssif_state = SSIF_NORMAL;
+ ssif_info->ssif_state = SSIF_IDLE;
ipmi_ssif_unlock_cond(ssif_info, flags);
break;
@@ -887,7 +887,7 @@ static void msg_done_handler(struct ssif
}
flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
- if (SSIF_IDLE(ssif_info) && !ssif_info->stopping) {
+ if (IS_SSIF_IDLE(ssif_info) && !ssif_info->stopping) {
if (ssif_info->req_events)
start_event_fetch(ssif_info, flags);
else if (ssif_info->req_flags)
@@ -1032,7 +1032,7 @@ static void start_next_msg(struct ssif_i
unsigned long oflags;
restart:
- if (!SSIF_IDLE(ssif_info)) {
+ if (!IS_SSIF_IDLE(ssif_info)) {
ipmi_ssif_unlock_cond(ssif_info, flags);
return;
}
@@ -1255,7 +1255,7 @@ static void shutdown_ssif(void *send_inf
dev_set_drvdata(&ssif_info->client->dev, NULL);
/* make sure the driver is not looking for flags any more. */
- while (ssif_info->ssif_state != SSIF_NORMAL)
+ while (ssif_info->ssif_state != SSIF_IDLE)
schedule_timeout(1);
ssif_info->stopping = true;
@@ -1827,7 +1827,7 @@ static int ssif_probe(struct i2c_client
}
spin_lock_init(&ssif_info->lock);
- ssif_info->ssif_state = SSIF_NORMAL;
+ ssif_info->ssif_state = SSIF_IDLE;
timer_setup(&ssif_info->retry_timer, retry_timeout, 0);
timer_setup(&ssif_info->watch_timer, watch_timeout, 0);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 434/567] s390/extmem: return correct segment type in __segment_load()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 433/567] ipmi_ssif: Rename idle state and check Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 435/567] s390: discard .interp section Greg Kroah-Hartman
` (136 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gerald Schaefer, Heiko Carstens
From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
commit 8c42dd78df148c90e48efff204cce38743906a79 upstream.
Commit f05f62d04271f ("s390/vmem: get rid of memory segment list")
reshuffled the call to vmem_add_mapping() in __segment_load(), which now
overwrites rc after it was set to contain the segment type code.
As result, __segment_load() will now always return 0 on success, which
corresponds to the segment type code SEG_TYPE_SW, i.e. a writeable
segment. This results in a kernel crash when loading a read-only segment
as dcssblk block device, and trying to write to it.
Instead of reshuffling code again, make sure to return the segment type
on success, and also describe this rather delicate and unexpected logic
in the function comment. Also initialize new segtype variable with
invalid value, to prevent possible future confusion.
Fixes: f05f62d04271 ("s390/vmem: get rid of memory segment list")
Cc: <stable@vger.kernel.org> # 5.9+
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/mm/extmem.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/arch/s390/mm/extmem.c
+++ b/arch/s390/mm/extmem.c
@@ -289,15 +289,17 @@ segment_overlaps_others (struct dcss_seg
/*
* real segment loading function, called from segment_load
+ * Must return either an error code < 0, or the segment type code >= 0
*/
static int
__segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long *end)
{
unsigned long start_addr, end_addr, dummy;
struct dcss_segment *seg;
- int rc, diag_cc;
+ int rc, diag_cc, segtype;
start_addr = end_addr = 0;
+ segtype = -1;
seg = kmalloc(sizeof(*seg), GFP_KERNEL | GFP_DMA);
if (seg == NULL) {
rc = -ENOMEM;
@@ -326,9 +328,9 @@ __segment_load (char *name, int do_nonsh
seg->res_name[8] = '\0';
strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name));
seg->res->name = seg->res_name;
- rc = seg->vm_segtype;
- if (rc == SEG_TYPE_SC ||
- ((rc == SEG_TYPE_SR || rc == SEG_TYPE_ER) && !do_nonshared))
+ segtype = seg->vm_segtype;
+ if (segtype == SEG_TYPE_SC ||
+ ((segtype == SEG_TYPE_SR || segtype == SEG_TYPE_ER) && !do_nonshared))
seg->res->flags |= IORESOURCE_READONLY;
/* Check for overlapping resources before adding the mapping. */
@@ -386,7 +388,7 @@ __segment_load (char *name, int do_nonsh
out_free:
kfree(seg);
out:
- return rc;
+ return rc < 0 ? rc : segtype;
}
/*
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 435/567] s390: discard .interp section
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 434/567] s390/extmem: return correct segment type in __segment_load() Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 436/567] s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler Greg Kroah-Hartman
` (135 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilya Leoshkevich, Heiko Carstens
From: Ilya Leoshkevich <iii@linux.ibm.com>
commit e9c9cb90e76ffaabcc7ca8f275d9e82195fd6367 upstream.
When debugging vmlinux with QEMU + GDB, the following GDB error may
occur:
(gdb) c
Continuing.
Warning:
Cannot insert breakpoint -1.
Cannot access memory at address 0xffffffffffff95c0
Command aborted.
(gdb)
The reason is that, when .interp section is present, GDB tries to
locate the file specified in it in memory and put a number of
breakpoints there (see enable_break() function in gdb/solib-svr4.c).
Sometimes GDB finds a bogus location that matches its heuristics,
fails to set a breakpoint and stops. This makes further debugging
impossible.
The .interp section contains misleading information anyway (vmlinux
does not need ld.so), so fix by discarding it.
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/vmlinux.lds.S | 1 +
1 file changed, 1 insertion(+)
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -227,5 +227,6 @@ SECTIONS
DISCARDS
/DISCARD/ : {
*(.eh_frame)
+ *(.interp)
}
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 436/567] s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 435/567] s390: discard .interp section Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 437/567] s390/kprobes: fix current_kprobe never cleared after kprobes reenter Greg Kroah-Hartman
` (134 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Heiko Carstens, Vasily Gorbik
From: Vasily Gorbik <gor@linux.ibm.com>
commit 42e19e6f04984088b6f9f0507c4c89a8152d9730 upstream.
Recent test_kprobe_missed kprobes kunit test uncovers the following error
(reported when CONFIG_DEBUG_ATOMIC_SLEEP is enabled):
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 662, name: kunit_try_catch
preempt_count: 0, expected: 0
RCU nest depth: 0, expected: 0
no locks held by kunit_try_catch/662.
irq event stamp: 280
hardirqs last enabled at (279): [<00000003e60a3d42>] __do_pgm_check+0x17a/0x1c0
hardirqs last disabled at (280): [<00000003e3bd774a>] kprobe_exceptions_notify+0x27a/0x318
softirqs last enabled at (0): [<00000003e3c5c890>] copy_process+0x14a8/0x4c80
softirqs last disabled at (0): [<0000000000000000>] 0x0
CPU: 46 PID: 662 Comm: kunit_try_catch Tainted: G N 6.2.0-173644-g44c18d77f0c0 #2
Hardware name: IBM 3931 A01 704 (LPAR)
Call Trace:
[<00000003e60a3a00>] dump_stack_lvl+0x120/0x198
[<00000003e3d02e82>] __might_resched+0x60a/0x668
[<00000003e60b9908>] __mutex_lock+0xc0/0x14e0
[<00000003e60bad5a>] mutex_lock_nested+0x32/0x40
[<00000003e3f7b460>] unregister_kprobe+0x30/0xd8
[<00000003e51b2602>] test_kprobe_missed+0xf2/0x268
[<00000003e51b5406>] kunit_try_run_case+0x10e/0x290
[<00000003e51b7dfa>] kunit_generic_run_threadfn_adapter+0x62/0xb8
[<00000003e3ce30f8>] kthread+0x2d0/0x398
[<00000003e3b96afa>] __ret_from_fork+0x8a/0xe8
[<00000003e60ccada>] ret_from_fork+0xa/0x40
The reason for this error report is that kprobes handling code failed
to restore irqs.
The problem is that when kprobe is triggered from another kprobe
post_handler current sequence of enable_singlestep / disable_singlestep
is the following:
enable_singlestep <- original kprobe (saves kprobe_saved_imask)
enable_singlestep <- kprobe triggered from post_handler (clobbers kprobe_saved_imask)
disable_singlestep <- kprobe triggered from post_handler (restores kprobe_saved_imask)
disable_singlestep <- original kprobe (restores wrong clobbered kprobe_saved_imask)
There is just one kprobe_ctlblk per cpu and both calls saves and
loads irq mask to kprobe_saved_imask. To fix the problem simply move
resume_execution (which calls disable_singlestep) before calling
post_handler. This also fixes the problem that post_handler is called
with pt_regs which were not yet adjusted after single-stepping.
Cc: stable@vger.kernel.org
Fixes: 4ba069b802c2 ("[S390] add kprobes support.")
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/kprobes.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -394,12 +394,11 @@ static int post_kprobe_handler(struct pt
if (!p)
return 0;
+ resume_execution(p, regs);
if (kcb->kprobe_status != KPROBE_REENTER && p->post_handler) {
kcb->kprobe_status = KPROBE_HIT_SSDONE;
p->post_handler(p, regs, 0);
}
-
- resume_execution(p, regs);
pop_kprobe(kcb);
preempt_enable_no_resched();
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 437/567] s390/kprobes: fix current_kprobe never cleared after kprobes reenter
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 436/567] s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 438/567] cifs: Fix uninitialized memory read in smb3_qfs_tcon() Greg Kroah-Hartman
` (133 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Heiko Carstens, Vasily Gorbik
From: Vasily Gorbik <gor@linux.ibm.com>
commit cd57953936f2213dfaccce10d20f396956222c7d upstream.
Recent test_kprobe_missed kprobes kunit test uncovers the following
problem. Once kprobe is triggered from another kprobe (kprobe reenter),
all future kprobes on this cpu are considered as kprobe reenter, thus
pre_handler and post_handler are not being called and kprobes are counted
as "missed".
Commit b9599798f953 ("[S390] kprobes: activation and deactivation")
introduced a simpler scheme for kprobes (de)activation and status
tracking by using push_kprobe/pop_kprobe, which supposed to work for
both initial kprobe entry as well as kprobe reentry and helps to avoid
handling those two cases differently. The problem is that a sequence of
calls in case of kprobes reenter:
push_kprobe() <- NULL (current_kprobe)
push_kprobe() <- kprobe1 (current_kprobe)
pop_kprobe() -> kprobe1 (current_kprobe)
pop_kprobe() -> kprobe1 (current_kprobe)
leaves "kprobe1" as "current_kprobe" on this cpu, instead of setting it
to NULL. In fact push_kprobe/pop_kprobe can only store a single state
(there is just one prev_kprobe in kprobe_ctlblk). Which is a hack but
sufficient, there is no need to have another prev_kprobe just to store
NULL. To make a simple and backportable fix simply reset "prev_kprobe"
when kprobe is poped from this "stack". No need to worry about
"kprobe_status" in this case, because its value is only checked when
current_kprobe != NULL.
Cc: stable@vger.kernel.org
Fixes: b9599798f953 ("[S390] kprobes: activation and deactivation")
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/kprobes.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -233,6 +233,7 @@ static void pop_kprobe(struct kprobe_ctl
{
__this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
kcb->kprobe_status = kcb->prev_kprobe.status;
+ kcb->prev_kprobe.kp = NULL;
}
NOKPROBE_SYMBOL(pop_kprobe);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 438/567] cifs: Fix uninitialized memory read in smb3_qfs_tcon()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 437/567] s390/kprobes: fix current_kprobe never cleared after kprobes reenter Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 439/567] btrfs: hold block group refcount during async discard Greg Kroah-Hartman
` (132 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Volker Lendecke,
Paulo Alcantara (SUSE),
Steve French
From: Volker Lendecke <vl@samba.org>
commit d447e794a37288ec7a080aa1b044a8d9deebbab7 upstream.
oparms was not fully initialized
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2ops.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -966,12 +966,13 @@ smb3_qfs_tcon(const unsigned int xid, st
struct cifs_fid fid;
struct cached_fid *cfid = NULL;
- oparms.tcon = tcon;
- oparms.desired_access = FILE_READ_ATTRIBUTES;
- oparms.disposition = FILE_OPEN;
- oparms.create_options = cifs_create_options(cifs_sb, 0);
- oparms.fid = &fid;
- oparms.reconnect = false;
+ oparms = (struct cifs_open_parms) {
+ .tcon = tcon,
+ .desired_access = FILE_READ_ATTRIBUTES,
+ .disposition = FILE_OPEN,
+ .create_options = cifs_create_options(cifs_sb, 0),
+ .fid = &fid,
+ };
rc = open_cached_dir(xid, tcon, "", cifs_sb, &cfid);
if (rc == 0)
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 439/567] btrfs: hold block group refcount during async discard
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 438/567] cifs: Fix uninitialized memory read in smb3_qfs_tcon() Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 440/567] locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath Greg Kroah-Hartman
` (131 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Boris Burkov, David Sterba
From: Boris Burkov <boris@bur.io>
commit 2b5463fcbdfb24e898916bcae2b1359042d26963 upstream.
Async discard does not acquire the block group reference count while it
holds a reference on the discard list. This is generally OK, as the
paths which destroy block groups tend to try to synchronize on
cancelling async discard work. However, relying on cancelling work
requires careful analysis to be sure it is safe from races with
unpinning scheduling more work.
While I am unable to find a race with unpinning in the current code for
either the unused bgs or relocation paths, I believe we have one in an
older version of auto relocation in a Meta internal build. This suggests
that this is in fact an error prone model, and could be fragile to
future changes to these bg deletion paths.
To make this ownership more clear, add a refcount for async discard. If
work is queued for a block group, its refcount should be incremented,
and when work is completed or canceled, it should be decremented.
CC: stable@vger.kernel.org # 5.15+
Signed-off-by: Boris Burkov <boris@bur.io>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/discard.c | 41 ++++++++++++++++++++++++++++++++++++++---
1 file changed, 38 insertions(+), 3 deletions(-)
--- a/fs/btrfs/discard.c
+++ b/fs/btrfs/discard.c
@@ -77,6 +77,7 @@ static struct list_head *get_discard_lis
static void __add_to_discard_list(struct btrfs_discard_ctl *discard_ctl,
struct btrfs_block_group *block_group)
{
+ lockdep_assert_held(&discard_ctl->lock);
if (!btrfs_run_discard_work(discard_ctl))
return;
@@ -88,6 +89,8 @@ static void __add_to_discard_list(struct
BTRFS_DISCARD_DELAY);
block_group->discard_state = BTRFS_DISCARD_RESET_CURSOR;
}
+ if (list_empty(&block_group->discard_list))
+ btrfs_get_block_group(block_group);
list_move_tail(&block_group->discard_list,
get_discard_list(discard_ctl, block_group));
@@ -107,8 +110,12 @@ static void add_to_discard_list(struct b
static void add_to_discard_unused_list(struct btrfs_discard_ctl *discard_ctl,
struct btrfs_block_group *block_group)
{
+ bool queued;
+
spin_lock(&discard_ctl->lock);
+ queued = !list_empty(&block_group->discard_list);
+
if (!btrfs_run_discard_work(discard_ctl)) {
spin_unlock(&discard_ctl->lock);
return;
@@ -120,6 +127,8 @@ static void add_to_discard_unused_list(s
block_group->discard_eligible_time = (ktime_get_ns() +
BTRFS_DISCARD_UNUSED_DELAY);
block_group->discard_state = BTRFS_DISCARD_RESET_CURSOR;
+ if (!queued)
+ btrfs_get_block_group(block_group);
list_add_tail(&block_group->discard_list,
&discard_ctl->discard_list[BTRFS_DISCARD_INDEX_UNUSED]);
@@ -130,6 +139,7 @@ static bool remove_from_discard_list(str
struct btrfs_block_group *block_group)
{
bool running = false;
+ bool queued = false;
spin_lock(&discard_ctl->lock);
@@ -139,7 +149,16 @@ static bool remove_from_discard_list(str
}
block_group->discard_eligible_time = 0;
+ queued = !list_empty(&block_group->discard_list);
list_del_init(&block_group->discard_list);
+ /*
+ * If the block group is currently running in the discard workfn, we
+ * don't want to deref it, since it's still being used by the workfn.
+ * The workfn will notice this case and deref the block group when it is
+ * finished.
+ */
+ if (queued && !running)
+ btrfs_put_block_group(block_group);
spin_unlock(&discard_ctl->lock);
@@ -212,10 +231,12 @@ again:
if (block_group && now >= block_group->discard_eligible_time) {
if (block_group->discard_index == BTRFS_DISCARD_INDEX_UNUSED &&
block_group->used != 0) {
- if (btrfs_is_block_group_data_only(block_group))
+ if (btrfs_is_block_group_data_only(block_group)) {
__add_to_discard_list(discard_ctl, block_group);
- else
+ } else {
list_del_init(&block_group->discard_list);
+ btrfs_put_block_group(block_group);
+ }
goto again;
}
if (block_group->discard_state == BTRFS_DISCARD_RESET_CURSOR) {
@@ -502,6 +523,15 @@ static void btrfs_discard_workfn(struct
spin_lock(&discard_ctl->lock);
discard_ctl->prev_discard = trimmed;
discard_ctl->prev_discard_time = now;
+ /*
+ * If the block group was removed from the discard list while it was
+ * running in this workfn, then we didn't deref it, since this function
+ * still owned that reference. But we set the discard_ctl->block_group
+ * back to NULL, so we can use that condition to know that now we need
+ * to deref the block_group.
+ */
+ if (discard_ctl->block_group == NULL)
+ btrfs_put_block_group(block_group);
discard_ctl->block_group = NULL;
__btrfs_discard_schedule_work(discard_ctl, now, false);
spin_unlock(&discard_ctl->lock);
@@ -638,8 +668,12 @@ void btrfs_discard_punt_unused_bgs_list(
list_for_each_entry_safe(block_group, next, &fs_info->unused_bgs,
bg_list) {
list_del_init(&block_group->bg_list);
- btrfs_put_block_group(block_group);
btrfs_discard_queue_work(&fs_info->discard_ctl, block_group);
+ /*
+ * This put is for the get done by btrfs_mark_bg_unused.
+ * Queueing discard incremented it for discard's reference.
+ */
+ btrfs_put_block_group(block_group);
}
spin_unlock(&fs_info->unused_bgs_lock);
}
@@ -669,6 +703,7 @@ static void btrfs_discard_purge_list(str
if (block_group->used == 0)
btrfs_mark_bg_unused(block_group);
spin_lock(&discard_ctl->lock);
+ btrfs_put_block_group(block_group);
}
}
spin_unlock(&discard_ctl->lock);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 440/567] locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 439/567] btrfs: hold block group refcount during async discard Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 441/567] ksmbd: fix wrong data area length for smb2 lock request Greg Kroah-Hartman
` (130 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Waiman Long, Ingo Molnar, Mukesh Ojha
From: Waiman Long <longman@redhat.com>
commit b613c7f31476c44316bfac1af7cac714b7d6bef9 upstream.
A non-first waiter can potentially spin in the for loop of
rwsem_down_write_slowpath() without sleeping but fail to acquire the
lock even if the rwsem is free if the following sequence happens:
Non-first RT waiter First waiter Lock holder
------------------- ------------ -----------
Acquire wait_lock
rwsem_try_write_lock():
Set handoff bit if RT or
wait too long
Set waiter->handoff_set
Release wait_lock
Acquire wait_lock
Inherit waiter->handoff_set
Release wait_lock
Clear owner
Release lock
if (waiter.handoff_set) {
rwsem_spin_on_owner(();
if (OWNER_NULL)
goto trylock_again;
}
trylock_again:
Acquire wait_lock
rwsem_try_write_lock():
if (first->handoff_set && (waiter != first))
return false;
Release wait_lock
A non-first waiter cannot really acquire the rwsem even if it mistakenly
believes that it can spin on OWNER_NULL value. If that waiter happens
to be an RT task running on the same CPU as the first waiter, it can
block the first waiter from acquiring the rwsem leading to live lock.
Fix this problem by making sure that a non-first waiter cannot spin in
the slowpath loop without sleeping.
Fixes: d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more consistent")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Tested-by: Mukesh Ojha <quic_mojha@quicinc.com>
Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230126003628.365092-2-longman@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/locking/rwsem.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
--- a/kernel/locking/rwsem.c
+++ b/kernel/locking/rwsem.c
@@ -586,18 +586,16 @@ static inline bool rwsem_try_write_lock(
*/
if (first->handoff_set && (waiter != first))
return false;
-
- /*
- * First waiter can inherit a previously set handoff
- * bit and spin on rwsem if lock acquisition fails.
- */
- if (waiter == first)
- waiter->handoff_set = true;
}
new = count;
if (count & RWSEM_LOCK_MASK) {
+ /*
+ * A waiter (first or not) can set the handoff bit
+ * if it is an RT task or wait in the wait queue
+ * for too long.
+ */
if (has_handoff || (!rt_task(waiter->task) &&
!time_after(jiffies, waiter->timeout)))
return false;
@@ -613,11 +611,12 @@ static inline bool rwsem_try_write_lock(
} while (!atomic_long_try_cmpxchg_acquire(&sem->count, &count, new));
/*
- * We have either acquired the lock with handoff bit cleared or
- * set the handoff bit.
+ * We have either acquired the lock with handoff bit cleared or set
+ * the handoff bit. Only the first waiter can have its handoff_set
+ * set here to enable optimistic spinning in slowpath loop.
*/
if (new & RWSEM_FLAG_HANDOFF) {
- waiter->handoff_set = true;
+ first->handoff_set = true;
lockevent_inc(rwsem_wlock_handoff);
return false;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 441/567] ksmbd: fix wrong data area length for smb2 lock request
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 440/567] locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 442/567] ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length Greg Kroah-Hartman
` (129 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit 8f8c43b125882ac14372f8dca0c8e50a59e78d79 upstream.
When turning debug mode on, The following error message from
ksmbd_smb2_check_message() is coming.
ksmbd: cli req padded more than expected. Length 112 not 88 for cmd:10 mid:14
data area length calculation for smb2 lock request in smb2_get_data_area_len() is
incorrect.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/smb2misc.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
--- a/fs/ksmbd/smb2misc.c
+++ b/fs/ksmbd/smb2misc.c
@@ -150,15 +150,11 @@ static int smb2_get_data_area_len(unsign
break;
case SMB2_LOCK:
{
- int lock_count;
+ unsigned short lock_count;
- /*
- * smb2_lock request size is 48 included single
- * smb2_lock_element structure size.
- */
- lock_count = le16_to_cpu(((struct smb2_lock_req *)hdr)->LockCount) - 1;
+ lock_count = le16_to_cpu(((struct smb2_lock_req *)hdr)->LockCount);
if (lock_count > 0) {
- *off = __SMB2_HEADER_STRUCTURE_SIZE + 48;
+ *off = offsetof(struct smb2_lock_req, locks);
*len = sizeof(struct smb2_lock_element) * lock_count;
}
break;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 442/567] ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 441/567] ksmbd: fix wrong data area length for smb2 lock request Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:02 ` [PATCH 5.15 443/567] ARM: dts: exynos: correct HDMI phy compatible in Exynos4 Greg Kroah-Hartman
` (128 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit fb533473d1595fe79ecb528fda1de33552b07178 upstream.
ksmbd allowed the actual frame length to be smaller than the rfc1002
length. If allowed, it is possible to allocates a large amount of memory
that can be limited by credit management and can eventually cause memory
exhaustion problem. This patch do not allow it except SMB2 Negotiate
request which will be validated when message handling proceeds.
Also, Allow a message that padded to 8byte boundary.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/smb2misc.c | 21 ++++++++++-----------
1 file changed, 10 insertions(+), 11 deletions(-)
--- a/fs/ksmbd/smb2misc.c
+++ b/fs/ksmbd/smb2misc.c
@@ -414,20 +414,19 @@ int ksmbd_smb2_check_message(struct ksmb
goto validate_credit;
/*
- * windows client also pad up to 8 bytes when compounding.
- * If pad is longer than eight bytes, log the server behavior
- * (once), since may indicate a problem but allow it and
- * continue since the frame is parseable.
+ * SMB2 NEGOTIATE request will be validated when message
+ * handling proceeds.
*/
- if (clc_len < len) {
- ksmbd_debug(SMB,
- "cli req padded more than expected. Length %d not %d for cmd:%d mid:%llu\n",
- len, clc_len, command,
- le64_to_cpu(hdr->MessageId));
+ if (command == SMB2_NEGOTIATE_HE)
goto validate_credit;
- }
- ksmbd_debug(SMB,
+ /*
+ * Allow a message that padded to 8byte boundary.
+ */
+ if (clc_len < len && (len - clc_len) < 8)
+ goto validate_credit;
+
+ pr_err_ratelimited(
"cli req too short, len %d not %d. cmd:%d mid:%llu\n",
len, clc_len, command,
le64_to_cpu(hdr->MessageId));
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 443/567] ARM: dts: exynos: correct HDMI phy compatible in Exynos4
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 442/567] ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length Greg Kroah-Hartman
@ 2023-03-07 17:02 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 444/567] hfs: fix missing hfs_bnode_get() in __hfs_bnode_create Greg Kroah-Hartman
` (127 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:02 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit af1c89ddb74f170eccd5a57001d7317560b638ea upstream.
The HDMI phy compatible was missing vendor prefix.
Fixes: ed80d4cab772 ("ARM: dts: add hdmi related nodes for exynos4 SoCs")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230125094513.155063-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos4.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/exynos4.dtsi
+++ b/arch/arm/boot/dts/exynos4.dtsi
@@ -605,7 +605,7 @@
status = "disabled";
hdmi_i2c_phy: hdmiphy@38 {
- compatible = "exynos4210-hdmiphy";
+ compatible = "samsung,exynos4210-hdmiphy";
reg = <0x38>;
};
};
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 444/567] hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2023-03-07 17:02 ` [PATCH 5.15 443/567] ARM: dts: exynos: correct HDMI phy compatible in Exynos4 Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 445/567] fs: hfsplus: fix UAF issue in hfsplus_put_super Greg Kroah-Hartman
` (126 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5b04b49a7ec7226c7426,
Liu Shixin, Fabio M. De Francesco, Viacheslav Dubeyko,
Andrew Morton
From: Liu Shixin <liushixin2@huawei.com>
commit a9dc087fd3c484fd1ed18c5efb290efaaf44ce03 upstream.
Syzbot found a kernel BUG in hfs_bnode_put():
kernel BUG at fs/hfs/bnode.c:466!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 3634 Comm: kworker/u4:5 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:hfs_bnode_put+0x46f/0x480 fs/hfs/bnode.c:466
Code: 8a 80 ff e9 73 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a0 fe ff ff 48 89 df e8 db 8a 80 ff e9 93 fe ff ff e8 a1 68 2c ff <0f> 0b e8 9a 68 2c ff 0f 0b 0f 1f 84 00 00 00 00 00 55 41 57 41 56
RSP: 0018:ffffc90003b4f258 EFLAGS: 00010293
RAX: ffffffff825e318f RBX: 0000000000000000 RCX: ffff8880739dd7c0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003b4f430 R08: ffffffff825e2d9b R09: ffffed10045157d1
R10: ffffed10045157d1 R11: 1ffff110045157d0 R12: ffff8880228abe80
R13: ffff88807016c000 R14: dffffc0000000000 R15: ffff8880228abe00
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa6ebe88718 CR3: 000000001e93d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
hfs_write_inode+0x1bc/0xb40
write_inode fs/fs-writeback.c:1440 [inline]
__writeback_single_inode+0x4d6/0x670 fs/fs-writeback.c:1652
writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1878
__writeback_inodes_wb+0x125/0x420 fs/fs-writeback.c:1949
wb_writeback+0x440/0x7b0 fs/fs-writeback.c:2054
wb_check_start_all fs/fs-writeback.c:2176 [inline]
wb_do_writeback fs/fs-writeback.c:2202 [inline]
wb_workfn+0x827/0xef0 fs/fs-writeback.c:2235
process_one_work+0x877/0xdb0 kernel/workqueue.c:2289
worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
</TASK>
The BUG_ON() is triggered at here:
/* Dispose of resources used by a node */
void hfs_bnode_put(struct hfs_bnode *node)
{
if (node) {
<skipped>
BUG_ON(!atomic_read(&node->refcnt)); <- we have issue here!!!!
<skipped>
}
}
By tracing the refcnt, I found the node is created by hfs_bmap_alloc()
with refcnt 1. Then the node is used by hfs_btree_write(). There is a
missing of hfs_bnode_get() after find the node. The issue happened in
following path:
<alloc>
hfs_bmap_alloc
hfs_bnode_find
__hfs_bnode_create <- allocate a new node with refcnt 1.
hfs_bnode_put <- decrease the refcnt
<write>
hfs_btree_write
hfs_bnode_find
__hfs_bnode_create
hfs_bnode_findhash <- find the node without refcnt increased.
hfs_bnode_put <- trigger the BUG_ON() since refcnt is 0.
Link: https://lkml.kernel.org/r/20221212021627.3766829-1-liushixin2@huawei.com
Reported-by: syzbot+5b04b49a7ec7226c7426@syzkaller.appspotmail.com
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Cc: Fabio M. De Francesco <fmdefrancesco@gmail.com>
Cc: Viacheslav Dubeyko <slava@dubeyko.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/hfs/bnode.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -281,6 +281,7 @@ static struct hfs_bnode *__hfs_bnode_cre
tree->node_hash[hash] = node;
tree->node_hash_cnt++;
} else {
+ hfs_bnode_get(node2);
spin_unlock(&tree->hash_lock);
kfree(node);
wait_event(node2->lock_wq, !test_bit(HFS_BNODE_NEW, &node2->flags));
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 445/567] fs: hfsplus: fix UAF issue in hfsplus_put_super
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 444/567] hfs: fix missing hfs_bnode_get() in __hfs_bnode_create Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 446/567] exfat: fix reporting fs error when reading dir beyond EOF Greg Kroah-Hartman
` (125 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+57e3e98f7e3b80f64d56,
Dongliang Mu, Bart Van Assche, Jens Axboe, Muchun Song,
Roman Gushchin, Theodore Tso, Andrew Morton
From: Dongliang Mu <mudongliangabcd@gmail.com>
commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 upstream.
The current hfsplus_put_super first calls hfs_btree_close on
sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an
use-after-free issue in hfsplus_release_folio.
As shown in hfsplus_fill_super, the error handling code also calls iput
before hfs_btree_close.
To fix this error, we move all iput calls before hfsplus_btree_close.
Note that this patch is tested on Syzbot.
Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com
Reported-by: syzbot+57e3e98f7e3b80f64d56@syzkaller.appspotmail.com
Tested-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Muchun Song <songmuchun@bytedance.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: "Theodore Ts'o" <tytso@mit.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/hfsplus/super.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -295,11 +295,11 @@ static void hfsplus_put_super(struct sup
hfsplus_sync_fs(sb, 1);
}
+ iput(sbi->alloc_file);
+ iput(sbi->hidden_dir);
hfs_btree_close(sbi->attr_tree);
hfs_btree_close(sbi->cat_tree);
hfs_btree_close(sbi->ext_tree);
- iput(sbi->alloc_file);
- iput(sbi->hidden_dir);
kfree(sbi->s_vhdr_buf);
kfree(sbi->s_backup_vhdr_buf);
unload_nls(sbi->nls);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 446/567] exfat: fix reporting fs error when reading dir beyond EOF
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 445/567] fs: hfsplus: fix UAF issue in hfsplus_put_super Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 447/567] exfat: fix unexpected EOF while reading dir Greg Kroah-Hartman
` (124 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuezhang Mo, Andy Wu, Aoyama Wataru,
Sungjong Seo, Namjae Jeon
From: Yuezhang Mo <Yuezhang.Mo@sony.com>
commit 706fdcac002316893434d753be8cfb549fe1d40d upstream.
Since seekdir() does not check whether the position is valid, the
position may exceed the size of the directory. We found that for
a directory with discontinuous clusters, if the position exceeds
the size of the directory and the excess size is greater than or
equal to the cluster size, exfat_readdir() will return -EIO,
causing a file system error and making the file system unavailable.
Reproduce this bug by:
seekdir(dir, dir_size + cluster_size);
dirent = readdir(dir);
The following log will be printed if mount with 'errors=remount-ro'.
[11166.712896] exFAT-fs (sdb1): error, invalid access to FAT (entry 0xffffffff)
[11166.712905] exFAT-fs (sdb1): Filesystem has been set read-only
Fixes: 1e5654de0f51 ("exfat: handle wrong stream entry size in exfat_readdir()")
Cc: stable@vger.kernel.org # v5.7+
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Andy Wu <Andy.Wu@sony.com>
Reviewed-by: Aoyama Wataru <wataru.aoyama@sony.com>
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exfat/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/exfat/dir.c
+++ b/fs/exfat/dir.c
@@ -103,7 +103,7 @@ static int exfat_readdir(struct inode *i
clu.dir = ei->hint_bmap.clu;
}
- while (clu_offset > 0) {
+ while (clu_offset > 0 && clu.dir != EXFAT_EOF_CLUSTER) {
if (exfat_get_next_cluster(sb, &(clu.dir)))
return -EIO;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 447/567] exfat: fix unexpected EOF while reading dir
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 446/567] exfat: fix reporting fs error when reading dir beyond EOF Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 448/567] exfat: redefine DIR_DELETED as the bad cluster number Greg Kroah-Hartman
` (123 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wang Yugui, Yuezhang Mo, Andy Wu,
Aoyama Wataru, Sungjong Seo, Namjae Jeon
From: Yuezhang Mo <Yuezhang.Mo@sony.com>
commit 6cb5d1a16a51d080fbc1649a5144cbc5ca7d6f88 upstream.
If the position is not aligned with the dentry size, the return
value of readdir() will be NULL and errno is 0, which means the
end of the directory stream is reached.
If the position is aligned with dentry size, but there is no file
or directory at the position, exfat_readdir() will continue to
get dentry from the next dentry. So the dentry gotten by readdir()
may not be at the position.
After this commit, if the position is not aligned with the dentry
size, round the position up to the dentry size and continue to get
the dentry.
Fixes: ca06197382bd ("exfat: add directory operations")
Cc: stable@vger.kernel.org # v5.7+
Reported-by: Wang Yugui <wangyugui@e16-tech.com>
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Andy Wu <Andy.Wu@sony.com>
Reviewed-by: Aoyama Wataru <wataru.aoyama@sony.com>
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exfat/dir.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/fs/exfat/dir.c
+++ b/fs/exfat/dir.c
@@ -237,10 +237,7 @@ static int exfat_iterate(struct file *fi
fake_offset = 1;
}
- if (cpos & (DENTRY_SIZE - 1)) {
- err = -ENOENT;
- goto unlock;
- }
+ cpos = round_up(cpos, DENTRY_SIZE);
/* name buffer should be allocated before use */
err = exfat_alloc_namebuf(nb);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 448/567] exfat: redefine DIR_DELETED as the bad cluster number
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 447/567] exfat: fix unexpected EOF while reading dir Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 449/567] exfat: fix inode->i_blocks for non-512 byte sector size device Greg Kroah-Hartman
` (122 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuezhang Mo, Sungjong Seo, Namjae Jeon
From: Sungjong Seo <sj1557.seo@samsung.com>
commit bdaadfd343e3cba49ad0b009ff4b148dad0fa404 upstream.
When a file or a directory is deleted, the hint for the cluster of
its parent directory in its in-memory inode is set as DIR_DELETED.
Therefore, DIR_DELETED must be one of invalid cluster numbers. According
to the exFAT specification, a volume can have at most 2^32-11 clusters.
However, DIR_DELETED is wrongly defined as 0xFFFF0321, which could be
a valid cluster number. To fix it, let's redefine DIR_DELETED as
0xFFFFFFF7, the bad cluster number.
Fixes: 1acf1a564b60 ("exfat: add in-memory and on-disk structures and headers")
Cc: stable@vger.kernel.org # v5.7+
Reported-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exfat/exfat_fs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/exfat/exfat_fs.h
+++ b/fs/exfat/exfat_fs.h
@@ -42,7 +42,7 @@ enum {
#define ES_2_ENTRIES 2
#define ES_ALL_ENTRIES 0
-#define DIR_DELETED 0xFFFF0321
+#define DIR_DELETED 0xFFFFFFF7
/* type values */
#define TYPE_UNUSED 0x0000
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 449/567] exfat: fix inode->i_blocks for non-512 byte sector size device
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 448/567] exfat: redefine DIR_DELETED as the bad cluster number Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 450/567] fs: dlm: dont set stop rx flag after node reset Greg Kroah-Hartman
` (121 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wang Yugui, Yuezhang Mo, Andy Wu,
Namjae Jeon
From: Yuezhang Mo <Yuezhang.Mo@sony.com>
commit 39c1ce8eafc0ff64fb9e28536ccc7df6a8e2999d upstream.
inode->i_blocks is not real number of blocks, but 512 byte ones.
Fixes: 98d917047e8b ("exfat: add file operations")
Cc: stable@vger.kernel.org # v5.7+
Reported-by: Wang Yugui <wangyugui@e16-tech.com>
Tested-by: Wang Yugui <wangyugui@e16-tech.com>
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Andy Wu <Andy.Wu@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exfat/file.c | 3 +--
fs/exfat/inode.c | 6 ++----
fs/exfat/namei.c | 2 +-
fs/exfat/super.c | 3 +--
4 files changed, 5 insertions(+), 9 deletions(-)
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -251,8 +251,7 @@ void exfat_truncate(struct inode *inode,
else
mark_inode_dirty(inode);
- inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >>
- inode->i_blkbits;
+ inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> 9;
write_size:
aligned_size = i_size_read(inode);
if (aligned_size & (blocksize - 1)) {
--- a/fs/exfat/inode.c
+++ b/fs/exfat/inode.c
@@ -243,8 +243,7 @@ static int exfat_map_cluster(struct inod
return err;
} /* end of if != DIR_DELETED */
- inode->i_blocks +=
- num_to_be_allocated << sbi->sect_per_clus_bits;
+ inode->i_blocks += EXFAT_CLU_TO_B(num_to_be_allocated, sbi) >> 9;
/*
* Move *clu pointer along FAT chains (hole care) because the
@@ -602,8 +601,7 @@ static int exfat_fill_inode(struct inode
exfat_save_attr(inode, info->attr);
- inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >>
- inode->i_blkbits;
+ inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> 9;
inode->i_mtime = info->mtime;
inode->i_ctime = info->mtime;
ei->i_crtime = info->crtime;
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -398,7 +398,7 @@ static int exfat_find_empty_entry(struct
ei->i_size_ondisk += sbi->cluster_size;
ei->i_size_aligned += sbi->cluster_size;
ei->flags = p_dir->flags;
- inode->i_blocks += 1 << sbi->sect_per_clus_bits;
+ inode->i_blocks += sbi->cluster_size >> 9;
}
return dentry;
--- a/fs/exfat/super.c
+++ b/fs/exfat/super.c
@@ -364,8 +364,7 @@ static int exfat_read_root(struct inode
inode->i_op = &exfat_dir_inode_operations;
inode->i_fop = &exfat_dir_operations;
- inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >>
- inode->i_blkbits;
+ inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> 9;
ei->i_pos = ((loff_t)sbi->root_dir << 32) | 0xffffffff;
ei->i_size_aligned = i_size_read(inode);
ei->i_size_ondisk = i_size_read(inode);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 450/567] fs: dlm: dont set stop rx flag after node reset
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 449/567] exfat: fix inode->i_blocks for non-512 byte sector size device Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 451/567] fs: dlm: move sending fin message into state change handling Greg Kroah-Hartman
` (120 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Aring, David Teigland
From: Alexander Aring <aahringo@redhat.com>
commit 15c63db8e86a72e0d5cfb9bf0cd1870e39a3e5fe upstream.
Similar to the stop tx flag, the rx flag should warn about a dlm message
being received at DLM_FIN state change, when we are assuming no other
dlm application messages. If we receive a FIN message and we are in the
state DLM_FIN_WAIT2 we call midcomms_node_reset() which puts the
midcomms node into DLM_CLOSED state. Afterwards we should not set the
DLM_NODE_FLAG_STOP_RX flag any more. This patch changes the setting
DLM_NODE_FLAG_STOP_RX in those state changes when we receive a FIN
message and we assume there will be no other dlm application messages
received until we hit DLM_CLOSED state.
Cc: stable@vger.kernel.org
Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect")
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dlm/midcomms.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/dlm/midcomms.c
+++ b/fs/dlm/midcomms.c
@@ -504,6 +504,7 @@ static void dlm_midcomms_receive_buffer(
break;
case DLM_FIN_WAIT1:
node->state = DLM_CLOSING;
+ set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags);
pr_debug("switch node %d to state %s\n",
node->nodeid, dlm_state_str(node->state));
break;
@@ -524,8 +525,6 @@ static void dlm_midcomms_receive_buffer(
return;
}
spin_unlock(&node->state_lock);
-
- set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags);
break;
default:
WARN_ON(test_bit(DLM_NODE_FLAG_STOP_RX, &node->flags));
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 451/567] fs: dlm: move sending fin message into state change handling
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 450/567] fs: dlm: dont set stop rx flag after node reset Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 452/567] fs: dlm: send FIN ack back in right cases Greg Kroah-Hartman
` (119 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Aring, David Teigland
From: Alexander Aring <aahringo@redhat.com>
commit a58496361802070996f9bd76e941d109c4a85ebd upstream.
This patch moves the send fin handling, which should appear in a specific
state change, into the state change handling while the per node
state_lock is held. I experienced issues with other messages because
we changed the state and a fin message was sent out in a different state.
Cc: stable@vger.kernel.org
Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect")
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dlm/midcomms.c | 33 +++++++++------------------------
1 file changed, 9 insertions(+), 24 deletions(-)
--- a/fs/dlm/midcomms.c
+++ b/fs/dlm/midcomms.c
@@ -394,7 +394,7 @@ static int dlm_send_fin(struct midcomms_
struct dlm_mhandle *mh;
char *ppc;
- mh = dlm_midcomms_get_mhandle(node->nodeid, mb_len, GFP_NOFS, &ppc);
+ mh = dlm_midcomms_get_mhandle(node->nodeid, mb_len, GFP_ATOMIC, &ppc);
if (!mh)
return -ENOMEM;
@@ -498,8 +498,8 @@ static void dlm_midcomms_receive_buffer(
node->state = DLM_LAST_ACK;
pr_debug("switch node %d to state %s case 1\n",
node->nodeid, dlm_state_str(node->state));
- spin_unlock(&node->state_lock);
- goto send_fin;
+ set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags);
+ dlm_send_fin(node, dlm_pas_fin_ack_rcv);
}
break;
case DLM_FIN_WAIT1:
@@ -542,12 +542,6 @@ static void dlm_midcomms_receive_buffer(
log_print_ratelimited("ignore dlm msg because seq mismatch, seq: %u, expected: %u, nodeid: %d",
seq, node->seq_next, node->nodeid);
}
-
- return;
-
-send_fin:
- set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags);
- dlm_send_fin(node, dlm_pas_fin_ack_rcv);
}
static struct midcomms_node *
@@ -1268,11 +1262,11 @@ void dlm_midcomms_remove_member(int node
case DLM_CLOSE_WAIT:
/* passive shutdown DLM_LAST_ACK case 2 */
node->state = DLM_LAST_ACK;
- spin_unlock(&node->state_lock);
-
pr_debug("switch node %d to state %s case 2\n",
node->nodeid, dlm_state_str(node->state));
- goto send_fin;
+ set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags);
+ dlm_send_fin(node, dlm_pas_fin_ack_rcv);
+ break;
case DLM_LAST_ACK:
/* probably receive fin caught it, do nothing */
break;
@@ -1288,12 +1282,6 @@ void dlm_midcomms_remove_member(int node
spin_unlock(&node->state_lock);
srcu_read_unlock(&nodes_srcu, idx);
- return;
-
-send_fin:
- set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags);
- dlm_send_fin(node, dlm_pas_fin_ack_rcv);
- srcu_read_unlock(&nodes_srcu, idx);
}
static void midcomms_node_release(struct rcu_head *rcu)
@@ -1324,6 +1312,7 @@ static void midcomms_shutdown(struct mid
node->state = DLM_FIN_WAIT1;
pr_debug("switch node %d to state %s case 2\n",
node->nodeid, dlm_state_str(node->state));
+ dlm_send_fin(node, dlm_act_fin_ack_rcv);
break;
case DLM_CLOSED:
/* we have what we want */
@@ -1337,12 +1326,8 @@ static void midcomms_shutdown(struct mid
}
spin_unlock(&node->state_lock);
- if (node->state == DLM_FIN_WAIT1) {
- dlm_send_fin(node, dlm_act_fin_ack_rcv);
-
- if (DLM_DEBUG_FENCE_TERMINATION)
- msleep(5000);
- }
+ if (DLM_DEBUG_FENCE_TERMINATION)
+ msleep(5000);
/* wait for other side dlm + fin */
ret = wait_event_timeout(node->shutdown_wait,
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 452/567] fs: dlm: send FIN ack back in right cases
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 451/567] fs: dlm: move sending fin message into state change handling Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 453/567] f2fs: fix information leak in f2fs_move_inline_dirents() Greg Kroah-Hartman
` (118 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Aring, David Teigland
From: Alexander Aring <aahringo@redhat.com>
commit 00908b3388255fc1d3782b744d07f327712f401f upstream.
This patch moves to send a ack back for receiving a FIN message only
when we are in valid states. In other cases and there might be a sender
waiting for a ack we just let it timeout at the senders time and
hopefully all other cleanups will remove the FIN message on their
sending queue. As an example we should never send out an ACK being in
LAST_ACK state or we cannot assume a working socket communication when
we are in CLOSED state.
Cc: stable@vger.kernel.org
Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect")
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dlm/midcomms.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/fs/dlm/midcomms.c
+++ b/fs/dlm/midcomms.c
@@ -366,7 +366,7 @@ static int dlm_send_ack(int nodeid, uint
struct dlm_msg *msg;
char *ppc;
- msg = dlm_lowcomms_new_msg(nodeid, mb_len, GFP_NOFS, &ppc,
+ msg = dlm_lowcomms_new_msg(nodeid, mb_len, GFP_ATOMIC, &ppc,
NULL, NULL);
if (!msg)
return -ENOMEM;
@@ -478,15 +478,14 @@ static void dlm_midcomms_receive_buffer(
switch (p->header.h_cmd) {
case DLM_FIN:
- /* send ack before fin */
- dlm_send_ack(node->nodeid, node->seq_next);
-
spin_lock(&node->state_lock);
pr_debug("receive fin msg from node %d with state %s\n",
node->nodeid, dlm_state_str(node->state));
switch (node->state) {
case DLM_ESTABLISHED:
+ dlm_send_ack(node->nodeid, node->seq_next);
+
node->state = DLM_CLOSE_WAIT;
pr_debug("switch node %d to state %s\n",
node->nodeid, dlm_state_str(node->state));
@@ -503,12 +502,14 @@ static void dlm_midcomms_receive_buffer(
}
break;
case DLM_FIN_WAIT1:
+ dlm_send_ack(node->nodeid, node->seq_next);
node->state = DLM_CLOSING;
set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags);
pr_debug("switch node %d to state %s\n",
node->nodeid, dlm_state_str(node->state));
break;
case DLM_FIN_WAIT2:
+ dlm_send_ack(node->nodeid, node->seq_next);
midcomms_node_reset(node);
pr_debug("switch node %d to state %s\n",
node->nodeid, dlm_state_str(node->state));
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 453/567] f2fs: fix information leak in f2fs_move_inline_dirents()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 452/567] fs: dlm: send FIN ack back in right cases Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 454/567] f2fs: fix cgroup writeback accounting with fs-layer encryption Greg Kroah-Hartman
` (117 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Chao Yu, Jaegeuk Kim
From: Eric Biggers <ebiggers@google.com>
commit 9a5571cff4ffcfc24847df9fd545cc5799ac0ee5 upstream.
When converting an inline directory to a regular one, f2fs is leaking
uninitialized memory to disk because it doesn't initialize the entire
directory block. Fix this by zero-initializing the block.
This bug was introduced by commit 4ec17d688d74 ("f2fs: avoid unneeded
initializing when converting inline dentry"), which didn't consider the
security implications of leaking uninitialized memory to disk.
This was found by running xfstest generic/435 on a KMSAN-enabled kernel.
Fixes: 4ec17d688d74 ("f2fs: avoid unneeded initializing when converting inline dentry")
Cc: <stable@vger.kernel.org> # v4.3+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/inline.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/fs/f2fs/inline.c
+++ b/fs/f2fs/inline.c
@@ -427,18 +427,17 @@ static int f2fs_move_inline_dirents(stru
dentry_blk = page_address(page);
+ /*
+ * Start by zeroing the full block, to ensure that all unused space is
+ * zeroed and no uninitialized memory is leaked to disk.
+ */
+ memset(dentry_blk, 0, F2FS_BLKSIZE);
+
make_dentry_ptr_inline(dir, &src, inline_dentry);
make_dentry_ptr_block(dir, &dst, dentry_blk);
/* copy data from inline dentry block to new dentry block */
memcpy(dst.bitmap, src.bitmap, src.nr_bitmap);
- memset(dst.bitmap + src.nr_bitmap, 0, dst.nr_bitmap - src.nr_bitmap);
- /*
- * we do not need to zero out remainder part of dentry and filename
- * field, since we have used bitmap for marking the usage status of
- * them, besides, we can also ignore copying/zeroing reserved space
- * of dentry block, because them haven't been used so far.
- */
memcpy(dst.dentry, src.dentry, SIZE_OF_DIR_ENTRY * src.max);
memcpy(dst.filename, src.filename, src.max * F2FS_SLOT_LEN);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 454/567] f2fs: fix cgroup writeback accounting with fs-layer encryption
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 453/567] f2fs: fix information leak in f2fs_move_inline_dirents() Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 455/567] ocfs2: fix defrag path triggering jbd2 ASSERT Greg Kroah-Hartman
` (116 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Wilcox (Oracle),
Eric Biggers, Tejun Heo, Chao Yu, Jaegeuk Kim
From: Eric Biggers <ebiggers@google.com>
commit 844545c51a5b2a524b22a2fe9d0b353b827d24b4 upstream.
When writing a page from an encrypted file that is using
filesystem-layer encryption (not inline encryption), f2fs encrypts the
pagecache page into a bounce page, then writes the bounce page.
It also passes the bounce page to wbc_account_cgroup_owner(). That's
incorrect, because the bounce page is a newly allocated temporary page
that doesn't have the memory cgroup of the original pagecache page.
This makes wbc_account_cgroup_owner() not account the I/O to the owner
of the pagecache page as it should.
Fix this by always passing the pagecache page to
wbc_account_cgroup_owner().
Fixes: 578c647879f7 ("f2fs: implement cgroup writeback support")
Cc: stable@vger.kernel.org
Reported-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -677,7 +677,7 @@ int f2fs_submit_page_bio(struct f2fs_io_
}
if (fio->io_wbc && !is_read_io(fio->op))
- wbc_account_cgroup_owner(fio->io_wbc, page, PAGE_SIZE);
+ wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE);
__attach_io_flag(fio);
bio_set_op_attrs(bio, fio->op, fio->op_flags);
@@ -887,7 +887,7 @@ alloc_new:
}
if (fio->io_wbc)
- wbc_account_cgroup_owner(fio->io_wbc, page, PAGE_SIZE);
+ wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE);
inc_page_count(fio->sbi, WB_DATA_TYPE(page));
@@ -961,7 +961,7 @@ alloc_new:
}
if (fio->io_wbc)
- wbc_account_cgroup_owner(fio->io_wbc, bio_page, PAGE_SIZE);
+ wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE);
io->last_block_in_bio = fio->new_blkaddr;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 455/567] ocfs2: fix defrag path triggering jbd2 ASSERT
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 454/567] f2fs: fix cgroup writeback accounting with fs-layer encryption Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 456/567] ocfs2: fix non-auto defrag path not working issue Greg Kroah-Hartman
` (115 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heming Zhao, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Gang He, Jun Piao,
Andrew Morton
From: Heming Zhao via Ocfs2-devel <ocfs2-devel@oss.oracle.com>
commit 60eed1e3d45045623e46944ebc7c42c30a4350f0 upstream.
code path:
ocfs2_ioctl_move_extents
ocfs2_move_extents
ocfs2_defrag_extent
__ocfs2_move_extent
+ ocfs2_journal_access_di
+ ocfs2_split_extent //sub-paths call jbd2_journal_restart
+ ocfs2_journal_dirty //crash by jbs2 ASSERT
crash stacks:
PID: 11297 TASK: ffff974a676dcd00 CPU: 67 COMMAND: "defragfs.ocfs2"
#0 [ffffb25d8dad3900] machine_kexec at ffffffff8386fe01
#1 [ffffb25d8dad3958] __crash_kexec at ffffffff8395959d
#2 [ffffb25d8dad3a20] crash_kexec at ffffffff8395a45d
#3 [ffffb25d8dad3a38] oops_end at ffffffff83836d3f
#4 [ffffb25d8dad3a58] do_trap at ffffffff83833205
#5 [ffffb25d8dad3aa0] do_invalid_op at ffffffff83833aa6
#6 [ffffb25d8dad3ac0] invalid_op at ffffffff84200d18
[exception RIP: jbd2_journal_dirty_metadata+0x2ba]
RIP: ffffffffc09ca54a RSP: ffffb25d8dad3b70 RFLAGS: 00010207
RAX: 0000000000000000 RBX: ffff9706eedc5248 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffff97337029ea28 RDI: ffff9706eedc5250
RBP: ffff9703c3520200 R8: 000000000f46b0b2 R9: 0000000000000000
R10: 0000000000000001 R11: 00000001000000fe R12: ffff97337029ea28
R13: 0000000000000000 R14: ffff9703de59bf60 R15: ffff9706eedc5250
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#7 [ffffb25d8dad3ba8] ocfs2_journal_dirty at ffffffffc137fb95 [ocfs2]
#8 [ffffb25d8dad3be8] __ocfs2_move_extent at ffffffffc139a950 [ocfs2]
#9 [ffffb25d8dad3c80] ocfs2_defrag_extent at ffffffffc139b2d2 [ocfs2]
Analysis
This bug has the same root cause of 'commit 7f27ec978b0e ("ocfs2: call
ocfs2_journal_access_di() before ocfs2_journal_dirty() in
ocfs2_write_end_nolock()")'. For this bug, jbd2_journal_restart() is
called by ocfs2_split_extent() during defragmenting.
How to fix
For ocfs2_split_extent() can handle journal operations totally by itself.
Caller doesn't need to call journal access/dirty pair, and caller only
needs to call journal start/stop pair. The fix method is to remove
journal access/dirty from __ocfs2_move_extent().
The discussion for this patch:
https://oss.oracle.com/pipermail/ocfs2-devel/2023-February/000647.html
Link: https://lkml.kernel.org/r/20230217003717.32469-1-heming.zhao@suse.com
Signed-off-by: Heming Zhao <heming.zhao@suse.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/move_extents.c | 10 ----------
1 file changed, 10 deletions(-)
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -105,14 +105,6 @@ static int __ocfs2_move_extent(handle_t
*/
replace_rec.e_flags = ext_flags & ~OCFS2_EXT_REFCOUNTED;
- ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode),
- context->et.et_root_bh,
- OCFS2_JOURNAL_ACCESS_WRITE);
- if (ret) {
- mlog_errno(ret);
- goto out;
- }
-
ret = ocfs2_split_extent(handle, &context->et, path, index,
&replace_rec, context->meta_ac,
&context->dealloc);
@@ -121,8 +113,6 @@ static int __ocfs2_move_extent(handle_t
goto out;
}
- ocfs2_journal_dirty(handle, context->et.et_root_bh);
-
context->new_phys_cpos = new_p_cpos;
/*
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 456/567] ocfs2: fix non-auto defrag path not working issue
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 455/567] ocfs2: fix defrag path triggering jbd2 ASSERT Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 457/567] selftests/landlock: Skip overlayfs tests when not supported Greg Kroah-Hartman
` (114 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heming Zhao, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Gang He, Jun Piao,
Andrew Morton
From: Heming Zhao via Ocfs2-devel <ocfs2-devel@oss.oracle.com>
commit 236b9254f8d1edc273ad88b420aa85fbd84f492d upstream.
This fixes three issues on move extents ioctl without auto defrag:
a) In ocfs2_find_victim_alloc_group(), we have to convert bits to block
first in case of global bitmap.
b) In ocfs2_probe_alloc_group(), when finding enough bits in block
group bitmap, we have to back off move_len to start pos as well,
otherwise it may corrupt filesystem.
c) In ocfs2_ioctl_move_extents(), set me_threshold both for non-auto
and auto defrag paths. Otherwise it will set move_max_hop to 0 and
finally cause unexpectedly ENOSPC error.
Currently there are no tools triggering the above issues since
defragfs.ocfs2 enables auto defrag by default. Tested with manually
changing defragfs.ocfs2 to run non auto defrag path.
Link: https://lkml.kernel.org/r/20230220050526.22020-1-heming.zhao@suse.com
Signed-off-by: Heming Zhao <heming.zhao@suse.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/move_extents.c | 24 +++++++++++++-----------
1 file changed, 13 insertions(+), 11 deletions(-)
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -434,7 +434,7 @@ static int ocfs2_find_victim_alloc_group
bg = (struct ocfs2_group_desc *)gd_bh->b_data;
if (vict_blkno < (le64_to_cpu(bg->bg_blkno) +
- le16_to_cpu(bg->bg_bits))) {
+ (le16_to_cpu(bg->bg_bits) << bits_per_unit))) {
*ret_bh = gd_bh;
*vict_bit = (vict_blkno - blkno) >>
@@ -549,6 +549,7 @@ static void ocfs2_probe_alloc_group(stru
last_free_bits++;
if (last_free_bits == move_len) {
+ i -= move_len;
*goal_bit = i;
*phys_cpos = base_cpos + i;
break;
@@ -1020,18 +1021,19 @@ int ocfs2_ioctl_move_extents(struct file
context->range = ⦥
+ /*
+ * ok, the default theshold for the defragmentation
+ * is 1M, since our maximum clustersize was 1M also.
+ * any thought?
+ */
+ if (!range.me_threshold)
+ range.me_threshold = 1024 * 1024;
+
+ if (range.me_threshold > i_size_read(inode))
+ range.me_threshold = i_size_read(inode);
+
if (range.me_flags & OCFS2_MOVE_EXT_FL_AUTO_DEFRAG) {
context->auto_defrag = 1;
- /*
- * ok, the default theshold for the defragmentation
- * is 1M, since our maximum clustersize was 1M also.
- * any thought?
- */
- if (!range.me_threshold)
- range.me_threshold = 1024 * 1024;
-
- if (range.me_threshold > i_size_read(inode))
- range.me_threshold = i_size_read(inode);
if (range.me_flags & OCFS2_MOVE_EXT_FL_PART_DEFRAG)
context->partial = 1;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 457/567] selftests/landlock: Skip overlayfs tests when not supported
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 456/567] ocfs2: fix non-auto defrag path not working issue Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 458/567] selftests/landlock: Test ptrace as much as possible with Yama Greg Kroah-Hartman
` (113 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff Xu, Guenter Roeck,
Mickaël Salaün
From: Jeff Xu <jeffxu@google.com>
commit 366617a69e60610912836570546f118006ebc7cb upstream.
overlayfs may be disabled in the kernel configuration, causing related
tests to fail. Check that overlayfs is supported at runtime, so we can
skip layout2_overlay.* accordingly.
Signed-off-by: Jeff Xu <jeffxu@google.com>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230113053229.1281774-2-jeffxu@google.com
[mic: Reword comments and constify variables]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/landlock/fs_test.c | 47 +++++++++++++++++++++++++++++
1 file changed, 47 insertions(+)
--- a/tools/testing/selftests/landlock/fs_test.c
+++ b/tools/testing/selftests/landlock/fs_test.c
@@ -11,6 +11,7 @@
#include <fcntl.h>
#include <linux/landlock.h>
#include <sched.h>
+#include <stdio.h>
#include <string.h>
#include <sys/capability.h>
#include <sys/mount.h>
@@ -87,6 +88,40 @@ static const char dir_s3d3[] = TMP_DIR "
* └── s3d3
*/
+static bool fgrep(FILE *const inf, const char *const str)
+{
+ char line[32];
+ const int slen = strlen(str);
+
+ while (!feof(inf)) {
+ if (!fgets(line, sizeof(line), inf))
+ break;
+ if (strncmp(line, str, slen))
+ continue;
+
+ return true;
+ }
+
+ return false;
+}
+
+static bool supports_overlayfs(void)
+{
+ bool res;
+ FILE *const inf = fopen("/proc/filesystems", "r");
+
+ /*
+ * Consider that the filesystem is supported if we cannot get the
+ * supported ones.
+ */
+ if (!inf)
+ return true;
+
+ res = fgrep(inf, "nodev\toverlay\n");
+ fclose(inf);
+ return res;
+}
+
static void mkdir_parents(struct __test_metadata *const _metadata,
const char *const path)
{
@@ -2650,6 +2685,9 @@ FIXTURE(layout2_overlay) {};
FIXTURE_SETUP(layout2_overlay)
{
+ if (!supports_overlayfs())
+ SKIP(return, "overlayfs is not supported");
+
prepare_layout(_metadata);
create_directory(_metadata, LOWER_BASE);
@@ -2686,6 +2724,9 @@ FIXTURE_SETUP(layout2_overlay)
FIXTURE_TEARDOWN(layout2_overlay)
{
+ if (!supports_overlayfs())
+ SKIP(return, "overlayfs is not supported");
+
EXPECT_EQ(0, remove_path(lower_do1_fl3));
EXPECT_EQ(0, remove_path(lower_dl1_fl2));
EXPECT_EQ(0, remove_path(lower_fl1));
@@ -2717,6 +2758,9 @@ FIXTURE_TEARDOWN(layout2_overlay)
TEST_F_FORK(layout2_overlay, no_restriction)
{
+ if (!supports_overlayfs())
+ SKIP(return, "overlayfs is not supported");
+
ASSERT_EQ(0, test_open(lower_fl1, O_RDONLY));
ASSERT_EQ(0, test_open(lower_dl1, O_RDONLY));
ASSERT_EQ(0, test_open(lower_dl1_fl2, O_RDONLY));
@@ -2880,6 +2924,9 @@ TEST_F_FORK(layout2_overlay, same_conten
size_t i;
const char *path_entry;
+ if (!supports_overlayfs())
+ SKIP(return, "overlayfs is not supported");
+
/* Sets rules on base directories (i.e. outside overlay scope). */
ruleset_fd = create_ruleset(_metadata, ACCESS_RW, layer1_base);
ASSERT_LE(0, ruleset_fd);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 458/567] selftests/landlock: Test ptrace as much as possible with Yama
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 457/567] selftests/landlock: Skip overlayfs tests when not supported Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 459/567] udf: Truncate added extents on failed expansion Greg Kroah-Hartman
` (112 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Xu, Mickaël Salaün
From: Jeff Xu <jeffxu@google.com>
commit 8677e555f17f51321d0730b945aeb7d4b95f998f upstream.
Update ptrace tests according to all potential Yama security policies.
This is required to make such tests pass even if Yama is enabled.
Tests are not skipped but they now check both Landlock and Yama boundary
restrictions at run time to keep a maximum test coverage (i.e. positive
and negative testing).
Signed-off-by: Jeff Xu <jeffxu@google.com>
Link: https://lore.kernel.org/r/20230114020306.1407195-2-jeffxu@google.com
Cc: stable@vger.kernel.org
[mic: Add curly braces around EXPECT_EQ() to make it build, and improve
commit message]
Co-developed-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/landlock/ptrace_test.c | 113 +++++++++++++++++++++----
1 file changed, 96 insertions(+), 17 deletions(-)
--- a/tools/testing/selftests/landlock/ptrace_test.c
+++ b/tools/testing/selftests/landlock/ptrace_test.c
@@ -19,6 +19,12 @@
#include "common.h"
+/* Copied from security/yama/yama_lsm.c */
+#define YAMA_SCOPE_DISABLED 0
+#define YAMA_SCOPE_RELATIONAL 1
+#define YAMA_SCOPE_CAPABILITY 2
+#define YAMA_SCOPE_NO_ATTACH 3
+
static void create_domain(struct __test_metadata *const _metadata)
{
int ruleset_fd;
@@ -60,6 +66,25 @@ static int test_ptrace_read(const pid_t
return 0;
}
+static int get_yama_ptrace_scope(void)
+{
+ int ret;
+ char buf[2] = {};
+ const int fd = open("/proc/sys/kernel/yama/ptrace_scope", O_RDONLY);
+
+ if (fd < 0)
+ return 0;
+
+ if (read(fd, buf, 1) < 0) {
+ close(fd);
+ return -1;
+ }
+
+ ret = atoi(buf);
+ close(fd);
+ return ret;
+}
+
/* clang-format off */
FIXTURE(hierarchy) {};
/* clang-format on */
@@ -232,8 +257,51 @@ TEST_F(hierarchy, trace)
pid_t child, parent;
int status, err_proc_read;
int pipe_child[2], pipe_parent[2];
+ int yama_ptrace_scope;
char buf_parent;
long ret;
+ bool can_read_child, can_trace_child, can_read_parent, can_trace_parent;
+
+ yama_ptrace_scope = get_yama_ptrace_scope();
+ ASSERT_LE(0, yama_ptrace_scope);
+
+ if (yama_ptrace_scope > YAMA_SCOPE_DISABLED)
+ TH_LOG("Incomplete tests due to Yama restrictions (scope %d)",
+ yama_ptrace_scope);
+
+ /*
+ * can_read_child is true if a parent process can read its child
+ * process, which is only the case when the parent process is not
+ * isolated from the child with a dedicated Landlock domain.
+ */
+ can_read_child = !variant->domain_parent;
+
+ /*
+ * can_trace_child is true if a parent process can trace its child
+ * process. This depends on two conditions:
+ * - The parent process is not isolated from the child with a dedicated
+ * Landlock domain.
+ * - Yama allows tracing children (up to YAMA_SCOPE_RELATIONAL).
+ */
+ can_trace_child = can_read_child &&
+ yama_ptrace_scope <= YAMA_SCOPE_RELATIONAL;
+
+ /*
+ * can_read_parent is true if a child process can read its parent
+ * process, which is only the case when the child process is not
+ * isolated from the parent with a dedicated Landlock domain.
+ */
+ can_read_parent = !variant->domain_child;
+
+ /*
+ * can_trace_parent is true if a child process can trace its parent
+ * process. This depends on two conditions:
+ * - The child process is not isolated from the parent with a dedicated
+ * Landlock domain.
+ * - Yama is disabled (YAMA_SCOPE_DISABLED).
+ */
+ can_trace_parent = can_read_parent &&
+ yama_ptrace_scope <= YAMA_SCOPE_DISABLED;
/*
* Removes all effective and permitted capabilities to not interfere
@@ -264,16 +332,21 @@ TEST_F(hierarchy, trace)
/* Waits for the parent to be in a domain, if any. */
ASSERT_EQ(1, read(pipe_parent[0], &buf_child, 1));
- /* Tests PTRACE_ATTACH and PTRACE_MODE_READ on the parent. */
+ /* Tests PTRACE_MODE_READ on the parent. */
err_proc_read = test_ptrace_read(parent);
+ if (can_read_parent) {
+ EXPECT_EQ(0, err_proc_read);
+ } else {
+ EXPECT_EQ(EACCES, err_proc_read);
+ }
+
+ /* Tests PTRACE_ATTACH on the parent. */
ret = ptrace(PTRACE_ATTACH, parent, NULL, 0);
- if (variant->domain_child) {
+ if (can_trace_parent) {
+ EXPECT_EQ(0, ret);
+ } else {
EXPECT_EQ(-1, ret);
EXPECT_EQ(EPERM, errno);
- EXPECT_EQ(EACCES, err_proc_read);
- } else {
- EXPECT_EQ(0, ret);
- EXPECT_EQ(0, err_proc_read);
}
if (ret == 0) {
ASSERT_EQ(parent, waitpid(parent, &status, 0));
@@ -283,11 +356,11 @@ TEST_F(hierarchy, trace)
/* Tests child PTRACE_TRACEME. */
ret = ptrace(PTRACE_TRACEME);
- if (variant->domain_parent) {
+ if (can_trace_child) {
+ EXPECT_EQ(0, ret);
+ } else {
EXPECT_EQ(-1, ret);
EXPECT_EQ(EPERM, errno);
- } else {
- EXPECT_EQ(0, ret);
}
/*
@@ -296,7 +369,7 @@ TEST_F(hierarchy, trace)
*/
ASSERT_EQ(1, write(pipe_child[1], ".", 1));
- if (!variant->domain_parent) {
+ if (can_trace_child) {
ASSERT_EQ(0, raise(SIGSTOP));
}
@@ -321,7 +394,7 @@ TEST_F(hierarchy, trace)
ASSERT_EQ(1, read(pipe_child[0], &buf_parent, 1));
/* Tests child PTRACE_TRACEME. */
- if (!variant->domain_parent) {
+ if (can_trace_child) {
ASSERT_EQ(child, waitpid(child, &status, 0));
ASSERT_EQ(1, WIFSTOPPED(status));
ASSERT_EQ(0, ptrace(PTRACE_DETACH, child, NULL, 0));
@@ -331,17 +404,23 @@ TEST_F(hierarchy, trace)
EXPECT_EQ(ESRCH, errno);
}
- /* Tests PTRACE_ATTACH and PTRACE_MODE_READ on the child. */
+ /* Tests PTRACE_MODE_READ on the child. */
err_proc_read = test_ptrace_read(child);
+ if (can_read_child) {
+ EXPECT_EQ(0, err_proc_read);
+ } else {
+ EXPECT_EQ(EACCES, err_proc_read);
+ }
+
+ /* Tests PTRACE_ATTACH on the child. */
ret = ptrace(PTRACE_ATTACH, child, NULL, 0);
- if (variant->domain_parent) {
+ if (can_trace_child) {
+ EXPECT_EQ(0, ret);
+ } else {
EXPECT_EQ(-1, ret);
EXPECT_EQ(EPERM, errno);
- EXPECT_EQ(EACCES, err_proc_read);
- } else {
- EXPECT_EQ(0, ret);
- EXPECT_EQ(0, err_proc_read);
}
+
if (ret == 0) {
ASSERT_EQ(child, waitpid(child, &status, 0));
ASSERT_EQ(1, WIFSTOPPED(status));
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 459/567] udf: Truncate added extents on failed expansion
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 458/567] selftests/landlock: Test ptrace as much as possible with Yama Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 460/567] udf: Do not bother merging very long extents Greg Kroah-Hartman
` (111 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara
From: Jan Kara <jack@suse.cz>
commit 70bfb3a8d661d4fdc742afc061b88a7f3fc9f500 upstream.
When a file expansion failed because we didn't have enough space for
indirect extents make sure we truncate extents created so far so that we
don't leave extents beyond EOF.
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -525,8 +525,10 @@ static int udf_do_extend_file(struct ino
}
if (fake) {
- udf_add_aext(inode, last_pos, &last_ext->extLocation,
- last_ext->extLength, 1);
+ err = udf_add_aext(inode, last_pos, &last_ext->extLocation,
+ last_ext->extLength, 1);
+ if (err < 0)
+ goto out_err;
count++;
} else {
struct kernel_lb_addr tmploc;
@@ -560,7 +562,7 @@ static int udf_do_extend_file(struct ino
err = udf_add_aext(inode, last_pos, &last_ext->extLocation,
last_ext->extLength, 1);
if (err)
- return err;
+ goto out_err;
count++;
}
if (new_block_bytes) {
@@ -569,7 +571,7 @@ static int udf_do_extend_file(struct ino
err = udf_add_aext(inode, last_pos, &last_ext->extLocation,
last_ext->extLength, 1);
if (err)
- return err;
+ goto out_err;
count++;
}
@@ -583,6 +585,11 @@ out:
return -EIO;
return count;
+out_err:
+ /* Remove extents we've created so far */
+ udf_clear_extent_cache(inode);
+ udf_truncate_extents(inode);
+ return err;
}
/* Extend the final block of the file to final_block_len bytes */
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 460/567] udf: Do not bother merging very long extents
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 459/567] udf: Truncate added extents on failed expansion Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 461/567] udf: Do not update file length for failed writes to inline files Greg Kroah-Hartman
` (110 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot+60f291a24acecb3c2bd5, Jan Kara
From: Jan Kara <jack@suse.cz>
commit 53cafe1d6d8ef9f93318e5bfccc0d24f27d41ced upstream.
When merging very long extents we try to push as much length as possible
to the first extent. However this is unnecessarily complicated and not
really worth the trouble. Furthermore there was a bug in the logic
resulting in corrupting extents in the file as syzbot reproducer shows.
So just don't bother with the merging of extents that are too long
together.
CC: stable@vger.kernel.org
Reported-by: syzbot+60f291a24acecb3c2bd5@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 19 ++-----------------
1 file changed, 2 insertions(+), 17 deletions(-)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1093,23 +1093,8 @@ static void udf_merge_extents(struct ino
blocksize - 1) >> blocksize_bits)))) {
if (((li->extLength & UDF_EXTENT_LENGTH_MASK) +
- (lip1->extLength & UDF_EXTENT_LENGTH_MASK) +
- blocksize - 1) & ~UDF_EXTENT_LENGTH_MASK) {
- lip1->extLength = (lip1->extLength -
- (li->extLength &
- UDF_EXTENT_LENGTH_MASK) +
- UDF_EXTENT_LENGTH_MASK) &
- ~(blocksize - 1);
- li->extLength = (li->extLength &
- UDF_EXTENT_FLAG_MASK) +
- (UDF_EXTENT_LENGTH_MASK + 1) -
- blocksize;
- lip1->extLocation.logicalBlockNum =
- li->extLocation.logicalBlockNum +
- ((li->extLength &
- UDF_EXTENT_LENGTH_MASK) >>
- blocksize_bits);
- } else {
+ (lip1->extLength & UDF_EXTENT_LENGTH_MASK) +
+ blocksize - 1) <= UDF_EXTENT_LENGTH_MASK) {
li->extLength = lip1->extLength +
(((li->extLength &
UDF_EXTENT_LENGTH_MASK) +
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 461/567] udf: Do not update file length for failed writes to inline files
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 460/567] udf: Do not bother merging very long extents Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 462/567] udf: Preserve link count of system files Greg Kroah-Hartman
` (109 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot+0937935b993956ba28ab, Jan Kara
From: Jan Kara <jack@suse.cz>
commit 256fe4162f8b5a1625b8603ca5f7ff79725bfb47 upstream.
When write to inline file fails (or happens only partly), we still
updated length of inline data as if the whole write succeeded. Fix the
update of length of inline data to happen only if the write succeeds.
Reported-by: syzbot+0937935b993956ba28ab@syzkaller.appspotmail.com
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/file.c | 26 ++++++++++++--------------
1 file changed, 12 insertions(+), 14 deletions(-)
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -148,26 +148,24 @@ static ssize_t udf_file_write_iter(struc
goto out;
down_write(&iinfo->i_data_sem);
- if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
- loff_t end = iocb->ki_pos + iov_iter_count(from);
-
- if (inode->i_sb->s_blocksize <
- (udf_file_entry_alloc_offset(inode) + end)) {
- err = udf_expand_file_adinicb(inode);
- if (err) {
- inode_unlock(inode);
- udf_debug("udf_expand_adinicb: err=%d\n", err);
- return err;
- }
- } else {
- iinfo->i_lenAlloc = max(end, inode->i_size);
- up_write(&iinfo->i_data_sem);
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB &&
+ inode->i_sb->s_blocksize < (udf_file_entry_alloc_offset(inode) +
+ iocb->ki_pos + iov_iter_count(from))) {
+ err = udf_expand_file_adinicb(inode);
+ if (err) {
+ inode_unlock(inode);
+ udf_debug("udf_expand_adinicb: err=%d\n", err);
+ return err;
}
} else
up_write(&iinfo->i_data_sem);
retval = __generic_file_write_iter(iocb, from);
out:
+ down_write(&iinfo->i_data_sem);
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB && retval > 0)
+ iinfo->i_lenAlloc = inode->i_size;
+ up_write(&iinfo->i_data_sem);
inode_unlock(inode);
if (retval > 0) {
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 462/567] udf: Preserve link count of system files
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 461/567] udf: Do not update file length for failed writes to inline files Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 463/567] udf: Detect system inodes linked into directory hierarchy Greg Kroah-Hartman
` (108 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara
From: Jan Kara <jack@suse.cz>
commit fc8033a34a3ca7d23353e645e6dde5d364ac5f12 upstream.
System files in UDF filesystem have link count 0. To not confuse VFS we
fudge the link count to be 1 when reading such inodes however we forget
to restore the link count of 0 when writing such inodes. Fix that.
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 9 +++++++--
fs/udf/super.c | 1 +
fs/udf/udf_i.h | 3 ++-
3 files changed, 10 insertions(+), 3 deletions(-)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1385,6 +1385,7 @@ reread:
ret = -EIO;
goto out;
}
+ iinfo->i_hidden = hidden_inode;
iinfo->i_unique = 0;
iinfo->i_lenEAttr = 0;
iinfo->i_lenExtents = 0;
@@ -1720,8 +1721,12 @@ static int udf_update_inode(struct inode
if (S_ISDIR(inode->i_mode) && inode->i_nlink > 0)
fe->fileLinkCount = cpu_to_le16(inode->i_nlink - 1);
- else
- fe->fileLinkCount = cpu_to_le16(inode->i_nlink);
+ else {
+ if (iinfo->i_hidden)
+ fe->fileLinkCount = cpu_to_le16(0);
+ else
+ fe->fileLinkCount = cpu_to_le16(inode->i_nlink);
+ }
fe->informationLength = cpu_to_le64(inode->i_size);
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -147,6 +147,7 @@ static struct inode *udf_alloc_inode(str
ei->i_next_alloc_goal = 0;
ei->i_strat4096 = 0;
ei->i_streamdir = 0;
+ ei->i_hidden = 0;
init_rwsem(&ei->i_data_sem);
ei->cached_extent.lstart = -1;
spin_lock_init(&ei->i_extent_cache_lock);
--- a/fs/udf/udf_i.h
+++ b/fs/udf/udf_i.h
@@ -44,7 +44,8 @@ struct udf_inode_info {
unsigned i_use : 1; /* unallocSpaceEntry */
unsigned i_strat4096 : 1;
unsigned i_streamdir : 1;
- unsigned reserved : 25;
+ unsigned i_hidden : 1; /* hidden system inode */
+ unsigned reserved : 24;
__u8 *i_data;
struct kernel_lb_addr i_locStreamdir;
__u64 i_lenStreams;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 463/567] udf: Detect system inodes linked into directory hierarchy
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 462/567] udf: Preserve link count of system files Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 464/567] udf: Fix file corruption when appending just after end of preallocated extent Greg Kroah-Hartman
` (107 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot+38695a20b8addcbc1084, Jan Kara
From: Jan Kara <jack@suse.cz>
commit 85a37983ec69cc9fcd188bc37c4de15ee326355a upstream.
When UDF filesystem is corrupted, hidden system inodes can be linked
into directory hierarchy which is an avenue for further serious
corruption of the filesystem and kernel confusion as noticed by syzbot
fuzzed images. Refuse to access system inodes linked into directory
hierarchy and vice versa.
CC: stable@vger.kernel.org
Reported-by: syzbot+38695a20b8addcbc1084@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1897,8 +1897,13 @@ struct inode *__udf_iget(struct super_bl
if (!inode)
return ERR_PTR(-ENOMEM);
- if (!(inode->i_state & I_NEW))
+ if (!(inode->i_state & I_NEW)) {
+ if (UDF_I(inode)->i_hidden != hidden_inode) {
+ iput(inode);
+ return ERR_PTR(-EFSCORRUPTED);
+ }
return inode;
+ }
memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr));
err = udf_read_inode(inode, hidden_inode);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 464/567] udf: Fix file corruption when appending just after end of preallocated extent
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 463/567] udf: Detect system inodes linked into directory hierarchy Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 465/567] RDMA/siw: Fix user page pinning accounting Greg Kroah-Hartman
` (106 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara
From: Jan Kara <jack@suse.cz>
commit 36ec52ea038b18a53e198116ef7d7e70c87db046 upstream.
When we append new block just after the end of preallocated extent, the
code in inode_getblk() wrongly determined we're going to use the
preallocated extent which resulted in adding block into a wrong logical
offset in the file. Sequence like this manifests it:
xfs_io -f -c "pwrite 0x2cacf 0xd122" -c "truncate 0x2dd6f" \
-c "pwrite 0x27fd9 0x69a9" -c "pwrite 0x32981 0x7244" <file>
The code that determined the use of preallocated extent is actually
stale because udf_do_extend_file() does not create preallocation anymore
so after calling that function we are sure there's no usable
preallocation. Just remove the faulty condition.
CC: stable@vger.kernel.org
Fixes: 16d055656814 ("udf: Discard preallocation before extending file with a hole")
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 24 +++++++++++-------------
1 file changed, 11 insertions(+), 13 deletions(-)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -804,19 +804,17 @@ static sector_t inode_getblk(struct inod
c = 0;
offset = 0;
count += ret;
- /* We are not covered by a preallocated extent? */
- if ((laarr[0].extLength & UDF_EXTENT_FLAG_MASK) !=
- EXT_NOT_RECORDED_ALLOCATED) {
- /* Is there any real extent? - otherwise we overwrite
- * the fake one... */
- if (count)
- c = !c;
- laarr[c].extLength = EXT_NOT_RECORDED_NOT_ALLOCATED |
- inode->i_sb->s_blocksize;
- memset(&laarr[c].extLocation, 0x00,
- sizeof(struct kernel_lb_addr));
- count++;
- }
+ /*
+ * Is there any real extent? - otherwise we overwrite the fake
+ * one...
+ */
+ if (count)
+ c = !c;
+ laarr[c].extLength = EXT_NOT_RECORDED_NOT_ALLOCATED |
+ inode->i_sb->s_blocksize;
+ memset(&laarr[c].extLocation, 0x00,
+ sizeof(struct kernel_lb_addr));
+ count++;
endnum = c + 1;
lastblock = 1;
} else {
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 465/567] RDMA/siw: Fix user page pinning accounting
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 464/567] udf: Fix file corruption when appending just after end of preallocated extent Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 466/567] KVM: Destroy target device if coalesced MMIO unregistration fails Greg Kroah-Hartman
` (105 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Alistair Popple,
Bernard Metzler, Leon Romanovsky, Sasha Levin
From: Bernard Metzler <bmt@zurich.ibm.com>
[ Upstream commit 65a8fc30fb6722fc25adec6d7dd5b53b0bb85820 ]
To avoid racing with other user memory reservations, immediately
account full amount of pages to be pinned.
Fixes: 2251334dcac9 ("rdma/siw: application buffer management")
Reported-by: Jason Gunthorpe <jgg@nvidia.com>
Suggested-by: Alistair Popple <apopple@nvidia.com>
Reviewed-by: Alistair Popple <apopple@nvidia.com>
Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
Link: https://lore.kernel.org/r/20230202101000.402990-1-bmt@zurich.ibm.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/siw/siw_mem.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c
index 61c17db70d658..bf69566e2eb63 100644
--- a/drivers/infiniband/sw/siw/siw_mem.c
+++ b/drivers/infiniband/sw/siw/siw_mem.c
@@ -398,7 +398,7 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable)
mlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
- if (num_pages + atomic64_read(&mm_s->pinned_vm) > mlock_limit) {
+ if (atomic64_add_return(num_pages, &mm_s->pinned_vm) > mlock_limit) {
rv = -ENOMEM;
goto out_sem_up;
}
@@ -411,18 +411,16 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable)
goto out_sem_up;
}
for (i = 0; num_pages; i++) {
- int got, nents = min_t(int, num_pages, PAGES_PER_CHUNK);
-
- umem->page_chunk[i].plist =
+ int nents = min_t(int, num_pages, PAGES_PER_CHUNK);
+ struct page **plist =
kcalloc(nents, sizeof(struct page *), GFP_KERNEL);
- if (!umem->page_chunk[i].plist) {
+
+ if (!plist) {
rv = -ENOMEM;
goto out_sem_up;
}
- got = 0;
+ umem->page_chunk[i].plist = plist;
while (nents) {
- struct page **plist = &umem->page_chunk[i].plist[got];
-
rv = pin_user_pages(first_page_va, nents,
foll_flags | FOLL_LONGTERM,
plist, NULL);
@@ -430,12 +428,11 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable)
goto out_sem_up;
umem->num_pages += rv;
- atomic64_add(rv, &mm_s->pinned_vm);
first_page_va += rv * PAGE_SIZE;
+ plist += rv;
nents -= rv;
- got += rv;
+ num_pages -= rv;
}
- num_pages -= got;
}
out_sem_up:
mmap_read_unlock(mm_s);
@@ -443,6 +440,10 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable)
if (rv > 0)
return umem;
+ /* Adjust accounting for pages not pinned */
+ if (num_pages)
+ atomic64_sub(num_pages, &mm_s->pinned_vm);
+
siw_umem_release(umem, false);
return ERR_PTR(rv);
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 466/567] KVM: Destroy target device if coalesced MMIO unregistration fails
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 465/567] RDMA/siw: Fix user page pinning accounting Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 467/567] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI Greg Kroah-Hartman
` (104 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, 柳菁峰,
Michal Luczaj, Sean Christopherson
From: Sean Christopherson <seanjc@google.com>
commit b1cb1fac22abf102ffeb29dd3eeca208a3869d54 upstream.
Destroy and free the target coalesced MMIO device if unregistering said
device fails. As clearly noted in the code, kvm_io_bus_unregister_dev()
does not destroy the target device.
BUG: memory leak
unreferenced object 0xffff888112a54880 (size 64):
comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s)
hex dump (first 32 bytes):
38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g.....
e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g.....
backtrace:
[<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline]
[<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline]
[<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150
[<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323
[<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline]
[<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline]
[<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696
[<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713
[<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline]
[<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline]
[<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
[<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290
[<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
BUG: leak checking failed
Fixes: 5d3c4c79384a ("KVM: Stop looking for coalesced MMIO zones if the bus is destroyed")
Cc: stable@vger.kernel.org
Reported-by: 柳菁峰 <liujingfeng@qianxin.com>
Reported-by: Michal Luczaj <mhal@rbox.co>
Link: https://lore.kernel.org/r/20221219171924.67989-1-seanjc@google.com
Link: https://lore.kernel.org/all/20230118220003.1239032-1-mhal@rbox.co
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/coalesced_mmio.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/virt/kvm/coalesced_mmio.c
+++ b/virt/kvm/coalesced_mmio.c
@@ -187,15 +187,17 @@ int kvm_vm_ioctl_unregister_coalesced_mm
r = kvm_io_bus_unregister_dev(kvm,
zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev);
+ kvm_iodevice_destructor(&dev->dev);
+
/*
* On failure, unregister destroys all devices on the
* bus _except_ the target device, i.e. coalesced_zones
- * has been modified. No need to restart the walk as
- * there aren't any zones left.
+ * has been modified. Bail after destroying the target
+ * device, there's no need to restart the walk as there
+ * aren't any zones left.
*/
if (r)
break;
- kvm_iodevice_destructor(&dev->dev);
}
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 467/567] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 466/567] KVM: Destroy target device if coalesced MMIO unregistration fails Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 468/567] KVM: SVM: Fix potential overflow in SEVs send|receive_update_data() Greg Kroah-Hartman
` (103 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Orr, Ben Gardon,
Venkatesh Srinivas, Maxim Levitsky, Sean Christopherson
From: Sean Christopherson <seanjc@google.com>
commit ba5838abb05334e4abfdff1490585c7f365e0424 upstream.
Inject a #GP if the guest attempts to set reserved bits in the x2APIC-only
Self-IPI register. Bits 7:0 hold the vector, all other bits are reserved.
Reported-by: Marc Orr <marcorr@google.com>
Cc: Ben Gardon <bgardon@google.com>
Cc: Venkatesh Srinivas <venkateshs@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Link: https://lore.kernel.org/r/20230107011025.565472-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/lapic.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2127,10 +2127,14 @@ int kvm_lapic_reg_write(struct kvm_lapic
break;
case APIC_SELF_IPI:
- if (apic_x2apic_mode(apic))
- kvm_apic_send_ipi(apic, APIC_DEST_SELF | (val & APIC_VECTOR_MASK), 0);
- else
+ /*
+ * Self-IPI exists only when x2APIC is enabled. Bits 7:0 hold
+ * the vector, everything else is reserved.
+ */
+ if (!apic_x2apic_mode(apic) || (val & ~APIC_VECTOR_MASK))
ret = 1;
+ else
+ kvm_apic_send_ipi(apic, APIC_DEST_SELF | val, 0);
break;
default:
ret = 1;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 468/567] KVM: SVM: Fix potential overflow in SEVs send|receive_update_data()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 467/567] KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 469/567] KVM: SVM: hyper-v: placate modpost section mismatch error Greg Kroah-Hartman
` (102 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Nguyen, Thomas Lendacky,
Peter Gonda, David Rientjes, Paolo Bonzini, Sean Christopherson,
kvm, linux-kernel
From: Peter Gonda <pgonda@google.com>
commit f94f053aa3a5d6ff17951870483d9eb9e13de2e2 upstream.
KVM_SEV_SEND_UPDATE_DATA and KVM_SEV_RECEIVE_UPDATE_DATA have an integer
overflow issue. Params.guest_len and offset are both 32 bits wide, with a
large params.guest_len the check to confirm a page boundary is not
crossed can falsely pass:
/* Check if we are crossing the page boundary *
offset = params.guest_uaddr & (PAGE_SIZE - 1);
if ((params.guest_len + offset > PAGE_SIZE))
Add an additional check to confirm that params.guest_len itself is not
greater than PAGE_SIZE.
Note, this isn't a security concern as overflow can happen if and only if
params.guest_len is greater than 0xfffff000, and the FW spec says these
commands fail with lengths greater than 16KB, i.e. the PSP will detect
KVM's goof.
Fixes: 15fb7de1a7f5 ("KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command")
Fixes: d3d1af85e2c7 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command")
Reported-by: Andy Nguyen <theflow@google.com>
Suggested-by: Thomas Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Peter Gonda <pgonda@google.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: kvm@vger.kernel.org
Cc: stable@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20230207171354.4012821-1-pgonda@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm/sev.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -1277,7 +1277,7 @@ static int sev_send_update_data(struct k
/* Check if we are crossing the page boundary */
offset = params.guest_uaddr & (PAGE_SIZE - 1);
- if ((params.guest_len + offset > PAGE_SIZE))
+ if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE)
return -EINVAL;
/* Pin guest memory */
@@ -1457,7 +1457,7 @@ static int sev_receive_update_data(struc
/* Check if we are crossing the page boundary */
offset = params.guest_uaddr & (PAGE_SIZE - 1);
- if ((params.guest_len + offset > PAGE_SIZE))
+ if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE)
return -EINVAL;
hdr = psp_copy_user_blob(params.hdr_uaddr, params.hdr_len);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 469/567] KVM: SVM: hyper-v: placate modpost section mismatch error
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 468/567] KVM: SVM: Fix potential overflow in SEVs send|receive_update_data() Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 470/567] KVM: s390: disable migration mode when dirty tracking is disabled Greg Kroah-Hartman
` (101 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Vineeth Pillai,
Paolo Bonzini, kvm, Sean Christopherson, Vitaly Kuznetsov
From: Randy Dunlap <rdunlap@infradead.org>
commit 45dd9bc75d9adc9483f0c7d662ba6e73ed698a0b upstream.
modpost reports section mismatch errors/warnings:
WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data)
WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data)
WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data)
This "(unknown) (section: .init.data)" all refer to svm_x86_ops.
Tag svm_hv_hardware_setup() with __init to fix a modpost warning as the
non-stub implementation accesses __initdata (svm_x86_ops), i.e. would
generate a use-after-free if svm_hv_hardware_setup() were actually invoked
post-init. The helper is only called from svm_hardware_setup(), which is
also __init, i.e. lack of __init is benign other than the modpost warning.
Fixes: 1e0c7d40758b ("KVM: SVM: hyper-v: Remote TLB flush for SVM")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Vineeth Pillai <viremana@linux.microsoft.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: kvm@vger.kernel.org
Cc: stable@vger.kernel.org
Reviewed-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20230222073315.9081-1-rdunlap@infradead.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/svm/svm_onhyperv.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/svm/svm_onhyperv.h
+++ b/arch/x86/kvm/svm/svm_onhyperv.h
@@ -48,7 +48,7 @@ static inline void svm_hv_init_vmcb(stru
hve->hv_enlightenments_control.enlightened_npt_tlb = 1;
}
-static inline void svm_hv_hardware_setup(void)
+static inline __init void svm_hv_hardware_setup(void)
{
if (npt_enabled &&
ms_hyperv.nested_features & HV_X64_NESTED_ENLIGHTENED_TLB) {
@@ -112,7 +112,7 @@ static inline void svm_hv_init_vmcb(stru
{
}
-static inline void svm_hv_hardware_setup(void)
+static inline __init void svm_hv_hardware_setup(void)
{
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 470/567] KVM: s390: disable migration mode when dirty tracking is disabled
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 469/567] KVM: SVM: hyper-v: placate modpost section mismatch error Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 471/567] x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) Greg Kroah-Hartman
` (100 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nico Boehr, Janosch Frank, Claudio Imbrenda
From: Nico Boehr <nrb@linux.ibm.com>
commit f2d3155e2a6bac44d16f04415a321e8707d895c6 upstream.
Migration mode is a VM attribute which enables tracking of changes in
storage attributes (PGSTE). It assumes dirty tracking is enabled on all
memslots to keep a dirty bitmap of pages with changed storage attributes.
When enabling migration mode, we currently check that dirty tracking is
enabled for all memslots. However, userspace can disable dirty tracking
without disabling migration mode.
Since migration mode is pointless with dirty tracking disabled, disable
migration mode whenever userspace disables dirty tracking on any slot.
Also update the documentation to clarify that dirty tracking must be
enabled when enabling migration mode, which is already enforced by the
code in kvm_s390_vm_start_migration().
Also highlight in the documentation for KVM_S390_GET_CMMA_BITS that it
can now fail with -EINVAL when dirty tracking is disabled while
migration mode is on. Move all the error codes to a table so this stays
readable.
To disable migration mode, slots_lock should be held, which is taken
in kvm_set_memory_region() and thus held in
kvm_arch_prepare_memory_region().
Restructure the prepare code a bit so all the sanity checking is done
before disabling migration mode. This ensures migration mode isn't
disabled when some sanity check fails.
Cc: stable@vger.kernel.org
Fixes: 190df4a212a7 ("KVM: s390: CMMA tracking, ESSA emulation, migration mode")
Signed-off-by: Nico Boehr <nrb@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Link: https://lore.kernel.org/r/20230127140532.230651-2-nrb@linux.ibm.com
Message-Id: <20230127140532.230651-2-nrb@linux.ibm.com>
[frankja@linux.ibm.com: fixed commit message typo, moved api.rst error table upwards]
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/virt/kvm/api.rst | 18 ++++++++++++------
Documentation/virt/kvm/devices/vm.rst | 4 ++++
arch/s390/kvm/kvm-s390.c | 17 +++++++++++++++++
3 files changed, 33 insertions(+), 6 deletions(-)
--- a/Documentation/virt/kvm/api.rst
+++ b/Documentation/virt/kvm/api.rst
@@ -4117,6 +4117,18 @@ not holding a previously reported uncorr
:Parameters: struct kvm_s390_cmma_log (in, out)
:Returns: 0 on success, a negative value on error
+Errors:
+
+ ====== =============================================================
+ ENOMEM not enough memory can be allocated to complete the task
+ ENXIO if CMMA is not enabled
+ EINVAL if KVM_S390_CMMA_PEEK is not set but migration mode was not enabled
+ EINVAL if KVM_S390_CMMA_PEEK is not set but dirty tracking has been
+ disabled (and thus migration mode was automatically disabled)
+ EFAULT if the userspace address is invalid or if no page table is
+ present for the addresses (e.g. when using hugepages).
+ ====== =============================================================
+
This ioctl is used to get the values of the CMMA bits on the s390
architecture. It is meant to be used in two scenarios:
@@ -4197,12 +4209,6 @@ mask is unused.
values points to the userspace buffer where the result will be stored.
-This ioctl can fail with -ENOMEM if not enough memory can be allocated to
-complete the task, with -ENXIO if CMMA is not enabled, with -EINVAL if
-KVM_S390_CMMA_PEEK is not set but migration mode was not enabled, with
--EFAULT if the userspace address is invalid or if no page table is
-present for the addresses (e.g. when using hugepages).
-
4.108 KVM_S390_SET_CMMA_BITS
----------------------------
--- a/Documentation/virt/kvm/devices/vm.rst
+++ b/Documentation/virt/kvm/devices/vm.rst
@@ -302,6 +302,10 @@ Allows userspace to start migration mode
Setting this attribute when migration mode is already active will have
no effects.
+Dirty tracking must be enabled on all memslots, else -EINVAL is returned. When
+dirty tracking is disabled on any memslot, migration mode is automatically
+stopped.
+
:Parameters: none
:Returns: -ENOMEM if there is not enough free memory to start migration mode;
-EINVAL if the state of the VM is invalid (e.g. no memory defined);
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -5066,6 +5066,23 @@ int kvm_arch_prepare_memory_region(struc
/* When we are protected, we should not change the memory slots */
if (kvm_s390_pv_get_handle(kvm))
return -EINVAL;
+
+ if (!kvm->arch.migration_mode)
+ return 0;
+
+ /*
+ * Turn off migration mode when:
+ * - userspace creates a new memslot with dirty logging off,
+ * - userspace modifies an existing memslot (MOVE or FLAGS_ONLY) and
+ * dirty logging is turned off.
+ * Migration mode expects dirty page logging being enabled to store
+ * its dirty bitmap.
+ */
+ if (change != KVM_MR_DELETE &&
+ !(mem->flags & KVM_MEM_LOG_DIRTY_PAGES))
+ WARN(kvm_s390_vm_stop_migration(kvm),
+ "Failed to stop migration mode");
+
return 0;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 471/567] x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 470/567] KVM: s390: disable migration mode when dirty tracking is disabled Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 472/567] x86/crash: Disable virt in core NMI crash handler to avoid double shootdown Greg Kroah-Hartman
` (99 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Cooper, Tom Lendacky,
Thomas Gleixner, Sean Christopherson
From: Sean Christopherson <seanjc@google.com>
commit 6a3236580b0b1accc3976345e723104f74f6f8e6 upstream.
Set GIF=1 prior to disabling SVM to ensure that INIT is recognized if the
kernel is disabling SVM in an emergency, e.g. if the kernel is about to
jump into a crash kernel or may reboot without doing a full CPU RESET.
If GIF is left cleared, the new kernel (or firmware) will be unabled to
awaken APs. Eat faults on STGI (due to EFER.SVME=0) as it's possible
that SVM could be disabled via NMI shootdown between reading EFER.SVME
and executing STGI.
Link: https://lore.kernel.org/all/cbcb6f35-e5d7-c1c9-4db9-fe5cc4de579a@amd.com
Cc: stable@vger.kernel.org
Cc: Andrew Cooper <Andrew.Cooper3@citrix.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20221130233650.1404148-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/virtext.h | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/virtext.h
+++ b/arch/x86/include/asm/virtext.h
@@ -126,7 +126,21 @@ static inline void cpu_svm_disable(void)
wrmsrl(MSR_VM_HSAVE_PA, 0);
rdmsrl(MSR_EFER, efer);
- wrmsrl(MSR_EFER, efer & ~EFER_SVME);
+ if (efer & EFER_SVME) {
+ /*
+ * Force GIF=1 prior to disabling SVM to ensure INIT and NMI
+ * aren't blocked, e.g. if a fatal error occurred between CLGI
+ * and STGI. Note, STGI may #UD if SVM is disabled from NMI
+ * context between reading EFER and executing STGI. In that
+ * case, GIF must already be set, otherwise the NMI would have
+ * been blocked, so just eat the fault.
+ */
+ asm_volatile_goto("1: stgi\n\t"
+ _ASM_EXTABLE(1b, %l[fault])
+ ::: "memory" : fault);
+fault:
+ wrmsrl(MSR_EFER, efer & ~EFER_SVME);
+ }
}
/** Makes sure SVM is disabled, if it is supported on the CPU
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 472/567] x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 471/567] x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 473/567] x86/reboot: Disable virtualization in an emergency if SVM is supported Greg Kroah-Hartman
` (98 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guilherme G. Piccoli,
Vitaly Kuznetsov, Paolo Bonzini, Thomas Gleixner,
Sean Christopherson
From: Sean Christopherson <seanjc@google.com>
commit 26044aff37a5455b19a91785086914fd33053ef4 upstream.
Disable virtualization in crash_nmi_callback() and rework the
emergency_vmx_disable_all() path to do an NMI shootdown if and only if a
shootdown has not already occurred. NMI crash shootdown fundamentally
can't support multiple invocations as responding CPUs are deliberately
put into halt state without unblocking NMIs. But, the emergency reboot
path doesn't have any work of its own, it simply cares about disabling
virtualization, i.e. so long as a shootdown occurred, emergency reboot
doesn't care who initiated the shootdown, or when.
If "crash_kexec_post_notifiers" is specified on the kernel command line,
panic() will invoke crash_smp_send_stop() and result in a second call to
nmi_shootdown_cpus() during native_machine_emergency_restart().
Invoke the callback _before_ disabling virtualization, as the current
VMCS needs to be cleared before doing VMXOFF. Note, this results in a
subtle change in ordering between disabling virtualization and stopping
Intel PT on the responding CPUs. While VMX and Intel PT do interact,
VMXOFF and writes to MSR_IA32_RTIT_CTL do not induce faults between one
another, which is all that matters when panicking.
Harden nmi_shootdown_cpus() against multiple invocations to try and
capture any such kernel bugs via a WARN instead of hanging the system
during a crash/dump, e.g. prior to the recent hardening of
register_nmi_handler(), re-registering the NMI handler would trigger a
double list_add() and hang the system if CONFIG_BUG_ON_DATA_CORRUPTION=y.
list_add double add: new=ffffffff82220800, prev=ffffffff8221cfe8, next=ffffffff82220800.
WARNING: CPU: 2 PID: 1319 at lib/list_debug.c:29 __list_add_valid+0x67/0x70
Call Trace:
__register_nmi_handler+0xcf/0x130
nmi_shootdown_cpus+0x39/0x90
native_machine_emergency_restart+0x1c9/0x1d0
panic+0x237/0x29b
Extract the disabling logic to a common helper to deduplicate code, and
to prepare for doing the shootdown in the emergency reboot path if SVM
is supported.
Note, prior to commit ed72736183c4 ("x86/reboot: Force all cpus to exit
VMX root if VMX is supported"), nmi_shootdown_cpus() was subtly protected
against a second invocation by a cpu_vmx_enabled() check as the kdump
handler would disable VMX if it ran first.
Fixes: ed72736183c4 ("x86/reboot: Force all cpus to exit VMX root if VMX is supported")
Cc: stable@vger.kernel.org
Reported-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/all/20220427224924.592546-2-gpiccoli@igalia.com
Tested-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20221130233650.1404148-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/reboot.h | 2 +
arch/x86/kernel/crash.c | 17 ----------
arch/x86/kernel/reboot.c | 65 ++++++++++++++++++++++++++++++++++--------
3 files changed, 56 insertions(+), 28 deletions(-)
--- a/arch/x86/include/asm/reboot.h
+++ b/arch/x86/include/asm/reboot.h
@@ -25,6 +25,8 @@ void __noreturn machine_real_restart(uns
#define MRR_BIOS 0
#define MRR_APM 1
+void cpu_emergency_disable_virtualization(void);
+
typedef void (*nmi_shootdown_cb)(int, struct pt_regs*);
void nmi_panic_self_stop(struct pt_regs *regs);
void nmi_shootdown_cpus(nmi_shootdown_cb callback);
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -37,7 +37,6 @@
#include <linux/kdebug.h>
#include <asm/cpu.h>
#include <asm/reboot.h>
-#include <asm/virtext.h>
#include <asm/intel_pt.h>
#include <asm/crash.h>
#include <asm/cmdline.h>
@@ -81,15 +80,6 @@ static void kdump_nmi_callback(int cpu,
*/
cpu_crash_vmclear_loaded_vmcss();
- /* Disable VMX or SVM if needed.
- *
- * We need to disable virtualization on all CPUs.
- * Having VMX or SVM enabled on any CPU may break rebooting
- * after the kdump kernel has finished its task.
- */
- cpu_emergency_vmxoff();
- cpu_emergency_svm_disable();
-
/*
* Disable Intel PT to stop its logging
*/
@@ -148,12 +138,7 @@ void native_machine_crash_shutdown(struc
*/
cpu_crash_vmclear_loaded_vmcss();
- /* Booting kdump kernel with VMX or SVM enabled won't work,
- * because (among other limitations) we can't disable paging
- * with the virt flags.
- */
- cpu_emergency_vmxoff();
- cpu_emergency_svm_disable();
+ cpu_emergency_disable_virtualization();
/*
* Disable Intel PT to stop its logging
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -528,10 +528,7 @@ static inline void kb_wait(void)
}
}
-static void vmxoff_nmi(int cpu, struct pt_regs *regs)
-{
- cpu_emergency_vmxoff();
-}
+static inline void nmi_shootdown_cpus_on_restart(void);
/* Use NMIs as IPIs to tell all CPUs to disable virtualization */
static void emergency_vmx_disable_all(void)
@@ -554,7 +551,7 @@ static void emergency_vmx_disable_all(vo
__cpu_emergency_vmxoff();
/* Halt and exit VMX root operation on the other CPUs. */
- nmi_shootdown_cpus(vmxoff_nmi);
+ nmi_shootdown_cpus_on_restart();
}
}
@@ -795,6 +792,17 @@ void machine_crash_shutdown(struct pt_re
/* This is the CPU performing the emergency shutdown work. */
int crashing_cpu = -1;
+/*
+ * Disable virtualization, i.e. VMX or SVM, to ensure INIT is recognized during
+ * reboot. VMX blocks INIT if the CPU is post-VMXON, and SVM blocks INIT if
+ * GIF=0, i.e. if the crash occurred between CLGI and STGI.
+ */
+void cpu_emergency_disable_virtualization(void)
+{
+ cpu_emergency_vmxoff();
+ cpu_emergency_svm_disable();
+}
+
#if defined(CONFIG_SMP)
static nmi_shootdown_cb shootdown_callback;
@@ -817,7 +825,14 @@ static int crash_nmi_callback(unsigned i
return NMI_HANDLED;
local_irq_disable();
- shootdown_callback(cpu, regs);
+ if (shootdown_callback)
+ shootdown_callback(cpu, regs);
+
+ /*
+ * Prepare the CPU for reboot _after_ invoking the callback so that the
+ * callback can safely use virtualization instructions, e.g. VMCLEAR.
+ */
+ cpu_emergency_disable_virtualization();
atomic_dec(&waiting_for_crash_ipi);
/* Assume hlt works */
@@ -828,18 +843,32 @@ static int crash_nmi_callback(unsigned i
return NMI_HANDLED;
}
-/*
- * Halt all other CPUs, calling the specified function on each of them
+/**
+ * nmi_shootdown_cpus - Stop other CPUs via NMI
+ * @callback: Optional callback to be invoked from the NMI handler
+ *
+ * The NMI handler on the remote CPUs invokes @callback, if not
+ * NULL, first and then disables virtualization to ensure that
+ * INIT is recognized during reboot.
*
- * This function can be used to halt all other CPUs on crash
- * or emergency reboot time. The function passed as parameter
- * will be called inside a NMI handler on all CPUs.
+ * nmi_shootdown_cpus() can only be invoked once. After the first
+ * invocation all other CPUs are stuck in crash_nmi_callback() and
+ * cannot respond to a second NMI.
*/
void nmi_shootdown_cpus(nmi_shootdown_cb callback)
{
unsigned long msecs;
+
local_irq_disable();
+ /*
+ * Avoid certain doom if a shootdown already occurred; re-registering
+ * the NMI handler will cause list corruption, modifying the callback
+ * will do who knows what, etc...
+ */
+ if (WARN_ON_ONCE(crash_ipi_issued))
+ return;
+
/* Make a note of crashing cpu. Will be used in NMI callback. */
crashing_cpu = safe_smp_processor_id();
@@ -867,7 +896,17 @@ void nmi_shootdown_cpus(nmi_shootdown_cb
msecs--;
}
- /* Leave the nmi callback set */
+ /*
+ * Leave the nmi callback set, shootdown is a one-time thing. Clearing
+ * the callback could result in a NULL pointer dereference if a CPU
+ * (finally) responds after the timeout expires.
+ */
+}
+
+static inline void nmi_shootdown_cpus_on_restart(void)
+{
+ if (!crash_ipi_issued)
+ nmi_shootdown_cpus(NULL);
}
/*
@@ -897,6 +936,8 @@ void nmi_shootdown_cpus(nmi_shootdown_cb
/* No other CPUs to shoot down */
}
+static inline void nmi_shootdown_cpus_on_restart(void) { }
+
void run_crash_ipi_callback(struct pt_regs *regs)
{
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 473/567] x86/reboot: Disable virtualization in an emergency if SVM is supported
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 472/567] x86/crash: Disable virt in core NMI crash handler to avoid double shootdown Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 474/567] x86/reboot: Disable SVM, not just VMX, when stopping CPUs Greg Kroah-Hartman
` (97 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Sean Christopherson
From: Sean Christopherson <seanjc@google.com>
commit d81f952aa657b76cea381384bef1fea35c5fd266 upstream.
Disable SVM on all CPUs via NMI shootdown during an emergency reboot.
Like VMX, SVM can block INIT, e.g. if the emergency reboot is triggered
between CLGI and STGI, and thus can prevent bringing up other CPUs via
INIT-SIPI-SIPI.
Cc: stable@vger.kernel.org
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20221130233650.1404148-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/reboot.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -530,27 +530,26 @@ static inline void kb_wait(void)
static inline void nmi_shootdown_cpus_on_restart(void);
-/* Use NMIs as IPIs to tell all CPUs to disable virtualization */
-static void emergency_vmx_disable_all(void)
+static void emergency_reboot_disable_virtualization(void)
{
/* Just make sure we won't change CPUs while doing this */
local_irq_disable();
/*
- * Disable VMX on all CPUs before rebooting, otherwise we risk hanging
- * the machine, because the CPU blocks INIT when it's in VMX root.
+ * Disable virtualization on all CPUs before rebooting to avoid hanging
+ * the system, as VMX and SVM block INIT when running in the host.
*
* We can't take any locks and we may be on an inconsistent state, so
- * use NMIs as IPIs to tell the other CPUs to exit VMX root and halt.
+ * use NMIs as IPIs to tell the other CPUs to disable VMX/SVM and halt.
*
- * Do the NMI shootdown even if VMX if off on _this_ CPU, as that
- * doesn't prevent a different CPU from being in VMX root operation.
+ * Do the NMI shootdown even if virtualization is off on _this_ CPU, as
+ * other CPUs may have virtualization enabled.
*/
- if (cpu_has_vmx()) {
- /* Safely force _this_ CPU out of VMX root operation. */
- __cpu_emergency_vmxoff();
+ if (cpu_has_vmx() || cpu_has_svm(NULL)) {
+ /* Safely force _this_ CPU out of VMX/SVM operation. */
+ cpu_emergency_disable_virtualization();
- /* Halt and exit VMX root operation on the other CPUs. */
+ /* Disable VMX/SVM and halt on other CPUs. */
nmi_shootdown_cpus_on_restart();
}
}
@@ -587,7 +586,7 @@ static void native_machine_emergency_res
unsigned short mode;
if (reboot_emergency)
- emergency_vmx_disable_all();
+ emergency_reboot_disable_virtualization();
tboot_shutdown(TB_SHUTDOWN_REBOOT);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 474/567] x86/reboot: Disable SVM, not just VMX, when stopping CPUs
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 473/567] x86/reboot: Disable virtualization in an emergency if SVM is supported Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 475/567] x86/kprobes: Fix __recover_optprobed_insn check optimizing logic Greg Kroah-Hartman
` (96 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Sean Christopherson
From: Sean Christopherson <seanjc@google.com>
commit a2b07fa7b93321c059af0c6d492cc9a4f1e390aa upstream.
Disable SVM and more importantly force GIF=1 when halting a CPU or
rebooting the machine. Similar to VMX, SVM allows software to block
INITs via CLGI, and thus can be problematic for a crash/reboot. The
window for failure is smaller with SVM as INIT is only blocked while
GIF=0, i.e. between CLGI and STGI, but the window does exist.
Fixes: fba4f472b33a ("x86/reboot: Turn off KVM when halting a CPU")
Cc: stable@vger.kernel.org
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20221130233650.1404148-5-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/smp.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/smp.c
+++ b/arch/x86/kernel/smp.c
@@ -32,7 +32,7 @@
#include <asm/mce.h>
#include <asm/trace/irq_vectors.h>
#include <asm/kexec.h>
-#include <asm/virtext.h>
+#include <asm/reboot.h>
/*
* Some notes on x86 processor bugs affecting SMP operation:
@@ -122,7 +122,7 @@ static int smp_stop_nmi_callback(unsigne
if (raw_smp_processor_id() == atomic_read(&stopping_cpu))
return NMI_HANDLED;
- cpu_emergency_vmxoff();
+ cpu_emergency_disable_virtualization();
stop_this_cpu(NULL);
return NMI_HANDLED;
@@ -134,7 +134,7 @@ static int smp_stop_nmi_callback(unsigne
DEFINE_IDTENTRY_SYSVEC(sysvec_reboot)
{
ack_APIC_irq();
- cpu_emergency_vmxoff();
+ cpu_emergency_disable_virtualization();
stop_this_cpu(NULL);
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 475/567] x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 474/567] x86/reboot: Disable SVM, not just VMX, when stopping CPUs Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 476/567] x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range Greg Kroah-Hartman
` (95 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Jihong, Masami Hiramatsu (Google)
From: Yang Jihong <yangjihong1@huawei.com>
commit 868a6fc0ca2407622d2833adefe1c4d284766c4c upstream.
Since the following commit:
commit f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code")
modified the update timing of the KPROBE_FLAG_OPTIMIZED, a optimized_kprobe
may be in the optimizing or unoptimizing state when op.kp->flags
has KPROBE_FLAG_OPTIMIZED and op->list is not empty.
The __recover_optprobed_insn check logic is incorrect, a kprobe in the
unoptimizing state may be incorrectly determined as unoptimizing.
As a result, incorrect instructions are copied.
The optprobe_queued_unopt function needs to be exported for invoking in
arch directory.
Link: https://lore.kernel.org/all/20230216034247.32348-2-yangjihong1@huawei.com/
Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code")
Cc: stable@vger.kernel.org
Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/kprobes/opt.c | 4 ++--
include/linux/kprobes.h | 1 +
kernel/kprobes.c | 2 +-
3 files changed, 4 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -46,8 +46,8 @@ unsigned long __recover_optprobed_insn(k
/* This function only handles jump-optimized kprobe */
if (kp && kprobe_optimized(kp)) {
op = container_of(kp, struct optimized_kprobe, kp);
- /* If op->list is not empty, op is under optimizing */
- if (list_empty(&op->list))
+ /* If op is optimized or under unoptimizing */
+ if (list_empty(&op->list) || optprobe_queued_unopt(op))
goto found;
}
}
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -349,6 +349,7 @@ extern int proc_kprobes_optimization_han
size_t *length, loff_t *ppos);
#endif
extern void wait_for_kprobe_optimizer(void);
+bool optprobe_queued_unopt(struct optimized_kprobe *op);
#else
static inline void wait_for_kprobe_optimizer(void) { }
#endif /* CONFIG_OPTPROBES */
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -656,7 +656,7 @@ void wait_for_kprobe_optimizer(void)
mutex_unlock(&kprobe_mutex);
}
-static bool optprobe_queued_unopt(struct optimized_kprobe *op)
+bool optprobe_queued_unopt(struct optimized_kprobe *op)
{
struct optimized_kprobe *_op;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 476/567] x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 475/567] x86/kprobes: Fix __recover_optprobed_insn check optimizing logic Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 477/567] x86/microcode/amd: Remove load_microcode_amd()s bsp parameter Greg Kroah-Hartman
` (94 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Jihong, Masami Hiramatsu (Google)
From: Yang Jihong <yangjihong1@huawei.com>
commit f1c97a1b4ef709e3f066f82e3ba3108c3b133ae6 upstream.
When arch_prepare_optimized_kprobe calculating jump destination address,
it copies original instructions from jmp-optimized kprobe (see
__recover_optprobed_insn), and calculated based on length of original
instruction.
arch_check_optimized_kprobe does not check KPROBE_FLAG_OPTIMATED when
checking whether jmp-optimized kprobe exists.
As a result, setup_detour_execution may jump to a range that has been
overwritten by jump destination address, resulting in an inval opcode error.
For example, assume that register two kprobes whose addresses are
<func+9> and <func+11> in "func" function.
The original code of "func" function is as follows:
0xffffffff816cb5e9 <+9>: push %r12
0xffffffff816cb5eb <+11>: xor %r12d,%r12d
0xffffffff816cb5ee <+14>: test %rdi,%rdi
0xffffffff816cb5f1 <+17>: setne %r12b
0xffffffff816cb5f5 <+21>: push %rbp
1.Register the kprobe for <func+11>, assume that is kp1, corresponding optimized_kprobe is op1.
After the optimization, "func" code changes to:
0xffffffff816cc079 <+9>: push %r12
0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000
0xffffffff816cc080 <+16>: incl 0xf(%rcx)
0xffffffff816cc083 <+19>: xchg %eax,%ebp
0xffffffff816cc084 <+20>: (bad)
0xffffffff816cc085 <+21>: push %rbp
Now op1->flags == KPROBE_FLAG_OPTIMATED;
2. Register the kprobe for <func+9>, assume that is kp2, corresponding optimized_kprobe is op2.
register_kprobe(kp2)
register_aggr_kprobe
alloc_aggr_kprobe
__prepare_optimized_kprobe
arch_prepare_optimized_kprobe
__recover_optprobed_insn // copy original bytes from kp1->optinsn.copied_insn,
// jump address = <func+14>
3. disable kp1:
disable_kprobe(kp1)
__disable_kprobe
...
if (p == orig_p || aggr_kprobe_disabled(orig_p)) {
ret = disarm_kprobe(orig_p, true) // add op1 in unoptimizing_list, not unoptimized
orig_p->flags |= KPROBE_FLAG_DISABLED; // op1->flags == KPROBE_FLAG_OPTIMATED | KPROBE_FLAG_DISABLED
...
4. unregister kp2
__unregister_kprobe_top
...
if (!kprobe_disabled(ap) && !kprobes_all_disarmed) {
optimize_kprobe(op)
...
if (arch_check_optimized_kprobe(op) < 0) // because op1 has KPROBE_FLAG_DISABLED, here not return
return;
p->kp.flags |= KPROBE_FLAG_OPTIMIZED; // now op2 has KPROBE_FLAG_OPTIMIZED
}
"func" code now is:
0xffffffff816cc079 <+9>: int3
0xffffffff816cc07a <+10>: push %rsp
0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000
0xffffffff816cc080 <+16>: incl 0xf(%rcx)
0xffffffff816cc083 <+19>: xchg %eax,%ebp
0xffffffff816cc084 <+20>: (bad)
0xffffffff816cc085 <+21>: push %rbp
5. if call "func", int3 handler call setup_detour_execution:
if (p->flags & KPROBE_FLAG_OPTIMIZED) {
...
regs->ip = (unsigned long)op->optinsn.insn + TMPL_END_IDX;
...
}
The code for the destination address is
0xffffffffa021072c: push %r12
0xffffffffa021072e: xor %r12d,%r12d
0xffffffffa0210731: jmp 0xffffffff816cb5ee <func+14>
However, <func+14> is not a valid start instruction address. As a result, an error occurs.
Link: https://lore.kernel.org/all/20230216034247.32348-3-yangjihong1@huawei.com/
Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code")
Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
Cc: stable@vger.kernel.org
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/kprobes/opt.c | 2 +-
include/linux/kprobes.h | 1 +
kernel/kprobes.c | 4 ++--
3 files changed, 4 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -346,7 +346,7 @@ int arch_check_optimized_kprobe(struct o
for (i = 1; i < op->optinsn.size; i++) {
p = get_kprobe(op->kp.addr + i);
- if (p && !kprobe_disabled(p))
+ if (p && !kprobe_disarmed(p))
return -EEXIST;
}
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -350,6 +350,7 @@ extern int proc_kprobes_optimization_han
#endif
extern void wait_for_kprobe_optimizer(void);
bool optprobe_queued_unopt(struct optimized_kprobe *op);
+bool kprobe_disarmed(struct kprobe *p);
#else
static inline void wait_for_kprobe_optimizer(void) { }
#endif /* CONFIG_OPTPROBES */
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -451,8 +451,8 @@ static inline int kprobe_optready(struct
return 0;
}
-/* Return true(!0) if the kprobe is disarmed. Note: p must be on hash list */
-static inline int kprobe_disarmed(struct kprobe *p)
+/* Return true if the kprobe is disarmed. Note: p must be on hash list */
+bool kprobe_disarmed(struct kprobe *p)
{
struct optimized_kprobe *op;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 477/567] x86/microcode/amd: Remove load_microcode_amd()s bsp parameter
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 476/567] x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 478/567] x86/microcode/AMD: Add a @cpu parameter to the reloading functions Greg Kroah-Hartman
` (93 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Borislav Petkov (AMD)
From: Borislav Petkov (AMD) <bp@alien8.de>
commit 2355370cd941cbb20882cc3f34460f9f2b8f9a18 upstream.
It is always the BSP.
No functional changes.
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230130161709.11615-2-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/microcode/amd.c | 17 +++++------------
1 file changed, 5 insertions(+), 12 deletions(-)
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -547,8 +547,7 @@ void load_ucode_amd_ap(unsigned int cpui
apply_microcode_early_amd(cpuid_1_eax, cp.data, cp.size, false);
}
-static enum ucode_state
-load_microcode_amd(bool save, u8 family, const u8 *data, size_t size);
+static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size);
int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax)
{
@@ -566,7 +565,7 @@ int __init save_microcode_in_initrd_amd(
if (!desc.mc)
return -EINVAL;
- ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size);
+ ret = load_microcode_amd(x86_family(cpuid_1_eax), desc.data, desc.size);
if (ret > UCODE_UPDATED)
return -EINVAL;
@@ -844,8 +843,7 @@ static enum ucode_state __load_microcode
return UCODE_OK;
}
-static enum ucode_state
-load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
+static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size)
{
struct ucode_patch *p;
enum ucode_state ret;
@@ -869,10 +867,6 @@ load_microcode_amd(bool save, u8 family,
ret = UCODE_NEW;
}
- /* save BSP's matching patch for early load */
- if (!save)
- return ret;
-
memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE));
@@ -900,12 +894,11 @@ static enum ucode_state request_microcod
{
char fw_name[36] = "amd-ucode/microcode_amd.bin";
struct cpuinfo_x86 *c = &cpu_data(cpu);
- bool bsp = c->cpu_index == boot_cpu_data.cpu_index;
enum ucode_state ret = UCODE_NFOUND;
const struct firmware *fw;
/* reload ucode container only on the boot cpu */
- if (!refresh_fw || !bsp)
+ if (!refresh_fw)
return UCODE_OK;
if (c->x86 >= 0x15)
@@ -920,7 +913,7 @@ static enum ucode_state request_microcod
if (!verify_container(fw->data, fw->size, false))
goto fw_release;
- ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size);
+ ret = load_microcode_amd(c->x86, fw->data, fw->size);
fw_release:
release_firmware(fw);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 478/567] x86/microcode/AMD: Add a @cpu parameter to the reloading functions
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 477/567] x86/microcode/amd: Remove load_microcode_amd()s bsp parameter Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 479/567] x86/microcode/AMD: Fix mixed steppings support Greg Kroah-Hartman
` (92 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Borislav Petkov (AMD)
From: Borislav Petkov (AMD) <bp@alien8.de>
commit a5ad92134bd153a9ccdcddf09a95b088f36c3cce upstream.
Will be used in a subsequent change.
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230130161709.11615-3-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/microcode.h | 4 ++--
arch/x86/include/asm/microcode_amd.h | 4 ++--
arch/x86/kernel/cpu/microcode/amd.c | 2 +-
arch/x86/kernel/cpu/microcode/core.c | 6 +++---
4 files changed, 8 insertions(+), 8 deletions(-)
--- a/arch/x86/include/asm/microcode.h
+++ b/arch/x86/include/asm/microcode.h
@@ -130,14 +130,14 @@ static inline unsigned int x86_cpuid_fam
#ifdef CONFIG_MICROCODE
extern void __init load_ucode_bsp(void);
extern void load_ucode_ap(void);
-void reload_early_microcode(void);
+void reload_early_microcode(unsigned int cpu);
extern bool get_builtin_firmware(struct cpio_data *cd, const char *name);
extern bool initrd_gone;
void microcode_bsp_resume(void);
#else
static inline void __init load_ucode_bsp(void) { }
static inline void load_ucode_ap(void) { }
-static inline void reload_early_microcode(void) { }
+static inline void reload_early_microcode(unsigned int cpu) { }
static inline void microcode_bsp_resume(void) { }
static inline bool
get_builtin_firmware(struct cpio_data *cd, const char *name) { return false; }
--- a/arch/x86/include/asm/microcode_amd.h
+++ b/arch/x86/include/asm/microcode_amd.h
@@ -47,12 +47,12 @@ struct microcode_amd {
extern void __init load_ucode_amd_bsp(unsigned int family);
extern void load_ucode_amd_ap(unsigned int family);
extern int __init save_microcode_in_initrd_amd(unsigned int family);
-void reload_ucode_amd(void);
+void reload_ucode_amd(unsigned int cpu);
#else
static inline void __init load_ucode_amd_bsp(unsigned int family) {}
static inline void load_ucode_amd_ap(unsigned int family) {}
static inline int __init
save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; }
-static inline void reload_ucode_amd(void) {}
+static inline void reload_ucode_amd(unsigned int cpu) {}
#endif
#endif /* _ASM_X86_MICROCODE_AMD_H */
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -572,7 +572,7 @@ int __init save_microcode_in_initrd_amd(
return 0;
}
-void reload_ucode_amd(void)
+void reload_ucode_amd(unsigned int cpu)
{
struct microcode_amd *mc;
u32 rev, dummy __always_unused;
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -315,7 +315,7 @@ struct cpio_data find_microcode_in_initr
#endif
}
-void reload_early_microcode(void)
+void reload_early_microcode(unsigned int cpu)
{
int vendor, family;
@@ -329,7 +329,7 @@ void reload_early_microcode(void)
break;
case X86_VENDOR_AMD:
if (family >= 0x10)
- reload_ucode_amd();
+ reload_ucode_amd(cpu);
break;
default:
break;
@@ -707,7 +707,7 @@ void microcode_bsp_resume(void)
if (uci->valid && uci->mc)
microcode_ops->apply_microcode(cpu);
else if (!uci->mc)
- reload_early_microcode();
+ reload_early_microcode(cpu);
}
static struct syscore_ops mc_syscore_ops = {
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 479/567] x86/microcode/AMD: Fix mixed steppings support
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 478/567] x86/microcode/AMD: Add a @cpu parameter to the reloading functions Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 480/567] x86/speculation: Allow enabling STIBP with legacy IBRS Greg Kroah-Hartman
` (91 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Borislav Petkov (AMD), stable
From: Borislav Petkov (AMD) <bp@alien8.de>
commit 7ff6edf4fef38ab404ee7861f257e28eaaeed35f upstream.
The AMD side of the loader has always claimed to support mixed
steppings. But somewhere along the way, it broke that by assuming that
the cached patch blob is a single one instead of it being one per
*node*.
So turn it into a per-node one so that each node can stash the blob
relevant for it.
[ NB: Fixes tag is not really the exactly correct one but it is good
enough. ]
Fixes: fe055896c040 ("x86/microcode: Merge the early microcode loader")
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org> # 2355370cd941 ("x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter")
Cc: <stable@kernel.org> # a5ad92134bd1 ("x86/microcode/AMD: Add a @cpu parameter to the reloading functions")
Link: https://lore.kernel.org/r/20230130161709.11615-4-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/microcode/amd.c | 34 +++++++++++++++++++++-------------
1 file changed, 21 insertions(+), 13 deletions(-)
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -55,7 +55,9 @@ struct cont_desc {
};
static u32 ucode_new_rev;
-static u8 amd_ucode_patch[PATCH_MAX_SIZE];
+
+/* One blob per node. */
+static u8 amd_ucode_patch[MAX_NUMNODES][PATCH_MAX_SIZE];
/*
* Microcode patch container file is prepended to the initrd in cpio
@@ -428,7 +430,7 @@ apply_microcode_early_amd(u32 cpuid_1_ea
patch = (u8 (*)[PATCH_MAX_SIZE])__pa_nodebug(&amd_ucode_patch);
#else
new_rev = &ucode_new_rev;
- patch = &amd_ucode_patch;
+ patch = &amd_ucode_patch[0];
#endif
desc.cpuid_1_eax = cpuid_1_eax;
@@ -574,10 +576,10 @@ int __init save_microcode_in_initrd_amd(
void reload_ucode_amd(unsigned int cpu)
{
- struct microcode_amd *mc;
u32 rev, dummy __always_unused;
+ struct microcode_amd *mc;
- mc = (struct microcode_amd *)amd_ucode_patch;
+ mc = (struct microcode_amd *)amd_ucode_patch[cpu_to_node(cpu)];
rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
@@ -845,6 +847,8 @@ static enum ucode_state __load_microcode
static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size)
{
+ struct cpuinfo_x86 *c;
+ unsigned int nid, cpu;
struct ucode_patch *p;
enum ucode_state ret;
@@ -857,18 +861,22 @@ static enum ucode_state load_microcode_a
return ret;
}
- p = find_patch(0);
- if (!p) {
- return ret;
- } else {
- if (boot_cpu_data.microcode >= p->patch_id)
- return ret;
+ for_each_node(nid) {
+ cpu = cpumask_first(cpumask_of_node(nid));
+ c = &cpu_data(cpu);
+
+ p = find_patch(cpu);
+ if (!p)
+ continue;
+
+ if (c->microcode >= p->patch_id)
+ continue;
ret = UCODE_NEW;
- }
- memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
- memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE));
+ memset(&amd_ucode_patch[nid], 0, PATCH_MAX_SIZE);
+ memcpy(&amd_ucode_patch[nid], p->data, min_t(u32, p->size, PATCH_MAX_SIZE));
+ }
return ret;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 480/567] x86/speculation: Allow enabling STIBP with legacy IBRS
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 479/567] x86/microcode/AMD: Fix mixed steppings support Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 481/567] Documentation/hw-vuln: Document the interaction between IBRS and STIBP Greg Kroah-Hartman
` (90 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, José Oliveira, Rodrigo Branco,
KP Singh, Borislav Petkov (AMD)
From: KP Singh <kpsingh@kernel.org>
commit 6921ed9049bc7457f66c1596c5b78aec0dae4a9d upstream.
When plain IBRS is enabled (not enhanced IBRS), the logic in
spectre_v2_user_select_mitigation() determines that STIBP is not needed.
The IBRS bit implicitly protects against cross-thread branch target
injection. However, with legacy IBRS, the IBRS bit is cleared on
returning to userspace for performance reasons which leaves userspace
threads vulnerable to cross-thread branch target injection against which
STIBP protects.
Exclude IBRS from the spectre_v2_in_ibrs_mode() check to allow for
enabling STIBP (through seccomp/prctl() by default or always-on, if
selected by spectre_v2_user kernel cmdline parameter).
[ bp: Massage. ]
Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS")
Reported-by: José Oliveira <joseloliveira11@gmail.com>
Reported-by: Rodrigo Branco <rodrigo@kernelhacking.com>
Signed-off-by: KP Singh <kpsingh@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230220120127.1975241-1-kpsingh@kernel.org
Link: https://lore.kernel.org/r/20230221184908.2349578-1-kpsingh@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/bugs.c | 25 ++++++++++++++++++-------
1 file changed, 18 insertions(+), 7 deletions(-)
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1103,14 +1103,18 @@ spectre_v2_parse_user_cmdline(void)
return SPECTRE_V2_USER_CMD_AUTO;
}
-static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
+static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode)
{
- return mode == SPECTRE_V2_IBRS ||
- mode == SPECTRE_V2_EIBRS ||
+ return mode == SPECTRE_V2_EIBRS ||
mode == SPECTRE_V2_EIBRS_RETPOLINE ||
mode == SPECTRE_V2_EIBRS_LFENCE;
}
+static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
+{
+ return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS;
+}
+
static void __init
spectre_v2_user_select_mitigation(void)
{
@@ -1173,12 +1177,19 @@ spectre_v2_user_select_mitigation(void)
}
/*
- * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible,
- * STIBP is not required.
+ * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP
+ * is not required.
+ *
+ * Enhanced IBRS also protects against cross-thread branch target
+ * injection in user-mode as the IBRS bit remains always set which
+ * implicitly enables cross-thread protections. However, in legacy IBRS
+ * mode, the IBRS bit is set only on kernel entry and cleared on return
+ * to userspace. This disables the implicit cross-thread protection,
+ * so allow for STIBP to be selected in that case.
*/
if (!boot_cpu_has(X86_FEATURE_STIBP) ||
!smt_possible ||
- spectre_v2_in_ibrs_mode(spectre_v2_enabled))
+ spectre_v2_in_eibrs_mode(spectre_v2_enabled))
return;
/*
@@ -2305,7 +2316,7 @@ static ssize_t mmio_stale_data_show_stat
static char *stibp_state(void)
{
- if (spectre_v2_in_ibrs_mode(spectre_v2_enabled))
+ if (spectre_v2_in_eibrs_mode(spectre_v2_enabled))
return "";
switch (spectre_v2_user_stibp) {
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 481/567] Documentation/hw-vuln: Document the interaction between IBRS and STIBP
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 480/567] x86/speculation: Allow enabling STIBP with legacy IBRS Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 482/567] brd: return 0/-error from brd_insert_page() Greg Kroah-Hartman
` (89 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, KP Singh, Borislav Petkov (AMD)
From: KP Singh <kpsingh@kernel.org>
commit e02b50ca442e88122e1302d4dbc1b71a4808c13f upstream.
Explain why STIBP is needed with legacy IBRS as currently implemented
(KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled.
Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS")
Signed-off-by: KP Singh <kpsingh@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230227060541.1939092-2-kpsingh@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/hw-vuln/spectre.rst | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
--- a/Documentation/admin-guide/hw-vuln/spectre.rst
+++ b/Documentation/admin-guide/hw-vuln/spectre.rst
@@ -479,8 +479,16 @@ Spectre variant 2
On Intel Skylake-era systems the mitigation covers most, but not all,
cases. See :ref:`[3] <spec_ref3>` for more details.
- On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced
- IBRS on x86), retpoline is automatically disabled at run time.
+ On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS
+ or enhanced IBRS on x86), retpoline is automatically disabled at run time.
+
+ Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at
+ boot, by setting the IBRS bit, and they're automatically protected against
+ Spectre v2 variant attacks, including cross-thread branch target injections
+ on SMT systems (STIBP). In other words, eIBRS enables STIBP too.
+
+ Legacy IBRS systems clear the IBRS bit on exit to userspace and
+ therefore explicitly enable STIBP for that
The retpoline mitigation is turned on by default on vulnerable
CPUs. It can be forced on or off by the administrator
@@ -504,9 +512,12 @@ Spectre variant 2
For Spectre variant 2 mitigation, individual user programs
can be compiled with return trampolines for indirect branches.
This protects them from consuming poisoned entries in the branch
- target buffer left by malicious software. Alternatively, the
- programs can disable their indirect branch speculation via prctl()
- (See :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
+ target buffer left by malicious software.
+
+ On legacy IBRS systems, at return to userspace, implicit STIBP is disabled
+ because the kernel clears the IBRS bit. In this case, the userspace programs
+ can disable indirect branch speculation via prctl() (See
+ :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
On x86, this will turn on STIBP to guard against attacks from the
sibling thread when the user program is running, and use IBPB to
flush the branch target buffer when switching to/from the program.
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 482/567] brd: return 0/-error from brd_insert_page()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 481/567] Documentation/hw-vuln: Document the interaction between IBRS and STIBP Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 483/567] ima: Align ima_file_mmap() parameters with mmap_file LSM hook Greg Kroah-Hartman
` (88 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Jens Axboe
From: Jens Axboe <axboe@kernel.dk>
commit db0ccc44a20b4bb3039c0f6885a1f9c3323c7673 upstream.
It currently returns a page, but callers just check for NULL/page to
gauge success. Clean this up and return the appropriate error directly
instead.
Cc: stable@vger.kernel.org # 5.10+
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/brd.c | 26 ++++++++++++--------------
1 file changed, 12 insertions(+), 14 deletions(-)
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -78,11 +78,9 @@ static struct page *brd_lookup_page(stru
}
/*
- * Look up and return a brd's page for a given sector.
- * If one does not exist, allocate an empty page, and insert that. Then
- * return it.
+ * Insert a new page for a given sector, if one does not already exist.
*/
-static struct page *brd_insert_page(struct brd_device *brd, sector_t sector)
+static int brd_insert_page(struct brd_device *brd, sector_t sector)
{
pgoff_t idx;
struct page *page;
@@ -90,7 +88,7 @@ static struct page *brd_insert_page(stru
page = brd_lookup_page(brd, sector);
if (page)
- return page;
+ return 0;
/*
* Must use NOIO because we don't want to recurse back into the
@@ -99,11 +97,11 @@ static struct page *brd_insert_page(stru
gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM;
page = alloc_page(gfp_flags);
if (!page)
- return NULL;
+ return -ENOMEM;
if (radix_tree_preload(GFP_NOIO)) {
__free_page(page);
- return NULL;
+ return -ENOMEM;
}
spin_lock(&brd->brd_lock);
@@ -120,8 +118,7 @@ static struct page *brd_insert_page(stru
spin_unlock(&brd->brd_lock);
radix_tree_preload_end();
-
- return page;
+ return 0;
}
/*
@@ -174,16 +171,17 @@ static int copy_to_brd_setup(struct brd_
{
unsigned int offset = (sector & (PAGE_SECTORS-1)) << SECTOR_SHIFT;
size_t copy;
+ int ret;
copy = min_t(size_t, n, PAGE_SIZE - offset);
- if (!brd_insert_page(brd, sector))
- return -ENOSPC;
+ ret = brd_insert_page(brd, sector);
+ if (ret)
+ return ret;
if (copy < n) {
sector += copy >> SECTOR_SHIFT;
- if (!brd_insert_page(brd, sector))
- return -ENOSPC;
+ ret = brd_insert_page(brd, sector);
}
- return 0;
+ return ret;
}
/*
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 483/567] ima: Align ima_file_mmap() parameters with mmap_file LSM hook
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 482/567] brd: return 0/-error from brd_insert_page() Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 484/567] irqdomain: Fix association race Greg Kroah-Hartman
` (87 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roberto Sassu, Stefan Berger, Mimi Zohar
From: Roberto Sassu <roberto.sassu@huawei.com>
commit 4971c268b85e1c7a734a61622fc0813c86e2362e upstream.
Commit 98de59bfe4b2f ("take calculation of final prot in
security_mmap_file() into a helper") moved the code to update prot, to be
the actual protections applied to the kernel, to a new helper called
mmap_prot().
However, while without the helper ima_file_mmap() was getting the updated
prot, with the helper ima_file_mmap() gets the original prot, which
contains the protections requested by the application.
A possible consequence of this change is that, if an application calls
mmap() with only PROT_READ, and the kernel applies PROT_EXEC in addition,
that application would have access to executable memory without having this
event recorded in the IMA measurement list. This situation would occur for
example if the application, before mmap(), calls the personality() system
call with READ_IMPLIES_EXEC as the first argument.
Align ima_file_mmap() parameters with those of the mmap_file LSM hook, so
that IMA can receive both the requested prot and the final prot. Since the
requested protections are stored in a new variable, and the final
protections are stored in the existing variable, this effectively restores
the original behavior of the MMAP_CHECK hook.
Cc: stable@vger.kernel.org
Fixes: 98de59bfe4b2 ("take calculation of final prot in security_mmap_file() into a helper")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/ima.h | 6 ++++--
security/integrity/ima/ima_main.c | 7 +++++--
security/security.c | 7 ++++---
3 files changed, 13 insertions(+), 7 deletions(-)
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -21,7 +21,8 @@ extern int ima_file_check(struct file *f
extern void ima_post_create_tmpfile(struct user_namespace *mnt_userns,
struct inode *inode);
extern void ima_file_free(struct file *file);
-extern int ima_file_mmap(struct file *file, unsigned long prot);
+extern int ima_file_mmap(struct file *file, unsigned long reqprot,
+ unsigned long prot, unsigned long flags);
extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot);
extern int ima_load_data(enum kernel_load_data_id id, bool contents);
extern int ima_post_load_data(char *buf, loff_t size,
@@ -91,7 +92,8 @@ static inline void ima_file_free(struct
return;
}
-static inline int ima_file_mmap(struct file *file, unsigned long prot)
+static inline int ima_file_mmap(struct file *file, unsigned long reqprot,
+ unsigned long prot, unsigned long flags)
{
return 0;
}
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -395,7 +395,9 @@ out:
/**
* ima_file_mmap - based on policy, collect/store measurement.
* @file: pointer to the file to be measured (May be NULL)
- * @prot: contains the protection that will be applied by the kernel.
+ * @reqprot: protection requested by the application
+ * @prot: protection that will be applied by the kernel
+ * @flags: operational flags
*
* Measure files being mmapped executable based on the ima_must_measure()
* policy decision.
@@ -403,7 +405,8 @@ out:
* On success return 0. On integrity appraisal error, assuming the file
* is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
*/
-int ima_file_mmap(struct file *file, unsigned long prot)
+int ima_file_mmap(struct file *file, unsigned long reqprot,
+ unsigned long prot, unsigned long flags)
{
u32 secid;
--- a/security/security.c
+++ b/security/security.c
@@ -1592,12 +1592,13 @@ static inline unsigned long mmap_prot(st
int security_mmap_file(struct file *file, unsigned long prot,
unsigned long flags)
{
+ unsigned long prot_adj = mmap_prot(file, prot);
int ret;
- ret = call_int_hook(mmap_file, 0, file, prot,
- mmap_prot(file, prot), flags);
+
+ ret = call_int_hook(mmap_file, 0, file, prot, prot_adj, flags);
if (ret)
return ret;
- return ima_file_mmap(file, prot);
+ return ima_file_mmap(file, prot, prot_adj, flags);
}
int security_mmap_addr(unsigned long addr)
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 484/567] irqdomain: Fix association race
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 483/567] ima: Align ima_file_mmap() parameters with mmap_file LSM hook Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 485/567] irqdomain: Fix disassociation race Greg Kroah-Hartman
` (86 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hsin-Yi Wang, Mark-PK Tsai,
Johan Hovold, Marc Zyngier
From: Johan Hovold <johan+linaro@kernel.org>
commit b06730a571a9ff1ba5bd6b20bf9e50e5a12f1ec6 upstream.
The sanity check for an already mapped virq is done outside of the
irq_domain_mutex-protected section which means that an (unlikely) racing
association may not be detected.
Fix this by factoring out the association implementation, which will
also be used in a follow-on change to fix a shared-interrupt mapping
race.
Fixes: ddaf144c61da ("irqdomain: Refactor irq_domain_associate_many()")
Cc: stable@vger.kernel.org # 3.11
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-2-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/irqdomain.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -559,8 +559,8 @@ static void irq_domain_disassociate(stru
irq_domain_clear_mapping(domain, hwirq);
}
-int irq_domain_associate(struct irq_domain *domain, unsigned int virq,
- irq_hw_number_t hwirq)
+static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq,
+ irq_hw_number_t hwirq)
{
struct irq_data *irq_data = irq_get_irq_data(virq);
int ret;
@@ -573,7 +573,6 @@ int irq_domain_associate(struct irq_doma
if (WARN(irq_data->domain, "error: virq%i is already associated", virq))
return -EINVAL;
- mutex_lock(&irq_domain_mutex);
irq_data->hwirq = hwirq;
irq_data->domain = domain;
if (domain->ops->map) {
@@ -590,7 +589,6 @@ int irq_domain_associate(struct irq_doma
}
irq_data->domain = NULL;
irq_data->hwirq = 0;
- mutex_unlock(&irq_domain_mutex);
return ret;
}
@@ -601,12 +599,23 @@ int irq_domain_associate(struct irq_doma
domain->mapcount++;
irq_domain_set_mapping(domain, hwirq, irq_data);
- mutex_unlock(&irq_domain_mutex);
irq_clear_status_flags(virq, IRQ_NOREQUEST);
return 0;
}
+
+int irq_domain_associate(struct irq_domain *domain, unsigned int virq,
+ irq_hw_number_t hwirq)
+{
+ int ret;
+
+ mutex_lock(&irq_domain_mutex);
+ ret = irq_domain_associate_locked(domain, virq, hwirq);
+ mutex_unlock(&irq_domain_mutex);
+
+ return ret;
+}
EXPORT_SYMBOL_GPL(irq_domain_associate);
void irq_domain_associate_many(struct irq_domain *domain, unsigned int irq_base,
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 485/567] irqdomain: Fix disassociation race
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 484/567] irqdomain: Fix association race Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 486/567] irqdomain: Look for existing mapping only once Greg Kroah-Hartman
` (85 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hsin-Yi Wang, Mark-PK Tsai,
Johan Hovold, Marc Zyngier
From: Johan Hovold <johan+linaro@kernel.org>
commit 3f883c38f5628f46b30bccf090faec054088e262 upstream.
The global irq_domain_mutex is held when mapping interrupts from
non-hierarchical domains but currently not when disposing them.
This specifically means that updates of the domain mapcount is racy
(currently only used for statistics in debugfs).
Make sure to hold the global irq_domain_mutex also when disposing
mappings from non-hierarchical domains.
Fixes: 9dc6be3d4193 ("genirq/irqdomain: Add map counter")
Cc: stable@vger.kernel.org # 4.13
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-3-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/irqdomain.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -538,6 +538,9 @@ static void irq_domain_disassociate(stru
return;
hwirq = irq_data->hwirq;
+
+ mutex_lock(&irq_domain_mutex);
+
irq_set_status_flags(irq, IRQ_NOREQUEST);
/* remove chip and handler */
@@ -557,6 +560,8 @@ static void irq_domain_disassociate(stru
/* Clear reverse map for this hwirq */
irq_domain_clear_mapping(domain, hwirq);
+
+ mutex_unlock(&irq_domain_mutex);
}
static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq,
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 486/567] irqdomain: Look for existing mapping only once
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 485/567] irqdomain: Fix disassociation race Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 487/567] irqdomain: Drop bogus fwspec-mapping error handling Greg Kroah-Hartman
` (84 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hsin-Yi Wang, Mark-PK Tsai,
Johan Hovold, Marc Zyngier
From: Johan Hovold <johan+linaro@kernel.org>
commit 6e6f75c9c98d2d246d90411ff2b6f0cd271f4cba upstream.
Avoid looking for an existing mapping twice when creating a new mapping
using irq_create_fwspec_mapping() by factoring out the actual allocation
which is shared with irq_create_mapping_affinity().
The new helper function will also be used to fix a shared-interrupt
mapping race, hence the Fixes tag.
Fixes: b62b2cf5759b ("irqdomain: Fix handling of type settings for existing mappings")
Cc: stable@vger.kernel.org # 4.8
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-5-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/irqdomain.c | 60 ++++++++++++++++++++++++++-----------------------
1 file changed, 33 insertions(+), 27 deletions(-)
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -682,6 +682,34 @@ unsigned int irq_create_direct_mapping(s
EXPORT_SYMBOL_GPL(irq_create_direct_mapping);
#endif
+static unsigned int __irq_create_mapping_affinity(struct irq_domain *domain,
+ irq_hw_number_t hwirq,
+ const struct irq_affinity_desc *affinity)
+{
+ struct device_node *of_node = irq_domain_get_of_node(domain);
+ int virq;
+
+ pr_debug("irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq);
+
+ /* Allocate a virtual interrupt number */
+ virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node),
+ affinity);
+ if (virq <= 0) {
+ pr_debug("-> virq allocation failed\n");
+ return 0;
+ }
+
+ if (irq_domain_associate(domain, virq, hwirq)) {
+ irq_free_desc(virq);
+ return 0;
+ }
+
+ pr_debug("irq %lu on domain %s mapped to virtual irq %u\n",
+ hwirq, of_node_full_name(of_node), virq);
+
+ return virq;
+}
+
/**
* irq_create_mapping_affinity() - Map a hardware interrupt into linux irq space
* @domain: domain owning this hardware interrupt or NULL for default domain
@@ -694,14 +722,11 @@ EXPORT_SYMBOL_GPL(irq_create_direct_mapp
* on the number returned from that call.
*/
unsigned int irq_create_mapping_affinity(struct irq_domain *domain,
- irq_hw_number_t hwirq,
- const struct irq_affinity_desc *affinity)
+ irq_hw_number_t hwirq,
+ const struct irq_affinity_desc *affinity)
{
- struct device_node *of_node;
int virq;
- pr_debug("irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq);
-
/* Look for default domain if necessary */
if (domain == NULL)
domain = irq_default_domain;
@@ -709,34 +734,15 @@ unsigned int irq_create_mapping_affinity
WARN(1, "%s(, %lx) called with NULL domain\n", __func__, hwirq);
return 0;
}
- pr_debug("-> using domain @%p\n", domain);
-
- of_node = irq_domain_get_of_node(domain);
/* Check if mapping already exists */
virq = irq_find_mapping(domain, hwirq);
if (virq) {
- pr_debug("-> existing mapping on virq %d\n", virq);
+ pr_debug("existing mapping on virq %d\n", virq);
return virq;
}
- /* Allocate a virtual interrupt number */
- virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node),
- affinity);
- if (virq <= 0) {
- pr_debug("-> virq allocation failed\n");
- return 0;
- }
-
- if (irq_domain_associate(domain, virq, hwirq)) {
- irq_free_desc(virq);
- return 0;
- }
-
- pr_debug("irq %lu on domain %s mapped to virtual irq %u\n",
- hwirq, of_node_full_name(of_node), virq);
-
- return virq;
+ return __irq_create_mapping_affinity(domain, hwirq, affinity);
}
EXPORT_SYMBOL_GPL(irq_create_mapping_affinity);
@@ -841,7 +847,7 @@ unsigned int irq_create_fwspec_mapping(s
return 0;
} else {
/* Create mapping */
- virq = irq_create_mapping(domain, hwirq);
+ virq = __irq_create_mapping_affinity(domain, hwirq, NULL);
if (!virq)
return virq;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 487/567] irqdomain: Drop bogus fwspec-mapping error handling
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 486/567] irqdomain: Look for existing mapping only once Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 488/567] irqdomain: Fix domain registration race Greg Kroah-Hartman
` (83 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hsin-Yi Wang, Mark-PK Tsai,
Johan Hovold, Marc Zyngier
From: Johan Hovold <johan+linaro@kernel.org>
commit e3b7ab025e931accdc2c12acf9b75c6197f1c062 upstream.
In case a newly allocated IRQ ever ends up not having any associated
struct irq_data it would not even be possible to dispose the mapping.
Replace the bogus disposal with a WARN_ON().
This will also be used to fix a shared-interrupt mapping race, hence the
CC-stable tag.
Fixes: 1e2a7d78499e ("irqdomain: Don't set type when mapping an IRQ")
Cc: stable@vger.kernel.org # 4.8
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-4-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/irqdomain.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -853,13 +853,8 @@ unsigned int irq_create_fwspec_mapping(s
}
irq_data = irq_get_irq_data(virq);
- if (!irq_data) {
- if (irq_domain_is_hierarchy(domain))
- irq_domain_free_irqs(virq, 1);
- else
- irq_dispose_mapping(virq);
+ if (WARN_ON(!irq_data))
return 0;
- }
/* Store trigger type */
irqd_set_trigger_type(irq_data, type);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 488/567] irqdomain: Fix domain registration race
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 487/567] irqdomain: Drop bogus fwspec-mapping error handling Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 489/567] crypto: qat - fix out-of-bounds read Greg Kroah-Hartman
` (82 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Johan Hovold
From: Marc Zyngier <maz@kernel.org>
commit 8932c32c3053accd50702b36e944ac2016cd103c upstream.
Hierarchical domains created using irq_domain_create_hierarchy() are
currently added to the domain list before having been fully initialised.
This specifically means that a racing allocation request might fail to
allocate irq data for the inner domains of a hierarchy in case the
parent domain pointer has not yet been set up.
Note that this is not really any issue for irqchip drivers that are
registered early (e.g. via IRQCHIP_DECLARE() or IRQCHIP_ACPI_DECLARE())
but could potentially cause trouble with drivers that are registered
later (e.g. modular drivers using IRQCHIP_PLATFORM_DRIVER_BEGIN(),
gpiochip drivers, etc.).
Fixes: afb7da83b9f4 ("irqdomain: Introduce helper function irq_domain_add_hierarchy()")
Cc: stable@vger.kernel.org # 3.19
Signed-off-by: Marc Zyngier <maz@kernel.org>
[ johan: add commit message ]
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-8-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/irqdomain.c | 62 +++++++++++++++++++++++++++++++++----------------
1 file changed, 43 insertions(+), 19 deletions(-)
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -123,23 +123,12 @@ void irq_domain_free_fwnode(struct fwnod
}
EXPORT_SYMBOL_GPL(irq_domain_free_fwnode);
-/**
- * __irq_domain_add() - Allocate a new irq_domain data structure
- * @fwnode: firmware node for the interrupt controller
- * @size: Size of linear map; 0 for radix mapping only
- * @hwirq_max: Maximum number of interrupts supported by controller
- * @direct_max: Maximum value of direct maps; Use ~0 for no limit; 0 for no
- * direct mapping
- * @ops: domain callbacks
- * @host_data: Controller private data pointer
- *
- * Allocates and initializes an irq_domain structure.
- * Returns pointer to IRQ domain, or NULL on failure.
- */
-struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size,
- irq_hw_number_t hwirq_max, int direct_max,
- const struct irq_domain_ops *ops,
- void *host_data)
+static struct irq_domain *__irq_domain_create(struct fwnode_handle *fwnode,
+ unsigned int size,
+ irq_hw_number_t hwirq_max,
+ int direct_max,
+ const struct irq_domain_ops *ops,
+ void *host_data)
{
struct irqchip_fwid *fwid;
struct irq_domain *domain;
@@ -227,12 +216,44 @@ struct irq_domain *__irq_domain_add(stru
irq_domain_check_hierarchy(domain);
+ return domain;
+}
+
+static void __irq_domain_publish(struct irq_domain *domain)
+{
mutex_lock(&irq_domain_mutex);
debugfs_add_domain_dir(domain);
list_add(&domain->link, &irq_domain_list);
mutex_unlock(&irq_domain_mutex);
pr_debug("Added domain %s\n", domain->name);
+}
+
+/**
+ * __irq_domain_add() - Allocate a new irq_domain data structure
+ * @fwnode: firmware node for the interrupt controller
+ * @size: Size of linear map; 0 for radix mapping only
+ * @hwirq_max: Maximum number of interrupts supported by controller
+ * @direct_max: Maximum value of direct maps; Use ~0 for no limit; 0 for no
+ * direct mapping
+ * @ops: domain callbacks
+ * @host_data: Controller private data pointer
+ *
+ * Allocates and initializes an irq_domain structure.
+ * Returns pointer to IRQ domain, or NULL on failure.
+ */
+struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size,
+ irq_hw_number_t hwirq_max, int direct_max,
+ const struct irq_domain_ops *ops,
+ void *host_data)
+{
+ struct irq_domain *domain;
+
+ domain = __irq_domain_create(fwnode, size, hwirq_max, direct_max,
+ ops, host_data);
+ if (domain)
+ __irq_domain_publish(domain);
+
return domain;
}
EXPORT_SYMBOL_GPL(__irq_domain_add);
@@ -1117,12 +1138,15 @@ struct irq_domain *irq_domain_create_hie
struct irq_domain *domain;
if (size)
- domain = irq_domain_create_linear(fwnode, size, ops, host_data);
+ domain = __irq_domain_create(fwnode, size, size, 0, ops, host_data);
else
- domain = irq_domain_create_tree(fwnode, ops, host_data);
+ domain = __irq_domain_create(fwnode, 0, ~0, 0, ops, host_data);
+
if (domain) {
domain->parent = parent;
domain->flags |= flags;
+
+ __irq_domain_publish(domain);
}
return domain;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 489/567] crypto: qat - fix out-of-bounds read
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 488/567] irqdomain: Fix domain registration race Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 490/567] io_uring: handle TIF_NOTIFY_RESUME when checking for task_work Greg Kroah-Hartman
` (81 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladis Dronov, Giovanni Cabiddu,
Fiona Trahe, Herbert Xu
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
commit f6044cc3030e139f60c281386f28bda6e3049d66 upstream.
When preparing an AER-CTR request, the driver copies the key provided by
the user into a data structure that is accessible by the firmware.
If the target device is QAT GEN4, the key size is rounded up by 16 since
a rounded up size is expected by the device.
If the key size is rounded up before the copy, the size used for copying
the key might be bigger than the size of the region containing the key,
causing an out-of-bounds read.
Fix by doing the copy first and then update the keylen.
This is to fix the following warning reported by KASAN:
[ 138.150574] BUG: KASAN: global-out-of-bounds in qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat]
[ 138.150641] Read of size 32 at addr ffffffff88c402c0 by task cryptomgr_test/2340
[ 138.150651] CPU: 15 PID: 2340 Comm: cryptomgr_test Not tainted 6.2.0-rc1+ #45
[ 138.150659] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0087.D13.2208261706 08/26/2022
[ 138.150663] Call Trace:
[ 138.150668] <TASK>
[ 138.150922] kasan_check_range+0x13a/0x1c0
[ 138.150931] memcpy+0x1f/0x60
[ 138.150940] qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat]
[ 138.151006] qat_alg_skcipher_init_sessions+0xc1/0x240 [intel_qat]
[ 138.151073] crypto_skcipher_setkey+0x82/0x160
[ 138.151085] ? prepare_keybuf+0xa2/0xd0
[ 138.151095] test_skcipher_vec_cfg+0x2b8/0x800
Fixes: 67916c951689 ("crypto: qat - add AES-CTR support for QAT GEN4 devices")
Cc: <stable@vger.kernel.org>
Reported-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Reviewed-by: Vladis Dronov <vdronov@redhat.com>
Tested-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/qat/qat_common/qat_algs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -434,8 +434,8 @@ static void qat_alg_skcipher_init_com(st
} else if (aes_v2_capable && mode == ICP_QAT_HW_CIPHER_CTR_MODE) {
ICP_QAT_FW_LA_SLICE_TYPE_SET(header->serv_specif_flags,
ICP_QAT_FW_LA_USE_UCS_SLICE_TYPE);
- keylen = round_up(keylen, 16);
memcpy(cd->ucs_aes.key, key, keylen);
+ keylen = round_up(keylen, 16);
} else {
memcpy(cd->aes.key, key, keylen);
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 490/567] io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 489/567] crypto: qat - fix out-of-bounds read Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 491/567] io_uring: mark task TASK_RUNNING before handling resume/task work Greg Kroah-Hartman
` (80 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe
From: Jens Axboe <axboe@kernel.dk>
commit b5d3ae202fbfe055aa2a8ae8524531ee1dcab717 upstream.
If TIF_NOTIFY_RESUME is set, then we need to call resume_user_mode_work()
for PF_IO_WORKER threads. They never return to usermode, hence never get
a chance to process any items that are marked by this flag. Most notably
this includes the final put of files, but also any throttling markers set
by block cgroups.
Cc: stable@vger.kernel.org # 5.10+
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2463,6 +2463,13 @@ static inline unsigned int io_put_rw_kbu
static inline bool io_run_task_work(void)
{
+ /*
+ * PF_IO_WORKER never returns to userspace, so check here if we have
+ * notify work that needs processing.
+ */
+ if (current->flags & PF_IO_WORKER &&
+ test_thread_flag(TIF_NOTIFY_RESUME))
+ tracehook_notify_resume(NULL);
if (test_thread_flag(TIF_NOTIFY_SIGNAL) || current->task_works) {
__set_current_state(TASK_RUNNING);
tracehook_notify_signal();
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 491/567] io_uring: mark task TASK_RUNNING before handling resume/task work
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 490/567] io_uring: handle TIF_NOTIFY_RESUME when checking for task_work Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 492/567] io_uring: add a conditional reschedule to the IOPOLL cancelation loop Greg Kroah-Hartman
` (79 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, kernel test robot, Jens Axboe
From: Jens Axboe <axboe@kernel.dk>
commit 2f2bb1ffc9983e227424d0787289da5483b0c74f upstream.
Just like for task_work, set the task mode to TASK_RUNNING before doing
potential resume work. We're not holding any locks at this point,
but we may have already set the task state to TASK_INTERRUPTIBLE in
preparation for going to sleep waiting for events. Ensure that we set it
back to TASK_RUNNING if we have work to process, to avoid warnings on
calling blocking operations with !TASK_RUNNING.
Fixes: b5d3ae202fbf ("io_uring: handle TIF_NOTIFY_RESUME when checking for task_work")
Reported-by: kernel test robot <oliver.sang@intel.com>
Link: https://lore.kernel.org/oe-lkp/202302062208.24d3e563-oliver.sang@intel.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2468,8 +2468,10 @@ static inline bool io_run_task_work(void
* notify work that needs processing.
*/
if (current->flags & PF_IO_WORKER &&
- test_thread_flag(TIF_NOTIFY_RESUME))
+ test_thread_flag(TIF_NOTIFY_RESUME)) {
+ __set_current_state(TASK_RUNNING);
tracehook_notify_resume(NULL);
+ }
if (test_thread_flag(TIF_NOTIFY_SIGNAL) || current->task_works) {
__set_current_state(TASK_RUNNING);
tracehook_notify_signal();
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 492/567] io_uring: add a conditional reschedule to the IOPOLL cancelation loop
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 491/567] io_uring: mark task TASK_RUNNING before handling resume/task work Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 493/567] io_uring/rsrc: disallow multi-source reg buffers Greg Kroah-Hartman
` (78 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe
From: Jens Axboe <axboe@kernel.dk>
commit fcc926bb857949dbfa51a7d95f3f5ebc657f198c upstream.
If the kernel is configured with CONFIG_PREEMPT_NONE, we could be
sitting in a tight loop reaping events but not giving them a chance to
finish. This results in a trace ala:
rcu: INFO: rcu_sched self-detected stall on CPU
rcu: 2-...!: (5249 ticks this GP) idle=935c/1/0x4000000000000000 softirq=4265/4274 fqs=1
(t=5251 jiffies g=465 q=4135 ncpus=4)
rcu: rcu_sched kthread starved for 5249 jiffies! g465 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_sched kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_sched state:R running task stack:0 pid:12 ppid:2 flags:0x00000008
Call trace:
__switch_to+0xb0/0xc8
__schedule+0x43c/0x520
schedule+0x4c/0x98
schedule_timeout+0xbc/0xdc
rcu_gp_fqs_loop+0x308/0x344
rcu_gp_kthread+0xd8/0xf0
kthread+0xb8/0xc8
ret_from_fork+0x10/0x20
rcu: Stack dump where RCU GP kthread last ran:
Task dump for CPU 0:
task:kworker/u8:10 state:R running task stack:0 pid:89 ppid:2 flags:0x0000000a
Workqueue: events_unbound io_ring_exit_work
Call trace:
__switch_to+0xb0/0xc8
0xffff0000c8fefd28
CPU: 2 PID: 95 Comm: kworker/u8:13 Not tainted 6.2.0-rc5-00042-g40316e337c80-dirty #2759
Hardware name: linux,dummy-virt (DT)
Workqueue: events_unbound io_ring_exit_work
pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : io_do_iopoll+0x344/0x360
lr : io_do_iopoll+0xb8/0x360
sp : ffff800009bebc60
x29: ffff800009bebc60 x28: 0000000000000000 x27: 0000000000000000
x26: ffff0000c0f67d48 x25: ffff0000c0f67840 x24: ffff800008950024
x23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c27d3200
x20: ffff0000c0f67840 x19: ffff0000c0f67800 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000001 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000179 x10: 0000000000000870 x9 : ffff800009bebd60
x8 : ffff0000c27d3ad0 x7 : fefefefefefefeff x6 : 0000646e756f626e
x5 : ffff0000c0f67840 x4 : 0000000000000000 x3 : ffff0000c2398000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
io_do_iopoll+0x344/0x360
io_uring_try_cancel_requests+0x21c/0x334
io_ring_exit_work+0x90/0x40c
process_one_work+0x1a4/0x254
worker_thread+0x1ec/0x258
kthread+0xb8/0xc8
ret_from_fork+0x10/0x20
Add a cond_resched() in the cancelation IOPOLL loop to fix this.
Cc: stable@vger.kernel.org # 5.10+
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 1 +
1 file changed, 1 insertion(+)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -9861,6 +9861,7 @@ static void io_uring_try_cancel_requests
while (!list_empty_careful(&ctx->iopoll_list)) {
io_iopoll_try_reap_events(ctx);
ret = true;
+ cond_resched();
}
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 493/567] io_uring/rsrc: disallow multi-source reg buffers
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 492/567] io_uring: add a conditional reschedule to the IOPOLL cancelation loop Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 494/567] io_uring: remove MSG_NOSIGNAL from recvmsg Greg Kroah-Hartman
` (77 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pavel Begunkov, Jens Axboe
From: Pavel Begunkov <asml.silence@gmail.com>
commit edd478269640b360c6f301f2baa04abdda563ef3 upstream.
If two or more mappings go back to back to each other they can be passed
into io_uring to be registered as a single registered buffer. That would
even work if mappings came from different sources, e.g. it's possible to
mix in this way anon pages and pages from shmem or hugetlb. That is not
a problem but it'd rather be less prone if we forbid such mixing.
Cc: <stable@vger.kernel.org>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -9228,14 +9228,17 @@ static int io_sqe_buffer_register(struct
pret = pin_user_pages(ubuf, nr_pages, FOLL_WRITE | FOLL_LONGTERM,
pages, vmas);
if (pret == nr_pages) {
+ struct file *file = vmas[0]->vm_file;
+
/* don't support file backed memory */
for (i = 0; i < nr_pages; i++) {
- struct vm_area_struct *vma = vmas[i];
-
- if (vma_is_shmem(vma))
+ if (vmas[i]->vm_file != file) {
+ ret = -EINVAL;
+ break;
+ }
+ if (!file)
continue;
- if (vma->vm_file &&
- !is_file_hugepages(vma->vm_file)) {
+ if (!vma_is_shmem(vmas[i]) && !is_file_hugepages(file)) {
ret = -EOPNOTSUPP;
break;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 494/567] io_uring: remove MSG_NOSIGNAL from recvmsg
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 493/567] io_uring/rsrc: disallow multi-source reg buffers Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 495/567] io_uring/poll: allow some retries for poll triggering spuriously Greg Kroah-Hartman
` (76 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Lamparter, Eric Dumazet, Jens Axboe
From: David Lamparter <equinox@diac24.ne>
commit 7605c43d67face310b4b87dee1a28bc0c8cd8c0f upstream.
MSG_NOSIGNAL is not applicable for the receiving side, SIGPIPE is
generated when trying to write to a "broken pipe". AF_PACKET's
packet_recvmsg() does enforce this, giving back EINVAL when MSG_NOSIGNAL
is set - making it unuseable in io_uring's recvmsg.
Remove MSG_NOSIGNAL from io_recvmsg_prep().
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: David Lamparter <equinox@diac24.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230224150123.128346-1-equinox@diac24.net
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -5141,7 +5141,7 @@ static int io_recvmsg_prep(struct io_kio
sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr));
sr->len = READ_ONCE(sqe->len);
sr->bgid = READ_ONCE(sqe->buf_group);
- sr->msg_flags = READ_ONCE(sqe->msg_flags) | MSG_NOSIGNAL;
+ sr->msg_flags = READ_ONCE(sqe->msg_flags);
if (sr->msg_flags & MSG_DONTWAIT)
req->flags |= REQ_F_NOWAIT;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 495/567] io_uring/poll: allow some retries for poll triggering spuriously
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 494/567] io_uring: remove MSG_NOSIGNAL from recvmsg Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 496/567] ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() Greg Kroah-Hartman
` (75 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe
From: Jens Axboe <axboe@kernel.dk>
commit c16bda37594f83147b167d381d54c010024efecf upstream.
If we get woken spuriously when polling and fail the operation with
-EAGAIN again, then we generally only allow polling again if data
had been transferred at some point. This is indicated with
REQ_F_PARTIAL_IO. However, if the spurious poll triggers when the socket
was originally empty, then we haven't transferred data yet and we will
fail the poll re-arm. This either punts the socket to io-wq if it's
blocking, or it fails the request with -EAGAIN if not. Neither condition
is desirable, as the former will slow things down, while the latter
will make the application confused.
We want to ensure that a repeated poll trigger doesn't lead to infinite
work making no progress, that's what the REQ_F_PARTIAL_IO check was
for. But it doesn't protect against a loop post the first receive, and
it's unnecessarily strict if we started out with an empty socket.
Add a somewhat random retry count, just to put an upper limit on the
potential number of retries that will be done. This should be high enough
that we won't really hit it in practice, unless something needs to be
aborted anyway.
Cc: stable@vger.kernel.org # v5.10+
Link: https://github.com/axboe/liburing/issues/364
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -486,6 +486,7 @@ struct io_poll_iocb {
struct file *file;
struct wait_queue_head *head;
__poll_t events;
+ int retries;
struct wait_queue_entry wait;
};
@@ -5894,6 +5895,14 @@ enum {
IO_APOLL_READY
};
+/*
+ * We can't reliably detect loops in repeated poll triggers and issue
+ * subsequently failing. But rather than fail these immediately, allow a
+ * certain amount of retries before we give up. Given that this condition
+ * should _rarely_ trigger even once, we should be fine with a larger value.
+ */
+#define APOLL_MAX_RETRY 128
+
static int io_arm_poll_handler(struct io_kiocb *req)
{
const struct io_op_def *def = &io_op_defs[req->opcode];
@@ -5905,8 +5914,6 @@ static int io_arm_poll_handler(struct io
if (!req->file || !file_can_poll(req->file))
return IO_APOLL_ABORTED;
- if ((req->flags & (REQ_F_POLLED|REQ_F_PARTIAL_IO)) == REQ_F_POLLED)
- return IO_APOLL_ABORTED;
if (!def->pollin && !def->pollout)
return IO_APOLL_ABORTED;
@@ -5924,8 +5931,13 @@ static int io_arm_poll_handler(struct io
if (req->flags & REQ_F_POLLED) {
apoll = req->apoll;
kfree(apoll->double_poll);
+ if (unlikely(!--apoll->poll.retries)) {
+ apoll->double_poll = NULL;
+ return IO_APOLL_ABORTED;
+ }
} else {
apoll = kmalloc(sizeof(*apoll), GFP_ATOMIC);
+ apoll->poll.retries = APOLL_MAX_RETRY;
}
if (unlikely(!apoll))
return IO_APOLL_ABORTED;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 496/567] ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 495/567] io_uring/poll: allow some retries for poll triggering spuriously Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 497/567] ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC Greg Kroah-Hartman
` (74 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dmitry Fomin, Takashi Iwai
From: Dmitry Fomin <fomindmitriyfoma@mail.ru>
commit 951606a14a8901e3551fe4d8d3cedd73fe954ce1 upstream.
If snd_ctl_add() fails in aureon_add_controls(), it immediately returns
and leaves ice->gpio_mutex locked. ice->gpio_mutex locks in
snd_ice1712_save_gpio_status and unlocks in
snd_ice1712_restore_gpio_status(ice).
It seems that the mutex is required only for aureon_cs8415_get(),
so snd_ice1712_restore_gpio_status(ice) can be placed
just after that. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Dmitry Fomin <fomindmitriyfoma@mail.ru>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230225184322.6286-1-fomindmitriyfoma@mail.ru
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/ice1712/aureon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/ice1712/aureon.c
+++ b/sound/pci/ice1712/aureon.c
@@ -1892,6 +1892,7 @@ static int aureon_add_controls(struct sn
unsigned char id;
snd_ice1712_save_gpio_status(ice);
id = aureon_cs8415_get(ice, CS8415_ID);
+ snd_ice1712_restore_gpio_status(ice);
if (id != 0x41)
dev_info(ice->card->dev,
"No CS8415 chip. Skipping CS8415 controls.\n");
@@ -1909,7 +1910,6 @@ static int aureon_add_controls(struct sn
kctl->id.device = ice->pcm->device;
}
}
- snd_ice1712_restore_gpio_status(ice);
}
return 0;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 497/567] ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 496/567] ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 498/567] jbd2: fix data missing when reusing bh which is ready to be checkpointed Greg Kroah-Hartman
` (73 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Łukasz Stelmach, Takashi Iwai
From: Łukasz Stelmach <l.stelmach@samsung.com>
commit ea24b9953bcd3889f77a66e7f1d7e86e995dd9c3 upstream.
HP EliteDesk 800 G6 Tower PC (103c:870c) requires a quirk for enabling
headset-mic.
Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Cc: <stable@vger.kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217008
Link: https://lore.kernel.org/r/20230223074749.1026060-1-l.stelmach@samsung.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -11236,6 +11236,7 @@ static const struct snd_pci_quirk alc662
SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
+ SND_PCI_QUIRK(0x103c, 0x870c, "HP", ALC897_FIXUP_HP_HSMIC_VERB),
SND_PCI_QUIRK(0x103c, 0x8719, "HP", ALC897_FIXUP_HP_HSMIC_VERB),
SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2),
SND_PCI_QUIRK(0x103c, 0x877e, "HP 288 Pro G6", ALC671_FIXUP_HP_HEADSET_MIC2),
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 498/567] jbd2: fix data missing when reusing bh which is ready to be checkpointed
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 497/567] ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 499/567] ext4: optimize ea_inode block expansion Greg Kroah-Hartman
` (72 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Zhihao Cheng, zhanchengbin,
Jan Kara, Theodore Tso
From: Zhihao Cheng <chengzhihao1@huawei.com>
commit e6b9bd7290d334451ce054e98e752abc055e0034 upstream.
Following process will make data lost and could lead to a filesystem
corrupted problem:
1. jh(bh) is inserted into T1->t_checkpoint_list, bh is dirty, and
jh->b_transaction = NULL
2. T1 is added into journal->j_checkpoint_transactions.
3. Get bh prepare to write while doing checkpoing:
PA PB
do_get_write_access jbd2_log_do_checkpoint
spin_lock(&jh->b_state_lock)
if (buffer_dirty(bh))
clear_buffer_dirty(bh) // clear buffer dirty
set_buffer_jbddirty(bh)
transaction =
journal->j_checkpoint_transactions
jh = transaction->t_checkpoint_list
if (!buffer_dirty(bh))
__jbd2_journal_remove_checkpoint(jh)
// bh won't be flushed
jbd2_cleanup_journal_tail
__jbd2_journal_file_buffer(jh, transaction, BJ_Reserved)
4. Aborting journal/Power-cut before writing latest bh on journal area.
In this way we get a corrupted filesystem with bh's data lost.
Fix it by moving the clearing of buffer_dirty bit just before the call
to __jbd2_journal_file_buffer(), both bit clearing and jh->b_transaction
assignment are under journal->j_list_lock locked, so that
jbd2_log_do_checkpoint() will wait until jh's new transaction fininshed
even bh is currently not dirty. And journal_shrink_one_cp_list() won't
remove jh from checkpoint list if the buffer head is reused in
do_get_write_access().
Fetch a reproducer in [Link].
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216898
Cc: <stable@kernel.org>
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: zhanchengbin <zhanchengbin1@huawei.com>
Suggested-by: Jan Kara <jack@suse.cz>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230110015327.1181863-1-chengzhihao1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jbd2/transaction.c | 50 +++++++++++++++++++++++++++++---------------------
1 file changed, 29 insertions(+), 21 deletions(-)
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1001,36 +1001,28 @@ repeat:
* ie. locked but not dirty) or tune2fs (which may actually have
* the buffer dirtied, ugh.) */
- if (buffer_dirty(bh)) {
+ if (buffer_dirty(bh) && jh->b_transaction) {
+ warn_dirty_buffer(bh);
/*
- * First question: is this buffer already part of the current
- * transaction or the existing committing transaction?
- */
- if (jh->b_transaction) {
- J_ASSERT_JH(jh,
- jh->b_transaction == transaction ||
- jh->b_transaction ==
- journal->j_committing_transaction);
- if (jh->b_next_transaction)
- J_ASSERT_JH(jh, jh->b_next_transaction ==
- transaction);
- warn_dirty_buffer(bh);
- }
- /*
- * In any case we need to clean the dirty flag and we must
- * do it under the buffer lock to be sure we don't race
- * with running write-out.
+ * We need to clean the dirty flag and we must do it under the
+ * buffer lock to be sure we don't race with running write-out.
*/
JBUFFER_TRACE(jh, "Journalling dirty buffer");
clear_buffer_dirty(bh);
+ /*
+ * The buffer is going to be added to BJ_Reserved list now and
+ * nothing guarantees jbd2_journal_dirty_metadata() will be
+ * ever called for it. So we need to set jbddirty bit here to
+ * make sure the buffer is dirtied and written out when the
+ * journaling machinery is done with it.
+ */
set_buffer_jbddirty(bh);
}
- unlock_buffer(bh);
-
error = -EROFS;
if (is_handle_aborted(handle)) {
spin_unlock(&jh->b_state_lock);
+ unlock_buffer(bh);
goto out;
}
error = 0;
@@ -1040,8 +1032,10 @@ repeat:
* b_next_transaction points to it
*/
if (jh->b_transaction == transaction ||
- jh->b_next_transaction == transaction)
+ jh->b_next_transaction == transaction) {
+ unlock_buffer(bh);
goto done;
+ }
/*
* this is the first time this transaction is touching this buffer,
@@ -1065,10 +1059,24 @@ repeat:
*/
smp_wmb();
spin_lock(&journal->j_list_lock);
+ if (test_clear_buffer_dirty(bh)) {
+ /*
+ * Execute buffer dirty clearing and jh->b_transaction
+ * assignment under journal->j_list_lock locked to
+ * prevent bh being removed from checkpoint list if
+ * the buffer is in an intermediate state (not dirty
+ * and jh->b_transaction is NULL).
+ */
+ JBUFFER_TRACE(jh, "Journalling dirty buffer");
+ set_buffer_jbddirty(bh);
+ }
__jbd2_journal_file_buffer(jh, transaction, BJ_Reserved);
spin_unlock(&journal->j_list_lock);
+ unlock_buffer(bh);
goto done;
}
+ unlock_buffer(bh);
+
/*
* If there is already a copy-out version of this buffer, then we don't
* need to make another one
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 499/567] ext4: optimize ea_inode block expansion
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 498/567] jbd2: fix data missing when reusing bh which is ready to be checkpointed Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 500/567] ext4: refuse to create ea block when umounted Greg Kroah-Hartman
` (71 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+2dacb8f015bf1420155f, stable,
Jun Nie, Theodore Tso
From: Jun Nie <jun.nie@linaro.org>
commit 1e9d62d252812575ded7c620d8fc67c32ff06c16 upstream.
Copy ea data from inode entry when expanding ea block if possible.
Then remove the ea entry if expansion success. Thus memcpy to a
temporary buffer may be avoided.
If the expansion fails, we do not need to recovery the removed ea
entry neither in this way.
Reported-by: syzbot+2dacb8f015bf1420155f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=3613786cb88c93aa1c6a279b1df6a7b201347d08
Link: https://lore.kernel.org/r/20230103014517.495275-2-jun.nie@linaro.org
Cc: stable@kernel.org
Signed-off-by: Jun Nie <jun.nie@linaro.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/xattr.c | 28 +++++++++++++++++-----------
1 file changed, 17 insertions(+), 11 deletions(-)
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -2549,9 +2549,8 @@ static int ext4_xattr_move_to_block(hand
is = kzalloc(sizeof(struct ext4_xattr_ibody_find), GFP_NOFS);
bs = kzalloc(sizeof(struct ext4_xattr_block_find), GFP_NOFS);
- buffer = kvmalloc(value_size, GFP_NOFS);
b_entry_name = kmalloc(entry->e_name_len + 1, GFP_NOFS);
- if (!is || !bs || !buffer || !b_entry_name) {
+ if (!is || !bs || !b_entry_name) {
error = -ENOMEM;
goto out;
}
@@ -2563,12 +2562,18 @@ static int ext4_xattr_move_to_block(hand
/* Save the entry name and the entry value */
if (entry->e_value_inum) {
+ buffer = kvmalloc(value_size, GFP_NOFS);
+ if (!buffer) {
+ error = -ENOMEM;
+ goto out;
+ }
+
error = ext4_xattr_inode_get(inode, entry, buffer, value_size);
if (error)
goto out;
} else {
size_t value_offs = le16_to_cpu(entry->e_value_offs);
- memcpy(buffer, (void *)IFIRST(header) + value_offs, value_size);
+ buffer = (void *)IFIRST(header) + value_offs;
}
memcpy(b_entry_name, entry->e_name, entry->e_name_len);
@@ -2583,25 +2588,26 @@ static int ext4_xattr_move_to_block(hand
if (error)
goto out;
- /* Remove the chosen entry from the inode */
- error = ext4_xattr_ibody_set(handle, inode, &i, is);
- if (error)
- goto out;
-
i.value = buffer;
i.value_len = value_size;
error = ext4_xattr_block_find(inode, &i, bs);
if (error)
goto out;
- /* Add entry which was removed from the inode into the block */
+ /* Move ea entry from the inode into the block */
error = ext4_xattr_block_set(handle, inode, &i, bs);
if (error)
goto out;
- error = 0;
+
+ /* Remove the chosen entry from the inode */
+ i.value = NULL;
+ i.value_len = 0;
+ error = ext4_xattr_ibody_set(handle, inode, &i, is);
+
out:
kfree(b_entry_name);
- kvfree(buffer);
+ if (entry->e_value_inum && buffer)
+ kvfree(buffer);
if (is)
brelse(is->iloc.bh);
if (bs)
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 500/567] ext4: refuse to create ea block when umounted
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 499/567] ext4: optimize ea_inode block expansion Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 501/567] ext4: Fix possible corruption when moving a directory Greg Kroah-Hartman
` (70 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+2dacb8f015bf1420155f, stable,
Jun Nie, Theodore Tso
From: Jun Nie <jun.nie@linaro.org>
commit f31173c19901a96bb2ebf6bcfec8a08df7095c91 upstream.
The ea block expansion need to access s_root while it is
already set as NULL when umount is triggered. Refuse this
request to avoid panic.
Reported-by: syzbot+2dacb8f015bf1420155f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=3613786cb88c93aa1c6a279b1df6a7b201347d08
Link: https://lore.kernel.org/r/20230103014517.495275-3-jun.nie@linaro.org
Cc: stable@kernel.org
Signed-off-by: Jun Nie <jun.nie@linaro.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/xattr.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1422,6 +1422,13 @@ static struct inode *ext4_xattr_inode_cr
uid_t owner[2] = { i_uid_read(inode), i_gid_read(inode) };
int err;
+ if (inode->i_sb->s_root == NULL) {
+ ext4_warning(inode->i_sb,
+ "refuse to create EA inode when umounting");
+ WARN_ON(1);
+ return ERR_PTR(-EINVAL);
+ }
+
/*
* Let the next inode be the goal, so we try and allocate the EA inode
* in the same group, or nearby one.
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 501/567] ext4: Fix possible corruption when moving a directory
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 500/567] ext4: refuse to create ea block when umounted Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 502/567] mtd: spi-nor: sfdp: Fix index value for SCCR dwords Greg Kroah-Hartman
` (69 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Theodore Tso
From: Jan Kara <jack@suse.cz>
commit 0813299c586b175d7edb25f56412c54b812d0379 upstream.
When we are renaming a directory to a different directory, we need to
update '..' entry in the moved directory. However nothing prevents moved
directory from being modified and even converted from the inline format
to the normal format. When such race happens the rename code gets
confused and we crash. Fix the problem by locking the moved directory.
CC: stable@vger.kernel.org
Fixes: 32f7f22c0b52 ("ext4: let ext4_rename handle inline dir")
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230126112221.11866-1-jack@suse.cz
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/namei.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3886,9 +3886,16 @@ static int ext4_rename(struct user_names
if (new.dir != old.dir && EXT4_DIR_LINK_MAX(new.dir))
goto end_rename;
}
+ /*
+ * We need to protect against old.inode directory getting
+ * converted from inline directory format into a normal one.
+ */
+ inode_lock_nested(old.inode, I_MUTEX_NONDIR2);
retval = ext4_rename_dir_prepare(handle, &old);
- if (retval)
+ if (retval) {
+ inode_unlock(old.inode);
goto end_rename;
+ }
}
/*
* If we're renaming a file within an inline_data dir and adding or
@@ -4013,6 +4020,8 @@ end_rename:
} else {
ext4_journal_stop(handle);
}
+ if (old.dir_bh)
+ inode_unlock(old.inode);
release_bh:
brelse(old.dir_bh);
brelse(old.bh);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 502/567] mtd: spi-nor: sfdp: Fix index value for SCCR dwords
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 501/567] ext4: Fix possible corruption when moving a directory Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:03 ` [PATCH 5.15 503/567] mtd: spi-nor: spansion: Consider reserved bits in CFR5 register Greg Kroah-Hartman
` (68 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Takahiro Kuwano, Tudor Ambarus,
Michael Walle
From: Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
commit ad9679f3811899fd1c21dc7bdd715e8e1cfb46b9 upstream.
Array index for SCCR 22th DOWRD should be 21.
Fixes: 981a8d60e01f ("mtd: spi-nor: Parse SFDP SCCR Map")
Signed-off-by: Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Reviewed-by: Michael Walle <michael@walle.cc>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/d8a2a77c2c95cf776e7dcae6392d29fdcf5d6307.1672026365.git.Takahiro.Kuwano@infineon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/spi-nor/sfdp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -1220,7 +1220,7 @@ static int spi_nor_parse_sccr(struct spi
le32_to_cpu_array(dwords, sccr_header->length);
- if (FIELD_GET(SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE, dwords[22]))
+ if (FIELD_GET(SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE, dwords[21]))
nor->flags |= SNOR_F_IO_MODE_EN_VOLATILE;
out:
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 503/567] mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 502/567] mtd: spi-nor: sfdp: Fix index value for SCCR dwords Greg Kroah-Hartman
@ 2023-03-07 17:03 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 504/567] mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type Greg Kroah-Hartman
` (67 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:03 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Takahiro Kuwano, Tudor Ambarus,
Dhruva Gole, Pratyush Yadav
From: Tudor Ambarus <tudor.ambarus@linaro.org>
commit 3f592a869f87723314f0cb1ac232bd3bf8245be8 upstream.
CFR5[6] is reserved bit and must be always 1. Set it to comply with flash
requirements. While fixing SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_{EN, DS}
definition, stop using magic numbers and describe the missing bit fields
in CFR5 register. This is useful for both readability and future possible
addition of Octal STR mode support.
Fixes: c3266af101f2 ("mtd: spi-nor: spansion: add support for Cypress Semper flash")
Cc: stable@vger.kernel.org
Reported-by: Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Reviewed-by: Dhruva Gole <d-gole@ti.com>
Reviewed-by: Pratyush Yadav <ptyadav@amazon.de>
Tested-by: Dhruva Gole <d-gole@ti.com>
Link: https://lore.kernel.org/linux-mtd/20230110164703.83413-1-tudor.ambarus@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/spi-nor/spansion.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/mtd/spi-nor/spansion.c
+++ b/drivers/mtd/spi-nor/spansion.c
@@ -15,8 +15,13 @@
#define SPINOR_REG_CYPRESS_CFR3V 0x00800004
#define SPINOR_REG_CYPRESS_CFR3V_PGSZ BIT(4) /* Page size. */
#define SPINOR_REG_CYPRESS_CFR5V 0x00800006
-#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_EN 0x3
-#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_DS 0
+#define SPINOR_REG_CYPRESS_CFR5_BIT6 BIT(6)
+#define SPINOR_REG_CYPRESS_CFR5_DDR BIT(1)
+#define SPINOR_REG_CYPRESS_CFR5_OPI BIT(0)
+#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_EN \
+ (SPINOR_REG_CYPRESS_CFR5_BIT6 | SPINOR_REG_CYPRESS_CFR5_DDR | \
+ SPINOR_REG_CYPRESS_CFR5_OPI)
+#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_DS SPINOR_REG_CYPRESS_CFR5_BIT6
#define SPINOR_OP_CYPRESS_RD_FAST 0xee
/**
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 504/567] mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2023-03-07 17:03 ` [PATCH 5.15 503/567] mtd: spi-nor: spansion: Consider reserved bits in CFR5 register Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 505/567] dm: send just one event on resize, not two Greg Kroah-Hartman
` (66 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Stein, Louis Rannou,
Tudor Ambarus
From: Louis Rannou <lrannou@baylibre.com>
commit f0f0cfdc3a024e21161714f2e05f0df3b84d42ad upstream.
spi_nor_set_erase_type() was used either to set or to mask out an erase
type. When we used it to mask out an erase type a shift-out-of-bounds
was hit:
UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24
shift exponent 4294967295 is too large for 32-bit type 'int'
The setting of the size_{shift, mask} and of the opcode are unnecessary
when the erase size is zero, as throughout the code just the erase size
is considered to determine whether an erase type is supported or not.
Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF
is an unused opcode. Thus when masking out an erase type, just set the
erase size to zero. This will fix the shift-out-of-bounds.
Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories")
Cc: stable@vger.kernel.org
Reported-by: Alexander Stein <Alexander.Stein@tq-group.com>
Signed-off-by: Louis Rannou <lrannou@baylibre.com>
Tested-by: Alexander Stein <Alexander.Stein@tq-group.com>
Link: https://lore.kernel.org/r/20230203070754.50677-1-tudor.ambarus@linaro.org
[ta: refine changes, new commit message, fix compilation error]
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/spi-nor/core.c | 9 +++++++++
drivers/mtd/spi-nor/core.h | 1 +
drivers/mtd/spi-nor/sfdp.c | 4 ++--
3 files changed, 12 insertions(+), 2 deletions(-)
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -2247,6 +2247,15 @@ void spi_nor_set_erase_type(struct spi_n
}
/**
+ * spi_nor_mask_erase_type() - mask out a SPI NOR erase type
+ * @erase: pointer to a structure that describes a SPI NOR erase type
+ */
+void spi_nor_mask_erase_type(struct spi_nor_erase_type *erase)
+{
+ erase->size = 0;
+}
+
+/**
* spi_nor_init_uniform_erase_map() - Initialize uniform erase map
* @map: the erase map of the SPI NOR
* @erase_mask: bitmask encoding erase types that can erase the entire
--- a/drivers/mtd/spi-nor/core.h
+++ b/drivers/mtd/spi-nor/core.h
@@ -538,6 +538,7 @@ void spi_nor_set_pp_settings(struct spi_
void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size,
u8 opcode);
+void spi_nor_mask_erase_type(struct spi_nor_erase_type *erase);
struct spi_nor_erase_region *
spi_nor_region_next(struct spi_nor_erase_region *region);
void spi_nor_init_uniform_erase_map(struct spi_nor_erase_map *map,
--- a/drivers/mtd/spi-nor/sfdp.c
+++ b/drivers/mtd/spi-nor/sfdp.c
@@ -874,7 +874,7 @@ static int spi_nor_init_non_uniform_eras
*/
for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++)
if (!(regions_erase_type & BIT(erase[i].idx)))
- spi_nor_set_erase_type(&erase[i], 0, 0xFF);
+ spi_nor_mask_erase_type(&erase[i]);
return 0;
}
@@ -1088,7 +1088,7 @@ static int spi_nor_parse_4bait(struct sp
erase_type[i].opcode = (dwords[1] >>
erase_type[i].idx * 8) & 0xFF;
else
- spi_nor_set_erase_type(&erase_type[i], 0u, 0xFF);
+ spi_nor_mask_erase_type(&erase_type[i]);
}
/*
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 505/567] dm: send just one event on resize, not two
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 504/567] mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 506/567] dm: add cond_resched() to dm_wq_work() Greg Kroah-Hartman
` (65 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Peter Rajnoha,
Mike Snitzer
From: Mikulas Patocka <mpatocka@redhat.com>
commit 7533afa1d27ba1234146d31d2402c195cf195962 upstream.
Device mapper sends an uevent when the device is suspended, using the
function set_capacity_and_notify. However, this causes a race condition
with udev.
Udev skips scanning dm devices that are suspended. If we send an uevent
while we are suspended, udev will be racing with device mapper resume
code. If the device mapper resume code wins the race, udev will process
the uevent after the device is resumed and it will properly scan the
device.
However, if udev wins the race, it will receive the uevent, find out that
the dm device is suspended and skip scanning the device. This causes bugs
such as systemd unmounting the device - see
https://bugzilla.redhat.com/show_bug.cgi?id=2158628
This commit fixes this race.
We replace the function set_capacity_and_notify with set_capacity, so that
the uevent is not sent at this point. In do_resume, we detect if the
capacity has changed and we pass a boolean variable need_resize_uevent to
dm_kobject_uevent. dm_kobject_uevent adds "RESIZE=1" to the uevent if
need_resize_uevent is set.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Tested-by: Peter Rajnoha <prajnoha@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-ioctl.c | 13 ++++++++++---
drivers/md/dm.c | 27 +++++++++++++--------------
drivers/md/dm.h | 2 +-
3 files changed, 24 insertions(+), 18 deletions(-)
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -482,7 +482,7 @@ static struct mapped_device *dm_hash_ren
dm_table_event(table);
dm_put_live_table(hc->md, srcu_idx);
- if (!dm_kobject_uevent(hc->md, KOBJ_CHANGE, param->event_nr))
+ if (!dm_kobject_uevent(hc->md, KOBJ_CHANGE, param->event_nr, false))
param->flags |= DM_UEVENT_GENERATED_FLAG;
md = hc->md;
@@ -989,7 +989,7 @@ static int dev_remove(struct file *filp,
dm_ima_measure_on_device_remove(md, false);
- if (!dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr))
+ if (!dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr, false))
param->flags |= DM_UEVENT_GENERATED_FLAG;
dm_put(md);
@@ -1123,6 +1123,7 @@ static int do_resume(struct dm_ioctl *pa
struct hash_cell *hc;
struct mapped_device *md;
struct dm_table *new_map, *old_map = NULL;
+ bool need_resize_uevent = false;
down_write(&_hash_lock);
@@ -1143,6 +1144,8 @@ static int do_resume(struct dm_ioctl *pa
/* Do we need to load a new map ? */
if (new_map) {
+ sector_t old_size, new_size;
+
/* Suspend if it isn't already suspended */
if (param->flags & DM_SKIP_LOCKFS_FLAG)
suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;
@@ -1151,6 +1154,7 @@ static int do_resume(struct dm_ioctl *pa
if (!dm_suspended_md(md))
dm_suspend(md, suspend_flags);
+ old_size = dm_get_size(md);
old_map = dm_swap_table(md, new_map);
if (IS_ERR(old_map)) {
dm_sync_table(md);
@@ -1158,6 +1162,9 @@ static int do_resume(struct dm_ioctl *pa
dm_put(md);
return PTR_ERR(old_map);
}
+ new_size = dm_get_size(md);
+ if (old_size && new_size && old_size != new_size)
+ need_resize_uevent = true;
if (dm_table_get_mode(new_map) & FMODE_WRITE)
set_disk_ro(dm_disk(md), 0);
@@ -1170,7 +1177,7 @@ static int do_resume(struct dm_ioctl *pa
if (!r) {
dm_ima_measure_on_device_resume(md, new_map ? true : false);
- if (!dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr))
+ if (!dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr, need_resize_uevent))
param->flags |= DM_UEVENT_GENERATED_FLAG;
}
}
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1942,10 +1942,7 @@ static struct dm_table *__bind(struct ma
if (size != dm_get_size(md))
memset(&md->geometry, 0, sizeof(md->geometry));
- if (!get_capacity(md->disk))
- set_capacity(md->disk, size);
- else
- set_capacity_and_notify(md->disk, size);
+ set_capacity(md->disk, size);
dm_table_event_callback(t, event_callback, md);
@@ -2707,23 +2704,25 @@ EXPORT_SYMBOL_GPL(dm_internal_resume_fas
* Event notification.
*---------------------------------------------------------------*/
int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
- unsigned cookie)
+ unsigned cookie, bool need_resize_uevent)
{
int r;
unsigned noio_flag;
char udev_cookie[DM_COOKIE_LENGTH];
- char *envp[] = { udev_cookie, NULL };
-
- noio_flag = memalloc_noio_save();
-
- if (!cookie)
- r = kobject_uevent(&disk_to_dev(md->disk)->kobj, action);
- else {
+ char *envp[3] = { NULL, NULL, NULL };
+ char **envpp = envp;
+ if (cookie) {
snprintf(udev_cookie, DM_COOKIE_LENGTH, "%s=%u",
DM_COOKIE_ENV_VAR_NAME, cookie);
- r = kobject_uevent_env(&disk_to_dev(md->disk)->kobj,
- action, envp);
+ *envpp++ = udev_cookie;
}
+ if (need_resize_uevent) {
+ *envpp++ = "RESIZE=1";
+ }
+
+ noio_flag = memalloc_noio_save();
+
+ r = kobject_uevent_env(&disk_to_dev(md->disk)->kobj, action, envp);
memalloc_noio_restore(noio_flag);
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -210,7 +210,7 @@ int dm_get_table_device(struct mapped_de
void dm_put_table_device(struct mapped_device *md, struct dm_dev *d);
int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
- unsigned cookie);
+ unsigned cookie, bool need_resize_uevent);
void dm_internal_suspend(struct mapped_device *md);
void dm_internal_resume(struct mapped_device *md);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 506/567] dm: add cond_resched() to dm_wq_work()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 505/567] dm: send just one event on resize, not two Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 507/567] wifi: rtl8xxxu: Use a longer retry limit of 48 Greg Kroah-Hartman
` (64 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pingfan Liu, Ming Lei, Mike Snitzer
From: Pingfan Liu <piliu@redhat.com>
commit 0ca44fcef241768fd25ee763b3d203b9852f269b upstream.
Otherwise the while() loop in dm_wq_work() can result in a "dead
loop" on systems that have preemption disabled. This is particularly
problematic on single cpu systems.
Cc: stable@vger.kernel.org
Signed-off-by: Pingfan Liu <piliu@redhat.com>
Acked-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2305,6 +2305,7 @@ static void dm_wq_work(struct work_struc
break;
submit_bio_noacct(bio);
+ cond_resched();
}
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 507/567] wifi: rtl8xxxu: Use a longer retry limit of 48
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 506/567] dm: add cond_resched() to dm_wq_work() Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 508/567] wifi: ath11k: allow system suspend to survive ath11k Greg Kroah-Hartman
` (63 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bitterblue Smith, Ping-Ke Shih, Kalle Valo
From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
commit 2a86aa9a1892d60ef2e3f310f5b42b8b05546d65 upstream.
The Realtek rate control algorithm goes back and forth a lot between
the highest and the lowest rate it's allowed to use. This is due to
a lot of frames being dropped because the retry limits set by
IEEE80211_CONF_CHANGE_RETRY_LIMITS are too low. (Experimentally, they
are 4 for long frames and 7 for short frames.)
The vendor drivers hardcode the value 48 for both retry limits (for
station mode), which makes dropped frames very rare and thus the rate
control is more stable.
Because most Realtek chips handle the rate control in the firmware,
which can't be modified, ignore the limits set by
IEEE80211_CONF_CHANGE_RETRY_LIMITS and use the value 48 (set during
chip initialisation), same as the vendor drivers.
Cc: stable@vger.kernel.org
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/477d745b-6bac-111d-403c-487fc19aa30d@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 9 ---------
1 file changed, 9 deletions(-)
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
@@ -5909,7 +5909,6 @@ static int rtl8xxxu_config(struct ieee80
{
struct rtl8xxxu_priv *priv = hw->priv;
struct device *dev = &priv->udev->dev;
- u16 val16;
int ret = 0, channel;
bool ht40;
@@ -5919,14 +5918,6 @@ static int rtl8xxxu_config(struct ieee80
__func__, hw->conf.chandef.chan->hw_value,
changed, hw->conf.chandef.width);
- if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
- val16 = ((hw->conf.long_frame_max_tx_count <<
- RETRY_LIMIT_LONG_SHIFT) & RETRY_LIMIT_LONG_MASK) |
- ((hw->conf.short_frame_max_tx_count <<
- RETRY_LIMIT_SHORT_SHIFT) & RETRY_LIMIT_SHORT_MASK);
- rtl8xxxu_write16(priv, REG_RETRY_LIMIT, val16);
- }
-
if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
switch (hw->conf.chandef.width) {
case NL80211_CHAN_WIDTH_20_NOHT:
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 508/567] wifi: ath11k: allow system suspend to survive ath11k
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 507/567] wifi: rtl8xxxu: Use a longer retry limit of 48 Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 509/567] wifi: cfg80211: Fix use after free for wext Greg Kroah-Hartman
` (62 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Len Brown, Kalle Valo
From: Len Brown <len.brown@intel.com>
commit 7c15430822e71e90203d87e6d0cfe83fa058b0dc upstream.
When ath11k runs into internal errors upon suspend,
it returns an error code to pci_pm_suspend, which
aborts the entire system suspend.
The driver should not abort system suspend, but should
keep its internal errors to itself, and allow the system
to suspend. Otherwise, a user can suspend a laptop
by closing the lid and sealing it into a case, assuming
that is will suspend, rather than heating up and draining
the battery when in transit.
In practice, the ath11k device seems to have plenty of transient
errors, and subsequent suspend cycles after this failure
often succeed.
https://bugzilla.kernel.org/show_bug.cgi?id=216968
Fixes: d1b0c33850d29 ("ath11k: implement suspend for QCA6390 PCI devices")
Signed-off-by: Len Brown <len.brown@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230201183201.14431-1-len.brown@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath11k/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath11k/pci.c
+++ b/drivers/net/wireless/ath/ath11k/pci.c
@@ -1395,7 +1395,7 @@ static __maybe_unused int ath11k_pci_pm_
if (ret)
ath11k_warn(ab, "failed to suspend core: %d\n", ret);
- return ret;
+ return 0;
}
static __maybe_unused int ath11k_pci_pm_resume(struct device *dev)
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 509/567] wifi: cfg80211: Fix use after free for wext
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 508/567] wifi: ath11k: allow system suspend to survive ath11k Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 510/567] qede: fix interrupt coalescing configuration Greg Kroah-Hartman
` (61 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Wetzel, Johannes Berg
From: Alexander Wetzel <alexander@wetzel-home.de>
commit 015b8cc5e7c4d7bb671f1984d7b7338c310b185b upstream.
Key information in wext.connect is not reset on (re)connect and can hold
data from a previous connection.
Reset key data to avoid that drivers or mac80211 incorrectly detect a
WEP connection request and access the freed or already reused memory.
Additionally optimize cfg80211_sme_connect() and avoid an useless
schedule of conn_work.
Fixes: fffd0934b939 ("cfg80211: rework key operation")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230124141856.356646-1-alexander@wetzel-home.de
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/sme.c | 31 ++++++++++++++++++++++++++-----
1 file changed, 26 insertions(+), 5 deletions(-)
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -268,6 +268,15 @@ void cfg80211_conn_work(struct work_stru
wiphy_unlock(&rdev->wiphy);
}
+static void cfg80211_step_auth_next(struct cfg80211_conn *conn,
+ struct cfg80211_bss *bss)
+{
+ memcpy(conn->bssid, bss->bssid, ETH_ALEN);
+ conn->params.bssid = conn->bssid;
+ conn->params.channel = bss->channel;
+ conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
+}
+
/* Returned bss is reference counted and must be cleaned up appropriately. */
static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
{
@@ -285,10 +294,7 @@ static struct cfg80211_bss *cfg80211_get
if (!bss)
return NULL;
- memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN);
- wdev->conn->params.bssid = wdev->conn->bssid;
- wdev->conn->params.channel = bss->channel;
- wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
+ cfg80211_step_auth_next(wdev->conn, bss);
schedule_work(&rdev->conn_work);
return bss;
@@ -567,7 +573,12 @@ static int cfg80211_sme_connect(struct w
wdev->conn->params.ssid_len = wdev->ssid_len;
/* see if we have the bss already */
- bss = cfg80211_get_conn_bss(wdev);
+ bss = cfg80211_get_bss(wdev->wiphy, wdev->conn->params.channel,
+ wdev->conn->params.bssid,
+ wdev->conn->params.ssid,
+ wdev->conn->params.ssid_len,
+ wdev->conn_bss_type,
+ IEEE80211_PRIVACY(wdev->conn->params.privacy));
if (prev_bssid) {
memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
@@ -578,6 +589,7 @@ static int cfg80211_sme_connect(struct w
if (bss) {
enum nl80211_timeout_reason treason;
+ cfg80211_step_auth_next(wdev->conn, bss);
err = cfg80211_conn_do_work(wdev, &treason);
cfg80211_put_bss(wdev->wiphy, bss);
} else {
@@ -1244,6 +1256,15 @@ int cfg80211_connect(struct cfg80211_reg
} else {
if (WARN_ON(connkeys))
return -EINVAL;
+
+ /* connect can point to wdev->wext.connect which
+ * can hold key data from a previous connection
+ */
+ connect->key = NULL;
+ connect->key_len = 0;
+ connect->key_idx = 0;
+ connect->crypto.cipher_group = 0;
+ connect->crypto.n_ciphers_pairwise = 0;
}
wdev->connect_keys = connkeys;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 510/567] qede: fix interrupt coalescing configuration
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 509/567] wifi: cfg80211: Fix use after free for wext Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 511/567] thermal: intel: powerclamp: Fix cur_state for multi package system Greg Kroah-Hartman
` (60 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manish Chopra, Bhaskar Upadhaya,
David S. Miller, Alok Prasad, Ariel Elior
From: Manish Chopra <manishc@marvell.com>
commit 908d4bb7c54caa58253a363d63e797a468eaf321 upstream.
On default driver load device gets configured with unexpected
higher interrupt coalescing values instead of default expected
values as memory allocated from krealloc() is not supposed to
be zeroed out and may contain garbage values.
Fix this by allocating the memory of required size first with
kcalloc() and then use krealloc() to resize and preserve the
contents across down/up of the interface.
Signed-off-by: Manish Chopra <manishc@marvell.com>
Fixes: b0ec5489c480 ("qede: preserve per queue stats across up/down of interface")
Cc: stable@vger.kernel.org
Cc: Bhaskar Upadhaya <bupadhaya@marvell.com>
Cc: David S. Miller <davem@davemloft.net>
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2160054
Signed-off-by: Alok Prasad <palok@marvell.com>
Signed-off-by: Ariel Elior <aelior@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qede/qede_main.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -909,8 +909,15 @@ static int qede_alloc_fp_array(struct qe
goto err;
}
- mem = krealloc(edev->coal_entry, QEDE_QUEUE_CNT(edev) *
- sizeof(*edev->coal_entry), GFP_KERNEL);
+ if (!edev->coal_entry) {
+ mem = kcalloc(QEDE_MAX_RSS_CNT(edev),
+ sizeof(*edev->coal_entry), GFP_KERNEL);
+ } else {
+ mem = krealloc(edev->coal_entry,
+ QEDE_QUEUE_CNT(edev) * sizeof(*edev->coal_entry),
+ GFP_KERNEL);
+ }
+
if (!mem) {
DP_ERR(edev, "coalesce entry allocation failed\n");
kfree(edev->coal_entry);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 511/567] thermal: intel: powerclamp: Fix cur_state for multi package system
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 510/567] qede: fix interrupt coalescing configuration Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 512/567] dm flakey: fix logic when corrupting a bio Greg Kroah-Hartman
` (59 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada, Rafael J. Wysocki
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 8e47363588377e1bdb65e2b020b409cfb44dd260 upstream.
The powerclamp cooling device cur_state shows actual idle observed by
package C-state idle counters. But the implementation is not sufficient
for multi package or multi die system. The cur_state value is incorrect.
On these systems, these counters must be read from each package/die and
somehow aggregate them. But there is no good method for aggregation.
It was not a problem when explicit CPU model addition was required to
enable intel powerclamp. In this way certain CPU models could have
been avoided. But with the removal of CPU model check with the
availability of Package C-state counters, the driver is loaded on most
of the recent systems.
For multi package/die systems, just show the actual target idle state,
the system is trying to achieve. In powerclamp this is the user set
state minus one.
Also there is no use of starting a worker thread for polling package
C-state counters and applying any compensation for multiple package
or multiple die systems.
Fixes: b721ca0d1927 ("thermal/powerclamp: remove cpu whitelist")
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: 4.14+ <stable@vger.kernel.org> # 4.14+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/intel/intel_powerclamp.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
--- a/drivers/thermal/intel/intel_powerclamp.c
+++ b/drivers/thermal/intel/intel_powerclamp.c
@@ -57,6 +57,7 @@
static unsigned int target_mwait;
static struct dentry *debug_dir;
+static bool poll_pkg_cstate_enable;
/* user selected target */
static unsigned int set_target_ratio;
@@ -262,6 +263,9 @@ static unsigned int get_compensation(int
{
unsigned int comp = 0;
+ if (!poll_pkg_cstate_enable)
+ return 0;
+
/* we only use compensation if all adjacent ones are good */
if (ratio == 1 &&
cal_data[ratio].confidence >= CONFIDENCE_OK &&
@@ -534,7 +538,8 @@ static int start_power_clamp(void)
control_cpu = cpumask_first(cpu_online_mask);
clamping = true;
- schedule_delayed_work(&poll_pkg_cstate_work, 0);
+ if (poll_pkg_cstate_enable)
+ schedule_delayed_work(&poll_pkg_cstate_work, 0);
/* start one kthread worker per online cpu */
for_each_online_cpu(cpu) {
@@ -603,11 +608,15 @@ static int powerclamp_get_max_state(stru
static int powerclamp_get_cur_state(struct thermal_cooling_device *cdev,
unsigned long *state)
{
- if (true == clamping)
- *state = pkg_cstate_ratio_cur;
- else
+ if (clamping) {
+ if (poll_pkg_cstate_enable)
+ *state = pkg_cstate_ratio_cur;
+ else
+ *state = set_target_ratio;
+ } else {
/* to save power, do not poll idle ratio while not clamping */
*state = -1; /* indicates invalid state */
+ }
return 0;
}
@@ -732,6 +741,9 @@ static int __init powerclamp_init(void)
goto exit_unregister;
}
+ if (topology_max_packages() == 1 && topology_max_die_per_package() == 1)
+ poll_pkg_cstate_enable = true;
+
cooling_dev = thermal_cooling_device_register("intel_powerclamp", NULL,
&powerclamp_cooling_ops);
if (IS_ERR(cooling_dev)) {
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 512/567] dm flakey: fix logic when corrupting a bio
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 511/567] thermal: intel: powerclamp: Fix cur_state for multi package system Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 513/567] dm flakey: dont corrupt the zero page Greg Kroah-Hartman
` (58 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sweet Tea Dorminy,
Mike Snitzer
From: Mikulas Patocka <mpatocka@redhat.com>
commit aa56b9b75996ff4c76a0a4181c2fa0206c3d91cc upstream.
If "corrupt_bio_byte" is set to corrupt reads and corrupt_bio_flags is
used, dm-flakey would erroneously return all writes as errors. Likewise,
if "corrupt_bio_byte" is set to corrupt writes, dm-flakey would return
errors for all reads.
Fix the logic so that if fc->corrupt_bio_byte is non-zero, dm-flakey
will not abort reads on writes with an error.
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reviewed-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-flakey.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -359,9 +359,11 @@ static int flakey_map(struct dm_target *
/*
* Corrupt matching writes.
*/
- if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == WRITE)) {
- if (all_corrupt_bio_flags_match(bio, fc))
- corrupt_bio_data(bio, fc);
+ if (fc->corrupt_bio_byte) {
+ if (fc->corrupt_bio_rw == WRITE) {
+ if (all_corrupt_bio_flags_match(bio, fc))
+ corrupt_bio_data(bio, fc);
+ }
goto map_bio;
}
@@ -387,13 +389,14 @@ static int flakey_end_io(struct dm_targe
return DM_ENDIO_DONE;
if (!*error && pb->bio_submitted && (bio_data_dir(bio) == READ)) {
- if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
- all_corrupt_bio_flags_match(bio, fc)) {
- /*
- * Corrupt successful matching READs while in down state.
- */
- corrupt_bio_data(bio, fc);
-
+ if (fc->corrupt_bio_byte) {
+ if ((fc->corrupt_bio_rw == READ) &&
+ all_corrupt_bio_flags_match(bio, fc)) {
+ /*
+ * Corrupt successful matching READs while in down state.
+ */
+ corrupt_bio_data(bio, fc);
+ }
} else if (!test_bit(DROP_WRITES, &fc->flags) &&
!test_bit(ERROR_WRITES, &fc->flags)) {
/*
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 513/567] dm flakey: dont corrupt the zero page
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 512/567] dm flakey: fix logic when corrupting a bio Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 514/567] dm flakey: fix a bug with 32-bit highmem systems Greg Kroah-Hartman
` (57 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sweet Tea Dorminy,
Mike Snitzer
From: Mikulas Patocka <mpatocka@redhat.com>
commit f50714b57aecb6b3dc81d578e295f86d9c73f078 upstream.
When we need to zero some range on a block device, the function
__blkdev_issue_zero_pages submits a write bio with the bio vector pointing
to the zero page. If we use dm-flakey with corrupt bio writes option, it
will corrupt the content of the zero page which results in crashes of
various userspace programs. Glibc assumes that memory returned by mmap is
zeroed and it uses it for calloc implementation; if the newly mapped
memory is not zeroed, calloc will return non-zeroed memory.
Fix this bug by testing if the page is equal to ZERO_PAGE(0) and
avoiding the corruption in this case.
Cc: stable@vger.kernel.org
Fixes: a00f5276e266 ("dm flakey: Properly corrupt multi-page bios.")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reviewed-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-flakey.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -301,8 +301,11 @@ static void corrupt_bio_data(struct bio
*/
bio_for_each_segment(bvec, bio, iter) {
if (bio_iter_len(bio, iter) > corrupt_bio_byte) {
- char *segment = (page_address(bio_iter_page(bio, iter))
- + bio_iter_offset(bio, iter));
+ char *segment;
+ struct page *page = bio_iter_page(bio, iter);
+ if (unlikely(page == ZERO_PAGE(0)))
+ break;
+ segment = (page_address(page) + bio_iter_offset(bio, iter));
segment[corrupt_bio_byte] = fc->corrupt_bio_value;
DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
"(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n",
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 514/567] dm flakey: fix a bug with 32-bit highmem systems
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 513/567] dm flakey: dont corrupt the zero page Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 515/567] ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node Greg Kroah-Hartman
` (56 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Sweet Tea Dorminy,
Mike Snitzer
From: Mikulas Patocka <mpatocka@redhat.com>
commit 8eb29c4fbf9661e6bd4dd86197a37ffe0ecc9d50 upstream.
The function page_address does not work with 32-bit systems with high
memory. Use bvec_kmap_local/kunmap_local instead.
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reviewed-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-flakey.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -305,8 +305,9 @@ static void corrupt_bio_data(struct bio
struct page *page = bio_iter_page(bio, iter);
if (unlikely(page == ZERO_PAGE(0)))
break;
- segment = (page_address(page) + bio_iter_offset(bio, iter));
+ segment = bvec_kmap_local(&bvec);
segment[corrupt_bio_byte] = fc->corrupt_bio_value;
+ kunmap_local(segment);
DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
"(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n",
bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 515/567] ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 514/567] dm flakey: fix a bug with 32-bit highmem systems Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 516/567] ARM: dts: exynos: correct TMU phandle in Exynos4210 Greg Kroah-Hartman
` (55 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Konrad Dybcio, Bjorn Andersson
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
commit af4ab377543853b690cc85b4c46cf976ab560dc2 upstream.
SDX55 uses the Qcom version of the SMMU-500 IP. So use "qcom,smmu-500"
compatible as the fallback to the SoC specific compatible.
Cc: <stable@vger.kernel.org> # 5.12
Fixes: a2bdfdfba2af ("ARM: dts: qcom: sdx55: Enable ARM SMMU")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230123131931.263024-3-manivannan.sadhasivam@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/qcom-sdx55.dtsi
+++ b/arch/arm/boot/dts/qcom-sdx55.dtsi
@@ -502,7 +502,7 @@
};
apps_smmu: iommu@15000000 {
- compatible = "qcom,sdx55-smmu-500", "arm,mmu-500";
+ compatible = "qcom,sdx55-smmu-500", "qcom,smmu-500", "arm,mmu-500";
reg = <0x15000000 0x20000>;
#iommu-cells = <2>;
#global-interrupts = <1>;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 516/567] ARM: dts: exynos: correct TMU phandle in Exynos4210
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 515/567] ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 517/567] ARM: dts: exynos: correct TMU phandle in Exynos4 Greg Kroah-Hartman
` (54 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 408ab6786dbf6dd696488054c9559681112ef994 upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing
it must not have an argument to phandle. Since thermal-sensors property is
already defined in included exynos4-cpu-thermal.dtsi, drop it from
exynos4210.dtsi to fix the error and remoev redundancy.
Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230209105841.779596-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos4210.dtsi | 1 -
1 file changed, 1 deletion(-)
--- a/arch/arm/boot/dts/exynos4210.dtsi
+++ b/arch/arm/boot/dts/exynos4210.dtsi
@@ -393,7 +393,6 @@
&cpu_thermal {
polling-delay-passive = <0>;
polling-delay = <0>;
- thermal-sensors = <&tmu 0>;
};
&gic {
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 517/567] ARM: dts: exynos: correct TMU phandle in Exynos4
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 516/567] ARM: dts: exynos: correct TMU phandle in Exynos4210 Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 518/567] ARM: dts: exynos: correct TMU phandle in Odroid XU3 family Greg Kroah-Hartman
` (53 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 8e4505e617a80f601e2f53a917611777f128f925 upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing
it must not have an argument to phandle.
Fixes: 328829a6ad70 ("ARM: dts: define default thermal-zones for exynos4")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230209105841.779596-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos4-cpu-thermal.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
+++ b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
@@ -10,7 +10,7 @@
/ {
thermal-zones {
cpu_thermal: cpu-thermal {
- thermal-sensors = <&tmu 0>;
+ thermal-sensors = <&tmu>;
polling-delay-passive = <0>;
polling-delay = <0>;
trips {
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 518/567] ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 517/567] ARM: dts: exynos: correct TMU phandle in Exynos4 Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 519/567] ARM: dts: exynos: correct TMU phandle in Exynos5250 Greg Kroah-Hartman
` (52 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit a3583e92d188ec6c58c7f603ac5e72dd8a11c21a upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing
it must not have an argument to phandle. This was not critical before,
but since rework of thermal Devicetree initialization in the
commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree
initialization"), this leads to errors registering thermal zones other
than first one:
thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2
thermal_sys: Failed to find thermal zone for tmu id=0
exynos-tmu 10064000.tmu: Failed to register sensor: -2
exynos-tmu: probe of 10064000.tmu failed with error -2
Fixes: f1722d7dd8b8 ("ARM: dts: Define default thermal-zones for exynos5422")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230209105841.779596-6-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
+++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
@@ -50,7 +50,7 @@
thermal-zones {
cpu0_thermal: cpu0-thermal {
- thermal-sensors = <&tmu_cpu0 0>;
+ thermal-sensors = <&tmu_cpu0>;
polling-delay-passive = <250>;
polling-delay = <0>;
trips {
@@ -139,7 +139,7 @@
};
};
cpu1_thermal: cpu1-thermal {
- thermal-sensors = <&tmu_cpu1 0>;
+ thermal-sensors = <&tmu_cpu1>;
polling-delay-passive = <250>;
polling-delay = <0>;
trips {
@@ -212,7 +212,7 @@
};
};
cpu2_thermal: cpu2-thermal {
- thermal-sensors = <&tmu_cpu2 0>;
+ thermal-sensors = <&tmu_cpu2>;
polling-delay-passive = <250>;
polling-delay = <0>;
trips {
@@ -285,7 +285,7 @@
};
};
cpu3_thermal: cpu3-thermal {
- thermal-sensors = <&tmu_cpu3 0>;
+ thermal-sensors = <&tmu_cpu3>;
polling-delay-passive = <250>;
polling-delay = <0>;
trips {
@@ -358,7 +358,7 @@
};
};
gpu_thermal: gpu-thermal {
- thermal-sensors = <&tmu_gpu 0>;
+ thermal-sensors = <&tmu_gpu>;
polling-delay-passive = <250>;
polling-delay = <0>;
trips {
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 519/567] ARM: dts: exynos: correct TMU phandle in Exynos5250
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 518/567] ARM: dts: exynos: correct TMU phandle in Odroid XU3 family Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 520/567] ARM: dts: exynos: correct TMU phandle in Odroid XU Greg Kroah-Hartman
` (51 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 33e2c595e2e4016991ead44933a29d1ef93d5f26 upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing
it must not have an argument to phandle.
Cc: <stable@vger.kernel.org>
Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU")
Link: https://lore.kernel.org/r/20230209105841.779596-3-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos5250.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -1119,7 +1119,7 @@
&cpu_thermal {
polling-delay-passive = <0>;
polling-delay = <0>;
- thermal-sensors = <&tmu 0>;
+ thermal-sensors = <&tmu>;
cooling-maps {
map0 {
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 520/567] ARM: dts: exynos: correct TMU phandle in Odroid XU
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 519/567] ARM: dts: exynos: correct TMU phandle in Exynos5250 Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 521/567] ARM: dts: exynos: correct TMU phandle in Odroid HC1 Greg Kroah-Hartman
` (50 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 9372eca505e7a19934d750b4b4c89a3652738e66 upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing
it must not have an argument to phandle. Since thermal-sensors property
is already defined in included exynosi5410.dtsi, drop it from
exynos5410-odroidxu.dts to fix the error and remoev redundancy.
Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230209105841.779596-4-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos5410-odroidxu.dts | 1 -
1 file changed, 1 deletion(-)
--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -120,7 +120,6 @@
};
&cpu0_thermal {
- thermal-sensors = <&tmu_cpu0 0>;
polling-delay-passive = <0>;
polling-delay = <0>;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 521/567] ARM: dts: exynos: correct TMU phandle in Odroid HC1
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 520/567] ARM: dts: exynos: correct TMU phandle in Odroid XU Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 522/567] fuse: add inode/permission checks to fileattr_get/fileattr_set Greg Kroah-Hartman
` (49 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 2e3d0e20d8456f876607a8af61fdb83dfbf98cb6 upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing
it must not have an argument to phandle. This was not critical before,
but since rework of thermal Devicetree initialization in the
commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree
initialization"), this leads to errors registering thermal zones other
than first one:
thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2
thermal_sys: Failed to find thermal zone for tmu id=0
exynos-tmu 10064000.tmu: Failed to register sensor: -2
exynos-tmu: probe of 10064000.tmu failed with error -2
Fixes: 1ac49427b566 ("ARM: dts: exynos: Add support for Hardkernel's Odroid HC1 board")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230209105841.779596-5-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos5422-odroidhc1.dts | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts
+++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts
@@ -29,7 +29,7 @@
thermal-zones {
cpu0_thermal: cpu0-thermal {
- thermal-sensors = <&tmu_cpu0 0>;
+ thermal-sensors = <&tmu_cpu0>;
trips {
cpu0_alert0: cpu-alert-0 {
temperature = <70000>; /* millicelsius */
@@ -84,7 +84,7 @@
};
};
cpu1_thermal: cpu1-thermal {
- thermal-sensors = <&tmu_cpu1 0>;
+ thermal-sensors = <&tmu_cpu1>;
trips {
cpu1_alert0: cpu-alert-0 {
temperature = <70000>;
@@ -128,7 +128,7 @@
};
};
cpu2_thermal: cpu2-thermal {
- thermal-sensors = <&tmu_cpu2 0>;
+ thermal-sensors = <&tmu_cpu2>;
trips {
cpu2_alert0: cpu-alert-0 {
temperature = <70000>;
@@ -172,7 +172,7 @@
};
};
cpu3_thermal: cpu3-thermal {
- thermal-sensors = <&tmu_cpu3 0>;
+ thermal-sensors = <&tmu_cpu3>;
trips {
cpu3_alert0: cpu-alert-0 {
temperature = <70000>;
@@ -216,7 +216,7 @@
};
};
gpu_thermal: gpu-thermal {
- thermal-sensors = <&tmu_gpu 0>;
+ thermal-sensors = <&tmu_gpu>;
trips {
gpu_alert0: gpu-alert-0 {
temperature = <70000>;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 522/567] fuse: add inode/permission checks to fileattr_get/fileattr_set
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 521/567] ARM: dts: exynos: correct TMU phandle in Odroid HC1 Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 523/567] rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails Greg Kroah-Hartman
` (48 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Mikhalitsyn, Miklos Szeredi
From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
commit 1cc4606d19e3710bfab3f6704b87ff9580493c69 upstream.
It looks like these checks were accidentally lost during the conversion to
fileattr API.
Fixes: 72227eac177d ("fuse: convert to fileattr")
Cc: <stable@vger.kernel.org> # v5.13
Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/ioctl.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/fuse/ioctl.c
+++ b/fs/fuse/ioctl.c
@@ -419,6 +419,12 @@ static struct fuse_file *fuse_priv_ioctl
struct fuse_mount *fm = get_fuse_mount(inode);
bool isdir = S_ISDIR(inode->i_mode);
+ if (!fuse_allow_current_process(fm->fc))
+ return ERR_PTR(-EACCES);
+
+ if (fuse_is_bad(inode))
+ return ERR_PTR(-EIO);
+
if (!S_ISREG(inode->i_mode) && !isdir)
return ERR_PTR(-ENOTTY);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 523/567] rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 522/567] fuse: add inode/permission checks to fileattr_get/fileattr_set Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 524/567] ceph: update the time stamps and try to drop the suid/sgid Greg Kroah-Hartman
` (47 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilya Dryomov
From: Ilya Dryomov <idryomov@gmail.com>
commit f7c4d9b133c7a04ca619355574e96b6abf209fba upstream.
If getting an ID or setting up a work queue in rbd_dev_create() fails,
use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts
is triggered in do_rbd_add(). The root cause is that the ownership of
these structures is transfered to rbd_dev prematurely and they all end
up getting freed when rbd_dev_create() calls rbd_dev_free() prior to
returning to do_rbd_add().
Found by Linux Verification Center (linuxtesting.org) with SVACE, an
incomplete patch submitted by Natalia Petrova <n.petrova@fintech.ru>.
Cc: stable@vger.kernel.org
Fixes: 1643dfa4c2c8 ("rbd: introduce a per-device ordered workqueue")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/rbd.c | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -5296,8 +5296,7 @@ static void rbd_dev_release(struct devic
module_put(THIS_MODULE);
}
-static struct rbd_device *__rbd_dev_create(struct rbd_client *rbdc,
- struct rbd_spec *spec)
+static struct rbd_device *__rbd_dev_create(struct rbd_spec *spec)
{
struct rbd_device *rbd_dev;
@@ -5342,9 +5341,6 @@ static struct rbd_device *__rbd_dev_crea
rbd_dev->dev.parent = &rbd_root_dev;
device_initialize(&rbd_dev->dev);
- rbd_dev->rbd_client = rbdc;
- rbd_dev->spec = spec;
-
return rbd_dev;
}
@@ -5357,12 +5353,10 @@ static struct rbd_device *rbd_dev_create
{
struct rbd_device *rbd_dev;
- rbd_dev = __rbd_dev_create(rbdc, spec);
+ rbd_dev = __rbd_dev_create(spec);
if (!rbd_dev)
return NULL;
- rbd_dev->opts = opts;
-
/* get an id and fill in device name */
rbd_dev->dev_id = ida_simple_get(&rbd_dev_id_ida, 0,
minor_to_rbd_dev_id(1 << MINORBITS),
@@ -5379,6 +5373,10 @@ static struct rbd_device *rbd_dev_create
/* we have a ref from do_rbd_add() */
__module_get(THIS_MODULE);
+ rbd_dev->rbd_client = rbdc;
+ rbd_dev->spec = spec;
+ rbd_dev->opts = opts;
+
dout("%s rbd_dev %p dev_id %d\n", __func__, rbd_dev, rbd_dev->dev_id);
return rbd_dev;
@@ -6739,7 +6737,7 @@ static int rbd_dev_probe_parent(struct r
goto out_err;
}
- parent = __rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec);
+ parent = __rbd_dev_create(rbd_dev->parent_spec);
if (!parent) {
ret = -ENOMEM;
goto out_err;
@@ -6749,8 +6747,8 @@ static int rbd_dev_probe_parent(struct r
* Images related by parent/child relationships always share
* rbd_client and spec/parent_spec, so bump their refcounts.
*/
- __rbd_get_client(rbd_dev->rbd_client);
- rbd_spec_get(rbd_dev->parent_spec);
+ parent->rbd_client = __rbd_get_client(rbd_dev->rbd_client);
+ parent->spec = rbd_spec_get(rbd_dev->parent_spec);
__set_bit(RBD_DEV_FLAG_READONLY, &parent->flags);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 524/567] ceph: update the time stamps and try to drop the suid/sgid
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 523/567] rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 525/567] alpha: fix FEN fault handling Greg Kroah-Hartman
` (46 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiubo Li, Jeff Layton, Ilya Dryomov
From: Xiubo Li <xiubli@redhat.com>
commit e027253c4b77d395798600a90b6a96fe4adf4d5e upstream.
The fallocate will try to clear the suid/sgid if a unprevileged user
changed the file.
There is no POSIX item requires that we should clear the suid/sgid
in fallocate code path but this is the default behaviour for most of
the filesystems and the VFS layer. And also the same for the write
code path, which have already support it.
And also we need to update the time stamps since the fallocate will
change the file contents.
Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/58054
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/file.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -2084,6 +2084,9 @@ static long ceph_fallocate(struct file *
loff_t endoff = 0;
loff_t size;
+ dout("%s %p %llx.%llx mode %x, offset %llu length %llu\n", __func__,
+ inode, ceph_vinop(inode), mode, offset, length);
+
if (mode != (FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
return -EOPNOTSUPP;
@@ -2124,6 +2127,10 @@ static long ceph_fallocate(struct file *
if (ret < 0)
goto unlock;
+ ret = file_modified(file);
+ if (ret)
+ goto put_caps;
+
filemap_invalidate_lock(inode->i_mapping);
ceph_zero_pagecache_range(inode, offset, length);
ret = ceph_zero_objects(inode, offset, length);
@@ -2139,6 +2146,7 @@ static long ceph_fallocate(struct file *
}
filemap_invalidate_unlock(inode->i_mapping);
+put_caps:
ceph_put_cap_refs(ci, got);
unlock:
inode_unlock(inode);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 525/567] alpha: fix FEN fault handling
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 524/567] ceph: update the time stamps and try to drop the suid/sgid Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 526/567] dax/kmem: Fix leak of memory-hotplug resources Greg Kroah-Hartman
` (45 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Richard Henderson, Al Viro
From: Al Viro <viro@zeniv.linux.org.uk>
commit 977a3009547dad4a5bc95d91be4a58c9f7eedac0 upstream.
Type 3 instruction fault (FPU insn with FPU disabled) is handled
by quietly enabling FPU and returning. Which is fine, except that
we need to do that both for fault in userland and in the kernel;
the latter *can* legitimately happen - all it takes is this:
.global _start
_start:
call_pal 0xae
lda $0, 0
ldq $0, 0($0)
- call_pal CLRFEN to clear "FPU enabled" flag and arrange for
a signal delivery (SIGSEGV in this case).
Fixed by moving the handling of type 3 into the common part of
do_entIF(), before we check for kernel vs. user mode.
Incidentally, the check for kernel mode is unidiomatic; the normal
way to do that is !user_mode(regs). The difference is that
the open-coded variant treats any of bits 63..3 of regs->ps being
set as "it's user mode" while the normal approach is to check just
the bit 3. PS is a 4-bit register and regs->ps always will have
bits 63..4 clear, so the open-coded variant here is actually equivalent
to !user_mode(regs). Harder to follow, though...
Cc: stable@vger.kernel.org
Reviewed-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/traps.c | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
--- a/arch/alpha/kernel/traps.c
+++ b/arch/alpha/kernel/traps.c
@@ -235,7 +235,21 @@ do_entIF(unsigned long type, struct pt_r
{
int signo, code;
- if ((regs->ps & ~IPL_MAX) == 0) {
+ if (type == 3) { /* FEN fault */
+ /* Irritating users can call PAL_clrfen to disable the
+ FPU for the process. The kernel will then trap in
+ do_switch_stack and undo_switch_stack when we try
+ to save and restore the FP registers.
+
+ Given that GCC by default generates code that uses the
+ FP registers, PAL_clrfen is not useful except for DoS
+ attacks. So turn the bleeding FPU back on and be done
+ with it. */
+ current_thread_info()->pcb.flags |= 1;
+ __reload_thread(¤t_thread_info()->pcb);
+ return;
+ }
+ if (!user_mode(regs)) {
if (type == 1) {
const unsigned int *data
= (const unsigned int *) regs->pc;
@@ -368,20 +382,6 @@ do_entIF(unsigned long type, struct pt_r
}
break;
- case 3: /* FEN fault */
- /* Irritating users can call PAL_clrfen to disable the
- FPU for the process. The kernel will then trap in
- do_switch_stack and undo_switch_stack when we try
- to save and restore the FP registers.
-
- Given that GCC by default generates code that uses the
- FP registers, PAL_clrfen is not useful except for DoS
- attacks. So turn the bleeding FPU back on and be done
- with it. */
- current_thread_info()->pcb.flags |= 1;
- __reload_thread(¤t_thread_info()->pcb);
- return;
-
case 5: /* illoc */
default: /* unexpected instruction-fault type */
;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 526/567] dax/kmem: Fix leak of memory-hotplug resources
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 525/567] alpha: fix FEN fault handling Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 527/567] mips: fix syscall_get_nr Greg Kroah-Hartman
` (44 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oscar Salvador, David Hildenbrand,
Pavel Tatashin, Vishal Verma, Dave Jiang, Dan Williams
From: Dan Williams <dan.j.williams@intel.com>
commit e686c32590f40bffc45f105c04c836ffad3e531a upstream.
While experimenting with CXL region removal the following corruption of
/proc/iomem appeared.
Before:
f010000000-f04fffffff : CXL Window 0
f010000000-f02fffffff : region4
f010000000-f02fffffff : dax4.0
f010000000-f02fffffff : System RAM (kmem)
After (modprobe -r cxl_test):
f010000000-f02fffffff : **redacted binary garbage**
f010000000-f02fffffff : System RAM (kmem)
...and testing further the same is visible with persistent memory
assigned to kmem:
Before:
480000000-243fffffff : Persistent Memory
480000000-57e1fffff : namespace3.0
580000000-243fffffff : dax3.0
580000000-243fffffff : System RAM (kmem)
After (ndctl disable-region all):
480000000-243fffffff : Persistent Memory
580000000-243fffffff : ***redacted binary garbage***
580000000-243fffffff : System RAM (kmem)
The corrupted data is from a use-after-free of the "dax4.0" and "dax3.0"
resources, and it also shows that the "System RAM (kmem)" resource is
not being removed. The bug does not appear after "modprobe -r kmem", it
requires the parent of "dax4.0" and "dax3.0" to be removed which
re-parents the leaked "System RAM (kmem)" instances. Those in turn
reference the freed resource as a parent.
First up for the fix is release_mem_region_adjustable() needs to
reliably delete the resource inserted by add_memory_driver_managed().
That is thwarted by a check for IORESOURCE_SYSRAM that predates the
dax/kmem driver, from commit:
65c78784135f ("kernel, resource: check for IORESOURCE_SYSRAM in release_mem_region_adjustable")
That appears to be working around the behavior of HMM's
"MEMORY_DEVICE_PUBLIC" facility that has since been deleted. With that
check removed the "System RAM (kmem)" resource gets removed, but
corruption still occurs occasionally because the "dax" resource is not
reliably removed.
The dax range information is freed before the device is unregistered, so
the driver can not reliably recall (another use after free) what it is
meant to release. Lastly if that use after free got lucky, the driver
was covering up the leak of "System RAM (kmem)" due to its use of
release_resource() which detaches, but does not free, child resources.
The switch to remove_resource() forces remove_memory() to be responsible
for the deletion of the resource added by add_memory_driver_managed().
Fixes: c2f3011ee697 ("device-dax: add an allocation interface for device-dax instances")
Cc: <stable@vger.kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@redhat.com>
Cc: Pavel Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/167653656244.3147810.5705900882794040229.stgit@dwillia2-xfh.jf.intel.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dax/bus.c | 2 +-
drivers/dax/kmem.c | 4 ++--
kernel/resource.c | 14 --------------
3 files changed, 3 insertions(+), 17 deletions(-)
--- a/drivers/dax/bus.c
+++ b/drivers/dax/bus.c
@@ -397,8 +397,8 @@ static void unregister_dev_dax(void *dev
dev_dbg(dev, "%s\n", __func__);
kill_dev_dax(dev_dax);
- free_dev_dax_ranges(dev_dax);
device_del(dev);
+ free_dev_dax_ranges(dev_dax);
put_device(dev);
}
--- a/drivers/dax/kmem.c
+++ b/drivers/dax/kmem.c
@@ -135,7 +135,7 @@ static int dev_dax_kmem_probe(struct dev
if (rc) {
dev_warn(dev, "mapping%d: %#llx-%#llx memory add failed\n",
i, range.start, range.end);
- release_resource(res);
+ remove_resource(res);
kfree(res);
data->res[i] = NULL;
if (mapped)
@@ -181,7 +181,7 @@ static void dev_dax_kmem_remove(struct d
rc = remove_memory(range.start, range_len(&range));
if (rc == 0) {
- release_resource(data->res[i]);
+ remove_resource(data->res[i]);
kfree(data->res[i]);
data->res[i] = NULL;
success++;
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1325,20 +1325,6 @@ retry:
continue;
}
- /*
- * All memory regions added from memory-hotplug path have the
- * flag IORESOURCE_SYSTEM_RAM. If the resource does not have
- * this flag, we know that we are dealing with a resource coming
- * from HMM/devm. HMM/devm use another mechanism to add/release
- * a resource. This goes via devm_request_mem_region and
- * devm_release_mem_region.
- * HMM/devm take care to release their resources when they want,
- * so if we are dealing with them, let us just back off here.
- */
- if (!(res->flags & IORESOURCE_SYSRAM)) {
- break;
- }
-
if (!(res->flags & IORESOURCE_MEM))
break;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 527/567] mips: fix syscall_get_nr
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 526/567] dax/kmem: Fix leak of memory-hotplug resources Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 528/567] media: ipu3-cio2: Fix PM runtime usage_count in driver unbind Greg Kroah-Hartman
` (43 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry V. Levin, Elvira Khabirova,
Thomas Bogendoerfer
From: Elvira Khabirova <lineprinter0@gmail.com>
commit 85cc91e2ba4262a602ec65e2b76c4391a9e60d3d upstream.
The implementation of syscall_get_nr on mips used to ignore the task
argument and return the syscall number of the calling thread instead of
the target thread.
The bug was exposed to user space by commit 201766a20e30f ("ptrace: add
PTRACE_GET_SYSCALL_INFO request") and detected by strace test suite.
Link: https://github.com/strace/strace/issues/235
Fixes: c2d9f1775731 ("MIPS: Fix syscall_get_nr for the syscall exit tracing.")
Cc: <stable@vger.kernel.org> # v3.19+
Co-developed-by: Dmitry V. Levin <ldv@strace.io>
Signed-off-by: Dmitry V. Levin <ldv@strace.io>
Signed-off-by: Elvira Khabirova <lineprinter0@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/include/asm/syscall.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/include/asm/syscall.h
+++ b/arch/mips/include/asm/syscall.h
@@ -38,7 +38,7 @@ static inline bool mips_syscall_is_indir
static inline long syscall_get_nr(struct task_struct *task,
struct pt_regs *regs)
{
- return current_thread_info()->syscall;
+ return task_thread_info(task)->syscall;
}
static inline void mips_syscall_update_nr(struct task_struct *task,
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 528/567] media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 527/567] mips: fix syscall_get_nr Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 529/567] remoteproc/mtk_scp: Move clk ops outside send_lock Greg Kroah-Hartman
` (42 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Bingbu Cao,
Mauro Carvalho Chehab
From: Sakari Ailus <sakari.ailus@linux.intel.com>
commit 909d3096ac99fa2289f9b8945a3eab2269947a0a upstream.
Get the PM runtime usage_count and forbid PM runtime at driver unbind. The
opposite is being done in probe() already.
Fixes: commit c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Cc: stable@vger.kernel.org # for >= 4.16
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c
@@ -1851,6 +1851,9 @@ static void cio2_pci_remove(struct pci_d
v4l2_device_unregister(&cio2->v4l2_dev);
media_device_cleanup(&cio2->media_dev);
mutex_destroy(&cio2->lock);
+
+ pm_runtime_forbid(&pci_dev->dev);
+ pm_runtime_get_noresume(&pci_dev->dev);
}
static int __maybe_unused cio2_runtime_suspend(struct device *dev)
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 529/567] remoteproc/mtk_scp: Move clk ops outside send_lock
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 528/567] media: ipu3-cio2: Fix PM runtime usage_count in driver unbind Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 530/567] docs: gdbmacros: print newest record Greg Kroah-Hartman
` (41 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai,
AngeloGioacchino Del Regno, Mathieu Poirier
From: Chen-Yu Tsai <wenst@chromium.org>
commit e46ceea3148163166ef9b7bcac578e72dd30c064 upstream.
Clocks are properly reference counted and do not need to be inside the
lock range.
Right now this triggers a false-positive lockdep warning on MT8192 based
Chromebooks, through a combination of mtk-scp that has a cros-ec-rpmsg
sub-device, the (actual) cros-ec I2C adapter registration, I2C client
(not on cros-ec) probe doing i2c transfers and enabling clocks.
This is a false positive because the cros-ec-rpmsg under mtk-scp does
not have an I2C adapter, and also each I2C adapter and cros-ec instance
have their own mutex.
Move the clk operations outside of the send_lock range.
Fixes: 63c13d61eafe ("remoteproc/mediatek: add SCP support for mt8183")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230104083110.736377-1-wenst@chromium.org
[Fixed "Fixes:" tag line]
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/remoteproc/mtk_scp_ipi.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/drivers/remoteproc/mtk_scp_ipi.c
+++ b/drivers/remoteproc/mtk_scp_ipi.c
@@ -164,21 +164,21 @@ int scp_ipi_send(struct mtk_scp *scp, u3
WARN_ON(len > sizeof(send_obj->share_buf)) || WARN_ON(!buf))
return -EINVAL;
- mutex_lock(&scp->send_lock);
-
ret = clk_prepare_enable(scp->clk);
if (ret) {
dev_err(scp->dev, "failed to enable clock\n");
- goto unlock_mutex;
+ return ret;
}
+ mutex_lock(&scp->send_lock);
+
/* Wait until SCP receives the last command */
timeout = jiffies + msecs_to_jiffies(2000);
do {
if (time_after(jiffies, timeout)) {
dev_err(scp->dev, "%s: IPI timeout!\n", __func__);
ret = -ETIMEDOUT;
- goto clock_disable;
+ goto unlock_mutex;
}
} while (readl(scp->reg_base + scp->data->host_to_scp_reg));
@@ -205,10 +205,9 @@ int scp_ipi_send(struct mtk_scp *scp, u3
ret = 0;
}
-clock_disable:
- clk_disable_unprepare(scp->clk);
unlock_mutex:
mutex_unlock(&scp->send_lock);
+ clk_disable_unprepare(scp->clk);
return ret;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 530/567] docs: gdbmacros: print newest record
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 529/567] remoteproc/mtk_scp: Move clk ops outside send_lock Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 531/567] mm: memcontrol: deprecate charge moving Greg Kroah-Hartman
` (40 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, John Ogness, Petr Mladek
From: John Ogness <john.ogness@linutronix.de>
commit f2e4cca2f670c8e52fbb551a295f2afc9aa2bd72 upstream.
@head_id points to the newest record, but the printing loop
exits when it increments to this value (before printing).
Exit the printing loop after the newest record has been printed.
The python-based function in scripts/gdb/linux/dmesg.py already
does this correctly.
Fixes: e60768311af8 ("scripts/gdb: update for lockless printk ringbuffer")
Cc: stable@vger.kernel.org
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20221229134339.197627-1-john.ogness@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/kdump/gdbmacros.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/Documentation/admin-guide/kdump/gdbmacros.txt
+++ b/Documentation/admin-guide/kdump/gdbmacros.txt
@@ -312,10 +312,10 @@ define dmesg
set var $prev_flags = $info->flags
end
- set var $id = ($id + 1) & $id_mask
if ($id == $end_id)
loop_break
end
+ set var $id = ($id + 1) & $id_mask
end
end
document dmesg
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 531/567] mm: memcontrol: deprecate charge moving
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 530/567] docs: gdbmacros: print newest record Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 532/567] mm/thp: check and bail out if page in deferred queue already Greg Kroah-Hartman
` (39 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Weiner, Shakeel Butt,
Hugh Dickins, Michal Hocko, Muchun Song, Roman Gushchin,
Andrew Morton
From: Johannes Weiner <hannes@cmpxchg.org>
commit da34a8484d162585e22ed8c1e4114aa2f60e3567 upstream.
Charge moving mode in cgroup1 allows memory to follow tasks as they
migrate between cgroups. This is, and always has been, a questionable
thing to do - for several reasons.
First, it's expensive. Pages need to be identified, locked and isolated
from various MM operations, and reassigned, one by one.
Second, it's unreliable. Once pages are charged to a cgroup, there isn't
always a clear owner task anymore. Cache isn't moved at all, for example.
Mapped memory is moved - but if trylocking or isolating a page fails,
it's arbitrarily left behind. Frequent moving between domains may leave a
task's memory scattered all over the place.
Third, it isn't really needed. Launcher tasks can kick off workload tasks
directly in their target cgroup. Using dedicated per-workload groups
allows fine-grained policy adjustments - no need to move tasks and their
physical pages between control domains. The feature was never
forward-ported to cgroup2, and it hasn't been missed.
Despite it being a niche usecase, the maintenance overhead of supporting
it is enormous. Because pages are moved while they are live and subject
to various MM operations, the synchronization rules are complicated.
There are lock_page_memcg() in MM and FS code, which non-cgroup people
don't understand. In some cases we've been able to shift code and cgroup
API calls around such that we can rely on native locking as much as
possible. But that's fragile, and sometimes we need to hold MM locks for
longer than we otherwise would (pte lock e.g.).
Mark the feature deprecated. Hopefully we can remove it soon.
And backport into -stable kernels so that people who develop against
earlier kernels are warned about this deprecation as early as possible.
[akpm@linux-foundation.org: fix memory.rst underlining]
Link: https://lkml.kernel.org/r/Y5COd+qXwk/S+n8N@cmpxchg.org
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Hugh Dickins <hughd@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Muchun Song <songmuchun@bytedance.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/cgroup-v1/memory.rst | 13 +++++++++++--
mm/memcontrol.c | 4 ++++
2 files changed, 15 insertions(+), 2 deletions(-)
--- a/Documentation/admin-guide/cgroup-v1/memory.rst
+++ b/Documentation/admin-guide/cgroup-v1/memory.rst
@@ -84,6 +84,8 @@ Brief summary of control files.
memory.swappiness set/show swappiness parameter of vmscan
(See sysctl's vm.swappiness)
memory.move_charge_at_immigrate set/show controls of moving charges
+ This knob is deprecated and shouldn't be
+ used.
memory.oom_control set/show oom controls.
memory.numa_stat show the number of memory usage per numa
node
@@ -723,8 +725,15 @@ NOTE2:
It is recommended to set the soft limit always below the hard limit,
otherwise the hard limit will take precedence.
-8. Move charges at task migration
-=================================
+8. Move charges at task migration (DEPRECATED!)
+===============================================
+
+THIS IS DEPRECATED!
+
+It's expensive and unreliable! It's better practice to launch workload
+tasks directly from inside their target cgroup. Use dedicated workload
+cgroups to allow fine-grained policy adjustments without having to
+move physical pages between control domains.
Users can move charges associated with a task along with task migration, that
is, uncharge task's pages from the old cgroup and charge them to the new cgroup.
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3872,6 +3872,10 @@ static int mem_cgroup_move_charge_write(
{
struct mem_cgroup *memcg = mem_cgroup_from_css(css);
+ pr_warn_once("Cgroup memory moving (move_charge_at_immigrate) is deprecated. "
+ "Please report your usecase to linux-mm@kvack.org if you "
+ "depend on this functionality.\n");
+
if (val & ~MOVE_MASK)
return -EINVAL;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 532/567] mm/thp: check and bail out if page in deferred queue already
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 531/567] mm: memcontrol: deprecate charge moving Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 533/567] ktest.pl: Give back console on Ctrt^C on monitor Greg Kroah-Hartman
` (38 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yin Fengwei, Nathan Chancellor,
David Rientjes, Huang, Ying, Feng Tang, Matthew Wilcox,
Rik van Riel, Xing Zhengjun, Yang Shi, Andrew Morton
From: Yin Fengwei <fengwei.yin@intel.com>
commit 81e506bec9be1eceaf5a2c654e28ba5176ef48d8 upstream.
Kernel build regression with LLVM was reported here:
https://lore.kernel.org/all/Y1GCYXGtEVZbcv%2F5@dev-arch.thelio-3990X/ with
commit f35b5d7d676e ("mm: align larger anonymous mappings on THP
boundaries"). And the commit f35b5d7d676e was reverted.
It turned out the regression is related with madvise(MADV_DONTNEED)
was used by ld.lld. But with none PMD_SIZE aligned parameter len.
trace-bpfcc captured:
531607 531732 ld.lld do_madvise.part.0 start: 0x7feca9000000, len: 0x7fb000, behavior: 0x4
531607 531793 ld.lld do_madvise.part.0 start: 0x7fec86a00000, len: 0x7fb000, behavior: 0x4
If the underneath physical page is THP, the madvise(MADV_DONTNEED) can
trigger split_queue_lock contention raised significantly. perf showed
following data:
14.85% 0.00% ld.lld [kernel.kallsyms] [k]
entry_SYSCALL_64_after_hwframe
11.52%
entry_SYSCALL_64_after_hwframe
do_syscall_64
__x64_sys_madvise
do_madvise.part.0
zap_page_range
unmap_single_vma
unmap_page_range
page_remove_rmap
deferred_split_huge_page
__lock_text_start
native_queued_spin_lock_slowpath
If THP can't be removed from rmap as whole THP, partial THP will be
removed from rmap by removing sub-pages from rmap. Even the THP head page
is added to deferred queue already, the split_queue_lock will be acquired
and check whether the THP head page is in the queue already. Thus, the
contention of split_queue_lock is raised.
Before acquire split_queue_lock, check and bail out early if the THP
head page is in the queue already. The checking without holding
split_queue_lock could race with deferred_split_scan, but it doesn't
impact the correctness here.
Test result of building kernel with ld.lld:
commit 7b5a0b664ebe (parent commit of f35b5d7d676e):
time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all
6:07.99 real, 26367.77 user, 5063.35 sys
commit f35b5d7d676e:
time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all
7:22.15 real, 26235.03 user, 12504.55 sys
commit f35b5d7d676e with the fixing patch:
time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all
6:08.49 real, 26520.15 user, 5047.91 sys
Link: https://lkml.kernel.org/r/20221223135207.2275317-1-fengwei.yin@intel.com
Signed-off-by: Yin Fengwei <fengwei.yin@intel.com>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: David Rientjes <rientjes@google.com>
Reviewed-by: "Huang, Ying" <ying.huang@intel.com>
Cc: Feng Tang <feng.tang@intel.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Xing Zhengjun <zhengjun.xing@linux.intel.com>
Cc: Yang Shi <shy828301@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/huge_memory.c | 3 +++
1 file changed, 3 insertions(+)
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2778,6 +2778,9 @@ void deferred_split_huge_page(struct pag
if (PageSwapCache(page))
return;
+ if (!list_empty(page_deferred_list(page)))
+ return;
+
spin_lock_irqsave(&ds_queue->split_queue_lock, flags);
if (list_empty(page_deferred_list(page))) {
count_vm_event(THP_DEFERRED_SPLIT_PAGE);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 533/567] ktest.pl: Give back console on Ctrt^C on monitor
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 532/567] mm/thp: check and bail out if page in deferred queue already Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 534/567] ktest.pl: Fix missing "end_monitor" when machine check fails Greg Kroah-Hartman
` (37 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Steven Rostedt
From: Steven Rostedt <rostedt@goodmis.org>
commit 83d29d439cd3ef23041570d55841f814af2ecac0 upstream.
When monitoring the console output, the stdout is being redirected to do
so. If Ctrl^C is hit during this mode, the stdout is not back to the
console, the user does not see anything they type (no echo).
Add "end_monitor" to the SIGINT interrupt handler to give back the console
on Ctrl^C.
Cc: stable@vger.kernel.org
Fixes: 9f2cdcbbb90e7 ("ktest: Give console process a dedicated tty")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/ktest/ktest.pl | 3 +++
1 file changed, 3 insertions(+)
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -4193,6 +4193,9 @@ sub send_email {
}
sub cancel_test {
+ if ($monitor_cnt) {
+ end_monitor;
+ }
if ($email_when_canceled) {
my $name = get_test_name;
send_email("KTEST: Your [$name] test was cancelled",
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 534/567] ktest.pl: Fix missing "end_monitor" when machine check fails
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 533/567] ktest.pl: Give back console on Ctrt^C on monitor Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 535/567] ktest.pl: Add RUN_TIMEOUT option with default unlimited Greg Kroah-Hartman
` (36 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Steven Rostedt
From: Steven Rostedt <rostedt@goodmis.org>
commit e8bf9b98d40dbdf4e39362e3b85a70c61da68cb7 upstream.
In the "reboot" command, it does a check of the machine to see if it is
still alive with a simple "ssh echo" command. If it fails, it will assume
that a normal "ssh reboot" is not possible and force a power cycle.
In this case, the "start_monitor" is executed, but the "end_monitor" is
not, and this causes the screen will not be given back to the console. That
is, after the test, a "reset" command needs to be performed, as "echo" is
turned off.
Cc: stable@vger.kernel.org
Fixes: 6474ace999edd ("ktest.pl: Powercycle the box on reboot if no connection can be made")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/ktest/ktest.pl | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -1488,7 +1488,8 @@ sub reboot {
# Still need to wait for the reboot to finish
wait_for_monitor($time, $reboot_success_line);
-
+ }
+ if ($powercycle || $time) {
end_monitor;
}
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 535/567] ktest.pl: Add RUN_TIMEOUT option with default unlimited
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 534/567] ktest.pl: Fix missing "end_monitor" when machine check fails Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 536/567] ring-buffer: Handle race between rb_move_tail and rb_check_pages Greg Kroah-Hartman
` (35 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Steven Rostedt
From: Steven Rostedt <rostedt@goodmis.org>
commit 4e7d2a8f0b52abf23b1dc13b3d88bc0923383cd5 upstream.
There is a disconnect between the run_command function and the
wait_for_input. The wait_for_input has a default timeout of 2 minutes. But
if that happens, the run_command loop will exit out to the waitpid() of
the executing command. This fails in that it no longer monitors the
command, and also, the ssh to the test box can hang when its finished, as
it's waiting for the pipe it's writing to to flush, but the loop that
reads that pipe has already exited, leaving the command stuck, and the
test hangs.
Instead, make the default "wait_for_input" of the run_command infinite,
and allow the user to override it if they want with a default timeout
option "RUN_TIMEOUT".
But this fixes the hang that happens when the pipe is full and the ssh
session never exits.
Cc: stable@vger.kernel.org
Fixes: 6e98d1b4415fe ("ktest: Add timeout to ssh command")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/ktest/ktest.pl | 20 ++++++++++++++++----
tools/testing/ktest/sample.conf | 5 +++++
2 files changed, 21 insertions(+), 4 deletions(-)
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -178,6 +178,7 @@ my $store_failures;
my $store_successes;
my $test_name;
my $timeout;
+my $run_timeout;
my $connect_timeout;
my $config_bisect_exec;
my $booted_timeout;
@@ -340,6 +341,7 @@ my %option_map = (
"STORE_SUCCESSES" => \$store_successes,
"TEST_NAME" => \$test_name,
"TIMEOUT" => \$timeout,
+ "RUN_TIMEOUT" => \$run_timeout,
"CONNECT_TIMEOUT" => \$connect_timeout,
"CONFIG_BISECT_EXEC" => \$config_bisect_exec,
"BOOTED_TIMEOUT" => \$booted_timeout,
@@ -1851,6 +1853,14 @@ sub run_command {
$command =~ s/\$SSH_USER/$ssh_user/g;
$command =~ s/\$MACHINE/$machine/g;
+ if (!defined($timeout)) {
+ $timeout = $run_timeout;
+ }
+
+ if (!defined($timeout)) {
+ $timeout = -1; # tell wait_for_input to wait indefinitely
+ }
+
doprint("$command ... ");
$start_time = time;
@@ -1877,13 +1887,10 @@ sub run_command {
while (1) {
my $fp = \*CMD;
- if (defined($timeout)) {
- doprint "timeout = $timeout\n";
- }
my $line = wait_for_input($fp, $timeout);
if (!defined($line)) {
my $now = time;
- if (defined($timeout) && (($now - $start_time) >= $timeout)) {
+ if ($timeout >= 0 && (($now - $start_time) >= $timeout)) {
doprint "Hit timeout of $timeout, killing process\n";
$hit_timeout = 1;
kill 9, $pid;
@@ -2055,6 +2062,11 @@ sub wait_for_input {
$time = $timeout;
}
+ if ($time < 0) {
+ # Negative number means wait indefinitely
+ undef $time;
+ }
+
$rin = '';
vec($rin, fileno($fp), 1) = 1;
vec($rin, fileno(\*STDIN), 1) = 1;
--- a/tools/testing/ktest/sample.conf
+++ b/tools/testing/ktest/sample.conf
@@ -809,6 +809,11 @@
# is issued instead of a reboot.
# CONNECT_TIMEOUT = 25
+# The timeout in seconds for how long to wait for any running command
+# to timeout. If not defined, it will let it go indefinitely.
+# (default undefined)
+#RUN_TIMEOUT = 600
+
# In between tests, a reboot of the box may occur, and this
# is the time to wait for the console after it stops producing
# output. Some machines may not produce a large lag on reboot
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 536/567] ring-buffer: Handle race between rb_move_tail and rb_check_pages
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 535/567] ktest.pl: Add RUN_TIMEOUT option with default unlimited Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 537/567] tools/bootconfig: fix single & used for logical condition Greg Kroah-Hartman
` (34 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, mhiramat, Zheng Yejian, Mukesh Ojha,
Steven Rostedt (Google)
From: Mukesh Ojha <quic_mojha@quicinc.com>
commit 8843e06f67b14f71c044bf6267b2387784c7e198 upstream.
It seems a data race between ring_buffer writing and integrity check.
That is, RB_FLAG of head_page is been updating, while at same time
RB_FLAG was cleared when doing integrity check rb_check_pages():
rb_check_pages() rb_handle_head_page():
-------- --------
rb_head_page_deactivate()
rb_head_page_set_normal()
rb_head_page_activate()
We do intergrity test of the list to check if the list is corrupted and
it is still worth doing it. So, let's refactor rb_check_pages() such that
we no longer clear and set flag during the list sanity checking.
[1] and [2] are the test to reproduce and the crash report respectively.
1:
``` read_trace.sh
while true;
do
# the "trace" file is closed after read
head -1 /sys/kernel/tracing/trace > /dev/null
done
```
``` repro.sh
sysctl -w kernel.panic_on_warn=1
# function tracer will writing enough data into ring_buffer
echo function > /sys/kernel/tracing/current_tracer
./read_trace.sh &
./read_trace.sh &
./read_trace.sh &
./read_trace.sh &
./read_trace.sh &
./read_trace.sh &
./read_trace.sh &
./read_trace.sh &
```
2:
------------[ cut here ]------------
WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653
rb_move_tail+0x450/0x470
Modules linked in:
CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:rb_move_tail+0x450/0x470
Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24
83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83
f8 02 0f 84 ce fb ff ff e9 db
RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203
RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18
RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400
RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2
R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000
R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108
FS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0
Call Trace:
<TASK>
ring_buffer_lock_reserve+0x136/0x360
? __do_softirq+0x287/0x2df
? __pfx_rcu_softirq_qs+0x10/0x10
trace_function+0x21/0x110
? __pfx_rcu_softirq_qs+0x10/0x10
? __do_softirq+0x287/0x2df
function_trace_call+0xf6/0x120
0xffffffffc038f097
? rcu_softirq_qs+0x5/0x140
rcu_softirq_qs+0x5/0x140
__do_softirq+0x287/0x2df
run_ksoftirqd+0x2a/0x30
smpboot_thread_fn+0x188/0x220
? __pfx_smpboot_thread_fn+0x10/0x10
kthread+0xe7/0x110
? __pfx_kthread+0x10/0x10
ret_from_fork+0x2c/0x50
</TASK>
---[ end trace 0000000000000000 ]---
[ crash report and test reproducer credit goes to Zheng Yejian]
Link: https://lore.kernel.org/linux-trace-kernel/1676376403-16462-1-git-send-email-quic_mojha@quicinc.com
Cc: <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 1039221cc278 ("ring-buffer: Do not disable recording when there is an iterator")
Reported-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 42 ++++++++++--------------------------------
1 file changed, 10 insertions(+), 32 deletions(-)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1545,19 +1545,6 @@ static int rb_check_bpage(struct ring_bu
}
/**
- * rb_check_list - make sure a pointer to a list has the last bits zero
- */
-static int rb_check_list(struct ring_buffer_per_cpu *cpu_buffer,
- struct list_head *list)
-{
- if (RB_WARN_ON(cpu_buffer, rb_list_head(list->prev) != list->prev))
- return 1;
- if (RB_WARN_ON(cpu_buffer, rb_list_head(list->next) != list->next))
- return 1;
- return 0;
-}
-
-/**
* rb_check_pages - integrity check of buffer pages
* @cpu_buffer: CPU buffer with pages to test
*
@@ -1566,36 +1553,27 @@ static int rb_check_list(struct ring_buf
*/
static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer)
{
- struct list_head *head = cpu_buffer->pages;
- struct buffer_page *bpage, *tmp;
+ struct list_head *head = rb_list_head(cpu_buffer->pages);
+ struct list_head *tmp;
- /* Reset the head page if it exists */
- if (cpu_buffer->head_page)
- rb_set_head_page(cpu_buffer);
-
- rb_head_page_deactivate(cpu_buffer);
-
- if (RB_WARN_ON(cpu_buffer, head->next->prev != head))
- return -1;
- if (RB_WARN_ON(cpu_buffer, head->prev->next != head))
+ if (RB_WARN_ON(cpu_buffer,
+ rb_list_head(rb_list_head(head->next)->prev) != head))
return -1;
- if (rb_check_list(cpu_buffer, head))
+ if (RB_WARN_ON(cpu_buffer,
+ rb_list_head(rb_list_head(head->prev)->next) != head))
return -1;
- list_for_each_entry_safe(bpage, tmp, head, list) {
+ for (tmp = rb_list_head(head->next); tmp != head; tmp = rb_list_head(tmp->next)) {
if (RB_WARN_ON(cpu_buffer,
- bpage->list.next->prev != &bpage->list))
+ rb_list_head(rb_list_head(tmp->next)->prev) != tmp))
return -1;
+
if (RB_WARN_ON(cpu_buffer,
- bpage->list.prev->next != &bpage->list))
- return -1;
- if (rb_check_list(cpu_buffer, &bpage->list))
+ rb_list_head(rb_list_head(tmp->prev)->next) != tmp))
return -1;
}
- rb_head_page_activate(cpu_buffer);
-
return 0;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 537/567] tools/bootconfig: fix single & used for logical condition
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 536/567] ring-buffer: Handle race between rb_move_tail and rb_check_pages Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 538/567] scsi: core: Remove the /proc/scsi/${proc_name} directory earlier Greg Kroah-Hartman
` (33 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antonio Alvarez Feijoo,
Masami Hiramatsu (Google)
From: Antonio Alvarez Feijoo <antonio.feijoo@suse.com>
commit cf8c59a3756b2735c409a9b3ac1e4ec556546a7a upstream.
A single & will create a background process and return true, so the grep
command will run even if the file checked in the first condition does not
exist.
Link: https://lore.kernel.org/all/20230112114215.17103-1-antonio.feijoo@suse.com/
Fixes: 1eaad3ac3f39 ("tools/bootconfig: Use per-group/all enable option in ftrace2bconf script")
Signed-off-by: Antonio Alvarez Feijoo <antonio.feijoo@suse.com>
Cc: stable@vger.kernel.org
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/bootconfig/scripts/ftrace2bconf.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/bootconfig/scripts/ftrace2bconf.sh b/tools/bootconfig/scripts/ftrace2bconf.sh
index 6183b36c6846..1603801cf126 100755
--- a/tools/bootconfig/scripts/ftrace2bconf.sh
+++ b/tools/bootconfig/scripts/ftrace2bconf.sh
@@ -93,7 +93,7 @@ referred_vars() {
}
event_is_enabled() { # enable-file
- test -f $1 & grep -q "1" $1
+ test -f $1 && grep -q "1" $1
}
per_event_options() { # event-dir
--
2.39.2
^ permalink raw reply related [flat|nested] 578+ messages in thread* [PATCH 5.15 538/567] scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 537/567] tools/bootconfig: fix single & used for logical condition Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 539/567] scsi: qla2xxx: Fix link failure in NPIV environment Greg Kroah-Hartman
` (32 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern, Yi Zhang,
Bart Van Assche, Martin K. Petersen
From: Bart Van Assche <bvanassche@acm.org>
commit fc663711b94468f4e1427ebe289c9f05669699c9 upstream.
Remove the /proc/scsi/${proc_name} directory earlier to fix a race
condition between unloading and reloading kernel modules. This fixes a bug
introduced in 2009 by commit 77c019768f06 ("[SCSI] fix /proc memory leak in
the SCSI core").
Fix the following kernel warning:
proc_dir_entry 'scsi/scsi_debug' already registered
WARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_register+0x27d/0x2e0
Call Trace:
proc_mkdir+0xb5/0xe0
scsi_proc_hostdir_add+0xb5/0x170
scsi_host_alloc+0x683/0x6c0
sdebug_driver_probe+0x6b/0x2d0 [scsi_debug]
really_probe+0x159/0x540
__driver_probe_device+0xdc/0x230
driver_probe_device+0x4f/0x120
__device_attach_driver+0xef/0x180
bus_for_each_drv+0xe5/0x130
__device_attach+0x127/0x290
device_initial_probe+0x17/0x20
bus_probe_device+0x110/0x130
device_add+0x673/0xc80
device_register+0x1e/0x30
sdebug_add_host_helper+0x1a7/0x3b0 [scsi_debug]
scsi_debug_init+0x64f/0x1000 [scsi_debug]
do_one_initcall+0xd7/0x470
do_init_module+0xe7/0x330
load_module+0x122a/0x12c0
__do_sys_finit_module+0x124/0x1a0
__x64_sys_finit_module+0x46/0x50
do_syscall_64+0x38/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Link: https://lore.kernel.org/r/20230210205200.36973-3-bvanassche@acm.org
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Yi Zhang <yi.zhang@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core")
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/hosts.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -180,6 +180,7 @@ void scsi_remove_host(struct Scsi_Host *
scsi_forget_host(shost);
mutex_unlock(&shost->scan_mutex);
scsi_proc_host_rm(shost);
+ scsi_proc_hostdir_rm(shost->hostt);
spin_lock_irqsave(shost->host_lock, flags);
if (scsi_host_set_state(shost, SHOST_DEL))
@@ -321,6 +322,7 @@ static void scsi_host_dev_release(struct
struct Scsi_Host *shost = dev_to_shost(dev);
struct device *parent = dev->parent;
+ /* In case scsi_remove_host() has not been called. */
scsi_proc_hostdir_rm(shost->hostt);
/* Wait for functions invoked through call_rcu(&scmd->rcu, ...) */
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 539/567] scsi: qla2xxx: Fix link failure in NPIV environment
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 538/567] scsi: core: Remove the /proc/scsi/${proc_name} directory earlier Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 540/567] scsi: qla2xxx: Check if port is online before sending ELS Greg Kroah-Hartman
` (31 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
From: Quinn Tran <qutran@marvell.com>
commit b1ae65c082f74536ec292b15766f2846f0238373 upstream.
User experienced symptoms of adapter failure in NPIV environment. NPIV
hosts were allowed to trigger chip reset back to back due to NPIV link
state being slow to come online.
Fix link failure in NPIV environment by removing NPIV host from directly
being able to perform chip reset.
kernel: qla2xxx [0000:04:00.1]-6009:261: Loop down - aborting ISP.
kernel: qla2xxx [0000:04:00.1]-6009:262: Loop down - aborting ISP.
kernel: qla2xxx [0000:04:00.1]-6009:281: Loop down - aborting ISP.
kernel: qla2xxx [0000:04:00.1]-6009:285: Loop down - aborting ISP
Fixes: 0d6e61bc6a4f ("[SCSI] qla2xxx: Correct various NPIV issues.")
Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_os.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -7422,7 +7422,7 @@ qla2x00_timer(struct timer_list *t)
/* if the loop has been down for 4 minutes, reinit adapter */
if (atomic_dec_and_test(&vha->loop_down_timer) != 0) {
- if (!(vha->device_flags & DFLG_NO_CABLE)) {
+ if (!(vha->device_flags & DFLG_NO_CABLE) && !vha->vp_idx) {
ql_log(ql_log_warn, vha, 0x6009,
"Loop down - aborting ISP.\n");
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 540/567] scsi: qla2xxx: Check if port is online before sending ELS
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 539/567] scsi: qla2xxx: Fix link failure in NPIV environment Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 541/567] scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests Greg Kroah-Hartman
` (30 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shreyas Deodhar, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
From: Shreyas Deodhar <sdeodhar@marvell.com>
commit 0c227dc22ca18856055983f27594feb2e0149965 upstream.
CT Ping and ELS cmds fail for NVMe targets. Check if port is online before
sending ELS instead of sending login.
Cc: stable@vger.kernel.org
Signed-off-by: Shreyas Deodhar <sdeodhar@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_bsg.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -278,8 +278,8 @@ qla2x00_process_els(struct bsg_job *bsg_
const char *type;
int req_sg_cnt, rsp_sg_cnt;
int rval = (DID_ERROR << 16);
- uint16_t nextlid = 0;
uint32_t els_cmd = 0;
+ int qla_port_allocated = 0;
if (bsg_request->msgcode == FC_BSG_RPT_ELS) {
rport = fc_bsg_to_rport(bsg_job);
@@ -329,9 +329,9 @@ qla2x00_process_els(struct bsg_job *bsg_
/* make sure the rport is logged in,
* if not perform fabric login
*/
- if (qla2x00_fabric_login(vha, fcport, &nextlid)) {
+ if (atomic_read(&fcport->state) != FCS_ONLINE) {
ql_dbg(ql_dbg_user, vha, 0x7003,
- "Failed to login port %06X for ELS passthru.\n",
+ "Port %06X is not online for ELS passthru.\n",
fcport->d_id.b24);
rval = -EIO;
goto done;
@@ -348,6 +348,7 @@ qla2x00_process_els(struct bsg_job *bsg_
goto done;
}
+ qla_port_allocated = 1;
/* Initialize all required fields of fcport */
fcport->vha = vha;
fcport->d_id.b.al_pa =
@@ -432,7 +433,7 @@ done_unmap_sg:
goto done_free_fcport;
done_free_fcport:
- if (bsg_request->msgcode != FC_BSG_RPT_ELS)
+ if (qla_port_allocated)
qla2x00_free_fcport(fcport);
done:
return rval;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 541/567] scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 540/567] scsi: qla2xxx: Check if port is online before sending ELS Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 542/567] scsi: qla2xxx: Remove unintended flag clearing Greg Kroah-Hartman
` (29 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arun Easi, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
From: Arun Easi <aeasi@marvell.com>
commit c75e6aef5039830cce5d4cf764dd204522f89e6b upstream.
The following message and call trace was seen with debug kernels:
DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map
error [device address=0x00000002a3ff38d8] [size=1024 bytes] [mapped as
single]
WARNING: CPU: 0 PID: 2930 at kernel/dma/debug.c:1017
check_unmap+0xf42/0x1990
Call Trace:
debug_dma_unmap_page+0xc9/0x100
qla_nvme_ls_unmap+0x141/0x210 [qla2xxx]
Remove DMA mapping from the driver altogether, as it is already done by FC
layer. This prevents the warning.
Fixes: c85ab7d9e27a ("scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests")
Cc: stable@vger.kernel.org
Signed-off-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_nvme.c | 19 +------------------
1 file changed, 1 insertion(+), 18 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -165,18 +165,6 @@ out:
qla2xxx_rel_qpair_sp(sp->qpair, sp);
}
-static void qla_nvme_ls_unmap(struct srb *sp, struct nvmefc_ls_req *fd)
-{
- if (sp->flags & SRB_DMA_VALID) {
- struct srb_iocb *nvme = &sp->u.iocb_cmd;
- struct qla_hw_data *ha = sp->fcport->vha->hw;
-
- dma_unmap_single(&ha->pdev->dev, nvme->u.nvme.cmd_dma,
- fd->rqstlen, DMA_TO_DEVICE);
- sp->flags &= ~SRB_DMA_VALID;
- }
-}
-
static void qla_nvme_release_ls_cmd_kref(struct kref *kref)
{
struct srb *sp = container_of(kref, struct srb, cmd_kref);
@@ -194,7 +182,6 @@ static void qla_nvme_release_ls_cmd_kref
fd = priv->fd;
- qla_nvme_ls_unmap(sp, fd);
fd->done(fd, priv->comp_status);
out:
qla2x00_rel_sp(sp);
@@ -360,13 +347,10 @@ static int qla_nvme_ls_req(struct nvme_f
nvme->u.nvme.rsp_len = fd->rsplen;
nvme->u.nvme.rsp_dma = fd->rspdma;
nvme->u.nvme.timeout_sec = fd->timeout;
- nvme->u.nvme.cmd_dma = dma_map_single(&ha->pdev->dev, fd->rqstaddr,
- fd->rqstlen, DMA_TO_DEVICE);
+ nvme->u.nvme.cmd_dma = fd->rqstdma;
dma_sync_single_for_device(&ha->pdev->dev, nvme->u.nvme.cmd_dma,
fd->rqstlen, DMA_TO_DEVICE);
- sp->flags |= SRB_DMA_VALID;
-
rval = qla2x00_start_sp(sp);
if (rval != QLA_SUCCESS) {
ql_log(ql_log_warn, vha, 0x700e,
@@ -374,7 +358,6 @@ static int qla_nvme_ls_req(struct nvme_f
wake_up(&sp->nvme_ls_waitq);
sp->priv = NULL;
priv->sp = NULL;
- qla_nvme_ls_unmap(sp, fd);
qla2x00_rel_sp(sp);
return rval;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 542/567] scsi: qla2xxx: Remove unintended flag clearing
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 541/567] scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 543/567] scsi: qla2xxx: Fix erroneous link down Greg Kroah-Hartman
` (28 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
From: Quinn Tran <qutran@marvell.com>
commit 7e8a936a2d0f98dd6e5d05d4838affabe606cabc upstream.
FCF_ASYNC_SENT flag is used in session management. This flag is cleared in
task management path by accident. Remove unintended flag clearing.
Fixes: 388a49959ee4 ("scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd")
Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2078,7 +2078,6 @@ qla2x00_async_tm_cmd(fc_port_t *fcport,
done_free_sp:
/* ref: INIT */
kref_put(&sp->cmd_kref, qla2x00_sp_release);
- fcport->flags &= ~FCF_ASYNC_SENT;
done:
return rval;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 543/567] scsi: qla2xxx: Fix erroneous link down
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 542/567] scsi: qla2xxx: Remove unintended flag clearing Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 544/567] scsi: qla2xxx: Remove increment of interface err cnt Greg Kroah-Hartman
` (27 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
From: Quinn Tran <qutran@marvell.com>
commit 3fbc74feb642deb688cc97f76d40b7287ddd4cb1 upstream.
If after an adapter reset the appearance of link is not recovered, the
devices are not rediscovered. This is result of a race condition between
adapter reset (abort_isp) and the topology scan. During adapter reset, the
ABORT_ISP_ACTIVE flag is set. Topology scan usually occurred after adapter
reset. In this case, the topology scan came earlier than usual where it
ran into problem due to ABORT_ISP_ACTIVE flag was still set.
kernel: qla2xxx [0000:13:00.0]-1005:1: Cmd 0x6a aborted with timeout since ISP Abort is pending
kernel: qla2xxx [0000:13:00.0]-28a0:1: MBX_GET_PORT_NAME failed, No FL Port.
kernel: qla2xxx [0000:13:00.0]-286b:1: qla2x00_configure_loop: exiting normally. local port wwpn 51402ec0123d9a80 id 012300)
kernel: qla2xxx [0000:13:00.0]-8017:1: ADAPTER RESET SUCCEEDED nexus=1:0:15.
Allow adapter reset to complete before any scan can start.
Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_os.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -7069,9 +7069,12 @@ qla2x00_do_dpc(void *data)
}
}
loop_resync_check:
- if (test_and_clear_bit(LOOP_RESYNC_NEEDED,
+ if (!qla2x00_reset_active(base_vha) &&
+ test_and_clear_bit(LOOP_RESYNC_NEEDED,
&base_vha->dpc_flags)) {
-
+ /*
+ * Allow abort_isp to complete before moving on to scanning.
+ */
ql_dbg(ql_dbg_dpc, base_vha, 0x400f,
"Loop resync scheduled.\n");
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 544/567] scsi: qla2xxx: Remove increment of interface err cnt
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 543/567] scsi: qla2xxx: Fix erroneous link down Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 545/567] scsi: ses: Dont attach if enclosure has no components Greg Kroah-Hartman
` (26 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saurav Kashyap, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
From: Saurav Kashyap <skashyap@marvell.com>
commit d676a9e3d9efb7e93df460bcf4c445496c16314f upstream.
Residual underrun is not an interface error, hence no need to increment
that count.
Fixes: dbf1f53cfd23 ("scsi: qla2xxx: Implementation to get and manage host, target stats and initiator port")
Cc: stable@vger.kernel.org
Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_isr.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3350,8 +3350,6 @@ qla2x00_status_entry(scsi_qla_host_t *vh
"Dropped frame(s) detected (0x%x of 0x%x bytes).\n",
resid, scsi_bufflen(cp));
- vha->interface_err_cnt++;
-
res = DID_ERROR << 16 | lscsi_status;
goto check_scsi_status;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 545/567] scsi: ses: Dont attach if enclosure has no components
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 544/567] scsi: qla2xxx: Remove increment of interface err cnt Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 546/567] scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() Greg Kroah-Hartman
` (25 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ding Hui, James Bottomley,
Martin K. Petersen
From: James Bottomley <jejb@linux.ibm.com>
commit 3fe97ff3d94934649abb0652028dd7296170c8d0 upstream.
An enclosure with no components can't usefully be operated by the driver
(since effectively it has nothing to manage), so report the problem and
don't attach. Not attaching also fixes an oops which could occur if the
driver tries to manage a zero component enclosure.
[mkp: Switched to KERN_WARNING since this scenario is common]
Link: https://lore.kernel.org/r/c5deac044ac409e32d9ad9968ce0dcbc996bfc7a.camel@linux.ibm.com
Cc: stable@vger.kernel.org
Reported-by: Ding Hui <dinghui@sangfor.com.cn>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/ses.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -704,6 +704,12 @@ static int ses_intf_add(struct device *c
type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE)
components += type_ptr[1];
}
+
+ if (components == 0) {
+ sdev_printk(KERN_WARNING, sdev, "enclosure has no enumerated components\n");
+ goto err_free;
+ }
+
ses_dev->page1 = buf;
ses_dev->page1_len = len;
buf = NULL;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 546/567] scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 545/567] scsi: ses: Dont attach if enclosure has no components Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 547/567] scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses Greg Kroah-Hartman
` (24 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tomas Henzl, Martin K. Petersen
From: Tomas Henzl <thenzl@redhat.com>
commit 9b4f5028e493cb353a5c8f5c45073eeea0303abd upstream.
A fix for:
BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses]
Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271
Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we
expect the size to be sanitized before first access to addl_desc_ptr[1].
Make sure we don't walk beyond end of page.
Link: https://lore.kernel.org/r/20230202162451.15346-2-thenzl@redhat.com
Cc: stable@vger.kernel.org
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/ses.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -603,9 +603,11 @@ static void ses_enclosure_data_process(s
/* these elements are optional */
type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT ||
type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT ||
- type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS))
+ type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) {
addl_desc_ptr += addl_desc_ptr[1] + 2;
-
+ if (addl_desc_ptr + 1 >= ses_dev->page10 + ses_dev->page10_len)
+ addl_desc_ptr = NULL;
+ }
}
}
kfree(buf);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 547/567] scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 546/567] scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 548/567] scsi: ses: Fix possible desc_ptr " Greg Kroah-Hartman
` (23 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tomas Henzl, Martin K. Petersen
From: Tomas Henzl <thenzl@redhat.com>
commit db95d4df71cb55506425b6e4a5f8d68e3a765b63 upstream.
Sanitize possible addl_desc_ptr out-of-bounds accesses in
ses_enclosure_data_process().
Link: https://lore.kernel.org/r/20230202162451.15346-3-thenzl@redhat.com
Cc: stable@vger.kernel.org
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/ses.c | 35 ++++++++++++++++++++++++++---------
1 file changed, 26 insertions(+), 9 deletions(-)
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -433,8 +433,8 @@ int ses_match_host(struct enclosure_devi
}
#endif /* 0 */
-static void ses_process_descriptor(struct enclosure_component *ecomp,
- unsigned char *desc)
+static int ses_process_descriptor(struct enclosure_component *ecomp,
+ unsigned char *desc, int max_desc_len)
{
int eip = desc[0] & 0x10;
int invalid = desc[0] & 0x80;
@@ -445,22 +445,32 @@ static void ses_process_descriptor(struc
unsigned char *d;
if (invalid)
- return;
+ return 0;
switch (proto) {
case SCSI_PROTOCOL_FCP:
if (eip) {
+ if (max_desc_len <= 7)
+ return 1;
d = desc + 4;
slot = d[3];
}
break;
case SCSI_PROTOCOL_SAS:
+
if (eip) {
+ if (max_desc_len <= 27)
+ return 1;
d = desc + 4;
slot = d[3];
d = desc + 8;
- } else
+ } else {
+ if (max_desc_len <= 23)
+ return 1;
d = desc + 4;
+ }
+
+
/* only take the phy0 addr */
addr = (u64)d[12] << 56 |
(u64)d[13] << 48 |
@@ -477,6 +487,8 @@ static void ses_process_descriptor(struc
}
ecomp->slot = slot;
scomp->addr = addr;
+
+ return 0;
}
struct efd {
@@ -549,7 +561,7 @@ static void ses_enclosure_data_process(s
/* skip past overall descriptor */
desc_ptr += len + 4;
}
- if (ses_dev->page10)
+ if (ses_dev->page10 && ses_dev->page10_len > 9)
addl_desc_ptr = ses_dev->page10 + 8;
type_ptr = ses_dev->page1_types;
components = 0;
@@ -557,6 +569,7 @@ static void ses_enclosure_data_process(s
for (j = 0; j < type_ptr[1]; j++) {
char *name = NULL;
struct enclosure_component *ecomp;
+ int max_desc_len;
if (desc_ptr) {
if (desc_ptr >= buf + page7_len) {
@@ -583,10 +596,14 @@ static void ses_enclosure_data_process(s
ecomp = &edev->component[components++];
if (!IS_ERR(ecomp)) {
- if (addl_desc_ptr)
- ses_process_descriptor(
- ecomp,
- addl_desc_ptr);
+ if (addl_desc_ptr) {
+ max_desc_len = ses_dev->page10_len -
+ (addl_desc_ptr - ses_dev->page10);
+ if (ses_process_descriptor(ecomp,
+ addl_desc_ptr,
+ max_desc_len))
+ addl_desc_ptr = NULL;
+ }
if (create)
enclosure_component_register(
ecomp);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 548/567] scsi: ses: Fix possible desc_ptr out-of-bounds accesses
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 547/567] scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 549/567] scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() Greg Kroah-Hartman
` (22 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tomas Henzl, Martin K. Petersen
From: Tomas Henzl <thenzl@redhat.com>
commit 801ab13d50cf3d26170ee073ea8bb4eececb76ab upstream.
Sanitize possible desc_ptr out-of-bounds accesses in
ses_enclosure_data_process().
Link: https://lore.kernel.org/r/20230202162451.15346-4-thenzl@redhat.com
Cc: stable@vger.kernel.org
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/ses.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -572,15 +572,19 @@ static void ses_enclosure_data_process(s
int max_desc_len;
if (desc_ptr) {
- if (desc_ptr >= buf + page7_len) {
+ if (desc_ptr + 3 >= buf + page7_len) {
desc_ptr = NULL;
} else {
len = (desc_ptr[2] << 8) + desc_ptr[3];
desc_ptr += 4;
- /* Add trailing zero - pushes into
- * reserved space */
- desc_ptr[len] = '\0';
- name = desc_ptr;
+ if (desc_ptr + len > buf + page7_len)
+ desc_ptr = NULL;
+ else {
+ /* Add trailing zero - pushes into
+ * reserved space */
+ desc_ptr[len] = '\0';
+ name = desc_ptr;
+ }
}
}
if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 549/567] scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 548/567] scsi: ses: Fix possible desc_ptr " Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 550/567] RISC-V: add a spin_shadow_stack declaration Greg Kroah-Hartman
` (21 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tomas Henzl, Martin K. Petersen
From: Tomas Henzl <thenzl@redhat.com>
commit 578797f0c8cbc2e3ec5fc0dab87087b4c7073686 upstream.
A fix for:
BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses]
Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013
When edev->components is zero, accessing edev->component[0] members is
wrong.
Link: https://lore.kernel.org/r/20230202162451.15346-5-thenzl@redhat.com
Cc: stable@vger.kernel.org
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/ses.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -856,7 +856,8 @@ static void ses_intf_remove_enclosure(st
kfree(ses_dev->page2);
kfree(ses_dev);
- kfree(edev->component[0].scratch);
+ if (edev->components)
+ kfree(edev->component[0].scratch);
put_device(&edev->edev);
enclosure_unregister(edev);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 550/567] RISC-V: add a spin_shadow_stack declaration
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 549/567] scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 551/567] riscv: mm: fix regression due to update_mmu_cache change Greg Kroah-Hartman
` (20 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Conor Dooley, Guo Ren, Palmer Dabbelt
From: Conor Dooley <conor.dooley@microchip.com>
commit eb9be8310c58c166f9fae3b71c0ad9d6741b4897 upstream.
The patchwork automation reported a sparse complaint that
spin_shadow_stack was not declared and should be static:
../arch/riscv/kernel/traps.c:335:15: warning: symbol 'spin_shadow_stack' was not declared. Should it be static?
However, this is used in entry.S and therefore shouldn't be static.
The same applies to the shadow_stack that this pseudo spinlock is
trying to protect, so do like its charge and add a declaration to
thread_info.h
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Fixes: 7e1864332fbc ("riscv: fix race when vmap stack overflow")
Reviewed-by: Guo Ren <guoren@kernel.org>
Link: https://lore.kernel.org/r/20230210185945.915806-1-conor@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/thread_info.h | 1 +
1 file changed, 1 insertion(+)
--- a/arch/riscv/include/asm/thread_info.h
+++ b/arch/riscv/include/asm/thread_info.h
@@ -43,6 +43,7 @@
#ifndef __ASSEMBLY__
extern long shadow_stack[SHADOW_OVERFLOW_STACK_SIZE / sizeof(long)];
+extern unsigned long spin_shadow_stack;
#include <asm/processor.h>
#include <asm/csr.h>
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 551/567] riscv: mm: fix regression due to update_mmu_cache change
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 550/567] RISC-V: add a spin_shadow_stack declaration Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 552/567] riscv: jump_label: Fixup unaligned arch_static_branch function Greg Kroah-Hartman
` (19 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad, Prabhakar, Sergey Matyukevich,
Conor Dooley, Palmer Dabbelt
From: Sergey Matyukevich <sergey.matyukevich@syntacore.com>
commit b49f700668fff7565b945dce823def79bff59bb0 upstream.
This is a partial revert of the commit 4bd1d80efb5a ("riscv: mm: notify
remote harts about mmu cache updates"). Original commit included two
loosely related changes serving the same purpose of fixing stale TLB
entries causing user-space application crash:
- introduce deferred per-ASID TLB flush for CPUs not running the task
- switch to per-ASID TLB flush on all CPUs running the task in update_mmu_cache
According to report and discussion in [1], the second part caused a
regression on Renesas RZ/Five SoC. For now restore the old behavior
of the update_mmu_cache.
[1] https://lore.kernel.org/linux-riscv/20220829205219.283543-1-geomatsi@gmail.com/
Fixes: 4bd1d80efb5a ("riscv: mm: notify remote harts about mmu cache updates")
Reported-by: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: Sergey Matyukevich <sergey.matyukevich@syntacore.com>
Link: trailer, so that it can be parsed with git's trailer functionality?
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20230129211818.686557-1-geomatsi@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/pgtable.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -386,7 +386,7 @@ static inline void update_mmu_cache(stru
* Relying on flush_tlb_fix_spurious_fault would suffice, but
* the extra traps reduce performance. So, eagerly SFENCE.VMA.
*/
- flush_tlb_page(vma, address);
+ local_flush_tlb_page(address);
}
static inline void update_mmu_cache_pmd(struct vm_area_struct *vma,
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 552/567] riscv: jump_label: Fixup unaligned arch_static_branch function
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 551/567] riscv: mm: fix regression due to update_mmu_cache change Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 553/567] riscv, mm: Perform BPF exhandler fixup on page fault Greg Kroah-Hartman
` (18 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Greentime Hu, Andy Chiu, Guo Ren,
Palmer Dabbelt
From: Andy Chiu <andy.chiu@sifive.com>
commit 9ddfc3cd806081ce1f6c9c2f988cbb031f35d28f upstream.
Runtime code patching must be done at a naturally aligned address, or we
may execute on a partial instruction.
We have encountered problems traced back to static jump functions during
the test. We switched the tracer randomly for every 1~5 seconds on a
dual-core QEMU setup and found the kernel sucking at a static branch
where it jumps to itself.
The reason is that the static branch was 2-byte but not 4-byte aligned.
Then, the kernel would patch the instruction, either J or NOP, with two
half-word stores if the machine does not have efficient unaligned
accesses. Thus, moments exist where half of the NOP mixes with the other
half of the J when transitioning the branch. In our particular case, on
a little-endian machine, the upper half of the NOP was mixed with the
lower part of the J when enabling the branch, resulting in a jump that
jumped to itself. Conversely, it would result in a HINT instruction when
disabling the branch, but it might not be observable.
ARM64 does not have this problem since all instructions must be 4-byte
aligned.
Fixes: ebc00dde8a97 ("riscv: Add jump-label implementation")
Link: https://lore.kernel.org/linux-riscv/20220913094252.3555240-6-andy.chiu@sifive.com/
Reviewed-by: Greentime Hu <greentime.hu@sifive.com>
Signed-off-by: Andy Chiu <andy.chiu@sifive.com>
Signed-off-by: Guo Ren <guoren@kernel.org>
Link: https://lore.kernel.org/r/20230206090440.1255001-1-guoren@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/jump_label.h | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/riscv/include/asm/jump_label.h
+++ b/arch/riscv/include/asm/jump_label.h
@@ -18,6 +18,7 @@ static __always_inline bool arch_static_
bool branch)
{
asm_volatile_goto(
+ " .align 2 \n\t"
" .option push \n\t"
" .option norelax \n\t"
" .option norvc \n\t"
@@ -39,6 +40,7 @@ static __always_inline bool arch_static_
bool branch)
{
asm_volatile_goto(
+ " .align 2 \n\t"
" .option push \n\t"
" .option norelax \n\t"
" .option norvc \n\t"
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 553/567] riscv, mm: Perform BPF exhandler fixup on page fault
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 552/567] riscv: jump_label: Fixup unaligned arch_static_branch function Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 554/567] riscv: ftrace: Remove wasted nops for !RISCV_ISA_C Greg Kroah-Hartman
` (17 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Björn Töpel, Palmer Dabbelt
From: Björn Töpel <bjorn@rivosinc.com>
commit 416721ff05fddc58ca531b6f069de250301de6e5 upstream.
Commit 21855cac82d3 ("riscv/mm: Prevent kernel module to access user
memory without uaccess routines") added early exits/deaths for page
faults stemming from accesses to user-space without using proper
uaccess routines (where sstatus.SUM is set).
Unfortunatly, this is too strict for some BPF programs, which relies
on BPF exhandler fixups. These BPF programs loads "BTF pointers". A
BTF pointers could either be a valid kernel pointer or NULL, but not a
userspace address.
Resolve the problem by calling the fixup handler in the early exit
path.
Fixes: 21855cac82d3 ("riscv/mm: Prevent kernel module to access user memory without uaccess routines")
Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
Link: https://lore.kernel.org/r/20230214162515.184827-1-bjorn@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/mm/fault.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/arch/riscv/mm/fault.c
+++ b/arch/riscv/mm/fault.c
@@ -271,10 +271,12 @@ asmlinkage void do_page_fault(struct pt_
if (user_mode(regs))
flags |= FAULT_FLAG_USER;
- if (!user_mode(regs) && addr < TASK_SIZE &&
- unlikely(!(regs->status & SR_SUM)))
- die_kernel_fault("access to user memory without uaccess routines",
- addr, regs);
+ if (!user_mode(regs) && addr < TASK_SIZE && unlikely(!(regs->status & SR_SUM))) {
+ if (fixup_exception(regs))
+ return;
+
+ die_kernel_fault("access to user memory without uaccess routines", addr, regs);
+ }
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 554/567] riscv: ftrace: Remove wasted nops for !RISCV_ISA_C
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 553/567] riscv, mm: Perform BPF exhandler fixup on page fault Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 555/567] riscv: ftrace: Reduce the detour code size to half Greg Kroah-Hartman
` (16 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guo Ren, Guo Ren, Palmer Dabbelt
From: Guo Ren <guoren@linux.alibaba.com>
commit 409c8fb20c66df7150e592747412438c04aeb11f upstream.
When CONFIG_RISCV_ISA_C=n, -fpatchable-function-entry=8 would generate
more nops than we expect. Because it treat nop opcode as 0x00000013
instead of 0x0001.
Dump of assembler code for function dw_pcie_free_msi:
0xffffffff806fce94 <+0>: sd ra,-8(sp)
0xffffffff806fce98 <+4>: auipc ra,0xff90f
0xffffffff806fce9c <+8>: jalr -684(ra) # 0xffffffff8000bbec
<ftrace_caller>
0xffffffff806fcea0 <+12>: ld ra,-8(sp)
0xffffffff806fcea4 <+16>: nop /* wasted */
0xffffffff806fcea8 <+20>: nop /* wasted */
0xffffffff806fceac <+24>: nop /* wasted */
0xffffffff806fceb0 <+28>: nop /* wasted */
0xffffffff806fceb4 <+0>: addi sp,sp,-48
0xffffffff806fceb8 <+4>: sd s0,32(sp)
0xffffffff806fcebc <+8>: sd s1,24(sp)
0xffffffff806fcec0 <+12>: sd s2,16(sp)
0xffffffff806fcec4 <+16>: sd s3,8(sp)
0xffffffff806fcec8 <+20>: sd ra,40(sp)
0xffffffff806fcecc <+24>: addi s0,sp,48
Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
Signed-off-by: Guo Ren <guoren@kernel.org>
Link: https://lore.kernel.org/r/20230112090603.1295340-3-guoren@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/Makefile | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/riscv/Makefile
+++ b/arch/riscv/Makefile
@@ -13,7 +13,11 @@ LDFLAGS_vmlinux :=
ifeq ($(CONFIG_DYNAMIC_FTRACE),y)
LDFLAGS_vmlinux := --no-relax
KBUILD_CPPFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY
+ifeq ($(CONFIG_RISCV_ISA_C),y)
CC_FLAGS_FTRACE := -fpatchable-function-entry=8
+else
+ CC_FLAGS_FTRACE := -fpatchable-function-entry=4
+endif
endif
ifeq ($(CONFIG_CMODEL_MEDLOW),y)
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 555/567] riscv: ftrace: Reduce the detour code size to half
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 554/567] riscv: ftrace: Remove wasted nops for !RISCV_ISA_C Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 556/567] MIPS: DTS: CI20: fix otg power gpio Greg Kroah-Hartman
` (15 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Shuai, Guo Ren, Guo Ren,
Evgenii Shatokhin, Palmer Dabbelt
From: Guo Ren <guoren@linux.alibaba.com>
commit 6724a76cff85ee271bbbff42ac527e4643b2ec52 upstream.
Use a temporary register to reduce the size of detour code from 16 bytes to
8 bytes. The previous implementation is from 'commit afc76b8b8011 ("riscv:
Using PATCHABLE_FUNCTION_ENTRY instead of MCOUNT")'.
Before the patch:
<func_prolog>:
0: REG_S ra, -SZREG(sp)
4: auipc ra, ?
8: jalr ?(ra)
12: REG_L ra, -SZREG(sp)
(func_boddy)
After the patch:
<func_prolog>:
0: auipc t0, ?
4: jalr t0, ?(t0)
(func_boddy)
This patch not just reduces the size of detour code, but also fixes an
important issue:
An Ftrace callback registered with FTRACE_OPS_FL_IPMODIFY flag can
actually change the instruction pointer, e.g. to "replace" the given
kernel function with a new one, which is needed for livepatching, etc.
In this case, the trampoline (ftrace_regs_caller) would not return to
<func_prolog+12> but would rather jump to the new function. So, "REG_L
ra, -SZREG(sp)" would not run and the original return address would not
be restored. The kernel is likely to hang or crash as a result.
This can be easily demonstrated if one tries to "replace", say,
cmdline_proc_show() with a new function with the same signature using
instruction_pointer_set(&fregs->regs, new_func_addr) in the Ftrace
callback.
Link: https://lore.kernel.org/linux-riscv/20221122075440.1165172-1-suagrfillet@gmail.com/
Link: https://lore.kernel.org/linux-riscv/d7d5730b-ebef-68e5-5046-e763e1ee6164@yadro.com/
Co-developed-by: Song Shuai <suagrfillet@gmail.com>
Signed-off-by: Song Shuai <suagrfillet@gmail.com>
Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
Signed-off-by: Guo Ren <guoren@kernel.org>
Cc: Evgenii Shatokhin <e.shatokhin@yadro.com>
Reviewed-by: Evgenii Shatokhin <e.shatokhin@yadro.com>
Link: https://lore.kernel.org/r/20230112090603.1295340-4-guoren@kernel.org
Cc: stable@vger.kernel.org
Fixes: 10626c32e382 ("riscv/ftrace: Add basic support")
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/Makefile | 4 +-
arch/riscv/include/asm/ftrace.h | 50 +++++++++++++++++++++++-------
arch/riscv/kernel/ftrace.c | 65 +++++++++++-----------------------------
arch/riscv/kernel/mcount-dyn.S | 42 +++++++++----------------
4 files changed, 75 insertions(+), 86 deletions(-)
--- a/arch/riscv/Makefile
+++ b/arch/riscv/Makefile
@@ -14,9 +14,9 @@ ifeq ($(CONFIG_DYNAMIC_FTRACE),y)
LDFLAGS_vmlinux := --no-relax
KBUILD_CPPFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY
ifeq ($(CONFIG_RISCV_ISA_C),y)
- CC_FLAGS_FTRACE := -fpatchable-function-entry=8
-else
CC_FLAGS_FTRACE := -fpatchable-function-entry=4
+else
+ CC_FLAGS_FTRACE := -fpatchable-function-entry=2
endif
endif
--- a/arch/riscv/include/asm/ftrace.h
+++ b/arch/riscv/include/asm/ftrace.h
@@ -42,6 +42,14 @@ struct dyn_arch_ftrace {
* 2) jalr: setting low-12 offset to ra, jump to ra, and set ra to
* return address (original pc + 4)
*
+ *<ftrace enable>:
+ * 0: auipc t0/ra, 0x?
+ * 4: jalr t0/ra, ?(t0/ra)
+ *
+ *<ftrace disable>:
+ * 0: nop
+ * 4: nop
+ *
* Dynamic ftrace generates probes to call sites, so we must deal with
* both auipc and jalr at the same time.
*/
@@ -52,25 +60,43 @@ struct dyn_arch_ftrace {
#define AUIPC_OFFSET_MASK (0xfffff000)
#define AUIPC_PAD (0x00001000)
#define JALR_SHIFT 20
-#define JALR_BASIC (0x000080e7)
-#define AUIPC_BASIC (0x00000097)
+#define JALR_RA (0x000080e7)
+#define AUIPC_RA (0x00000097)
+#define JALR_T0 (0x000282e7)
+#define AUIPC_T0 (0x00000297)
#define NOP4 (0x00000013)
-#define make_call(caller, callee, call) \
+#define to_jalr_t0(offset) \
+ (((offset & JALR_OFFSET_MASK) << JALR_SHIFT) | JALR_T0)
+
+#define to_auipc_t0(offset) \
+ ((offset & JALR_SIGN_MASK) ? \
+ (((offset & AUIPC_OFFSET_MASK) + AUIPC_PAD) | AUIPC_T0) : \
+ ((offset & AUIPC_OFFSET_MASK) | AUIPC_T0))
+
+#define make_call_t0(caller, callee, call) \
do { \
- call[0] = to_auipc_insn((unsigned int)((unsigned long)callee - \
- (unsigned long)caller)); \
- call[1] = to_jalr_insn((unsigned int)((unsigned long)callee - \
- (unsigned long)caller)); \
+ unsigned int offset = \
+ (unsigned long) callee - (unsigned long) caller; \
+ call[0] = to_auipc_t0(offset); \
+ call[1] = to_jalr_t0(offset); \
} while (0)
-#define to_jalr_insn(offset) \
- (((offset & JALR_OFFSET_MASK) << JALR_SHIFT) | JALR_BASIC)
+#define to_jalr_ra(offset) \
+ (((offset & JALR_OFFSET_MASK) << JALR_SHIFT) | JALR_RA)
-#define to_auipc_insn(offset) \
+#define to_auipc_ra(offset) \
((offset & JALR_SIGN_MASK) ? \
- (((offset & AUIPC_OFFSET_MASK) + AUIPC_PAD) | AUIPC_BASIC) : \
- ((offset & AUIPC_OFFSET_MASK) | AUIPC_BASIC))
+ (((offset & AUIPC_OFFSET_MASK) + AUIPC_PAD) | AUIPC_RA) : \
+ ((offset & AUIPC_OFFSET_MASK) | AUIPC_RA))
+
+#define make_call_ra(caller, callee, call) \
+do { \
+ unsigned int offset = \
+ (unsigned long) callee - (unsigned long) caller; \
+ call[0] = to_auipc_ra(offset); \
+ call[1] = to_jalr_ra(offset); \
+} while (0)
/*
* Let auipc+jalr be the basic *mcount unit*, so we make it 8 bytes here.
--- a/arch/riscv/kernel/ftrace.c
+++ b/arch/riscv/kernel/ftrace.c
@@ -57,12 +57,15 @@ static int ftrace_check_current_call(uns
}
static int __ftrace_modify_call(unsigned long hook_pos, unsigned long target,
- bool enable)
+ bool enable, bool ra)
{
unsigned int call[2];
unsigned int nops[2] = {NOP4, NOP4};
- make_call(hook_pos, target, call);
+ if (ra)
+ make_call_ra(hook_pos, target, call);
+ else
+ make_call_t0(hook_pos, target, call);
/* Replace the auipc-jalr pair at once. Return -EPERM on write error. */
if (patch_text_nosync
@@ -72,42 +75,13 @@ static int __ftrace_modify_call(unsigned
return 0;
}
-/*
- * Put 5 instructions with 16 bytes at the front of function within
- * patchable function entry nops' area.
- *
- * 0: REG_S ra, -SZREG(sp)
- * 1: auipc ra, 0x?
- * 2: jalr -?(ra)
- * 3: REG_L ra, -SZREG(sp)
- *
- * So the opcodes is:
- * 0: 0xfe113c23 (sd)/0xfe112e23 (sw)
- * 1: 0x???????? -> auipc
- * 2: 0x???????? -> jalr
- * 3: 0xff813083 (ld)/0xffc12083 (lw)
- */
-#if __riscv_xlen == 64
-#define INSN0 0xfe113c23
-#define INSN3 0xff813083
-#elif __riscv_xlen == 32
-#define INSN0 0xfe112e23
-#define INSN3 0xffc12083
-#endif
-
-#define FUNC_ENTRY_SIZE 16
-#define FUNC_ENTRY_JMP 4
-
int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
{
- unsigned int call[4] = {INSN0, 0, 0, INSN3};
- unsigned long target = addr;
- unsigned long caller = rec->ip + FUNC_ENTRY_JMP;
+ unsigned int call[2];
- call[1] = to_auipc_insn((unsigned int)(target - caller));
- call[2] = to_jalr_insn((unsigned int)(target - caller));
+ make_call_t0(rec->ip, addr, call);
- if (patch_text_nosync((void *)rec->ip, call, FUNC_ENTRY_SIZE))
+ if (patch_text_nosync((void *)rec->ip, call, MCOUNT_INSN_SIZE))
return -EPERM;
return 0;
@@ -116,15 +90,14 @@ int ftrace_make_call(struct dyn_ftrace *
int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
unsigned long addr)
{
- unsigned int nops[4] = {NOP4, NOP4, NOP4, NOP4};
+ unsigned int nops[2] = {NOP4, NOP4};
- if (patch_text_nosync((void *)rec->ip, nops, FUNC_ENTRY_SIZE))
+ if (patch_text_nosync((void *)rec->ip, nops, MCOUNT_INSN_SIZE))
return -EPERM;
return 0;
}
-
/*
* This is called early on, and isn't wrapped by
* ftrace_arch_code_modify_{prepare,post_process}() and therefor doesn't hold
@@ -146,10 +119,10 @@ int ftrace_init_nop(struct module *mod,
int ftrace_update_ftrace_func(ftrace_func_t func)
{
int ret = __ftrace_modify_call((unsigned long)&ftrace_call,
- (unsigned long)func, true);
+ (unsigned long)func, true, true);
if (!ret) {
ret = __ftrace_modify_call((unsigned long)&ftrace_regs_call,
- (unsigned long)func, true);
+ (unsigned long)func, true, true);
}
return ret;
@@ -166,16 +139,16 @@ int ftrace_modify_call(struct dyn_ftrace
unsigned long addr)
{
unsigned int call[2];
- unsigned long caller = rec->ip + FUNC_ENTRY_JMP;
+ unsigned long caller = rec->ip;
int ret;
- make_call(caller, old_addr, call);
+ make_call_t0(caller, old_addr, call);
ret = ftrace_check_current_call(caller, call);
if (ret)
return ret;
- return __ftrace_modify_call(caller, addr, true);
+ return __ftrace_modify_call(caller, addr, true, false);
}
#endif
@@ -210,12 +183,12 @@ int ftrace_enable_ftrace_graph_caller(vo
int ret;
ret = __ftrace_modify_call((unsigned long)&ftrace_graph_call,
- (unsigned long)&prepare_ftrace_return, true);
+ (unsigned long)&prepare_ftrace_return, true, true);
if (ret)
return ret;
return __ftrace_modify_call((unsigned long)&ftrace_graph_regs_call,
- (unsigned long)&prepare_ftrace_return, true);
+ (unsigned long)&prepare_ftrace_return, true, true);
}
int ftrace_disable_ftrace_graph_caller(void)
@@ -223,12 +196,12 @@ int ftrace_disable_ftrace_graph_caller(v
int ret;
ret = __ftrace_modify_call((unsigned long)&ftrace_graph_call,
- (unsigned long)&prepare_ftrace_return, false);
+ (unsigned long)&prepare_ftrace_return, false, true);
if (ret)
return ret;
return __ftrace_modify_call((unsigned long)&ftrace_graph_regs_call,
- (unsigned long)&prepare_ftrace_return, false);
+ (unsigned long)&prepare_ftrace_return, false, true);
}
#endif /* CONFIG_DYNAMIC_FTRACE */
#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
--- a/arch/riscv/kernel/mcount-dyn.S
+++ b/arch/riscv/kernel/mcount-dyn.S
@@ -13,8 +13,8 @@
.text
-#define FENTRY_RA_OFFSET 12
-#define ABI_SIZE_ON_STACK 72
+#define FENTRY_RA_OFFSET 8
+#define ABI_SIZE_ON_STACK 80
#define ABI_A0 0
#define ABI_A1 8
#define ABI_A2 16
@@ -23,10 +23,10 @@
#define ABI_A5 40
#define ABI_A6 48
#define ABI_A7 56
-#define ABI_RA 64
+#define ABI_T0 64
+#define ABI_RA 72
.macro SAVE_ABI
- addi sp, sp, -SZREG
addi sp, sp, -ABI_SIZE_ON_STACK
REG_S a0, ABI_A0(sp)
@@ -37,6 +37,7 @@
REG_S a5, ABI_A5(sp)
REG_S a6, ABI_A6(sp)
REG_S a7, ABI_A7(sp)
+ REG_S t0, ABI_T0(sp)
REG_S ra, ABI_RA(sp)
.endm
@@ -49,24 +50,18 @@
REG_L a5, ABI_A5(sp)
REG_L a6, ABI_A6(sp)
REG_L a7, ABI_A7(sp)
+ REG_L t0, ABI_T0(sp)
REG_L ra, ABI_RA(sp)
addi sp, sp, ABI_SIZE_ON_STACK
- addi sp, sp, SZREG
.endm
#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
.macro SAVE_ALL
- addi sp, sp, -SZREG
addi sp, sp, -PT_SIZE_ON_STACK
- REG_S x1, PT_EPC(sp)
- addi sp, sp, PT_SIZE_ON_STACK
- REG_L x1, (sp)
- addi sp, sp, -PT_SIZE_ON_STACK
+ REG_S t0, PT_EPC(sp)
REG_S x1, PT_RA(sp)
- REG_L x1, PT_EPC(sp)
-
REG_S x2, PT_SP(sp)
REG_S x3, PT_GP(sp)
REG_S x4, PT_TP(sp)
@@ -100,15 +95,11 @@
.endm
.macro RESTORE_ALL
+ REG_L t0, PT_EPC(sp)
REG_L x1, PT_RA(sp)
- addi sp, sp, PT_SIZE_ON_STACK
- REG_S x1, (sp)
- addi sp, sp, -PT_SIZE_ON_STACK
- REG_L x1, PT_EPC(sp)
REG_L x2, PT_SP(sp)
REG_L x3, PT_GP(sp)
REG_L x4, PT_TP(sp)
- REG_L x5, PT_T0(sp)
REG_L x6, PT_T1(sp)
REG_L x7, PT_T2(sp)
REG_L x8, PT_S0(sp)
@@ -137,17 +128,16 @@
REG_L x31, PT_T6(sp)
addi sp, sp, PT_SIZE_ON_STACK
- addi sp, sp, SZREG
.endm
#endif /* CONFIG_DYNAMIC_FTRACE_WITH_REGS */
ENTRY(ftrace_caller)
SAVE_ABI
- addi a0, ra, -FENTRY_RA_OFFSET
+ addi a0, t0, -FENTRY_RA_OFFSET
la a1, function_trace_op
REG_L a2, 0(a1)
- REG_L a1, ABI_SIZE_ON_STACK(sp)
+ mv a1, ra
mv a3, sp
ftrace_call:
@@ -155,8 +145,8 @@ ftrace_call:
call ftrace_stub
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
- addi a0, sp, ABI_SIZE_ON_STACK
- REG_L a1, ABI_RA(sp)
+ addi a0, sp, ABI_RA
+ REG_L a1, ABI_T0(sp)
addi a1, a1, -FENTRY_RA_OFFSET
#ifdef HAVE_FUNCTION_GRAPH_FP_TEST
mv a2, s0
@@ -166,17 +156,17 @@ ftrace_graph_call:
call ftrace_stub
#endif
RESTORE_ABI
- ret
+ jr t0
ENDPROC(ftrace_caller)
#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
ENTRY(ftrace_regs_caller)
SAVE_ALL
- addi a0, ra, -FENTRY_RA_OFFSET
+ addi a0, t0, -FENTRY_RA_OFFSET
la a1, function_trace_op
REG_L a2, 0(a1)
- REG_L a1, PT_SIZE_ON_STACK(sp)
+ mv a1, ra
mv a3, sp
ftrace_regs_call:
@@ -196,6 +186,6 @@ ftrace_graph_regs_call:
#endif
RESTORE_ALL
- ret
+ jr t0
ENDPROC(ftrace_regs_caller)
#endif /* CONFIG_DYNAMIC_FTRACE_WITH_REGS */
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 556/567] MIPS: DTS: CI20: fix otg power gpio
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 555/567] riscv: ftrace: Reduce the detour code size to half Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 557/567] PCI/PM: Observe reset delay irrespective of bridge_d3 Greg Kroah-Hartman
` (14 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, H. Nikolaus Schaller, Paul Cercueil,
Thomas Bogendoerfer
From: H. Nikolaus Schaller <hns@goldelico.com>
commit 0cb4228f6cc9ed0ca2be0d9ddf29168a8e3a3905 upstream.
According to schematics it is PF15 and not PF14 (MIC_SW_EN).
Seems as if it was hidden and not noticed during testing since
there is no sound DT node.
Fixes: 158c774d3c64 ("MIPS: Ingenic: Add missing nodes for Ingenic SoCs and boards.")
Cc: stable@vger.kernel.org
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Acked-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/boot/dts/ingenic/ci20.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/boot/dts/ingenic/ci20.dts
+++ b/arch/mips/boot/dts/ingenic/ci20.dts
@@ -99,7 +99,7 @@
regulator-min-microvolt = <5000000>;
regulator-max-microvolt = <5000000>;
- gpio = <&gpf 14 GPIO_ACTIVE_LOW>;
+ gpio = <&gpf 15 GPIO_ACTIVE_LOW>;
enable-active-high;
};
};
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 557/567] PCI/PM: Observe reset delay irrespective of bridge_d3
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 556/567] MIPS: DTS: CI20: fix otg power gpio Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 558/567] PCI: hotplug: Allow marking devices as disconnected during bind/unbind Greg Kroah-Hartman
` (13 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ravi Kishore Koppuravuri,
Lukas Wunner, Bjorn Helgaas, Mika Westerberg,
Kuppuswamy Sathyanarayanan
From: Lukas Wunner <lukas@wunner.de>
commit 8ef0217227b42e2c34a18de316cee3da16c9bf1e upstream.
If a PCI bridge is suspended to D3cold upon entering system sleep,
resuming it entails a Fundamental Reset per PCIe r6.0 sec 5.8.
The delay prescribed after a Fundamental Reset in PCIe r6.0 sec 6.6.1
is sought to be observed by:
pci_pm_resume_noirq()
pci_pm_bridge_power_up_actions()
pci_bridge_wait_for_secondary_bus()
However, pci_bridge_wait_for_secondary_bus() bails out if the bridge_d3
flag is not set. That flag indicates whether a bridge is allowed to
suspend to D3cold at *runtime*.
Hence *no* delay is observed on resume from system sleep if runtime
D3cold is forbidden. That doesn't make any sense, so drop the bridge_d3
check from pci_bridge_wait_for_secondary_bus().
The purpose of the bridge_d3 check was probably to avoid delays if a
bridge remained in D0 during suspend. However the sole caller of
pci_bridge_wait_for_secondary_bus(), pci_pm_bridge_power_up_actions(),
is only invoked if the previous power state was D3cold. Hence the
additional bridge_d3 check seems superfluous.
Fixes: ad9001f2f411 ("PCI/PM: Add missing link delays required by the PCIe spec")
Link: https://lore.kernel.org/r/eb37fa345285ec8bacabbf06b020b803f77bdd3d.1673769517.git.lukas@wunner.de
Tested-by: Ravi Kishore Koppuravuri <ravi.kishore.koppuravuri@intel.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: stable@vger.kernel.org # v5.5+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -4902,7 +4902,7 @@ void pci_bridge_wait_for_secondary_bus(s
if (pci_dev_is_disconnected(dev))
return;
- if (!pci_is_bridge(dev) || !dev->bridge_d3)
+ if (!pci_is_bridge(dev))
return;
down_read(&pci_bus_sem);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 558/567] PCI: hotplug: Allow marking devices as disconnected during bind/unbind
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 557/567] PCI/PM: Observe reset delay irrespective of bridge_d3 Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 559/567] PCI: Avoid FLR for AMD FCH AHCI adapters Greg Kroah-Hartman
` (12 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anatoli Antonovitch, Lukas Wunner,
Bjorn Helgaas, Keith Busch
From: Lukas Wunner <lukas@wunner.de>
commit 74ff8864cc842be994853095dba6db48e716400a upstream.
On surprise removal, pciehp_unconfigure_device() and acpiphp's
trim_stale_devices() call pci_dev_set_disconnected() to mark removed
devices as permanently offline. Thereby, the PCI core and drivers know
to skip device accesses.
However pci_dev_set_disconnected() takes the device_lock and thus waits for
a concurrent driver bind or unbind to complete. As a result, the driver's
->probe and ->remove hooks have no chance to learn that the device is gone.
That doesn't make any sense, so drop the device_lock and instead use atomic
xchg() and cmpxchg() operations to update the device state.
As a byproduct, an AB-BA deadlock reported by Anatoli is fixed which occurs
on surprise removal with AER concurrently performing a bus reset.
AER bus reset:
INFO: task irq/26-aerdrv:95 blocked for more than 120 seconds.
Tainted: G W 6.2.0-rc3-custom-norework-jan11+
schedule
rwsem_down_write_slowpath
down_write_nested
pciehp_reset_slot # acquires reset_lock
pci_reset_hotplug_slot
pci_slot_reset # acquires device_lock
pci_bus_error_reset
aer_root_reset
pcie_do_recovery
aer_process_err_devices
aer_isr
pciehp surprise removal:
INFO: task irq/26-pciehp:96 blocked for more than 120 seconds.
Tainted: G W 6.2.0-rc3-custom-norework-jan11+
schedule_preempt_disabled
__mutex_lock
mutex_lock_nested
pci_dev_set_disconnected # acquires device_lock
pci_walk_bus
pciehp_unconfigure_device
pciehp_disable_slot
pciehp_handle_presence_or_link_change
pciehp_ist # acquires reset_lock
Link: https://bugzilla.kernel.org/show_bug.cgi?id=215590
Fixes: a6bd101b8f84 ("PCI: Unify device inaccessible")
Link: https://lore.kernel.org/r/3dc88ea82bdc0e37d9000e413d5ebce481cbd629.1674205689.git.lukas@wunner.de
Reported-by: Anatoli Antonovitch <anatoli.antonovitch@amd.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # v4.20+
Cc: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci.h | 43 +++++++++++++------------------------------
1 file changed, 13 insertions(+), 30 deletions(-)
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -347,53 +347,36 @@ struct pci_sriov {
* @dev: PCI device to set new error_state
* @new: the state we want dev to be in
*
- * Must be called with device_lock held.
+ * If the device is experiencing perm_failure, it has to remain in that state.
+ * Any other transition is allowed.
*
* Returns true if state has been changed to the requested state.
*/
static inline bool pci_dev_set_io_state(struct pci_dev *dev,
pci_channel_state_t new)
{
- bool changed = false;
+ pci_channel_state_t old;
- device_lock_assert(&dev->dev);
switch (new) {
case pci_channel_io_perm_failure:
- switch (dev->error_state) {
- case pci_channel_io_frozen:
- case pci_channel_io_normal:
- case pci_channel_io_perm_failure:
- changed = true;
- break;
- }
- break;
+ xchg(&dev->error_state, pci_channel_io_perm_failure);
+ return true;
case pci_channel_io_frozen:
- switch (dev->error_state) {
- case pci_channel_io_frozen:
- case pci_channel_io_normal:
- changed = true;
- break;
- }
- break;
+ old = cmpxchg(&dev->error_state, pci_channel_io_normal,
+ pci_channel_io_frozen);
+ return old != pci_channel_io_perm_failure;
case pci_channel_io_normal:
- switch (dev->error_state) {
- case pci_channel_io_frozen:
- case pci_channel_io_normal:
- changed = true;
- break;
- }
- break;
+ old = cmpxchg(&dev->error_state, pci_channel_io_frozen,
+ pci_channel_io_normal);
+ return old != pci_channel_io_perm_failure;
+ default:
+ return false;
}
- if (changed)
- dev->error_state = new;
- return changed;
}
static inline int pci_dev_set_disconnected(struct pci_dev *dev, void *unused)
{
- device_lock(&dev->dev);
pci_dev_set_io_state(dev, pci_channel_io_perm_failure);
- device_unlock(&dev->dev);
return 0;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 559/567] PCI: Avoid FLR for AMD FCH AHCI adapters
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 558/567] PCI: hotplug: Allow marking devices as disconnected during bind/unbind Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 560/567] iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode Greg Kroah-Hartman
` (11 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel, Damien Le Moal,
Bjorn Helgaas
From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
commit 63ba51db24ed1b8f8088a897290eb6c036c5435d upstream.
PCI passthrough to VMs does not work with AMD FCH AHCI adapters: the guest
OS fails to correctly probe devices attached to the controller due to FIS
communication failures:
ata4: softreset failed (1st FIS failed)
...
ata4.00: qc timeout after 5000 msecs (cmd 0xec)
ata4.00: failed to IDENTIFY (I/O error, err_mask=0x4)
Forcing the "bus" reset method before unbinding & binding the adapter to
the vfio-pci driver solves this issue, e.g.:
echo "bus" > /sys/bus/pci/devices/<ID>/reset_method
gives a working guest OS, indicating that the default FLR reset method
doesn't work correctly.
Apply quirk_no_flr() to AMD FCH AHCI devices to work around this issue.
Link: https://lore.kernel.org/r/20230128013951.523247-1-damien.lemoal@opensource.wdc.com
Reported-by: Niklas Cassel <niklas.cassel@wdc.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -5328,6 +5328,7 @@ static void quirk_no_flr(struct pci_dev
DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1487, quirk_no_flr);
DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x148c, quirk_no_flr);
DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x149c, quirk_no_flr);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x7901, quirk_no_flr);
DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_no_flr);
DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_no_flr);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 560/567] iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 559/567] PCI: Avoid FLR for AMD FCH AHCI adapters Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 561/567] vfio/type1: prevent underflow of locked_vm via exec() Greg Kroah-Hartman
` (10 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Murphy, Kevin Tian,
Sanjay Kumar, Jacob Pan, Lu Baolu, Joerg Roedel
From: Jacob Pan <jacob.jun.pan@linux.intel.com>
commit 16a75bbe480c3598b3af57a2504ea89b1e32c3ac upstream.
Intel IOMMU driver implements IOTLB flush queue with domain selective
or PASID selective invalidations. In this case there's no need to track
IOVA page range and sync IOTLBs, which may cause significant performance
hit.
This patch adds a check to avoid IOVA gather page and IOTLB sync for
the lazy path.
The performance difference on Sapphire Rapids 100Gb NIC is improved by
the following (as measured by iperf send):
w/o this fix~48 Gbits/s. with this fix ~54 Gbits/s
Cc: <stable@vger.kernel.org>
Fixes: 2a2b8eaa5b25 ("iommu: Handle freelists when using deferred flushing in iommu drivers")
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Tested-by: Sanjay Kumar <sanjay.k.kumar@intel.com>
Signed-off-by: Sanjay Kumar <sanjay.k.kumar@intel.com>
Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
Link: https://lore.kernel.org/r/20230209175330.1783556-1-jacob.jun.pan@linux.intel.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel/iommu.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -5140,7 +5140,12 @@ static size_t intel_iommu_unmap(struct i
if (dmar_domain->max_addr == iova + size)
dmar_domain->max_addr = iova;
- iommu_iotlb_gather_add_page(domain, gather, iova, size);
+ /*
+ * We do not use page-selective IOTLB invalidation in flush queue,
+ * so there is no need to track page and sync iotlb.
+ */
+ if (!iommu_iotlb_gather_queued(gather))
+ iommu_iotlb_gather_add_page(domain, gather, iova, size);
return size;
}
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 561/567] vfio/type1: prevent underflow of locked_vm via exec()
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 560/567] iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 562/567] vfio/type1: track locked_vm per dma Greg Kroah-Hartman
` (9 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steve Sistare, Kevin Tian,
Jason Gunthorpe, Alex Williamson
From: Steve Sistare <steven.sistare@oracle.com>
commit 046eca5018f8a5dd1dc2cedf87fb5843b9ea3026 upstream.
When a vfio container is preserved across exec, the task does not change,
but it gets a new mm with locked_vm=0, and loses the count from existing
dma mappings. If the user later unmaps a dma mapping, locked_vm underflows
to a large unsigned value, and a subsequent dma map request fails with
ENOMEM in __account_locked_vm.
To avoid underflow, grab and save the mm at the time a dma is mapped.
Use that mm when adjusting locked_vm, rather than re-acquiring the saved
task's mm, which may have changed. If the saved mm is dead, do nothing.
locked_vm is incremented for existing mappings in a subsequent patch.
Fixes: 73fa0d10d077 ("vfio: Type1 IOMMU implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/1675184289-267876-3-git-send-email-steven.sistare@oracle.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/vfio_iommu_type1.c | 41 +++++++++++++---------------------------
1 file changed, 14 insertions(+), 27 deletions(-)
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -100,6 +100,7 @@ struct vfio_dma {
struct task_struct *task;
struct rb_root pfn_list; /* Ex-user pinned pfn list */
unsigned long *bitmap;
+ struct mm_struct *mm;
};
struct vfio_batch {
@@ -424,8 +425,8 @@ static int vfio_lock_acct(struct vfio_dm
if (!npage)
return 0;
- mm = async ? get_task_mm(dma->task) : dma->task->mm;
- if (!mm)
+ mm = dma->mm;
+ if (async && !mmget_not_zero(mm))
return -ESRCH; /* process exited */
ret = mmap_write_lock_killable(mm);
@@ -798,8 +799,8 @@ static int vfio_pin_page_external(struct
struct mm_struct *mm;
int ret;
- mm = get_task_mm(dma->task);
- if (!mm)
+ mm = dma->mm;
+ if (!mmget_not_zero(mm))
return -ENODEV;
ret = vaddr_get_pfns(mm, vaddr, 1, dma->prot, pfn_base, pages);
@@ -809,7 +810,7 @@ static int vfio_pin_page_external(struct
ret = 0;
if (do_accounting && !is_invalid_reserved_pfn(*pfn_base)) {
- ret = vfio_lock_acct(dma, 1, true);
+ ret = vfio_lock_acct(dma, 1, false);
if (ret) {
put_pfn(*pfn_base, dma->prot);
if (ret == -ENOMEM)
@@ -1179,6 +1180,7 @@ static void vfio_remove_dma(struct vfio_
vfio_unmap_unpin(iommu, dma, true);
vfio_unlink_dma(iommu, dma);
put_task_struct(dma->task);
+ mmdrop(dma->mm);
vfio_dma_bitmap_free(dma);
if (dma->vaddr_invalid) {
iommu->vaddr_invalid_count--;
@@ -1649,29 +1651,15 @@ static int vfio_dma_do_map(struct vfio_i
* against the locked memory limit and we need to be able to do both
* outside of this call path as pinning can be asynchronous via the
* external interfaces for mdev devices. RLIMIT_MEMLOCK requires a
- * task_struct and VM locked pages requires an mm_struct, however
- * holding an indefinite mm reference is not recommended, therefore we
- * only hold a reference to a task. We could hold a reference to
- * current, however QEMU uses this call path through vCPU threads,
- * which can be killed resulting in a NULL mm and failure in the unmap
- * path when called via a different thread. Avoid this problem by
- * using the group_leader as threads within the same group require
- * both CLONE_THREAD and CLONE_VM and will therefore use the same
- * mm_struct.
- *
- * Previously we also used the task for testing CAP_IPC_LOCK at the
- * time of pinning and accounting, however has_capability() makes use
- * of real_cred, a copy-on-write field, so we can't guarantee that it
- * matches group_leader, or in fact that it might not change by the
- * time it's evaluated. If a process were to call MAP_DMA with
- * CAP_IPC_LOCK but later drop it, it doesn't make sense that they
- * possibly see different results for an iommu_mapped vfio_dma vs
- * externally mapped. Therefore track CAP_IPC_LOCK in vfio_dma at the
- * time of calling MAP_DMA.
+ * task_struct. Save the group_leader so that all DMA tracking uses
+ * the same task, to make debugging easier. VM locked pages requires
+ * an mm_struct, so grab the mm in case the task dies.
*/
get_task_struct(current->group_leader);
dma->task = current->group_leader;
dma->lock_cap = capable(CAP_IPC_LOCK);
+ dma->mm = current->mm;
+ mmgrab(dma->mm);
dma->pfn_list = RB_ROOT;
@@ -3168,9 +3156,8 @@ static int vfio_iommu_type1_dma_rw_chunk
!(dma->prot & IOMMU_READ))
return -EPERM;
- mm = get_task_mm(dma->task);
-
- if (!mm)
+ mm = dma->mm;
+ if (!mmget_not_zero(mm))
return -EPERM;
if (kthread)
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 562/567] vfio/type1: track locked_vm per dma
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 561/567] vfio/type1: prevent underflow of locked_vm via exec() Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:04 ` [PATCH 5.15 563/567] vfio/type1: restore locked_vm Greg Kroah-Hartman
` (8 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steve Sistare, Kevin Tian,
Jason Gunthorpe, Alex Williamson
From: Steve Sistare <steven.sistare@oracle.com>
commit 18e292705ba21cc9b3227b9ad5b1c28973605ee5 upstream.
Track locked_vm per dma struct, and create a new subroutine, both for use
in a subsequent patch. No functional change.
Fixes: c3cbab24db38 ("vfio/type1: implement interfaces to update vaddr")
Cc: stable@vger.kernel.org
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/1675184289-267876-4-git-send-email-steven.sistare@oracle.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/vfio_iommu_type1.c | 23 +++++++++++++++++------
1 file changed, 17 insertions(+), 6 deletions(-)
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -101,6 +101,7 @@ struct vfio_dma {
struct rb_root pfn_list; /* Ex-user pinned pfn list */
unsigned long *bitmap;
struct mm_struct *mm;
+ size_t locked_vm;
};
struct vfio_batch {
@@ -417,6 +418,19 @@ static int vfio_iova_put_vfio_pfn(struct
return ret;
}
+static int mm_lock_acct(struct task_struct *task, struct mm_struct *mm,
+ bool lock_cap, long npage)
+{
+ int ret = mmap_write_lock_killable(mm);
+
+ if (ret)
+ return ret;
+
+ ret = __account_locked_vm(mm, abs(npage), npage > 0, task, lock_cap);
+ mmap_write_unlock(mm);
+ return ret;
+}
+
static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async)
{
struct mm_struct *mm;
@@ -429,12 +443,9 @@ static int vfio_lock_acct(struct vfio_dm
if (async && !mmget_not_zero(mm))
return -ESRCH; /* process exited */
- ret = mmap_write_lock_killable(mm);
- if (!ret) {
- ret = __account_locked_vm(mm, abs(npage), npage > 0, dma->task,
- dma->lock_cap);
- mmap_write_unlock(mm);
- }
+ ret = mm_lock_acct(dma->task, mm, dma->lock_cap, npage);
+ if (!ret)
+ dma->locked_vm += npage;
if (async)
mmput(mm);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 563/567] vfio/type1: restore locked_vm
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 562/567] vfio/type1: track locked_vm per dma Greg Kroah-Hartman
@ 2023-03-07 17:04 ` Greg Kroah-Hartman
2023-03-07 17:05 ` [PATCH 5.15 564/567] drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv Greg Kroah-Hartman
` (7 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:04 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steve Sistare, Kevin Tian,
Jason Gunthorpe, Alex Williamson
From: Steve Sistare <steven.sistare@oracle.com>
commit 90fdd158a695d70403163f9a0e4efc5b20f3fd3e upstream.
When a vfio container is preserved across exec or fork-exec, the new
task's mm has a locked_vm count of 0. After a dma vaddr is updated using
VFIO_DMA_MAP_FLAG_VADDR, locked_vm remains 0, and the pinned memory does
not count against the task's RLIMIT_MEMLOCK.
To restore the correct locked_vm count, when VFIO_DMA_MAP_FLAG_VADDR is
used and the dma's mm has changed, add the dma's locked_vm count to
the new mm->locked_vm, subject to the rlimit, and subtract it from the
old mm->locked_vm.
Fixes: c3cbab24db38 ("vfio/type1: implement interfaces to update vaddr")
Cc: stable@vger.kernel.org
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/1675184289-267876-5-git-send-email-steven.sistare@oracle.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/vfio_iommu_type1.c | 35 +++++++++++++++++++++++++++++++++++
1 file changed, 35 insertions(+)
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -1576,6 +1576,38 @@ static bool vfio_iommu_iova_dma_valid(st
return list_empty(iova);
}
+static int vfio_change_dma_owner(struct vfio_dma *dma)
+{
+ struct task_struct *task = current->group_leader;
+ struct mm_struct *mm = current->mm;
+ long npage = dma->locked_vm;
+ bool lock_cap;
+ int ret;
+
+ if (mm == dma->mm)
+ return 0;
+
+ lock_cap = capable(CAP_IPC_LOCK);
+ ret = mm_lock_acct(task, mm, lock_cap, npage);
+ if (ret)
+ return ret;
+
+ if (mmget_not_zero(dma->mm)) {
+ mm_lock_acct(dma->task, dma->mm, dma->lock_cap, -npage);
+ mmput(dma->mm);
+ }
+
+ if (dma->task != task) {
+ put_task_struct(dma->task);
+ dma->task = get_task_struct(task);
+ }
+ mmdrop(dma->mm);
+ dma->mm = mm;
+ mmgrab(dma->mm);
+ dma->lock_cap = lock_cap;
+ return 0;
+}
+
static int vfio_dma_do_map(struct vfio_iommu *iommu,
struct vfio_iommu_type1_dma_map *map)
{
@@ -1625,6 +1657,9 @@ static int vfio_dma_do_map(struct vfio_i
dma->size != size) {
ret = -EINVAL;
} else {
+ ret = vfio_change_dma_owner(dma);
+ if (ret)
+ goto out_unlock;
dma->vaddr = vaddr;
dma->vaddr_invalid = false;
iommu->vaddr_invalid_count--;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 564/567] drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2023-03-07 17:04 ` [PATCH 5.15 563/567] vfio/type1: restore locked_vm Greg Kroah-Hartman
@ 2023-03-07 17:05 ` Greg Kroah-Hartman
2023-03-07 17:05 ` [PATCH 5.15 565/567] drm/radeon: Fix eDP for single-display iMac11,2 Greg Kroah-Hartman
` (6 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mavroudis Chatzilaridis, Jani Nikula
From: Mavroudis Chatzilaridis <mavchatz@protonmail.com>
commit 5e438bf7f9a1705ebcae5fa89cdbfbc6932a7871 upstream.
This laptop uses inverted backlight PWM. Thus, without this quirk,
backlight brightness decreases as the brightness value increases and
vice versa.
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8013
Cc: stable@vger.kernel.org
Signed-off-by: Mavroudis Chatzilaridis <mavchatz@protonmail.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230201184947.8835-1-mavchatz@protonmail.com
(cherry picked from commit 83e7d6fd330d413cb2064e680ffea91b0512a520)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_quirks.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/i915/display/intel_quirks.c
+++ b/drivers/gpu/drm/i915/display/intel_quirks.c
@@ -193,6 +193,8 @@ static struct intel_quirk intel_quirks[]
/* ECS Liva Q2 */
{ 0x3185, 0x1019, 0xa94d, quirk_increase_ddi_disabled_time },
{ 0x3184, 0x1019, 0xa94d, quirk_increase_ddi_disabled_time },
+ /* HP Notebook - 14-r206nv */
+ { 0x0f31, 0x103c, 0x220f, quirk_invert_brightness },
};
void intel_init_quirks(struct drm_i915_private *i915)
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 565/567] drm/radeon: Fix eDP for single-display iMac11,2
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2023-03-07 17:05 ` [PATCH 5.15 564/567] drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv Greg Kroah-Hartman
@ 2023-03-07 17:05 ` Greg Kroah-Hartman
2023-03-07 17:05 ` [PATCH 5.15 566/567] drm/i915: Dont use BAR mappings for ring buffers with LLC Greg Kroah-Hartman
` (5 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:05 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mark Hawrylak, Alex Deucher
From: Mark Hawrylak <mark.hawrylak@gmail.com>
commit 05eacc198c68cbb35a7281ce4011f8899ee1cfb8 upstream.
Apple iMac11,2 (mid 2010) also with Radeon HD-4670 that has the same
issue as iMac10,1 (late 2009) where the internal eDP panel stays dark on
driver load. This patch treats iMac11,2 the same as iMac10,1,
so the eDP panel stays active.
Additional steps:
Kernel boot parameter radeon.nomodeset=0 required to keep the eDP
panel active.
This patch is an extension of
commit 564d8a2cf3ab ("drm/radeon: Fix eDP for single-display iMac10,1 (v2)")
Link: https://lore.kernel.org/all/lsq.1507553064.833262317@decadent.org.uk/
Signed-off-by: Mark Hawrylak <mark.hawrylak@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/atombios_encoders.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -2188,11 +2188,12 @@ int radeon_atom_pick_dig_encoder(struct
/*
* On DCE32 any encoder can drive any block so usually just use crtc id,
- * but Apple thinks different at least on iMac10,1, so there use linkb,
+ * but Apple thinks different at least on iMac10,1 and iMac11,2, so there use linkb,
* otherwise the internal eDP panel will stay dark.
*/
if (ASIC_IS_DCE32(rdev)) {
- if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1"))
+ if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1") ||
+ dmi_match(DMI_PRODUCT_NAME, "iMac11,2"))
enc_idx = (dig->linkb) ? 1 : 0;
else
enc_idx = radeon_crtc->crtc_id;
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 566/567] drm/i915: Dont use BAR mappings for ring buffers with LLC
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2023-03-07 17:05 ` [PATCH 5.15 565/567] drm/radeon: Fix eDP for single-display iMac11,2 Greg Kroah-Hartman
@ 2023-03-07 17:05 ` Greg Kroah-Hartman
2023-03-07 17:05 ` [PATCH 5.15 567/567] drm/edid: fix AVI infoframe aspect ratio handling Greg Kroah-Hartman
` (4 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Harrison, Chris Wilson,
Joonas Lahtinen, Jani Nikula, Rodrigo Vivi, Tvrtko Ursulin,
intel-gfx, Jouni Högander, Daniele Ceraolo Spurio,
Jani Nikula
From: John Harrison <John.C.Harrison@Intel.com>
commit 85636167e3206c3fbd52254fc432991cc4e90194 upstream.
Direction from hardware is that ring buffers should never be mapped
via the BAR on systems with LLC. There are too many caching pitfalls
due to the way BAR accesses are routed. So it is safest to just not
use it.
Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
Fixes: 9d80841ea4c9 ("drm/i915: Allow ringbuffers to be bound anywhere")
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v4.9+
Tested-by: Jouni Högander <jouni.hogander@intel.com>
Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230216011101.1909009-3-John.C.Harrison@Intel.com
(cherry picked from commit 65c08339db1ada87afd6cfe7db8e60bb4851d919)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/gt/intel_ring.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/i915/gt/intel_ring.c
+++ b/drivers/gpu/drm/i915/gt/intel_ring.c
@@ -51,7 +51,7 @@ int intel_ring_pin(struct intel_ring *ri
if (unlikely(ret))
goto err_unpin;
- if (i915_vma_is_map_and_fenceable(vma)) {
+ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915)) {
addr = (void __force *)i915_vma_pin_iomap(vma);
} else {
int type = i915_coherent_map_type(vma->vm->i915, vma->obj, false);
@@ -96,7 +96,7 @@ void intel_ring_unpin(struct intel_ring
return;
i915_vma_unset_ggtt_write(vma);
- if (i915_vma_is_map_and_fenceable(vma))
+ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915))
i915_vma_unpin_iomap(vma);
else
i915_gem_object_unpin_map(vma->obj);
^ permalink raw reply [flat|nested] 578+ messages in thread* [PATCH 5.15 567/567] drm/edid: fix AVI infoframe aspect ratio handling
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2023-03-07 17:05 ` [PATCH 5.15 566/567] drm/i915: Dont use BAR mappings for ring buffers with LLC Greg Kroah-Hartman
@ 2023-03-07 17:05 ` Greg Kroah-Hartman
2023-03-07 20:02 ` [PATCH 5.15 000/567] 5.15.99-rc1 review Harshit Mogalapalli
` (3 subsequent siblings)
570 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-07 17:05 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, William Tseng,
Ville Syrjälä,
Jani Nikula
From: Jani Nikula <jani.nikula@intel.com>
commit 1cbc1f0d324ba6c4d1b10ac6362b5e0b029f63d5 upstream.
We try to avoid sending VICs defined in the later specs in AVI
infoframes to sinks that conform to the earlier specs, to not upset
them, and use 0 for the VIC instead. However, we do this detection and
conversion to 0 too early, as we'll need the actual VIC to figure out
the aspect ratio.
In particular, for a mode with 64:27 aspect ratio, 0 for VIC fails the
AVI infoframe generation altogether with -EINVAL.
Separate the VIC lookup from the "filtering", and postpone the
filtering, to use the proper VIC for aspect ratio handling, and the 0
VIC for the infoframe video code as needed.
Reported-by: William Tseng <william.tseng@intel.com>
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6153
Cc: <stable@vger.kernel.org>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/c3e78cc6d01ed237f71ad0038826b08d83d75eef.1672826282.git.jani.nikula@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_edid.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -5598,8 +5598,6 @@ static u8 drm_mode_hdmi_vic(const struct
static u8 drm_mode_cea_vic(const struct drm_connector *connector,
const struct drm_display_mode *mode)
{
- u8 vic;
-
/*
* HDMI spec says if a mode is found in HDMI 1.4b 4K modes
* we should send its VIC in vendor infoframes, else send the
@@ -5609,13 +5607,18 @@ static u8 drm_mode_cea_vic(const struct
if (drm_mode_hdmi_vic(connector, mode))
return 0;
- vic = drm_match_cea_mode(mode);
+ return drm_match_cea_mode(mode);
+}
- /*
- * HDMI 1.4 VIC range: 1 <= VIC <= 64 (CEA-861-D) but
- * HDMI 2.0 VIC range: 1 <= VIC <= 107 (CEA-861-F). So we
- * have to make sure we dont break HDMI 1.4 sinks.
- */
+/*
+ * Avoid sending VICs defined in HDMI 2.0 in AVI infoframes to sinks that
+ * conform to HDMI 1.4.
+ *
+ * HDMI 1.4 (CTA-861-D) VIC range: [1..64]
+ * HDMI 2.0 (CTA-861-F) VIC range: [1..107]
+ */
+static u8 vic_for_avi_infoframe(const struct drm_connector *connector, u8 vic)
+{
if (!is_hdmi2_sink(connector) && vic > 64)
return 0;
@@ -5691,7 +5694,7 @@ drm_hdmi_avi_infoframe_from_display_mode
picture_aspect = HDMI_PICTURE_ASPECT_NONE;
}
- frame->video_code = vic;
+ frame->video_code = vic_for_avi_infoframe(connector, vic);
frame->picture_aspect = picture_aspect;
frame->active_aspect = HDMI_ACTIVE_ASPECT_PICTURE;
frame->scan_mode = HDMI_SCAN_MODE_UNDERSCAN;
^ permalink raw reply [flat|nested] 578+ messages in thread* Re: [PATCH 5.15 000/567] 5.15.99-rc1 review
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2023-03-07 17:05 ` [PATCH 5.15 567/567] drm/edid: fix AVI infoframe aspect ratio handling Greg Kroah-Hartman
@ 2023-03-07 20:02 ` Harshit Mogalapalli
2023-03-07 20:12 ` Vegard Nossum
2023-03-07 23:06 ` Daniel Díaz
` (2 subsequent siblings)
570 siblings, 1 reply; 578+ messages in thread
From: Harshit Mogalapalli @ 2023-03-07 20:02 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, Vegard Nossum, Darren Kenny
Hi Greg,
On 07/03/23 10:25 pm, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.99 release.
> There are 567 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
While trying to build 5.15.99-rc1 with
* make -C tools/perf all
The following build errors are seen.
util/intel-pt-decoder/intel-pt-decoder.c: In function
'intel_pt_eptw_lookahead_cb':
util/intel-pt-decoder/intel-pt-decoder.c:1445:14: error: 'INTEL_PT_CFE'
undeclared (first use in this function); did you mean 'INTEL_PT_CBR'?
1445 | case INTEL_PT_CFE:
| ^~~~~~~~~~~~
| INTEL_PT_CBR
util/intel-pt-decoder/intel-pt-decoder.c:1445:14: note: each undeclared
identifier is reported only once for each function it appears in
util/intel-pt-decoder/intel-pt-decoder.c:1446:14: error:
'INTEL_PT_CFE_IP' undeclared (first use in this function); did you mean
'INTEL_PT_BEP_IP'?
1446 | case INTEL_PT_CFE_IP:
| ^~~~~~~~~~~~~~~
| INTEL_PT_BEP_IP
util/intel-pt-decoder/intel-pt-decoder.c:1447:14: error: 'INTEL_PT_EVD'
undeclared (first use in this function); did you mean 'INTEL_PT_OVF'?
1447 | case INTEL_PT_EVD:
| ^~~~~~~~~~~~
| INTEL_PT_OVF
[PATCH 5.15 264/567] perf intel-pt: Add support for emulated ptwrite
is causing this error.
Thanks,
Harshit
> Responses should be made by Thu, 09 Mar 2023 16:57:34 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.99-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 5.15.99-rc1
>
> Jani Nikula <jani.nikula@intel.com>
> drm/edid: fix AVI infoframe aspect ratio handling
>
> John Harrison <John.C.Harrison@Intel.com>
> drm/i915: Don't use BAR mappings for ring buffers with LLC
>
> Mark Hawrylak <mark.hawrylak@gmail.com>
> drm/radeon: Fix eDP for single-display iMac11,2
>
> Mavroudis Chatzilaridis <mavchatz@protonmail.com>
> drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
>
> Steve Sistare <steven.sistare@oracle.com>
> vfio/type1: restore locked_vm
>
> Steve Sistare <steven.sistare@oracle.com>
> vfio/type1: track locked_vm per dma
>
> Steve Sistare <steven.sistare@oracle.com>
> vfio/type1: prevent underflow of locked_vm via exec()
>
> Jacob Pan <jacob.jun.pan@linux.intel.com>
> iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode
>
> Damien Le Moal <damien.lemoal@opensource.wdc.com>
> PCI: Avoid FLR for AMD FCH AHCI adapters
>
> Lukas Wunner <lukas@wunner.de>
> PCI: hotplug: Allow marking devices as disconnected during bind/unbind
>
> Lukas Wunner <lukas@wunner.de>
> PCI/PM: Observe reset delay irrespective of bridge_d3
>
> H. Nikolaus Schaller <hns@goldelico.com>
> MIPS: DTS: CI20: fix otg power gpio
>
> Guo Ren <guoren@linux.alibaba.com>
> riscv: ftrace: Reduce the detour code size to half
>
> Guo Ren <guoren@linux.alibaba.com>
> riscv: ftrace: Remove wasted nops for !RISCV_ISA_C
>
> Björn Töpel <bjorn@rivosinc.com>
> riscv, mm: Perform BPF exhandler fixup on page fault
>
> Andy Chiu <andy.chiu@sifive.com>
> riscv: jump_label: Fixup unaligned arch_static_branch function
>
> Sergey Matyukevich <sergey.matyukevich@syntacore.com>
> riscv: mm: fix regression due to update_mmu_cache change
>
> Conor Dooley <conor.dooley@microchip.com>
> RISC-V: add a spin_shadow_stack declaration
>
> Tomas Henzl <thenzl@redhat.com>
> scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
>
> Tomas Henzl <thenzl@redhat.com>
> scsi: ses: Fix possible desc_ptr out-of-bounds accesses
>
> Tomas Henzl <thenzl@redhat.com>
> scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
>
> Tomas Henzl <thenzl@redhat.com>
> scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
>
> James Bottomley <jejb@linux.ibm.com>
> scsi: ses: Don't attach if enclosure has no components
>
> Saurav Kashyap <skashyap@marvell.com>
> scsi: qla2xxx: Remove increment of interface err cnt
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Fix erroneous link down
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Remove unintended flag clearing
>
> Arun Easi <aeasi@marvell.com>
> scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
>
> Shreyas Deodhar <sdeodhar@marvell.com>
> scsi: qla2xxx: Check if port is online before sending ELS
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Fix link failure in NPIV environment
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
>
> Antonio Alvarez Feijoo <antonio.feijoo@suse.com>
> tools/bootconfig: fix single & used for logical condition
>
> Mukesh Ojha <quic_mojha@quicinc.com>
> ring-buffer: Handle race between rb_move_tail and rb_check_pages
>
> Steven Rostedt <rostedt@goodmis.org>
> ktest.pl: Add RUN_TIMEOUT option with default unlimited
>
> Steven Rostedt <rostedt@goodmis.org>
> ktest.pl: Fix missing "end_monitor" when machine check fails
>
> Steven Rostedt <rostedt@goodmis.org>
> ktest.pl: Give back console on Ctrt^C on monitor
>
> Yin Fengwei <fengwei.yin@intel.com>
> mm/thp: check and bail out if page in deferred queue already
>
> Johannes Weiner <hannes@cmpxchg.org>
> mm: memcontrol: deprecate charge moving
>
> John Ogness <john.ogness@linutronix.de>
> docs: gdbmacros: print newest record
>
> Chen-Yu Tsai <wenst@chromium.org>
> remoteproc/mtk_scp: Move clk ops outside send_lock
>
> Sakari Ailus <sakari.ailus@linux.intel.com>
> media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
>
> Elvira Khabirova <lineprinter0@gmail.com>
> mips: fix syscall_get_nr
>
> Dan Williams <dan.j.williams@intel.com>
> dax/kmem: Fix leak of memory-hotplug resources
>
> Al Viro <viro@zeniv.linux.org.uk>
> alpha: fix FEN fault handling
>
> Xiubo Li <xiubli@redhat.com>
> ceph: update the time stamps and try to drop the suid/sgid
>
> Ilya Dryomov <idryomov@gmail.com>
> rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
>
> Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
> fuse: add inode/permission checks to fileattr_get/fileattr_set
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: exynos: correct TMU phandle in Odroid HC1
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: exynos: correct TMU phandle in Odroid XU
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: exynos: correct TMU phandle in Exynos5250
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: exynos: correct TMU phandle in Exynos4
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: exynos: correct TMU phandle in Exynos4210
>
> Manivannan Sadhasivam <mani@kernel.org>
> ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node
>
> Mikulas Patocka <mpatocka@redhat.com>
> dm flakey: fix a bug with 32-bit highmem systems
>
> Mikulas Patocka <mpatocka@redhat.com>
> dm flakey: don't corrupt the zero page
>
> Mikulas Patocka <mpatocka@redhat.com>
> dm flakey: fix logic when corrupting a bio
>
> Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
> thermal: intel: powerclamp: Fix cur_state for multi package system
>
> Manish Chopra <manishc@marvell.com>
> qede: fix interrupt coalescing configuration
>
> Alexander Wetzel <alexander@wetzel-home.de>
> wifi: cfg80211: Fix use after free for wext
>
> Len Brown <len.brown@intel.com>
> wifi: ath11k: allow system suspend to survive ath11k
>
> Bitterblue Smith <rtl8821cerfe2@gmail.com>
> wifi: rtl8xxxu: Use a longer retry limit of 48
>
> Pingfan Liu <piliu@redhat.com>
> dm: add cond_resched() to dm_wq_work()
>
> Mikulas Patocka <mpatocka@redhat.com>
> dm: send just one event on resize, not two
>
> Louis Rannou <lrannou@baylibre.com>
> mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
>
> Tudor Ambarus <tudor.ambarus@linaro.org>
> mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
>
> Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
> mtd: spi-nor: sfdp: Fix index value for SCCR dwords
>
> Jan Kara <jack@suse.cz>
> ext4: Fix possible corruption when moving a directory
>
> Jun Nie <jun.nie@linaro.org>
> ext4: refuse to create ea block when umounted
>
> Jun Nie <jun.nie@linaro.org>
> ext4: optimize ea_inode block expansion
>
> Zhihao Cheng <chengzhihao1@huawei.com>
> jbd2: fix data missing when reusing bh which is ready to be checkpointed
>
> Łukasz Stelmach <l.stelmach@samsung.com>
> ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
>
> Dmitry Fomin <fomindmitriyfoma@mail.ru>
> ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
>
> Jens Axboe <axboe@kernel.dk>
> io_uring/poll: allow some retries for poll triggering spuriously
>
> David Lamparter <equinox@diac24.ne>
> io_uring: remove MSG_NOSIGNAL from recvmsg
>
> Pavel Begunkov <asml.silence@gmail.com>
> io_uring/rsrc: disallow multi-source reg buffers
>
> Jens Axboe <axboe@kernel.dk>
> io_uring: add a conditional reschedule to the IOPOLL cancelation loop
>
> Jens Axboe <axboe@kernel.dk>
> io_uring: mark task TASK_RUNNING before handling resume/task work
>
> Jens Axboe <axboe@kernel.dk>
> io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
>
> Giovanni Cabiddu <giovanni.cabiddu@intel.com>
> crypto: qat - fix out-of-bounds read
>
> Marc Zyngier <maz@kernel.org>
> irqdomain: Fix domain registration race
>
> Johan Hovold <johan+linaro@kernel.org>
> irqdomain: Drop bogus fwspec-mapping error handling
>
> Johan Hovold <johan+linaro@kernel.org>
> irqdomain: Look for existing mapping only once
>
> Johan Hovold <johan+linaro@kernel.org>
> irqdomain: Fix disassociation race
>
> Johan Hovold <johan+linaro@kernel.org>
> irqdomain: Fix association race
>
> Roberto Sassu <roberto.sassu@huawei.com>
> ima: Align ima_file_mmap() parameters with mmap_file LSM hook
>
> Jens Axboe <axboe@kernel.dk>
> brd: return 0/-error from brd_insert_page()
>
> KP Singh <kpsingh@kernel.org>
> Documentation/hw-vuln: Document the interaction between IBRS and STIBP
>
> KP Singh <kpsingh@kernel.org>
> x86/speculation: Allow enabling STIBP with legacy IBRS
>
> Borislav Petkov (AMD) <bp@alien8.de>
> x86/microcode/AMD: Fix mixed steppings support
>
> Borislav Petkov (AMD) <bp@alien8.de>
> x86/microcode/AMD: Add a @cpu parameter to the reloading functions
>
> Borislav Petkov (AMD) <bp@alien8.de>
> x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
>
> Yang Jihong <yangjihong1@huawei.com>
> x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
>
> Yang Jihong <yangjihong1@huawei.com>
> x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
>
> Sean Christopherson <seanjc@google.com>
> x86/reboot: Disable SVM, not just VMX, when stopping CPUs
>
> Sean Christopherson <seanjc@google.com>
> x86/reboot: Disable virtualization in an emergency if SVM is supported
>
> Sean Christopherson <seanjc@google.com>
> x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
>
> Sean Christopherson <seanjc@google.com>
> x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
>
> Nico Boehr <nrb@linux.ibm.com>
> KVM: s390: disable migration mode when dirty tracking is disabled
>
> Randy Dunlap <rdunlap@infradead.org>
> KVM: SVM: hyper-v: placate modpost section mismatch error
>
> Peter Gonda <pgonda@google.com>
> KVM: SVM: Fix potential overflow in SEV's send|receive_update_data()
>
> Sean Christopherson <seanjc@google.com>
> KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
>
> Sean Christopherson <seanjc@google.com>
> KVM: Destroy target device if coalesced MMIO unregistration fails
>
> Bernard Metzler <bmt@zurich.ibm.com>
> RDMA/siw: Fix user page pinning accounting
>
> Jan Kara <jack@suse.cz>
> udf: Fix file corruption when appending just after end of preallocated extent
>
> Jan Kara <jack@suse.cz>
> udf: Detect system inodes linked into directory hierarchy
>
> Jan Kara <jack@suse.cz>
> udf: Preserve link count of system files
>
> Jan Kara <jack@suse.cz>
> udf: Do not update file length for failed writes to inline files
>
> Jan Kara <jack@suse.cz>
> udf: Do not bother merging very long extents
>
> Jan Kara <jack@suse.cz>
> udf: Truncate added extents on failed expansion
>
> Jeff Xu <jeffxu@google.com>
> selftests/landlock: Test ptrace as much as possible with Yama
>
> Jeff Xu <jeffxu@google.com>
> selftests/landlock: Skip overlayfs tests when not supported
>
> Heming Zhao via Ocfs2-devel <ocfs2-devel@oss.oracle.com>
> ocfs2: fix non-auto defrag path not working issue
>
> Heming Zhao via Ocfs2-devel <ocfs2-devel@oss.oracle.com>
> ocfs2: fix defrag path triggering jbd2 ASSERT
>
> Eric Biggers <ebiggers@google.com>
> f2fs: fix cgroup writeback accounting with fs-layer encryption
>
> Eric Biggers <ebiggers@google.com>
> f2fs: fix information leak in f2fs_move_inline_dirents()
>
> Alexander Aring <aahringo@redhat.com>
> fs: dlm: send FIN ack back in right cases
>
> Alexander Aring <aahringo@redhat.com>
> fs: dlm: move sending fin message into state change handling
>
> Alexander Aring <aahringo@redhat.com>
> fs: dlm: don't set stop rx flag after node reset
>
> Yuezhang Mo <Yuezhang.Mo@sony.com>
> exfat: fix inode->i_blocks for non-512 byte sector size device
>
> Sungjong Seo <sj1557.seo@samsung.com>
> exfat: redefine DIR_DELETED as the bad cluster number
>
> Yuezhang Mo <Yuezhang.Mo@sony.com>
> exfat: fix unexpected EOF while reading dir
>
> Yuezhang Mo <Yuezhang.Mo@sony.com>
> exfat: fix reporting fs error when reading dir beyond EOF
>
> Dongliang Mu <mudongliangabcd@gmail.com>
> fs: hfsplus: fix UAF issue in hfsplus_put_super
>
> Liu Shixin <liushixin2@huawei.com>
> hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: exynos: correct HDMI phy compatible in Exynos4
>
> Namjae Jeon <linkinjeon@kernel.org>
> ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length
>
> Namjae Jeon <linkinjeon@kernel.org>
> ksmbd: fix wrong data area length for smb2 lock request
>
> Waiman Long <longman@redhat.com>
> locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath
>
> Boris Burkov <boris@bur.io>
> btrfs: hold block group refcount during async discard
>
> Volker Lendecke <vl@samba.org>
> cifs: Fix uninitialized memory read in smb3_qfs_tcon()
>
> Vasily Gorbik <gor@linux.ibm.com>
> s390/kprobes: fix current_kprobe never cleared after kprobes reenter
>
> Vasily Gorbik <gor@linux.ibm.com>
> s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
>
> Ilya Leoshkevich <iii@linux.ibm.com>
> s390: discard .interp section
>
> Gerald Schaefer <gerald.schaefer@linux.ibm.com>
> s390/extmem: return correct segment type in __segment_load()
>
> Corey Minyard <cminyard@mvista.com>
> ipmi_ssif: Rename idle state and check
>
> Corey Minyard <cminyard@mvista.com>
> ipmi:ssif: resend_msg() cannot fail
>
> Johan Hovold <johan+linaro@kernel.org>
> rtc: pm8xxx: fix set-alarm race
>
> Jens Axboe <axboe@kernel.dk>
> block: don't allow multiple bios for IOCB_NOWAIT issue
>
> Alper Nebi Yasak <alpernebiyasak@gmail.com>
> firmware: coreboot: framebuffer: Ignore reserved pixel color bits
>
> Jun ASAKA <JunASAKA@zzy040330.moe>
> wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
>
> Asahi Lina <lina@asahilina.net>
> drm/shmem-helper: Revert accidental non-GPL export
>
> Jeff Layton <jlayton@kernel.org>
> nfsd: zero out pointers after putting nfsd_files on COPY setup error
>
> Mike Snitzer <snitzer@kernel.org>
> dm cache: add cond_resched() to various workqueue loops
>
> Mike Snitzer <snitzer@kernel.org>
> dm thin: add cond_resched() to various workqueue loops
>
> Darrell Kavanagh <darrell.kavanagh@gmail.com>
> drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
>
> Bastien Nocera <hadess@hadess.net>
> HID: logitech-hidpp: Don't restart communication if not necessary
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> scsi: snic: Fix memory leak with using debugfs_lookup()
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> pinctrl: at91: use devm_kasprintf() to avoid potential leaks
>
> Robin Murphy <robin.murphy@arm.com>
> hwmon: (coretemp) Simplify platform device handling
>
> Andreas Gruenbacher <agruenba@redhat.com>
> gfs2: Improve gfs2_make_fs_rw error handling
>
> Kees Cook <keescook@chromium.org>
> regulator: s5m8767: Bounds check id indexing into arrays
>
> Kees Cook <keescook@chromium.org>
> regulator: max77802: Bounds check regulator id against opmode
>
> Kees Cook <keescook@chromium.org>
> ASoC: kirkwood: Iterate over array indexes instead of using pointer math
>
> 강신형 <s47.kang@samsung.com>
> ASoC: soc-compress: Reposition and add pcm_mutex
>
> Jakob Koschel <jkl820.git@gmail.com>
> docs/scripts/gdb: add necessary make scripts_gdb step
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> drm/msm/dsi: Add missing check for alloc_ordered_workqueue
>
> Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
> drm: amd: display: Fix memory leakage
>
> Thomas Zimmermann <tzimmermann@suse.de>
> Revert "fbcon: don't lose the console font across generic->chip driver switch"
>
> Justin Tee <justin.tee@broadcom.com>
> scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write
>
> Liwei Song <liwei.song@windriver.com>
> drm/radeon: free iio for atombios when driver shutdown
>
> Carlo Caione <ccaione@baylibre.com>
> drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
>
> Jingyuan Liang <jingyliang@chromium.org>
> HID: Add Mapping for System Microphone Mute
>
> Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> drm/omap: dsi: Fix excessive stack usage
>
> Roman Li <roman.li@amd.com>
> drm/amd/display: Fix potential null-deref in dm_resume
>
> Ian Chen <ian.chen@amd.com>
> drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write
>
> Eric Dumazet <edumazet@google.com>
> scm: add user copy checks to put_cmsg()
>
> Michael Kelley <mikelley@microsoft.com>
> hv_netvsc: Check status in SEND_RNDIS_PKT completion message
>
> Moises Cardona <moisesmcardona@gmail.com>
> Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> PM: EM: fix memory leak with using debugfs_lookup()
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> PM: domains: fix memory leak with using debugfs_lookup()
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> time/debug: Fix memory leak with using debugfs_lookup()
>
> Heiko Carstens <hca@linux.ibm.com>
> s390/idle: mark arch_cpu_idle() noinstr
>
> Kees Cook <keescook@chromium.org>
> uaccess: Add minimum bounds check on kernel buffer size
>
> Kees Cook <keescook@chromium.org>
> coda: Avoid partial allocation of sig_inputArgs
>
> Shay Drory <shayd@nvidia.com>
> net/mlx5: fw_tracer: Fix debug print
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI: video: Fix Lenovo Ideapad Z570 DMI match
>
> Lorenzo Bianconi <lorenzo@kernel.org>
> wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
>
> Zhang Rui <rui.zhang@intel.com>
> tools/power/x86/intel-speed-select: Add Emerald Rapid quirk
>
> Alok Tiwari <alok.a.tiwari@oracle.com>
> netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj()
>
> Michael Schmitz <schmitzmic@gmail.com>
> m68k: Check syscall_trace_enter() return code
>
> Florian Fainelli <f.fainelli@gmail.com>
> net: bcmgenet: Add a check for oversized packets
>
> Kees Cook <keescook@chromium.org>
> crypto: hisilicon: Wipe entire pool on error
>
> Feng Tang <feng.tang@intel.com>
> clocksource: Suspend the watchdog temporarily when high read latency detected
>
> Tim Zimmermann <tim@linux4.de>
> thermal: intel: intel_pch: Add support for Wellsburg PCH
>
> Mark Rutland <mark.rutland@arm.com>
> ACPI: Don't build ACPICA with '-Os'
>
> Jesse Brandeburg <jesse.brandeburg@intel.com>
> ice: add missing checks for PF vsi type
>
> Siddaraju DH <siddaraju.dh@intel.com>
> ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> inet: fix fast path in __inet_hash_connect()
>
> Jisoo Jang <jisoo.jang@yonsei.ac.kr>
> wifi: mt7601u: fix an integer underflow
>
> Jisoo Jang <jisoo.jang@yonsei.ac.kr>
> wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
>
> Breno Leitao <leitao@debian.org>
> x86/bugs: Reset speculation control settings on init
>
> Jann Horn <jannh@google.com>
> timers: Prevent union confusion from unexpected restart_syscall()
>
> Yang Li <yang.lee@linux.alibaba.com>
> thermal: intel: Fix unsigned comparison with less than zero
>
> Kalle Valo <quic_kvalo@quicinc.com>
> wifi: ath11k: debugfs: fix to work with multiple PCI devices
>
> Zqiang <qiang1.zhang@intel.com>
> rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
>
> Paul E. McKenney <paulmck@kernel.org>
> rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
>
> Paul E. McKenney <paulmck@kernel.org>
> rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
>
> Jisoo Jang <jisoo.jang@yonsei.ac.kr>
> wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
>
> Minsuk Kang <linuxlovemin@yonsei.ac.kr>
> wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> trace/blktrace: fix memory leak with using debugfs_lookup()
>
> Li Nan <linan122@huawei.com>
> blk-iocost: fix divide by 0 error in calc_lcoefs()
>
> Markuss Broks <markuss.broks@gmail.com>
> ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
>
> Jan Kara <jack@suse.cz>
> udf: Define EFSCORRUPTED error code
>
> Bjorn Andersson <quic_bjorande@quicinc.com>
> rpmsg: glink: Avoid infinite loop on intent for missing channel
>
> Tasos Sahanidis <tasos@tasossah.com>
> media: saa7134: Use video_unregister_device for radio_dev
>
> Duoming Zhou <duoming@zju.edu.cn>
> media: usb: siano: Fix use after free bugs caused by do_submit_urb
>
> Hans Verkuil <hverkuil-cisco@xs4all.nl>
> media: i2c: ov7670: 0 instead of -EINVAL was returned
>
> Duoming Zhou <duoming@zju.edu.cn>
> media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
>
> Ming Qian <ming.qian@nxp.com>
> media: imx-jpeg: Apply clk_bulk api instead of operating specific clk
>
> Ming Qian <ming.qian@nxp.com>
> media: v4l2-jpeg: ignore the unknown APP14 marker
>
> Ming Qian <ming.qian@nxp.com>
> media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
>
> Jai Luthra <j-luthra@ti.com>
> media: i2c: imx219: Fix binning for RAW8 capture
>
> Adam Ford <aford173@gmail.com>
> media: i2c: imx219: Split common registers from mode tables
>
> Yuan Can <yuancan@huawei.com>
> media: i2c: ov772x: Fix memleak in ov772x_probe()
>
> Shang XiaoJing <shangxiaojing@huawei.com>
> media: ov5675: Fix memleak in ov5675_init_controls()
>
> Shang XiaoJing <shangxiaojing@huawei.com>
> media: ov2740: Fix memleak in ov2740_init_controls()
>
> Shang XiaoJing <shangxiaojing@huawei.com>
> media: max9286: Fix memleak in max9286_v4l2_register()
>
> Bastian Germann <bage@linutronix.de>
> builddeb: clean generated package content
>
> Nathan Chancellor <nathan@kernel.org>
> s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64
>
> Masahiro Yamada <masahiroy@kernel.org>
> s390/vdso: remove -nostdlib compiler flag
>
> Nathan Chancellor <nathan@kernel.org>
> powerpc: Remove linker flag from KBUILD_AFLAGS
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> media: platform: ti: Add missing check for devm_regulator_get
>
> Gaosheng Cui <cuigaosheng1@huawei.com>
> media: ti: cal: fix possible memory leak in cal_ctx_create()
>
> Sibi Sankar <quic_sibis@quicinc.com>
> remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
>
> Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
> IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
>
> Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
> IB/hfi1: Fix math bugs in hfi1_can_pin_pages()
>
> Tina Zhang <tina.zhang@intel.com>
> iommu/vt-d: Allow to use flush-queue when first level is default
>
> Lu Baolu <baolu.lu@linux.intel.com>
> iommu/vt-d: Use second level for GPA->HPA translation
>
> Lu Baolu <baolu.lu@linux.intel.com>
> iommu/vt-d: Check FL and SL capability sanity in scalable mode
>
> Lu Baolu <baolu.lu@linux.intel.com>
> iommu/vt-d: Remove duplicate identity domain flag
>
> Lu Baolu <baolu.lu@linux.intel.com>
> iommu/vt-d: Fix error handling in sva enable/disable paths
>
> Kees Cook <keescook@chromium.org>
> dmaengine: dw-axi-dmac: Do not dereference NULL structure
>
> Shravan Chippa <shravan.chippa@microchip.com>
> dmaengine: sf-pdma: pdma_desc memory leak fix
>
> Jason Gunthorpe <jgg@ziepe.ca>
> iommu: Fix error unwind in iommu_group_alloc()
>
> Dan Carpenter <error27@gmail.com>
> iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()
>
> Neill Kapron <nkapron@google.com>
> phy: rockchip-typec: fix tcphy_get_mode error case
>
> Serge Semin <Sergey.Semin@baikalelectronics.ru>
> dmaengine: dw-edma: Fix readq_ch() return value truncation
>
> Saravana Kannan <saravanak@google.com>
> driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
>
> Peng Fan <peng.fan@nxp.com>
> tty: serial: imx: disable Ageing Timer interrupt request irq
>
> Marek Vasut <marex@denx.de>
> tty: serial: imx: Handle RS485 DE signal active high
>
> Shenwei Wang <shenwei.wang@nxp.com>
> serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
>
> Mustafa Ismail <mustafa.ismail@intel.com>
> RDMA/irdma: Cap MSIX used to online CPUs + 1
>
> Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
> usb: max-3421: Fix setting of I/O pins
>
> Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()
>
> Andreas Kemnade <andreas@kemnade.info>
> power: supply: remove faulty cooling logic
>
> Lu Baolu <baolu.lu@linux.intel.com>
> iommu/vt-d: Set No Execute Enable bit in PASID table entry
>
> Udipto Goswami <quic_ugoswami@quicinc.com>
> usb: gadget: configfs: Restrict symlink creation is UDC already binded
>
> Jakob Koschel <jakobkoschel@gmail.com>
> usb: gadget: configfs: remove using list iterator after loop body as a ptr
>
> Linyu Yuan <quic_linyyuan@quicinc.com>
> usb: gadget: configfs: use to_usb_function_instance() in cfg (un)link func
>
> Linyu Yuan <quic_linyyuan@quicinc.com>
> usb: gadget: configfs: use to_config_usb_cfg() in os_desc_link()
>
> Dan Carpenter <error27@gmail.com>
> usb: musb: mediatek: don't unregister something that wasn't registered
>
> Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> RDMA/cxgb4: add null-ptr-check after ip_dev_find()
>
> Sherry Sun <sherry.sun@nxp.com>
> tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> usb: early: xhci-dbc: Fix a potential out-of-bound memory access
>
> Serge Semin <Sergey.Semin@baikalelectronics.ru>
> dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers
>
> Fabian Vogt <fabian@ritter-vogt.de>
> fotg210-udc: Add missing completion handler
>
> Chen Zhongjin <chenzhongjin@huawei.com>
> firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
>
> Yang Yingliang <yangyingliang@huawei.com>
> drivers: base: transport_class: fix resource leak when transport_add_device() fails
>
> Yang Yingliang <yangyingliang@huawei.com>
> drivers: base: transport_class: fix possible memory leak
>
> Zhengchao Shao <shaozhengchao@huawei.com>
> driver core: fix resource leak in device_add()
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> misc/mei/hdcp: Use correct macros to initialize uuid_le
>
> George Kennedy <george.kennedy@oracle.com>
> VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
>
> Yang Yingliang <yangyingliang@huawei.com>
> firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe()
>
> Xiongfeng Wang <wangxiongfeng2@huawei.com>
> applicom: Fix PCI device refcount leak in applicom_init()
>
> Yuan Can <yuancan@huawei.com>
> eeprom: idt_89hpesx: Fix error handling in idt_init()
>
> Duoming Zhou <duoming@zju.edu.cn>
> Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol"
>
> Yi Yang <yiyang13@huawei.com>
> serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init()
>
> Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> tty: serial: qcom-geni-serial: stop operations in progress at shutdown
>
> Sherry Sun <sherry.sun@nxp.com>
> tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown()
>
> Sherry Sun <sherry.sun@nxp.com>
> tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown()
>
> Bjorn Helgaas <bhelgaas@google.com>
> PCI: switchtec: Return -EFAULT for copy_to_user() errors
>
> Alexey V. Vissarionov <gremlin@altlinux.org>
> PCI/IOV: Enlarge virtfn sysfs name buffer
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count
>
> Heikki Krogerus <heikki.krogerus@linux.intel.com>
> usb: typec: intel_pmc_mux: Use the helper acpi_dev_get_memory_resources()
>
> Heikki Krogerus <heikki.krogerus@linux.intel.com>
> ACPI: resource: Add helper function acpi_dev_get_memory_resources()
>
> Mao Jinlong <quic_jinlmao@quicinc.com>
> coresight: cti: Add PM runtime call in enable_store
>
> James Clark <james.clark@arm.com>
> coresight: cti: Prevent negative values of enable count
>
> Junhao He <hejunhao3@huawei.com>
> coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR
>
> Hans Verkuil <hverkuil-cisco@xs4all.nl>
> media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Check controls flags before accessing them
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Use control names from framework
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Add support for V4L2_CTRL_TYPE_CTRL_CLASS
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: refactor __uvc_ctrl_add_mapping
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Remove s_ctrl and g_ctrl
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Do not check for V4L2_CTRL_WHICH_DEF_VAL
>
> Al Viro <viro@zeniv.linux.org.uk>
> alpha/boot/tools/objstrip: fix the check for ELF header
>
> Wang Hai <wanghai38@huawei.com>
> kobject: Fix slab-out-of-bounds in fill_kobj_path()
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> kobject: modify kobject_get_path() to take a const *
>
> Yang Yingliang <yangyingliang@huawei.com>
> driver core: fix potential null-ptr-deref in device_add()
>
> Richard Fitzgerald <rf@opensource.cirrus.com>
> soundwire: cadence: Don't overflow the command FIFOs
>
> Hanna Hawa <hhhawa@amazon.com>
> i2c: designware: fix i2c_dw_clk_rate() return size to be u32
>
> Gaosheng Cui <cuigaosheng1@huawei.com>
> usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe()
>
> Ferry Toth <ftoth@exalondelft.nl>
> iio: light: tsl2563: Do not hardcode interrupt trigger type
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> dmaengine: HISI_DMA should depend on ARCH_HISI
>
> Fenghua Yu <fenghua.yu@intel.com>
> dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
>
> Qiheng Lin <linqiheng@huawei.com>
> mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
>
> Randy Dunlap <rdunlap@infradead.org>
> mfd: cs5535: Don't build on UML
>
> Arnd Bergmann <arnd@arndb.de>
> objtool: add UACCESS exceptions for __tsan_volatile_read/write
>
> Arnd Bergmann <arnd@arndb.de>
> printf: fix errname.c list
>
> Masami Hiramatsu (Google) <mhiramat@kernel.org>
> selftests/ftrace: Fix bash specific "==" operator
>
> Randy Dunlap <rdunlap@infradead.org>
> sparc: allow PM configs for sparc32 COMPILE_TEST
>
> Yicong Yang <yangyicong@hisilicon.com>
> perf tools: Fix auto-complete on aarch64
>
> Namhyung Kim <namhyung@kernel.org>
> perf intel-pt: Do not try to queue auxtrace data on pipe
>
> Adrian Hunter <adrian.hunter@intel.com>
> perf intel-pt: Add support for emulated ptwrite
>
> Adrian Hunter <adrian.hunter@intel.com>
> perf intel-pt: Add link to the perf wiki's Intel PT page
>
> Adrian Hunter <adrian.hunter@intel.com>
> perf intel-pt: Add documentation for Event Trace and TNT disable
>
> Namhyung Kim <namhyung@kernel.org>
> perf inject: Use perf_data__read() for auxtrace
>
> Miaoqian Lin <linmq006@gmail.com>
> leds: led-core: Fix refcount leak in of_led_get()
>
> Ian Rogers <irogers@google.com>
> perf llvm: Fix inadvertent file creation
>
> Andreas Gruenbacher <agruenba@redhat.com>
> gfs2: jdata writepage fix
>
> Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
> cifs: Fix warning and UAF when destroy the MR list
>
> Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
> cifs: Fix lost destroy smbd connection when MR allocate failed
>
> Benjamin Coddington <bcodding@redhat.com>
> nfsd: fix race to check ls_layouts
>
> Asahi Lina <lina@asahilina.net>
> drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> hid: bigben_probe(): validate report count
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> HID: bigben: use spinlock to safely schedule workers
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> HID: bigben_worker() remove unneeded check on report_field
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> HID: bigben: use spinlock to protect concurrent accesses
>
> Lucas Tanure <lucas.tanure@collabora.com>
> ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
>
> NeilBrown <neilb@suse.de>
> NFS: fix disabling of swap
>
> Benjamin Coddington <bcodding@redhat.com>
> nfs4trace: fix state manager flag printing
>
> NeilBrown <neilb@suse.de>
> NFSv4: keep state manager thread active if swap is enabled
>
> Mike Snitzer <snitzer@kernel.org>
> dm: remove flush_scheduled_work() during local_exit()
>
> Steffen Aschbacher <steffen.aschbacher@stihl.de>
> ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
>
> Vadim Pasternak <vadimp@nvidia.com>
> hwmon: (mlxreg-fan) Return zero speed for broken fan
>
> William Zhang <william.zhang@broadcom.com>
> spi: bcm63xx-hsspi: Fix multi-bit mode setting
>
> William Zhang <william.zhang@broadcom.com>
> spi: bcm63xx-hsspi: Endianness fix for ARM based SoC
>
> Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> ASoC: codecs: lpass: fix incorrect mclk rate
>
> Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> ASoC: codecs: tx-macro: move to individual clks from bulk
>
> Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> ASoC: codecs: rx-macro: move to individual clks from bulk
>
> Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> ASoC: codecs: tx-macro: move clk provider to managed variants
>
> Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
> ASoC: codecs: rx-macro: move clk provider to managed variants
>
> Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
> ASoC: codecs: Change bulk clock voting to optional voting in digital codecs
>
> Dmitry Torokhov <dmitry.torokhov@gmail.com>
> HID: retain initial quirks set up when creating HID devices
>
> Allen Ballway <ballway@chromium.org>
> HID: multitouch: Add quirks for flipped axes
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> scsi: aic94xx: Add missing check for dma_map_single()
>
> Tomas Henzl <thenzl@redhat.com>
> scsi: mpt3sas: Fix a memory leak
>
> Arnd Bergmann <arnd@arndb.de>
> drm/amdgpu: fix enum odm_combine_mode mismatch
>
> Jonathan Cormier <jcormier@criticallink.com>
> hwmon: (ltc2945) Handle error case in ltc2945_value_store
>
> Jerome Brunet <jbrunet@baylibre.com>
> ASoC: dt-bindings: meson: fix gx-card codec node regex
>
> Nathan Chancellor <nathan@kernel.org>
> ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
>
> Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
> ASoC: rsnd: fixup #endif position
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> ASoC: mchp-spdifrx: fix controls that works with completion mechanism
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> ASoC: mchp-spdifrx: fix return value in case completion times out
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> ASoC: mchp-spdifrx: fix controls which rely on rsr register
>
> Arnd Bergmann <arnd@arndb.de>
> spi: dw_bt1: fix MUX_MMIO dependencies
>
> Haibo Chen <haibo.chen@nxp.com>
> gpio: vf610: connect GPIO label to dev name
>
> Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
> ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
>
> Nícolas F. R. A. Prado <nfraprado@collabora.com>
> drm/mediatek: Clean dangling pointer on bind error path
>
> ruanjinjie <ruanjinjie@huawei.com>
> drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
>
> Rob Clark <robdclark@chromium.org>
> drm/mediatek: Drop unbalanced obj unref
>
> Miles Chen <miles.chen@mediatek.com>
> drm/mediatek: Use NULL instead of 0 for NULL pointer
>
> Xinlei Lee <xinlei.lee@mediatek.com>
> drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update()
>
> Mikko Perttunen <mperttunen@nvidia.com>
> drm/tegra: firewall: Check for is_addr_reg existence in IMM check
>
> Mikko Perttunen <mperttunen@nvidia.com>
> gpu: host1x: Don't skip assigning syncpoints to channels
>
> Guodong Liu <Guodong.Liu@mediatek.com>
> pinctrl: mediatek: Initialize variable *buf to zero
>
> Guodong Liu <Guodong.Liu@mediatek.com>
> pinctrl: mediatek: Initialize variable pullen and pullup to zero
>
> Zhiyong Tao <zhiyong.tao@mediatek.com>
> pinctrl: mediatek: fix coding style
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> drm/msm/mdp5: Add check for kzalloc
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> drm/msm/dpu: Add check for pstates
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> drm/msm/dpu: Add check for cstate
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/msm: use strscpy instead of strncpy
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> drm/msm/dsi: Allow 2 CTRLs on v2.5.0
>
> Jagan Teki <jagan@amarulasolutions.com>
> drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
>
> Daniel Mentz <danielmentz@google.com>
> drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/bridge: lt9611: pass a pointer to the of node
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/bridge: lt9611: fix clock calculation
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/bridge: lt9611: fix programming of video modes
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/bridge: lt9611: fix polarity programming
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/bridge: lt9611: fix HPD reenablement
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/bridge: lt9611: fix sleep mode setup
>
> Marijn Suijten <marijn.suijten@somainline.org>
> drm/msm/dpu: Disallow unallocated resources to be returned
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> drm/msm/gem: Add check for kmalloc
>
> Alexey V. Vissarionov <gremlin@altlinux.org>
> ALSA: hda/ca0132: minor fix for allocation size
>
> Akhil P Oommen <quic_akhilpo@quicinc.com>
> drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
>
> Shengjiu Wang <shengjiu.wang@nxp.com>
> ASoC: fsl_sai: initialize is_dsp_mode flag
>
> Mark Brown <broonie@kernel.org>
> ASoC: fsl_sai: Update to modern clocking terminology
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Fix exchange oversubscription for management commands
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Fix exchange oversubscription
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: edif: Fix I/O timeout due to over-subscription
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/msm: clean event_thread->worker in case of an error
>
> Dave Stevenson <dave.stevenson@raspberrypi.com>
> drm/vc4: hdmi: Correct interlaced timings again
>
> Dave Stevenson <dave.stevenson@raspberrypi.com>
> drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
>
> Dave Stevenson <dave.stevenson@raspberrypi.com>
> drm/vc4: hvs: Set AXI panic modes
>
> Miaoqian Lin <linmq006@gmail.com>
> pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
>
> Miaoqian Lin <linmq006@gmail.com>
> pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
>
> Adam Skladowski <a39.skl@gmail.com>
> pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
>
> Armin Wolf <W_Armin@gmx.de>
> hwmon: (ftsteutates) Fix scaling of measurements
>
> Liang He <windhl@126.com>
> gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
>
> Randolph Sapp <rs@ti.com>
> drm: tidss: Fix pixel format definition
>
> Dave Stevenson <dave.stevenson@raspberrypi.com>
> drm/vc4: dpi: Fix format mapping for RGB565
>
> Dave Stevenson <dave.stevenson@raspberrypi.com>
> drm/vc4: dpi: Add option for inverting pixel clock and output enable
>
> Yuan Can <yuancan@huawei.com>
> drm/vkms: Fix null-ptr-deref in vkms_release()
>
> Yuan Can <yuancan@huawei.com>
> drm/vkms: Fix memory leak in vkms_init()
>
> Yuan Can <yuancan@huawei.com>
> drm/bridge: megachips: Fix error handling in i2c_register_driver()
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
>
> Frieder Schrempf <frieder.schrempf@kontron.de>
> drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec
>
> Geert Uytterhoeven <geert@linux-m68k.org>
> drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
>
> Shang XiaoJing <shangxiaojing@huawei.com>
> drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
>
> Jiri Pirko <jiri@nvidia.com>
> sefltests: netdevsim: wait for devlink instance after netns removal
>
> Roxana Nicolescu <roxana.nicolescu@canonical.com>
> selftest: fib_tests: Always cleanup before exit
>
> Doug Berger <opendmb@gmail.com>
> net: bcmgenet: fix MoCA LED control
>
> Shigeru Yoshida <syoshida@redhat.com>
> l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
>
> Jakub Sitnicki <jakub@cloudflare.com>
> selftests/net: Interpret UDP_GRO cmsg data as an int value
>
> Florian Fainelli <f.fainelli@gmail.com>
> irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
>
> Florian Fainelli <f.fainelli@gmail.com>
> irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
>
> Andrii Nakryiko <andrii@kernel.org>
> bpf: Fix global subprog context argument resolution logic
>
> Frank Jungclaus <frank.jungclaus@esd.eu>
> can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
>
> Yongqin Liu <yongqin.liu@linaro.org>
> thermal/drivers/hisi: Drop second sensor hi3660
>
> Shayne Chen <shayne.chen@mediatek.com>
> wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: crypto4xx - Call dma_unmap_page when done
>
> Werner Sembach <wse@tuxedocomputers.com>
> ACPI: resource: Do IRQ override on all TongFang GMxRGxx
>
> Adam Niederer <adam.niederer@gmail.com>
> ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models
>
> Ilya Leoshkevich <iii@linux.ibm.com>
> selftests/bpf: Fix out-of-srctree build
>
> Dan Carpenter <error27@gmail.com>
> wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> wifi: iwl4965: Add missing check for create_singlethread_workqueue()
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> wifi: iwl3945: Add missing check for create_singlethread_workqueue
>
> Conor Dooley <conor.dooley@microchip.com>
> RISC-V: time: initialize hrtimer based broadcast clock event device
>
> Randy Dunlap <rdunlap@infradead.org>
> m68k: /proc/hardware should depend on PROC_FS
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: rsa-pkcs1pad - Use akcipher_request_complete
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
>
> Ilya Leoshkevich <iii@linux.ibm.com>
> libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
>
> Halil Pasic <pasic@linux.ibm.com>
> s390/ap: fix status returned by ap_qact()
>
> Halil Pasic <pasic@linux.ibm.com>
> s390/ap: fix status returned by ap_aqic()
>
> Zhengping Jiang <jiangzp@google.com>
> Bluetooth: hci_qca: get wakeup status from serdev device handle
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: L2CAP: Fix potential user-after-free
>
> Qi Zheng <zhengqi.arch@bytedance.com>
> OPP: fix error checking in opp_migrate_dentry()
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> tap: tap_open(): correctly initialize socket uid
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> tun: tun_chr_open(): correctly initialize socket uid
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> net: add sock_init_data_uid()
>
> Vasily Gorbik <gor@linux.ibm.com>
> s390/vmem: fix empty page tables cleanup under KASAN
>
> Vasily Gorbik <gor@linux.ibm.com>
> s390/mem_detect: fix detect_memory() error handling
>
> Miaoqian Lin <linmq006@gmail.com>
> irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
>
> Miaoqian Lin <linmq006@gmail.com>
> irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
>
> Miaoqian Lin <linmq006@gmail.com>
> irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
>
> Miaoqian Lin <linmq006@gmail.com>
> irqchip: Fix refcount leak in platform_irqchip_probe
>
> Jack Morgenstein <jackm@nvidia.com>
> net/mlx5: Enhance debug print in page allocation failure
>
> Felix Fietkau <nbd@nbd.name>
> mt76: mt7915: fix polling firmware-own status
>
> Tonghao Zhang <tong@infragraf.org>
> bpftool: profile online CPUs instead of possible
>
> Tom Lendacky <thomas.lendacky@amd.com>
> crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
>
> Peter Gonda <pgonda@google.com>
> crypto: ccp - Refactor out sev_fw_alloc()
>
> Hans de Goede <hdegoede@redhat.com>
> leds: led-class: Add missing put_device() to led_put()
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: xts - Handle EBUSY correctly
>
> Ashok Raj <ashok.raj@intel.com>
> x86/microcode: Adjust late loading result reporting message
>
> Ashok Raj <ashok.raj@intel.com>
> x86/microcode: Check CPU capabilities after late microcode update correctly
>
> Ashok Raj <ashok.raj@intel.com>
> x86/microcode: Add a parameter to microcode_check() to store CPU capabilities
>
> Ashok Raj <ashok.raj@intel.com>
> x86/microcode: Print previous version of microcode after reload
>
> Borislav Petkov <bp@suse.de>
> x86/microcode: Default-disable late loading
>
> Borislav Petkov <bp@suse.de>
> x86/microcode: Rip out the OLD_INTERFACE
>
> Peter Zijlstra <peterz@infradead.org>
> x86: Mark stop_this_cpu() __noreturn
>
> Yang Yingliang <yangyingliang@huawei.com>
> powercap: fix possible name leak in powercap_register_zone()
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: seqiv - Handle EBUSY correctly
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: essiv - Handle EBUSY correctly
>
> Koba Ko <koba.taiwan@gmail.com>
> crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
>
> Armin Wolf <W_Armin@gmx.de>
> ACPI: battery: Fix missing NUL-termination with large strings
>
> Shivani Baranwal <quic_shivbara@quicinc.com>
> wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data()
>
> Miaoqian Lin <linmq006@gmail.com>
> wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
>
> Minsuk Kang <linuxlovemin@yonsei.ac.kr>
> wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
>
> Pavel Skripkin <paskripkin@gmail.com>
> ath9k: htc: clean up statistics macros
>
> Wan Jiabing <wanjiabing@vivo.com>
> ath9k: hif_usb: simplify if-if to if-else
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
>
> Alexey Kodanev <aleksei.kodanev@bell-sw.com>
> wifi: orinoco: check return value of hermes_write_wordrec()
>
> Bitterblue Smith <rtl8821cerfe2@gmail.com>
> wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> thermal/drivers/tsens: limit num_sensors to 9 for msm8939
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> thermal/drivers/tsens: fix slope values for msm8939
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> thermal/drivers/tsens: Add compat string for the qcom,msm8960
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> thermal/drivers/tsens: Drop msm8976-specific defines
>
> Daniil Tatianin <d-tatianin@yandex-team.ru>
> ACPICA: nsrepair: handle cases without a return value correctly
>
> David Rientjes <rientjes@google.com>
> crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
>
> Herbert Xu <herbert@gondor.apana.org.au>
> lib/mpi: Fix buffer overrun when SG is too long
>
> Frederic Weisbecker <frederic@kernel.org>
> rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
>
> Frederic Weisbecker <frederic@kernel.org>
> rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
>
> Frederic Weisbecker <frederic@kernel.org>
> rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
>
> Zhen Lei <thunder.leizhen@huawei.com>
> genirq: Fix the return type of kstat_cpu_irqs_sum()
>
> Mario Limonciello <mario.limonciello@amd.com>
> ACPICA: Drop port I/O validation for some regions
>
> Eric Biggers <ebiggers@google.com>
> crypto: x86/ghash - fix unaligned access in ghash_setkey()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
>
> Zhengchao Shao <shaozhengchao@huawei.com>
> wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
>
> Zhang Changzhong <zhangchangzhong@huawei.com>
> wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
>
> Zhang Changzhong <zhangchangzhong@huawei.com>
> wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
>
> Zhengchao Shao <shaozhengchao@huawei.com>
> wifi: ipw2200: fix memory leak in ipw_wdev_init()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
>
> Andrii Nakryiko <andrii@kernel.org>
> libbpf: Fix btf__align_of() by taking into account field offsets
>
> Li Zetao <lizetao1@huawei.com>
> wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
>
> Zhengchao Shao <shaozhengchao@huawei.com>
> wifi: libertas: fix memory leak in lbs_init_adapter()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
>
> Yang Yingliang <yangyingliang@huawei.com>
> wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
>
> Yuan Can <yuancan@huawei.com>
> wifi: rsi: Fix memory leak in rsi_coex_attach()
>
> Martin K. Petersen <martin.petersen@oracle.com>
> block: bio-integrity: Copy flags when bio_integrity_payload is cloned
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> arm64: dts: qcom: pmk8350: Use the correct PON compatible
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> arm64: dts: qcom: pmk8350: Specify PBS register for PON
>
> Denis Kenzior <denkenz@gmail.com>
> KEYS: asymmetric: Fix ECDSA use via keyctl uapi
>
> silviazhao <silviazhao-oc@zhaoxin.com>
> x86/perf/zhaoxin: Add stepping check for ZXC
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> sched/rt: pick_next_rt_entity(): check list_entry
>
> Dietmar Eggemann <dietmar.eggemann@arm.com>
> sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
>
> Qiheng Lin <linqiheng@huawei.com>
> s390/dasd: Fix potential memleak in dasd_eckd_init()
>
> Jamie Douglass <jamiemdouglass@gmail.com>
> arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions
>
> Kemeng Shi <shikemeng@huaweicloud.com>
> blk-mq: correct stale comment of .get_budget
>
> Kemeng Shi <shikemeng@huaweicloud.com>
> blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
>
> Kemeng Shi <shikemeng@huaweicloud.com>
> blk-mq: avoid sleep in blk_mq_alloc_request_hctx
>
> AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
> arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
>
> AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
> arm64: dts: mt8192: Fix CPU map for single-cluster SoC
>
> Peng Fan <peng.fan@nxp.com>
> ARM: dts: imx7s: correct iomuxc gpr mux controller cells
>
> Samuel Holland <samuel@sholland.org>
> ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
>
> Christian Hewitt <christianshewitt@gmail.com>
> arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
>
> Adam Ford <aford173@gmail.com>
> arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
>
> Waiman Long <longman@redhat.com>
> locking/rwsem: Disable preemption in all down_read*() and up_read() code paths
>
> Muchun Song <songmuchun@bytedance.com>
> locking/rwsem: Optimize down_read_trylock() under highly contended case
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
>
> Angus Chen <angus.chen@jaguarmicro.com>
> ARM: imx: Call ida_simple_remove() for ida_simple_get
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
>
> Vaishnav Achath <vaishnav.a@ti.com>
> arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
>
> Arnd Bergmann <arnd@arndb.de>
> ARM: s3c: fix s3c64xx_set_timer_source prototype
>
> Stefan Wahren <stefan.wahren@i2se.com>
> ARM: bcm2835_defconfig: Enable the framebuffer
>
> Yang Yingliang <yangyingliang@huawei.com>
> ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
>
> Christian Hewitt <christianshewitt@gmail.com>
> arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
>
> Robert Marko <robimarko@gmail.com>
> arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
>
> Robert Marko <robimarko@gmail.com>
> arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
>
> Robert Marko <robimarko@gmail.com>
> arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
>
> Robert Marko <robimarko@gmail.com>
> arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
>
> Johan Hovold <johan+linaro@kernel.org>
> arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size
>
> Shawn Guo <shawn.guo@linaro.org>
> arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes
>
> Robert Marko <robimarko@gmail.com>
> arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
>
> Petr Vorel <petr.vorel@gmail.com>
> arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem
>
> Petr Vorel <petr.vorel@gmail.com>
> arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size
>
> Dominik Kobinski <dominikkobinski314@gmail.com>
> arm64: dts: msm8992-bullhead: add memory hole region
>
> Martin Blumenstingl <martin.blumenstingl@googlemail.com>
> arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
>
> Martin Blumenstingl <martin.blumenstingl@googlemail.com>
> arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
>
> Martin Blumenstingl <martin.blumenstingl@googlemail.com>
> arm64: dts: meson-gx: Fix Ethernet MAC address unit name
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sc7280: correct SPMI bus address cells
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sc7180: correct SPMI bus address cells
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
>
> Chen-Yu Tsai <wenst@chromium.org>
> arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
>
> Qiheng Lin <linqiheng@huawei.com>
> ARM: zynq: Fix refcount leak in zynq_early_slcr_init
>
> Marek Vasut <marex@denx.de>
> arm64: dts: imx8m: Align SoC unique ID node unit address
>
> Marijn Suijten <marijn.suijten@somainline.org>
> arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings
>
> Marijn Suijten <marijn.suijten@somainline.org>
> arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> arm64: dts: qcom: qcs404: use symbol names for PCIe resets
>
> Chen Hui <judy.chenhui@huawei.com>
> ARM: OMAP2+: Fix memory leak in realtime_counter_init()
>
> Anders Roxell <anders.roxell@linaro.org>
> powerpc/mm: Rearrange if-else block to avoid clang warning
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> HID: asus: use spinlock to safely schedule workers
>
> Pietro Borrello <borrello@diag.uniroma1.it>
> HID: asus: use spinlock to protect concurrent accesses
>
>
> -------------
>
> Diffstat:
>
> Documentation/admin-guide/cgroup-v1/memory.rst | 13 +-
> Documentation/admin-guide/hw-vuln/spectre.rst | 21 +-
> Documentation/admin-guide/kdump/gdbmacros.txt | 2 +-
> Documentation/dev-tools/gdb-kernel-debugging.rst | 4 +
> .../bindings/sound/amlogic,gx-sound-card.yaml | 2 +-
> Documentation/hwmon/ftsteutates.rst | 4 +
> Documentation/virt/kvm/api.rst | 18 +-
> Documentation/virt/kvm/devices/vm.rst | 4 +
> Makefile | 4 +-
> arch/alpha/boot/tools/objstrip.c | 2 +-
> arch/alpha/kernel/traps.c | 30 +-
> arch/arm/boot/dts/exynos3250-rinato.dts | 2 +-
> arch/arm/boot/dts/exynos4-cpu-thermal.dtsi | 2 +-
> arch/arm/boot/dts/exynos4.dtsi | 2 +-
> arch/arm/boot/dts/exynos4210.dtsi | 1 -
> arch/arm/boot/dts/exynos5250.dtsi | 2 +-
> arch/arm/boot/dts/exynos5410-odroidxu.dts | 1 -
> arch/arm/boot/dts/exynos5420.dtsi | 2 +-
> arch/arm/boot/dts/exynos5422-odroidhc1.dts | 10 +-
> arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi | 10 +-
> arch/arm/boot/dts/imx7s.dtsi | 2 +-
> arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +-
> arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts | 2 +-
> arch/arm/configs/bcm2835_defconfig | 1 +
> arch/arm/mach-imx/mmdc.c | 24 +-
> arch/arm/mach-omap1/timer.c | 2 +-
> arch/arm/mach-omap2/timer.c | 1 +
> arch/arm/mach-s3c/s3c64xx.c | 3 +-
> arch/arm/mach-zynq/slcr.c | 1 +
> arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 4 +-
> arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +-
> arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 --
> .../boot/dts/amlogic/meson-gx-libretech-pc.dtsi | 2 +-
> arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +-
> arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 2 +-
> .../dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +-
> .../boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts | 1 -
> arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +-
> .../boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 6 +-
> .../boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 10 +-
> arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +-
> arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +-
> arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +-
> arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +-
> arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 +
> arch/arm64/boot/dts/mediatek/mt8183.dtsi | 12 +-
> arch/arm64/boot/dts/mediatek/mt8192.dtsi | 11 +-
> arch/arm64/boot/dts/qcom/ipq8074.dtsi | 93 ++++--
> .../boot/dts/qcom/msm8992-bullhead-rev-101.dts | 18 +-
> .../boot/dts/qcom/msm8996-sony-xperia-tone.dtsi | 5 +-
> arch/arm64/boot/dts/qcom/pmk8350.dtsi | 5 +-
> arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 +-
> arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 +-
> arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 +-
> arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +-
> arch/arm64/boot/dts/qcom/sm6125.dtsi | 6 +-
> .../boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 7 +-
> .../boot/dts/renesas/beacon-renesom-baseboard.dtsi | 24 +-
> .../boot/dts/ti/k3-j7200-common-proc-board.dts | 2 +-
> arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 29 +-
> arch/m68k/68000/entry.S | 2 +
> arch/m68k/Kconfig.devices | 1 +
> arch/m68k/coldfire/entry.S | 2 +
> arch/m68k/kernel/entry.S | 3 +
> arch/mips/boot/dts/ingenic/ci20.dts | 2 +-
> arch/mips/include/asm/syscall.h | 2 +-
> arch/powerpc/Makefile | 2 +-
> arch/powerpc/mm/book3s64/radix_tlb.c | 11 +-
> arch/riscv/Makefile | 6 +-
> arch/riscv/include/asm/ftrace.h | 50 ++-
> arch/riscv/include/asm/jump_label.h | 2 +
> arch/riscv/include/asm/pgtable.h | 2 +-
> arch/riscv/include/asm/thread_info.h | 1 +
> arch/riscv/kernel/ftrace.c | 65 ++--
> arch/riscv/kernel/mcount-dyn.S | 42 +--
> arch/riscv/kernel/time.c | 3 +
> arch/riscv/mm/fault.c | 10 +-
> arch/s390/boot/mem_detect.c | 2 +-
> arch/s390/include/asm/ap.h | 12 +-
> arch/s390/kernel/idle.c | 2 +-
> arch/s390/kernel/kprobes.c | 4 +-
> arch/s390/kernel/vdso32/Makefile | 2 +-
> arch/s390/kernel/vdso64/Makefile | 4 +-
> arch/s390/kernel/vmlinux.lds.S | 1 +
> arch/s390/kvm/kvm-s390.c | 17 +
> arch/s390/mm/extmem.c | 12 +-
> arch/s390/mm/vmem.c | 6 +-
> arch/sparc/Kconfig | 2 +-
> arch/x86/Kconfig | 15 +-
> arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +-
> arch/x86/events/zhaoxin/core.c | 8 +-
> arch/x86/include/asm/microcode.h | 4 +-
> arch/x86/include/asm/microcode_amd.h | 4 +-
> arch/x86/include/asm/msr-index.h | 4 +
> arch/x86/include/asm/processor.h | 5 +-
> arch/x86/include/asm/reboot.h | 2 +
> arch/x86/include/asm/virtext.h | 16 +-
> arch/x86/kernel/cpu/bugs.c | 35 ++-
> arch/x86/kernel/cpu/common.c | 47 ++-
> arch/x86/kernel/cpu/microcode/amd.c | 53 ++--
> arch/x86/kernel/cpu/microcode/core.c | 134 ++------
> arch/x86/kernel/crash.c | 17 +-
> arch/x86/kernel/kprobes/opt.c | 6 +-
> arch/x86/kernel/process.c | 2 +-
> arch/x86/kernel/reboot.c | 88 ++++--
> arch/x86/kernel/smp.c | 6 +-
> arch/x86/kvm/lapic.c | 10 +-
> arch/x86/kvm/svm/sev.c | 4 +-
> arch/x86/kvm/svm/svm_onhyperv.h | 4 +-
> block/bio-integrity.c | 1 +
> block/blk-iocost.c | 11 +-
> block/blk-mq-sched.c | 7 +-
> block/blk-mq.c | 3 +-
> block/fops.c | 21 +-
> crypto/asymmetric_keys/public_key.c | 24 +-
> crypto/essiv.c | 7 +-
> crypto/rsa-pkcs1pad.c | 34 +-
> crypto/seqiv.c | 2 +-
> crypto/xts.c | 8 +-
> drivers/acpi/acpica/Makefile | 2 +-
> drivers/acpi/acpica/hwvalid.c | 7 +-
> drivers/acpi/acpica/nsrepair.c | 12 +-
> drivers/acpi/battery.c | 2 +-
> drivers/acpi/resource.c | 43 ++-
> drivers/acpi/video_detect.c | 2 +-
> drivers/base/core.c | 31 +-
> drivers/base/power/domain.c | 5 +-
> drivers/base/transport_class.c | 17 +-
> drivers/block/brd.c | 26 +-
> drivers/block/rbd.c | 20 +-
> drivers/bluetooth/btusb.c | 4 +
> drivers/bluetooth/hci_qca.c | 7 +-
> drivers/char/applicom.c | 5 +-
> drivers/char/ipmi/ipmi_ssif.c | 74 ++---
> drivers/char/pcmcia/cm4000_cs.c | 6 +-
> drivers/crypto/amcc/crypto4xx_core.c | 10 +-
> drivers/crypto/ccp/ccp-dmaengine.c | 21 +-
> drivers/crypto/ccp/sev-dev.c | 33 +-
> drivers/crypto/hisilicon/sgl.c | 3 +-
> drivers/crypto/qat/qat_common/qat_algs.c | 2 +-
> drivers/dax/bus.c | 2 +-
> drivers/dax/kmem.c | 4 +-
> drivers/dma/Kconfig | 2 +-
> drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 -
> drivers/dma/dw-edma/dw-edma-core.c | 4 +
> drivers/dma/dw-edma/dw-edma-v0-core.c | 2 +-
> drivers/dma/idxd/device.c | 2 +-
> drivers/dma/idxd/init.c | 2 +-
> drivers/dma/idxd/sysfs.c | 4 +-
> drivers/dma/sf-pdma/sf-pdma.c | 3 +-
> drivers/dma/sf-pdma/sf-pdma.h | 1 -
> drivers/firmware/dmi-sysfs.c | 10 +-
> drivers/firmware/google/framebuffer-coreboot.c | 4 +-
> drivers/firmware/stratix10-svc.c | 16 +-
> drivers/gpio/gpio-vf610.c | 2 +-
> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +-
> drivers/gpu/drm/amd/display/dc/core/dc.c | 1 +
> drivers/gpu/drm/amd/display/dc/core/dc_link.c | 6 -
> drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 14 +-
> drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 1 -
> .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 8 +-
> .../display/dc/dml/dcn20/display_mode_vba_20v2.c | 10 +-
> .../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 12 +-
> drivers/gpu/drm/bridge/lontium-lt9611.c | 65 ++--
> .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +-
> drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 +
> drivers/gpu/drm/drm_edid.c | 21 +-
> drivers/gpu/drm/drm_fourcc.c | 4 +
> drivers/gpu/drm/drm_gem_shmem_helper.c | 52 ++--
> drivers/gpu/drm/drm_mipi_dsi.c | 52 ++++
> drivers/gpu/drm/drm_mode_config.c | 8 +-
> drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 +
> drivers/gpu/drm/exynos/exynos_drm_dsi.c | 8 +-
> drivers/gpu/drm/i915/display/intel_quirks.c | 2 +
> drivers/gpu/drm/i915/gt/intel_ring.c | 4 +-
> drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 +
> drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
> drivers/gpu/drm/mediatek/mtk_drm_gem.c | 4 +-
> drivers/gpu/drm/mediatek/mtk_dsi.c | 2 +-
> drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 +-
> drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 7 +-
> drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 15 +-
> drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 5 +
> drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 +-
> drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 +-
> drivers/gpu/drm/msm/dsi/dsi_host.c | 3 +
> drivers/gpu/drm/msm/hdmi/hdmi.c | 4 +
> drivers/gpu/drm/msm/msm_drv.c | 2 +-
> drivers/gpu/drm/msm/msm_fence.c | 2 +-
> drivers/gpu/drm/msm/msm_gem_submit.c | 4 +
> drivers/gpu/drm/mxsfb/Kconfig | 1 +
> drivers/gpu/drm/omapdrm/dss/dsi.c | 26 +-
> drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c | 4 +-
> drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c | 3 +-
> drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 -
> drivers/gpu/drm/radeon/atombios_encoders.c | 5 +-
> drivers/gpu/drm/radeon/radeon_device.c | 1 +
> drivers/gpu/drm/tegra/firewall.c | 3 +
> drivers/gpu/drm/tidss/tidss_dispc.c | 4 +-
> drivers/gpu/drm/tiny/ili9486.c | 13 +-
> drivers/gpu/drm/vc4/vc4_dpi.c | 66 ++--
> drivers/gpu/drm/vc4/vc4_hdmi.c | 5 +-
> drivers/gpu/drm/vc4/vc4_hvs.c | 11 +
> drivers/gpu/drm/vc4/vc4_plane.c | 2 +
> drivers/gpu/drm/vc4/vc4_regs.h | 6 +
> drivers/gpu/drm/vkms/vkms_drv.c | 10 +-
> drivers/gpu/host1x/hw/syncpt_hw.c | 3 -
> drivers/gpu/ipu-v3/ipu-common.c | 1 +
> drivers/hid/hid-asus.c | 37 ++-
> drivers/hid/hid-bigbenff.c | 75 ++++-
> drivers/hid/hid-debug.c | 1 +
> drivers/hid/hid-input.c | 8 +
> drivers/hid/hid-logitech-hidpp.c | 32 +-
> drivers/hid/hid-multitouch.c | 39 ++-
> drivers/hid/hid-quirks.c | 2 +-
> drivers/hid/i2c-hid/i2c-hid-core.c | 6 +-
> drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 42 +++
> drivers/hid/i2c-hid/i2c-hid.h | 3 +
> drivers/hwmon/coretemp.c | 128 ++++----
> drivers/hwmon/ftsteutates.c | 19 +-
> drivers/hwmon/ltc2945.c | 2 +
> drivers/hwmon/mlxreg-fan.c | 6 +
> drivers/hwtracing/coresight/coresight-cti-core.c | 11 +-
> drivers/hwtracing/coresight/coresight-cti-sysfs.c | 13 +-
> drivers/hwtracing/coresight/coresight-etm4x-core.c | 18 +-
> drivers/i2c/busses/i2c-designware-common.c | 2 +-
> drivers/i2c/busses/i2c-designware-core.h | 2 +-
> drivers/iio/light/tsl2563.c | 8 +-
> drivers/infiniband/hw/cxgb4/cm.c | 7 +
> drivers/infiniband/hw/cxgb4/restrack.c | 2 +-
> drivers/infiniband/hw/hfi1/sdma.c | 4 +-
> drivers/infiniband/hw/hfi1/sdma.h | 15 +-
> drivers/infiniband/hw/hfi1/user_pages.c | 61 ++--
> drivers/infiniband/hw/irdma/hw.c | 2 +
> drivers/infiniband/sw/siw/siw_mem.c | 23 +-
> drivers/iommu/intel/cap_audit.c | 13 +
> drivers/iommu/intel/cap_audit.h | 1 +
> drivers/iommu/intel/iommu.c | 50 ++-
> drivers/iommu/intel/pasid.c | 11 +
> drivers/iommu/iommu.c | 8 +-
> drivers/irqchip/irq-alpine-msi.c | 1 +
> drivers/irqchip/irq-bcm7120-l2.c | 3 +-
> drivers/irqchip/irq-brcmstb-l2.c | 6 +-
> drivers/irqchip/irq-mvebu-gicp.c | 1 +
> drivers/irqchip/irq-ti-sci-intr.c | 1 +
> drivers/irqchip/irqchip.c | 8 +-
> drivers/leds/led-class.c | 6 +-
> drivers/md/dm-cache-target.c | 4 +
> drivers/md/dm-flakey.c | 31 +-
> drivers/md/dm-ioctl.c | 13 +-
> drivers/md/dm-thin.c | 2 +
> drivers/md/dm.c | 29 +-
> drivers/md/dm.h | 2 +-
> drivers/media/i2c/imx219.c | 255 +++++++--------
> drivers/media/i2c/max9286.c | 1 +
> drivers/media/i2c/ov2740.c | 4 +-
> drivers/media/i2c/ov5675.c | 4 +-
> drivers/media/i2c/ov7670.c | 2 +-
> drivers/media/i2c/ov772x.c | 3 +-
> drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 3 +
> drivers/media/pci/saa7134/saa7134-core.c | 2 +-
> drivers/media/platform/imx-jpeg/mxc-jpeg.c | 35 +--
> drivers/media/platform/imx-jpeg/mxc-jpeg.h | 4 +-
> drivers/media/platform/omap3isp/isp.c | 9 +
> drivers/media/platform/ti-vpe/cal.c | 4 +-
> drivers/media/rc/ene_ir.c | 3 +-
> drivers/media/usb/siano/smsusb.c | 1 +
> drivers/media/usb/uvc/uvc_ctrl.c | 250 ++++++++++++---
> drivers/media/usb/uvc/uvc_driver.c | 8 +-
> drivers/media/usb/uvc/uvc_v4l2.c | 90 ++----
> drivers/media/usb/uvc/uvcvideo.h | 6 +-
> drivers/media/v4l2-core/v4l2-jpeg.c | 4 +-
> drivers/mfd/Kconfig | 1 +
> drivers/mfd/pcf50633-adc.c | 7 +-
> drivers/misc/eeprom/idt_89hpesx.c | 10 +-
> drivers/misc/mei/hdcp/mei_hdcp.c | 4 +-
> drivers/misc/vmw_vmci/vmci_host.c | 2 +
> drivers/mtd/spi-nor/core.c | 9 +
> drivers/mtd/spi-nor/core.h | 1 +
> drivers/mtd/spi-nor/sfdp.c | 6 +-
> drivers/mtd/spi-nor/spansion.c | 9 +-
> drivers/net/can/usb/esd_usb2.c | 4 +-
> drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 +
> drivers/net/ethernet/broadcom/genet/bcmmii.c | 11 +-
> drivers/net/ethernet/intel/ice/ice_main.c | 17 +-
> drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +-
> .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
> .../net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 +-
> drivers/net/ethernet/qlogic/qede/qede_main.c | 11 +-
> drivers/net/hyperv/netvsc.c | 18 ++
> drivers/net/tap.c | 2 +-
> drivers/net/tun.c | 2 +-
> drivers/net/wireless/ath/ath11k/core.h | 1 -
> drivers/net/wireless/ath/ath11k/debugfs.c | 48 ++-
> drivers/net/wireless/ath/ath11k/dp_rx.c | 1 +
> drivers/net/wireless/ath/ath11k/pci.c | 2 +-
> drivers/net/wireless/ath/ath9k/hif_usb.c | 62 ++--
> drivers/net/wireless/ath/ath9k/htc.h | 32 +-
> drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +
> drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +-
> drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +-
> drivers/net/wireless/ath/ath9k/wmi.c | 1 +
> .../wireless/broadcom/brcm80211/brcmfmac/common.c | 7 +-
> .../wireless/broadcom/brcm80211/brcmfmac/core.c | 1 +
> .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 +-
> drivers/net/wireless/intel/ipw2x00/ipw2200.c | 11 +-
> drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 +-
> drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 +-
> drivers/net/wireless/intel/iwlegacy/common.c | 4 +-
> drivers/net/wireless/intersil/orinoco/hw.c | 2 +
> drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +-
> drivers/net/wireless/marvell/libertas/if_usb.c | 2 +-
> drivers/net/wireless/marvell/libertas/main.c | 3 +-
> drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +-
> drivers/net/wireless/marvell/mwifiex/11n.c | 6 +-
> drivers/net/wireless/mediatek/mt76/dma.c | 13 +-
> drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
> drivers/net/wireless/mediatek/mt76/mt7915/regs.h | 1 +
> drivers/net/wireless/mediatek/mt7601u/dma.c | 3 +-
> drivers/net/wireless/microchip/wilc1000/netdev.c | 1 +
> .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 +
> .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 19 +-
> .../net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 6 +-
> .../net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 +-
> .../net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 6 +-
> .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 ++--
> drivers/net/wireless/rsi/rsi_91x_coex.c | 1 +
> drivers/net/wireless/wl3501_cs.c | 2 +-
> drivers/opp/debugfs.c | 2 +-
> drivers/pci/iov.c | 2 +-
> drivers/pci/pci.c | 2 +-
> drivers/pci/pci.h | 43 +--
> drivers/pci/quirks.c | 1 +
> drivers/pci/switch/switchtec.c | 9 +-
> drivers/phy/rockchip/phy-rockchip-typec.c | 4 +-
> drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 -
> drivers/pinctrl/mediatek/pinctrl-paris.c | 12 +-
> drivers/pinctrl/pinctrl-at91-pio4.c | 4 +-
> drivers/pinctrl/pinctrl-at91.c | 2 +-
> drivers/pinctrl/pinctrl-rockchip.c | 1 +
> drivers/pinctrl/qcom/pinctrl-msm8976.c | 8 +-
> drivers/pinctrl/stm32/pinctrl-stm32.c | 1 +
> drivers/power/supply/power_supply_core.c | 97 ------
> drivers/powercap/powercap_sys.c | 14 +-
> drivers/regulator/max77802-regulator.c | 34 +-
> drivers/regulator/s5m8767.c | 6 +-
> drivers/remoteproc/mtk_scp_ipi.c | 11 +-
> drivers/remoteproc/qcom_q6v5_mss.c | 59 +++-
> drivers/rpmsg/qcom_glink_native.c | 1 +
> drivers/rtc/rtc-pm8xxx.c | 24 +-
> drivers/s390/block/dasd_eckd.c | 4 +-
> drivers/scsi/aic94xx/aic94xx_task.c | 3 +
> drivers/scsi/hosts.c | 2 +
> drivers/scsi/lpfc/lpfc_sli.c | 19 +-
> drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +
> drivers/scsi/qla2xxx/qla_bsg.c | 9 +-
> drivers/scsi/qla2xxx/qla_def.h | 6 +-
> drivers/scsi/qla2xxx/qla_dfs.c | 10 +-
> drivers/scsi/qla2xxx/qla_edif.c | 8 +
> drivers/scsi/qla2xxx/qla_init.c | 14 +-
> drivers/scsi/qla2xxx/qla_inline.h | 55 +++-
> drivers/scsi/qla2xxx/qla_iocb.c | 95 +++++-
> drivers/scsi/qla2xxx/qla_isr.c | 6 +-
> drivers/scsi/qla2xxx/qla_nvme.c | 34 +-
> drivers/scsi/qla2xxx/qla_os.c | 9 +-
> drivers/scsi/ses.c | 64 +++-
> drivers/scsi/snic/snic_debugfs.c | 4 +-
> drivers/soundwire/cadence_master.c | 3 +-
> drivers/spi/Kconfig | 1 -
> drivers/spi/spi-bcm63xx-hsspi.c | 14 +-
> drivers/spi/spi-synquacer.c | 7 +-
> drivers/thermal/hisi_thermal.c | 4 -
> drivers/thermal/intel/intel_pch_thermal.c | 8 +
> drivers/thermal/intel/intel_powerclamp.c | 20 +-
> drivers/thermal/intel/intel_soc_dts_iosf.c | 2 +-
> drivers/thermal/qcom/tsens-v0_1.c | 28 +-
> drivers/thermal/qcom/tsens-v1.c | 61 ++--
> drivers/thermal/qcom/tsens.c | 6 +
> drivers/thermal/qcom/tsens.h | 2 +-
> drivers/tty/serial/fsl_lpuart.c | 19 +-
> drivers/tty/serial/imx.c | 69 ++++-
> drivers/tty/serial/qcom_geni_serial.c | 2 +
> drivers/tty/serial/serial-tegra.c | 7 +-
> drivers/usb/early/xhci-dbc.c | 3 +-
> drivers/usb/gadget/configfs.c | 44 +--
> drivers/usb/gadget/udc/fotg210-udc.c | 16 +
> drivers/usb/gadget/udc/fusb300_udc.c | 10 +-
> drivers/usb/host/max3421-hcd.c | 2 +-
> drivers/usb/musb/mediatek.c | 3 +-
> drivers/usb/typec/mux/intel_pmc_mux.c | 15 +-
> drivers/vfio/vfio_iommu_type1.c | 99 ++++--
> drivers/video/fbdev/core/fbcon.c | 17 +-
> fs/btrfs/discard.c | 41 ++-
> fs/ceph/file.c | 8 +
> fs/cifs/smb2ops.c | 13 +-
> fs/cifs/smbdirect.c | 4 +-
> fs/coda/upcall.c | 2 +-
> fs/dlm/midcomms.c | 45 +--
> fs/exfat/dir.c | 7 +-
> fs/exfat/exfat_fs.h | 2 +-
> fs/exfat/file.c | 3 +-
> fs/exfat/inode.c | 6 +-
> fs/exfat/namei.c | 2 +-
> fs/exfat/super.c | 3 +-
> fs/ext4/namei.c | 11 +-
> fs/ext4/xattr.c | 35 ++-
> fs/f2fs/data.c | 6 +-
> fs/f2fs/inline.c | 13 +-
> fs/fuse/ioctl.c | 6 +
> fs/gfs2/aops.c | 3 +-
> fs/gfs2/super.c | 8 +-
> fs/hfs/bnode.c | 1 +
> fs/hfsplus/super.c | 4 +-
> fs/jbd2/transaction.c | 50 +--
> fs/ksmbd/smb2misc.c | 31 +-
> fs/nfs/file.c | 15 +-
> fs/nfs/nfs4_fs.h | 1 +
> fs/nfs/nfs4proc.c | 22 ++
> fs/nfs/nfs4state.c | 40 ++-
> fs/nfs/nfs4trace.h | 42 +--
> fs/nfsd/nfs4layouts.c | 4 +-
> fs/nfsd/nfs4proc.c | 2 +
> fs/ocfs2/move_extents.c | 34 +-
> fs/udf/file.c | 26 +-
> fs/udf/inode.c | 74 ++---
> fs/udf/super.c | 1 +
> fs/udf/udf_i.h | 3 +-
> fs/udf/udf_sb.h | 2 +
> include/drm/drm_mipi_dsi.h | 4 +
> include/linux/acpi.h | 1 +
> include/linux/device.h | 1 +
> include/linux/hid.h | 1 +
> include/linux/ima.h | 6 +-
> include/linux/intel-iommu.h | 3 -
> include/linux/kernel_stat.h | 2 +-
> include/linux/kobject.h | 2 +-
> include/linux/kprobes.h | 2 +
> include/linux/nfs_xdr.h | 2 +
> include/linux/rcupdate.h | 11 +-
> include/linux/transport_class.h | 8 +-
> include/linux/uaccess.h | 4 +
> include/net/sock.h | 7 +-
> include/sound/soc-dapm.h | 1 +
> io_uring/io_uring.c | 41 ++-
> kernel/bpf/btf.c | 13 +-
> kernel/irq/irqdomain.c | 153 +++++----
> kernel/kprobes.c | 6 +-
> kernel/locking/rwsem.c | 60 ++--
> kernel/pid_namespace.c | 17 +
> kernel/power/energy_model.c | 5 +-
> kernel/rcu/tasks.h | 64 ++--
> kernel/rcu/tree_exp.h | 2 +
> kernel/resource.c | 14 -
> kernel/sched/deadline.c | 5 +-
> kernel/sched/rt.c | 10 +-
> kernel/time/clocksource.c | 45 ++-
> kernel/time/hrtimer.c | 2 +
> kernel/time/posix-stubs.c | 2 +
> kernel/time/posix-timers.c | 2 +
> kernel/time/test_udelay.c | 2 +-
> kernel/trace/blktrace.c | 4 +-
> kernel/trace/ring_buffer.c | 42 +--
> lib/errname.c | 22 +-
> lib/kobject.c | 20 +-
> lib/mpi/mpicoder.c | 3 +-
> mm/huge_memory.c | 3 +
> mm/memcontrol.c | 4 +
> net/bluetooth/l2cap_core.c | 24 --
> net/bluetooth/l2cap_sock.c | 8 +
> net/core/scm.c | 2 +
> net/core/sock.c | 15 +-
> net/ipv4/inet_hashtables.c | 12 +-
> net/l2tp/l2tp_ppp.c | 125 ++++----
> net/mac80211/sta_info.c | 2 +-
> net/netfilter/nf_tables_api.c | 3 +
> net/rds/message.c | 2 +-
> net/sunrpc/clnt.c | 4 +
> net/wireless/nl80211.c | 2 +-
> net/wireless/sme.c | 31 +-
> scripts/package/mkdebian | 2 +-
> security/integrity/ima/ima_main.c | 7 +-
> security/security.c | 7 +-
> sound/pci/hda/patch_ca0132.c | 2 +-
> sound/pci/hda/patch_realtek.c | 1 +
> sound/pci/ice1712/aureon.c | 2 +-
> sound/soc/atmel/mchp-spdifrx.c | 342 ++++++++++++++-------
> sound/soc/codecs/lpass-rx-macro.c | 100 ++++--
> sound/soc/codecs/lpass-tx-macro.c | 104 +++++--
> sound/soc/codecs/lpass-va-macro.c | 2 +-
> sound/soc/codecs/tlv320adcx140.c | 2 +-
> sound/soc/fsl/fsl_sai.c | 35 ++-
> sound/soc/fsl/fsl_sai.h | 2 +-
> sound/soc/kirkwood/kirkwood-dma.c | 2 +-
> sound/soc/sh/rcar/rsnd.h | 4 +-
> sound/soc/soc-compress.c | 11 +-
> tools/bootconfig/scripts/ftrace2bconf.sh | 2 +-
> tools/bpf/bpftool/prog.c | 38 ++-
> tools/lib/bpf/btf.c | 13 +
> tools/lib/bpf/nlattr.c | 2 +-
> tools/objtool/check.c | 3 +
> tools/perf/Documentation/perf-intel-pt.txt | 229 +++++++++++++-
> tools/perf/builtin-inject.c | 6 +-
> tools/perf/perf-completion.sh | 11 +-
> tools/perf/util/auxtrace.c | 3 +
> .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 99 +++++-
> .../perf/util/intel-pt-decoder/intel-pt-decoder.h | 1 +
> .../util/intel-pt-decoder/intel-pt-insn-decoder.c | 1 +
> .../util/intel-pt-decoder/intel-pt-insn-decoder.h | 1 +
> tools/perf/util/intel-pt.c | 43 ++-
> tools/perf/util/llvm-utils.c | 25 +-
> tools/power/x86/intel-speed-select/isst-config.c | 2 +-
> tools/testing/ktest/ktest.pl | 26 +-
> tools/testing/ktest/sample.conf | 5 +
> tools/testing/selftests/bpf/Makefile | 2 -
> .../selftests/drivers/net/netdevsim/devlink.sh | 18 ++
> .../ftrace/test.d/ftrace/func_event_triggers.tc | 2 +-
> tools/testing/selftests/landlock/fs_test.c | 47 +++
> tools/testing/selftests/landlock/ptrace_test.c | 113 ++++++-
> tools/testing/selftests/net/fib_tests.sh | 2 +
> tools/testing/selftests/net/udpgso_bench_rx.c | 6 +-
> virt/kvm/coalesced_mmio.c | 8 +-
> 521 files changed, 5196 insertions(+), 2849 deletions(-)
>
>
^ permalink raw reply [flat|nested] 578+ messages in thread* Re: [PATCH 5.15 000/567] 5.15.99-rc1 review
2023-03-07 20:02 ` [PATCH 5.15 000/567] 5.15.99-rc1 review Harshit Mogalapalli
@ 2023-03-07 20:12 ` Vegard Nossum
2023-03-08 7:19 ` Greg Kroah-Hartman
0 siblings, 1 reply; 578+ messages in thread
From: Vegard Nossum @ 2023-03-07 20:12 UTC (permalink / raw)
To: Harshit Mogalapalli, Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, Darren Kenny, Adrian Hunter, Arnaldo Carvalho de Melo
On 3/7/23 21:02, Harshit Mogalapalli wrote:
> On 07/03/23 10:25 pm, Greg Kroah-Hartman wrote:
>> This is the start of the stable review cycle for the 5.15.99 release.
>> There are 567 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>>
>
> While trying to build 5.15.99-rc1 with
> * make -C tools/perf all
>
> The following build errors are seen.
>
> util/intel-pt-decoder/intel-pt-decoder.c: In function
> 'intel_pt_eptw_lookahead_cb':
> util/intel-pt-decoder/intel-pt-decoder.c:1445:14: error: 'INTEL_PT_CFE'
[...]
>
> [PATCH 5.15 264/567] perf intel-pt: Add support for emulated ptwrite
> is causing this error.
In addition, cherry-picking this fixes the build (but we haven't done a
full test with it):
commit 2750af50a360b52c6df1f5652ae728878bececc0
Author: Adrian Hunter <adrian.hunter@intel.com>
Date: Mon Jan 24 10:41:39 2022 +0200
perf intel-pt: pkt-decoder: Add CFE and EVD packets
Greg: Do you prefer this kind of error report go to the 0/N email (like
in this case) or to the specific problematic patch email if we've
already identified it?
Thanks,
Vegard
^ permalink raw reply [flat|nested] 578+ messages in thread* Re: [PATCH 5.15 000/567] 5.15.99-rc1 review
2023-03-07 20:12 ` Vegard Nossum
@ 2023-03-08 7:19 ` Greg Kroah-Hartman
0 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-08 7:19 UTC (permalink / raw)
To: Vegard Nossum
Cc: Harshit Mogalapalli, stable, patches, linux-kernel, torvalds,
akpm, linux, shuah, patches, lkft-triage, pavel, jonathanh,
f.fainelli, sudipm.mukherjee, srw, rwarsow, Darren Kenny,
Adrian Hunter, Arnaldo Carvalho de Melo
On Tue, Mar 07, 2023 at 09:12:48PM +0100, Vegard Nossum wrote:
>
> On 3/7/23 21:02, Harshit Mogalapalli wrote:
> > On 07/03/23 10:25 pm, Greg Kroah-Hartman wrote:
> > > This is the start of the stable review cycle for the 5.15.99 release.
> > > There are 567 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> >
> > While trying to build 5.15.99-rc1 with
> > * make -C tools/perf all
> >
> > The following build errors are seen.
> >
> > util/intel-pt-decoder/intel-pt-decoder.c: In function
> > 'intel_pt_eptw_lookahead_cb':
> > util/intel-pt-decoder/intel-pt-decoder.c:1445:14: error: 'INTEL_PT_CFE'
> [...]
> >
> > [PATCH 5.15 264/567] perf intel-pt: Add support for emulated ptwrite
> > is causing this error.
>
> In addition, cherry-picking this fixes the build (but we haven't done a
> full test with it):
>
> commit 2750af50a360b52c6df1f5652ae728878bececc0
> Author: Adrian Hunter <adrian.hunter@intel.com>
> Date: Mon Jan 24 10:41:39 2022 +0200
>
> perf intel-pt: pkt-decoder: Add CFE and EVD packets
>
> Greg: Do you prefer this kind of error report go to the 0/N email (like
> in this case) or to the specific problematic patch email if we've
> already identified it?
Either works for me, I'll go queue this up now, thanks!
greg k-h
^ permalink raw reply [flat|nested] 578+ messages in thread
* Re: [PATCH 5.15 000/567] 5.15.99-rc1 review
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2023-03-07 20:02 ` [PATCH 5.15 000/567] 5.15.99-rc1 review Harshit Mogalapalli
@ 2023-03-07 23:06 ` Daniel Díaz
2023-03-08 7:19 ` Greg Kroah-Hartman
2023-03-08 4:19 ` Bagas Sanjaya
2023-03-08 6:24 ` Daniel Díaz
570 siblings, 1 reply; 578+ messages in thread
From: Daniel Díaz @ 2023-03-07 23:06 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow
Hello!
On 07/03/23 10:55, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.99 release.
> There are 567 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 09 Mar 2023 16:57:34 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.99-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
We see Perf failing to compile on: arm, arm64, i386, x86_64, under OpenEmbedded (GCC 11.3) when building for the following machines:
* Dragonboard 410c (arm64)
* Dragonboard 845c (arm64)
* Juno (arm64)
* X15 (arm)
* intel-core2-32 (i386)
* intel-corei7-64 (x86_64)
Error:
-----8<-----
util/intel-pt-decoder/intel-pt-decoder.c: In function 'intel_pt_eptw_lookahead_cb':
util/intel-pt-decoder/intel-pt-decoder.c:1445:7: error: 'INTEL_PT_CFE' undeclared (first use in this function); did you mean 'INTEL_PT_CBR'?
1445 | case INTEL_PT_CFE:
| ^~~~~~~~~~~~
| INTEL_PT_CBR
util/intel-pt-decoder/intel-pt-decoder.c:1445:7: note: each undeclared identifier is reported only once for each function it appears in
util/intel-pt-decoder/intel-pt-decoder.c:1446:7: error: 'INTEL_PT_CFE_IP' undeclared (first use in this function); did you mean 'INTEL_PT_BEP_IP'?
1446 | case INTEL_PT_CFE_IP:
| ^~~~~~~~~~~~~~~
| INTEL_PT_BEP_IP
util/intel-pt-decoder/intel-pt-decoder.c:1447:7: error: 'INTEL_PT_EVD' undeclared (first use in this function); did you mean 'INTEL_PT_OVF'?
1447 | case INTEL_PT_EVD:
| ^~~~~~~~~~~~
| INTEL_PT_OVF
----->8-----
Additionally, we see this same problem outside of OpenEmbedded but only on arm (32-bits), because in all other cases it fails to build at an earlier point with the already reported problem of init_disassemble_info() [1][2], so it's very likely to be there too on all architectures.
[1] https://lore.kernel.org/all/CAEUSe7-vBpHrbEy+eQrNZ_LTeqHpn2eQEr3C7cmfNYjK1YL4Ww@mail.gmail.com/
[2] https://lore.kernel.org/all/e6e2df31-6327-f2ad-3049-0cbfa214ae5c@hauke-m.de/
Greetings!
Daniel Díaz
daniel.diaz@linaro.org
^ permalink raw reply [flat|nested] 578+ messages in thread* Re: [PATCH 5.15 000/567] 5.15.99-rc1 review
2023-03-07 23:06 ` Daniel Díaz
@ 2023-03-08 7:19 ` Greg Kroah-Hartman
0 siblings, 0 replies; 578+ messages in thread
From: Greg Kroah-Hartman @ 2023-03-08 7:19 UTC (permalink / raw)
To: Daniel Díaz
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow
On Tue, Mar 07, 2023 at 05:06:23PM -0600, Daniel Díaz wrote:
> Hello!
>
> On 07/03/23 10:55, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 5.15.99 release.
> > There are 567 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu, 09 Mar 2023 16:57:34 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.99-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> We see Perf failing to compile on: arm, arm64, i386, x86_64, under OpenEmbedded (GCC 11.3) when building for the following machines:
> * Dragonboard 410c (arm64)
> * Dragonboard 845c (arm64)
> * Juno (arm64)
> * X15 (arm)
> * intel-core2-32 (i386)
> * intel-corei7-64 (x86_64)
>
> Error:
> -----8<-----
> util/intel-pt-decoder/intel-pt-decoder.c: In function 'intel_pt_eptw_lookahead_cb':
> util/intel-pt-decoder/intel-pt-decoder.c:1445:7: error: 'INTEL_PT_CFE' undeclared (first use in this function); did you mean 'INTEL_PT_CBR'?
> 1445 | case INTEL_PT_CFE:
> | ^~~~~~~~~~~~
> | INTEL_PT_CBR
> util/intel-pt-decoder/intel-pt-decoder.c:1445:7: note: each undeclared identifier is reported only once for each function it appears in
> util/intel-pt-decoder/intel-pt-decoder.c:1446:7: error: 'INTEL_PT_CFE_IP' undeclared (first use in this function); did you mean 'INTEL_PT_BEP_IP'?
> 1446 | case INTEL_PT_CFE_IP:
> | ^~~~~~~~~~~~~~~
> | INTEL_PT_BEP_IP
> util/intel-pt-decoder/intel-pt-decoder.c:1447:7: error: 'INTEL_PT_EVD' undeclared (first use in this function); did you mean 'INTEL_PT_OVF'?
> 1447 | case INTEL_PT_EVD:
> | ^~~~~~~~~~~~
> | INTEL_PT_OVF
> ----->8-----
Should now be fixed.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 578+ messages in thread
* Re: [PATCH 5.15 000/567] 5.15.99-rc1 review
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2023-03-07 23:06 ` Daniel Díaz
@ 2023-03-08 4:19 ` Bagas Sanjaya
2023-03-08 6:24 ` Daniel Díaz
570 siblings, 0 replies; 578+ messages in thread
From: Bagas Sanjaya @ 2023-03-08 4:19 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow
[-- Attachment #1: Type: text/plain, Size: 539 bytes --]
On Tue, Mar 07, 2023 at 05:55:36PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.99 release.
> There are 567 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
Successfully cross-compiled for arm64 (bcm2711_defconfig, GCC 10.2.0) and
powerpc (ps3_defconfig, GCC 12.2.0).
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
--
An old man doll... just what I always wanted! - Clara
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 578+ messages in thread* Re: [PATCH 5.15 000/567] 5.15.99-rc1 review
2023-03-07 16:55 [PATCH 5.15 000/567] 5.15.99-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2023-03-08 4:19 ` Bagas Sanjaya
@ 2023-03-08 6:24 ` Daniel Díaz
2023-03-12 13:57 ` Linux regression tracking (Thorsten Leemhuis)
570 siblings, 1 reply; 578+ messages in thread
From: Daniel Díaz @ 2023-03-08 6:24 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, peterz, jpoimboe
Hello!
On 07/03/23 10:55, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.99 release.
> There are 567 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 09 Mar 2023 16:57:34 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.99-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
A new warning has been introduced on x86_64; we've seen it with GCC 8, 11, 12, and Clang 16.
arch/x86/kernel/smp.o: warning: objtool: sysvec_reboot()+0x54: unreachable instruction
Bisection pointed towards "x86: Mark stop_this_cpu() __noreturn" (upstream commit f9cdf7ca57cada055f61ef6d0eb4db21c3f200db). Reverting this commit did remove the warning.
Reproducer:
tuxmake \
--runtime podman \
--target-arch x86_64 \
--toolchain gcc-11 \
--kconfig https://storage.tuxsuite.com/public/linaro/lkft/builds/2MhGKYH63pYIllJIDAxH3FsvakK/config
Greetings!
Daniel Díaz
daniel.diaz@linaro.org
^ permalink raw reply [flat|nested] 578+ messages in thread* Re: [PATCH 5.15 000/567] 5.15.99-rc1 review
2023-03-08 6:24 ` Daniel Díaz
@ 2023-03-12 13:57 ` Linux regression tracking (Thorsten Leemhuis)
0 siblings, 0 replies; 578+ messages in thread
From: Linux regression tracking (Thorsten Leemhuis) @ 2023-03-12 13:57 UTC (permalink / raw)
To: Daniel Díaz, Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, peterz, jpoimboe, ray
On 08.03.23 07:24, Daniel Díaz wrote:
>
> On 07/03/23 10:55, Greg Kroah-Hartman wrote:
>> This is the start of the stable review cycle for the 5.15.99 release.
>> There are 567 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>>
>> Responses should be made by Thu, 09 Mar 2023 16:57:34 +0000.
>> Anything received after that time might be too late.
>>
>> The whole patch series can be found in one patch at:
>> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.99-rc1.gz
>> or in the git tree and branch at:
>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
>> and the diffstat can be found below.
>
> A new warning has been introduced on x86_64; we've seen it with GCC 8,
> 11, 12, and Clang 16.
>
> arch/x86/kernel/smp.o: warning: objtool: sysvec_reboot()+0x54:
> unreachable instruction
>
> Bisection pointed towards "x86: Mark stop_this_cpu() __noreturn"
> (upstream commit f9cdf7ca57cada055f61ef6d0eb4db21c3f200db). Reverting
> this commit did remove the warning.
>
> Reproducer:
>
> tuxmake \
> --runtime podman \
> --target-arch x86_64 \
> --toolchain gcc-11 \
> --kconfig
> https://storage.tuxsuite.com/public/linaro/lkft/builds/2MhGKYH63pYIllJIDAxH3FsvakK/config
FWIW, thee is another report about it here:
https://bugzilla.kernel.org/show_bug.cgi?id=217175
CCing the reporter
This is definitely not my area of expertise, so you might better want to
ignore the the following: I did some quick searching and now wonder if
backporting be0075951fde ("x86: Annotate call_on_stack()") might fix the
warning; it already was backported to 5.15 afaics:
https://lore.kernel.org/all/20220412062945.857488242@linuxfoundation.org/
Ciao, Thorsten
^ permalink raw reply [flat|nested] 578+ messages in thread